Data desensitization method, device, storage medium and terminal

Abstract

The present invention discloses a data desensitization method, device, storage medium and terminal, which are applied to a server, and the method includes: when receiving a target data text to be distributed, obtaining multiple fields of the target data text; identifying sensitive fields and non-sensitive fields in the multiple fields, generating a sensitive field set and a non-sensitive field set; desensitizing the data of each sensitive field in the sensitive field set to generate desensitized data; combining the desensitized data with the data of the non-sensitive field, and distributing the combined data to a client. Since the present application automatically desensitizes the sensitive fields existing in the target data text by automatically identifying them on the server, the automatic identification, desensitization and distribution of data are realized, the risk of data leakage caused by data circulation is reduced, and the efficiency of data distribution is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a data desensitization method, device, storage medium and terminal. Background Art

[0002] Sensitive data, also known as private data, commonly includes name, ID number, address, phone number, bank account, email, password, medical information, educational background, etc. This information, which is closely related to personal life and work, is subject to data privacy regulations of different industries and governments. If the company or government responsible for storing and publishing this information cannot guarantee data privacy, it will face serious financial, legal or accountability risks, and suffer huge losses in user trust. In the process of business and daily activities of enterprises and governments, it is inevitable that data will be distributed step by step. And these data often include personal data of citizens. How to distribute data normally under the premise of ensuring that citizens' personal information is not leaked has become a difficult problem in the daily work of governments and enterprises.

[0003] In the existing technical solutions, the current data distribution method involving citizens' personal information mainly adopts the method of manual intervention, that is, before data distribution, it is reviewed by a dedicated data security manager, or a sensitive data identification tool identifies whether the data is sensitive, gives a fuzzification / labeling opinion, and then the functional department performs fuzzification / labeling before distributing the data. The current data distribution has the following defects: it is extremely dependent on manual labor. Due to the particularity of sensitive data, it cannot be directly distributed automatically. It requires manual intervention or sensitive data identification tools to identify, classify and grade the data, and then distribute it manually. It cannot form effective knowledge accumulation and relies on the personal experience of functional personnel. It consumes human resources and lacks efficiency, and the timeliness of data is also affected; it cannot precipitate to form an effective knowledge graph library, which makes it easy to cause interruptions in the review of sensitive data distribution due to personnel changes, reducing the efficiency of data distribution. Summary of the invention

[0004] The embodiments of the present application provide a data desensitization method, device, storage medium and terminal. In order to have a basic understanding of some aspects of the disclosed embodiments, a simple summary is given below. This summary is not a general review, nor is it intended to identify key / important components or describe the scope of protection of these embodiments. Its only purpose is to present some concepts in a simple form as a preface to the detailed description that follows.

[0005] In a first aspect, an embodiment of the present application provides a data desensitization method, which is applied to a server, and the method includes:

[0006] When receiving the target data text to be distributed, obtaining multiple fields of the target data text;

[0007] Identify sensitive fields and non-sensitive fields in multiple fields, and generate a sensitive field set and a non-sensitive field set;

[0008] Desensitizing the data of each sensitive field in the sensitive field set to generate desensitized data;

[0009] Combine the desensitized data with the data in non-sensitive fields, and distribute the combined data to the client.

[0010] Optionally, get multiple fields of the target data text, including:

[0011] Parse the target data text according to the preset key value rules to generate the parsed data text;

[0012] Traverse the parsed data text one by one to obtain the key-value pair set;

[0013] Divide each key-value pair in the key-value pair set into an attribute feature and a value feature, and obtain the attribute feature and the value feature of each key-value pair;

[0014] A plurality of fields of the target data text are determined based on the attribute characteristics and the value characteristics of each key-value pair.

[0015] Optionally, multiple fields of the target data text are determined based on the attribute characteristics and value characteristics of each key-value pair, including:

[0016] Concatenate the attribute features and value features of each key-value pair to obtain multiple concatenated features;

[0017] Convert each concatenated feature into a vector to obtain a vector set;

[0018] Combining each vector in the vector set to generate a term matrix;

[0019] Perform singular value decomposition on the term matrix to obtain multiple semantic indexes;

[0020] The field corresponding to each semantic index in the multiple semantic indexes is queried according to the preset semantic field table to obtain multiple fields of the target data text.

[0021] Optionally, sensitive fields and non-sensitive fields are identified in multiple fields, and a sensitive field set and a non-sensitive field set are generated, including:

[0022] Get the sensitive field type table set for sensitive fields;

[0023] Analyze the data type of each field in multiple fields;

[0024] Map each field one by one according to the sensitive field type table and the data type of each field to determine whether each field is a sensitive field, and mark the sensitive field as 1, and mark the non-sensitive field as 0;

[0025] Count the fields marked as 1 and determine them as a set of sensitive fields;

[0026] The fields marked as 0 are counted and determined as a set of non-sensitive fields.

[0027] Optionally, analyze the data type of each of multiple fields, including:

[0028] Input each of the multiple fields into a pre-trained data type recognition model, and output the data type of each field; wherein,

[0029] Follow these steps to generate a pre-trained data type recognition model, including:

[0030] Use convolutional neural networks to create data type recognition models;

[0031] Get multiple pre-labeled field-type label data;

[0032] Input multiple field-type label data into the data type recognition model for training and output the loss value;

[0033] When the loss value reaches the minimum, a pre-trained data type recognition model is generated.

[0034] Optionally, desensitize the data of each sensitive field in the sensitive field set to generate desensitized data, including:

[0035] Obtain the desensitization rule corresponding to each sensitive field according to the type information of each sensitive field in the sensitive field set;

[0036] Desensitize the data of the corresponding sensitive field according to the desensitization rule corresponding to each sensitive field to obtain desensitized data;

[0037] Desensitized data is generated after desensitizing and copying the desensitized data.

[0038] Optionally, after desensitizing and copying the desensitized data to generate desensitized data, the following steps are also included:

[0039] Delete sensitive field sets and desensitized data.

[0040] In a second aspect, an embodiment of the present application provides a data desensitization device, which is applied to a server, and the device includes:

[0041] A field acquisition module, used for acquiring a plurality of fields of the target data text when receiving the target data text to be distributed;

[0042] A field identification module, used to identify sensitive fields and non-sensitive fields in multiple fields, and generate a sensitive field set and a non-sensitive field set;

[0043] The field desensitization module is used to desensitize the data of each sensitive field in the sensitive field set to generate desensitized data;

[0044] The data distribution module is used to combine the desensitized data with the data of non-sensitive fields and distribute the combined data to the client.

[0045] In a third aspect, an embodiment of the present application provides a computer storage medium, which stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the above-mentioned method steps.

[0046] In a fourth aspect, an embodiment of the present application provides a terminal, which may include: a processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the above-mentioned method steps.

[0047] The technical solution provided by the embodiments of the present application may have the following beneficial effects:

[0048] In an embodiment of the present application, the data desensitization device first obtains multiple fields of the target data text when receiving the target data text to be distributed, then identifies sensitive fields and non-sensitive fields in the multiple fields, generates a sensitive field set and a non-sensitive field set, and then desensitizes the data of each sensitive field in the sensitive field set to generate desensitized data, and finally combines the desensitized data with the data of the non-sensitive field, and distributes the combined data to the client. Since the present application automatically identifies the sensitive fields existing in the target data text on the server side and performs automatic desensitization, it can realize automatic identification, desensitization and distribution of data, reduce the risk of data leakage caused by data circulation, and improve the efficiency of data distribution.

[0049] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0051] Figure 1 It is a flowchart of a data desensitization method provided in an embodiment of the present application;

[0052] Figure 2 This is a flowchart of a data desensitization process provided by this application;

[0053] Figure 3 It is a flowchart of another data desensitization method provided in an embodiment of the present application;

[0054] Figure 4 It is a structural schematic diagram of a data desensitization device provided in an embodiment of the present application;

[0055] Figure 5 It is a structural diagram of a terminal provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] The following description and the drawings sufficiently illustrate specific embodiments of the invention to enable those skilled in the art to practice them.

[0057] It should be clear that the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0058] When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are only examples of devices and methods consistent with some aspects of the present invention as detailed in the attached claims.

[0059] In the description of the present invention, it should be understood that the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. For those of ordinary skill in the art, the specific meanings of the above terms in the present invention can be understood according to specific circumstances. In addition, in the description of the present invention, unless otherwise specified, "plurality" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the previously associated objects are in an "or" relationship.

[0060] The present application provides a data desensitization method, device, storage medium and terminal, which are applied to the server to solve the problems existing in the above-mentioned related technical problems. In the technical solution provided by the present application, since the present application automatically identifies the sensitive fields existing in the target data text on the server side and performs automatic desensitization processing, it can realize automatic identification, desensitization and distribution of data, reduce the risk of data leakage caused by data flow, and improve the efficiency of data distribution. The following is a detailed description using an exemplary embodiment.

[0061] The following will be combined with the attached Figure 1 -Attached Figure 3 , the data desensitization method provided in the embodiment of the present application is introduced in detail. The method can be implemented by a computer program and can be run on a data desensitization device based on the von Neumann system. The computer program can be integrated into an application or run as an independent tool application.

[0062] See also Figure 1 , which is a flow chart of a data desensitization method provided in the embodiment of the present application, and is applied to the server. Figure 1 As shown, the method of the embodiment of the present application may include the following steps:

[0063] S101, when receiving a target data text to be distributed, obtaining multiple fields of the target data text;

[0064] Typically, the data sender refers to the terminal of an organization or individual who intends to share data with another party and has database access rights.

[0065] In one possible implementation, when obtaining multiple fields of a target data text, the target data text is first parsed according to a preset key-value rule to generate a parsed data text, and then the key-value pair set is traversed one by one in the parsed data text, and then each key-value pair in the key-value pair set is divided into attribute features and value features to obtain the attribute features and value features of each key-value pair, and finally, the multiple fields of the target data text are determined based on the attribute features and value features of each key-value pair.

[0066] Specifically, when determining multiple fields of the target data text based on the attribute features and value features of each key-value pair, firstly, the attribute features and value features of each key-value pair are concatenated to obtain multiple concatenated features, and then each concatenated feature is converted into a vector to obtain a vector set, and then the vectors in the vector set are combined to generate a term matrix, and then the term matrix is ​​singular value decomposed to obtain multiple semantic indexes, and finally, the field corresponding to each semantic index in the multiple semantic indexes is queried according to the preset semantic field table to obtain multiple fields of the target data text.

[0067] S102, identifying sensitive fields and non-sensitive fields from multiple fields, and generating a sensitive field set and a non-sensitive field set;

[0068] Among them, sensitive fields are fields that need to be desensitized and involve private data. Non-sensitive fields are fields that do not require encryption and can be directly provided to third parties.

[0069] In one possible implementation, when generating a sensitive field set and a non-sensitive field set, first obtain the sensitive field type table set for the sensitive field, then analyze the data type of each field in the multiple fields, and then map each field one by one according to the sensitive field type table and the data type of each field to determine whether each field is a sensitive field, and mark the sensitive field as 1, and mark the non-sensitive field as 0, and finally count the fields marked as 1 and determine them as a sensitive field set, and count the fields marked as 0 and determine them as a non-sensitive field set.

[0070] Specifically, when analyzing the data type of each of the multiple fields, each of the multiple fields is input into a pre-trained data type recognition model, and the data type of each field is output.

[0071] Furthermore, a pre-trained data type recognition model can be generated according to the following steps: first, a convolutional neural network is used to create a data type recognition model, and then multiple pre-labeled field-type label data are obtained, and then the multiple field-type label data are input into the data type recognition model for training, and the loss value is output. Finally, when the loss value reaches the minimum, the pre-trained data type recognition model is generated.

[0072] Furthermore, when the loss value has not reached the minimum, the pre-labeled multiple field-type label data continue to be input into the data type recognition model for training until the pre-trained data type recognition model is generated when the loss value cannot change.

[0073] S103, performing desensitization processing on the data of each sensitive field in the sensitive field set to generate desensitized data;

[0074] In an embodiment of the present application, when performing desensitization processing, first, the desensitization rules corresponding to each sensitive field are obtained according to the type information of each sensitive field in the sensitive field set, and then the data of the corresponding sensitive field is desensitized according to the desensitization rules corresponding to each sensitive field to obtain desensitized data, and finally the desensitized data is desensitized and copied to generate desensitized data.

[0075] Furthermore, after desensitizing and copying the desensitized data to generate the desensitized data, the sensitive field set and the desensitized data need to be deleted, which can greatly increase the security of the sensitive data.

[0076] It should be noted that in production environments, sensitive data needs to be desensitized in real time, because sometimes different levels of desensitization are required for reading the same sensitive data in different situations. For example, different roles and permissions may require different desensitization schemes.

[0077] Specifically, the desensitization rules can be divided into invalidation method, random value method, data replacement method, symmetric encryption method, average value method, and offset and rounding method.

[0078] In one possible implementation, when the desensitization rule is invalidation, the desensitization method desensitizes the sensitive data by truncating, encrypting, hiding, etc. the data value of the sensitive field when processing the data to be desensitized, so that it is no longer useful. Generally, special characters (such as *) are used to replace the true value. This method of hiding sensitive data is simple, but the disadvantage is that the user cannot know the format of the original data. If you want to obtain complete information, you must ask the user to authorize the query. For example, replacing the real number of the ID number with * becomes "220724 ****** 3523"

[0079] In another possible implementation method, when the desensitization rule is a random value method, the random value replacement method is to change the letters of the sensitive data into random letters, the numbers into random numbers, and the text into random text to change the sensitive data. The advantage of this solution is that it can retain the format of the original data to a certain extent, and this method is often not easy for users to detect.

[0080] In another possible implementation, when the desensitization rule is data replacement, data replacement is similar to the previous invalidation method, except that special characters are not used to block the data, but a set virtual value is used to replace the real value. For example, we set the mobile phone number to "136513XXXXX".

[0081] In another possible implementation, when the desensitization rule is symmetric encryption, symmetric encryption is a special reversible desensitization method that encrypts sensitive data using encryption keys and algorithms. The ciphertext format is consistent with the original data in logical rules, and the original data can be restored by key decryption, such as encryption using the SHA256 encryption algorithm.

[0082] In another possible implementation, when the desensitization rule is an average value method, the average value method needs to calculate the mean of the numerical data first, and then make the desensitized values ​​randomly distributed around the mean, so as to keep the total of the data unchanged.

[0083] In another possible implementation, when the desensitization rule is offset and rounding, this method changes the digital data by random shifting. Offset and rounding maintain the security of the data while ensuring the approximate authenticity of the range. It is closer to the real data than the previous solutions and is more meaningful in big data analysis scenarios. For example, in the date field create_time, 2020-12-08 15:12:25 becomes 2018-01-02 15:00:00.

[0084] S104, combining the desensitized data with the data of non-sensitive fields, and distributing the combined data to the client.

[0085] In a possible implementation, after obtaining the desensitized target field, the desensitized data is combined with the data of the non-sensitive field, and the combined data is distributed to the client.

[0086] For example Figure 2 As shown, Figure 2 This is a flow chart of a data desensitization process provided by the present application. The user in the distribution area refers to a database user specially created for the data sender in the database, so that the distributed data is isolated from other data in the database; the distributed data (target data text to be distributed) refers to the data that the sender intends to share, which may contain sensitive data or non-sensitive data. The sensitive data identification device is a device for classifying data according to the characteristics of the data text. The classification standard refers to the data classification and classification specifications within the organization. It determines whether it is sensitive data by type, and records and identifies the determined type. The category information of the data is the basis for whether the data is sensitive and the desensitization of sensitive data. It is stored in a table separately, including information such as table-field-sensitive category. The desensitization copy device performs desensitization copying on the data according to the data category information and creates a desensitized copy. In the desensitized copy and the receiving area user, the data of the sensitive field in the desensitized copy will be blurred, including replacement with *, SHA256 encryption, etc., so that the blurred data has no possibility of reproduction and identification, depending on the data classification and classification standards within the organization. The receiving area user refers to the database user created for the receiver in the database. It only stores the desensitized copy for data isolation. The data receiver is the downstream of data distribution and receives the data distributed by the upstream.

[0087] In an embodiment of the present application, the data desensitization device first obtains multiple fields of the target data text when receiving the target data text to be distributed, then identifies sensitive fields and non-sensitive fields in the multiple fields, generates a sensitive field set and a non-sensitive field set, and then desensitizes the data of each sensitive field in the sensitive field set to generate desensitized data, and finally combines the desensitized data with the data of the non-sensitive field, and distributes the combined data to the client. Since the present application automatically identifies the sensitive fields existing in the target data text on the server side and performs automatic desensitization, it can realize automatic identification, desensitization and distribution of data, reduce the risk of data leakage caused by data circulation, and improve the efficiency of data distribution.

[0088] See also Figure 3 , which is a flow chart of a data desensitization method provided in the embodiment of the present application, and is applied to the server. Figure 3As shown, the method of the embodiment of the present application may include the following steps:

[0089] S201, parsing the target data text according to the preset key value rule to generate the parsed data text;

[0090] S202, traversing the parsed data text one by one to obtain a key-value pair set;

[0091] S203, dividing each key-value pair in the key-value pair set into an attribute feature and a value feature, and obtaining the attribute feature and the value feature of each key-value pair;

[0092] S204, determining multiple fields of the target data text based on the attribute characteristics and value characteristics of each key-value pair;

[0093] S205, obtaining a sensitive field type table set for sensitive fields;

[0094] S206, analyzing the data type of each field in the plurality of fields;

[0095] S207, mapping one by one according to the sensitive field type table and the data type of each field to determine whether each field is a sensitive field, and marking the sensitive field as 1, and marking the non-sensitive field as 0;

[0096] S208, counting the fields marked as 1 and determining them as a sensitive field set, and counting the fields marked as 0 and determining them as a non-sensitive field set;

[0097] S209, obtaining a desensitization rule corresponding to each sensitive field according to the type information of each sensitive field in the sensitive field set;

[0098] S210, desensitizing the data of the corresponding sensitive field according to the desensitization rule corresponding to each sensitive field to obtain desensitized data, and desensitizing and copying the desensitized data to generate desensitized data;

[0099] S211, combining the desensitized data with the data of non-sensitive fields, and distributing the combined data to the client.

[0100] In an embodiment of the present application, the data desensitization device first obtains multiple fields of the target data text when receiving the target data text to be distributed, then identifies sensitive fields and non-sensitive fields in the multiple fields, generates a sensitive field set and a non-sensitive field set, and then desensitizes the data of each sensitive field in the sensitive field set to generate desensitized data, and finally combines the desensitized data with the data of the non-sensitive field, and distributes the combined data to the client. Since the present application automatically identifies the sensitive fields existing in the target data text on the server side and performs automatic desensitization, it can realize automatic identification, desensitization and distribution of data, reduce the risk of data leakage caused by data circulation, and improve the efficiency of data distribution.

[0101] The following are embodiments of the device of the present invention, which can be used to implement the method embodiments of the present invention. For details not disclosed in the device embodiments of the present invention, please refer to the method embodiments of the present invention.

[0102] See also Figure 4 , which shows a schematic diagram of the structure of a data desensitization device provided by an exemplary embodiment of the present invention, which is applied to a server. The data desensitization device can be implemented as all or part of a terminal through software, hardware, or a combination of both. The device 1 includes a field acquisition module 10, a field identification module 20, a field desensitization module 30, and a data distribution module 40.

[0103] The field acquisition module 10 is used to acquire multiple fields of the target data text when receiving the target data text to be distributed;

[0104] A field identification module 20, used to identify sensitive fields and non-sensitive fields in multiple fields, and generate a sensitive field set and a non-sensitive field set;

[0105] The field desensitization module 30 is used to perform desensitization processing on the data of each sensitive field in the sensitive field set to generate desensitized data;

[0106] The data distribution module 40 is used to combine the desensitized data with the data of the non-sensitive field, and distribute the combined data to the client.

[0107] It should be noted that when the data desensitization device provided in the above embodiment executes the data desensitization method, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the data desensitization device provided in the above embodiment belongs to the same concept as the data desensitization method embodiment. The implementation process is detailed in the method embodiment, which will not be repeated here.

[0108] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0109] In an embodiment of the present application, the data desensitization device first obtains multiple fields of the target data text when receiving the target data text to be distributed, then identifies sensitive fields and non-sensitive fields in the multiple fields, generates a sensitive field set and a non-sensitive field set, and then desensitizes the data of each sensitive field in the sensitive field set to generate desensitized data, and finally combines the desensitized data with the data of the non-sensitive field, and distributes the combined data to the client. Since the present application automatically identifies the sensitive fields existing in the target data text on the server side and performs automatic desensitization, it can realize automatic identification, desensitization and distribution of data, reduce the risk of data leakage caused by data circulation, and improve the efficiency of data distribution.

[0110] The present invention also provides a computer-readable medium having program instructions stored thereon, which, when executed by a processor, implement the data desensitization methods provided by the above-mentioned various method embodiments.

[0111] The present invention also provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the data desensitization methods of the above-mentioned various method embodiments.

[0112] See also Figure 5 , which is a schematic diagram of the structure of a terminal provided in an embodiment of the present application. Figure 5 As shown, the terminal 1000 may include: at least one processor 1001 , at least one network interface 1004 , a user interface 1003 , a memory 1005 , and at least one communication bus 1002 .

[0113] The communication bus 1002 is used to realize the connection and communication between these components.

[0114] The user interface 1003 may include a display screen (Display) and a camera (Camera). Optionally, the user interface 1003 may also include a standard wired interface and a wireless interface.

[0115] The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0116] Among them, the processor 1001 may include one or more processing cores. The processor 1001 uses various interfaces and lines to connect various parts of the entire electronic device 1000, and executes various functions and processes data of the electronic device 1000 by running or executing instructions, programs, code sets or instruction sets stored in the memory 1005, and calling data stored in the memory 1005. Optionally, the processor 1001 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 1001 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 1001, and it can be implemented separately through a chip.

[0117] Among them, the memory 1005 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory). Optionally, the memory 1005 includes a non-transitory computer-readable storage medium. The memory 1005 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 1005 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 1005 may also be optionally at least one storage device located away from the aforementioned processor 1001. As Figure 5 As shown, the memory 1005 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a data desensitization application.

[0118] exist Figure 5In the terminal 1000 shown, the user interface 1003 is mainly used to provide an input interface for the user and obtain the data input by the user; and the processor 1001 can be used to call the data desensitization application stored in the memory 1005, and specifically perform the following operations:

[0119] When receiving the target data text to be distributed, obtaining multiple fields of the target data text;

[0120] Identify sensitive fields and non-sensitive fields in multiple fields, and generate a sensitive field set and a non-sensitive field set;

[0121] Desensitizing the data of each sensitive field in the sensitive field set to generate desensitized data;

[0122] Combine the desensitized data with the data in non-sensitive fields, and distribute the combined data to the client.

[0123] In one embodiment, when executing to obtain multiple fields of the target data text, the processor 1001 specifically performs the following operations:

[0124] Parse the target data text according to the preset key value rules to generate the parsed data text;

[0125] Traverse the parsed data text one by one to obtain the key-value pair set;

[0126] Divide each key-value pair in the key-value pair set into an attribute feature and a value feature, and obtain the attribute feature and the value feature of each key-value pair;

[0127] A plurality of fields of the target data text are determined based on the attribute characteristics and the value characteristics of each key-value pair.

[0128] In one embodiment, when the processor 1001 determines multiple fields of the target data text based on the attribute feature and the value feature of each key-value pair, the processor 1001 specifically performs the following operations:

[0129] Concatenate the attribute features and value features of each key-value pair to obtain multiple concatenated features;

[0130] Convert each concatenated feature into a vector to obtain a vector set;

[0131] Combining each vector in the vector set to generate a term matrix;

[0132] Perform singular value decomposition on the term matrix to obtain multiple semantic indexes;

[0133] The field corresponding to each semantic index in the multiple semantic indexes is queried according to the preset semantic field table to obtain multiple fields of the target data text.

[0134] In one embodiment, when the processor 1001 identifies sensitive fields and non-sensitive fields in multiple fields and generates a sensitive field set and a non-sensitive field set, the processor 1001 specifically performs the following operations:

[0135] Get the sensitive field type table set for sensitive fields;

[0136] Analyze the data type of each field in multiple fields;

[0137] Map each field one by one according to the sensitive field type table and the data type of each field to determine whether each field is a sensitive field, and mark the sensitive field as 1, and mark the non-sensitive field as 0;

[0138] Count the fields marked as 1 and determine them as a set of sensitive fields;

[0139] The fields marked as 0 are counted and determined as a set of non-sensitive fields.

[0140] In one embodiment, when analyzing the data type of each field in the plurality of fields, the processor 1001 specifically performs the following operations:

[0141] Input each of the multiple fields into a pre-trained data type recognition model, and output the data type of each field; wherein,

[0142] Follow these steps to generate a pre-trained data type recognition model, including:

[0143] Use convolutional neural networks to create data type recognition models;

[0144] Get multiple pre-labeled field-type label data;

[0145] Input multiple field-type label data into the data type recognition model for training and output the loss value;

[0146] When the loss value reaches the minimum, a pre-trained data type recognition model is generated.

[0147] In one embodiment, when the processor 1001 performs desensitization processing on the data of each sensitive field in the sensitive field set to generate desensitized data, the processor 1001 specifically performs the following operations:

[0148] Obtain the desensitization rule corresponding to each sensitive field according to the type information of each sensitive field in the sensitive field set;

[0149] Desensitize the data of the corresponding sensitive field according to the desensitization rule corresponding to each sensitive field to obtain desensitized data;

[0150] Desensitized data is generated after desensitizing and copying the desensitized data.

[0151] In an embodiment of the present application, the data desensitization device first obtains multiple fields of the target data text when receiving the target data text to be distributed, then identifies sensitive fields and non-sensitive fields in the multiple fields, generates a sensitive field set and a non-sensitive field set, and then desensitizes the data of each sensitive field in the sensitive field set to generate desensitized data, and finally combines the desensitized data with the data of the non-sensitive field, and distributes the combined data to the client. Since the present application automatically identifies the sensitive fields existing in the target data text on the server side and performs automatic desensitization, it can realize automatic identification, desensitization and distribution of data, reduce the risk of data leakage caused by data circulation, and improve the efficiency of data distribution.

[0152] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the data desensitization program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0153] The above disclosure is only the preferred embodiment of the present application, which certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope covered by the present application.

Claims

1. A data desensitization method, characterized in that: Applied to the server, the method includes: When receiving the target data text to be distributed, multiple fields of the target data text are obtained; wherein the obtaining of the multiple fields of the target data text includes: Parsing the target data text according to preset key value rules to generate parsed data text; Traverse the parsed data text one by one to obtain the key-value pair set; Dividing each key-value pair in the key-value pair set into an attribute feature and a value feature, to obtain an attribute feature and a value feature of each key-value pair; Determine multiple fields of the target data text based on the attribute characteristics and value characteristics of each key-value pair; wherein, The determining of the multiple fields of the target data text based on the attribute characteristics and value characteristics of each key-value pair includes: Performing feature splicing on the attribute feature and the value feature of each key-value pair to obtain a plurality of spliced ​​features; Convert each of the splicing features into a vector to obtain a vector set; Combining each vector in the vector set to generate a term matrix; Performing singular value decomposition on the term matrix to obtain multiple semantic indexes; Querying a field corresponding to each semantic index in the multiple semantic indexes according to a preset semantic field table to obtain multiple fields of the target data text; Identify sensitive fields and non-sensitive fields from the multiple fields, and generate a sensitive field set and a non-sensitive field set; Desensitizing the data of each sensitive field in the sensitive field set to generate desensitized data; The desensitized data is combined with the data of the non-sensitive field, and the combined data is distributed to the client.

2. The method according to claim 1, characterized in that The step of identifying sensitive fields and non-sensitive fields from the plurality of fields and generating a sensitive field set and a non-sensitive field set includes: Obtain a sensitive field type table set for the sensitive field; Analyzing the data type of each of the multiple fields; Mapping one by one according to the sensitive field type table and the data type of each field to determine whether each field is a sensitive field, and marking the sensitive field as 1, and marking the non-sensitive field as 0; Count the fields marked as 1 and determine them as a sensitive field set; The fields marked as 0 are counted and determined as a non-sensitive field set.

3. The method according to claim 2, characterized in that The analyzing the data type of each field in the plurality of fields comprises: Input each of the multiple fields into a pre-trained data type recognition model, and output the data type of each field; wherein, Follow these steps to generate a pre-trained data type recognition model, including: Use convolutional neural networks to create data type recognition models; Get multiple pre-labeled field-type label data; Input the plurality of field-type label data into the data type recognition model for training, and output a loss value; When the loss value reaches the minimum, a pre-trained data type recognition model is generated.

4. The method according to claim 1, characterized in that: The desensitizing the data of each sensitive field in the sensitive field set to generate desensitized data includes: Obtaining a desensitization rule corresponding to each sensitive field according to the type information of each sensitive field in the sensitive field set; Desensitizing the data of the corresponding sensitive field according to the desensitization rule corresponding to each sensitive field to obtain desensitized data; Desensitized data is generated after desensitizing and copying the desensitized data.

5. The method according to claim 4, characterized in that After desensitizing and copying the desensitized data to generate desensitized data, the method further includes: Delete the sensitive field set and desensitized data.

6. A data desensitization device, characterized in that: Applied to the server, the device comprises: The field acquisition module is used to acquire multiple fields of the target data text when receiving the target data text to be distributed; wherein the acquiring multiple fields of the target data text includes: Parsing the target data text according to preset key value rules to generate parsed data text; Traverse the parsed data text one by one to obtain the key-value pair set; Dividing each key-value pair in the key-value pair set into an attribute feature and a value feature, to obtain an attribute feature and a value feature of each key-value pair; Determine multiple fields of the target data text based on the attribute characteristics and value characteristics of each key-value pair; wherein, The determining of the multiple fields of the target data text based on the attribute characteristics and value characteristics of each key-value pair includes: Performing feature splicing on the attribute feature and the value feature of each key-value pair to obtain a plurality of spliced ​​features; Convert each of the splicing features into a vector to obtain a vector set; Combining each vector in the vector set to generate a term matrix; Performing singular value decomposition on the term matrix to obtain multiple semantic indexes; Querying a field corresponding to each semantic index in the multiple semantic indexes according to a preset semantic field table to obtain multiple fields of the target data text; A field identification module, used to identify sensitive fields and non-sensitive fields in the multiple fields, and generate a sensitive field set and a non-sensitive field set; A field desensitization module, used to perform desensitization processing on the data of each sensitive field in the sensitive field set to generate desensitized data; The data distribution module is used to combine the desensitized data with the data of the non-sensitive field and distribute the combined data to the client.

7. A computer storage medium, characterized in that: The computer storage medium stores a plurality of instructions, which are suitable for being loaded by a processor and executing the method steps according to any one of claims 1 to 5.

8. A terminal, characterized in that: include: A processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the method steps as claimed in any one of claims 1 to 5.

Images