Data desensitization method, terminal device and storage medium

Abstract

The present invention relates to a data desensitization method, terminal equipment and storage medium, the method comprising: constructing a corresponding feature set based on features with a fixed number of types in a name or ID card number to be desensitized; finding the position of the corresponding feature from the feature set, and using the found position and the calculation result of the fixed offset as the position of the desensitized feature corresponding to the feature in the feature set, thereby obtaining the desensitized feature; combining the position of the feature before or after desensitization in the feature set, calculating the desensitized features corresponding to other features; splicing all the desensitized features into the desensitized name or ID card number in sequence. The present invention allows the desensitized data to retain the original format and confuse it with the real data so that it cannot be immediately distinguished.

Description

Technical Field

[0001] The present invention relates to the field of desensitization technology, and in particular to a data desensitization method, terminal equipment and storage medium. Background Art

[0002] Data desensitization, as the name implies, is to transform sensitive information in the data (such as name, ID number, mobile phone number, address, email address, etc.) through desensitization rules to achieve the shielding of sensitive information. Common desensitization rules in the industry include: replacement, encryption, rearrangement, masking, truncation, and you can also customize desensitization rules through the desired algorithm. With the advent of the big data era, data as a carrier of information often has high value, and data describing people is more sensitive, making the data security of personnel information particularly important.

[0003] Most of the existing personnel information data desensitization adopts two solutions:

[0004] (1) Hide or replace key sensitive information, such as replacing the name with '*' when desensitizing the name, and hiding the middle 4 digits of the mobile phone number. This method is the simplest and therefore widely used, but the data after desensitization by this method still retains some authenticity, which may lead to risks, and there are serious problems of irreversibility and complete loss of deceptiveness of the desensitized data. Mask is the most commonly used replacement data desensitization method. This method keeps the data length unchanged and only retains part of the data information, such as: '123456789' is desensitized to '123***789', and 'Zhang San' is desensitized to 'Zhang*'. This method retains the format characteristics of the data, but the irreversibility of the data and the easy repeatability after desensitization are exposed.

[0005] (2) Generate exclusive encryption keys on a per-person or per-batch basis. For example, under the premise of custom desensitization rules, bind the relationship between the ID number and the key, and use the associated key to encrypt the personal information data. This method ensures sufficient data security, but often due to frequent desensitization of a large amount of data, storage and query of keys and associated information will cause waste of resources, and data bundling is relatively serious, making it difficult to reverse desensitize a single piece of data or a single field of data. Hashing is the most commonly used encryption data desensitization method, which maps variable-length data to fixed-length values, such as: '14234569874' is desensitized to '1583426531', and 'Li Si' is desensitized to '4774325433'. This method largely ensures data security and one-to-one mapping, but greatly reduces the recognition of data types. Summary of the invention

[0006] In order to solve the above problems, the present invention proposes a data desensitization method, a terminal device and a storage medium.

[0007] The specific plan is as follows:

[0008] A data desensitization method comprises the following steps:

[0009] Construct a corresponding feature set based on the features with a fixed number of types in the name or ID number to be desensitized;

[0010] Find the location of the corresponding feature in the feature set, and use the calculated result of the found location and the fixed offset as the location of the desensitized feature corresponding to the feature in the feature set, thereby obtaining the desensitized feature;

[0011] Combine the positions of the features before or after desensitization in the feature set to calculate the desensitized features corresponding to other features;

[0012] Concatenate all the desensitized features in order into the desensitized name or ID number.

[0013] Furthermore, when desensitizing a name, the feature used to construct the feature set is set to be the first Chinese character representing the surname in the name, and the corresponding feature set is the surname character set.

[0014] Furthermore, when desensitizing a name, the specific method for calculating the desensitized features corresponding to other features is based on the position of the features before or after desensitization in the feature set: for other Chinese characters after the first Chinese character, add the position of each Chinese character in the GB2312 character set and the position offset corresponding to each Chinese character, and take the result of the added value cyclically in the hexadecimal position range of B0A0-F7EF as the position of the desensitized Chinese character corresponding to each Chinese character in the GB2312 character set, and search the GB2312 character set according to the position to obtain the desensitized Chinese character of each Chinese character; wherein, the position offset corresponding to the second Chinese character is the position of the desensitized Chinese character corresponding to the first Chinese character in the surname character set; and the position offset corresponding to the Chinese character after the second Chinese character is the position of the desensitized Chinese character corresponding to the previous Chinese character in the GB2312 character set.

[0015] Furthermore, when desensitizing the ID card number, the features used to construct the feature set are set to be the first 6 characters representing the regional code in the ID card number, and the corresponding feature set is the regional code character set.

[0016] Furthermore, when the ID card number is desensitized, the specific method for calculating the desensitized features corresponding to other features is as follows, based on the positions of the features before or after desensitization in the feature set: set the positions of the features before and after desensitization in the feature set to A and B respectively, and split the ID card number to be desensitized into a 6-digit area code, a 4-digit year, a 2-digit month, a 2-digit date, a 3-digit sequence code and a 1-digit check code according to its composition; take the value of the year minus B as the desensitized year; take the month plus the value of A in a cycle within the range of 1-12 as the desensitized month; take the date plus the value of A in a cycle within the date corresponding to the new month as the desensitized date; calculate the result C of the sequence code plus the value of B in a cycle within the range of 1-1000, and take the difference between 1000 and C as the desensitized sequence code; concatenate the desensitized area code, year, month, date and sequence code and calculate a new check code using the ID card verification algorithm.

[0017] A data desensitizing terminal device includes a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned method in an embodiment of the present invention when executing the computer program.

[0018] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the method described above in an embodiment of the present invention are implemented.

[0019] The present invention adopts the above technical solution, so that the original format is retained after desensitization, and it is mixed with the real data and cannot be immediately distinguished. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 Shown is a flow chart of Embodiment 1 of the present invention. DETAILED DESCRIPTION

[0021] To further illustrate various embodiments, the present invention provides drawings. These drawings are part of the disclosure of the present invention, which are mainly used to illustrate the embodiments and can be used in conjunction with the relevant descriptions in the specification to explain the operating principles of the embodiments. With reference to these contents, ordinary technicians in this field should be able to understand other possible implementations and advantages of the present invention.

[0022] The present invention will now be further described with reference to the accompanying drawings and specific implementation methods.

[0023] Embodiment 1:

[0024] The embodiment of the present invention provides a data desensitization method, such as Figure 1 As shown, the method comprises the following steps:

[0025] S1: Construct a corresponding feature set based on a fixed number of features in the name or ID number to be desensitized.

[0026] S2: Find the position of the corresponding feature in the feature set, and use the calculated result of the found position and the fixed offset as the position of the desensitized feature corresponding to the feature in the feature set, thereby obtaining the desensitized feature;

[0027] S3: Combine the positions of the features before or after desensitization in the feature set to calculate the desensitized features corresponding to other features;

[0028] S4: All desensitized features are concatenated in order to form the name or ID number to be desensitized.

[0029] In this embodiment, the calculation method of the operation result of the position found in step S2 and the fixed offset is set as follows: after adding the found position and the fixed offset, the result of cyclically taking the added value within the position range of the feature set is used as the operation result of the found position and the fixed offset. Cyclic valuation means that when the added value is greater than the maximum value in the range, the value is subtracted from the maximum value multiple times until it is within the range, and the value within the range is used as the result of cyclic valuation. For example, if the range is 1-12 and the added value is 51, then 51-4*12=3, and 3 is used as the result of cyclic valuation. The subsequent cyclic valuation methods are the same.

[0030] It should be noted that the fixed offset in step S2 can be set by those skilled in the art according to requirements (eg, set to 8), and is not limited here.

[0031] (1) When desensitizing a name, since the number of surnames is fixed, in this embodiment, after splitting the name into individual Chinese characters, a surname character set is constructed based on all the surnames in the name, so that the position of each surname in the surname character set is fixed.

[0032] Since Chinese characters are evenly distributed in the B0A0-F7EF area in the existing GB2312 character set, with 72 characters in each area, in this embodiment, desensitization of other features other than the surname (i.e., other Chinese characters after the first Chinese character in the name) is realized based on the GB2312 character set. The specific allergy method is: for other Chinese characters after the first Chinese character, the position of each Chinese character in the GB2312 character set is added to the position offset corresponding to each Chinese character, and the result of the added value is cyclically taken in the hexadecimal B0A0-F7EF position range as the position of the desensitized Chinese character corresponding to each Chinese character in the GB2312 character set, and the desensitized Chinese character of each Chinese character is obtained from the GB2312 character set according to the position; wherein, the position offset corresponding to the second Chinese character is the position of the desensitized Chinese character corresponding to the first Chinese character in the surname character set; the position offset corresponding to the Chinese character after the second Chinese character is the position of the desensitized Chinese character corresponding to the previous Chinese character in the GB2312 character set.

[0033] Finally, all the desensitized Chinese characters are concatenated into the desensitized name in the order of the name.

[0034] (2) When desensitizing the ID card number, since the ID card number consists of a 6-digit area code, a 4-digit year, a 2-digit month, a 2-digit date, a 3-digit sequence code and a 1-digit check code, and the number of 6-digit area codes is fixed, in this embodiment, after the ID card number is split according to its composition, a area code character set is constructed based on all the area codes in the ID card number, so that the position of each area code in the area code character set is fixed.

[0035] When the ID card number is desensitized, the specific method for calculating the desensitized features corresponding to other features is as follows, combining the positions of the features before or after desensitization in the feature set: set the positions of the features before and after desensitization in the feature set to A and B respectively, and split the ID card number to be desensitized into a 6-digit area code, a 4-digit year, a 2-digit month, a 2-digit date, a 3-digit sequence code and a 1-digit check code according to its composition; subtract the value of B from the year as the desensitized year; take the month plus the value of A in a cycle within the range of 1-12 as the desensitized month; take the date plus the value of A in a cycle within the date corresponding to the new month as the desensitized date; calculate the sequence code plus the value of B in a cycle within the range of 1-1000, and take the difference between 1000 and C as the desensitized sequence code; concatenate the desensitized area code, year, month, date and sequence code and obtain a new check code by calculating the ID card verification algorithm.

[0036] Finally, according to the composition order of the ID card number, all the desensitized features are concatenated into the desensitized ID card number.

[0037] The embodiment of the present invention desensitizes the name and ID number in the personnel information, based on the self-built surname character set and the regional code surname character set, and integrates the customized desensitization rules to retain the format of the data, ensure the uniqueness of desensitization, and retain the display value and deceptiveness of the desensitized data to a great extent. In addition, desensitization is performed on a single data field to eliminate the correlation between the data. In the process of desensitization and reverse desensitization, the server pressure is greatly reduced, making it more suitable for massive data environments.

[0038] The embodiment of the present invention replaces the secret key with a self-built feature set and then integrates the GB2312 character set. Therefore, under the premise of ensuring data security, it is possible to reverse desensitize and retain the format of the data, making the desensitization of personal information data and the reuse of desensitized data more flexible.

[0039] The personal information data after desensitization by the method of this embodiment is exactly the same as the real data, which is very suitable for display training or testing. The self-built library and the key have the same function, but greatly save the consumption of resources.

[0040] Embodiment 2:

[0041] The present invention also provides a data desensitizing terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps in the above-mentioned method embodiment of the first embodiment of the present invention when executing the computer program.

[0042] Further, as an executable solution, the data desensitizing terminal device can be a computing device such as a desktop computer, a notebook, a PDA, and a cloud server. The data desensitizing terminal device may include, but is not limited to, a processor and a memory. Those skilled in the art will appreciate that the composition structure of the above-mentioned data desensitizing terminal device is merely an example of a data desensitizing terminal device and does not constitute a limitation on the data desensitizing terminal device. It may include more or fewer components than the above-mentioned, or a combination of certain components, or different components. For example, the data desensitizing terminal device may also include input and output devices, network access devices, buses, etc., which are not limited in the embodiments of the present invention.

[0043] Further, as an executable solution, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc. The processor is the control center of the data desensitization terminal device, and various interfaces and lines are used to connect the various parts of the entire data desensitization terminal device.

[0044] The memory can be used to store the computer program and / or module, and the processor realizes various functions of the data desensitization terminal device by running or executing the computer program and / or module stored in the memory, and calling the data stored in the memory. The memory can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system, an application required for at least one function; the data storage area can store data created according to the use of the mobile phone, etc. In addition, the memory can include a high-speed random access memory, and can also include a non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), at least one disk storage device, a flash memory device, or other volatile solid-state storage devices.

[0045] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above method in the embodiment of the present invention are implemented.

[0046] If the module / unit integrated in the data desensitization terminal device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on such an understanding, the present invention implements all or part of the process in the above-mentioned embodiment method, and can also be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes a computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a U disk, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory) and a software distribution medium, etc.

[0047] Although the present invention has been specifically shown and described in conjunction with the preferred embodiments, it should be understood by those skilled in the art that various changes may be made to the present invention in form and details without departing from the spirit and scope of the present invention as defined by the appended claims, all of which are within the scope of protection of the present invention.

Claims

1. A data desensitization method, characterized in that: The following steps are involved: Constructing a corresponding feature set based on features of a fixed number of types in the name to be desensitized; when desensitizing a name, setting the feature used to construct the feature set to be the first Chinese character representing the surname in the name, and the corresponding feature set is the surname character set; Find the location of the corresponding feature in the feature set, and use the calculated result of the found location and the fixed offset as the location of the desensitized feature corresponding to the feature in the feature set, thereby obtaining the desensitized feature; Combined with the position of the features before or after desensitization in the feature set, calculate the desensitized features corresponding to other features; when desensitizing a name, the specific method is: for other Chinese characters after the first Chinese character, add the position of each Chinese character in the GB2312 character set and the position offset corresponding to each Chinese character, and take the result of the added value cyclically in the hexadecimal position range of B0A0-F7EF as the position of the desensitized Chinese character corresponding to each Chinese character in the GB2312 character set, and search the GB2312 character set according to the position to obtain the desensitized Chinese character of each Chinese character; wherein, the position offset corresponding to the second Chinese character is the position of the desensitized Chinese character corresponding to the first Chinese character in the surname character set; the position offset corresponding to the Chinese character after the second Chinese character is the position of the desensitized Chinese character corresponding to the previous Chinese character in the GB2312 character set; Concatenate all the desensitized features in order to form the desensitized name.

2. A data desensitization method, characterized in that: The following steps are involved: Construct a corresponding feature set based on features with a fixed number of types in the ID card number to be desensitized; when desensitizing the ID card number, the features used to construct the feature set are set to be the first 6 characters representing the regional code in the ID card number, and the corresponding feature set is the regional code character set; Find the location of the corresponding feature in the feature set, and use the calculated result of the found location and the fixed offset as the location of the desensitized feature corresponding to the feature in the feature set, thereby obtaining the desensitized feature; Combined with the position of the features before or after desensitization in the feature set, calculate the desensitized features corresponding to other features; when desensitizing the ID card number, the specific method is: set the positions of the features before and after desensitization in the feature set to A and B respectively, split the ID card number to be desensitized into a 6-digit area code, a 4-digit year, a 2-digit month, a 2-digit date, a 3-digit sequence code and a 1-digit check code according to its composition; subtract the value of B from the year as the desensitized year; add the value of A to the month and take the result of cyclically taking the value in the range of 1-12 as the desensitized month; Add the value of A to the date and take the result of the cycle within the date corresponding to the new month as the desensitized date; Calculate the sequence code plus the value of B in the range of 1-1000 to get the result C, and use the difference between 1000 and C as the desensitized sequence code; The new verification code is calculated by concatenating the desensitized area code, year, month, date and sequence code through the ID card verification algorithm; Concatenate all the desensitized features in order to form the desensitized ID number.

3. A data desensitization terminal device, characterized in that: The method comprises a processor, a memory and a computer program stored in the memory and running on the processor, wherein the processor implements the steps of the method according to any one of claims 1 to 2 when executing the computer program.

4. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 2 are implemented.

Images