A data desensitization method and system based on blockchain

Abstract

The present invention relates to the field of information security technology, and provides a data desensitization method and system based on blockchain, which integrates and processes the acquired user personal data and extracts desensitized element codes locally, and uploads the corresponding virtual mapping address and permutation and combination queue to the blockchain; then encrypts the permutation and combination queue in the cloud to obtain a target combination queue, desensitizes the plaintext data file according to the target combination queue to obtain a virtual desensitized mapping address and uploads it to the blockchain; uses blockchain technology to ensure security in data transmission and data access, uses blockchain as a medium for information transmission, ensures that desensitization rule information is invisible, and thus improves data security; uses shared access to a cloud server to provide desensitization rule computing services independent of a local system, and can further improve the flexibility and loose coupling characteristics of data desensitization processing, as well as desensitization work efficiency.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a data desensitization method and system based on blockchain. Background Art

[0002] Data desensitization refers to the deformation of certain sensitive information through desensitization rules to achieve reliable protection of sensitive privacy data. In the case of customer security data or some commercial sensitive data, real data is transformed and provided for testing without violating system rules. For example, personal information such as ID card number, mobile phone number, card number, customer number, etc. need to be desensitized. As one of the data security technologies, database security technology mainly includes: database leak scanning, database encryption, database firewall, data desensitization, and database security audit system. Database security risks include: dragging database, brushing database, and collision database.

[0003] With the digital development of the medical field, the digital communication and transmission of patients' personal data has facilitated human life, but it also brings different degrees of security threats to human life. The legitimacy of the data source, the security of medical data, the privacy of the patient's condition and other issues, therefore, security protection based on big data is becoming more and more important. The existing big data platform generally ensures data security through user authentication, permission management and data encryption. However, the above methods cannot completely guarantee that the data will not be obtained or cracked. On the one hand, any participant in the data storage and circulation link may have the risk of causing data leakage. On the other hand, those who do not have access to the data may also have the need to analyze and mine the data. The restriction of data access rights will lead to the inability to fully utilize the data value.

[0004] Existing big data platforms generally ensure data security through user authentication, permission management, and data encryption. However, the above methods cannot completely guarantee that data will not be obtained or cracked. In addition, due to the limitations of existing system deployment, the data desensitization operation rules often consume a lot of server performance. In the case of huge data volumes, desensitization takes a lot of time. Summary of the invention

[0005] The present invention provides a data desensitization method and system based on blockchain, which solves the technical problems that the existing data desensitization storage has low security, occupies a large amount of running memory of the local system, and is limited to the data processing capacity of the local system, resulting in low desensitization processing efficiency.

[0006] In order to solve the above technical problems, the present invention provides a data desensitization method based on blockchain, comprising the steps of:

[0007] S1. Obtain the user's personal data in plain text, and generate a plain text data file and the corresponding virtual mapping address;

[0008] S2. Desensitizing the plaintext data file and extracting the element encoding, and storing the obtained permutation and combination queue and the virtual mapping address in the blockchain;

[0009] S3, reading the permutation and combination queue and the virtual mapping address in the blockchain, encrypting the permutation and combination queue according to the virtual mapping address, and obtaining a target combination queue;

[0010] S4. Desensitize the plaintext data file according to the target combination queue, generate a desensitized data file and a corresponding virtual desensitized mapping address, and store them in the blockchain.

[0011] This basic solution integrates and processes the acquired user personal data locally and extracts the desensitized element codes, and uploads the corresponding virtual mapping address and permutation and combination queue to the blockchain; then, the permutation and combination queue is encrypted in the cloud to obtain the target combination queue, and the plaintext data file is desensitized according to the target combination queue to obtain the virtual desensitized mapping address and upload it to the blockchain; blockchain technology is used to ensure the security of data transmission and data access, and blockchain is used as a medium for information transmission to ensure the invisibility of desensitization rule information, thereby improving data security; with the shared access of cloud servers, cloud servers independent of the local system provide desensitization rule computing services, which can further improve the flexibility and loose coupling characteristics of data desensitization processing, as well as the efficiency of desensitization work.

[0012] In a further embodiment, step S1 comprises:

[0013] S11, the application terminal obtains the user's personal data in plain text and generates a plain text data file;

[0014] S12. Obtain a virtual mapping address corresponding to the plaintext data file from a cloud server.

[0015] In a further embodiment, step S2 comprises:

[0016] S21, extracting desensitizing element codes from each sensitive field in the plaintext data file, and obtaining a permutation and combination queue of desensitizing element codes corresponding to the permutation relationship of each desensitizing field in the plaintext data file;

[0017] S22. Upload the permutation and combination queue and the virtual mapping address to a block in the blockchain to obtain a unique block retention code corresponding to the block.

[0018] This solution utilizes the characteristics of blockchain technology such as decentralization and information immutability, which can ensure the privacy of users' personal data and improve the security, integrity and availability of medical data.

[0019] In a further embodiment, step S3 comprises:

[0020] S31, the cloud server reads the permutation and combination queue and the virtual mapping address in the blockchain according to the acquired unique block retention code;

[0021] S32: Using the virtual mapping address as a main index, encrypt the permutation and combination queue to obtain a target combination queue.

[0022] This solution designs processing logic independent of the local system in the cloud server, uses the initial virtual mapping address of the plaintext data file as the main index, encrypts the permutation and combination queue, obtains the target combination queue, and further encrypts and adjusts the desensitizing rules. Without modifying the local system operating rules, it can reduce the risk of data decryption and improve the security protection of sensitive data.

[0023] In a further embodiment, step S4 comprises:

[0024] S41, the application terminal obtains the virtual mapping address and the target combination queue from the cloud server;

[0025] S42, obtaining the corresponding plaintext data file according to the virtual mapping address;

[0026] S43, performing desensitization processing on the plaintext data file according to the target combination queue to generate a desensitized data file and a corresponding virtual desensitization mapping address;

[0027] S44, uploading the virtual desensitized mapping address to the blockchain.

[0028] This scheme desensitizes the plaintext data file according to the encrypted target combination queue, generates a desensitized data file and a corresponding virtual desensitized mapping address, and uses the encrypted virtual desensitized mapping address to make the desensitization rules corresponding to the user's plaintext data file unable to be deciphered by others after encryption; uploading the virtual desensitized mapping address to the blockchain can effectively prevent it from being tampered with.

[0029] In a further embodiment, the present invention further comprises:

[0030] Step S5: When the application terminal obtains the data retrieval application, it sends a request to the cloud server; the cloud server responds to the request and obtains the virtual desensitized mapping address from the blockchain and returns it to the application terminal; the application terminal obtains the corresponding desensitized data file according to the virtual desensitized mapping address.

[0031] In a further implementation scheme, the encryption method in step S32 is queue offset encryption, including queue offset encryption toward the head and queue offset encryption toward the tail.

[0032] In a further embodiment, the desensitized fields include one or more of name, ID number, contact number, address, email address, gender, preferences, bank account number, password, medical information, educational background, private pictures and social relationships.

[0033] The present invention also provides a data desensitization system based on blockchain, which is applied to the above-mentioned data desensitization method based on blockchain, and includes at least one data exchange terminal and a desensitization server in the cloud;

[0034] The data exchange terminal is used for human-computer interaction, obtaining the user's personal data in plain text, and generating a plain text data file and a corresponding virtual mapping address; it is used for desensitizing element encoding and extraction of the plain text data file, and storing the obtained permutation and combination queue and the virtual mapping address in the blockchain;

[0035] The desensitizing server is used to read the permutation and combination queue and the virtual mapping address in the blockchain, and encrypt the permutation and combination queue according to the virtual mapping address to obtain a target combination queue;

[0036] The data exchange terminal is further used to perform desensitization processing on the plaintext data file according to the target combination queue, generate a desensitized data file and a corresponding virtual desensitization mapping address, and store them in the blockchain;

[0037] The data exchange terminal is used to send a request to the cloud server when obtaining a data retrieval application;

[0038] The desensitizing server is also used to respond to the request, obtain the virtual desensitizing mapping address from the blockchain and send it to the data exchange terminal;

[0039] The data exchange terminal is also used to obtain the corresponding desensitized data file according to the virtual desensitization mapping address.

[0040] This solution designs a desensitizing server (in the cloud) that is connected to multiple data exchange terminals installed locally. By utilizing the powerful computing power of the cloud server, it can simultaneously process the desensitizing encryption of multiple data exchange terminals, thereby further improving the operating performance of the data exchange terminals and the flexibility of data desensitization processing while improving data security. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 This is a workflow diagram of a data desensitization method based on blockchain provided by an embodiment of the present invention;

[0042] Figure 2 This is a schematic diagram of the desensitization work of a blockchain-based data desensitization system provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0043] The following specifically illustrates the implementation mode of the present invention in conjunction with the accompanying drawings. The embodiments are provided for illustrative purposes only and cannot be understood as limiting the present invention. The accompanying drawings are provided for reference and illustration only and do not constitute a limitation on the scope of patent protection of the present invention, because many changes can be made to the present invention without departing from the spirit and scope of the present invention.

[0044] Example 1

[0045] The embodiment of the present invention provides a data desensitization method based on blockchain, such as Figure 1 As shown, in this embodiment, steps S1 to S5 are included:

[0046] S1. Obtain the user's personal data in plain text, and generate a plain text data file and a corresponding virtual mapping address, including S11 to S12:

[0047] S11, the application terminal obtains the user's personal data in plain text and generates a plain text data file;

[0048] S12. Obtain a virtual mapping address corresponding to the plaintext data file from the cloud server.

[0049] S2. Desensitize the plaintext data file and extract the element encoding, and store the obtained permutation and combination queue and virtual mapping address in the blockchain, including S21-S22:

[0050] S21. Extract desensitizing element codes from each sensitive field in the plaintext data file to obtain a permutation and combination queue of desensitizing element codes corresponding to the permutation relationship of each desensitizing field in the plaintext data file.

[0051] In this embodiment, the desensitized fields include one or more of name, ID number, contact number, address, email address, gender, preferences, bank account number, password, medical information, educational background, private pictures and social relationships.

[0052] S22. Upload the permutation and combination queue and the virtual mapping address to the block of the blockchain to obtain a unique block retention code corresponding to the block.

[0053] This solution utilizes the characteristics of blockchain technology such as decentralization and information immutability, which can ensure the privacy of users' personal data and improve the security, integrity and availability of medical data.

[0054] S3, read the permutation and combination queue and virtual mapping address in the blockchain, encrypt the permutation and combination queue according to the virtual mapping address, and obtain the target combination queue, including S31~S32:

[0055] S31, the cloud server reads the permutation and combination queue and virtual mapping address in the blockchain according to the unique block retention code obtained from the application terminal;

[0056] S32, using the virtual mapping address as the main index, encrypting the permutation and combination queue to obtain a target combination queue.

[0057] In this embodiment, the encryption method includes but is not limited to queue offset encryption, such as queue head offset encryption and queue tail offset encryption. Figure 2 , Taking the head offset encryption as an example, the original permutation combination queue is "ABCDEFGH", and after encryption, the target combination queue is "EFGHABCD".

[0058] This solution designs processing logic independent of the local system in the cloud server, uses the initial virtual mapping address of the plaintext data file as the main index, encrypts the permutation and combination queue, obtains the target combination queue, and further encrypts and adjusts the desensitizing rules. Without modifying the local system operating rules, it can reduce the risk of data decryption and improve the security protection of sensitive data.

[0059] S4. Desensitize the plaintext data file according to the target combination queue, generate a desensitized data file and a corresponding virtual desensitized mapping address, and store them in the blockchain, including S41 to S44:

[0060] S41, the application terminal obtains the virtual mapping address and the target combination queue from the cloud server;

[0061] S42, obtaining the corresponding plaintext data file according to the virtual mapping address;

[0062] S43, desensitizing the corresponding desensitized field in the plaintext data file according to each desensitized element code in the target combination queue, generating a desensitized data file and a corresponding virtual desensitized mapping address;

[0063] That is, at this time, the user's virtual desensitized mapping address corresponds to the plaintext data file and the desensitized data file.

[0064] S44, upload the virtual desensitized mapping address to the blockchain.

[0065] This scheme desensitizes the plaintext data file according to the encrypted target combination queue, generates a desensitized data file and a corresponding virtual desensitized mapping address, and uses the encrypted virtual desensitized mapping address to make the desensitization rules corresponding to the user's plaintext data file unable to be deciphered by others after encryption; uploading the virtual desensitized mapping address to the blockchain can effectively prevent it from being tampered with.

[0066] S5. When the application terminal obtains the data retrieval application, it sends a request to the cloud server; the cloud server responds to the request and obtains the virtual desensitized mapping address from the blockchain and returns it to the application terminal; the application terminal obtains the corresponding desensitized data file according to the virtual desensitized mapping address.

[0067] The embodiment of the present invention integrates and processes the acquired user personal data locally and extracts the desensitized element codes, and uploads the corresponding virtual mapping address and permutation and combination queue to the blockchain; then the permutation and combination queue is encrypted in the cloud to obtain the target combination queue, and the plaintext data file is desensitized according to the target combination queue to obtain the virtual desensitized mapping address and upload it to the blockchain; with the help of blockchain technology, security is guaranteed for data transmission and data access, and blockchain is used as a medium for information transmission to ensure the invisibility of desensitization rule information, thereby improving data security; with the help of shared access to the cloud server, a cloud server independent of the local system is used to provide desensitization rule computing services, which can further improve the flexibility and loose coupling characteristics of data desensitization processing, as well as the desensitization work efficiency.

[0068] Example 2

[0069] The present invention also provides a blockchain-based data desensitization system, which is applied to the above-mentioned blockchain-based data desensitization method, see Figure 2 , including at least one data exchange terminal and a desensitizing server in the cloud; in this embodiment, the data exchange terminal is the application terminal in Example 1.

[0070] The data exchange terminal is used for human-computer interaction, obtaining the user's personal data in plain text, and generating plain text data files and corresponding virtual mapping addresses; it is used to extract the desensitized element encoding of the plain text data files, and store the obtained permutation and combination queues and virtual mapping addresses in the blockchain;

[0071] The desensitizing server is used to read the permutation and combination queue and the virtual mapping address in the blockchain, and encrypt the permutation and combination queue according to the virtual mapping address to obtain the target combination queue;

[0072] The data exchange terminal is also used to desensitize the plaintext data file according to the target combination queue, generate a desensitized data file and a corresponding virtual desensitized mapping address, and store them in the blockchain;

[0073] The data exchange terminal is used to send a request to the cloud server when receiving a data retrieval application;

[0074] The desensitizing server is also used to respond to requests, obtain virtual desensitizing mapping addresses from the blockchain and send them to the data exchange terminal;

[0075] The data exchange terminal is also used to obtain the corresponding desensitized data file according to the virtual desensitization mapping address.

[0076] This solution designs a desensitizing server that is connected to multiple data exchange terminals installed locally. By utilizing the powerful computing power of the cloud server, it can simultaneously process the desensitizing encryption of multiple data exchange terminals, thereby further improving the operating performance of the data exchange terminals and the flexibility of data desensitization processing while improving data security.

[0077] The data desensitization system provided in this embodiment is used to implement each step in the data desensitization method, provide a hardware foundation for the data desensitization method, and facilitate the implementation of the method.

[0078] The above embodiments are preferred implementation modes of the present invention, but the implementation modes of the present invention are not limited to the above embodiments. Any other changes, modifications, substitutions, combinations, and simplifications that do not deviate from the spirit and principles of the present invention should be equivalent replacement methods and are included in the protection scope of the present invention.

Claims

1. A data desensitization method based on blockchain, characterized in that: Includes steps: S1. Obtain the user's personal data in plain text, and generate a plain text data file and the corresponding virtual mapping address; S2. Desensitizing the plaintext data file and extracting the element encoding, and storing the obtained permutation and combination queue and the virtual mapping address in the blockchain; S3, reading the permutation and combination queue and the virtual mapping address in the blockchain, encrypting the permutation and combination queue according to the virtual mapping address, and obtaining a target combination queue; S4. Desensitizing the plaintext data file according to the target combination queue, generating a desensitized data file and a corresponding virtual desensitized mapping address, and storing them in the blockchain; The step S2 comprises: S21, extracting desensitizing element codes from each sensitive field in the plaintext data file, and obtaining a permutation and combination queue of desensitizing element codes corresponding to the permutation relationship of each desensitizing field in the plaintext data file; S22. Upload the permutation and combination queue and the virtual mapping address to a block in the blockchain to obtain a unique block retention code corresponding to the block.

2. A data desensitization method based on blockchain as claimed in claim 1, characterized in that: The step S1 comprises: S11, the application terminal obtains the user's personal data in plain text and generates a plain text data file; S12. Obtain a virtual mapping address corresponding to the plaintext data file from a cloud server.

3. A blockchain-based data desensitization method as claimed in claim 1, characterized in that: The step S3 comprises: S31, the cloud server reads the permutation and combination queue and the virtual mapping address in the blockchain according to the acquired unique block retention code; S32: Using the virtual mapping address as a main index, encrypt the permutation and combination queue to obtain a target combination queue.

4. A data desensitization method based on blockchain as claimed in claim 3, characterized in that: The step S4 comprises: S41, the application terminal obtains the virtual mapping address and the target combination queue from the cloud server; S42, obtaining the corresponding plaintext data file according to the virtual mapping address; S43, performing desensitization processing on the plaintext data file according to the target combination queue to generate a desensitized data file and a corresponding virtual desensitization mapping address; S44, uploading the virtual desensitized mapping address to the blockchain.

5. A blockchain-based data desensitization method as claimed in claim 1, characterized in that: Also includes: Step S5: When the application terminal obtains the data retrieval application, it sends a request to the cloud server; The cloud server obtains the virtual desensitized mapping address from the blockchain in response to the request, and returns it to the application terminal; The application terminal obtains the corresponding desensitized data file according to the virtual desensitization mapping address.

6. A data desensitization method based on blockchain as claimed in claim 3, characterized in that: The encryption method in step S32 is queue offset encryption, including queue offset encryption toward the head and queue offset encryption toward the tail.

7. A data desensitization method based on blockchain as claimed in claim 1, characterized in that: The desensitized fields include one or more of name, ID number, contact number, address, email address, gender, preferences, bank account number, password, medical information, educational background, private pictures and social relationships.

8. A data desensitization system based on blockchain, applied to a data desensitization method based on blockchain as claimed in any one of claims 1 to 7, characterized in that: It includes at least one data exchange terminal and a desensitizing server in the cloud; The data exchange terminal is used to perform human-computer interaction, obtain the user's personal data in plain text, and generate a plain text data file and a corresponding virtual mapping address; Used to perform desensitized element encoding extraction on the plaintext data file, and store the obtained permutation and combination queue and the virtual mapping address in the blockchain; The desensitizing server is used to read the permutation and combination queue and the virtual mapping address in the blockchain, and encrypt the permutation and combination queue according to the virtual mapping address to obtain a target combination queue; The data exchange terminal is further used to perform desensitization processing on the plaintext data file according to the target combination queue, generate a desensitized data file and a corresponding virtual desensitization mapping address, and store them in the blockchain; The data exchange terminal is used to send a request to the cloud server when obtaining a data retrieval application; The desensitizing server is also used to respond to the request, obtain the virtual desensitizing mapping address from the blockchain and send it to the data exchange terminal; The data exchange terminal is also used to obtain the corresponding desensitized data file according to the virtual desensitization mapping address.

Images