A sensitive information detection method, device, equipment and storage medium

Abstract

The application discloses a sensitive information detection method, device and equipment and a storage medium. The method comprises the following steps: determining a to-be-detected database and a to-be-detected field according to a received sensitive information detection instruction; acquiring all to-be-detected data under the to-be-detected field from the to-be-detected database, and acquiring a field data rule of the to-be-detected field; and determining to-be-detected data meeting the field data rule as suspected sensitive data. The application solves the problem that existing data desensitization is not completely possible, leading to sensitive information leakage, and achieves effective detection of sensitive data in a database, so that complete desensitization of system test data is ensured as much as possible.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of information processing, and particularly relate to a sensitive information detection method, device, equipment and storage medium. BACKGROUND

[0002] With the rapid development of computer network technology, more and more sensitive information related to personal privacy or business secrets are spread through the network. How to ensure that sensitive information is not leaked is increasingly valued in the industry and becomes the primary consideration for information security.

[0003] In daily informatization construction, it is inevitable to migrate a large amount of data from a production database carrying core business to a test database for business testing as test data. The data in the production database contains a large amount of sensitive information. Directly migrating the data of the production database to the test database will inevitably have a risk of sensitive information leakage in the process of using the test database. Therefore, when migrating the data of the production database to the test database, the data of the production database needs to be desensitized before being stored in the test database. However, it is not known whether the data of the production database is completely desensitized. In order to protect sensitive information to the maximum extent on the basis of informatization construction, it is now necessary to batch detect the sensitive information of the database to ensure that the test data is completely desensitized. SUMMARY

[0004] The present application provides a sensitive information detection method, device, equipment and storage medium to effectively detect sensitive data in a database.

[0005] In a first aspect, the embodiments of the present application provide a sensitive information detection method, comprising:

[0006] determining a database to be detected and a field to be detected according to a received sensitive information detection instruction;

[0007] obtaining all test data under the field to be detected from the database to be detected, and obtaining a field data rule of the field to be detected;

[0008] determining the test data meeting the field data rule as suspected sensitive data.

[0009] Optionally, the determining of the database to be detected and the field to be detected according to the received sensitive information detection instruction comprises:

[0010] receiving a sensitive information detection instruction, and extracting a target database name and a target field name from the sensitive information detection instruction;

[0011] determine a database consistent with the target database name as a to-be-detected database, and determine a field consistent with the target field name in the to-be-detected database as a to-be-detected field.

[0012] Optionally, the method further comprises:

[0013] Optionally, the method further comprises:

[0014] Optionally, the method further comprises:

[0015] Optionally, the method further comprises:

[0016] Optionally, the method further comprises:

[0017] Optionally, the method further comprises:

[0018] Optionally, the method further comprises:

[0019] Optionally, the method further comprises:

[0020] Optionally, the method further comprises:

[0021] Optionally, the method further comprises:

[0022] In a second aspect, an embodiment of the present application further provides a sensitive information detection device, which comprises:

[0023] a to-be-detected information determination module configured to determine a to-be-detected database and a to-be-detected field according to a received sensitive information detection instruction;

[0024] a to-be-detected data extraction module configured to acquire all to-be-detected data under the to-be-detected field from the to-be-detected database, and acquire a field data rule of the to-be-detected field;

[0025] The sensitive information detection module is configured to determine the to-be-detected data satisfying the field data rule as suspected sensitive data

[0026] In a third aspect, an embodiment of the present application further provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the sensitive information detection method according to any embodiment of the present application when executing the program.

[0027] In a fourth aspect, an embodiment of the present application further provides a storage medium containing computer executable instructions, which are used to execute the sensitive information detection method according to any embodiment of the present application when executed by a computer processor.

[0028] The present application determines the to-be-detected database and the to-be-detected field according to the received sensitive information detection instruction, obtains all to-be-detected data under the to-be-detected field from the to-be-detected database, and obtains the field data rule of the to-be-detected field, and determines the to-be-detected data satisfying the field data rule as suspected sensitive data, thereby solving the problem that the existing data desensitization is not completely possible to cause sensitive information leakage, and achieving effective detection of sensitive data in the database, and ensuring that the system test data is completely desensitized as much as possible. BRIEF DESCRIPTION OF DRAWINGS

[0029] Figure 1 is a flowchart of a sensitive information detection method provided by an embodiment of the present application;

[0030] Figure 2 is a structural block diagram of a sensitive information detection device provided by an embodiment of the present application;

[0031] Figure 3 is a structural block diagram of a computer device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0032] The present application will be further described in detail below with reference to the accompanying drawings and embodiments. It can be understood that the specific embodiments described herein are only used to explain the present application, but not to limit the present application. In addition, it should be noted that, for the convenience of description, only the parts related to the present application are shown in the drawings, and not all structures, and in the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.

[0033] Embodiment one

[0034] Figure 1 is a flowchart of a sensitive information detection method provided by an embodiment of the present application, and the present embodiment can be applied to the case of detecting the information sensitivity of the data in the database, and the method can be executed by a sensitive information detection device, and the device can be realized by software and / or hardware.

[0035] like Figure 1 As shown, the method specifically includes the following steps:

[0036] Step 110: Determine the database to be detected and the fields to be detected based on the received sensitive information detection instructions.

[0037] Generally speaking, information related to an individual's or company's identity can be called sensitive information, such as name, ID number, mobile phone number, bank card number, bank account number, account password, payment password, company name, company address, legal representative, and legal representative's ID number.

[0038] The sensitive information detection method in this embodiment can be executed by a client in a sensitive information detection system. The sensitive information detection system may include a server for centralized management and multiple clients for detection execution. The server generates sensitive information detection instructions based on detection requirements and sends them to the clients. Each client has multiple databases. When a client receives a sensitive information detection instruction from the server, it can extract relevant detection information from the instruction, determine the database to be detected from its local databases, and identify the fields to be detected within that database. The server and client in this embodiment can be devices such as servers or computers.

[0039] In this embodiment, by setting the generation of sensitive information detection instructions and sensitive information detection on the server and client respectively, it can play the role of centralized monitoring and decentralized scheduling, and the data sampling inspection strategy can be uniformly and flexibly configured on the server.

[0040] Optionally, step 110 can be implemented in the following way: receiving a sensitive information detection instruction, extracting the target database name and target field name from the sensitive information detection instruction; identifying the database with the same target database name as the database to be detected, and identifying the field in the database to be detected that has the same target field name as the field to be detected.

[0041] In this embodiment, the sensitive information detection instruction may include information such as the database server address, database connection address, username, password (ciphertext), table name, and field name. The sensitive information detection instruction can be synchronized to the client as a file. The client can extract important parameter information from the sensitive information detection instruction to determine the fields to be detected in the database.

[0042] Step 120: Obtain all data to be tested under the field to be tested from the database to be tested, and obtain the field data rules of the field to be tested.

[0043] Specifically, when determining the to-be-detected field in the to-be-detected database, all data under the to-be-detected field can be taken as the to-be-detected data. Specifically, when the sensitive information detection instruction contains the extraction number information, the to-be-detected data can be selected from all data under the to-be-detected field according to the extraction number. Generally, the data under each field has a certain data character composition rule, and the field data rule of the data under different fields can be counted in advance. When a specified field is detected, the client can directly obtain the field data rule corresponding to the field.

[0044] It can be understood that, in order to accurately perform business testing, the character length and character type of the data in the test database are consistent with the real data, and therefore, the field data rule described in the embodiment does not include the string length and character type of the data. A specific example is that the ID number of a person is composed of 18 digits, wherein the 7th-14th digits are the birth date of the person, and the maximum age of the person is 150 years old by default. The data character composition rule can be added to the field data rule of the ID number. When the 7th-14th digits of a piece of ID number data are "19920102", it can be considered that the piece of ID number data satisfies the field data rule of the ID number. When the 7th-14th digits of another piece of ID number data are "18220102", and the detection year is 2022, 2022-1822>150, it can be considered that the piece of ID number data does not exist in reality and does not satisfy the field data rule of the ID number.

[0045] Step 130, determining the to-be-detected data satisfying the field data rule as suspected sensitive data.

[0046] Specifically, when a piece of to-be-detected data satisfies the corresponding field data rule, it can be considered that the piece of to-be-detected data may not be desensitized and may be the real sensitive information of the user, and therefore, the piece of to-be-detected data can be determined as suspected sensitive data for further detection and investigation by the operation and maintenance personnel.

[0047] Optionally, step 130 can be specifically implemented by the following method: for each piece of to-be-detected data, detecting whether the to-be-detected data satisfies the field data rule, and if yes, determining the to-be-detected data as suspected sensitive data.

[0048] The technical scheme of the embodiment determines a to-be-detected database and a to-be-detected field according to the received sensitive information detection instruction, obtains all to-be-detected data under the to-be-detected field from the to-be-detected database, and obtains a field data rule of the to-be-detected field; and determines the to-be-detected data meeting the field data rule as suspected sensitive data, thereby solving the problem that existing data desensitization is not completely possible and leads to sensitive information leakage, and achieving effective detection of sensitive data in the database and ensuring that system test data is completely desensitized as much as possible.

[0049] On the basis of the above technical scheme, the sensitive information detection method provided in the embodiment can further implement the following steps:

[0050] After the to-be-detected data meeting the field data rule is determined as suspected sensitive data, a target desensitization processing system of the suspected sensitive data is determined, and if the target desensitization processing system is marked as a reliable desensitization system, the suspected sensitive data is determined as desensitized data.

[0051] In the embodiment, the to-be-detected fields of all to-be-detected databases are data processed by sensitive information desensitization processing systems. In actual application, there are some desensitization processing systems that have good desensitization effect and are similar to real data, and we can consider that the data processed by these desensitization processing systems are reliable desensitized data, and mark these desensitization processing systems as reliable desensitization systems. Therefore, after the to-be-detected data meeting the field data rule is determined as suspected sensitive data, it can be further inquired which desensitization processing system desensitizes the suspected sensitive data, and if the desensitization is performed by a desensitization processing system marked as a reliable desensitization system, the suspected sensitive data can be considered as desensitized data, which is only close to real data.

[0052] Optionally, the sensitive information detection method provided in the embodiment can further implement the following steps:

[0053] According to the matching degree of the suspected sensitive data and the field data rule, a sensitive level of the suspected sensitive data is determined, and the matching degree and the sensitive level are positively correlated.

[0054] Specifically, when the matching degree of a piece of suspected sensitive data and the corresponding field data rule is high, it can be considered that the possibility of the suspected sensitive data being non-desensitized data is high, and therefore the sensitive level of the suspected sensitive data can be determined to be high. Correspondingly, when the matching degree of a piece of suspected sensitive data and the corresponding field data rule is low, it can be considered that the possibility of the suspected sensitive data being non-desensitized data is low, and therefore the sensitive level of the suspected sensitive data can be determined to be low.

[0055] Optionally, the sensitive information detection method provided in the embodiment can further implement the following steps:

[0056] The suspected sensitive data is marked, and a sensitive information prompt message is formed and sent to a designated user.

[0057] Specifically, when the client detects the suspected sensitive data, the suspected sensitive data can be marked, and a sensitive information prompt message is formed according to the related information of the suspected sensitive data to remind the operation and maintenance person in charge to confirm the sensitive information by means of email, short message and the like.

[0058] Optionally, the sensitive information detection method provided by the embodiment can also achieve:

[0059] Periodically receive a sensitive information detection instruction, trigger a sensitive information detection operation, and save a sensitive information detection result in a detection file.

[0060] Specifically, the server of the embodiment can set the execution frequency and trigger time of the scheduling job, generate a sensitive information detection instruction periodically, and send it to the client. After the client periodically receives the sensitive information detection instruction sent by the server, the sensitive information detection operation is performed. For each sensitive information detection operation, the server can format the sensitive data log file according to the operation process, form a corresponding detection file, and save it.

[0061] Illustratively, the embodiment can take detecting sensitive information of an oracle database as an example, use java to write the detection management central control system of the server and the client, use shell to write the database extraction script, and use python to write the sensitive data checking script.

[0062] The server can use the SpringBoot framework, use java program to write the detection management central control system, and the server can include organization management, resource management, role permission management, etc. The detection administrator of each technical service department is assigned a role and permission, the database access address information and the detection strategy are uniformly configured and updated and published, and the detection management interface can be used to view the checking alarm information, the detection log, the checking of the detection quality of each department, and the modification of the completed management server. The client can use java to write the detection management central control system, use shell to write the database extraction script, and use python to write the sensitive data checking script, to realize the timing scanning task, store the initialization parameter file configured by the detection management central control system, the batch strategy parameter, the database access parameter file, the checking database information and the matching parameter file, the graphical interface such as viewing the scanning result, actively obtaining the parameter script page, and the like, and remind the system person in charge to confirm the sensitive information by means of email, short message and the like.

[0063] Embodiment two

[0064] The sensitive information detection device provided by the embodiment of the present application can execute the sensitive information detection method provided by any of the embodiments of the present application, and has the function modules and beneficial effects corresponding to the execution method. Figure 2 is a structural block diagram of a sensitive information detection device provided by the second embodiment of the present application, as shown in the figure, the device comprises: a to-be-detected information determination module 210, a to-be-detected data extraction module 220 and a sensitive information detection module 230. Figure 2

[0065] The to-be-detected information determination module 210 is configured to determine a to-be-detected database and a to-be-detected field according to a received sensitive information detection instruction.

[0066] The to-be-detected data extraction module 220 is configured to obtain all to-be-detected data under the to-be-detected field from the to-be-detected database, and obtain a field data rule of the to-be-detected field.

[0067] The sensitive information detection module 230 is configured to determine to-be-detected data satisfying the field data rule as suspected sensitive data.

[0068] The technical solution of the embodiment determines a to-be-detected database and a to-be-detected field according to a received sensitive information detection instruction, obtains all to-be-detected data under the to-be-detected field from the to-be-detected database, and obtains a field data rule of the to-be-detected field, and determines to-be-detected data satisfying the field data rule as suspected sensitive data, thereby solving the problem that incomplete data desensitization may lead to sensitive information leakage, and achieving effective detection of sensitive data in a database and ensuring that system test data is completely desensitized.

[0069] Optionally, the to-be-detected information determination module 210 comprises:

[0070] A to-be-detected information name extraction unit is configured to receive a sensitive information detection instruction, and extract a target database name and a target field name from the sensitive information detection instruction.

[0071] A to-be-detected information determination unit is configured to determine a database consistent with the target database name as a to-be-detected database, and determine a field consistent with the target field name in the to-be-detected database as a to-be-detected field.

[0072] Optionally, the sensitive information detection module 230 is specifically configured to:

[0073] For each to-be-detected data, it is detected whether the to-be-detected data satisfies the field data rule, and if yes, the to-be-detected data is determined as suspected sensitive data.

[0074] Optionally, the device further comprises a desensitized data checking module configured to: ​

[0075] After identifying the data to be detected that meets the field data rules as suspected sensitive data, the target de-identification processing system for the suspected sensitive data is determined. If the target de-identification processing system is marked as a reliable de-identification system, the suspected sensitive data is determined as de-identified data.

[0076] Optionally, the device further includes a sensitivity level determination module, used for:

[0077] After identifying the data to be detected that meets the field data rules as suspected sensitive data, the sensitivity level of the suspected sensitive data is determined based on the degree of matching between the suspected sensitive data and the field data rules, wherein the degree of matching is positively correlated with the sensitivity level.

[0078] Optionally, the device further includes a prompt message sending module, used for:

[0079] After identifying the data to be detected that meets the field data rules as suspected sensitive data, the suspected sensitive data is marked and a sensitive information prompt message is generated and sent to the designated user.

[0080] Optionally, the device further includes a periodic detection module for:

[0081] It periodically receives sensitive information detection commands, triggers sensitive information detection operations, and saves the sensitive information detection results as a detection file.

[0082] Example 3

[0083] Figure 3 This is a structural block diagram of a computer device provided in Embodiment 3 of the present invention, as shown below. Figure 3 As shown, the computer device includes a processor 310, a memory 320, an input device 330, and an output device 340; the number of processors 310 in the computer device can be one or more. Figure 3 Taking a processor 310 as an example; the processor 310, memory 320, input device 330, and output device 340 in a computer device can be connected via a bus or other means. Figure 3 Taking the example of a connection between China and Israel via a bus.

[0084] The memory 320, as a computer readable storage medium, can be used to store software programs, computer executable programs and modules, such as program instructions / modules corresponding to the sensitive information detection method in the embodiments of the present application (for example, the to-be-detected information determination module 210, the to-be-detected data extraction module 220 and the sensitive information detection module 230 in the sensitive information detection device). The processor 310 executes the software programs, instructions and modules stored in the memory 320, thereby performing various function applications and data processing of the computer device, that is, implementing the sensitive information detection method described above.

[0085] The memory 320 can mainly include a program storage area and a data storage area, wherein the program storage area can store an operating system and application programs required by at least one function; the data storage area can store data created according to the use of the terminal and the like. In addition, the memory 320 can include a high-speed random access memory, and can also include a non-volatile memory, such as at least one magnetic disk storage device, a flash memory device, or other non-volatile solid-state memory device. In some examples, the memory 320 can further include a memory remotely arranged with respect to the processor 310, which can be connected to the computer device through a network. Examples of the above network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network and a combination thereof.

[0086] The input device 330 can be used to receive input digital or character information, and generate key signal input related to the user settings and function control of the computer device. The output device 340 can include a display device such as a display screen.

[0087] Embodiment four

[0088] The embodiment four of the present application also provides a storage medium containing computer executable instructions, which, when executed by a computer processor, are used to perform a sensitive information detection method, the method comprising:

[0089] determining a to-be-detected database and a to-be-detected field according to the received sensitive information detection instruction;

[0090] obtaining all to-be-detected data under the to-be-detected field from the to-be-detected database, and obtaining a field data rule of the to-be-detected field;

[0091] determining to-be-detected data meeting the field data rule as suspected sensitive data.

[0092] Of course, the computer executable instructions of the storage medium provided by the embodiment of the present application are not limited to the method operations described above, and can also perform related operations in the sensitive information detection method provided by any embodiment of the present application.

[0093] Through the above description of the embodiments, those skilled in the art can clearly understand that the present application can be realized by means of software and necessary universal hardware, and of course can also be realized by hardware, but in many cases the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product in essence or in the form of a part of the prior art that makes a contribution. The computer software product can be stored in a computer readable storage medium, such as a floppy disk, a read-only memory (ROM), a random access memory (RAM), a FLASH memory, a hard disk, or an optical disk, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in various embodiments of the present application.

[0094] It is worth noting that in the above embodiments of the sensitive information detection device, each unit and module included is only divided according to functional logic, but is not limited to the above division, as long as the corresponding functions can be realized; in addition, the specific names of each functional unit are only for easy mutual differentiation, and do not limit the protection scope of the present application.

[0095] Note that the above are only preferred embodiments of the present application and the technical principles applied. Those skilled in the art will understand that the present application is not limited to the specific embodiments described herein, and those skilled in the art can make various obvious changes, readjustments and substitutions without departing from the scope of the present application. Therefore, although the present application has been described in more detail through the above embodiments, the present application is not limited to the above embodiments, and can include more other equivalent embodiments without departing from the concept of the present application, and the scope of the present application is determined by the scope of the appended claims.

Claims

1. A method for detecting sensitive information, characterized in that, include: The database and fields to be detected are determined based on the received sensitive information detection instructions; All data to be detected under the field to be detected are obtained from the database to be detected, and the field data rules of the field to be detected are obtained, wherein the field data rules are data character composition rules; Data that meets the aforementioned field data rules is identified as potentially sensitive data; The step of determining the database to be detected and the field to be detected based on the received sensitive information detection instruction includes: Receive a sensitive information detection instruction, and extract the target database name and target field name from the sensitive information detection instruction. The sensitive information detection instruction includes at least the database server address, database connection address, username, password, table name, and field name. The database with the same name as the target database is identified as the database to be detected, and the field in the database to be detected that has the same name as the target field is identified as the field to be detected. The field to be detected in the database to be detected is data processed by the sensitive information desensitization processing system. After identifying the data to be detected that meets the aforementioned field data rules as potentially sensitive data, the process includes: Identify the target desensitization system for the suspected sensitive data. If the target desensitization system is marked as a reliable desensitization system, then the suspected sensitive data is identified as desensitized data. After identifying the data to be detected that meets the aforementioned field data rules as suspected sensitive data, the process also includes: The sensitivity level of the suspected sensitive data is determined based on the degree of matching between the suspected sensitive data and the field data rules, and the degree of matching is positively correlated with the sensitivity level.

2. The sensitive information detection method according to claim 1, characterized in that, The step of identifying the data to be detected that meets the field data rules as suspected sensitive data includes: For each piece of data to be detected, check whether the data meets the field data rules. If it does, the data to be detected is identified as suspected sensitive data.

3. The sensitive information detection method according to claim 1, characterized in that, After identifying the data to be detected that meets the aforementioned field data rules as suspected sensitive data, the process also includes: The suspected sensitive data is marked, and a sensitive information alert message is sent to the designated user.

4. The sensitive information detection method according to claim 1, characterized in that, The method further includes: It periodically receives sensitive information detection commands, triggers sensitive information detection operations, and saves the sensitive information detection results as a detection file.

5. A sensitive information detection device, characterized in that, include: The module for determining information to be detected is used to determine the database and fields to be detected based on the received sensitive information detection instructions. The data extraction module is used to obtain all data to be detected under the field to be detected from the database to be detected, and to obtain the field data rules of the field to be detected, wherein the field data rules are data character composition rules; The sensitive information detection module is used to identify data to be detected that meets the data rules of the field as suspected sensitive data; The module for determining the information to be detected includes: The unit for extracting the name of the information to be detected is used to receive a sensitive information detection instruction and extract the target database name and target field name from the sensitive information detection instruction. The sensitive information detection instruction includes at least the database server address, database connection address, username, password, table name, and field name. The information to be detected determination unit is used to determine the database with the same name as the target database as the database to be detected, and to determine the field in the database to be detected with the same name as the target field as the field to be detected. The field to be detected in the database to be detected is data processed by the sensitive information desensitization processing system. The device further includes: The de-identified data screening module is used to determine the target de-identification processing system for the suspected sensitive data after identifying the data to be detected that meets the field data rules as suspected sensitive data. If the target de-identification processing system is marked as a reliable de-identification system, the suspected sensitive data is identified as de-identified data. The sensitivity level determination module is used to determine the sensitivity level of suspected sensitive data based on the degree of matching between the suspected sensitive data and the field data rules after identifying the data to be detected that meets the field data rules as suspected sensitive data. The degree of matching is positively correlated with the sensitivity level.

6. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the sensitive information detection method as described in any one of claims 1-4.

7. A storage medium containing computer-executable instructions, characterized in that, The computer-executable instructions, when executed by a computer processor, are used to perform the sensitive information detection method as described in any one of claims 1-4.

Images