A data processing method and device, electronic equipment and storage medium

Abstract

The application discloses a data processing method and device, electronic equipment and storage medium. The application respectively performs desensitization processing and encryption processing on the to-be-processed data in each system to obtain desensitized data and encrypted data, and establishes a corresponding relationship among the identification information of the to-be-processed data, the to-be-processed data, the desensitized data and the encrypted data. The same desensitization algorithm is used when performing the desensitization processing, so that the desensitized data corresponding to the same plaintext data in each system is the same, and therefore the matching and interaction of the plaintext data between different systems can be realized based on the desensitized data. According to the above corresponding relationship, the encrypted data corresponding to the desensitized data can be obtained, so that data restoration is realized, and the plaintext data use scenario is met. In addition, different encryption algorithms or encryption keys are used to perform the encryption processing on the to-be-processed data in each system when performing the encryption processing, so that even if a certain key is leaked, the data of other systems is still safe.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data security, and in particular to a data processing method and device, electronic equipment and storage medium. BACKGROUND

[0002] In the field of data security, some business scenarios need to use plaintext data, for example, in order to meet regulatory requirements, plaintext data needs to be provided to relevant units. Some scenarios also need to protect the privacy of data, that is, to hide the true value of the data. Data processing generally includes data desensitization processing and data encryption processing. The data after desensitization processing cannot be restored and is suitable for scenarios where data privacy needs to be protected. The data after encryption processing can be decrypted and restored and is suitable for scenarios where plaintext data needs to be used.

[0003] The related art has the following problems. On the one hand, the data after desensitization processing cannot be restored and cannot meet the plaintext data usage scenario. On the other hand, there is matching and interaction of plaintext data between different systems. In order to avoid the problem that the encryption fields of different systems are inconsistent and the operations such as adding, deleting, modifying and querying fail due to information differences, different systems will use the same key to encrypt the data. Once the key is leaked, the data of each system is at risk of exposure. SUMMARY

[0004] The embodiments of the present application provide a data processing method, device, electronic equipment and storage medium to provide a data processing scheme that can support the demand for corresponding plaintext data in necessary scenarios and reduce the risk of exposure of data of each system.

[0005] The embodiments of the present application provide a data processing method, which comprises:

[0006] Obtaining the to-be-processed data in each system;

[0007] Desensitizing the to-be-processed data in each system by using the same desensitization algorithm, encrypting the to-be-processed data in each system by using different encryption algorithms or encryption keys, obtaining the desensitized data and encrypted data corresponding to the to-be-processed data, and establishing the correspondence between the identification information of the to-be-processed data, the desensitized data and the encrypted data;

[0008] When receiving a data query instruction, querying the data according to the established correspondence in each system.

[0009] Further, the data query according to the established correspondence in each system when receiving a data query instruction comprises:

[0010] For each of the systems, when receiving the desensitization data query instruction of the system, the desensitization data corresponding to the first identification information of the to-be-queried data in the system is queried according to the first identification information carried in the desensitization data query instruction.

[0011] Further, the data query according to the established correspondence in each of the systems when receiving the data query instruction comprises:

[0012] For each of the systems, when receiving the encryption data query instruction of the system, the encryption data corresponding to the second identification information of the to-be-queried data in the system is queried according to the second identification information carried in the encryption data query instruction.

[0013] Further, the data query according to the established correspondence in each of the systems when receiving the data query instruction comprises:

[0014] When receiving the cross-system association query instruction, the desensitization data corresponding to the third identification information of the to-be-queried data in the relevant system is queried according to the third identification information carried in the cross-system association query instruction, and the encryption data corresponding to the desensitization data is queried as the primary key.

[0015] Further, the method further comprises:

[0016] After the encryption data is queried, the encryption data is decrypted according to the encryption key and the decryption key corresponding to each of the systems pre-stored, to obtain the plaintext data corresponding to the encryption data.

[0017] On the other hand, an embodiment of the present application provides a data processing device, the device comprises:

[0018] The acquisition module is configured to acquire to-be-processed data in each of the systems.

[0019] The data processing module is configured to desensitize the to-be-processed data in each of the systems by using the same desensitization algorithm, encrypt the to-be-processed data in each of the systems by using different encryption algorithms or encryption keys, to obtain desensitization data and encryption data corresponding to the to-be-processed data, and establish a correspondence between the identification information of the to-be-processed data, the desensitization data and the encryption data.

[0020] The query module is configured to query data according to the established correspondence in each of the systems when receiving a data query instruction.

[0021] Further, the query module is specifically configured to, for each system, when receiving a de-identified data query instruction of the system, query, according to first identification information of to-be-queried data carried in the de-identified data query instruction, de-identified data corresponding to the first identification information in the system.

[0022] Further, the query module is specifically configured to, for each system, when receiving an encrypted data query instruction of the system, query, according to second identification information of to-be-queried data carried in the encrypted data query instruction, encrypted data corresponding to the second identification information in the system.

[0023] Further, the query module is specifically configured to, when receiving a cross-system association query instruction, query, according to third identification information of to-be-queried data carried in the cross-system association query instruction, de-identified data corresponding to the third identification information in a related system, and query, taking the de-identified data as a primary key, corresponding encrypted data.

[0024] Further, the device further comprises:

[0025] The decryption module is configured to, after querying the encrypted data, perform decryption processing on the encrypted data according to pre-stored encryption keys and decryption keys corresponding to each system, to obtain plaintext data corresponding to the encrypted data.

[0026] In another aspect, an embodiment of the present application provides an electronic device, comprising a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete communication with each other through the communication bus.

[0027] The memory is used to store a computer program.

[0028] The processor is used to execute the program stored on the memory, and implement the method steps of any one of the above aspects.

[0029] In another aspect, an embodiment of the present application provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the method steps of any one of the above aspects.

[0030] This invention provides a data processing method, apparatus, electronic device, and storage medium. The method includes: acquiring data to be processed from various systems; performing desensitization processing on the data to be processed in each system using the same desensitization algorithm, and encrypting the data to be processed in each system using different encryption algorithms or encryption keys to obtain desensitized data and encrypted data corresponding to the data to be processed; establishing a correspondence between the identification information of the data to be processed, the desensitized data, and the encrypted data; and performing a data query based on the established correspondence in each system when a data query instruction is received.

[0031] The above technical solution has the following advantages or beneficial effects:

[0032] In this embodiment of the invention, the data to be processed in each system is subjected to both de-identification and encryption processing to obtain de-identified and encrypted data, and a correspondence is established between the identification information of the data to be processed, the de-identified data, and the encrypted data. The same de-identification algorithm is used during the de-identification process, ensuring that the de-identified data corresponding to the same plaintext data in each system is identical. Therefore, matching and interaction of plaintext data between different systems can be achieved based on the de-identified data. The encrypted data corresponding to the de-identified data can be obtained based on the above correspondence, thereby achieving data restoration and meeting the needs of plaintext data usage scenarios. Furthermore, different encryption algorithms or encryption keys are used to encrypt the data to be processed in each system during the encryption process. Even if one key is leaked, the data in other systems remains secure, minimizing the risk of data exposure. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is a schematic diagram of the data processing process provided in an embodiment of the present invention;

[0035] Figure 2 A data processing architecture diagram provided for embodiments of the present invention;

[0036] Figure 3 This is a schematic diagram of the data processing device structure provided in an embodiment of the present invention;

[0037] Figure 4 This is a schematic diagram of the electronic device structure provided in an embodiment of the present invention. Detailed Implementation

[0038] The application will be described in further detail below with reference to the drawings, it is obvious that the described embodiments are only a part of the embodiments of the application, but not all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative work belong to the protection scope of the application.

[0039] Figure 1 A data processing process schematic diagram provided by the embodiments of the application, the process includes the following steps:

[0040] S101: obtaining the to-be-processed data in each system.

[0041] S102: adopting the same desensitization algorithm to perform desensitization processing on the to-be-processed data in each system, adopting different encryption algorithms or encryption keys to perform encryption processing on the to-be-processed data in each system, obtaining the desensitization data and the encryption data corresponding to the to-be-processed data, and establishing the corresponding relationship between the identification information of the to-be-processed data, the desensitization data and the encryption data.

[0042] S103: when receiving a data query instruction, performing data query according to the established corresponding relationship in each system.

[0043] The data processing method provided by the embodiments of the application is applied to an electronic device, which can be a PC, a tablet computer and the like, or a server.

[0044] The server first acquires the to-be-processed data in each system. The to-be-processed data can be a customer's bank card number, ID number, mobile phone number, bank card balance, and the like. After the electronic device acquires the to-be-processed data, the to-be-processed data is subjected to desensitization processing and encryption processing. Specifically, the same desensitization algorithm is used to desensitize the to-be-processed data in each system, so that the desensitized data corresponding to the same to-be-processed data in each system is the same. The desensitization algorithm can be a substitution method: a fictitious data is used to replace a true value. For example, a larger virtual value data table is established, a random seed is generated for each real value record, and the original data content is subjected to hash mapping replacement. An invalidation method: NULL or ***** is used to replace a true value or a part of the true value, such as masking the last 12 digits of a credit card number. A permutation method: the value of the to-be-processed data is randomly redistributed. An offset method: a number data is changed by random shifting to achieve the purpose of data desensitization. It should be noted that the above desensitization algorithm is only for illustration, and the desensitization algorithm provided in the embodiment of the present application includes but is not limited to the above example. The SM3 algorithm is used for desensitization processing. Preferably, in order to protect the privacy of the data, a desensitization algorithm that is difficult to restore is used to desensitize the to-be-processed data in each system to obtain the desensitized data corresponding to the to-be-processed data, for example, the SM3 algorithm is used. As long as the same desensitization algorithm is used to desensitize the to-be-processed data in each system.

[0045] In order to avoid key leakage, the data of each system is at risk of exposure. In the embodiment of the present application, different encryption algorithms or encryption keys are used to encrypt the to-be-processed data in each system. Thus, each system has an independent encryption algorithm or encryption / decryption key pair. Even if the key of a certain system is leaked, the data of other systems cannot be decrypted, ensuring the security of the data of other systems. The encryption algorithm can be a symmetric encryption algorithm AES. The AES key has a short establishment time, good sensitivity, and low memory requirement. In actual use, the working mode is CTR, which requires the introduction of an IV parameter (a 16-bit byte array). The key length is 128 / 192 / 256, and 192 and 256 require a no-policy-restriction permission file (JDK6). The most commonly used padding modes are PKCS5Padding and PKCS7Padding. The encryption algorithm can also be an asymmetric encryption algorithm, such as the DH algorithm, the RSA algorithm, the DSA algorithm, and the elliptic curve algorithm (EC). The encryption algorithm is not limited in the embodiment of the present application, as long as different encryption algorithms are used in different systems or different encryption keys are used.

[0046] After the desensitization processing and the encryption processing are respectively performed on the to-be-processed data in each system to obtain the desensitized data and the encrypted data corresponding to the to-be-processed data, a corresponding relationship between the identification information of the to-be-processed data, the to-be-processed data, the desensitized data and the encrypted data is established. It should be noted that, for each system, the corresponding relationship between the identification information of the to-be-processed data, the to-be-processed data, the desensitized data and the encrypted data in the system is established. The to-be-processed data is, for example, data such as a bank card number, an ID card number, a mobile phone number, a bank card balance and the like of a customer, and the identification information of the to-be-processed data is, for example, name information of the customer.

[0047] After the above corresponding relationship is established for each system, when a data query instruction is received, data query is performed according to the established corresponding relationship in each system. The process of data query is described in detail below.

[0048] I. Desensitized data query in a single system

[0049] The data query according to the established corresponding relationship in each system includes:

[0050] For each system, when a desensitized data query instruction of the system is received, desensitized data corresponding to first identification information of to-be-queried data carried in the desensitized data query instruction is queried in the system.

[0051] In the embodiment of the application, the electronic device can provide a desensitized data query window or a desensitized data query API interface for each system. The desensitized data query instruction is received through the desensitized data query window or the desensitized data query API interface, and the desensitized data query instruction carries first identification information of to-be-queried data. After the electronic device receives the desensitized data query instruction, the first identification information of to-be-queried data carried in the desensitized data query instruction is obtained, and then the desensitized data corresponding to the first identification information is queried according to the corresponding relationship between the identification information of the to-be-processed data and the desensitized data.

[0052] The desensitized data query in a single system is described below through an example.

[0053] Taking system A as an example, the corresponding relationship between the identification information of the to-be-processed data, the desensitized data and the encrypted data established in system A is shown in Table 1 as follows:

[0054] Identification information of data to be processed De-identified data Encrypted data Zhang San De-identified data A Encrypted data A Li Si De-identified data B Encrypted data B Wang Wu De-identified data C Encrypted data C

[0055] Table 1

[0056] When the electronic device receives the desensitization data query instruction of system A, the first identification information of the data to be queried carried in the desensitization data query instruction is obtained as Zhang San, and the desensitization data corresponding to Zhang San in the table 1 of system A is queried as desensitization data A.

[0057] II. Encryption data query in a single system.

[0058] The data query according to the established correspondence relationship in each system when receiving the data query instruction includes:

[0059] For each system, when receiving the encryption data query instruction of the system, the second identification information of the data to be queried carried in the encryption data query instruction is queried in the system to correspond to the encryption data corresponding to the second identification information.

[0060] In the embodiment of the application, the electronic device can provide an encryption data query window or an encryption data query API interface for each system. The encryption data query instruction is received through the encryption data query window or the encryption data query API interface, and the second identification information of the data to be queried is carried in the encryption data query instruction. After the electronic device receives the encryption data query instruction, the second identification information of the data to be queried carried in the encryption data query instruction is obtained, and then the second identification information corresponding to the encryption data is queried according to the identification information of the data to be processed and the correspondence relationship of the encryption data.

[0061] Take table 1 as an example to illustrate the encryption data query in a single system.

[0062] When the electronic device receives the encryption data query instruction of system A, the second identification information of the data to be queried carried in the encryption data query instruction is obtained as Li Si, and the encryption data corresponding to Li Si in the table 1 of system A is queried as encryption data B.

[0063] III. Cross-system association query.

[0064] The data query according to the established correspondence relationship in each system when receiving the data query instruction includes:

[0065] When the cross-system association query instruction is received, the third identification information of the data to be queried carried in the cross-system association instruction is queried in the related system to correspond to the desensitization data, and the corresponding encryption data is queried as the primary key of the desensitization data.

[0066] In the embodiment of the present application, the electronic device can provide an associated query window or an associated query API interface for each system. The cross-system associated query instruction is received through the associated query window or the associated query API interface, and the cross-system associated query instruction carries third identification information of data to be queried and identification information of the system. After receiving the cross-system associated query instruction, the electronic device obtains the third identification information of the data to be queried and the identification information of the system carried in the cross-system associated query instruction, and then queries the desensitization data corresponding to the third identification information according to the correspondence between the identification information of the data to be processed and the desensitization data and the encrypted data. Then, the corresponding encrypted data is queried across the systems with the desensitization data as the primary key.

[0067] The cross-system associated query is described below through an example.

[0068] The electronic device receives the cross-system associated query instruction, and the identification information of the system carried in the cross-system associated query instruction is the identification information of system A and the identification information of system B, which indicates that the associated query is performed between system A and system B. The third identification information of the data to be queried carried in the cross-system associated query instruction is Wang Wu.

[0069] The correspondence between the identification information of the data to be processed, the desensitization data and the encrypted data established in system A is shown in Table 1.

[0070] The correspondence between the identification information of the data to be processed, the desensitization data and the encrypted data established in system B is shown in Table 2.

[0071] Identification information of data to be processed De-identified data Encrypted data Zhang San De-identified data A Encrypted data M Li Si De-identified data B Encrypted data N Wang Wu De-identified data C Encrypted data Q

[0072] Table 2

[0073] According to the third identification information of the data to be queried carried in the cross-system associated instruction, the desensitization data corresponding to the third identification information is desensitization data C in system A and system B. The corresponding encrypted data is encrypted data C and encrypted data Q respectively with the desensitization data C as the primary key.

[0074] After the encrypted data is queried, the encrypted data is decrypted according to the pre-stored encrypted key and decryption key corresponding to each system, and the plaintext data corresponding to the encrypted data is obtained.

[0075] To avoid key leakage and the risk of data exposure in each system, this invention employs different encryption algorithms or keys to encrypt the data to be processed in each system. For each system, after encrypting the data using the corresponding encryption algorithm or key, the decryption key for that system is saved. Thus, each system has an independent encryption / decryption key pair. Upon retrieving the encrypted data from that system, the decryption key saved by that system is used to decrypt the encrypted data, obtaining the corresponding plaintext data. This plaintext data is then used for subsequent plaintext data utilization.

[0076] The data processing solution provided in this invention combines de-identification and encryption technologies. The system stores both de-identified and encrypted data simultaneously. De-identified data can be prioritized for business operation scenarios, while plaintext data can be obtained by decrypting the encrypted data when plaintext data is needed. A unified de-identification algorithm ensures the consistency of de-identified data across systems, and the de-identified data obtained by the algorithm can be used for querying and related retrieval. Differentiated encryption algorithms effectively ensure data security (even if the key is leaked, the impact can be controlled within a certain range) while meeting the daily business needs for plaintext data. Furthermore, all user requests for plaintext data are recorded, facilitating data security monitoring.

[0077] On the one hand, if multiple systems within an entity or multiple systems of different entities need to communicate sensitive data, the same desensitization algorithm should be used to desensitize the same sensitive data or data that needs to be desensitized and encrypted, and the desensitized data should be used as the main operation key. The desensitization algorithm can uniformly use the national cryptographic SM3 algorithm, with or without salting, but salting is recommended for safety. At this point, since the anonymized data within the same entity uses the same anonymization algorithm, the values ​​are identical. This allows for communication between internal and external systems without information discrepancies. A unified search field can be used in scenarios where queries, related searches, or where the anonymized data meets viewing requirements. Furthermore, because irreversible anonymization is used, privacy is effectively protected during communication, thus resolving the issue of inconsistent anonymized data across multiple systems. On the other hand, daily business operations may require the use of plaintext data. In such cases, if the data is anonymized, the bank cannot pinpoint the specific card number or associate it with a specific individual, necessitating the use of plaintext data. Here, with unified anonymized data already available, each system can employ different encryption algorithms or keys for personalized encryption and provide corresponding plaintext data access APIs. These APIs receive the anonymized data, the backend associates it with the encrypted data, decrypts it, and returns the plaintext data. This supports the need for plaintext data in necessary business scenarios, and all related requests record user request information. The use of differentiated encryption algorithms or keys by each system effectively avoids the risk of large-scale data leaks that could result from key disclosure.

[0078] Figure 2 This is a data processing architecture diagram provided in an embodiment of the present invention. Figure 2 The data processing procedure is illustrated using System 1 and System 2 as examples. Figure 2 As shown, sensitive plaintext data is first stored in System 1 and System 2. System 1 and System 2 apply the same de-identification algorithm to the plaintext data, while simultaneously applying different encryption algorithms to encrypt the plaintext data, resulting in de-identified and encrypted data respectively. The same plaintext data is stored in two fields: the de-identified data and the encrypted data. When systems need to use plaintext data, they can use the de-identified data as the primary key for queries within each system. Simultaneously, they can use the system's decryption key to decrypt the encrypted data stored within that system to obtain the plaintext data. When cross-system queries are required, the stored de-identified data can be used as the primary key for inter-system joins, thus avoiding the use of plaintext data and ensuring data security.

[0079] Figure 3 This is a schematic diagram of a data processing device provided in an embodiment of the present invention. The device includes:

[0080] The acquisition module 31 is used to acquire data to be processed from various systems;

[0081] Data processing module 32 is used to perform desensitization processing on the data to be processed in each system using the same desensitization algorithm, and to perform encryption processing on the data to be processed in each system using different encryption algorithms or encryption keys, so as to obtain desensitized data and encrypted data corresponding to the data to be processed; and to establish the correspondence between the identification information of the data to be processed, the desensitized data and the encrypted data;

[0082] The query module 33 is used to perform data query based on the established correspondence in each system when a data query instruction is received.

[0083] The query module 33 is specifically used to, for each system, when receiving a de-identified data query instruction from the system, query the de-identified data corresponding to the first identifier information carried in the de-identified data query instruction in the system.

[0084] The query module 33 is specifically used to, for each system, when receiving an encrypted data query instruction from the system, query the encrypted data corresponding to the second identifier information of the data to be queried carried in the encrypted data query instruction.

[0085] The query module 33 is specifically configured to, when receiving a cross-system association query instruction, query, according to third identification information of to-be-queried data carried in the cross-system association instruction, desensitization data corresponding to the third identification information in a related system, and query corresponding encrypted data by taking the desensitization data as a primary key.

[0086] The device further includes:

[0087] The decryption module 34 is configured to, after querying the encrypted data, perform decryption processing on the encrypted data according to pre-stored encryption keys and decryption keys corresponding to each system, to obtain plaintext data corresponding to the encrypted data.

[0088] The electronic device provided in the embodiment of the application is specifically as shown in the accompanying drawings and includes a processor 301, a communication interface 302, a memory 303, and a communication bus 304, wherein the processor 301, the communication interface 302, and the memory 303 complete mutual communication through the communication bus 304. Figure 4

[0089] The memory 303 stores a computer program, and when the program is executed by the processor 301, the processor 301 performs the following steps:

[0090] Obtain to-be-processed data in each system;

[0091] Desensitize the to-be-processed data in each system by using the same desensitization algorithm, encrypt the to-be-processed data in each system by using different encryption algorithms or encryption keys, to obtain desensitization data and encrypted data corresponding to the to-be-processed data, and establish a corresponding relationship between identification information of the to-be-processed data, the desensitization data, and the encrypted data;

[0092] When receiving a data query instruction, perform data query according to the established corresponding relationship in each system.

[0093] Based on the same inventive concept, the embodiment of the application further provides an electronic device, and since the principle of the electronic device for solving the problem is similar to the data processing method, the implementation of the electronic device can be referred to the implementation of the method, and the repeated parts will not be described herein.

[0094] The electronic device provided in the embodiment of the application can be specifically a desktop computer, a portable computer, a smart phone, a tablet computer, a personal digital assistant (PDA), a network side device, or the like.

[0095] ​The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For the convenience of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0096] The communication interface 302 is used for communication between the above electronic device and other devices.

[0097] The memory can include a Random Access Memory (RAM) and can also include a Non-Volatile Memory (NVM), such as at least one disk memory. Optionally, the memory can also be at least one storage device located away from the aforementioned processor.

[0098] The processor mentioned above can be a general-purpose processor, including a central processing unit, a network processor (NP), etc.; can also be a Digital Signal Processing (DSP), an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc.

[0099] The embodiment of the present application also provides a computer storage readable storage medium, the computer readable storage medium stores a computer program executable by an electronic device, when the program runs on the electronic device, makes the electronic device execute the following steps:

[0100] Obtaining to-be-processed data in each system;

[0101] The to-be-processed data in each system is desensitized by using the same desensitization algorithm, and the to-be-processed data in each system is encrypted by using different encryption algorithms or encryption keys, to obtain desensitized data and encrypted data corresponding to the to-be-processed data; and a corresponding relationship between the identification information of the to-be-processed data, the desensitized data and the encrypted data is established;

[0102] When receiving a data query instruction, data query is performed according to the established corresponding relationship in each system.

[0103] Based on the same inventive concept, the embodiment of the present application also provides a computer readable storage medium, since the principle of solving problems of the processor in executing the computer program stored on the computer readable storage medium is similar to the data processing method, therefore, the implementation of the processor in executing the computer program stored on the computer readable storage medium can be referred to the implementation of the method, and the repeated parts will not be described herein.

[0104] The computer readable storage medium described above can be any available medium or data storage device accessible by the processor in the electronic device, including but not limited to magnetic memories such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc., optical memories such as CDs, DVDs, BDs, HVDs, etc., and semiconductor memories such as ROMs, EPROMs, EEPROMs, non-volatile memories (NAND FLASH), solid state disks (SSD), etc.

[0105] The present application is described with reference to flowcharts and / or block diagrams of the method, device (system), and computer program product according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and the combination of the flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device that implements the flow Figure 1 The function specified in one flow or multiple flows and / or blocks. Figure 1 The function specified in one flow or multiple flows and / or blocks.

[0106] These computer program instructions can also be stored in a computer readable memory capable of guiding the computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer readable memory produce a product including instruction devices, which implement the flow Figure 1 The function specified in one flow or multiple flows and / or blocks. Figure 1 The function specified in one flow or multiple flows and / or blocks.

[0107] These computer program instructions can also be loaded into the computer or other programmable data processing device, so that a series of operation steps are performed on the computer or other programmable device to produce a computer implemented process, so that the instructions executed on the computer or other programmable device provide a process for implementing the flow Figure 1 The function specified in one flow or multiple flows and / or blocks. Figure 1 The function specified in one flow or multiple flows and / or blocks.

[0108] While the preferred embodiments of the application have been described, additional variations and modifications can be made to these embodiments by those skilled in the art once they have the benefit of the present disclosure without departing from the spirit and scope of the application. Accordingly, it is intended that the appended claims include all such modifications and variations as fall within the scope of the present application.

[0109] It is apparent that those skilled in the art can make various changes and modifications to the application without departing from the spirit and scope of the application. It is therefore intended that the present application cover all such changes and modifications that are within its scope.

Claims

1. A data processing method, characterized by, The method comprises: obtaining to-be-processed data in each system; performing desensitization processing on the to-be-processed data in each system by using the same desensitization algorithm, performing encryption processing on the to-be-processed data in each system by using different encryption algorithms or encryption keys, obtaining desensitized data and encrypted data corresponding to the to-be-processed data, and establishing a corresponding relationship between identification information of the to-be-processed data, the desensitized data and the encrypted data; when receiving a data query instruction, performing data query according to the established corresponding relationship in each system; the data query according to the established corresponding relationship in each system when receiving the data query instruction comprises: when receiving a cross-system association query instruction, querying desensitized data corresponding to third identification information of to-be-queried data carried in the cross-system association query instruction in a related system, and querying corresponding encrypted data by taking the desensitized data as a primary key.

2. The method of claim 1, wherein, the data query according to the established corresponding relationship in each system when receiving the data query instruction comprises: for each system, when receiving a desensitized data query instruction of the system, querying desensitized data corresponding to first identification information of to-be-queried data carried in the desensitized data query instruction in the system.

3. The method of claim 1, wherein, the data query according to the established corresponding relationship in each system when receiving the data query instruction comprises: for each system, when receiving an encrypted data query instruction of the system, querying encrypted data corresponding to second identification information of to-be-queried data carried in the encrypted data query instruction in the system.

4. The method of claim 3, wherein, the method further comprises: after querying the encrypted data, performing decryption processing on the encrypted data according to pre-stored encryption keys and decryption keys corresponding to each system, to obtain plaintext data corresponding to the encrypted data.

5. A data processing apparatus, characterized by, The device comprises: an acquisition module configured to obtain to-be-processed data in each system; a data processing module configured to perform desensitization processing on the to-be-processed data in each system by using the same desensitization algorithm, perform encryption processing on the to-be-processed data in each system by using different encryption algorithms or encryption keys, obtain desensitized data and encrypted data corresponding to the to-be-processed data, and establish a corresponding relationship between identification information of the to-be-processed data, the desensitized data and the encrypted data; a query module configured to perform data query according to the established corresponding relationship in each system when receiving a data query instruction. the query module is specifically configured to, when receiving a cross-system association query instruction, query desensitized data corresponding to third identification information of to-be-queried data carried in the cross-system association query instruction in a related system, and query corresponding encrypted data by taking the desensitized data as a primary key.

6. The apparatus of claim 5, wherein, The query module is specifically configured to, for each system, when receiving a desensitization data query instruction of the system, query, according to first identification information of to-be-queried data carried in the desensitization data query instruction, desensitization data corresponding to the first identification information in the system.

7. The apparatus of claim 5, wherein, The query module is specifically configured to, for each system, when receiving an encryption data query instruction of the system, query, according to second identification information of to-be-queried data carried in the encryption data query instruction, encryption data corresponding to the second identification information in the system.

8. The apparatus of claim 7, wherein, The device further comprises: The decryption module is configured to, after querying the encryption data, perform decryption processing on the encryption data according to the encryption key and the decryption key corresponding to each system and previously stored, to obtain plaintext data corresponding to the encryption data.

9. An electronic device, comprising: The device comprises a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory complete mutual communication through the communication bus. The memory is configured to store a computer program. The processor is configured to execute the program stored on the memory, to implement the method steps in any one of claims 1-4.

10. A computer-readable storage medium, characterized in that, The computer program is stored in the computer readable storage medium, and the computer program is executed by the processor to implement the method steps in any one of claims 1-4.

Images