SQL statement desensitization method, device and equipment and computer readable storage medium

Abstract

Embodiments of the present application provide a SQL statement desensitization method, device, equipment and computer readable storage medium, the method comprises: obtaining a target SQL statement to be processed; determining the target desensitization rule corresponding to the target SQL statement from the candidate desensitization rule according to the comparison result of the target SQL statement and the preset candidate desensitization rule; processing the target SQL statement according to the target desensitization rule to obtain a desensitized SQL statement; and sending the desensitized SQL statement to a preset database for processing. The technical scheme provided by the embodiments of the present application matches the SQL statement with the preset candidate desensitization rule automatically, thereby obtaining the corresponding target desensitization rule, so that the desensitization processing can be automatically performed on different SQL statements using the corresponding desensitization rule, and the desensitized SQL statement is executed, which improves the security of the SQL statement and ensures the writing efficiency of the SQL statement.

Description

Technical Field

[0001] This application relates to the field of data desensitization technology, specifically to a method, apparatus, device, and computer-readable storage medium for desensitizing SQL statements. Background Technology

[0002] SQL statements are a structured language used to manipulate databases, including updating, adding, and deleting data. The security of SQL statements directly impacts the security of the data within the database.

[0003] However, the current SQL statement masking rules are relatively simple and still have certain security issues. But if complex masking rules are configured, the user's writing requirements are high, the statement writing is not convenient, and the writing efficiency is low. Summary of the Invention

[0004] This application provides a method, apparatus, device, and computer-readable storage medium for de-identifying SQL statements, aiming to solve the technical problem that existing SQL statement de-identification methods cannot simultaneously meet the requirements of security and efficiency.

[0005] On the one hand, embodiments of this application provide a method for de-identifying SQL statements, including:

[0006] Retrieve the target SQL statement to be processed;

[0007] Based on the comparison results between the target SQL statement and the preset candidate de-identification rules, the target de-identification rule corresponding to the target SQL statement is determined from the candidate de-identification rules;

[0008] The target SQL statement is processed according to the target de-identification rules to obtain the de-identified SQL statement;

[0009] The de-identified SQL statement is sent to a preset database for processing.

[0010] The process of determining the target de-identification rule from the candidate de-identification rules based on the comparison results between the target SQL statement and the preset candidate de-identification rules includes:

[0011] The target SQL statement is parsed to determine the target characters within it;

[0012] The character attributes of the target character are matched with the processing attributes of the preset candidate desensitization rules to determine the target desensitization rule corresponding to each target character in the target SQL statement.

[0013] As a feasible embodiment of this application, the step of parsing the target SQL statement and determining the target characters in the target SQL statement includes:

[0014] Lexical analysis is performed on the target SQL statement to determine the type of each character in the target SQL statement; the type includes at least one of keywords, expressions, literals, and operators.

[0015] The target SQL statement is parsed based on the type of each character in the target SQL statement to determine the target character in the target SQL statement.

[0016] As a feasible embodiment of this application, before matching the character attributes of the target character with the processing attributes of preset candidate de-identification rules to determine the target de-identification rule corresponding to each target character in the target SQL statement, the method further includes:

[0017] Based on the digest algorithm selected on the preset configuration page, generate the first desensitization rule, and set the table name and column name as the processing attributes corresponding to the first desensitization rule;

[0018] Based on the encryption algorithm selected on the preset configuration page, a second de-identification rule is generated, and the table value is set as the processing attribute corresponding to the second de-identification rule;

[0019] Set the first desensitization rule and the second desensitization rule as the preset candidate desensitization rules.

[0020] As a feasible embodiment of this application, before determining the target desensitization rule corresponding to the target SQL statement from the candidate desensitization rules based on the comparison result between the target SQL statement and the preset candidate desensitization rules, the method further includes:

[0021] Based on the user identification information corresponding to the target SQL statement, obtain the de-identification rule database corresponding to the user identification information;

[0022] Set the desensitization rules in the desensitization rule database as the preset candidate desensitization rules.

[0023] As a feasible embodiment of this application, after sending the de-identified SQL statement to a preset database for processing, the method further includes:

[0024] The target de-identification rule is associated with the de-identified characters in the de-identification SQL statement and written into the preset database. When the target de-identification rule is updated to an update de-identification rule, the de-identified characters in the preset database are updated according to the target de-identification rule and the update de-identification rule.

[0025] As a feasible embodiment of this application, after sending the de-identified SQL statement to a preset database for processing, the method further includes:

[0026] If the target SQL statement is a query statement, then obtain the de-identified query result returned by the preset database and the character attribute corresponding to the de-identified query result;

[0027] Determine the restoration desensitization rule corresponding to the desensitization query result based on the character attributes corresponding to the desensitization query result;

[0028] The desensitized query results are processed according to the desensitization rules, and the target query results are output.

[0029] On the other hand, embodiments of this application also provide an SQL statement de-identification device, comprising:

[0030] The acquisition module is used to acquire the target SQL statement to be processed.

[0031] The comparison module is used to determine the target de-identification rule corresponding to the target SQL statement from the candidate de-identification rules based on the comparison result between the target SQL statement and the preset candidate de-identification rules;

[0032] The de-identification module is used to process the target SQL statement according to the target de-identification rules to obtain the de-identified SQL statement;

[0033] The processing module is used to send the de-identified SQL statement to a preset database for processing;

[0034] The process of determining the target de-identification rule from the candidate de-identification rules based on the comparison results between the target SQL statement and the preset candidate de-identification rules includes:

[0035] The target SQL statement is parsed to determine the target characters within it;

[0036] The character attributes of the target character are matched with the processing attributes of the preset candidate desensitization rules to determine the target desensitization rule corresponding to each target character in the target SQL statement.

[0037] On the other hand, this application embodiment also provides an SQL statement de-identification device, which includes a processor, a memory, and an SQL statement de-identification program stored in the memory and executable on the processor. The processor executes the SQL statement de-identification program to implement the steps in the above-described SQL statement de-identification method.

[0038] On the other hand, embodiments of this application also provide a computer-readable storage medium storing an SQL statement de-identification program, which is executed by a processor to implement the steps in the SQL statement de-identification method described above.

[0039] The SQL statement desensitization method provided in this application automatically matches the SQL statement with preset candidate desensitization rules after obtaining the user-written SQL statement, thereby obtaining the corresponding target desensitization rule. This enables automatic desensitization processing of different SQL statements using the corresponding desensitization rules and execution of the desensitized SQL statement, which improves the security of the SQL statement while ensuring the efficiency of writing the SQL statement. Attached Figure Description

[0040] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0041] Figure 1 A schematic diagram illustrating an implementation scenario of an SQL statement de-identification method provided in this application embodiment;

[0042] Figure 2 This application provides a flowchart illustrating the steps of an SQL statement de-identification method.

[0043] Figure 3 This application provides a schematic flowchart illustrating the steps for determining target desensitization rules in an embodiment of the present application.

[0044] Figure 4 This application provides a flowchart illustrating the steps for parsing a statement to obtain target characters.

[0045] Figure 5 This application provides a schematic flowchart illustrating the steps for configuring candidate de-identification rules.

[0046] Figure 6 This is a flowchart illustrating the steps of configuring target de-identification rules based on user identifiers in an embodiment of this application.

[0047] Figure 7 A flowchart illustrating the steps for updating the database based on the updated target de-identification rules provided in this application embodiment;

[0048] Figure 8 A flowchart illustrating the steps for restoring query results based on a query SQL statement, as provided in an embodiment of this application.

[0049] Figure 9 This is a schematic diagram of the structure of an SQL statement de-identification device provided in an embodiment of this application;

[0050] Figure 10 This is a schematic diagram of the structure of an SQL statement de-identification device provided in an embodiment of this application. Detailed Implementation

[0051] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of the present invention.

[0052] In this application, the term "exemplary" is used to mean "used as an example, illustration, or description." Any embodiment described as "exemplary" in this application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to implement and use the invention. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that the invention can be implemented without using these specific details. In other instances, well-known structures and processes will not be described in detail to avoid obscuring the description of the invention with unnecessary detail. Therefore, the invention is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed in the embodiments of this application.

[0053] This application provides a method, apparatus, device, and computer-readable storage medium for de-identifying SQL statements, which will be described in detail below.

[0054] In this embodiment, the SQL statement masking method is deployed as a program on the SQL statement masking device. The SQL statement masking device is installed in the SQL statement masking device as a processor. The SQL statement masking device in the SQL statement masking device executes the following steps by running the program corresponding to the SQL statement masking method:

[0055] like Figure 1 As shown, Figure 1This is a schematic diagram illustrating an implementation scenario of an SQL statement desensitization method provided in this application embodiment. The implementation scenario includes an SQL statement desensitization device 100, a rule configuration library 200, and a database 300. The SQL statement desensitization device 100 is mainly used to acquire SQL statements input by users through any input method such as keyboard and mouse input, touch input, or voice input. This SQL statement is the target SQL statement to be processed. It interacts with the rule configuration library 200 to obtain the target desensitization rules corresponding to the target SQL statement, thereby completing the desensitization processing of the target SQL statement, obtaining the desensitized SQL statement, and finally sending the desensitized SQL statement to the corresponding database 300 so that the database 300 executes the desensitized SQL statement, thus completing the entire SQL statement desensitization and execution process.

[0056] It should be noted that, Figure 1 The scenario diagram of the SQL statement desensitization method provided is merely an example. The scenario of the SQL statement desensitization method described in this application embodiment is to more clearly illustrate the technical solution of this application embodiment and does not constitute a limitation on the technical solution provided in this application embodiment.

[0057] Based on the above schematic diagram of the implementation scenario of the SQL statement desensitization method, a specific implementation method of the SQL statement desensitization method is proposed.

[0058] like Figure 2 As shown, Figure 2 This is a flowchart illustrating the steps of an SQL statement de-identification method provided in an embodiment of this application. The SQL statement de-identification method in this embodiment includes steps 201-204:

[0059] 201, retrieve the target SQL statement to be processed.

[0060] In this embodiment of the application, SQL statements refer to a structured language used by programmers to manipulate databases, typically involving updating, adding, and deleting data in the database. Examples include:

[0061] Create a new table: create table tabname(col1 type1[not null][primary key],col2type2[not null],..);

[0062] Add a column: `ALTER TABLE tabname ADD COLUMN col type;`

[0063] Deleting a primary key: `Alter table tabname drop primary key(col)`;

[0064] Create an index: create[unique]index idxname on tabname(col….);

[0065] Update: update table1 set field1 = value1 where range;

[0066] Search: select * from table1 where field1 like '%value1%' etc.

[0067] In addition, SQL statements can also involve statistical analysis of data in the database, for example:

[0068] Sorting: select*from table1 order by field1,field2[desc]

[0069] Sum: select sum(field1)as sumvalue from table1, etc.

[0070] Since SQL statements are common knowledge in the field of program development, the embodiments of this application will not be described in detail here.

[0071] In this embodiment, the target SQL statement to be processed usually refers to the SQL statement input by the user to the SQL statement desensitization device through any input method such as keyboard and mouse input, touch input, or voice input. This embodiment will not be described in detail here.

[0072] 202. Based on the comparison results between the target SQL statement and the preset candidate desensitization rules, determine the target desensitization rule corresponding to the target SQL statement from the candidate desensitization rules.

[0073] In this embodiment, when the SQL statement de-identification device receives the target SQL statement input by the user, it compares the target SQL statement with preset candidate de-identification rules. Based on the comparison result, it selects the target de-identification rule corresponding to the target SQL statement from the candidate rules. There are many types of candidate de-identification rules. For example, candidate de-identification rules may include adding stars to some key information or using preset encryption algorithms or digest algorithms to de-identify the SQL statement. These will not be elaborated further in this embodiment. Specifically, the candidate de-identification rules are stored in the Apollo configuration center.

[0074] Specifically, the comparison here can be a comparison of the attribute information of the target SQL statement with the attribute information pre-configured for the de-identification rules, or it can be achieved by using other information to compare the target SQL statement with the candidate de-identification rules. The embodiments in this application will not be elaborated further here.

[0075] Furthermore, to facilitate subsequent database processing of the masked SQL statements, certain special characters in the target SQL statement, such as operators and logical operators, are not masked. Therefore, as a feasible implementation scheme of this application, the target SQL statement is first parsed to extract the characters that need to be rewritten, and the target masking rule corresponding to the character is determined from the candidate masking rules, thereby completing the rewriting of the target SQL statement. Specific implementation schemes can be found in subsequent sections. Figure 3 And its explanations and descriptions.

[0076] Of course, it is also feasible to perform complete de-identification processing on the target SQL statement. In this case, during the subsequent processing of the de-identified SQL statement by the database, the database also needs to use the restoration rules corresponding to the target de-identification rules to restore the de-identified SQL statement.

[0077] Furthermore, as another optional embodiment of this application, different users can configure different de-identification rule databases to achieve customized de-identification processing. In this case, the target SQL statement obtained by the SQL statement de-identification device will also carry additional user identification information, so as to identify the corresponding de-identification rule database based on the user identification information, and thus use the de-identification rules contained in the de-identification rule database as candidate de-identification rules. For specific implementation schemes, please refer to the following. Figure 6 And its explanations and descriptions.

[0078] 203. Process the target SQL statement according to the target de-identification rules to obtain the de-identified SQL statement.

[0079] In this embodiment of the application, after determining the target desensitization rule from the candidate desensitization rules, the SQL statement desensitization device will use the target desensitization rule to process the SQL statement to obtain the desensitized SQL statement, that is, the desensitized SQL statement, so that the database can be controlled through the desensitized SQL statement in the future.

[0080] Furthermore, combining the aforementioned feasible implementation schemes, the target SQL statement is first parsed to extract the characters that need to be rewritten. Then, the SQL statement is processed using target de-identification rules, which means replacing the target characters in the SQL statement with de-identified characters using the corresponding target de-identification rules. This results in the de-identified SQL statement.

[0081] 204. The de-identified SQL statement is sent to a preset database for processing.

[0082] In this embodiment, after the SQL statement de-identification device processes the SQL statement using the target de-identification rules to obtain the de-identified SQL statement, it sends the de-identified SQL statement to the database corresponding to the SQL statement for processing. Of course, as described above, if the de-identified SQL statement is obtained by completely processing the target SQL statement, the database needs to restore the de-identified SQL statement to retrieve the special characters, such as operators and logical operators, when processing it. Conversely, if the de-identified SQL statement is obtained by parsing the target SQL statement and de-identifying only some of its characters, the database can process the de-identified SQL statement directly without the intervention of de-identification rules.

[0083] Furthermore, considering that when the database processes specific types of de-identified SQL statements, such as insert and update statements, it writes and updates the de-identified characters processed according to specific de-identification rules into the database, it is necessary to clean these characters in the database, i.e., update them, when the corresponding de-identification rules change. Specific implementation solutions can be found in subsequent sections. Figure 7 And its explanations and descriptions.

[0084] Furthermore, for query-type SQL statements, the database also returns query results to the SQL statement de-identification device. As described above, these results may be written to or updated in the database in the form of de-identified characters. Therefore, as a feasible embodiment of this application, the SQL statement de-identification device further utilizes corresponding de-identification rules to restore the query results, thereby outputting the original text to the user. Specific implementation schemes can be found in the following sections. Figure 8 And its explanations and descriptions.

[0085] The SQL statement desensitization method provided in this application automatically matches the SQL statement with preset candidate desensitization rules after obtaining the user-written SQL statement, thereby obtaining the corresponding target desensitization rule. This enables automatic desensitization processing of different SQL statements using the corresponding desensitization rules and execution of the desensitized SQL statement, which improves the security of the SQL statement while ensuring the efficiency of writing the SQL statement.

[0086] like Figure 3 As shown, Figure 3 A flowchart illustrating the steps for determining target desensitization rules provided in this application embodiment is described in detail below.

[0087] In this embodiment of the application, a technical solution is proposed to extract target characters from SQL statements by parsing them and to determine the target de-identification rules corresponding to each target character, specifically including steps 301 to 302:

[0088] 301. Parse the target SQL statement to determine the target characters in the target SQL statement.

[0089] In this embodiment, parsing SQL statements typically involves lexical and syntactic analysis. Specifically, parsing an SQL statement usually requires pre-identifying the database type (e.g., MySQL or Oracle) using a JDBC adapter, and then obtaining the appropriate parsing engine based on the database to complete the parsing. Specific implementation details can be found in subsequent sections. Figure 4 And its explanations and descriptions.

[0090] In this embodiment of the application, the target character usually refers to the variable in the SQL statement. For example, taking the SQL statement "add the value '123456789' to the 'phone number' column" as an example, by parsing the SQL statement, it can be determined that "phone number" and "123456789" in the SQL statement are variable that can be modified. Therefore, the SQL statement desensitization device will regard "phone number" and "123456789" as target characters for subsequent desensitization processing.

[0091] 302. Match the character attributes of the target character with the processing attributes of the preset candidate desensitization rules to determine the target desensitization rule corresponding to each target character in the target SQL statement.

[0092] In this embodiment, after determining the target characters in the SQL statement, the system further matches each target character with its character attributes and the processing attributes of preset candidate desensitization rules to determine the target desensitization rule corresponding to each target character. This allows for the application of different desensitization rules to different target characters in subsequent processing. Specific implementation schemes for configuring candidate desensitization rules can be found in subsequent sections. Figure 5 And its explanations and descriptions.

[0093] The technical solution provided in this application, by parsing SQL statements and extracting target characters from them, and by using different desensitization rules to process different target characters, can further improve the desensitization effect. At the same time, by parsing SQL statements, variable characters in SQL statements can be used as target characters that can be desensitized, while special characters are regarded as non-target characters that do not need to be desensitized. This facilitates the subsequent processing of desensitized SQL statements by the database and improves the processing efficiency of SQL statements.

[0094] like Figure 4 As shown, Figure 4 The following is a detailed flowchart illustrating the steps for parsing a statement to obtain target characters, as provided in an embodiment of this application.

[0095] This application provides a specific implementation scheme for parsing SQL statements through lexical analysis and syntax analysis, specifically including steps 401-402:

[0096] 401. Perform lexical analysis on the target SQL statement to determine the type of each character in the target SQL statement.

[0097] In this embodiment of the application, lexical parsing of SQL statements refers to the SQL statement desensitization device using a preset lexical parser, which is a parsing engine corresponding to the database type of the SQL statement, to decompose the target SQL statement into indivisible atomic symbols, i.e., characters, and classify each character into keywords, expressions, literals, and operators according to a dictionary corresponding to the database type. That is, the type corresponding to each character in the target SQL statement includes at least one of keywords, expressions, literals, and operators.

[0098] 402. Perform syntax parsing on the target SQL statement according to the type corresponding to each character in the target SQL statement to determine the target character in the target SQL statement.

[0099] In this embodiment of the application, after determining the type of each character, the SQL statement desensitization device will further use a preset syntax parser to convert the target SQL statement into an abstract syntax tree, and by traversing the abstract syntax tree and combining the type of each character, extract the context required for fragmentation, thereby determining the position in the target SQL statement that needs to be rewritten, that is, the target character in the target SQL statement.

[0100] like Figure 5 As shown, Figure 5 This is a schematic flowchart illustrating the steps for configuring candidate de-identification rules, as provided in an embodiment of this application. Details are as follows.

[0101] In this embodiment of the application, a de-identification rule is provided based on a digest algorithm and an encryption algorithm, respectively, specifically including steps 501 to 503:

[0102] 501. Based on the digest algorithm selected on the preset configuration page, generate the first desensitization rule and set the table name and column name as the processing attributes corresponding to the first desensitization rule.

[0103] In this embodiment, the hash algorithm typically refers to an algorithm that does not require a key, and the data processed by the hash algorithm cannot be decrypted. There are many specific hash algorithms, such as MD5, SHA-1, and their numerous variants. In this embodiment, the hash algorithm is displayed on a preset configuration interface, allowing users to customize and select the hash algorithm as a de-identification rule.

[0104] Furthermore, considering that data processed by the digest algorithm cannot be decrypted, the character attributes processed by the de-identification rules generated by the digest algorithm should be characters that are not stored as key values ​​in the SQL statement. For example, common table names and column names. In databases, table names and column names usually serve as identifying information, and both the original characters before and after digest algorithm processing can still function as identifiers. Therefore, table names and column names can be used as the processing attributes corresponding to the de-identification rules generated by the digest algorithm, so that subsequent target characters in SQL statements with the character attribute "table name" or "column name" can be processed using the corresponding digest algorithm.

[0105] 502. Based on the encryption algorithm selected on the preset configuration page, generate a second desensitization rule and set the table value as the processing attribute corresponding to the second desensitization rule.

[0106] In this embodiment, the encryption algorithm typically refers to an algorithm that uses a key for de-identification, and the data processed by the encryption algorithm can be decrypted using the key to recover the original data. Specifically, there are many types of encryption algorithms, such as the commonly used DES and RSA. In this embodiment, the encryption algorithm is displayed on a preset configuration interface, allowing users to customize and select the encryption algorithm as a de-identification rule.

[0107] Furthermore, considering that data processed by the encryption algorithm can be decrypted using the key, the character attributes processed by the de-identification rules generated by this encryption algorithm should be table values ​​in the SQL statement that serve as information carriers. Therefore, table values ​​can be used as the processing attributes corresponding to the de-identification rules generated by the encryption algorithm, so that subsequent target characters in the SQL statement with the character attribute "table value" can be processed using the corresponding encryption algorithm.

[0108] 503, set the first desensitization rule and the second desensitization rule as the preset candidate desensitization rules.

[0109] In this embodiment, both the first and second desensitization rules are rules that can achieve desensitization effects, and both have been configured with corresponding processing attributes. Therefore, they can be used as candidate desensitization rules to facilitate the selection of the corresponding target desensitization rule based on the attributes of the target characters in the SQL statement. Specifically, for ease of understanding, the following explanation will use the aforementioned SQL statement "add the value '123456789' to the 'phone number' column" as an example.

[0110] Specifically, in the aforementioned SQL statement, although both "phone number" and "123456789" can be considered target characters, their corresponding attributes are different. For example, "phone number" is generally a column name in the database, mainly used for unique identification. Therefore, during desensitization, a digest algorithm can be used for desensitization processing, so the desensitized character can still serve as a unique identifier. Conversely, "123456789" is more likely a table value in the database. As an information carrier, the information it carries cannot be changed. Therefore, the desensitized character corresponding to this target character needs to be able to be restored to the original target character. Thus, the corresponding desensitization rule should be an encryption algorithm with decryption capabilities. In this way, after retrieving the desensitized character corresponding to "123456789" from the database, it can be restored to the original text "123456789" based on the corresponding decryption rule to be displayed to the user.

[0111] like Figure 6 As shown, Figure 6 This is a flowchart illustrating the steps for configuring target de-identification rules based on user identifiers, as provided in an embodiment of this application. Details are as follows.

[0112] This application provides an implementation scheme for configuring target de-identification rules based on different user identifiers, specifically including steps 601-602:

[0113] 601. Obtain the de-identification rule database corresponding to the user identification information based on the user identification information corresponding to the target SQL statement.

[0114] Unlike other SQL statements, in this embodiment, when a user inputs an SQL statement using any feasible input method, the SQL statement desensitization device obtains the user identification information corresponding to the SQL statement, and further obtains the corresponding desensitization rule database based on the user identification information. In other words, for each user, they can create a database and configure corresponding desensitization rules within it, so that during subsequent desensitization processing, the corresponding desensitization rule database can be obtained based on the user identification information of different users.

[0115] 602, set the desensitization rules in the desensitization rule database as the preset candidate desensitization rules.

[0116] In this embodiment of the application, as can be seen from the foregoing description, different users can create a database and configure corresponding de-identification rules in the database. Therefore, the de-identification rules in the database can be set as preset candidate de-identification rules so as to facilitate the subsequent determination of the target de-identification rule.

[0117] like Figure 7 As shown, Figure 7 This is a flowchart illustrating the steps for updating the database based on the updated target de-identification rules, as provided in an embodiment of this application. Details are as follows.

[0118] This application provides an implementation scheme for cleaning and updating data in the database after the de-identification rules are updated, specifically including steps 701-702:

[0119] 701. Associate the target de-identification rule with the de-identification characters in the de-identification SQL statement and write it into the preset database.

[0120] In this embodiment, the de-identified characters in the de-identified SQL statement refer to the characters obtained by de-identifying the target characters in the target SQL statement. Specifically, when the target SQL statement is a write or update statement, the database will associate the de-identified characters in the de-identified SQL statement with the preset database when executing the de-identified SQL statement. At this time, in order to facilitate the corresponding update of the de-identified characters in the database when the target de-identification rules change, the target de-identification rules will be associated with the de-identified characters and written synchronously when the de-identified SQL statement is executed.

[0121] 702. If the target desensitization rule is updated to an update desensitization rule, then the desensitized characters in the preset database are updated according to the target desensitization rule and the update desensitization rule.

[0122] In this embodiment, if the target de-identification rule is updated to a new de-identification rule, i.e., the de-identification rule is updated, the database needs to be cleaned. Specifically, characters in the preset database associated with the target de-identification rule are considered as de-identified characters. First, the character is restored using the restoration de-identification rule corresponding to the target de-identification rule. Then, the restored character is de-identified a second time using the updated de-identification rule to obtain the updated character, which replaces the corresponding character in the preset database, thereby achieving the character update.

[0123] like Figure 8 As shown, Figure 8 This is a flowchart illustrating the steps for restoring query results based on a query SQL statement, as provided in an embodiment of this application. Details are as follows.

[0124] This application provides an implementation scheme for restoring the query results after obtaining the query results for SQL statements of the query type, specifically including steps 801 to 803:

[0125] 801, Obtain the de-identified query result returned by the preset database and the character attribute corresponding to the de-identified query result.

[0126] In this embodiment, if the SQL statement is query data, the preset database, after processing the SQL data, will return the corresponding de-identified query result to the SQL statement de-identification device, and simultaneously return the character attribute corresponding to the de-identified query result. As described above, the values ​​in the preset database are usually in the form of de-identified characters; therefore, the de-identified query result is also in the form of de-identified characters.

[0127] 802, determine the restoration desensitization rule corresponding to the desensitization query result based on the character attribute corresponding to the desensitization query result.

[0128] In this embodiment of the application, after the SQL statement desensitization device obtains the desensitization query result returned by the preset database, it determines the corresponding target desensitization rule from the candidate desensitization rules based on the character attributes, and then obtains the restoration desensitization rule corresponding to the target desensitization rule. That is, the restoration desensitization rule can be understood as the reverse processing of the target desensitization rule. The target desensitization rule is used to encrypt the original text into ciphertext, that is, the desensitized characters, while the restoration desensitization rule is used to restore the encrypted ciphertext back to the original text, that is, to restore the desensitized characters back to the initial characters.

[0129] 803. Process the desensitized query results according to the restoration and desensitization rules, and output the target query results.

[0130] In this embodiment of the application, the desensitization query results are processed using the restoration desensitization rules, so that the initial characters can be finally output and provided to the user.

[0131] To better implement the SQL statement de-identification method provided in this application, this application also provides an SQL statement de-identification device based on the SQL statement de-identification method. For example... Figure 9 As shown, Figure 9 This is a schematic diagram of an SQL statement de-identification device provided in an embodiment of this application. Specifically, the SQL statement de-identification device includes:

[0132] Module 901 is used to obtain the target SQL statement to be processed.

[0133] The comparison module 902 is used to determine the target desensitization rule corresponding to the target SQL statement from the candidate desensitization rules based on the comparison result between the target SQL statement and the preset candidate desensitization rules;

[0134] The desensitization module 903 is used to process the target SQL statement according to the target desensitization rule to obtain the desensitized SQL statement;

[0135] The processing module 904 is used to send the de-identified SQL statement to a preset database for processing.

[0136] In some embodiments of this application, the comparison module includes:

[0137] The parsing module is used to parse the target SQL statement and determine the target characters in the target SQL statement;

[0138] The matching module is used to match the character attributes of the target character with the processing attributes of preset candidate desensitization rules to determine the target desensitization rule corresponding to each target character in the target SQL statement.

[0139] In some embodiments of this application, the above-mentioned parsing sub-module includes:

[0140] The lexical analysis unit is used to perform lexical analysis on the target SQL statement and determine the type of each character in the target SQL statement; the type includes at least one of keywords, expressions, literals and operators.

[0141] The syntax parsing unit is used to perform syntax parsing on the target SQL statement according to the type corresponding to each character in the target SQL statement, and to determine the target characters in the target SQL statement.

[0142] In some embodiments of this application, the comparison module further includes a rule configuration sub-module, which includes:

[0143] The first rule configuration unit is used to generate a first desensitization rule based on the digest algorithm selected on the preset configuration page, and set the table name and column name as the processing attributes corresponding to the first desensitization rule;

[0144] The second rule configuration unit is used to generate a second desensitization rule according to the encryption algorithm selected on the preset configuration page, and set the table value as the processing attribute corresponding to the second desensitization rule;

[0145] The rule setting unit is used to set the first desensitization rule and the second desensitization rule as the preset candidate desensitization rules.

[0146] In some embodiments of this application, the above-mentioned rule configuration sub-module includes:

[0147] The rule database acquisition unit is used to acquire a de-identification rule database corresponding to the user identification information based on the user identification information corresponding to the target SQL statement;

[0148] The rule configuration unit is used to set the de-identification rules in the de-identification rule database as the preset candidate de-identification rules.

[0149] In some embodiments of this application, the above-mentioned SQL statement de-identification device includes:

[0150] An update module is used to associate the target de-identification rule with the de-identified characters in the de-identification SQL statement and write them into the preset database, so that when the target de-identification rule is updated to an update de-identification rule, the de-identified characters in the preset database are updated according to the target de-identification rule and the update de-identification rule.

[0151] In some embodiments of this application, the SQL statement de-identification device includes a restoration module; the restoration module includes:

[0152] The query result acquisition module is used to acquire the de-identified query result returned by the preset database and the character attribute corresponding to the de-identified query result if the target SQL statement is a query statement;

[0153] The restoration rule determination module is used to determine the restoration desensitization rule corresponding to the desensitization query result based on the character attribute corresponding to the desensitization query result.

[0154] The restoration module is used to process the desensitized query results according to the restoration desensitization rules and output the target query results.

[0155] This application also provides an SQL statement de-identification device, such as... Figure 10 As shown, Figure 10 This is a schematic diagram of the structure of an SQL statement de-identification device provided in an embodiment of this application.

[0156] The SQL statement desensitization device includes a memory, a processor, and an SQL statement desensitization program stored in the memory and executable on the processor. When the processor executes the SQL statement desensitization program, it implements the steps in the SQL statement desensitization method provided in any embodiment of this application.

[0157] Specifically, an SQL statement desensitization device may include components such as a processor 1001 with one or more processing cores, a memory 1002 with one or more storage media, a power supply 1003, and an input unit 1004. Those skilled in the art will understand that... Figure 10 The SQL statement masking device structure shown does not constitute a limitation on the SQL statement masking device. It may include more or fewer components than shown, or combine certain components, or have different component arrangements. Wherein:

[0158] The processor 1001 is the control center of the SQL statement masking device. It connects to various parts of the device via various interfaces and lines, and performs various functions and data processing by running or executing software programs and / or modules stored in the memory 1002, and by calling data stored in the memory 1002, thereby providing overall monitoring of the SQL statement masking device. Optionally, the processor 1001 may include one or more processing cores; preferably, the processor 1001 may integrate an application processor and a modem processor, wherein the application processor mainly handles the operating system, user interface, and applications, and the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 1001.

[0159] The memory 1002 can be used to store software programs and modules. The processor 1001 executes various functional applications and data processing by running the software programs and modules stored in the memory 1002. The memory 1002 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, application programs required for at least one function (such as sound playback function, image playback function, etc.), etc.; the data storage area may store data created according to the use of the SQL statement de-identification device, etc. In addition, the memory 1002 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory 1002 may also include a memory controller to provide the processor 1001 with access to the memory 1002.

[0160] The SQL statement desensitization device also includes a power supply 1003 that supplies power to the various components. Preferably, the power supply 1003 can be logically connected to the processor 1001 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system. The power supply 1003 may also include one or more DC or AC power supplies, recharging systems, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components.

[0161] The SQL statement desensitization device may also include an input unit 1004, which can be used to receive input numeric or character information, and generate keyboard, mouse, joystick, optical or trackball signal inputs related to user settings and function control.

[0162] Although not shown, the SQL statement desensitization device may also include a display unit, etc., which will not be described in detail here. Specifically, in this embodiment, the processor 1001 in the SQL statement desensitization device loads the executable files corresponding to the processes of one or more applications into the memory 1002 according to the following instructions, and the processor 1001 runs the applications stored in the memory 1002, thereby implementing the steps in the SQL statement desensitization method provided in any embodiment of this application.

[0163] Therefore, embodiments of this application provide a computer-readable storage medium, which may include: read-only memory (ROM), random access memory (RAM), a magnetic disk, or an optical disk, etc. The computer-readable storage medium stores an SQL statement de-identification program, which, when executed by a processor, implements the steps of the SQL statement de-identification method provided in any embodiment of this application.

[0164] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the detailed descriptions of other embodiments above, which will not be repeated here.

[0165] In practice, each of the above units or structures can be implemented as an independent entity or can be arbitrarily combined to be implemented as the same or several entities. For the specific implementation of each of the above units or structures, please refer to the previous method embodiments, which will not be repeated here.

[0166] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0167] The above provides a detailed description of an SQL statement desensitization method provided by the embodiments of this application. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A method for desensitizing SQL statements, characterized in that, include: Retrieve the target SQL statement to be processed; Based on the comparison results between the target SQL statement and the preset candidate de-identification rules, the target de-identification rule corresponding to the target SQL statement is determined from the candidate de-identification rules; The target SQL statement is processed according to the target de-identification rules to obtain the de-identified SQL statement; The de-identified SQL statement is sent to a preset database for processing. The process of determining the target de-identification rule from the candidate de-identification rules based on the comparison results between the target SQL statement and the preset candidate de-identification rules includes: Based on the parsing engine corresponding to the database type of the target SQL statement, lexical analysis is performed on the target SQL statement to determine the indivisible atomic symbols of the target SQL statement and obtain the type corresponding to each character in the target SQL statement; the type includes at least one of keywords, expressions, literals and operators; The target SQL statement is converted into an abstract syntax tree, and the context required for sharding is extracted by traversing the abstract syntax tree according to the type corresponding to each character, so as to determine the target character in the target SQL statement. The target character is used to indicate the position in the target SQL statement that needs to be rewritten. The character attributes of the target character are matched with the processing attributes of the preset candidate desensitization rules to determine the target desensitization rule corresponding to each target character in the target SQL statement; Before matching the character attributes of the target character with the processing attributes of preset candidate de-identification rules to determine the target de-identification rule corresponding to each target character in the target SQL statement, the method further includes: Based on the digest algorithm selected on the preset configuration page, generate the first desensitization rule, and set the table name and column name as the processing attributes corresponding to the first desensitization rule; Based on the encryption algorithm selected on the preset configuration page, a second desensitization rule is generated, and the table value is set as the processing attribute corresponding to the second desensitization rule; Set the first desensitization rule and the second desensitization rule as the preset candidate desensitization rules.

2. The SQL statement desensitization method according to claim 1, characterized in that, Before determining the target desensitization rule corresponding to the target SQL statement from the candidate desensitization rules based on the comparison result between the target SQL statement and the preset candidate desensitization rules, the method further includes: Based on the user identification information corresponding to the target SQL statement, obtain the de-identification rule database corresponding to the user identification information; Set the desensitization rules in the desensitization rule database as the preset candidate desensitization rules.

3. The SQL statement desensitization method according to claim 1, characterized in that, After sending the de-identified SQL statement to a preset database for processing, the method further includes: The target de-identification rule is associated with the de-identified characters in the de-identification SQL statement and written into the preset database. When the target de-identification rule is updated to an update de-identification rule, the de-identified characters in the preset database are updated according to the target de-identification rule and the update de-identification rule.

4. The SQL statement desensitization method according to claim 1, characterized in that, After sending the de-identified SQL statement to a preset database for processing, the method further includes: If the target SQL statement is a query statement, then obtain the de-identified query result returned by the preset database and the character attribute corresponding to the de-identified query result; Determine the restoration desensitization rule corresponding to the desensitization query result based on the character attributes corresponding to the desensitization query result; The desensitized query results are processed according to the desensitization rules, and the target query results are output.

5. The SQL statement desensitization method according to any one of claims 1 to 4, characterized in that, The candidate de-identification rules are stored in the Apollo configuration center.

6. An SQL statement desensitization device, characterized in that, include: The acquisition module is used to acquire the target SQL statement to be processed. The comparison module is used to determine the target de-identification rule corresponding to the target SQL statement from the candidate de-identification rules based on the comparison result between the target SQL statement and the preset candidate de-identification rules; The de-identification module is used to process the target SQL statement according to the target de-identification rules to obtain the de-identified SQL statement; The processing module is used to send the de-identified SQL statement to a preset database for processing; The process of determining the target de-identification rule from the candidate de-identification rules based on the comparison results between the target SQL statement and the preset candidate de-identification rules includes: Based on the parsing engine corresponding to the database type of the target SQL statement, lexical analysis is performed on the target SQL statement to determine the indivisible atomic symbols of the target SQL statement and obtain the type corresponding to each character in the target SQL statement; the type includes at least one of keywords, expressions, literals and operators; The target SQL statement is converted into an abstract syntax tree, and the context required for sharding is extracted by traversing the abstract syntax tree according to the type corresponding to each character, so as to determine the target character in the target SQL statement. The target character is used to indicate the position in the target SQL statement that needs to be rewritten. The character attributes of the target character are matched with the processing attributes of the preset candidate desensitization rules to determine the target desensitization rule corresponding to each target character in the target SQL statement; Before matching the character attributes of the target character with the processing attributes of preset candidate de-identification rules to determine the target de-identification rule corresponding to each target character in the target SQL statement, the method further includes: Based on the digest algorithm selected on the preset configuration page, generate the first desensitization rule, and set the table name and column name as the processing attributes corresponding to the first desensitization rule; Based on the encryption algorithm selected on the preset configuration page, a second desensitization rule is generated, and the table value is set as the processing attribute corresponding to the second desensitization rule; Set the first desensitization rule and the second desensitization rule as the preset candidate desensitization rules.

7. An SQL statement desensitization device, characterized in that, The SQL statement de-identification device includes a processor, a memory, and an SQL statement de-identification program stored in the memory and executable on the processor. The processor executes the SQL statement de-identification program to implement the steps in the SQL statement de-identification method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores an SQL statement de-identification program, which is executed by a processor to implement the steps of the SQL statement de-identification method according to any one of claims 1 to 5.

Images