A method and device for implementing database sensitive field desensitization

Abstract

The application provides a method and device for realizing database sensitive field desensitization. The method comprises the following steps: analyzing input storage data, and judging whether the target sensitive field to be desensitized is contained; if yes, calling a preset data desensitization rule on a SM4 encryption extender encapsulated based on an open source framework of database partitioning to perform encryption processing on the target sensitive field, to obtain corresponding ciphertext data; and storing the ciphertext data into a database; wherein the data desensitization rule comprises a data encryption strategy and a data decryption strategy based on an SM4 block encryption algorithm. The method for realizing database sensitive field desensitization can avoid repeated encryption operation to increase workload, reduce the risk of sensitive field leakage, and improve the security and robustness of storage data.

Description

Technical Field

[0001] This invention relates to the field of data encryption technology, specifically to a method and apparatus for desensitizing sensitive fields in a database. It also relates to an electronic device and a non-transitory computer-readable storage medium. Background Technology

[0002] With the rapid development of computer technology, data security has received increasing attention, and data anonymization technology is a crucial part of data security. Data anonymization refers to the process of transforming sensitive information according to anonymization rules to reliably protect sensitive and private data. ShardingSphere is an ecosystem of open-source distributed database middleware solutions. It consists of three independent yet complementary products: JDBC (Java Database Connectivity), Proxy, and Sidecar. It provides standard data sharding, distributed transactions, and database governance capabilities. SM4 (Chinese national cryptographic algorithm) is a currently used block cipher standard.

[0003] However, existing database sensitive field masking solutions based on ShardingSphere or SM4 block cipher algorithms have many drawbacks. For example, one approach involves encapsulating the SM4 algorithm into a utility class to encrypt sensitive fields before saving the encrypted data to the database. This method requires each system to encapsulate the SM4 algorithm, resulting in repetitive encryption operations, increased workload, inconsistent encryption algorithm implementations, and added operational steps, thus increasing the risk of sensitive field leakage. Therefore, designing an efficient and simple solution for database sensitive field masking has become an important research topic in this field. Summary of the Invention

[0004] To address this issue, the present invention provides a method and apparatus for desensitizing sensitive fields in a database, thereby resolving the problem that existing base station cost sharing schemes have significant limitations and cannot meet current practical needs.

[0005] This invention provides a method for desensitizing sensitive fields in a database, comprising: parsing the input stored data and determining whether it contains the target sensitive field to be desensitized;

[0006] If so, the target sensitive field is encrypted using the SM4 encryption extender pre-packaged based on the open-source database sharding and table partitioning framework, and the preset data desensitization rules are invoked to obtain the corresponding ciphertext data; and the ciphertext data is stored in the database.

[0007] The data desensitization rules include data encryption and decryption strategies based on the SM4 block cipher algorithm.

[0008] Furthermore, the method for desensitizing sensitive fields in a database also includes:

[0009] When a user queries the data stored in the database, the system checks whether the data contains the corresponding target encrypted field according to the data anonymization rules. If so, the target encrypted field is retrieved from the database, and the SM4 encryption extender is used to call the data anonymization rules to decrypt the target encrypted field, obtaining the corresponding plaintext data, which is then returned to the user.

[0010] Furthermore, the data desensitization rules also include: data encryption strategies and data decryption strategies based on Advanced Encryption Standard (AES) algorithms or MD5 message digest algorithms;

[0011] The step of using the SM4 encryption extender to call the data desensitization rule to decrypt the target encrypted field specifically includes: when the encryption / decryption switch of the corresponding pre-configured historical application algorithm is triggered, using the data decryption strategy based on the SM4 block cipher algorithm contained in the data desensitization rule to decrypt the ciphertext data; if decryption fails, then using the data decryption strategy based on the Advanced Encryption Standard algorithm or the MD5 message digest algorithm contained in the data desensitization rule to decrypt the ciphertext data again.

[0012] Furthermore, the method for implementing database sensitive field desensitization also includes: before parsing the input stored data, extending the data desensitization encryption method of the open-source database sharding framework to support the original data desensitization extender provided by the open-source database sharding framework, extending the SM4 block encryption algorithm to the open-source database sharding framework, encapsulating data desensitization rules, obtaining the SM4 encryption extender, and releasing the corresponding configuration component package for external applications.

[0013] Furthermore, the method for desensitizing sensitive fields in the database further includes: configuring encryption / decryption switches for corresponding historical application algorithms in the configuration component package; wherein the historical application algorithms correspond to historical encrypted data, specifically including Advanced Encryption Standard (AES) algorithms or MD5 message digest algorithms.

[0014] Furthermore, in the method for desensitizing sensitive fields in a database, the step of determining whether a target sensitive field to be desensitized is included specifically: determining whether a target sensitive field to be desensitized is included based on the data desensitization rules.

[0015] The present invention also provides an apparatus for desensitizing sensitive fields in a database, comprising:

[0016] The sensitive field determination unit is used to parse the input stored data and determine whether it contains the target sensitive field to be de-identified.

[0017] The sensitive field desensitization processing unit is used to, if so, use a pre-packaged SM4 encryption extender based on a database sharding and table partitioning open source framework to call a preset data desensitization rule to encrypt the target sensitive field, obtain the corresponding ciphertext data, and store the ciphertext data in the database; wherein, the data desensitization rule includes a data encryption strategy and a data decryption strategy based on the SM4 block cipher algorithm.

[0018] Furthermore, the apparatus for desensitizing sensitive fields in the database further includes:

[0019] The encrypted data query processing unit is used to check whether the data contains the corresponding target encrypted field according to the data desensitization rules when a user queries the data stored in the database. If so, the target encrypted field is obtained from the database, and the target encrypted field is decrypted by calling the data desensitization rules using the SM4 encryption extender to obtain the corresponding plaintext data, which is then returned to the user.

[0020] Furthermore, the data desensitization rules also include: data encryption strategies and data decryption strategies based on Advanced Encryption Standard (AES) algorithms or MD5 message digest algorithms;

[0021] The sensitive field desensitization processing unit is specifically used to: when the encryption / decryption switch of the corresponding pre-configured historical application algorithm is triggered, decrypt the ciphertext data using the data desensitization rule containing the data decryption strategy based on the SM4 block encryption algorithm; if decryption fails, decrypt the ciphertext data again using the data decryption strategy contained in the data desensitization rule based on the Advanced Encryption Standard algorithm or the MD5 message digest algorithm.

[0022] Furthermore, the device for implementing database sensitive field desensitization also includes: an extended configuration unit, used to extend the support for the data desensitization encryption method of the open-source database sharding framework based on the original data desensitization extender provided by the open-source database sharding framework before parsing the input stored data, extend the SM4 block encryption algorithm to the open-source database sharding framework, encapsulate the data desensitization rules, obtain the SM4 encryption extender, and publish the corresponding configuration component package for external applications.

[0023] Furthermore, the device for desensitizing sensitive fields in the database further includes: an encryption / decryption switch configuration unit, used to configure encryption / decryption switches for corresponding historical application algorithms in the configuration component package; wherein the historical application algorithms correspond to historical encrypted data, specifically including Advanced Encryption Standard (AES) algorithms or MD5 message digest algorithms.

[0024] Furthermore, in the apparatus for desensitizing sensitive fields in a database, the sensitive field determination unit is specifically used to: determine whether the data contains a target sensitive field to be desensitized based on the data desensitization rules.

[0025] Accordingly, the present invention also provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the method for desensitizing sensitive fields in a database as described in any of the preceding claims.

[0026] Accordingly, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method for desensitizing sensitive fields in a database as described in any of the preceding claims.

[0027] The method for desensitizing sensitive fields in a database as described in this invention involves parsing the input stored data to identify the target sensitive fields to be desensitized. Then, a pre-built SM4 encryption extender, based on a database sharding and table partitioning open-source framework, is used to encrypt the target sensitive fields according to preset data desensitization rules, resulting in ciphertext data. This ciphertext data is then stored in the database. This method effectively avoids repeated encryption operations that increase workload, reduces the risk of sensitive field leakage, and improves the security and robustness of stored data. Attached Figure Description

[0028] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0029] Figure 1 This is a flowchart illustrating a method for desensitizing sensitive fields in a database, provided by an embodiment of the present invention.

[0030] Figure 2 This is a schematic diagram of the architecture corresponding to the method for desensitizing sensitive fields in a database provided in an embodiment of the present invention;

[0031] Figure 3This is a schematic diagram of a device for desensitizing sensitive fields in a database, provided in an embodiment of the present invention.

[0032] Figure 4 This is a schematic diagram of the physical structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0033] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0034] The following is a detailed description of embodiments of the method for desensitizing sensitive fields in a database based on the present invention. For example... Figure 1 The diagram shown is a flowchart illustrating a method for desensitizing sensitive fields in a database, as provided in an embodiment of the present invention. The specific implementation process includes the following steps:

[0035] Step 101: Parse the input stored data and determine whether it contains the target sensitive field to be de-identified.

[0036] In this step, the input data to be stored must first be parsed, and the data anonymization rules must be used to determine whether it contains the target sensitive fields to be anonymized.

[0037] For example, when an application saves data to a database, it first parses the input SQL (Structured Query Language). If sensitive fields are present, based on the open-source sharding framework (ShardingSphere), the SM4 Encryptor extended according to this invention rewrites the SQL statement by calling pre-configured de-identification rules, thereby encrypting the data to be stored and storing the ciphertext data in the database. When a user queries data, the ciphertext data is retrieved from the database, and the plaintext data is decrypted according to the corresponding de-identification rules called by the SM4 Encryptor of this invention, and returned to the user. The entire process makes the de-identification process transparent, and the application does not need to concern itself with the details of the de-identification implementation.

[0038] It's important to note that in the actual implementation, ShardingSphere's Encrypt-JDBC and the business code are deployed together. The business side needs to perform JDBC programming using Encrypt-JDBC. Since Encrypt-JDBC implements all standard JDBC interfaces, the business code can be used compatibly without additional modifications. At this point, all database interactions between the business code and the database are handled by Encrypt-JDBC. The business only needs to provide the corresponding data masking rules. As a bridge between the business code and the underlying database, Encrypt-JDBC can intercept user behavior and, after modifying the behavior, interact with the database.

[0039] Encrypt-JDBC intercepts user-initiated SQL queries, parses and understands the SQL behavior using an SQL syntax parser, and then, based on the user-provided de-identification rules, identifies the target sensitive fields that need de-identification. SM4Encryptor then encrypts and decrypts these sensitive fields before interacting with the underlying database. ShardingSphere encrypts the plaintext data requested by the user and stores it in the underlying database. When the user queries, the encrypted data is retrieved from the database, decrypted, and then the corresponding plaintext data is returned to the end user. By shielding the user from the de-identification process, ShardingSphere allows users to use de-identified data as if it were ordinary data, without needing to be aware of the SQL parsing, data encryption, and decryption processes, thus improving the user experience.

[0040] Additionally, it should be noted that before parsing the input stored data during implementation, it is necessary to extend the data masking and encryption methods of the ShardingSphere open-source framework to support the original data masking extender (i.e., Encryptor). This involves extending the SM4 (Chinese national cryptographic algorithm) block cipher algorithm into the framework, encapsulating the data masking rules, providing the utility class SM4Utils to obtain the SM4 encryption extender, and releasing a corresponding configuration component package JAR (JavaArchive) for external applications. In this embodiment, the encryption / decryption switch for the corresponding historical application algorithm can be configured in the configuration component package. The historical application algorithm corresponds to the historical encrypted data and specifically includes Advanced Encryption Standard (AES) block cipher algorithm or MD5 (MD5 Message-Digest Algorithm), etc. This ensures compatibility with historical data encrypted using the original historical application algorithm, guaranteeing that historical data can be correctly decrypted during the query process. To complete the module injection, the full path of the SM4 encryption extender can be placed in META-INF / services / for loading and instantiation.

[0041] Step 102: If so, the target sensitive field is encrypted using the pre-packaged SM4 encryption extender based on the open-source database sharding framework, following preset data desensitization rules to obtain the corresponding ciphertext data; and the ciphertext data is stored in the database. The data desensitization rules include a data encryption strategy and a data decryption strategy based on the SM4 block cipher algorithm.

[0042] As described in step 101, in order to be compatible with historical data encrypted using the original historical application algorithm and to ensure that historical data can be correctly decrypted during the query process, the data desensitization rules also include: data encryption strategies and data decryption strategies based on the Advanced Encryption Standard algorithm or the MD5 message digest algorithm.

[0043] When a user queries data stored in the database, the system checks whether it contains the corresponding target encrypted field according to the data anonymization rules. If so, the target encrypted field is retrieved from the database, and the SM4 encryption extender is used to decrypt the target encrypted field using the data anonymization rules to obtain the corresponding plaintext data, which is then returned to the user. Specifically, during data querying, the system first attempts to decrypt the data using the SM4 block cipher algorithm. If this fails, it then attempts to decrypt the data using the historical application algorithm. Specifically, encrypted data is first decrypted using SM4; if successful, the data is returned. If decryption fails, the historical application algorithm is used; if successful, the data is returned. If decryption fails again, a data decryption error is returned. It should be noted that, since the encryption algorithms of SM4 and historical application algorithms are different, data encrypted with historical application algorithms will return a data decryption failure exception when decrypted with SM4, and similarly, data encrypted with SM4 will also return a data decryption exception when decrypted with historical application algorithms. If the user has enabled the switch to be compatible with historical application algorithm decryption, based on the above decryption phenomenon, this invention will capture the decryption failure exception when performing SM4 decryption. After capturing it, it will perform decryption with historical application algorithms. If successful, the data will be returned; if decryption still fails, it indicates that there is a problem with the encrypted data, and a data decryption error will be returned.

[0044] Accordingly, the specific implementation process of using the SM4 encryption extender to call the data desensitization rule to decrypt the target encrypted field includes: when the encryption / decryption switch of the corresponding pre-configured historical application algorithm is triggered, the ciphertext data is decrypted using the data decryption strategy based on the SM4 block cipher algorithm contained in the data desensitization rule; if decryption fails, the ciphertext data is decrypted again using the data decryption strategy based on the Advanced Encryption Standard algorithm or the MD5 message digest algorithm contained in the data desensitization rule.

[0045] In this embodiment of the invention, the de-identification rule configuration is mainly divided into four parts: data source configuration, encryptor configuration, de-identification table configuration, and query attribute configuration. Specifically, data source configuration refers to the configuration of the DataSource. Encryptor configuration refers to the encryption strategy used for encryption and decryption; currently, ShardingSphere has two built-in encryption and decryption strategies: an encryption and decryption strategy based on the AES / MD5 block cipher algorithm. This solution implements the interface provided by ShardingSphere and encapsulates SM4Encryptor based on the SM4 block cipher algorithm to implement a set of block encryption. De-identification table configuration tells ShardingSphere which column in the data table is used to store ciphertext data (cipherColumn), which column is used to store plaintext data (plainColumn), and which column the user wants to use for SQL writing (logicColumn). Query attribute configuration: when the underlying database table stores both plaintext and ciphertext data, this attribute switch determines whether to directly query the plaintext data in the database table and return it, or query the ciphertext data and return it after decryption via Encrypt-JDBC.

[0046] In its implementation, this invention extends SM4Encryptor, based on the SM4 block cipher algorithm, within ShardingSphere, and rewrites the encryption function `encrypt()` and the decryption function `decrypt()` to encrypt and decrypt the data requiring anonymization. When a user performs INSERT, DELETE, or UPDATE operations, ShardingSphere parses, rewrites, and routes the SQL according to the user's configuration, and calls `encrypt()` to encrypt the data before storing it in the database. During SELECT operations, the `decrypt()` method is called to decrypt the encrypted data (i.e., the anonymized data) retrieved from the database, ultimately returning the original data (i.e., the stored data containing the target sensitive information) to the user.

[0047] Based on ShardingSphere, SM4Encryptor is used to rewrite SQL queries according to data anonymization rules. The specific implementation process includes: During insert and update operations, the SQL rewriting process first checks for the presence of target sensitive fields (i.e., fields to be anonymized) according to the anonymization rules. If such fields are present, SM4Encryptor encrypts the data, replacing the plaintext of the corresponding target sensitive field in the original SQL with ciphertext data before storing the data. During queries, the configuration file is also checked for encrypted fields (i.e., anonymized fields). If such fields are present, SM4Encryptor decrypts the data, and the original SQL is returned to the user with the decrypted plaintext data.

[0048] The invention utilizes SM4Encryptor to decrypt plaintext based on data anonymization rules. The specific implementation process includes: This invention provides sensitive field anonymization for existing databases based on ShardingSphere and the SM4 block cipher algorithm. ShardingSphere already provides data anonymization rules based on AES and MD5 block cipher algorithms, and it also provides an external data anonymization extension interface (Encryptor). This invention extends the support for ShardingSphere's data anonymization extension interface, encapsulating the SM4 block cipher algorithm into SM4Encryptor based on ShardingSphere. The data anonymization rules invoked by SM4Encryptor include data encryption and decryption methods. The encapsulation of the decryption method first uses SM4 for decryption; if decryption fails, it then uses a previous encryption algorithm. The SM4 block cipher algorithm is a block cipher standard, which will not be described in detail here.

[0049] The method for desensitizing sensitive fields in a database as described in this embodiment of the invention involves parsing the input stored data to determine the target sensitive fields to be desensitized, and then using a pre-packaged SM4 encryption extender based on a database sharding and table partitioning open-source framework to encrypt the target sensitive fields according to preset data desensitization rules to obtain the corresponding ciphertext data. The ciphertext data is then stored in the database. This method effectively avoids repeated encryption operations that increase workload, reduces the risk of sensitive field leakage, and improves the security and robustness of stored data.

[0050] Corresponding to the method for de-identifying sensitive fields in a database provided above, this invention also provides an apparatus for de-identifying sensitive fields in a database. Since the embodiments of this apparatus are similar to the method embodiments described above, the description is relatively simple. For relevant details, please refer to the description in the method embodiment section above. The embodiments of the apparatus for de-identifying sensitive fields in a database described below are merely illustrative. Please refer to... Figure 3 The diagram shown is a structural schematic of an apparatus for de-identifying sensitive fields in a database, provided by an embodiment of the present invention. The apparatus for de-identifying sensitive fields in a database according to the present invention specifically includes the following parts:

[0051] Sensitive field determination unit 301 is used to parse the input stored data and determine whether it contains the target sensitive field to be desensitized;

[0052] Sensitive field desensitization processing unit 302 is used to, if so, use a pre-packaged SM4 encryption extender based on a database sharding and table partitioning open source framework to call a preset data desensitization rule to encrypt the target sensitive field, obtain the corresponding ciphertext data; and store the ciphertext data in the database; wherein, the data desensitization rule includes a data encryption strategy and a data decryption strategy based on the SM4 block cipher algorithm.

[0053] The apparatus for desensitizing sensitive fields in a database, as described in this embodiment of the invention, parses the input stored data to determine the target sensitive fields to be desensitized, and uses a pre-packaged SM4 encryption extender based on a database sharding and table partitioning open-source framework to encrypt the target sensitive fields using preset data desensitization rules to obtain the corresponding ciphertext data. This ciphertext data is then stored in the database. This effectively avoids repeated encryption operations that increase workload, reduces the risk of sensitive field leakage, and improves the security and robustness of stored data.

[0054] Corresponding to the method for desensitizing sensitive fields in a database provided above, this invention also provides an electronic device. Since the embodiment of this electronic device is similar to the method embodiment described above, it is described simply. For relevant details, please refer to the description in the method embodiment section above. The electronic device described below is merely illustrative. Figure 4 The diagram shows a physical structure of an electronic device disclosed in an embodiment of the present invention. The electronic device may include a processor 401, a memory 402, and a communication bus 403, wherein the processor 401 and the memory 402 communicate with each other via the communication bus 403. The processor 401 can call logical instructions in the memory 402 to execute a method for desensitizing sensitive fields in a database. This method includes: parsing the input stored data and determining whether it contains a target sensitive field to be desensitized; if so, using a pre-packaged SM4 encryption extender based on a database sharding and table partitioning open-source framework to encrypt the target sensitive field using preset data desensitization rules to obtain corresponding ciphertext data; and storing the ciphertext data in the database; wherein the data desensitization rules include a data encryption strategy and a data decryption strategy based on the SM4 block cipher algorithm.

[0055] Furthermore, the logical instructions in the aforementioned memory 402 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0056] On the other hand, embodiments of the present invention also provide a computer program product, the computer program product including a computer program stored on a non-transitory computer-readable storage medium, the computer program including program instructions, when the program instructions are executed by a computer, the computer can execute the method for desensitizing sensitive fields in a database provided in the above-described method embodiments, the method including: parsing the input stored data and determining whether it contains a target sensitive field to be desensitized; if so, using a pre-packaged SM4 encryption extender based on a database sharding and table partitioning open source framework to call a preset data desensitization rule to encrypt the target sensitive field to obtain corresponding ciphertext data; and storing the ciphertext data in a database; wherein, the data desensitization rule includes a data encryption strategy and a data decryption strategy based on the SM4 block cipher algorithm.

[0057] In another aspect, embodiments of the present invention also provide a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the method for desensitizing sensitive fields in a database provided in the above embodiments. The method includes: parsing the input stored data and determining whether it contains a target sensitive field to be desensitized; if so, using a pre-packaged SM4 encryption extender based on a database sharding and table partitioning open-source framework to call a preset data desensitization rule to encrypt the target sensitive field, obtaining corresponding ciphertext data; and storing the ciphertext data in a database; wherein the data desensitization rule includes a data encryption strategy and a data decryption strategy based on the SM4 block cipher algorithm.

[0058] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0059] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0060] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for desensitizing sensitive fields in a database, characterized in that, include: The input stored data is parsed, and it is determined whether it contains the target sensitive fields to be de-identified. If so, the target sensitive field is encrypted using the SM4 encryption extender pre-encapsulated based on the open-source framework for database sharding and table partitioning, and the preset data desensitization rules are invoked to obtain the corresponding ciphertext data. The encrypted data is then stored in a database; wherein the data desensitization rules include data encryption and decryption strategies based on the SM4 block cipher algorithm, as well as data encryption and decryption strategies based on the Advanced Encryption Standard algorithm or the MD5 message digest algorithm. Before parsing the input stored data, the data desensitization and encryption methods of the open-source database sharding and table partitioning framework are extended based on the original data desensitization extender provided by the open-source database sharding and table partitioning framework. The SM4 block encryption algorithm is extended to the open-source database sharding and table partitioning framework, the data desensitization rules are encapsulated, the SM4 encryption extender is obtained, and the corresponding configuration component package for external applications is released. Configure encryption / decryption switches for corresponding historical application algorithms in the configuration component package; wherein, the historical application algorithms correspond to historical encrypted data, specifically including Advanced Encryption Standard (AES) algorithms or MD5 message digest algorithms.

2. The method for desensitizing sensitive fields in a database according to claim 1, characterized in that, Also includes: When a user queries the data stored in the database, the system checks whether the data contains the corresponding target encrypted field according to the data anonymization rules. If so, the target encrypted field is retrieved from the database, and the SM4 encryption extender is used to call the data anonymization rules to decrypt the target encrypted field, obtaining the corresponding plaintext data, which is then returned to the user.

3. The method for desensitizing sensitive fields in a database according to claim 2, characterized in that, The step of using the SM4 encryption extender to call the data desensitization rule to decrypt the target encrypted field specifically includes: when the encryption / decryption switch of the corresponding pre-configured historical application algorithm is triggered, using the data decryption strategy based on the SM4 block cipher algorithm contained in the data desensitization rule to decrypt the ciphertext data; if decryption fails, then using the data decryption strategy based on the Advanced Encryption Standard algorithm or the MD5 message digest algorithm contained in the data desensitization rule to decrypt the ciphertext data again.

4. The method for desensitizing sensitive fields in a database according to claim 1, characterized in that, The determination of whether the target sensitive field to be de-identified is specifically: based on the data de-identification rules, it is determined whether the target sensitive field to be de-identified is included.

5. An apparatus for desensitizing sensitive fields in a database, characterized in that, include: The sensitive field determination unit is used to parse the input stored data and determine whether it contains the target sensitive field to be de-identified. The sensitive field desensitization processing unit is used to, if so, use the SM4 encryption extender pre-encapsulated based on the open-source framework of database sharding and table partitioning to call the preset data desensitization rules to encrypt the target sensitive field and obtain the corresponding ciphertext data; The encrypted data is then stored in a database; wherein the data desensitization rules include data encryption and decryption strategies based on the SM4 block cipher algorithm, as well as data encryption and decryption strategies based on the Advanced Encryption Standard algorithm or the MD5 message digest algorithm. Before parsing the input stored data, the data desensitization and encryption methods of the open-source database sharding and table partitioning framework are extended based on the original data desensitization extender provided by the open-source database sharding and table partitioning framework. The SM4 block encryption algorithm is extended to the open-source database sharding and table partitioning framework, the data desensitization rules are encapsulated, the SM4 encryption extender is obtained, and the corresponding configuration component package for external applications is released. Configure encryption / decryption switches for corresponding historical application algorithms in the configuration component package; wherein, the historical application algorithms correspond to historical encrypted data, specifically including Advanced Encryption Standard (AES) algorithms or MD5 message digest algorithms.

6. The apparatus for desensitizing sensitive fields in a database according to claim 5, characterized in that, Also includes: The encrypted data query processing unit is used to check whether the data contains the corresponding target encrypted field according to the data desensitization rules when a user queries the data stored in the database. If so, the target encrypted field is obtained from the database, and the target encrypted field is decrypted by calling the data desensitization rules using the SM4 encryption extender to obtain the corresponding plaintext data, which is then returned to the user.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method for desensitizing sensitive fields in a database as described in any one of claims 1-4.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the method for desensitizing sensitive fields in a database as described in any one of claims 1-4.

Images