Data desensitization method, device, computer equipment and storage medium

Abstract

The present application relates to a data desensitization method, device, computer equipment, storage medium and computer program product. The method comprises: when the bus architecture is an enterprise service bus architecture, obtaining a first transmission protocol type used for transmitting a call request from a request header field of a corresponding message of the call request; when the first transmission protocol type is an http protocol, determining whether the call request is forwarded via a gateway by judging whether a key value in a request header field of a corresponding message of the call request is empty to indicate that the call request is forwarded via a gateway; when the call request is forwarded via a gateway, obtaining respective service party identifiers of a first service provider and a second service provider from a request header field of a corresponding message of the call request; and mapping the enterprise service bus architecture, the http protocol and respective service party identifiers of the first service provider and the second service provider to corresponding first encryption decision messages according to preset mapping rules.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a data desensitization method, apparatus, computer equipment, storage medium and computer program product. Background Art

[0002] In recent years, the requirements for data security and confidentiality have become increasingly stringent, especially in recent years, a number of security and confidentiality regulations and even laws related to financial institutions have been issued, which has posed higher challenges to the IT architecture system of banks. The traditional monolithic IT architecture system cannot meet the existing needs due to the limitation of single service, so the microservice architecture is introduced to solve these problems by using the flexibility of the microservice architecture.

[0003] Under the microservice framework, the data desensitization technology of financial institutions is currently mainly focused on static desensitization and dynamic desensitization. In the related technology, the dynamic desensitization method under the microservice framework is usually to determine the encryption rules of the required returned data by judging whether the call request issued by the service caller is forwarded through the microservice gateway. Among them, the request issued by the service caller is forwarded through the microservice gateway, corresponding to one encryption rule; and the call request issued by the service caller is not forwarded through the microservice gateway, corresponding to another encryption rule. The above desensitization process has the problem of low flexibility. Summary of the invention

[0004] Based on this, it is necessary to provide a data desensitization method, device, computer equipment, computer-readable storage medium and computer program product that can improve the flexibility of the desensitization process in response to the above-mentioned technical problems, which relates to the field of information security technology.

[0005] In a first aspect, the present application provides a data desensitization method. The method is implemented based on the sidecar services corresponding to the first service provider and the second service provider; the method includes:

[0006] When a call request sent by the first service provider to the second service provider is obtained, the bus architecture between the first service provider and the second service provider is determined by parsing a message corresponding to the call request;

[0007] In the case where the bus architecture is an enterprise service bus architecture, a first transmission protocol type used for transmitting the call request is obtained from a request header field of a message corresponding to the call request through a request header obtaining function;

[0008] In the case where the first transmission protocol type is the http protocol, determining whether the call request is forwarded via the gateway by judging whether the key value in the request header field of the corresponding message of the call request, which is used to indicate that the call request is forwarded via the gateway, is empty;

[0009] In the case where the call request is forwarded via the gateway, obtaining the service provider identifiers of the first service provider and the second service provider from the request header field of the corresponding message of the call request;

[0010] According to the preset mapping rules, the enterprise service bus architecture, http protocol, and the respective service provider identifiers of the first service provider and the second service provider are mapped into corresponding first encryption decision messages, and the first encryption decision message is returned to the second service provider; the first encryption decision message is used to instruct the second service provider to encrypt the required return data according to the encryption method type carried by the first encryption decision message when receiving the call request sent by the first service provider.

[0011] In one embodiment, after determining whether the call request is forwarded via the gateway by judging whether the key value in the request header field of the corresponding message of the call request is empty and indicating that the call request is forwarded via the gateway, the method includes:

[0012] When the call request is not forwarded via the gateway, the enterprise service bus architecture and the service provider identifiers of the first service provider and the second service provider are mapped into corresponding second encryption decision messages according to the preset mapping rules, and the second encryption decision message is returned to the second service provider; the second encryption decision message is used to instruct the second service provider not to encrypt the required return data when receiving the call request sent by the first service provider.

[0013] In one embodiment, after obtaining the first transmission protocol type used for transmitting the call request from the request header field of the corresponding message of the call request through the request header obtaining function, the method includes:

[0014] When the first transmission protocol type is the https protocol, obtaining the service provider identifiers of the first service provider and the second service provider from the request header field of the corresponding message of the call request;

[0015] According to the preset mapping rules, the enterprise service bus architecture, the https protocol, and the respective service provider identifiers of the first service provider and the second service provider are mapped into corresponding third encrypted decision messages, and the third encrypted decision message is returned to the second service provider; the third encrypted decision message is used to instruct the second service provider to encrypt the required return data according to the encryption method type carried by the third encrypted decision message when receiving the call request sent by the first service provider.

[0016] In one embodiment, after determining the bus architecture between the first service provider and the second service provider by parsing the message corresponding to the call request, the method includes:

[0017] In the case where the bus architecture is a point-to-point architecture, parsing the protocol type field in the corresponding message of the call request to obtain the first transmission protocol type used for transmitting the call request;

[0018] When the first transmission protocol type is TCP or UDP, parse the transmission data description field of the call request to obtain the network architecture type and the service provider identifiers of the first service provider and the second service provider;

[0019] According to the preset mapping rules, the point-to-point architecture, the network architecture type, the first transmission protocol type, and the respective service provider identifiers of the first service provider and the second service provider are mapped into corresponding fourth encryption decision messages, and the fourth encryption decision message is returned to the second service provider; the fourth encryption decision message is used to instruct the second service provider to encrypt the required return data according to the encryption method type carried by the fourth encryption decision message when receiving the call request sent by the first service provider.

[0020] In one embodiment, the method further comprises:

[0021] In the case where the calling request sent by the first service provider to the second service provider is not obtained, obtaining the target data returned by the second service provider in response to the calling request;

[0022] By parsing the target data, a bus architecture between the first service provider and the second service provider and a second transmission protocol type used to transmit the target data are obtained;

[0023] According to the preset mapping rules, the bus architecture and the second transmission protocol type are mapped to the corresponding fifth encryption decision message, and the fifth encryption decision message is returned to the second service party; the fifth encryption decision message is used to instruct the second service party to encrypt the required return data according to the encryption method type carried by the fifth encryption decision message when receiving the call request sent by the first service party.

[0024] In one embodiment, the method further comprises:

[0025] When the first service party receives the first encrypted data returned by the second service party based on the third encryption decision message, and the service party identifier of the first service party and / or the service party identifier of the second service party are not service party identifiers covered by the preset mapping rules, the enterprise service bus architecture, the https protocol, and the respective service party identifiers of the first service party and the second service party are mapped to the corresponding first decryption decision message in accordance with the preset mapping rules, and the first decryption decision message is returned to the first service party; the first decryption decision message does not carry the key for decrypting the first encrypted data.

[0026] In a second aspect, the present application also provides a data desensitization device. The device comprises:

[0027] A first determination module is used to determine the bus architecture between the first service provider and the second service provider by parsing a message corresponding to the call request when a call request sent by the first service provider to the second service provider is obtained;

[0028] A first acquisition module is used to acquire a first transmission protocol type used for transmitting the call request from a request header field of a message corresponding to the call request through a request header acquisition function when the bus architecture is an enterprise service bus architecture;

[0029] A second determination module is used to determine whether the call request is forwarded via the gateway by judging whether the key value used to indicate that the call request is forwarded via the gateway in the request header field of the corresponding message of the call request is empty when the first transmission protocol type is the http protocol;

[0030] A second acquisition module is used to acquire the service provider identifications of the first service provider and the second service provider from the request header field of the corresponding message of the call request when the call request is forwarded via the gateway;

[0031] The first mapping module is used to map the enterprise service bus architecture, the http protocol, and the respective service provider identifiers of the first service provider and the second service provider into corresponding first encryption decision messages according to preset mapping rules, and return the first encryption decision message to the second service provider; the first encryption decision message is used to instruct the second service provider to encrypt the required return data according to the encryption method type carried by the first encryption decision message when receiving the call request sent by the first service provider.

[0032] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0033] When a call request sent by the first service provider to the second service provider is obtained, the bus architecture between the first service provider and the second service provider is determined by parsing a message corresponding to the call request;

[0034] In the case where the bus architecture is an enterprise service bus architecture, a first transmission protocol type used for transmitting the call request is obtained from a request header field of a message corresponding to the call request through a request header obtaining function;

[0035] In the case where the first transmission protocol type is the http protocol, determining whether the call request is forwarded via the gateway by judging whether the key value in the request header field of the corresponding message of the call request, which is used to indicate that the call request is forwarded via the gateway, is empty;

[0036] In the case where the call request is forwarded via the gateway, obtaining the service provider identifiers of the first service provider and the second service provider from the request header field of the corresponding message of the call request;

[0037] According to the preset mapping rules, the enterprise service bus architecture, http protocol, and the respective service provider identifiers of the first service provider and the second service provider are mapped into corresponding first encryption decision messages, and the first encryption decision message is returned to the second service provider; the first encryption decision message is used to instruct the second service provider to encrypt the required return data according to the encryption method type carried by the first encryption decision message when receiving the call request sent by the first service provider.

[0038] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0039] When a call request sent by the first service provider to the second service provider is obtained, the bus architecture between the first service provider and the second service provider is determined by parsing a message corresponding to the call request;

[0040] In the case where the bus architecture is an enterprise service bus architecture, a first transmission protocol type used for transmitting the call request is obtained from a request header field of a message corresponding to the call request through a request header obtaining function;

[0041] In the case where the first transmission protocol type is the http protocol, determining whether the call request is forwarded via the gateway by judging whether the key value in the request header field of the corresponding message of the call request, which is used to indicate that the call request is forwarded via the gateway, is empty;

[0042] In the case where the call request is forwarded via the gateway, obtaining the service provider identifiers of the first service provider and the second service provider from the request header field of the corresponding message of the call request;

[0043] According to the preset mapping rules, the enterprise service bus architecture, http protocol, and the respective service provider identifiers of the first service provider and the second service provider are mapped into corresponding first encryption decision messages, and the first encryption decision message is returned to the second service provider; the first encryption decision message is used to instruct the second service provider to encrypt the required return data according to the encryption method type carried by the first encryption decision message when receiving the call request sent by the first service provider.

[0044] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0045] When a call request sent by the first service provider to the second service provider is obtained, the bus architecture between the first service provider and the second service provider is determined by parsing a message corresponding to the call request;

[0046] In the case where the bus architecture is an enterprise service bus architecture, a first transmission protocol type used for transmitting the call request is obtained from a request header field of a message corresponding to the call request through a request header obtaining function;

[0047] In the case where the first transmission protocol type is the http protocol, determining whether the call request is forwarded via the gateway by judging whether the key value in the request header field of the corresponding message of the call request, which is used to indicate that the call request is forwarded via the gateway, is empty;

[0048] In the case where the call request is forwarded via the gateway, obtaining the service provider identifiers of the first service provider and the second service provider from the request header field of the corresponding message of the call request;

[0049] According to the preset mapping rules, the enterprise service bus architecture, http protocol, and the respective service provider identifiers of the first service provider and the second service provider are mapped into corresponding first encryption decision messages, and the first encryption decision message is returned to the second service provider; the first encryption decision message is used to instruct the second service provider to encrypt the required return data according to the encryption method type carried by the first encryption decision message when receiving the call request sent by the first service provider.

[0050] The above-mentioned data desensitization method, device, computer equipment, storage medium and computer program product, on the one hand, because the encryption strategy of the required returned data is determined based on the bus architecture between the first service provider and the second service provider, the first transmission protocol type adopted by the call request, whether the call request is forwarded via the gateway, and the service provider identification of the first service provider and the second service provider, compared with the method of determining the encryption strategy of the required returned data based only on the information of whether the call request is forwarded via the gateway, the information used to determine the encryption strategy has a higher granularity, thereby achieving more flexible desensitization of the required returned data, thereby improving the flexibility of the desensitization process and solving the problem of low flexibility of the desensitization process. On the other hand, since the above-mentioned method is implemented based on the sidecar service of the second service provider, when the corresponding acquisition logic of the first encryption decision message needs to be updated, only the sidecar service of the second service provider needs to be updated, and the second service provider only needs to be responsible for business logic processing and can still provide services normally, thereby improving the availability of the second service provider. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 The following is a flow chart of a data desensitization method in one embodiment;

[0052] Figure 2 A schematic diagram of the connection relationship between microservices in a data desensitization method in an embodiment;

[0053] Figure 3 The following is a flow chart of a data desensitization method in one embodiment;

[0054] Figure 4 Schematic diagram of a data desensitization method in another embodiment;

[0055] Figure 5 A schematic diagram of the connection relationship between microservices in a data desensitization method in another embodiment;

[0056] Figure 6 It is a flowchart of a data desensitization method in another embodiment;

[0057] Figure 7 is a structural block diagram of a data desensitization device in one embodiment;

[0058] Figure 8 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0059] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0060] It is understood that the terms "first", "second", etc. used in this application can be used in this article to describe various professional terms, but unless otherwise specified, these professional terms are not limited by these terms. These terms are only used to distinguish one professional term from another professional term. For example, without departing from the scope of this application, the first transmission protocol type and the second transmission protocol type can be the same or different.

[0061] In recent years, the requirements for data security and confidentiality have become increasingly stringent, especially in recent years, a number of security and confidentiality regulations and even laws related to financial institutions have been issued, which has posed higher challenges to the IT architecture system of banks. The traditional monolithic IT architecture system cannot meet the existing needs due to the limitation of single service, so the microservice architecture is introduced to solve these problems by using the flexibility of the microservice architecture.

[0062] Under the microservice framework, the data desensitization technology of financial institutions is currently mainly focused on static desensitization and dynamic desensitization. In the related technology, the dynamic desensitization method under the microservice framework is usually to determine the encryption rules of the required returned data by judging whether the call request issued by the service caller is forwarded through the microservice gateway. Among them, the request issued by the service caller is forwarded through the microservice gateway, corresponding to one encryption rule; and the call request issued by the service caller is not forwarded through the microservice gateway, corresponding to another encryption rule. The above desensitization process has the problem of low flexibility.

[0063] In view of the problems existing in the above-mentioned related technologies, an embodiment of the present invention provides a data desensitization method, which can be applied to a server, a terminal, or a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. Among them, the server can be implemented with an independent server or a server cluster consisting of multiple servers. The terminal can be, but is not limited to, various personal computers, laptops, smart phones, tablet computers, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car-mounted devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. It should be noted that the numbers of "multiple" and the like mentioned in each embodiment of the present application all refer to the number of "at least two", for example, "multiple" refers to "at least two".

[0064] In one embodiment, Figure 1 As shown, a data desensitization method is provided. This embodiment takes the method applied to a server as an example for illustration. The method is implemented based on the sidecar services corresponding to the first service provider and the second service provider. The method includes the following steps:

[0065] 102. When a call request sent by the first service provider to the second service provider is obtained, determine the bus architecture between the first service provider and the second service provider by parsing a message corresponding to the call request.

[0066] The first service provider and the second service provider are both microservices.

[0067] For ease of understanding, the corresponding sidecar services of the first service provider and the second service provider are explained. The sidecar service of the second service provider refers to: by deploying a service mesh proxy next to the second service provider, it handles service discovery, traffic management, load balancing, health checks, circuit breakers, failover, authentication, and other functions. The explanation of the sidecar service of the first service provider can refer to the explanation of the sidecar service of the second service provider, which will not be repeated here.

[0068] In addition, the acquisition of the first encryption decision message can be implemented based on the sidecar service of the second service provider. The reason why it is not implemented directly based on the second service provider is that when the corresponding acquisition logic of the first encryption decision message needs to be updated, this method is implemented based on the sidecar service of the second service provider. Only the sidecar service of the second service provider needs to be updated, and the second service provider only needs to be responsible for business logic processing. The second service provider can still provide services normally, thereby improving the availability of the second service provider.

[0069] 104. When the bus architecture is an enterprise service bus architecture, a first transmission protocol type used for transmitting the call request is obtained from a request header field of a corresponding message of the call request through a request header obtaining function.

[0070] For ease of understanding, when the bus architecture is an enterprise service bus architecture, the connection relationship between microservices can be as follows: Figure 2 It should be noted that Figure 2 The nodes in can be distributed clusters with independent processing capabilities. Figure 2 As shown, steps 104 to 110 can be implemented based on the desensitizing interceptor in the sidecar service of the second service provider, and this embodiment of the present application does not specifically limit this.

[0071] The request header acquisition function may be httpServletRequest.getHeader(key). Specifically, the request header field in step 104 may be an X-forwarded-proto key-value pair, and accordingly, the first transmission protocol type adopted by the transmission call request may be acquired through the X-forwarded-proto key-value pair.

[0072] 106. When the first transmission protocol type is the http protocol, determine whether the call request is forwarded via the gateway by judging whether the key value in the request header field of the corresponding message of the call request, which is used to indicate that the call request is forwarded via the gateway, is empty.

[0073] like Figure 2 As shown, a desensitizing filter can be added to the microservice gateway, and the desensitizing filter injects a custom header request header into the request passing through the gateway. For example, the microservice gateway is a zuul gateway, and the statement for injecting a custom header request header into the request passing through the gateway can be: RequestContext.addZuulRequestHeader(name:"X-forwarded-prefix",value:" / zuur-Gzone102").

[0074] It should be noted that the reason why the value is assigned to / zuur-Gzone102, a name associated with a specific gateway server, is to facilitate the expansion of more fine-grained encryption and decryption rules in the future.

[0075] It is understandable that since the desensitizing filter will inject a custom header request header into the request passing through the gateway, when the call request is forwarded via the gateway, the key value in the request header field of the corresponding message of the call request used to indicate that the call request is forwarded via the gateway will not be empty.

[0076] Accordingly, by judging whether the key value in the request header field of the corresponding message of the call request, which is used to indicate that the call request is forwarded via the gateway, determining whether the call request is forwarded via the gateway may include: when the key value in the request header of the call request, which is used to indicate that the call request is forwarded via the gateway, is empty, determining that the call request is not forwarded via the gateway; when the key value in the request header of the call request, which is used to indicate that the call request is forwarded via the gateway, is not empty, determining that the call request is forwarded via the gateway.

[0077] It should be noted that the request header field in step 106 may be x-forwarded-prefix. When the call request is forwarded via a gateway, the key value in the x-forwarded-prefix field used to indicate that the call request is forwarded via the gateway may be / zuur-Gzone102. When the call request is not forwarded via a gateway, the key value in the x-forwarded-prefix field used to indicate that the call request is forwarded via the gateway may be empty.

[0078] Combination Figure 2 It can be understood that, when the first transmission protocol type is the http protocol and the call request is forwarded via the gateway, it means that the call between the first service provider and the second service provider is an internal core business system call. When the first transmission protocol type is the http protocol and the call request is not forwarded via the gateway, it means that the call between the first service provider and the second service provider is an internal node microservice call.

[0079] 108. In the case where the call request is forwarded via the gateway, obtain the service provider identifiers of the first service provider and the second service provider from the request header field of the corresponding message of the call request.

[0080] The request header field in step 108 may be an X-b3-spanid key-value pair. Accordingly, the service provider identifiers of the first service provider and the second service provider may be obtained through the X-b3-spanid key-value pair.

[0081] 110. According to the preset mapping rules, the enterprise service bus architecture, the http protocol, and the respective service provider identifiers of the first service provider and the second service provider are mapped into corresponding first encryption decision messages, and the first encryption decision message is returned to the second service provider; the first encryption decision message is used to instruct the second service provider to encrypt the required return data according to the encryption method type carried by the first encryption decision message when receiving the call request sent by the first service provider.

[0082] The preset mapping rules may be as shown in Table 1:

[0083] Table 1

[0084]

[0085] In Table 1, ESB refers to the enterprise service bus architecture, P2P refers to the point-to-point architecture, the caller refers to the first service provider, and the provider refers to the second service provider. It should be noted that Table 1 only gives an example of the preset mapping rules in a certain application scenario. In actual application scenarios, the preset mapping rules can be set in combination with the application scenarios and customer needs. Different application scenarios or different customer needs will result in different preset mapping rules.

[0086] When the preset mapping rule is as shown in Table 1, the encryption mode type carried by the first encryption decision message may be 3DES, where 3DES is a triple data encryption algorithm.

[0087] In the above data desensitization method, when a call request sent by the first service provider to the second service provider is obtained, the bus architecture between the first service provider and the second service provider is determined by parsing the message corresponding to the call request; when the bus architecture is an enterprise service bus architecture, the first transmission protocol type used for transmitting the call request is obtained from the request header field of the message corresponding to the call request through a request header acquisition function; when the first transmission protocol type is the http protocol, it is determined whether the call request is forwarded via the gateway by judging whether the key value used to indicate that the call request is forwarded via the gateway in the request header field of the message corresponding to the call request is empty; when the call request is forwarded via the gateway, the service party identifiers of the first service provider and the second service provider are obtained from the request header field of the message corresponding to the call request; according to the preset mapping rule, the enterprise service bus architecture, the http protocol and the service party identifiers of the first service provider and the second service provider are mapped to the corresponding first encryption decision message, and the first encryption decision message is returned to the second service provider; the first encryption decision message is used to instruct the second service provider to encrypt the required returned data according to the encryption method type carried by the first encryption decision message when receiving the call request sent by the first service provider.

[0088] On the one hand, since the encryption strategy of the data to be returned is determined based on information in several dimensions, including the bus architecture between the first service party and the second service party, the first transmission protocol type adopted by the call request, whether the call request is forwarded via a gateway, and the service party identifications of the first service party and the second service party, compared with the method of determining the encryption strategy of the data to be returned based only on information in one dimension, namely whether the call request is forwarded via a gateway, the information used to determine the encryption strategy has a higher granularity, thereby achieving more flexible desensitization of the data to be returned, thereby improving the flexibility of the desensitization process and solving the problem of low flexibility of the desensitization process.

[0089] On the other hand, since the above method is implemented based on the sidecar service of the second service provider, when the corresponding acquisition logic of the first encryption decision message needs to be updated, only the sidecar service of the second service provider needs to be updated, and the second service provider only needs to be responsible for business logic processing and can still provide services normally, thereby improving the availability of the second service provider.

[0090] In one embodiment, after determining whether the call request is forwarded via the gateway by judging whether the key value in the request header field of the corresponding message of the call request is empty and indicating that the call request is forwarded via the gateway, the method includes:

[0091] When the call request is not forwarded via the gateway, the enterprise service bus architecture and the service provider identifiers of the first service provider and the second service provider are mapped into corresponding second encryption decision messages according to the preset mapping rules, and the second encryption decision message is returned to the second service provider; the second encryption decision message is used to instruct the second service provider not to encrypt the required return data when receiving the call request sent by the first service provider.

[0092] Among them, the acquisition of the second encryption decision message can also be achieved based on the sidecar service of the second service provider.

[0093] It is understandable that, when the call request is not forwarded via the gateway, the call between the first service provider and the second service provider is an internal core business system call, and there is no need to encrypt the required returned data. When the preset mapping rule is Table 1, the second encryption decision message can be determined based on the encryption and decryption rule with an encryption and decryption rule ID of 6 in Table 1.

[0094] In this embodiment, when the call request is not forwarded through the gateway, the enterprise service bus architecture and the service provider identifiers of the first service provider and the second service provider are mapped into corresponding second encryption decision messages according to preset mapping rules, and the second encryption decision message is returned to the second service provider; the second encryption decision message is used to instruct the second service provider not to encrypt the required return data when receiving the call request sent by the first service provider.

[0095] Since the encryption strategy for the data to be returned is determined based on information in several dimensions, including the bus architecture between the first service provider and the second service provider, the first transmission protocol type adopted by the call request, whether the call request is forwarded via a gateway, and the service provider identifications of the first service provider and the second service provider, compared with a method of determining the encryption strategy for the data to be returned based only on information in one dimension, namely whether the call request is forwarded via a gateway, the information used to determine the encryption strategy has a higher granularity, thereby achieving more flexible desensitization of the data to be returned, thereby improving the flexibility of the desensitization process and solving the problem of low flexibility of the desensitization process.

[0096] In one embodiment, Figure 3 As shown, after step 104, the following steps are included:

[0097] 302. When the first transmission protocol type is the https protocol, obtain the service provider identifiers of the first service provider and the second service provider from the request header field of the corresponding message of the call request.

[0098] It can be understood that when the first transmission protocol type is the https protocol, the calling relationship between the first service provider and the second service provider is a call between an internal core business system and an external system.

[0099] Among them, the explanation of the request header field in step 302 can refer to the explanation of the request header field in the above step 108, which will not be repeated here.

[0100] 304. According to the preset mapping rules, the enterprise service bus architecture, the https protocol, and the respective service provider identifiers of the first service provider and the second service provider are mapped into corresponding third encryption decision messages, and the third encryption decision message is returned to the second service provider; the third encryption decision message is used to instruct the second service provider to encrypt the required return data according to the encryption method type carried by the third encryption decision message when receiving the call request sent by the first service provider.

[0101] Among them, the acquisition of the third encryption decision message can also be achieved based on the sidecar service of the second service provider.

[0102] When the preset mapping rule is Table 1, the encryption type carried by the third encryption decision message may be asymmetric encryption. Specifically, RSA may be used to encrypt the data to be returned.

[0103] In the present embodiment, since the encryption strategy for the data to be returned is determined based on information of several dimensions, including the bus architecture between the first service party and the second service party, the first transmission protocol type adopted by the call request, and the service party identifications of the first service party and the second service party, compared with the method of determining the encryption strategy for the data to be returned based only on information of one dimension, namely, whether the call request is forwarded via a gateway, the information used to determine the encryption strategy has a higher granularity, thereby achieving more flexible desensitization of the data to be returned, thereby improving the flexibility of the desensitization process and solving the problem of low flexibility of the desensitization process.

[0104] In one embodiment, Figure 4 As shown, after step 102, the following steps are included:

[0105] 402. When the bus architecture is a point-to-point architecture, parse the protocol type field in the corresponding message of the call request to obtain the first transmission protocol type used for transmitting the call request.

[0106] For ease of understanding, when the bus architecture is a point-to-point architecture, the connection relationship between microservices can be as follows: Figure 5 shown.

[0107] 404. When the first transmission protocol type is TCP or UDP, parse the transmission data description field of the call request to obtain the network architecture type and the service provider identifiers of the first service provider and the second service provider.

[0108] Specifically, the traffic characteristics of the transmission data description field of the call request are identified to obtain the network architecture type and the service provider identifications of the first service provider and the second service provider.

[0109] 406. According to the preset mapping rules, the point-to-point architecture, the network architecture type, the first transmission protocol type, and the respective service provider identifiers of the first service provider and the second service provider are mapped into corresponding fourth encryption decision messages, and the fourth encryption decision message is returned to the second service provider; the fourth encryption decision message is used to instruct the second service provider to encrypt the required return data according to the encryption method type carried by the fourth encryption decision message when receiving the call request sent by the first service provider.

[0110] Among them, the acquisition of the fourth encryption decision message can also be achieved based on the sidecar service of the second service provider.

[0111] When the preset mapping rule is Table 1, the encryption type carried by the fourth encryption decision message may be ECC. ECC is an elliptic encryption algorithm, and since ECC is much faster than other algorithms in processing private keys (decryption and signing) and generating keys, and keys of the same length have higher security strength, it is very suitable for point-to-point architecture.

[0112] In the present embodiment, since the encryption strategy for the data to be returned is determined based on information of several dimensions, including the bus architecture between the first service provider and the second service provider, the first transmission protocol type adopted by the call request, the network architecture type, and the service provider identifications of the first service provider and the second service provider respectively, compared with the method of determining the encryption strategy for the data to be returned based only on information of one dimension, namely, whether the call request is forwarded via a gateway, the information used to determine the encryption strategy has a higher granularity, thereby achieving more flexible desensitization of the data to be returned, thereby improving the flexibility of the desensitization process and solving the problem of low flexibility of the desensitization process.

[0113] In one embodiment, Figure 6 As shown, the method also includes:

[0114] 602. If the calling request sent by the first service provider to the second service provider is not obtained, obtain the target data returned by the second service provider in response to the calling request.

[0115] Wherein, if the calling request sent by the first service provider to the second service provider is not obtained, the first service provider and the second service provider communicate with each other through Figure 5 Interact with the lines in .

[0116] It should be noted that Figure 5 The Helper in is a connection, through which data between services are exchanged. A connection can be seen as a connection between services. A logical connection is defined as a connection from an output queue of one service to an input queue of another service. A connection is an instantiation of a logical connection, which is responsible for moving data from the output queue of a specific service provider to the downstream node. Through the connection, communication between services is asynchronous, which is a typical implementation of a point-to-point architecture for microservices. The connection is also responsible for flow control and load balancing, and can automatically balance the load according to the processing capacity of the downstream node.

[0117] 604. Obtain the bus architecture between the first service provider and the second service provider and the second transmission protocol type used to transmit the target data by parsing the target data.

[0118] Among them, the bus architecture can be a point-to-point architecture, and the second transmission protocol type is the http protocol.

[0119] 606. According to the preset mapping rules, the bus architecture and the second transmission protocol type are mapped to the corresponding fifth encryption decision message, and the fifth encryption decision message is returned to the second service party; the fifth encryption decision message is used to instruct the second service party to encrypt the required return data according to the encryption method type carried by the fifth encryption decision message when receiving the call request sent by the first service party.

[0120] Among them, the acquisition of the fifth encryption decision message can also be achieved based on the sidecar service of the second service provider.

[0121] When the preset mapping rule is Table 1, the encryption type carried by the fifth encryption decision message may be ECC.

[0122] It can be understood that when the calling request sent by the first service party to the second service party is not obtained, since the calling relationship between the first service party and the second service party is defined in the connection, the communication is an asynchronous relationship, and the second service party does not know the service party identifier of the first service party. Therefore, in this case, the five encryption decision messages are determined directly based on the bus architecture and the second transmission protocol type.

[0123] In the present embodiment, since the encryption strategy of the data to be returned is determined based on information of two dimensions, namely, the bus architecture between the first service party and the second service party and the second transmission protocol type used to transmit the target data, when the call request sent from the first service party to the second service party is not obtained, compared with the method of determining the encryption strategy of the data to be returned based only on information of one dimension, namely, whether the call request is forwarded via a gateway, the information used to determine the encryption strategy has a higher granularity, thereby achieving more flexible desensitization of the data to be returned and solving the problem of low flexibility in the desensitization process.

[0124] In one embodiment, the method further comprises:

[0125] When the first service party receives the first encrypted data returned by the second service party based on the third encryption decision message, and the service party identifier of the first service party and / or the service party identifier of the second service party are not service party identifiers covered by the preset mapping rules, the enterprise service bus architecture, the https protocol, and the respective service party identifiers of the first service party and the second service party are mapped to the corresponding first decryption decision message in accordance with the preset mapping rules, and the first decryption decision message is returned to the first service party; the first decryption decision message does not carry the key for decrypting the first encrypted data.

[0126] The acquisition of the first decryption decision message can be implemented based on the sidecar service of the first service provider. The reason why it is not implemented directly based on the first service provider is that when the corresponding acquisition logic of the first decryption decision message needs to be updated, this method is implemented based on the sidecar service of the first service provider. Only the sidecar service of the first service provider needs to be updated, and the first service provider only needs to be responsible for business logic processing. The first service provider can still provide services normally, thereby improving the availability of the first service provider.

[0127] In the above case, it means that the first service provider is an external user, and the first service provider has no corresponding key for decryption, and the first service provider can only see meaningless first encrypted data.

[0128] In the present embodiment, on the one hand, since the decryption strategy for the first encrypted data is determined based on information of several dimensions, including the bus architecture between the first service party and the second service party, the first transmission protocol type adopted by the call request, and the service party identifications of the first service party and the second service party respectively, compared with the method of determining the decryption strategy for the first encrypted data based only on information of one dimension, namely, whether the call request is forwarded via a gateway, the information used to determine the decryption strategy has a higher granularity, thereby achieving more flexible decryption of the first encrypted data, thereby improving the flexibility of the decryption process.

[0129] On the other hand, since the first service party is an external user when the service party identifier of the first service party and / or the service party identifier of the second service party are not covered by the preset mapping rules, the first service party is an external user. Therefore, in order to improve the security of the second service party, according to the preset mapping rules, the enterprise service bus architecture, the https protocol, and the service party identifiers of the first service party and the second service party are mapped to the corresponding first decryption decision message, and the first decryption decision message does not carry the key for decrypting the first encrypted data, ensuring that when the service party identifier of the first service party and / or the service party identifier of the second service party are not covered by the preset mapping rules, the first service party has no corresponding key for decryption. The first service party can only see the meaningless first encrypted data, thereby improving the security of the second service party.

[0130] In one embodiment, the method further comprises:

[0131] When the first service provider receives the second encrypted data returned by the second service provider based on the fifth encryption decision message, the service provider identifications of the first service provider and the second service provider are obtained.

[0132] Specifically, the service provider identifications of the first service provider and the second service provider may be obtained according to the data acquisition logic of the first service provider, wherein the data acquisition logic may be the execution code of the first service provider.

[0133] According to the preset mapping rules, the bus architecture, the second transmission protocol type, and the respective service party identifiers of the first service party and the second service party are mapped into corresponding second decryption decision messages, and the second decryption decision message is returned to the first service party; the second decryption decision message is used to instruct the first service party to decrypt the second encrypted data according to the decryption method type carried by the second decryption decision message when receiving the second encrypted data returned by the second service party based on the fifth encryption decision message.

[0134] Among them, when the preset mapping rule is Table 1, the decryption method type carried by the second decryption decision message may be ECC.

[0135] In the present embodiment, since the decryption strategy for the second encrypted data is determined based on information of several dimensions, namely, the bus architecture between the first service provider and the second service provider, the second transmission protocol type, and the service provider identifications of the first service provider and the second service provider respectively, compared with a method of determining the decryption strategy for the second encrypted data based only on information of one dimension, namely, whether the call request is forwarded via a gateway, the information used to determine the decryption strategy has a higher granularity, thereby achieving more flexible decryption of the second encrypted data, thereby improving the flexibility of the decryption process.

[0136] In one embodiment, the method further comprises:

[0137] When the first service party receives the third encrypted data returned by the second service party based on the third encryption decision message, the enterprise service bus architecture, the http protocol, and the service party identifiers of the first service party and the second service party are mapped into corresponding third decryption decision messages according to preset mapping rules, and the third decryption decision message is returned to the first service party; the third decryption decision message is used to instruct the first service party to decrypt the third encrypted data according to the decryption method type carried by the third decryption decision message when receiving the third encrypted data returned by the second service party based on the first encryption decision message.

[0138] Wherein, when the preset mapping rule is as shown in Table 1, the decryption mode type carried by the third decryption decision message may be 3DES. It should be noted that 3DES is a triple data encryption algorithm.

[0139] In the present embodiment, since the decryption strategy for the third encrypted data is determined based on information of several dimensions, namely, the bus architecture between the first service provider and the second service provider, the first transmission protocol type, and the service provider identifications of the first service provider and the second service provider, compared with a method of determining the decryption strategy for the third encrypted data based only on information of one dimension, namely, whether the call request is forwarded via a gateway, the information used to determine the decryption strategy has a higher granularity, thereby achieving more flexible decryption of the third encrypted data, thereby improving the flexibility of the decryption process.

[0140] In one embodiment, the method further comprises:

[0141] When the first service party receives the fourth encrypted data returned by the second service party based on the third encryption decision message, and the service party identifiers of the first service party and the second service party are respectively covered by the preset mapping rules, the enterprise service bus architecture, the https protocol, and the service party identifiers of the first service party and the second service party are mapped to the corresponding fourth decryption decision message in accordance with the preset mapping rules, and the fourth decryption decision message is returned to the first service party; the fourth decryption decision message is used to instruct the first service party to decrypt the fourth encrypted data according to the decryption method type carried by the fourth decryption decision message when receiving the fourth encrypted data returned by the second service party based on the third encryption decision message.

[0142] Wherein, when the preset mapping rule is as shown in Table 1, the decryption method type carried by the fourth decryption decision message may be RSA, where RSA is an asymmetric cryptographic algorithm.

[0143] In the present embodiment, since the decryption strategy for the fourth encrypted data is determined based on information of several dimensions, namely, the bus architecture between the first service provider and the second service provider, the first transmission protocol type, and the service provider identifications of the first service provider and the second service provider respectively, compared with a method of determining the decryption strategy for the fourth encrypted data based only on information of one dimension, namely, whether the call request is forwarded via a gateway, the information used to determine the decryption strategy has a higher granularity, thereby achieving more flexible decryption of the fourth encrypted data, thereby improving the flexibility of the decryption process.

[0144] In one embodiment, the method further comprises:

[0145] When the first service party receives the fifth encrypted data returned by the second service party based on the fourth encryption decision message, the point-to-point architecture, the network architecture type, the first transmission protocol type, and the service party identifiers of the first service party and the second service party are mapped into the corresponding fifth decryption decision message according to the preset mapping rule, and the fifth decryption decision message is returned to the first service party; the fifth decryption decision message is used to instruct the first service party to decrypt the fifth encrypted data according to the decryption method type carried by the fifth decryption decision message when receiving the fifth encrypted data returned by the second service party based on the fourth encryption decision message.

[0146] Among them, when the preset mapping rule is Table 1, the decryption method type carried by the fifth decryption decision message may be ECC.

[0147] It should be noted that the acquisition of the second decryption decision message, the third decryption decision message, the fourth decryption decision message and the fifth decryption decision message can also be implemented based on the sidecar service of the first service provider.

[0148] In the present embodiment, since the decryption strategy for the fifth encrypted data is determined based on information of several dimensions, namely, the bus architecture between the first service provider and the second service provider, the first transmission protocol type, the network architecture type, and the service provider identifications of the first service provider and the second service provider respectively, compared with a method of determining the decryption strategy for the fifth encrypted data based only on information of one dimension, namely, whether the call request is forwarded via a gateway, the information used to determine the decryption strategy has a higher granularity, thereby achieving more flexible decryption of the fifth encrypted data, thereby improving the flexibility of the decryption process.

[0149] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0150] Based on the same inventive concept, the embodiment of the present application also provides a data desensitization device for implementing the data desensitization method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more data desensitization device embodiments provided below can refer to the limitations on the data desensitization method above, and will not be repeated here.

[0151] In one embodiment, Figure 7 As shown, a data desensitization device is provided, including: a first determination module 702, a first acquisition module 704, a second determination module 706, a second acquisition module 708 and a first mapping module 710, wherein:

[0152] A first determining module 702 is used to determine the bus architecture between the first service provider and the second service provider by parsing a message corresponding to the calling request when a calling request sent by the first service provider to the second service provider is obtained;

[0153] The first acquisition module 704 is used to acquire the first transmission protocol type adopted for transmitting the call request from the request header field of the corresponding message of the call request through the request header acquisition function when the bus architecture is an enterprise service bus architecture;

[0154] The second determination module 706 is used to determine whether the call request is forwarded via the gateway by judging whether the key value in the request header field of the corresponding message of the call request, which is used to indicate that the call request is forwarded via the gateway, is empty when the first transmission protocol type is the http protocol;

[0155] The second acquisition module 708 is used to acquire the service provider identifiers of the first service provider and the second service provider from the request header field of the corresponding message of the call request when the call request is forwarded via the gateway;

[0156] The first mapping module 710 is used to map the enterprise service bus architecture, the http protocol, and the respective service provider identifiers of the first service provider and the second service provider into corresponding first encryption decision messages according to preset mapping rules, and return the first encryption decision message to the second service provider; the first encryption decision message is used to instruct the second service provider to encrypt the required return data according to the encryption method type carried by the first encryption decision message when receiving the call request sent by the first service provider.

[0157] In one embodiment, the device further comprises:

[0158] The second mapping module is used to map the enterprise service bus architecture and the service provider identifiers of the first service provider and the second service provider into corresponding second encryption decision messages according to preset mapping rules when the call request is not forwarded via the gateway, and return the second encryption decision message to the second service provider; the second encryption decision message is used to instruct the second service provider not to encrypt the required return data when receiving the call request sent by the first service provider.

[0159] In one embodiment, the device further comprises:

[0160] A third acquisition module is used to acquire the service provider identifiers of the first service provider and the second service provider from the request header field of the corresponding message of the call request when the first transmission protocol type is the https protocol;

[0161] The third mapping module is used to map the enterprise service bus architecture, the https protocol, and the respective service provider identifiers of the first service provider and the second service provider into corresponding third encryption decision messages according to preset mapping rules, and return the third encryption decision message to the second service provider; the third encryption decision message is used to instruct the second service provider to encrypt the required return data according to the encryption method type carried by the third encryption decision message when receiving the call request sent by the first service provider.

[0162] In one embodiment, the device further comprises:

[0163] A fourth acquisition module, used for parsing the protocol type field in the corresponding message of the call request when the bus architecture is a point-to-point architecture, to obtain the first transmission protocol type adopted for transmitting the call request;

[0164] A fifth acquisition module, used for parsing the transmission data description field of the call request when the first transmission protocol type is the TCP protocol or the UDP protocol, and obtaining the network architecture type and the service provider identifiers of the first service provider and the second service provider respectively;

[0165] The fourth mapping module is used to map the point-to-point architecture, the network architecture type, the first transmission protocol type, and the respective service provider identifiers of the first service provider and the second service provider into corresponding fourth encryption decision messages according to preset mapping rules, and return the fourth encryption decision message to the second service provider; the fourth encryption decision message is used to instruct the second service provider to encrypt the required return data according to the encryption method type carried by the fourth encryption decision message when receiving the call request sent by the first service provider.

[0166] In one embodiment, the device further comprises:

[0167] A sixth acquisition module, configured to acquire target data returned by the second service provider in response to the call request if the call request sent by the first service provider to the second service provider is not acquired;

[0168] a seventh acquisition module, configured to obtain the bus architecture between the first service provider and the second service provider and the second transmission protocol type used for transmitting the target data by parsing the target data;

[0169] The fifth mapping module is used to map the bus architecture and the second transmission protocol type into the corresponding fifth encryption decision message according to the preset mapping rules, and return the fifth encryption decision message to the second service party; the fifth encryption decision message is used to instruct the second service party to encrypt the required return data according to the encryption method type carried by the fifth encryption decision message when receiving the call request sent by the first service party.

[0170] In one embodiment, the device further comprises:

[0171] The sixth mapping module is used to map the enterprise service bus architecture, the https protocol, and the respective service party identities of the first service party and the second service party into a corresponding first decryption decision message in accordance with the preset mapping rule, and return the first decryption decision message to the first service party when the first service party receives the first encrypted data returned by the second service party based on the third encryption decision message, and the service party identity of the first service party and / or the service party identity of the second service party are not service party identities covered by the preset mapping rule; the first decryption decision message does not carry a key for decrypting the first encrypted data.

[0172] Each module in the above-mentioned data desensitization device can be implemented in whole or in part by software, hardware and their combination. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0173] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 8 The computer device includes a processor, a memory and a network interface connected through a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store preset mapping rules, a first encryption decision message, a second encryption decision message, a third encryption decision message, a fourth encryption decision message, a fifth encryption decision message, and first to fourth decryption decision message data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a data desensitization method is implemented.

[0174] Those skilled in the art will understand that Figure 8 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0175] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0176] In the case of obtaining a call request sent by the first service provider to the second service provider, the bus architecture between the first service provider and the second service provider is determined by parsing the message corresponding to the call request; in the case where the bus architecture is an enterprise service bus architecture, the first transmission protocol type used for transmitting the call request is obtained from the request header field of the message corresponding to the call request through a request header acquisition function; in the case where the first transmission protocol type is the http protocol, by judging whether the key value used to indicate that the call request is forwarded via the gateway in the request header field of the message corresponding to the call request is empty, it is determined whether the call request is forwarded via the gateway; in the case where the call request is forwarded via the gateway, the service provider identifiers of the first service provider and the second service provider are obtained from the request header field of the message corresponding to the call request; according to the preset mapping rule, the enterprise service bus architecture, the http protocol and the service provider identifiers of the first service provider and the second service provider are mapped to the corresponding first encryption decision message, and the first encryption decision message is returned to the second service provider; the first encryption decision message is used to instruct the second service provider to encrypt the required returned data according to the encryption method type carried by the first encryption decision message when receiving the call request sent by the first service provider.

[0177] In one embodiment, when the processor executes the computer program, the following steps are also implemented: when the call request is not forwarded via the gateway, the enterprise service bus architecture and the respective service party identifiers of the first service party and the second service party are mapped into corresponding second encryption decision messages according to preset mapping rules, and the second encryption decision message is returned to the second service party; the second encryption decision message is used to instruct the second service party not to encrypt the required return data when receiving the call request sent by the first service party.

[0178] In one embodiment, the processor also implements the following steps when executing the computer program: when the first transmission protocol type is the https protocol, obtaining the respective service party identifications of the first service party and the second service party from the request header field of the corresponding message of the call request; according to the preset mapping rules, mapping the enterprise service bus architecture, the https protocol, and the respective service party identifications of the first service party and the second service party into corresponding third encryption decision messages, and returning the third encryption decision message to the second service party; the third encryption decision message is used to instruct the second service party to encrypt the required return data according to the encryption method type carried by the third encryption decision message when receiving the call request sent by the first service party.

[0179] In one embodiment, when the processor executes the computer program, the following steps are also implemented: when the bus architecture is a point-to-point architecture, the protocol type field in the corresponding message of the call request is parsed to obtain the first transmission protocol type used for transmitting the call request; when the first transmission protocol type is the TCP protocol or the UDP protocol, the transmission data description field of the call request is parsed to obtain the network architecture type and the service party identification of the first service party and the second service party respectively; according to the preset mapping rules, the point-to-point architecture, the network architecture type, the first transmission protocol type, and the service party identification of the first service party and the second service party are mapped to the corresponding fourth encryption decision message, and the fourth encryption decision message is returned to the second service party; the fourth encryption decision message is used to instruct the second service party to encrypt the required return data according to the encryption method type carried by the fourth encryption decision message when receiving the call request sent by the first service party.

[0180] In one embodiment, when the processor executes the computer program, the following steps are also implemented: in the case where the call request sent by the first service party to the second service party is not obtained, the target data returned by the second service party in response to the call request is obtained; by parsing the target data, the bus architecture between the first service party and the second service party, and the second transmission protocol type used to transmit the target data are obtained; according to the preset mapping rules, the bus architecture and the second transmission protocol type are mapped to the corresponding fifth encryption decision message, and the fifth encryption decision message is returned to the second service party; the fifth encryption decision message is used to instruct the second service party to encrypt the required return data according to the encryption method type carried by the fifth encryption decision message when receiving the call request sent by the first service party.

[0181] In one embodiment, when the processor executes the computer program, the following steps are also implemented: when the first service party receives the first encrypted data returned by the second service party based on the third encryption decision message, and the service party identifier of the first service party and / or the service party identifier of the second service party are not service party identifiers covered by the preset mapping rules, the enterprise service bus architecture, the https protocol, and the respective service party identifiers of the first service party and the second service party are mapped to the corresponding first decryption decision message according to the preset mapping rules, and the first decryption decision message is returned to the first service party; the first decryption decision message does not carry the key for decrypting the first encrypted data.

[0182] In one embodiment, a computer readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the following steps are implemented:

[0183] In the case of obtaining a call request sent by the first service provider to the second service provider, the bus architecture between the first service provider and the second service provider is determined by parsing the message corresponding to the call request; in the case where the bus architecture is an enterprise service bus architecture, the first transmission protocol type used for transmitting the call request is obtained from the request header field of the message corresponding to the call request through a request header acquisition function; in the case where the first transmission protocol type is the http protocol, by judging whether the key value used to indicate that the call request is forwarded via the gateway in the request header field of the message corresponding to the call request is empty, it is determined whether the call request is forwarded via the gateway; in the case where the call request is forwarded via the gateway, the service provider identifiers of the first service provider and the second service provider are obtained from the request header field of the message corresponding to the call request; according to the preset mapping rule, the enterprise service bus architecture, the http protocol and the service provider identifiers of the first service provider and the second service provider are mapped to the corresponding first encryption decision message, and the first encryption decision message is returned to the second service provider; the first encryption decision message is used to instruct the second service provider to encrypt the required returned data according to the encryption method type carried by the first encryption decision message when receiving the call request sent by the first service provider.

[0184] In one embodiment, when the computer program is executed by the processor, the following steps are also implemented: when the call request is not forwarded via the gateway, the enterprise service bus architecture and the service provider identifiers of the first service provider and the second service provider are mapped into corresponding second encryption decision messages according to preset mapping rules, and the second encryption decision message is returned to the second service provider; the second encryption decision message is used to instruct the second service provider not to encrypt the required return data when receiving the call request sent by the first service provider.

[0185] In one embodiment, a computer program product is provided, comprising a computer program, which, when executed by a processor, implements the following steps:

[0186] In the case of obtaining a call request sent by the first service provider to the second service provider, the bus architecture between the first service provider and the second service provider is determined by parsing the message corresponding to the call request; in the case where the bus architecture is an enterprise service bus architecture, the first transmission protocol type used for transmitting the call request is obtained from the request header field of the message corresponding to the call request through a request header acquisition function; in the case where the first transmission protocol type is the http protocol, by judging whether the key value used to indicate that the call request is forwarded via the gateway in the request header field of the message corresponding to the call request is empty, it is determined whether the call request is forwarded via the gateway; in the case where the call request is forwarded via the gateway, the service provider identifiers of the first service provider and the second service provider are obtained from the request header field of the message corresponding to the call request; according to the preset mapping rule, the enterprise service bus architecture, the http protocol and the service provider identifiers of the first service provider and the second service provider are mapped to the corresponding first encryption decision message, and the first encryption decision message is returned to the second service provider; the first encryption decision message is used to instruct the second service provider to encrypt the required returned data according to the encryption method type carried by the first encryption decision message when receiving the call request sent by the first service provider.

[0187] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0188] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0189] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A data desensitization method, characterized in that: The method is implemented based on the sidecar services corresponding to the first service provider and the second service provider; the method includes: In the case of acquiring a call request sent by the first service provider to the second service provider, determining a bus architecture between the first service provider and the second service provider by parsing a message corresponding to the call request; In the case where the bus architecture is an enterprise service bus architecture, a first transmission protocol type used for transmitting the call request is obtained from a request header field of a message corresponding to the call request through a request header obtaining function; In the case where the first transmission protocol type is the http protocol, determining whether the call request is forwarded via the gateway by judging whether the key value in the request header field of the corresponding message of the call request, which is used to indicate that the call request is forwarded via the gateway, is empty; In the case where the call request is forwarded via a gateway, obtaining the service provider identifiers of the first service provider and the second service provider from the request header field of the corresponding message of the call request; According to the preset mapping rules, the enterprise service bus architecture, the http protocol, and the respective service provider identifiers of the first service provider and the second service provider are mapped into corresponding first encryption decision messages, and the first encryption decision message is returned to the second service provider; the first encryption decision message is used to instruct the second service provider to encrypt the required return data according to the encryption method type carried by the first encryption decision message when receiving the call request sent by the first service provider.

2. The method according to claim 1, characterized in that: After determining whether the call request is forwarded via a gateway by judging whether the key value in the request header field of the corresponding message of the call request is empty and indicating that the call request is forwarded via a gateway, the method includes: In the case where the call request is not forwarded via the gateway, the enterprise service bus architecture and the respective service provider identifiers of the first service provider and the second service provider are mapped into corresponding second encryption decision messages in accordance with the preset mapping rules, and the second encryption decision message is returned to the second service provider; the second encryption decision message is used to instruct the second service provider not to encrypt the required return data when receiving the call request sent by the first service provider.

3. The method according to claim 1, characterized in that After obtaining the first transmission protocol type adopted for transmitting the call request from the request header field of the message corresponding to the call request through the request header obtaining function, it includes: In the case where the first transmission protocol type is the https protocol, obtaining the respective service provider identifiers of the first service provider and the second service provider from the request header field of the corresponding message of the call request; According to the preset mapping rules, the enterprise service bus architecture, the https protocol, and the respective service provider identifiers of the first service provider and the second service provider are mapped into corresponding third encryption decision messages, and the third encryption decision message is returned to the second service provider; the third encryption decision message is used to instruct the second service provider to encrypt the required return data according to the encryption method type carried by the third encryption decision message when receiving the call request sent by the first service provider.

4. The method according to claim 1, characterized in that: After the bus architecture between the first service provider and the second service provider is determined by parsing the message corresponding to the call request, the method includes: In the case where the bus architecture is a point-to-point architecture, parsing the protocol type field in the message corresponding to the call request to obtain the first transmission protocol type used to transmit the call request; In the case where the first transmission protocol type is the TCP protocol or the UDP protocol, parsing the transmission data description field of the call request to obtain the network architecture type and the service provider identifiers of the first service provider and the second service provider respectively; According to the preset mapping rule, the point-to-point architecture, the network architecture type, the first transmission protocol type, and the respective service provider identifiers of the first service provider and the second service provider are mapped into corresponding fourth encryption decision messages, and the fourth encryption decision message is returned to the second service provider; the fourth encryption decision message is used to instruct the second service provider to encrypt the required return data according to the encryption method type carried by the fourth encryption decision message when receiving the call request sent by the first service provider.

5. The method according to claim 1, characterized in that The method further comprises: In the case where the calling request sent by the first service provider to the second service provider is not obtained, obtaining the target data returned by the second service provider in response to the calling request; By parsing the target data, a bus architecture between the first service provider and the second service provider and a second transmission protocol type used to transmit the target data are obtained; According to the preset mapping rules, the bus architecture and the second transmission protocol type are mapped into the corresponding fifth encryption decision message, and the fifth encryption decision message is returned to the second service party; the fifth encryption decision message is used to instruct the second service party to encrypt the required return data according to the encryption method type carried by the fifth encryption decision message when receiving the call request sent by the first service party.

6. The method according to claim 3, characterized in that The method further comprises: When the first service party receives the first encrypted data returned by the second service party based on the third encryption decision message, and the service party identifier of the first service party and / or the service party identifier of the second service party are not service party identifiers covered by the preset mapping rule, the enterprise service bus architecture, the https protocol, and the respective service party identifiers of the first service party and the second service party are mapped to corresponding first decryption decision messages in accordance with the preset mapping rules, and the first decryption decision message is returned to the first service party; the first decryption decision message does not carry a key for decrypting the first encrypted data.

7. A data desensitization device, characterized in that: The device comprises: A first determining module is used to determine the bus architecture between the first service provider and the second service provider by parsing a message corresponding to the calling request when a calling request sent by the first service provider to the second service provider is obtained; A first acquisition module is used to acquire, when the bus architecture is an enterprise service bus architecture, a first transmission protocol type adopted for transmitting the call request from a request header field of a message corresponding to the call request through a request header acquisition function; A second determination module is used to determine whether the call request is forwarded via a gateway by judging whether a key value in a request header field of a corresponding message of the call request, which is used to indicate that the call request is forwarded via a gateway, is empty when the first transmission protocol type is an http protocol; A second acquisition module, configured to acquire the respective service provider identifiers of the first service provider and the second service provider from a request header field of a corresponding message of the call request when the call request is forwarded via a gateway; The first mapping module is used to map the enterprise service bus architecture, the http protocol, and the respective service provider identifiers of the first service provider and the second service provider into corresponding first encryption decision messages according to preset mapping rules, and return the first encryption decision message to the second service provider; the first encryption decision message is used to instruct the second service provider to encrypt the required return data according to the encryption method type carried by the first encryption decision message when receiving the call request sent by the first service provider.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images