Sensitive data processing method, system, electronic device and readable storage medium
By using method class annotations in the business system to identify and intercept sensitive data, and combining data encryption/decryption interfaces and desensitization interfaces to process sensitive data, the problem of high coupling between data and desensitization APIs is solved, achieving automated desensitization and independence of business logic.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- 广域铭岛数字科技有限公司
- Filing Date
- 2022-10-27
- Publication Date
- 2026-05-19
AI Technical Summary
Existing data anonymization methods require data to be directly input into an anonymization API for processing, resulting in a high degree of coupling between the data and the anonymization API, which can easily affect business logic when the system is updated.
Sensitive monitoring methods within function classes are identified using method class annotations. Business data input to these sensitive monitoring methods is intercepted, and sensitive data is identified and de-identified based on the annotations. Data processing is performed using data encryption/decryption and de-identification interfaces to avoid directly inputting de-identification APIs.
It automates data anonymization, reduces the coupling between data, ensures that business logic is not affected during system updates, and improves the applicability of the data.
Smart Images
Figure CN115618389B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data desensitization technology, and in particular to a sensitive data processing method, system, electronic device, and readable storage medium. Background Technology
[0002] Currently, with the continuous development of computer technology and information technology, database security has become a focal point of information security. Enterprises and financial institutions store vast amounts of sensitive information in their back-end databases, using this massive data to support business operations and decision-making. Important private information, such as identity information, bank account information, location information, and medical information, faces serious security risks during use. Once information leakage occurs, it can cause not only significant financial losses but also severe damage to the company's reputation. Therefore, the state and organizations have formulated relevant laws and regulations requiring the resolution of data masking and anonymization issues related to the use of production data in insecure environments. This aims to effectively protect commercial information, corporate information, and personal privacy information. Enterprises can utilize low-cost, high-efficiency, secure, and reliable data anonymization technologies to hide sensitive information while preserving data validity. Furthermore, they can restrict access permissions based on the data user's role to protect the security of sensitive and personal information, reducing the possibility of illegal use and acquisition of sensitive and private data, eliminating necessary access and copying of sensitive data, and thus mitigating business risks.
[0003] However, existing data masking methods require data to be directly input into the masking API (Application Programming Interface) for masking, resulting in a high degree of coupling between the data and the masking API. If the data masking module in the system is updated, it will affect the original system business logic. Summary of the Invention
[0004] To provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. This summary is not intended as a general commentary, nor is it intended to identify key / important components or describe the scope of protection of these embodiments, but rather as a prelude to the detailed description that follows.
[0005] In view of the shortcomings of the prior art described above, the present invention discloses a sensitive data processing method, system, electronic device and readable storage medium to reduce the coupling degree of data desensitization.
[0006] This invention discloses a sensitive data processing method, comprising: acquiring a business system, wherein the business system includes function method classes and corresponding method class annotations; identifying sensitive monitoring method classes in the function method classes according to the method class annotations, and intercepting business data input to the sensitive monitoring method classes; extracting sensitive data annotations from the business data, and identifying sensitive data in the business data according to the sensitive data annotations; performing desensitization processing on the sensitive data according to a preset desensitization rule matching the sensitive data annotations, and passing the desensitized sensitive data into the corresponding sensitive monitoring method class.
[0007] Optionally, the sensitive data is desensitized according to a preset desensitization rule matching the sensitive data annotation, including: establishing a data encryption / decryption interface and a data desensitization interface, and classifying the sensitive data according to the sensitive data annotation to obtain at least one of data to be encrypted and data to be desensitized; if the sensitive data includes data to be encrypted, the data encryption / decryption interface is used to encrypt the data to be encrypted based on a preset data encryption rule to obtain encrypted data; if the sensitive data includes data to be desensitized, the data desensitization interface is used to fill the data to be desensitized into a preset type template to desensitize the data to be desensitized.
[0008] Optionally, the method further includes at least one of the following: if a desensitization call instruction is received from a user, new sensitive data is extracted from the desensitization call instruction, and the data encryption / decryption interface or the data desensitization interface is called according to the desensitization call instruction to perform desensitization processing on the extracted sensitive data; after performing desensitization processing on the sensitive data according to a preset desensitization rule matching the sensitive data annotation, the data desensitization result fed back by the data encryption / decryption interface or the data desensitization interface is received, and a sensitive data log is generated according to the data desensitization result.
[0009] Optionally, data encryption rules can be obtained through any of the following methods: establishing an implementation class registration interface corresponding to the data encryption / decryption interface, wherein the implementation class registration interface is used to register clients and extract data encryption rules from successfully registered clients; searching for encryption implementation classes in the service framework where the sensitive monitoring method class is located and extracting data encryption rules from the encryption implementation classes; or extracting data encryption rules from the interface configuration file of the data encryption / decryption interface.
[0010] Optionally, after encrypting the data to be encrypted using the data encryption / decryption interface according to a preset data encryption rule to obtain encrypted data, the method class further includes: adding encryption data annotations to the encrypted data; identifying the decryption monitoring method class in the function method class according to the method class annotations, and intercepting the business data input to the decryption monitoring method class; extracting the encryption data annotations from the business data, and identifying the encrypted data in the business data according to the encryption data annotations; decrypting the encrypted data using the data encryption / decryption interface based on the preset data encryption rule, and passing the decrypted encrypted data to the corresponding decryption monitoring method class.
[0011] Optionally, the method further includes at least one of the following: after desensitizing the sensitive data according to a preset desensitization rule matching the sensitive data annotation, sending a desensitization notification to the user; before decrypting the encrypted data using the data encryption / decryption interface based on the preset data encryption rule, sending a decryption notification to the user.
[0012] Optionally, the sensitive monitoring method class includes at least one of the following: a data persistence method class for storing input business data into a preset database; a data display method class for displaying input business data; and a log printing method class for printing log data.
[0013] This invention discloses a sensitive data processing system, comprising: an acquisition module for acquiring a business system, the business system including function method classes and corresponding method class annotations; an interception module for identifying sensitive monitoring method classes in the function method classes based on the method class annotations, and intercepting business data input to the sensitive monitoring method classes; an identification module for extracting sensitive data annotations from the business data, and identifying sensitive data in the business data based on the sensitive data annotations; and a desensitization module for desensitizing the sensitive data according to a preset desensitization rule matching the sensitive data annotations, and transmitting the desensitized sensitive data to the corresponding sensitive monitoring method class.
[0014] The present invention discloses an electronic device, comprising: a processor and a memory; the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to cause the electronic device to perform the above-described method.
[0015] The present invention discloses a computer-readable storage medium having a computer program stored thereon: when the computer program is executed by a processor, it implements the above-described method.
[0016] The beneficial effects of this invention are:
[0017] This system identifies sensitive monitoring methods within function classes using method class annotations, intercepts business data input to these methods, and then identifies sensitive data based on corresponding sensitive data annotations. This sensitive data is then de-identified and passed to the appropriate sensitive monitoring method. In this way, by using method class annotations to identify sensitive monitoring methods within function classes and using sensitive data annotations to identify sensitive data within those business data, the system automates data de-identification, avoids direct data input into the de-identification API, reduces data coupling, and ensures that system updates do not affect business logic. Furthermore, by using annotations to identify sensitive data, the system does not restrict the data structure of sensitive data, thus expanding the applicability of the data.
[0018] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and do not limit this application. Attached Figure Description
[0019] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort. In the drawings:
[0020] Figure 1 This is a flowchart illustrating a sensitive data processing method in an embodiment of the present invention;
[0021] Figure 2-a This is a flowchart illustrating another sensitive data processing method in an embodiment of the present invention;
[0022] Figure 2-b This is a flowchart illustrating another sensitive data processing method in an embodiment of the present invention;
[0023] Figure 2-c This is a flowchart illustrating another sensitive data processing method in an embodiment of the present invention;
[0024] Figure 3-a This is a schematic diagram of the structure of a sensitive data processing module in an embodiment of the present invention;
[0025] Figure 3-b This is a schematic diagram of the structure of an operating environment in an embodiment of the present invention;
[0026] Figure 4 This is a schematic diagram of the structure of a sensitive data processing system according to an embodiment of the present invention;
[0027] Figure 5This is a schematic diagram of the structure of an electronic device in an embodiment of the present invention. Detailed Implementation
[0028] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that, unless otherwise specified, the following embodiments and sub-samples in the embodiments can be combined with each other.
[0029] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention. Therefore, the drawings only show the components related to the present invention and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.
[0030] In the following description, numerous details are explored to provide a more thorough explanation of embodiments of the invention. However, it will be apparent to those skilled in the art that embodiments of the invention may be practiced without these specific details. In other embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring embodiments of the invention.
[0031] The terms "first," "second," etc., used in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this disclosure described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion.
[0032] Unless otherwise stated, the term "multiple" means two or more.
[0033] In this embodiment of the disclosure, the character " / " indicates that the objects before and after it are in an "or" relationship. For example, A / B means: A or B.
[0034] The term "and / or" describes an association between objects, indicating that three relationships can exist. For example, A and / or B means: A or B, or A and B.
[0035] Combination Figure 1 As shown, this disclosure provides a sensitive data processing method, including:
[0036] Step S101: Obtain the business system;
[0037] The business system includes function method classes and corresponding method class annotations;
[0038] Step S102: Identify sensitive monitoring method classes in function method classes based on method class annotations, and intercept business data input to sensitive monitoring method classes;
[0039] Step S103: Extract sensitive data annotations from the business data and identify sensitive data in the business data based on the sensitive data annotations;
[0040] Step S104: Desensitize the sensitive data according to the preset desensitization rules that match the sensitive data annotation, and pass the desensitized sensitive data into the corresponding sensitive monitoring method class.
[0041] The sensitive data processing method provided in this disclosure identifies sensitive monitoring method classes within function method classes through method class annotations, intercepts business data input to these sensitive monitoring method classes, and then identifies sensitive data based on the sensitive data annotations corresponding to the business data. This process de-identifies the sensitive data and then passes the de-identified sensitive data to the corresponding sensitive monitoring method class. In this way, by identifying sensitive monitoring method classes within function method classes through method class annotations and intercepting business data, and by identifying sensitive data within the business data through sensitive data annotations, data de-identification is automated. This avoids direct data input into the de-identification API, reduces the coupling between data, and does not affect business logic when updating the system. Furthermore, by identifying sensitive data through annotations, the data structure of sensitive data is not restricted, thus improving the applicability of the data.
[0042] In some embodiments, the sensitive data processing method is configured in the business system by including a JAR (Java Runtime Archive) within the installation package of the sensitive data processing method. The JAR package contains a Java archive code package. It includes a decryption algorithm and related configurations, such as an encryption / decryption algorithm API. The package configures the business systems to be scanned, including business data and function / method classes. It adds method class annotations to function / method classes used for handling sensitive data based on their purpose, and adds sensitive data annotations to sensitive data within the business data based on their data type. Method class annotations include one or more of Desensitization, Encryption, Secret, and Encoder, while sensitive data annotations include one or more of Desensitization, Encryption, and Secret. The package sets the sensitive data processing methods in the business systems. The program automatically scans methods marked with encryption / decryption and desensitization annotations, automatically generates proxy objects for the corresponding objects, and then weaves in the encryption / decryption and desensitization processing logic. Encryption and desensitization automatically process and replace method parameters, while decryption processing logic automatically decrypts and replaces method return values, thus achieving automatic encryption / decryption and desensitization functionality.
[0043] In this way, the sensitive data processing method is provided to the customer via a JAR file. The customer only needs to import the corresponding JAR file to implement the sensitive data processing method. By removing the JAR file, the use of the sensitive data processing method is stopped without affecting the original logic of the program.
[0044] Optionally, the sensitive monitoring method class includes at least one of the following: a data persistence method class for storing input business data into a preset database; a data display method class for displaying input business data; and a log printing method class for printing log data.
[0045] In some embodiments, AOP (Aspect Oriented Programming) is used to monitor and intercept sensitive monitoring method classes. AOP acts as an intermediate proxy layer, using pre-compilation and runtime dynamic proxies to achieve unified maintenance of program functions.
[0046] In some embodiments, a persistent AOP is established to intercept data persistence method classes annotated with Desensitization and / or Encryption.
[0047] In some embodiments, a controller AOP is established to intercept data display method classes and / or log printing method classes annotated with Desensitization.
[0048] In this way, by using AOP monitoring and interception methods, data does not need to be added to the data processing API, reducing the coupling between data and ensuring that business logic is not affected when the system is updated.
[0049] Optionally, sensitive data is desensitized according to preset desensitization rules that match the sensitive data annotations, including: establishing a data encryption / decryption interface and a data desensitization interface, and classifying the sensitive data according to the sensitive data annotations to obtain at least one of the data to be encrypted and the data to be desensitized; if the sensitive data includes the data to be encrypted, the data encryption / decryption interface is used to encrypt the data to be encrypted based on preset data encryption rules to obtain encrypted data; if the sensitive data includes the data to be desensitized, the data desensitization interface is used to fill the data to be desensitized into a preset type template to desensitize the data to be desensitized.
[0050] In some embodiments, an SDK (Software Development Kit) is provided through a Starter mechanism to establish data encryption / decryption interfaces and data anonymization interfaces. The encryption algorithm uses symmetric encryption by default, and the key is read from the configuration. If a project has special requirements, it can implement the interface and configure a Bean object or use SPI (Service Provider Interface) to replace the default implementation.
[0051] In some implementations, Starter is a very important mechanism in Spring Boot, which can eliminate the previous cumbersome configuration and integrate it into Starter. Users only need to introduce the Starter dependency in Maven, and Spring Boot can automatically scan for the information to be loaded and start the corresponding default configuration. Starter frees us from the trouble of dealing with various dependency libraries and configuring various information. Spring Boot will automatically discover the required Beans through the classes under the ClassPath and register them into the IOC (Inversion of Control) container.
[0052] Optionally, the method further includes at least one of the following: if a desensitization call instruction is received from the user, new sensitive data is extracted from the desensitization call instruction, and the data encryption / decryption interface or data desensitization interface is called according to the desensitization call instruction to perform desensitization processing on the extracted sensitive data; after performing desensitization processing on the sensitive data according to the preset desensitization rules matching the sensitive data annotation, the data desensitization result fed back by the data encryption / decryption interface or data desensitization interface is received, and a sensitive data log is generated according to the data desensitization result.
[0053] In some embodiments, a manual module and a log module are added to the business logic layer of the business data. The manual module is used to call the data encryption / decryption interface or the data desensitization interface to perform desensitization processing on the specified sensitive data, and the log module is used to record the data desensitization results fed back by the data encryption / decryption interface or the data desensitization interface.
[0054] Optionally, data encryption rules can be obtained through any of the following methods: establishing an implementation class registration interface corresponding to the data encryption / decryption interface, wherein the implementation class registration interface is used to register clients and extract data encryption rules from successfully registered clients; searching for encryption implementation classes in the service framework where sensitive monitoring method classes are located and extracting data encryption rules from encryption implementation classes; or extracting data encryption rules from the interface configuration file of the data encryption / decryption interface.
[0055] In some embodiments, the implementation class registration interface corresponding to the data encryption / decryption interface is implemented through SPI. By introducing the SPI mechanism, the service interface and service implementation are separated, achieving decoupling and program extensibility. After the service provider (such as Spring Boot Starter) provides the SPI interface, the client (a typical Spring Boot project) can register the implementation class with the server through local registration, easily achieving pluggable functionality.
[0056] Optionally, the data encryption / decryption interface is used to encrypt the data to be encrypted according to preset data encryption rules. After obtaining the encrypted data, the method class also includes: adding encryption data annotations to the encrypted data; identifying the decryption monitoring method class in the function method class according to the method class annotations, and intercepting the business data input to the decryption monitoring method class; extracting the encryption data annotations of the business data, identifying the encrypted data in the business data according to the encryption data annotations; decrypting the encrypted data according to the preset data encryption rules using the data encryption / decryption interface, and passing the decrypted encrypted data to the corresponding decryption monitoring method class.
[0057] In some embodiments, monitoring and interception of decryption monitoring method classes are achieved through AOP.
[0058] Optionally, the method further includes at least one of the following: after desensitizing sensitive data according to a preset desensitization rule matching the sensitive data annotation, sending a desensitization notification to the user; before decrypting encrypted data using a data encryption / decryption interface based on a preset data encryption rule, sending a decryption notification to the user.
[0059] In some embodiments, the desensitization AOP and the encryption AOP are set as post-notification AOPs to send a desensitization notification to the user after the sensitive data has been desensitized; the decryption AOP is set as a pre-notification AOP to send a decryption notification to the user first, and then decrypt the encrypted data based on a preset data encryption rule.
[0060] Combination Figure 2-a As shown, this disclosure provides a method for processing sensitive data, including:
[0061] Step S201: The business layer calls persistent AOP to intercept data marked with Encryption;
[0062] The data marked with "Encryption" includes data to be de-identified and data to be encrypted;
[0063] Step S202: Persistent AOP performs data anonymization processing on the extracted data to be anonymized through the data anonymization interface;
[0064] Step S203: The data desensitization interface feeds back the desensitization result to the persistent AOP;
[0065] Step S204: Persistent AOP encrypts the extracted data to be encrypted through the data encryption / decryption interface;
[0066] Step S205: The data encryption / decryption interface sends the encryption result back to the persistent AOP;
[0067] Step S206: Persistent AOP updates the corresponding parameters based on the de-identification and encryption results to obtain updated data;
[0068] Step S207: Persistent AOP persists the updated data to the database by calling the persistence layer;
[0069] In step S208, the database sequentially feeds back the persistence results to the business layer through the persistence layer and persistence AOP.
[0070] The sensitive data processing method provided in this disclosure identifies sensitive monitoring method classes within function method classes through method class annotations, intercepts business data input to these sensitive monitoring method classes, and then identifies sensitive data based on the sensitive data annotations corresponding to the business data. This process de-identifies the sensitive data and then passes the de-identified sensitive data to the corresponding sensitive monitoring method class. In this way, by identifying sensitive monitoring method classes within function method classes through method class annotations and intercepting business data, and by identifying sensitive data within the business data through sensitive data annotations, the data de-identification process is automated. This avoids directly inputting data into the de-identification API, reduces the coupling between data, and ensures that system updates do not affect business logic.
[0071] Combination Figure 2-b As shown, this disclosure provides a method for processing sensitive data, including:
[0072] Step S211: The business layer calls persistent AOP to intercept query commands for persistent data;
[0073] Step S212: Persistent AOP sends a query command to the persistence layer;
[0074] Step S213: The persistence layer queries the persistent data in the database according to the query command;
[0075] Step S214: The persistence layer feeds back persistent data to the persistent AOP;
[0076] Step S215: Persistent AOP extracts the data to be de-identified from the persistent data, which is labeled with Encryption.
[0077] Step S216: Persistent AOP performs data anonymization processing on the extracted data to be anonymized through the data anonymization interface;
[0078] Step S217: The data desensitization interface feeds back the desensitization result to the persistent AOP;
[0079] Step S218: Persistent AOP updates the corresponding parameters based on the desensitization results to obtain updated data;
[0080] Step S219: Persistent AOP sends update data to the business layer.
[0081] The sensitive data processing method provided in this disclosure identifies sensitive monitoring method classes within function method classes through method class annotations, intercepts business data input to these sensitive monitoring method classes, and then identifies sensitive data based on the sensitive data annotations corresponding to the business data. This process de-identifies the sensitive data and then passes the de-identified sensitive data to the corresponding sensitive monitoring method class. In this way, by identifying sensitive monitoring method classes within function method classes through method class annotations and intercepting business data, and by identifying sensitive data within the business data through sensitive data annotations, the data de-identification process is automated. This avoids directly inputting data into the de-identification API, reduces the coupling between data, and ensures that system updates do not affect business logic.
[0082] Combination Figure 2-c As shown, this disclosure provides a method for processing sensitive data, including:
[0083] Step S221: The front-end device calls the controller's AOP to intercept the service processing request;
[0084] Step S222: The controller AOP sends a service processing request to the controller;
[0085] Step S223: The controller performs business processing based on the business processing request;
[0086] Step S224: The controller AOP intercepts and retrieves the sensitive data method class marked with Secret from the controller;
[0087] Step S225: The controller AOP extracts the data fields to be de-identified that are marked with Secret from the sensitive data method class;
[0088] Step S226: The controller AOP performs data anonymization processing on the extracted data fields to be anonymized through the data anonymization interface;
[0089] Step S217: The data desensitization interface feeds back the desensitization result to the controller AOP;
[0090] In step S218, the controller AOP responds to the front-end device based on the desensitization result.
[0091] The sensitive data processing method provided in this disclosure identifies sensitive monitoring method classes within function method classes through method class annotations, intercepts business data input to these sensitive monitoring method classes, and then identifies sensitive data based on the sensitive data annotations corresponding to the business data. This process de-identifies the sensitive data and then passes the de-identified sensitive data to the corresponding sensitive monitoring method class. In this way, by identifying sensitive monitoring method classes within function method classes through method class annotations and intercepting business data, and by identifying sensitive data within the business data through sensitive data annotations, the data de-identification process is automated. This avoids directly inputting data into the de-identification API, reduces the coupling between data, and ensures that system updates do not affect business logic.
[0092] Combination Figure 3-aAs shown, this disclosure provides a sensitive data processing module, including an AOP unit 301, a Starter unit 302, and a business logic layer 303; the AOP unit 301 includes persistent AOP 3011 and controller AOP. 3012, wherein, the persistence AOP is used to intercept data persistence method classes annotated with Desensitization and / or Encryption, and the controller AOP is used to intercept data display method classes and / or log printing method classes annotated with Desensitization; the Starter unit 302 includes a data encryption / decryption interface 3021 and a data desensitization interface 3022, wherein, if the sensitive data includes data to be encrypted, the data encryption / decryption interface is used to encrypt the data to be encrypted based on preset data encryption rules to obtain encrypted data; if the sensitive data includes data to be desensitized, the data desensitization interface is used to fill the data to be desensitized into a preset type template to perform desensitization processing on the data to be desensitized; the business logic layer 303 includes a manual module 3031 and a log module 3032, wherein, the manual module is used to call the data encryption / decryption interface or the data desensitization interface to perform desensitization processing on specified sensitive data, and the log module is used to record the data desensitization results fed back by the data encryption / decryption interface or the data desensitization interface.
[0093] The sensitive data processing module provided in this embodiment identifies sensitive monitoring method classes within function method classes through method class annotations, intercepts business data input to these sensitive monitoring method classes, and then identifies sensitive data based on the sensitive data annotations corresponding to the business data. This process de-identifies the sensitive data and then passes the de-identified sensitive data to the corresponding sensitive monitoring method class. In this way, by identifying sensitive monitoring method classes within function method classes through method class annotations and intercepting business data, and by identifying sensitive data within the business data through sensitive data annotations, data de-identification is automated. This avoids direct data input into the de-identification API, reduces the coupling between data, and ensures that system updates do not affect business logic.
[0094] Combination Figure 3-bAs shown, this disclosure provides an operating environment for implementing a sensitive data processing method, including a desensitization and encryption component 311 and an application class 312. The desensitization and encryption component includes a startup class 3111, a post-notification AOP 3112, a pre-notification AOP 3113, encryption and desensitization algorithm logic 3114, and decryption algorithm logic 3115. The application class includes an encryption and desensitization proxy object 3121 and a decryption proxy object 3122. The startup class loads the post-notification AOP and the pre-notification AOP. The post-notification AOP is used to automatically search for and discover methods marked with encryption annotations, generate encryption and desensitization proxy objects for these methods, and weave in the encryption and desensitization algorithm logic. The pre-notification AOP is used to automatically search for and discover methods marked with decryption annotations, generate decryption proxy objects for these methods, and weave in the decryption algorithm logic. The encryption and desensitization proxy objects encrypt and / or desensitize sensitive data in the methods using the encryption and desensitization algorithm logic. The decryption proxy objects decrypt the encrypted data in the methods using the decryption algorithm logic.
[0095] The sensitive data processing method provided in this disclosure identifies sensitive monitoring method classes within function method classes through method class annotations, intercepts business data input to these sensitive monitoring method classes, identifies sensitive data based on the sensitive data annotations corresponding to the business data, thereby de-identifying the sensitive data, and then passes the de-identified sensitive data into the corresponding sensitive monitoring method class. This method has the following advantages:
[0096] First, sensitive monitoring methods in function method classes are identified through method class annotations to monitor and intercept business data, and sensitive data in business data is identified through sensitive data annotations, thereby achieving automated data desensitization.
[0097] Secondly, by avoiding direct input of data into the de-identified API, the coupling between data is reduced, and business logic is not affected when the system is updated.
[0098] Third, by identifying sensitive documents through annotations, the data structure of sensitive data is not restricted, thus increasing the applicability of the data.
[0099] Fourth, the sensitive data processing method is provided to the customer in the form of a JAR file. The customer only needs to import the corresponding JAR file to implement the sensitive data processing method. By removing the JAR file, the use of the sensitive data processing method is stopped without affecting the original logic of the program.
[0100] Fifth, by using AOP to monitor and intercept methods, data does not need to be added to the data processing API, reducing the coupling between data and ensuring that business logic is not affected when updating the system.
[0101] Combination Figure 4As shown, this disclosure provides a sensitive data processing system, including an acquisition module 401, an interception module 402, an identification module 403, and a desensitization module 404. The acquisition module 401 acquires a business system, which includes function method classes and corresponding method class annotations. The interception module 402 identifies sensitive monitoring method classes within the function method classes based on the method class annotations and intercepts business data input to these sensitive monitoring method classes. The identification module 403 extracts sensitive data annotations from the business data and identifies sensitive data within the business data based on these annotations. The desensitization module 404 desensitizes the sensitive data according to preset desensitization rules matching the sensitive data annotations and transmits the desensitized sensitive data to the corresponding sensitive monitoring method class.
[0102] The sensitive data processing system provided in this disclosure identifies sensitive monitoring method classes within function method classes through method class annotations, intercepts business data input to these sensitive monitoring method classes, and then identifies sensitive data based on the sensitive data annotations corresponding to the business data. This process de-identifies the sensitive data and then passes the de-identified sensitive data to the corresponding sensitive monitoring method class. In this way, by identifying sensitive monitoring method classes within function method classes through method class annotations and intercepting business data, and by identifying sensitive data within the business data through sensitive data annotations, the system automates data de-identification, avoids direct data input into the de-identification API, reduces the coupling between data, and ensures that system updates do not affect business logic.
[0103] Figure 5 A schematic diagram of a computer system suitable for implementing the embodiments of this application is shown. It should be noted that... Figure 5 The computer system 500 of the electronic device shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments of this application.
[0104] like Figure 5 As shown, the computer system 500 includes a Central Processing Unit (CPU) 501, which can perform various appropriate actions and processes, such as executing the methods described in the above embodiments, based on programs stored in Read-Only Memory (ROM) 502 or programs loaded from storage portion 508 into Random Access Memory (RAM) 503. The RAM 503 also stores various programs and data required for system operation. The CPU 501, ROM 502, and RAM 503 are interconnected via a bus 504. An Input / Output (I / O) interface 505 is also connected to the bus 504.
[0105] The following components are connected to I / O interface 505: an input section 506 including a keyboard, mouse, etc.; an output section 507 including a cathode ray tube (CRT), liquid crystal display (LCD), etc., and speakers, etc.; a storage section 508 including a hard disk, etc.; and a communication section 509 including a network interface card such as a LAN (Local Area Network) card, modem, etc. The communication section 509 performs communication processing via a network such as the Internet. A drive 510 is also connected to I / O interface 505 as needed. Removable media 511, such as a disk, optical disk, magneto-optical disk, semiconductor memory, etc., are installed on drive 510 as needed so that computer programs read from them can be installed into storage section 508 as needed.
[0106] Specifically, according to embodiments of this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program including a computer program for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication section 509, and / or installed from removable medium 511. When the computer program is executed by central processing unit (CPU) 501, it performs various functions defined in the system of this application.
[0107] It should be noted that the computer-readable medium shown in the embodiments of this application can be a computer-readable signal medium or a computer-readable storage medium, or any combination of the two. A computer-readable storage medium can be, for example, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this application, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying a computer-readable computer program. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The computer program contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.
[0108] This disclosure also provides a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements any of the methods described in this embodiment.
[0109] The computer-readable storage medium in the embodiments of this disclosure will be understood by those skilled in the art: all or part of the steps of the above method embodiments can be implemented by hardware related to computer programs. The aforementioned computer program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disk, or optical disk.
[0110] The electronic device disclosed in this embodiment includes a processor, a memory, a transceiver, and a communication interface. The memory and the communication interface are connected to the processor and the transceiver and complete communication between them. The memory is used to store computer programs, the communication interface is used to perform communication, and the processor and the transceiver are used to run the computer programs, so that the electronic device performs the various steps of the above method.
[0111] In this embodiment, the memory may include random access memory (RAM) and may also include non-volatile memory, such as at least one disk storage device.
[0112] The processors mentioned above can be general-purpose processors, including central processing units (CPUs), graphics processing units (GPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.
[0113] The foregoing description and accompanying drawings fully illustrate embodiments of this disclosure to enable those skilled in the art to practice them. Other embodiments may include structural, logical, electrical, procedural, and other changes. The embodiments represent only possible variations. Individual components and functions are optional unless explicitly required, and the order of operation may vary. Parts and subsamples of some embodiments may be included in or replace parts and subsamples of other embodiments. Moreover, the terminology used in this application is for describing embodiments only and is not intended to limit the claims. As used in the description of embodiments and claims, the singular forms “a,” “an,” and “the” are intended to equally include the plural forms unless the context clearly indicates otherwise. Similarly, the term “and / or” as used herein means including one or more of the associated listed items and all possible combinations thereof. Additionally, when used in this application, the term "comprise" and its variations "comprises" and / or "comprising" refer to the presence of stated subsamples, wholes, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other subsamples, wholes, steps, operations, elements, components, and / or groups thereof. Without further limitations, an element defined by the phrase "comprising a..." does not exclude the presence of other identical elements in the process, method, or apparatus that includes the element. In this document, each embodiment may focus on the differences from other embodiments, and similar or identical parts between embodiments can be referred to mutually. For methods, products, etc., disclosed in the embodiments, if they correspond to the method section disclosed in the embodiments, the relevant parts can be referred to the description of the method section.
[0114] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the embodiments of this disclosure. Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.
[0115] The methods and products (including but not limited to devices and equipment) disclosed in the embodiments herein can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For instance, the division of units may be merely a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some sub-samples may be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be electrical, mechanical, or other forms. Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected to implement this embodiment according to actual needs. Furthermore, the functional units in the embodiments of this disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
[0116] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than that shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. In the descriptions corresponding to the flowcharts and block diagrams in the accompanying drawings, the operations or steps corresponding to different blocks may also occur in a different order than disclosed in the description, and sometimes there is no specific order between different operations or steps. For example, two consecutive operations or steps may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. Each block in a block diagram and / or flowchart, and combinations of blocks in a block diagram and / or flowchart, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.
Claims
1. A method for processing sensitive data, characterized in that, include: Obtain the business system, wherein the business system includes function method classes and method class annotations corresponding to the function method classes; Include the JAR file in the installation package; add the decryption algorithm and related configuration through the JAR file; add method class annotations to the function method classes used to process sensitive data according to the purpose of the method class, and add sensitive data annotations to the sensitive data in the business data according to the data type; set the sensitive data processing methods in the business system through the installation package; Method annotations include one or more of the following: de-identification, encryption, secret, and encoding; Based on the method class annotation, identify the sensitive monitoring method class in the function method class, and intercept the business data input to the sensitive monitoring method class; Extract sensitive data annotations from the business data, and identify sensitive data in the business data based on the sensitive data annotations; The sensitive data is desensitized according to the preset desensitization rules that match the sensitive data annotation, and the desensitized sensitive data is passed to the corresponding sensitive monitoring method class. The sensitive data is desensitized according to a preset desensitization rule that matches the sensitive data annotation. This includes establishing a data encryption / decryption interface and a data desensitization interface, and classifying the sensitive data according to the sensitive data annotation to obtain at least one of data to be encrypted and data to be desensitized. If the sensitive data includes data to be encrypted, the data encryption / decryption interface is used to encrypt the data to be encrypted based on a preset data encryption rule to obtain encrypted data. If the sensitive data includes data to be desensitized, the data desensitization interface is used to fill the data to be desensitized into a preset type template to desensitize the data. The SDK establishes data encryption / decryption and data anonymization interfaces. The encryption algorithm uses symmetric encryption by default, and the key is read from the configuration. Bean objects are configured or SPI is used to implement business requirements.
2. The method according to claim 1, characterized in that, The method further includes at least one of the following: If a desensitization call instruction is received from the user, new sensitive data is extracted from the desensitization call instruction, and the data encryption / decryption interface or the data desensitization interface is called according to the desensitization call instruction to perform desensitization processing on the extracted sensitive data; After desensitizing the sensitive data according to the preset desensitization rules that match the sensitive data annotation, the data desensitization result is received from the data desensitization interface, and a sensitive data log is generated based on the data desensitization result.
3. The method according to claim 1, characterized in that, Obtain the data encryption rules using any of the following methods: Establish an implementation class registration interface corresponding to the data encryption / decryption interface, wherein the implementation class registration interface is used to register clients and extract data encryption rules from successfully registered clients; Search for the encryption implementation class in the service framework where the sensitive monitoring method class is located, and extract the data encryption rules from the encryption implementation class; Extract the data encryption rules from the interface configuration file of the data encryption / decryption interface.
4. The method according to claim 1, characterized in that, After encrypting the data to be encrypted using the data encryption / decryption interface according to a preset data encryption rule to obtain encrypted data, the method further includes: Add encryption data annotations to the encrypted data; Identify the decryption monitoring method class in the function method class based on the method class annotation, and intercept the business data input to the decryption monitoring method class; Extract the encrypted data annotations from the business data, and identify the encrypted data in the business data based on the encrypted data annotations; The encrypted data is decrypted using the data encryption / decryption interface based on the preset data encryption rules, and the decrypted data is then passed to the corresponding decryption monitoring method class.
5. The method according to claim 4, characterized in that, The method further includes at least one of the following: After desensitizing the sensitive data according to the preset desensitization rules that match the sensitive data annotation, a desensitization notification is sent to the user. Before using the data encryption / decryption interface to decrypt the encrypted data based on the preset data encryption rules, a decryption notification is sent to the user.
6. The method according to any one of claims 1 to 5, characterized in that, Sensitive monitoring method classes include at least one of the following: The data persistence method class is used to store the input business data into a preset database; A data visualization method class used to display the input business data; A class for printing log data.
7. A sensitive data processing system, characterized in that, include: The acquisition module is used to acquire the business system, which includes function method classes and method class annotations corresponding to the function method classes; Include the JAR file in the installation package; add the decryption algorithm and related configuration through the JAR file; add method class annotations to the function class classes used to process sensitive data according to the purpose of the method class, and add sensitive data annotations to the sensitive data in the business data according to the data type; The sensitive data processing methods are set in the business system through the installation package; Method annotations include one or more of the following: de-identification, encryption, secret, and encoding; The interception module is used to identify sensitive monitoring method classes in the function method class based on the method class annotation, and to intercept the business data input to the sensitive monitoring method class; The identification module is used to extract sensitive data annotations from the business data and identify sensitive data in the business data based on the sensitive data annotations. The desensitization module is used to desensitize the sensitive data according to the preset desensitization rules that match the sensitive data annotation, and to pass the desensitized sensitive data into the corresponding sensitive monitoring method class; The desensitization module performs desensitization processing in the following manner: it establishes a data encryption / decryption interface and a data desensitization interface, and classifies the sensitive data according to the sensitive data annotation to obtain at least one of the data to be encrypted and the data to be desensitized; if the sensitive data includes the data to be encrypted, it uses the data encryption / decryption interface to encrypt the data to be encrypted based on a preset data encryption rule to obtain encrypted data. If the sensitive data includes data to be desensitized, the data desensitization interface is used to fill the data to be desensitized into a preset type template to perform desensitization processing on the data to be desensitized. The SDK establishes data encryption / decryption and data anonymization interfaces. The encryption algorithm uses symmetric encryption by default, and the key is read from the configuration. Bean objects are configured or SPI is used to implement business requirements.
8. An electronic device, characterized in that, include: Processor and memory; The memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to cause the electronic device to perform the method as described in any one of claims 1 to 6.
9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 6.