Data processing method and device, computer device and storage medium

Abstract

The application relates to a data processing method and device, computer equipment and a storage medium. The method comprises the following steps: acquiring a plurality of data processing strategies provided by an initial security control; based on at least two data processing strategies selected by a user, configuring a data processing strategy combination corresponding to a target business for the initial security control to obtain a target security control bound to the target business; when target data under the target business is acquired based on the target security control, calling the data processing strategy combination through the target security control; parsing the data processing strategy combination into an instruction calling sequence; and converting and processing the target data according to the instruction calling sequence to obtain converted data. The method can flexibly convert and process target data under a target business to effectively improve the security of the target data under the target business.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a data processing method, apparatus, computer equipment, and storage medium. Background Technology

[0002] With the rapid development of internet information technology, data transmission speeds are increasing and the reach is expanding, making it crucial to ensure the security of important data. Currently, technologies have emerged to transform and encrypt data to protect critical information.

[0003] In related technologies, target data is typically processed using a pre-defined, fixed scheme. However, this method usually involves calling a common, specific, and singular encryption algorithm. This encryption method is relatively fixed and singular, making the encryption algorithm vulnerable to cracking and potentially leading to the leakage of critical target data, resulting in low data security. Summary of the Invention

[0004] Therefore, it is necessary to provide a data processing method, apparatus, computer equipment, and storage medium that can effectively improve data security in response to the above-mentioned technical problems.

[0005] A data processing method, the method comprising:

[0006] Obtain the various data processing strategies provided by the initial security controls;

[0007] Based on at least two of the data processing strategies selected by the user, a combination of data processing strategies corresponding to the target business is configured for the initial security control to obtain a target security control bound to the target business.

[0008] When target data under the target business is obtained based on the target security control, the data processing strategy combination is invoked through the target security control.

[0009] The data processing strategies are combined and parsed into a sequence of instruction calls;

[0010] The target data is transformed according to the instruction call sequence to obtain the transformed data.

[0011] A data processing apparatus, the apparatus comprising:

[0012] The strategy acquisition module is used to acquire various data processing strategies provided by the initial security controls.

[0013] The security control configuration module is used to configure a combination of data processing strategies corresponding to the target business for the initial security control based on at least two custom-selected data processing strategies, so as to obtain a target security control bound to the target business.

[0014] The security control invocation module is used to invoke the data processing strategy combination through the target security control when target data under the target business is obtained based on the target security control.

[0015] The data conversion and processing module is used to parse the data processing strategy combination into an instruction call sequence; and to convert the target data according to the instruction call sequence to obtain the converted data.

[0016] In one embodiment, the security control configuration module is further configured to obtain at least two data processing strategies corresponding to the target business based on a custom selection; generate a nested call function corresponding to the target business according to the at least two data processing strategies; configure the nested call function in the initial security control to obtain a target security control bound to the target business.

[0017] In one embodiment, the security control configuration module is further configured to determine the nested call order corresponding to at least two custom-selected data processing strategies; and parse the at least two data processing strategies into nested call functions corresponding to the target business according to the nested call order.

[0018] In one embodiment, the security control configuration module is further configured to configure a data processing strategy for the initial security control; based on the configured data processing strategy, a corresponding combination strategy is configured in the initial security control to generate an initial security control that provides multiple data processing strategies.

[0019] In one embodiment, the security control invocation module is further configured to, when the acquired data under the target business is target data, invoke the target security control invocation expression parser and the data processing strategy combination; determine the order of expressions in the data processing strategy combination through the expression parser, and parse the data processing strategy combination into an instruction invocation sequence according to the order.

[0020] In one embodiment, the security control invocation module is further configured to initialize the instruction list through the expression parser; determine the outer function interface of the data processing strategy combination; if the data processing strategy combination is identified as including nested call functions based on the outer function interface, then the nested call functions are parsed layer by layer to obtain the nested expressions in the nested call functions, and the parsed expressions are added to the instruction list in the parsing order to obtain the instruction invocation sequence.

[0021] In one embodiment, the security control invocation module is further configured to parse the nested invocation function layer by layer to determine the position and number of input parameters in the parsed current expression; if the parsed current expression includes one input parameter, then the current expression is added to the instruction list; if the parsed current expression includes at least two input parameters, then a parameter concatenation expression is generated according to the position and number of the input parameters and added to the instruction list.

[0022] In one embodiment, the security control invocation module is further configured to perform validity checks on the parsed expressions respectively; if the validity checks pass, the parsed expressions are added to the instruction list in the parsing order to obtain the instruction invocation sequence.

[0023] In one embodiment, the instruction call sequence includes at least two call instructions with an execution order; the data conversion processing module is further configured to execute the call instructions in the instruction call sequence according to the execution order, and during the execution process, use the execution result of the previous call instruction as the input of the next call instruction to convert the target data and obtain the converted data.

[0024] In one embodiment, the target security control includes an encryption policy corresponding to the target business's custom configuration; the data processing device further includes an encryption module, used to invoke the encryption policy through the target security control if the attribute of the target data is an encryption attribute; and to encrypt the processed data according to the encryption policy.

[0025] In one embodiment, the initial security control is a security control based on the runtime environment of a parent application, which provides a runtime environment for multiple sub-applications; the security control configuration module is further configured to obtain at least two data processing strategies for a custom selection of a target sub-application; configure the initial security control with a combination of data processing strategies corresponding to the target business in the target sub-application to obtain a target security control bound to the target business; the target security control is used to perform transformation processing on the target data under the target business in the target sub-application.

[0026] In one embodiment, the data conversion processing module is further configured to, when a target sub-application running in the runtime environment of the parent application obtains target data corresponding to the target business of the target sub-application, call the corresponding custom-configured data processing strategy combination through the target security control in the target sub-application to convert the target data according to the data processing strategy combination.

[0027] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the data processing methods in the embodiments of this application.

[0028] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the data processing methods in the embodiments of this application.

[0029] A computer program product or computer program includes computer instructions stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium, and when the processor executes the computer instructions, it implements the steps of the data processing methods in the embodiments of this application.

[0030] The aforementioned data processing method, apparatus, computer equipment, and storage medium acquire various data processing strategies provided by the initial security control. The business party can then customize and combine various data processing strategies within the initial security control. Based on at least two custom-selected data processing strategies, a data processing strategy combination corresponding to the target business is configured for the initial security control, thereby obtaining a target security control bound to the target business. This allows the business party to flexibly generate various data processing strategy combinations, and the combined data processing strategies offer higher data processing security. When target data under the target business is acquired, the target security control calls the data processing strategy combination corresponding to the target business. The data processing strategy combination is then parsed into an instruction call sequence, and the target data is transformed and processed according to the instruction call sequence. This enables more secure transformation and processing of the target data, making the transformed data less susceptible to cracking and leakage, thus effectively improving the security of the target data. Attached Figure Description

[0031] Figure 1 This is a diagram illustrating the application environment of a data processing method in one embodiment.

[0032] Figure 2 This is a flowchart illustrating a data processing method in one embodiment;

[0033] Figure 3 This is a rendering of the target security control in one embodiment;

[0034] Figure 4 Here is a flowchart of the expression parser in one embodiment;

[0035] Figure 5 This is a flowchart illustrating the target data processing method in another embodiment;

[0036] Figure 6 This is a timing diagram of data processing in one embodiment;

[0037] Figure 7 This is a flowchart illustrating a data processing method in a specific embodiment.

[0038] Figure 8 This is a structural block diagram of a data processing device in one embodiment;

[0039] Figure 9 This is an internal structural diagram of a computer device in one embodiment;

[0040] Figure 10 This is a diagram of the internal structure of a computer device in another embodiment. Detailed Implementation

[0041] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0042] The data processing method provided in this application can be applied to computer equipment. The computer equipment can be a terminal or a server. It is understood that the data processing method provided in this application can be applied to a terminal, a server, or a system including both a terminal and a server, and is implemented through interaction between the terminal and the server.

[0043] The data processing method provided in this application can be applied to, for example... Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. After obtaining various data processing strategies provided by the initial security control from server 104, terminal 102 obtains at least two data processing strategies customized by the business user and uploads them to server 104. Then, server 104 obtains the various data processing strategies provided by the initial security control; based on the at least two customized data processing strategies, it configures a data processing strategy combination corresponding to the target business for the initial security control, obtaining a target security control bound to the target business; when target data under the target business is obtained based on the target security control, the data processing strategy combination is invoked through the target security control; the data processing strategy combination is parsed into an instruction invocation sequence; and the target data is processed according to the instruction invocation sequence to obtain the processed data.

[0044] Server 104 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud technology services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms. Terminal 102 can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, etc., but is not limited to these. The terminal and server can be directly or indirectly connected via wired or wireless communication, which is not limited herein.

[0045] Cloud technology refers to a hosting technology that unifies hardware, software, and network resources within a wide area network (WAN) or local area network (LAN) to enable data computation, storage, processing, and sharing. Based on the cloud computing business model, cloud technology encompasses network technology, information technology, integration technology, management platform technology, and application technology. It can form resource pools, allowing for flexible and convenient on-demand resource utilization.

[0046] Cloud computing refers to the delivery and usage model of IT (Internet Technology) infrastructure, meaning obtaining necessary resources in an on-demand and easily scalable manner through a network. In a broader sense, cloud computing also refers to the delivery and usage model of services, meaning obtaining necessary services in an on-demand and easily scalable manner through a network. These services can be IT and software related, internet-related, or other services. Cloud computing is a product of the convergence and development of traditional computer and network technologies such as grid computing, distributed computing, parallel computing, utility computing, network storage technologies, virtualization, and load balancing. With the rapid development and application of the internet industry, every item may have its own identification mark in the future, requiring transmission to a backend system for logical processing. Data at different levels will be processed separately, and various industry data will require powerful system support, which can only be achieved through cloud computing.

[0047] Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and cryptographic algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked together using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include an underlying platform, a platform product service layer, and an application service layer.

[0048] The underlying blockchain platform can include processing modules such as user management, basic services, smart contracts, and operational monitoring. The user management module is responsible for managing the identity information of all blockchain participants, including maintaining public and private key generation (account management), key management, and maintaining the correspondence between user real identities and blockchain addresses (access management). Under authorization, it also monitors and audits transactions of certain real identities and provides risk control rule configuration (risk control audit). The basic services module is deployed on all blockchain node devices to verify the validity of business requests. After consensus is reached on valid requests, they are recorded in storage. For a new business request, the basic services first perform interface adaptation parsing and authentication (interface adaptation), then encrypt the business information using a consensus algorithm (consensus management), and finally transmit the encrypted information completely and consistently to the shared ledger (network communication) for recording and storage. The smart contract module is responsible for contract registration, issuance, and...

[0049] Contract triggering and execution: Developers can define contract logic using a programming language, publish it to the blockchain (contract registration), and execute it by calling keys or other events according to the contract terms. It also provides functions for contract upgrades and cancellations. The operations monitoring module is mainly responsible for deployment, configuration modification, contract settings, cloud adaptation, and real-time status visualization during product launch, such as alarms, network monitoring, and monitoring node device health. The platform's product service layer provides basic capabilities and implementation frameworks for typical applications. Developers can build upon these capabilities, add business characteristics, and complete the blockchain implementation of business logic. The application service layer provides blockchain-based application services for business participants.

[0050] The terminal device in this technical solution can be a blockchain node device, and multiple blockchain node devices can form a blockchain storage system through network communication. Another application scenario for the data processing method provided in this technical solution is as follows: when a blockchain node device receives a business request, it uses the data processing method provided in this technical solution to process key business information, such as processing the account information of the blockchain node. After processing the key business information, the processed data is transmitted to the shared ledger and stored in the blockchain as a new data block.

[0051] In one embodiment, such as Figure 2 As shown, a data processing method is provided, which can be applied to... Figure 1 Taking a computer device as an example, this method can specifically be a terminal or a server. In this embodiment, the method includes the following steps:

[0052] Step S202: Obtain the various data processing strategies provided by the initial security control.

[0053] Security controls are plugins developed for specific business systems or browsers to protect critical data. These include functions such as maintaining the confidentiality of server-side and client-side information and preventing the loss of account passwords. Security controls are typically programs or plugins designed to enhance user data security and prevent malicious software such as Trojans or viruses from stealing target data like account passwords. Security controls can be configured in various business systems or applications, or downloaded, installed, and loaded through a browser to provide data protection services.

[0054] The initial security control in this embodiment is a custom-configured security control, which is configured with multiple data processing strategies. "Multiple" here refers to at least two.

[0055] Data transformation processing can be understood as the process of altering certain critical information using processing rules. In other words, it's the process of converting easily leakable real target data into non-real data that is less susceptible to leakage, thereby achieving reliable protection of critical data. This allows the processed real dataset to be used securely in development, testing, and other non-production environments, as well as outsourced environments. Specifically, data transformation processing can involve data concealment or encryption, transforming the original data to hide its plaintext counterpart. For example, concealment can be a form of data anonymization, which is the process of transforming sensitive privacy data into non-real data.

[0056] In a specific embodiment, the data processing strategy can refer to a rule-based strategy for de-identifying data. Specifically, it can be a de-identification strategy, i.e., a de-identification algorithm customized according to specified de-identification rules. For example, the data processing strategy includes at least one of the following: replacement, rearrangement, encryption, truncation, masking, etc. The encryption algorithm can include Sha256 (Secure Hash Algorithm), SM3, Sha1, MD5 (Message-Digest Algorithm 5), etc.

[0057] Sha256 is a cryptographically secure hash algorithm, also known as a hash function. This function scrambles and mixes data to create a fingerprint called a hash value. The hash value is typically represented by a short string of random letters and numbers. For any message length, Sha256 produces a 256-bit hash value, called a message digest. SM3 is also a cryptographically secure hash algorithm, primarily used for digital signatures and verification, message authentication code generation and verification, and random number generation. Sha1 is a security algorithm mainly used to verify data integrity. Data may change during transmission, thus producing different message digests. The MD5 message digest algorithm is a widely used cryptographic hash function that produces a 128-bit hash value to ensure the integrity and consistency of transmitted information.

[0058] It is understood that the initial security control is pre-configured with multiple data processing strategies. Specifically, there can be at least three data processing strategies. These strategies can include common encryption and de-identification algorithms, as well as custom encryption and de-identification algorithms.

[0059] Before processing target data under a target business, computer equipment can pre-configure target security controls corresponding to the target business. Specifically, the computer equipment can first obtain various data processing strategies provided by the initial security controls, and then configure target security controls for the target business based on these strategies.

[0060] Step S204: Based on at least two custom-selected data processing strategies, configure a combination of data processing strategies corresponding to the target business for the initial security control to obtain the target security control bound to the target business.

[0061] The target business can refer to a business application of a specific business type. For example, it can be a business system of various business types or a sub-business within a business system, or an application of various business types or a sub-application within an application.

[0062] A target security control is a security control that is configured with a combination of at least two custom-selected data processing strategies for a target business.

[0063] Specifically, developers can customize and select at least two data processing strategies from the various data processing strategies provided by the initial security control, targeting specific business needs. The computer device then configures the initial security control according to the customized selection of at least two data processing strategies and binds the initial security control to the target business, thereby flexibly obtaining a target security control bound to the target business.

[0064] In one embodiment, the business entity can also customize and select one of the various data processing strategies provided by the initial security control. Then, a data processing strategy corresponding to the target business is configured for the initial security control, thereby obtaining a target security control bound to the target business.

[0065] Step S206: When target data under the target business is obtained based on the target security control, the data processing strategy combination is invoked through the target security control.

[0066] As we can understand, target data, also known as critical data, refers to data that, if leaked, could cause serious harm to society or individuals. For example, target data can specifically be sensitive data.

[0067] In one embodiment, the target data includes at least one of the following: name, ID number, address, telephone number, bank account number, email address, password, medical information, and educational background.

[0068] Once a computer device is configured with a target security control that has a custom combination of data processing strategies for the target business, the target data under the target business can be processed through the target security control.

[0069] Specifically, when a computer device obtains target data under a target business, it calls the target security control bound to the target business in real time and loads the configured data processing strategy combination through the target security control.

[0070] Step S208: The data processing strategy combination is parsed into an instruction call sequence.

[0071] The instruction call sequence can represent a set of instructions, specifically multiple instruction calls with an execution order, i.e., a series of instructions arranged in a certain execution order. More specifically, it can be the instruction calls corresponding to at least two data processing strategies in a data processing strategy combination. Each instruction call sequence can correspond to a de-identification algorithm or an encryption algorithm.

[0072] It is understandable that when a computer device processes target data, it executes a sequence of instructions to transform and process the target data, thereby obtaining the data with the plaintext hidden.

[0073] The target security control also includes parsing rules for combinations of data processing strategies, which are used to parse custom combinations of data processing strategies into instruction call sequences.

[0074] After the computer device loads a custom data processing strategy combination through the target security control, it performs policy parsing on the data processing strategy combination according to the parsing rules for the data processing strategy combination in the target security control, and obtains the instruction call sequence corresponding to the data processing strategy combination.

[0075] After the computer device parses the custom data processing strategy combination into the corresponding instruction call sequence, it executes each instruction call sequence in turn according to the instruction execution order of the instruction call sequence.

[0076] Step S210: Perform conversion processing on the target data according to the instruction call sequence to obtain the converted data.

[0077] It is understood that the transformation process in this embodiment can be achieved by executing a series of instruction calls on the target data to transform the target data. For example, it can specifically be a de-identification process on the target data to obtain de-identified data.

[0078] After a computer device parses a combination of data processing strategies into a corresponding instruction call sequence, it can execute the instruction call sequence sequentially for the target data according to the corresponding instruction execution order.

[0079] For example, if the instruction call sequence has at least three instructions, the computer device first executes the first instruction call sequence. Based on the result of executing the first instruction, it then executes the subsequent instruction call sequences in the order of instruction execution until the last instruction call sequence is executed, at which point the converted data is obtained. The converted data can specifically be in the form of a hash value.

[0080] It is understandable that computer equipment transforms the target data, and after obtaining the transformed data, it stores the transformed data in the database corresponding to the target business, thereby effectively avoiding the storage of plaintext data in the database.

[0081] In one embodiment, after configuring a target security control bound to the target service based on at least two custom-selected data processing strategies, if there is historical target data under the target service in plaintext, the computer device can use the target security control to convert the historical target data under the target service into concealed data. Since the target security control is configured with a custom combination of data processing strategies bound to the target service, it is beneficial to maintain compatibility with older data and data formats under the target service, thereby enabling more secure and flexible concealment of target data under the target service.

[0082] like Figure 3 The image shown is a rendering of a target security control in one embodiment. It can be understood that password information is a typical type of target data. (Refer to...) Figure 3 Target security controls can be applied in scenarios involving password anonymization within target business processes. For example, in a process where a user needs to enter a password to verify their identity, once the computer device receives the password, it immediately invokes the bound target security control. This control then calls a data processing strategy combination corresponding to the target business. The data processing strategy combination is then parsed into an instruction call sequence, and the target data is anonymized according to this sequence. The computer device can then further perform authentication based on the anonymized data, effectively preventing the exposure of plaintext data and ensuring the security of critical target data.

[0083] In the aforementioned data processing method, the computer device acquires various data processing strategies provided by the initial security control. The business party can then customize and combine these strategies within the initial security control. Based on at least two of the custom-selected strategies, a data processing strategy combination corresponding to the target business is configured for the initial security control, resulting in a target security control bound to the target business. This allows the business party to flexibly generate various data processing strategy combinations, and the combined strategies offer higher data processing security. When target data under the target business is acquired, the target security control invokes the data processing strategy combination corresponding to the target business. The data processing strategy combination is then parsed into an instruction call sequence, and the target data is transformed according to this sequence. This more secure transformation process makes the transformed data less susceptible to cracking and leakage, effectively improving the security of the target data.

[0084] In one embodiment, the step of configuring a combination of data processing strategies corresponding to the target business for an initial security control based on at least two custom-selected data processing strategies to obtain a target security control bound to the target business includes: obtaining at least two data processing strategies corresponding to the target business based on custom selection; generating a nested call function corresponding to the target business according to the at least two data processing strategies; and configuring the nested call function in the initial security control to obtain a target security control bound to the target business.

[0085] Nested calls occur when one function calls another; in other words, function nesting allows a function to call another function from within another function. For example, when there are multiple functions that have a hierarchical calling relationship, then these functions are considered nested call functions.

[0086] It can be understood that each data processing strategy can be a strategy function, and a custom combination of data processing strategies includes at least two strategy functions, which can form nested call functions. In other words, a nested call function represents multiple strategy functions with a hierarchical calling relationship.

[0087] The computer device obtains multiple data processing strategies provided by the initial security control, and after obtaining at least two data processing strategies that are custom-selected for the target business from the multiple data processing strategies provided by the initial security control, it performs strategy parsing on the combination of at least two custom-selected data processing strategies to obtain nested call functions corresponding to the target business.

[0088] The computer device then configures nested call functions in the initial security control. Since the custom-selected data processing strategy combination corresponds to the target business, the initial security control can be bound to the target business at the same time during the configuration of the initial security control, thus enabling more flexible configuration of the target security control bound to the target business.

[0089] In one embodiment, the step of generating nested call functions corresponding to the target business based on at least two data processing strategies includes: determining the nested call order corresponding to the at least two custom-selected data processing strategies; and resolving the at least two data processing strategies into nested call functions corresponding to the target business according to the nested call order.

[0090] Nested call order refers to the order in which strategy functions are called.

[0091] It can be understood that each data processing strategy can be a strategy function, and a custom combination of data processing strategies includes at least two strategy functions, which can form nested call functions. In other words, a nested call function represents multiple strategy functions with a hierarchical calling relationship.

[0092] When a computer device parses a combination of at least two custom-selected data processing strategies, it can specifically invoke the parser in the initial security control. First, the parser in the initial security control determines multiple strategy functions corresponding to the at least two custom-selected data processing strategies, as well as the nested call order of each strategy function. Then, according to the nested call order, the at least two data processing strategies are parsed into nested call functions corresponding to the target business, thereby enabling flexible and efficient custom configuration to obtain the target security control bound to the target business.

[0093] In one embodiment, before obtaining the various data processing strategies provided by the initial security control, the method further includes a configuration step for the initial security control, which includes: configuring data processing strategies for the initial security control; and configuring corresponding combination strategies in the initial security control based on the configured data processing strategies to generate an initial security control that provides various data processing strategies.

[0094] It is understandable that the initial security control is a security control that is pre-configured with a variety of data processing strategies. This allows the business to provide the initial security control, enabling the business to customize and select the required combination of data processing strategies from the various data processing strategies provided by the initial security control, so as to achieve secure and flexible processing of target data.

[0095] Before acquiring the initial security control, the computer device also includes a configuration step for the initial security control. This configuration step can be performed by other third-party platforms or by the current computer device.

[0096] Among them, the combination strategy refers to the combination strategy between various data processing strategies.

[0097] Specifically, the computer device first acquires multiple data processing policies, which may include custom data processing policies. It then configures the acquired multiple data processing policies in an initial security control and determines a combination strategy between the various data processing policies. The computer device further configures the combination strategy between the various data processing policies in the initial security control, thereby generating an initial security control that provides multiple data processing policies.

[0098] In this embodiment, by configuring multiple data processing strategies on the initial security control, the initial security control can provide multiple data processing strategies, allowing the business party to customize the combination of data processing strategies for the target business, thereby obtaining a custom-configured target security control bound to the target business.

[0099] In one embodiment, when target data under a target business is obtained based on a target security control, the step of calling a data processing strategy combination through the target security control includes: when the obtained data under the target business is target data, calling an expression parser and a data processing strategy combination through the target security control.

[0100] The steps of resolving a data processing strategy combination into an instruction call sequence include: determining the order of expressions in the data processing strategy combination using an expression parser, and resolving the data processing strategy combination into an instruction call sequence in that order.

[0101] When a computer device obtains target data under a target business, it calls the target security control bound to the target business in real time and loads the configured data processing strategy combination through the target security control.

[0102] An expression parser is a parsing toolkit configured within a target security control to parse data processing strategies into instruction calls. For example, an expression parser can parse various expressions, including mathematical functions, Boolean operations, string operations, encryption functions, nested functions, and user-defined functions. The order of these expressions refers to their execution order.

[0103] After configuring the target security control corresponding to the target business, when the computer device obtains the target data under the target business, it will invoke the target security control, load the expression parser in the target security control, and call the data processing strategy combination corresponding to the target business.

[0104] The computer then uses an expression parser to parse the data processing strategy combination. Specifically, the computer first parses the order of the expressions in the data processing strategy combination using the expression parser, and then converts the expressions in the data processing strategy combination into a sequence of instruction calls with an execution order, according to the order of the expressions. It can be understood that the order of the expressions corresponds to the execution order of the instruction call sequence.

[0105] In this embodiment, the expression parser of the target security control parses the custom-selected combination of data processing strategies, which can quickly and effectively parse the combination of data processing strategies into a sequence of instruction calls with an execution order, thereby enabling efficient and secure processing of the target data.

[0106] In one embodiment, the step of determining the order of expressions in a data processing strategy combination using an expression parser and parsing the data processing strategy combination into an instruction call sequence in that order includes: initializing an instruction list using the expression parser; determining the outer function interface of the data processing strategy combination; if the data processing strategy combination is identified as including nested function calls based on the outer function interface, then parsing the nested function calls layer by layer to obtain the nested expressions within the nested function calls, and adding the parsed expressions to the instruction list in the parsing order to obtain the instruction call sequence.

[0107] The instruction list is a list used to record all the parsed instructions. Specifically, the instructions recorded in the instruction list can be represented as a set of instruction sequences. Multiple instructions can be concatenated in execution order to form an instruction queue. The instruction execution order is used to execute each instruction sequentially.

[0108] It can be understood that the outer function interface is the outer function in the data processing strategy composition. The outer function is the last expression executed in the data processing strategy composition; the inner function is the first expression executed in the data processing strategy composition.

[0109] In the process of parsing data processing strategy combinations through an expression parser, computer equipment parses the data processing strategy combinations layer by layer to extract each expression in the data processing strategy combination.

[0110] Specifically, the computer device first initializes a list of instructions through an expression parser and inputs the data processing strategy combination into the expression parser. The expression parser then first determines the outer function interface of the data processing strategy combination, and then identifies whether the outer function interface also contains nested function calls, that is, whether it contains inner functions.

[0111] If the data processing strategy combination is identified as including nested function calls based on the outer function interface, the nested function calls are parsed layer by layer. The nested expressions in the nested function calls are obtained in the parsing order, and the parsed expressions are added to the instruction list in the parsing order to obtain the instruction call sequence.

[0112] In one embodiment, if the business party selects only one data processing strategy from the various data processing strategies provided by the initial security control, and then configures the initial security control with a data processing strategy corresponding to the target business, a target security control bound to the target business is obtained. When target data under the target business is obtained based on the target security control, the data processing strategy is invoked through the target security control. Then, the expression parser in the target security control directly parses the data processing strategy to obtain the corresponding conversion instructions. The computer device then performs conversion processing on the target data according to the instruction call sequence to obtain converted data with higher security.

[0113] In one embodiment, the step of parsing nested function calls layer by layer to obtain nested expressions within the nested function calls includes: parsing the nested function calls layer by layer to determine the position and number of input parameters in the current expression obtained from the parsing; if the current expression obtained from the parsing includes one input parameter, then the current expression is added to the instruction list; if the current expression obtained from the parsing includes at least two input parameters, then a parameter concatenation expression is generated based on the position and number of input parameters and added to the instruction list.

[0114] As can be understood, input parameters refer to a set of variables input into a specified expression. In this embodiment, input parameters may include target data under the target business, intermediate processing results, random value parameters, etc. Specifically, random value parameters may be Salt values, also known as salted values, which are random numerical values ​​generated by combining with target data.

[0115] In the process of parsing nested function calls layer by layer, the computer first determines whether there are nested function calls within nested function calls. If so, it further parses the nested function calls to obtain the current expression. If the current expression does not contain nested function calls, it identifies the position and number of input parameters in the current expression. Then, based on the position and number of input parameters, it adds the corresponding expression to the instruction list.

[0116] Specifically, if the parsed current expression includes one input parameter, then the current expression is added to the instruction list. If the parsed current expression includes at least two input parameters, then a parameter concatenation expression is generated based on the position and number of the input parameters, and this parameter concatenation expression is added to the instruction list. For example, if the parsed current expression includes one input parameter of target data and one input parameter of random value, then the current parameter concatenation expression is generated based on the positional relationship between the input parameters of target data and random value.

[0117] If the input parameters for the target data come first, followed by the input parameters for the random values, the generated parameter concatenation expression can be a forward concatenation expression. If the input parameters for the random values ​​come later, followed by the input parameters for the target data, the generated parameter concatenation expression can be a backward concatenation expression. By adding these expressions to the instruction list in the order they are parsed, the instruction call sequence can be obtained, thus effectively parsing data processing strategies into corresponding instruction call sequences.

[0118] In one embodiment, the step of adding the parsed expressions to the instruction list in the parsing order to obtain the instruction call sequence includes: performing a validity check on each of the parsed expressions; if the validity check passes, adding the parsed expressions to the instruction list in the parsing order to obtain the instruction call sequence.

[0119] As we can understand it, validating the validity of an expression means checking whether the expression conforms to the algorithm rules, that is, checking whether the expression can be recognized and executed by a computer. For example, validity checking can include checking whether the input parameters, operators, and functions in the expression conform to the algorithm rules.

[0120] During the process of parsing nested function calls layer by layer, the computer device performs a validity check on each expression obtained in each round of parsing. If the validity check passes, the expression is added to the instruction list. This process continues until all expressions in the data processing strategy combination have been parsed and added to the instruction list, at which point the instruction call sequence is obtained. This effectively parses the data processing strategy combination corresponding to the target business into the corresponding instruction call sequence.

[0121] In one embodiment, the instruction call sequence includes at least two call instructions with an execution order; the step of converting the target data according to the instruction call sequence to obtain the converted data includes: executing the call instructions in the instruction call sequence according to the execution order, and during the execution, using the execution result of the previous call instruction as the input of the next call instruction to convert the target data to obtain the converted data.

[0122] It can be understood that the execution result of the previous instruction is an intermediate processing result in the instruction call sequence.

[0123] After parsing the data processing strategy into a sequence of instruction calls with an execution order, the computer device executes the instructions in the sequence sequentially. During the execution of each instruction, after obtaining the corresponding execution result, the result of the previous instruction is used as the input for the next instruction to transform and process the target data, thereby safely and efficiently obtaining the transformed data.

[0124] like Figure 4 The diagram shown is a flowchart of the expression parser in one embodiment. (Refer to...) Figure 4 The expression parser first initializes the instruction list and determines whether the expression combining the data processing strategies is valid. If it is valid, the expression combining the data processing strategies is parsed. Specifically, it first parses the current outer function name interface and calculates the hash value of the outer function name API using a hash value, resulting in the encoded hash value of the current outer function name API, i.e., HashApi. Then, it identifies whether the current outer function has nested calls, which may include identifying nested expression calls and nested parameter calls, etc.

[0125] If nested calls are identified in the current outer function, the recursive call parsing of the current outer function is further performed to further parse out the called expression function.

[0126] If the outer function is not nested, the number and position of input parameters in the current expression are further identified. Specifically, if the current expression has only one parameter, the HashApi corresponding to the outer function is directly added to the instruction list as an instruction.

[0127] If the current expression includes two parameters, it means that the input parameters include a random value parameter. If the random value comes first, a forward-concatenated expression is generated, such as insertSalt(). This current expression is then added to the instruction list, and the corresponding function HashApi is added as an instruction to the instruction list. If the random value comes second, HashApi is first added to the instruction list, then a backward-concatenated expression is generated, such as appendSalt(), and this current expression is added to the instruction list.

[0128] If the current expression includes three parameters, indicating that the input parameters include two random value parameters, then first, a forward concatenation expression is generated, such as insertSalt(), and this current expression is added to the instruction list. Then, the corresponding function HashApi is added as an instruction to the instruction list. Finally, a backward concatenation expression is generated, such as appendSalt(), and this current expression is added to the instruction list.

[0129] Before adding the current expression obtained from each parsing step to the instruction list, it is necessary to determine whether the current input expression is a valid expression. Only if it is a valid expression is the current expression added to the instruction list. This process continues until the expression parsing for the combined data processing strategies is complete, at which point the instructions in the instruction list constitute the resulting instruction call sequence.

[0130] For example, let's take the expression "Sha256(Salt2,SM3(pwd,Salt1),Salt3)" as an example of a data processing strategy combination. Here, "pwd" represents the target data under the target business, such as password information; "Salt" represents the random value parameter; "SM3()" represents the SM3 algorithm; and "Sha256()" represents the Sha256 algorithm. The expression parser can parse the current expression into the corresponding pseudocode. Pseudocode can be understood as an algorithm description language that allows the described algorithm to be easily implemented in any programming language.

[0131] The expression is parsed according to the above expression parsing process. First, after initializing the instruction list, the current outer function "Sha256()" is parsed first, and then it is checked whether the current outer function has nested calls. Since the current outer function "Sha256()" has nested calls, the recursive call parsing of the current outer function is further performed to further parse the called expression function, resulting in the current expression "(pwd,Salt1)". Since the random value parameter Salt1 is at the end, the backward concatenation expression appendSalt(Salt1) is generated, and the pseudocode corresponding to the first parsed expression is added to the instruction list. The corresponding execution result is "pwd+Salt1".

[0132] Then, the parsing continues to obtain the current outer function "SM3()", and the pseudocode corresponding to the second expression obtained from this parsing is added to the instruction list. The corresponding execution result is "SM3(pwd+Salt1)".

[0133] The computer device further parses the current outer function through the expression parser, and parses the current expression as "Salt2,SM3(pwd,Salt1)". Since the random value parameter Salt1 comes first, the forward concatenation expression insertSalt(Salt2) is generated, and the pseudocode corresponding to the third expression obtained by parsing is added to the instruction list. The corresponding execution result is "Salt2+SM3(pwd+Salt1)".

[0134] Furthermore, the expression parser continues to parse the current outer function, parsing the current expression as "Salt2,SM3(pwd,Salt1),Salt3". Since the random value parameter Salt1 is at the end, the backward concatenation expression appendSalt(Salt3) is generated, and the pseudocode corresponding to this parsed fourth expression is added to the instruction list. The corresponding execution result is "Salt2+SM3(pwd+Salt1)+Salt3".

[0135] Then, the expression parser continues to parse the current outer function, parses the current expression as "Sha256()", and adds the pseudocode corresponding to the fourth expression obtained by parsing to the instruction list. The corresponding execution result is "Sha256(Salt2+SM3(pwd+Salt1)+Salt3)".

[0136] The list of instructions ultimately parsed by this data processing strategy combination is shown in Table 1 below.

[0137]

[0138] Table 1

[0139] In this embodiment, after configuring the initial security control with a combination of data processing strategies corresponding to the target business based on at least two custom-selected data processing strategies, when target data under the target business is obtained, the target security control calls the combination of data processing strategies corresponding to the target business. Then, the combination of data processing strategies is parsed into an instruction call sequence, and the target data is processed according to the instruction call sequence. This allows for more secure concealment of the target data, making the concealed data less likely to be cracked or leaked.

[0140] In one embodiment, after converting the target data according to the instruction call sequence to obtain the converted data, the above data processing method further includes: when the attribute of the target data is an encrypted attribute, calling the encryption policy through the target security control; and encrypting the processed data according to the encryption policy.

[0141] The target security control includes an encryption policy corresponding to the target business's custom configuration. This encryption policy is used to encrypt data, specifically data with an encryption attribute.

[0142] The target security control also includes a pre-configured encryption policy for the target business, used to encrypt target data with an encryption attribute.

[0143] If a computer device identifies that the target data under a target service has an encrypted attribute, it indicates that the target data is of high importance and requires conversion and encryption processing. Specifically, the computer device invokes the encryption policy through the target security control, and then uses the expression parser in the target security control to parse the security policy into corresponding encryption instructions. Then, for the converted data, the corresponding encryption instructions are executed to perform encryption processing.

[0144] In this embodiment, by further encrypting the converted data, the target data can be converted and encrypted more securely, making the converted data less susceptible to cracking and leakage, thereby greatly improving the security of the target data.

[0145] In one embodiment, the step of configuring a combination of data processing strategies corresponding to the target business for an initial security control based on at least two custom-selected data processing strategies to obtain a target security control bound to the target business includes: obtaining at least two custom-selected data processing strategies for the target sub-application; configuring a combination of data processing strategies corresponding to the target business in the target sub-application for the initial security control to obtain a target security control bound to the target business.

[0146] The initial security control is a security control based on the runtime environment of the parent application, which provides a runtime environment for multiple child applications.

[0147] It can be understood that a parent application refers to an application that can run independently; it is a native application that runs directly on the operating system. Specifically, a parent application can be an application that hosts child applications and provides a runtime environment for the child applications to run. Parent applications include, but are not limited to, instant messaging applications, SNS (Social Network Sites) applications, short video applications, long video applications, game applications, music sharing applications, and UGC (User Generated Content) applications, but are not limited to these.

[0148] Sub-applications can be various business application scenarios attached to the parent application, or they can be sub-applications running within the parent application. Each sub-application can correspond to a different business domain. Sub-applications include, but are not limited to, instant messaging applications, SNS applications, short video applications, long video applications, game applications, music sharing applications, shopping and sales applications, UGC applications, and various intelligent recognition applications, but are not limited to these.

[0149] Each sub-application can configure its own target security controls for its target business, and then configure the runtime environment of the sub-application according to the runtime environment of the parent application, so that the sub-application can run on the parent application.

[0150] The parent application pre-configured with initial security controls that provide various data processing strategies. If the target business needs to build a runtime environment for its target sub-application on the parent application, it can obtain the initial security controls provided by the parent application. Then, from the various customizable data processing strategies provided by the initial security controls, it can arbitrarily select the desired data processing strategy or combination of data processing strategies, and subsequently configure the target security control bound to the target sub-application. The target security control is used to transform and process the target data under the target business within the target sub-application.

[0151] Specifically, after the computer device obtains at least two data processing strategies that the target business party has customized for the target sub-application, it binds the initial security control to the target business of the target sub-application and configures the initial security control with a combination of data processing strategies corresponding to the target business, thereby obtaining a target security control with higher security that is bound to the target business.

[0152] In this embodiment, the initial security control provided by the parent application, which allows for the customization of multiple data processing strategies, enables each sub-application running in the parent application to arbitrarily select the desired data processing strategy or combination of data processing strategies from the various data processing strategies provided by the initial security control. This effectively generates multiple freely combinable combinations of data processing strategies for each sub-application, thereby enabling more secure transformation and processing of target data, making the transformed data less susceptible to cracking and leakage.

[0153] In one embodiment, such as Figure 5 As shown, another method for processing target data is provided, which specifically includes the following steps:

[0154] Step S502: Obtain the various data processing strategies provided by the initial security control; the initial security control is a security control mother based on the parent application's runtime environment, and the application provides a runtime environment for multiple sub-applications.

[0155] Step S504: Obtain at least two data processing strategies for the target sub-application using a custom selection.

[0156] Step S506: Configure the initial security control with a combination of data processing strategies corresponding to the target business in the target sub-application to obtain the target security control bound to the target business.

[0157] Step S508: When the target sub-application running in the parent application's runtime environment obtains the target data corresponding to the target business of the target sub-application, it calls the corresponding custom-configured data processing strategy combination through the target security control in the target sub-application.

[0158] Step S510: The data processing strategy combination is parsed into an instruction call sequence.

[0159] Step S512: Perform conversion processing on the target data according to the instruction call sequence to obtain the converted data.

[0160] It is understandable that after the computer device obtains at least two data processing strategies that the target business party has customized for the target sub-application, it binds the initial security control to the target business of the target sub-application and configures the initial security control with a combination of data processing strategies corresponding to the target business, thereby obtaining a target security control with higher security that is bound to the target business.

[0161] When a target sub-application running in the parent application's runtime environment obtains target data corresponding to its target business, it indicates that the target data under the target business of the target sub-application needs to be transformed. The computer device then calls the corresponding custom-configured data processing strategy combination through the target security control in the target sub-application. The target security control then parses the data processing strategy combination to obtain the corresponding instruction call sequence with execution order. The instruction call sequence is then executed sequentially on the target data according to the execution order until the instruction call sequence is completed, thus completing the transformation of the target data and obtaining the transformed data.

[0162] Computer equipment can further store and apply the converted data, thereby effectively ensuring that the data processing strategies corresponding to the target business of each sub-application can be customized more securely and flexibly without exposing the plaintext of the target data. This makes the target data conversion process more secure, so that the converted data is not easily cracked or leaked, effectively ensuring the security of the target data.

[0163] In a specific embodiment, such as Figure 6 The diagram shown is a timing diagram of data conversion processing in one embodiment. (Refer to...) Figure 6The computer device contains security controls, which are target security controls corresponding to the target business. Specifically, these controls can represent the server corresponding to the target business. The target business can be specifically represented as the terminal corresponding to the target business party.

[0164] Specifically, the computer device uses the various data processing strategies provided by the initial security control. Based on the target business party's custom selection of the desired data processing strategy combination from these strategies, the initial security control is configured with the corresponding data processing strategy combination for the target business, resulting in a target security control bound to the target business. When the target business party inputs target data, the computer device invokes the bound target security control, loads the custom-configured data processing strategy combination within it, and parses it to obtain a sequence of instruction calls with execution order.

[0165] Once the target data collection is complete, a notification can be sent to the target business party confirming the completion of data collection. The target security control then acquires the collected target data and inputs it into the control. The control first executes the first parsed instruction in the instruction call sequence according to the execution order. Then, it executes the parsed instructions sequentially until the last instruction is executed, yielding the transformed data, which is then returned to the target business party. For example, the transformed data could be a transformed HashData hash value.

[0166] In a specific embodiment, such as Figure 7 As shown, a specific data processing method is provided, which includes the following steps:

[0167] Step 702: Obtain the various data processing strategies provided by the initial security control.

[0168] Step 704: Obtain at least two data processing strategies corresponding to the target business based on the custom selection, and determine the nested call order corresponding to the at least two custom-selected data processing strategies.

[0169] Step 706: According to the nested call order, parse at least two data processing strategies into nested call functions corresponding to the target business.

[0170] Step 708: Configure nested call functions in the initial security control to obtain the target security control bound to the target business.

[0171] Step 710: When the data obtained under the target business is the target data, the expression parser and data processing strategy combination is invoked through the target security control.

[0172] Step 712: Initialize the instruction list through the expression parser; determine the outer function interface for the data processing strategy combination.

[0173] Step 714: If the data processing strategy combination is identified as including nested function calls based on the outer function interface, then the nested function calls are parsed layer by layer to obtain the nested expressions in the nested function calls. The parsed expressions are added to the instruction list in the parsing order to obtain the instruction call sequence.

[0174] Step 716: Execute the call instructions in the instruction call sequence according to the execution order. During the execution process, the execution result of the previous call instruction is used as the input of the next call instruction to transform the target data and obtain the transformed data.

[0175] In this embodiment, by configuring a combination of data processing strategies corresponding to the target business for the initial security control based on at least two custom-selected data processing strategies, a target security control bound to the target business is obtained. This allows the business party to flexibly generate various combinations of data processing strategies, and the combined data processing strategies offer higher security for data transformation. When target data under the target business is obtained, the target security control parses the data processing strategy combination into an instruction call sequence, and then transforms the target data according to the instruction call sequence. This enables more secure transformation of the target data, making the transformed data less susceptible to cracking and leakage, thereby effectively improving the security of the target data.

[0176] This application also provides an application scenario in which the above-described data processing method is applied. Specifically, the user terminal runs an application corresponding to the target business or accesses a corresponding business system website, such as various communication services, banking services, payment services, etc. The application corresponding to the target business or the website accessing the corresponding business system can be pre-configured with a corresponding target security control. This target security control is configured based on a combination of data processing strategies custom-selected by the target business party from a variety of data processing strategies provided by the initial security control.

[0177] Users can input data related to a specific business function through the application on their user terminal. When the user inputs target data for that business function, such as passwords or personal information, the terminal invokes the corresponding target security control. This control loads and parses the corresponding data processing strategy combination, then uses the parsed instruction sequence to perform real-time conversion processing on the user-input target data, resulting in the converted data. This effectively ensures that the plaintext of the target data is not leaked during the user's input process. For high-security scenarios such as password input and payment / financial transactions, this effectively guarantees password and payment security, thereby significantly improving the security of critical target data.

[0178] It should be understood that, although Figure 2 , Figure 5 , Figure 7 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 2 , Figure 5 , Figure 7 At least some of the steps in the process may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but may be executed at different times. The execution order of these steps or stages is not necessarily sequential, but may be executed in turn or alternately with other steps or at least some of the steps or stages in other steps.

[0179] In one embodiment, such as Figure 8 As shown, a data processing device 800 is provided. This device can be a software module, a hardware module, or a combination of both, integrated into a computer device. Specifically, the device includes: a policy acquisition module 802, a security control configuration module 804, a security control invocation module 806, and a data conversion and processing module 808, wherein:

[0180] The strategy acquisition module 802 is used to acquire various data processing strategies provided by the initial security control.

[0181] The security control configuration module 804 is used to configure a combination of data processing strategies corresponding to the target business for the initial security control based on at least two custom-selected data processing strategies, so as to obtain a target security control bound to the target business.

[0182] The security control invocation module 806 is used to invoke a combination of data processing strategies through the target security control when target data under the target business is obtained based on the target security control.

[0183] The data conversion and processing module 808 is used to parse the data processing strategy combination into an instruction call sequence; and to convert the target data according to the instruction call sequence to obtain the converted data.

[0184] In one embodiment, the security control configuration module 804 is further configured to obtain at least two data processing strategies corresponding to the target business based on a custom selection; generate a nested call function corresponding to the target business according to the at least two data processing strategies; configure the nested call function in the initial security control to obtain a target security control bound to the target business.

[0185] In one embodiment, the security control configuration module 804 is further configured to determine the nested call order corresponding to at least two custom-selected data processing strategies; and to parse the at least two data processing strategies into nested call functions corresponding to the target business according to the nested call order.

[0186] In one embodiment, the security control configuration module 804 is further configured to configure a data processing strategy for the initial security control; based on the configured data processing strategy, a corresponding combination strategy is configured in the initial security control to generate an initial security control that provides multiple data processing strategies.

[0187] In one embodiment, the security control invocation module 806 is further configured to, when the data acquired under the target business is target data, invoke the target security control expression parser and the data processing strategy combination; through the expression parser, determine the order of expressions in the data processing strategy combination, and parse the data processing strategy combination into an instruction invocation sequence in order.

[0188] In one embodiment, the security control calling module 806 is further configured to initialize the instruction list through an expression parser; determine the outer function interface of the data processing strategy combination; if the data processing strategy combination is identified to include nested call functions based on the outer function interface, then the nested call functions are parsed layer by layer to obtain the nested expressions in the nested call functions, and the parsed expressions are added to the instruction list in the parsing order to obtain the instruction call sequence.

[0189] In one embodiment, the security control calling module 806 is further configured to parse the nested calling function layer by layer to determine the position and number of input parameters in the parsed current expression; if the parsed current expression includes one input parameter, the current expression is added to the instruction list; if the parsed current expression includes at least two input parameters, a parameter concatenation expression is generated based on the position and number of input parameters and added to the instruction list.

[0190] In one embodiment, the security control invocation module 806 is further configured to perform legality checks on the parsed expressions respectively; if the legality checks pass, the parsed expressions are added to the instruction list in the parsing order to obtain the instruction invocation sequence.

[0191] In one embodiment, the instruction call sequence includes at least two call instructions with an execution order; the data conversion processing module 808 is further configured to execute the call instructions in the instruction call sequence according to the execution order, and during the execution process, use the execution result of the previous call instruction as the input of the next call instruction to convert the target data and obtain the converted data.

[0192] In one embodiment, the target security control includes an encryption policy corresponding to the target business's custom configuration; the data processing device further includes an encryption module, used to invoke the encryption policy through the target security control if the attribute of the target data is an encrypted attribute; and to encrypt the converted data according to the encryption policy.

[0193] In one embodiment, the initial security control is a security control based on the runtime environment of the parent application, which provides a runtime environment for multiple sub-applications; the security control configuration module 804 is also used to obtain at least two data processing strategies for the target sub-application; configure the initial security control with a combination of data processing strategies corresponding to the target business in the target sub-application to obtain a target security control bound to the target business; the target security control is used to transform and process the target data under the target business in the target sub-application.

[0194] In one embodiment, the data conversion processing module 808 is further configured to, when a target sub-application running in the parent application's runtime environment obtains target data corresponding to the target business of the target sub-application, call the corresponding custom-configured data processing strategy combination through the target security control in the target sub-application to convert and process the target data according to the data processing strategy combination.

[0195] Specific limitations regarding the data processing device can be found in the limitations regarding the data processing method described above, and will not be repeated here. Each module in the aforementioned data processing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in the computer device in hardware form, or stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0196] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 9As shown, the computer device includes a processor, memory, and a network interface connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements a data processing method.

[0197] In another embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 10 As shown, the computer device includes a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a data processing method. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device casing, or an external keyboard, touchpad, or mouse.

[0198] Those skilled in the art will understand that Figure 9 and Figure 10 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0199] In one embodiment, a computer device is also provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps in the above method embodiments.

[0200] In one embodiment, a computer-readable storage medium is provided storing a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0201] In one embodiment, a computer program product or computer program is provided, the computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and executes the computer instructions, causing the computer device to perform the steps in the above method embodiments.

[0202] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0203] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0204] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A data processing method, characterized in that, The method includes: Obtain the various data processing strategies provided by the initial security controls; Based on at least two custom-selected data processing strategies, a combination of data processing strategies corresponding to the target business is configured for the initial security control to obtain a target security control bound to the target business, including: generating a nested call function corresponding to the target business based on at least two custom-selected data processing strategies corresponding to the target business, configuring the nested call function in the initial security control to obtain a target security control bound to the target business; When target data under the target business is obtained based on the target security control, the data processing strategy combination is called through the target security control, and the data processing strategy combination is parsed into an instruction call sequence. This includes: calling the expression parser and the data processing strategy combination through the target security control; initializing the instruction list through the expression parser; determining the outer function interface of the data processing strategy combination; if the data processing strategy combination is identified as including nested call functions based on the outer function interface, then the nested call functions are parsed layer by layer to obtain the nested expressions in the nested call functions; and the parsed expressions are added to the instruction list in the parsing order to obtain the instruction call sequence. The target data is transformed according to the instruction call sequence to obtain the transformed data.

2. The method according to claim 1, characterized in that, The process of generating nested call functions corresponding to the target business based on at least two data processing strategies selected by the user and corresponding to the target business includes: Obtain at least two of the data processing strategies corresponding to the target business, selected by the user. Determine the nested invocation order corresponding to at least two of the custom-selected data processing strategies; According to the nested call order, the at least two data processing strategies are parsed into nested call functions corresponding to the target business.

3. The method according to claim 1, characterized in that, Before acquiring the various data processing strategies provided by the initial security control, the method further includes a configuration step for the initial security control, which includes: Configure data processing strategies for the initial security controls; Based on the configured data processing strategy, the corresponding combination strategy is configured in the initial security control to generate an initial security control that provides multiple data processing strategies.

4. The method according to claim 1, characterized in that, The step-by-step parsing of the nested function calls yields the nested expressions within the nested function calls, including: The nested function calls are parsed layer by layer to determine the position and number of input parameters in the current expression obtained from the parsing. If the parsed current expression includes an input parameter, then the current expression is added to the instruction list; If the parsed current expression includes at least two input parameters, then a parameter concatenation expression is generated and added to the instruction list based on the position and number of the input parameters.

5. The method according to claim 4, characterized in that, If the parsed current expression includes at least two input parameters, then based on the position and number of the input parameters, a parameter concatenation expression is generated and added to the instruction list, including: If the parsed current expression includes an input parameter of target data and an input parameter of random value, then a parameter concatenation expression is generated and added to the instruction list based on the positional relationship between the input parameter of target data and the input parameter of random value.

6. The method according to claim 5, characterized in that, The step of generating a parameter concatenation expression and adding it to the instruction list based on the positional relationship between the input parameters of the target data and the input parameters of the random values ​​includes: When the input parameter of the random value precedes the input parameter of the target data, a forward concatenation expression is generated and added to the instruction list; When the input parameter of the random value is after the input parameter of the target data, a backward concatenation expression is generated and added to the instruction list.

7. The method according to claim 1, characterized in that, The step of adding the parsed expressions to the instruction list in the parsing order to obtain the instruction call sequence includes: Perform validity checks on the parsed expressions respectively; If the validity check passes, the parsed expression is added to the instruction list in the parsing order to obtain the instruction call sequence.

8. The method according to claim 1, characterized in that, The instruction call sequence includes at least two call instructions with an execution order; the transformation processing of the target data according to the instruction call sequence to obtain the transformed data includes: The call instructions in the instruction call sequence are executed according to the execution order. During the execution, the execution result of the previous call instruction is used as the input of the next call instruction to transform the target data and obtain the transformed data.

9. The method according to claim 1, characterized in that, The target security control includes an encryption policy corresponding to the custom configuration of the target business; After the target data is transformed according to the instruction call sequence to obtain the transformed data, the method further includes: If the target data has an encrypted attribute, the encryption policy is invoked through the target security control. The converted data is encrypted according to the encryption strategy described above.

10. The method according to claim 9, characterized in that, The step of encrypting the converted data according to the encryption strategy includes: The expression parser parses the encryption strategy into encryption instructions. The encryption instruction is executed to encrypt the converted data.

11. The method according to any one of claims 1 to 10, characterized in that, The initial security control is a security control based on the runtime environment of the parent application, which provides a runtime environment for multiple child applications; The at least two data processing strategies selected based on custom criteria are configured for the initial security control to form a combination of data processing strategies corresponding to the target business, resulting in a target security control bound to the target business, including: Obtain at least two of the data processing strategies described herein, based on a custom selection for the target sub-application; Configure the initial security control with a data processing strategy combination corresponding to the target business in the target sub-application to obtain a target security control bound to the target business; the target security control is used to transform and process the target data under the target business in the target sub-application.

12. The method according to claim 11, characterized in that, When target data under the target business is obtained based on the target security control, the data processing strategy combination is invoked through the target security control, including: When a target sub-application running in the parent application's runtime environment obtains target data corresponding to the target business of the target sub-application, then The target security control in the target sub-application invokes the corresponding custom-configured data processing strategy combination to transform the target data according to the data processing strategy combination.

13. A data processing apparatus, characterized in that, The device includes: The strategy acquisition module is used to acquire various data processing strategies provided by the initial security controls. A security control generation module is used to configure a combination of data processing strategies corresponding to a target business for an initial security control based on at least two custom-selected data processing strategies to obtain a target security control bound to the target business. The module includes: generating a nested call function corresponding to the target business based on at least two custom-selected data processing strategies corresponding to the target business; configuring the nested call function in the initial security control to obtain a target security control bound to the target business. The security control invocation module is used to invoke the data processing strategy combination through the target security control when target data under the target business is obtained based on the target security control, including: invoking the expression parser and the data processing strategy combination through the target security control; The data conversion and processing module is used to parse the data processing strategy combination into an instruction call sequence, including: initializing the instruction list through the expression parser; determining the outer function interface of the data processing strategy combination; if the data processing strategy combination includes nested function calls identified based on the outer function interface, parsing the nested function calls layer by layer to obtain the nested expressions in the nested function calls; adding the parsed expressions to the instruction list in the parsing order to obtain the instruction call sequence; and converting the target data according to the instruction call sequence to obtain the converted data.

14. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 12.

15. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 12.

16. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 12.

Images