Data processing method and device, equipment, storage medium and program product

Abstract

The application provides a data processing method, device and equipment, computer readable storage medium and computer program product; comprising: in response to a data acquisition request of a development object for original data, obtaining the associated information of the development object and the original data; based on the associated information, generating a confusion factor corresponding to the original data, and dividing the original data into at least two data blocks; for at least one of the at least two data blocks, based on the confusion factor, generating confusion data corresponding to the data block; inserting the confusion data into the corresponding data block in the original data to obtain target data corresponding to the original data, and returning the target data to the terminal corresponding to the development object. Through the application, the security of data in the development process can be improved.

Description

Technical Field

[0001] This application relates to Internet technology, and more particularly to a data processing method, apparatus, device, computer-readable storage medium, and computer program product. Background Technology

[0002] In related technologies, data development typically employs two approaches. The first is to directly develop logical algorithms using Structured Query Language (SQL) on the production log server. This method directly connects to the production log server for development and debugging, ensuring data accuracy and reliability. The second approach involves fetching partial data from the production log server to the development log server for further development and debugging, resulting in high performance. However, the first approach suffers from high data risk and low performance during development and debugging. While the second approach addresses the issues of low performance and partial data risk, it suffers from incomplete data and still presents data security risks. Summary of the Invention

[0003] This application provides a data processing method, apparatus, device, computer-readable storage medium, and computer program product, which can improve data security during the development process.

[0004] The technical solution of this application embodiment is implemented as follows: This application provides a data processing method, including: In response to a data acquisition request from a development object for raw data, obtain the associated information of the development object and the raw data; Based on the association information, a confusion factor corresponding to the original data is generated, and the original data is divided into data blocks to obtain at least two data blocks; For at least one of the at least two data blocks, based on the confusion factor, generate obfuscated data corresponding to the data block; The obfuscated data is inserted into the corresponding data block in the original data to obtain the target data corresponding to the original data, and the target data is returned to the terminal corresponding to the development object.

[0005] This application provides a data processing apparatus, including: The acquisition module is used to respond to a data acquisition request from a development object for raw data, and to acquire the associated information of the development object and the raw data. The first generation module is used to generate a confusion factor corresponding to the original data based on the association information, and to divide the original data into data blocks to obtain at least two data blocks; The second generation module is used to generate obfuscated data corresponding to at least one of the at least two data blocks, based on the obfuscation factor; The obfuscation module is used to insert the obfuscated data into the corresponding data block of the original data to obtain the target data corresponding to the original data, and return the target data to the terminal corresponding to the development object.

[0006] In the above scheme, the acquisition module is further configured to parse the data acquisition request to obtain the association information of the development object carried by the data acquisition request. The association information includes at least one of the following: the identity information of the development object, the generation time of the data acquisition request, and the permission level corresponding to the development object; or, to obtain the object identifier corresponding to the development object, and to perform association information indexing based on the object identifier to obtain the association information of the development object.

[0007] In the above scheme, the first generation module is further used to obtain the confusion factor key and the corresponding encryption method; based on the confusion factor key, the associated information is encrypted using the encryption method to generate a confusion factor corresponding to the original data.

[0008] In the above scheme, the first generation module is further configured to perform the following operations for each row of data in the original data when the original data includes at least one row of data: obtain the number of data blocks corresponding to the row of data; wherein the number of data blocks is not less than two; and divide the row of data into a corresponding number of data blocks based on the number of data blocks to obtain at least two data blocks.

[0009] In the above scheme, the at least two data blocks constitute a data block sequence, and the second generation module is further configured to obtain the data block number corresponding to each data block in the data block sequence; and generate obfuscated data corresponding to the data block based on the obfuscation factor and the data block number.

[0010] In the above scheme, the second generation module is further configured to obtain the data block digest corresponding to each data block; for each data block, perform product processing on the confusion factor, the data block digest and the data block number to obtain the confusion sub-data corresponding to each data block; and perform sum processing on the confusion sub-data corresponding to each data block to obtain the confusion data corresponding to the data block.

[0011] In the above scheme, the device further includes an insertion module, which is used to perform target data processing on the obfuscated data and the data block numbers of each data block to obtain target processing results corresponding to each data block; perform modulo processing on the target processing results for each data block to obtain modulo results corresponding to each data block; determine an insertion identifier based on the modulo results corresponding to each data block, the insertion identifier being used to indicate the data block into which the obfuscated data is inserted; the obfuscation module is also used to insert the obfuscated data into the corresponding data block based on the insertion identifier to obtain target data corresponding to the original data.

[0012] In the above scheme, the insertion module is further configured to, when there are at least two identical modulo results in the modulo results corresponding to each of the data blocks, filter out the duplicate modulo results and take the remaining modulo results as the target modulo results; and determine the insertion identifier based on the target modulo results.

[0013] In the above scheme, the insertion module is further configured to obtain a pre-set insertion rule, which is used to indicate the insertion position of the obfuscated data in the data block sequence; based on the insertion rule, determine an insertion identifier, which is used to indicate the data block in which the obfuscated data is inserted; the obfuscation module is further configured to insert the obfuscated data into the corresponding data block based on the insertion identifier, thereby obtaining the target data corresponding to the original data.

[0014] In the above scheme, the device further includes a presentation module, which is used to determine the viewing permission level corresponding to the development object based on the association information of the development object; and to present the target data on the terminal in a target display format based on the viewing permission level; wherein, different viewing permission levels correspond to different display formats of the target data.

[0015] This application provides an electronic device, including: Memory, used to store executable instructions; The processor, when executing executable instructions stored in the memory, implements the data processing method provided in the embodiments of this application.

[0016] This application provides a computer-readable storage medium storing executable instructions for inducing a processor to execute and implement the data processing method provided in this application.

[0017] This application provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. The processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the data processing method provided in this application.

[0018] The embodiments of this application have the following beneficial effects: By dividing the data into data blocks, and based on the resulting data blocks and the obfuscation factor generated according to the associated information of the development object, the obfuscated data of the corresponding data blocks is determined. The determined obfuscated data is then inserted into the corresponding data blocks to achieve the obfuscation operation. In this way, not only is the security level of the data effectively improved, but the data development process is also made more open and controllable. Attached Figure Description

[0019] Figure 1 This is an optional architecture diagram of the data processing system 100 provided in this application embodiment; Figure 2 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application; Figure 3 This is a flowchart illustrating the data processing method provided in an embodiment of this application; Figure 4 This is an optional schematic diagram of the generation of confusion factors provided in the embodiments of this application; Figure 5 This is a flowchart illustrating the process of generating obfuscated data provided in an embodiment of this application; Figure 6 This is a flowchart illustrating the process of generating obfuscated data provided in an embodiment of this application; Figure 7 This is a schematic diagram illustrating the target conversion of the confusion factor provided in an embodiment of this application; Figure 8 This is a schematic diagram of the obfuscated data corresponding to each data block provided in the embodiments of this application; Figure 9 This is a schematic diagram of the process for determining an insertion identifier for a data block used to indicate the insertion of obfuscated data, provided in an embodiment of this application. Figure 10 This is a schematic diagram of the process for determining an insertion identifier for a data block used to indicate the insertion of obfuscated data, provided in an embodiment of this application. Figure 11 This is a schematic diagram illustrating the target data for obtaining the corresponding original data, provided in an embodiment of this application. Figure 12 This is a schematic diagram illustrating the target data for obtaining the corresponding original data, provided in an embodiment of this application. Figure 13 This is a flowchart illustrating the target data presentation process provided in the embodiments of this application; Figure 14 This is a schematic diagram illustrating the display of report data provided in an embodiment of this application; Figure 15 This is a schematic diagram illustrating the display of report data provided in an embodiment of this application; Figure 16 This is a schematic diagram illustrating the inverse process of target conversion for the target confusion factor provided in the embodiments of this application; Figure 17 This is a schematic diagram illustrating the decryption process of the obfuscation factor provided in an embodiment of this application; Figure 18 This is a schematic diagram of a leaked data fragment provided in an embodiment of this application; Figure 19 This is an optional schematic diagram illustrating development on a production log server, as provided in an embodiment of this application. Figure 20 This is an optional schematic diagram illustrating development on a development log server, provided in an embodiment of this application. Figure 21 This is a schematic diagram of the data retrieval operation of the data processing system provided in the embodiments of this application. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0021] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0022] In the following description, the terms "first," "second," and "third" are used merely to distinguish similar objects and do not represent a specific ordering of the objects. It is understood that "first," "second," and "third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein. In the following description, the term "multiple" means at least two.

[0023] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0024] Before providing a further detailed description of the embodiments of this application, the nouns and terms involved in the embodiments of this application will be explained, and the nouns and terms involved in the embodiments of this application shall be interpreted as follows.

[0025] 1) Sensitive data: Sensitive statistical data such as retention data, activity data, online data and payment data of each game.

[0026] 2) Permission levels: User permissions are tiered according to different user roles, such as outsourced personnel, regular employees, leaders, directors, etc.

[0027] 3) Obfuscated data: Data obtained by obfuscating sensitive data through technical means.

[0028] The applicant discovered that there are varying degrees of risks in both the traditional data development stage and the statistical report output stage in the production environment. The main risk is the lack of filtering and obfuscation of sensitive data, which exposes the official sensitive data and the resulting report data.

[0029] Based on this, embodiments of this application provide a data processing method, apparatus, electronic device, computer-readable storage medium, and computer program product. These not only obfuscate key fields and information in sensitive data during the development phase, thus protecting sensitive data at the source of development, but also obfuscate sensitive fields in formal report data from the production environment. This ensures that results intercepted by low-privilege users carry traces of obfuscated information, resulting in slightly different results seen by users with different permission levels.

[0030] See Figure 1 , Figure 1 This is an optional architecture diagram of the data processing system 100 provided in this application embodiment. To realize the application scenario of data processing (for example, an independent obfuscated database can be created on the basis of the formal development database. The obfuscated database has independent permissions and is not coupled with the formal development database. The data source of the obfuscated database comes from the data retrieval operation of the data processing system. Data filtering and obfuscation are performed during the retrieval process, and then the data is written into the obfuscated database through the interface so that the development object can be developed based on the obfuscated database), the terminal (terminal 400 is shown as an example) connects to the server 200 through the network 300. The network 300 can be a wide area network or a local area network, or a combination of both.

[0031] Terminal 400 is used by users to access client 401, and is displayed on display interface 401-1 (development interface 401-1 is shown as an example). Terminal 400 and server 200 are interconnected via wired or wireless network.

[0032] Server 200 is used to respond to the data acquisition request of the development object for the original data, acquire the associated information of the development object and the original data; based on the associated information, generate the obfuscation factor corresponding to the original data, and divide the original data into data blocks to obtain at least two data blocks; for at least one of the at least two data blocks, generate obfuscated data for the corresponding data block based on the obfuscation factor; insert the obfuscated data into the corresponding data block in the original data to obtain the target data corresponding to the original data, and return the target data to the terminal 400 corresponding to the development object; Terminal 400 is also used to display the received target data in the development interface 401-1.

[0033] In some embodiments, server 200 may be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. Terminal 400 may be a smartphone, tablet, laptop, desktop computer, set-top box, or mobile device (e.g., mobile phone, portable music player, personal digital assistant, dedicated messaging device, in-vehicle terminal, in-vehicle infotainment system, in-vehicle data center, portable gaming device, smart speaker, and smartwatch), but is not limited thereto. Terminal devices and servers can be directly or indirectly connected via wired or wireless communication, which is not limited in this embodiment.

[0034] See Figure 2 , Figure 2 This is a schematic diagram of the structure of the electronic device provided in the embodiments of this application. In practical applications, the electronic device can be... Figure 1 The server 200 or terminal 400 shown are described in the following document. Figure 2 , Figure 2 The illustrated electronic device includes at least one processor 410, a memory 450, at least one network interface 420, and a user interface 430. The various components in terminal 400 are coupled together via a bus system 440. It is understood that the bus system 440 is used to implement communication between these components. In addition to a data bus, the bus system 440 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in… Figure 2 The general labeled all buses as Bus System 440.

[0035] Processor 410 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor can be a microprocessor or any conventional processor, etc.

[0036] User interface 430 includes one or more output devices 431 that enable the presentation of media content, including one or more speakers and / or one or more visual displays. User interface 430 also includes one or more input devices 432, including user interface components that facilitate user input, such as a keyboard, mouse, microphone, touch screen display, camera, other input buttons and controls.

[0037] The memory 450 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state storage, hard disk drives, optical disk drives, etc. The memory 450 may optionally include one or more storage devices physically located away from the processor 410.

[0038] The memory 450 may include volatile memory or non-volatile memory, or both. The non-volatile memory may be read-only memory (ROM), and the volatile memory may be random access memory (RAM). The memory 450 described in this application embodiment is intended to include any suitable type of memory.

[0039] In some embodiments, memory 450 is capable of storing data to support various operations, examples of which include programs, modules, and data structures or subsets or supersets thereof, as illustrated below.

[0040] Operating system 451 includes system programs for handling various basic system services and performing hardware-related tasks, such as the framework layer, core library layer, driver layer, etc., for implementing various basic business functions and handling hardware-based tasks; The network communication module 452 is used to reach other computing devices via one or more (wired or wireless) network interfaces 420, exemplary network interfaces 420 including: Bluetooth, WiFi, and Universal Serial Bus (USB), etc. Presentation module 453 is configured to enable the presentation of information (e.g., a user interface for operating peripheral devices and displaying content and information) via one or more output devices 431 associated with user interface 430 (e.g., a display screen, a speaker, etc.). The input processing module 454 is used to detect and translate one or more user inputs or interactions from one or more input devices 432.

[0041] In some embodiments, the data processing apparatus provided in this application can be implemented in software. Figure 2 A data processing device 455 stored in memory 450 is shown. It may be software in the form of programs and plug-ins, including the following software modules: acquisition module 4551, first generation module 4552, second generation module 4553, and obfuscation module 4554. These modules are logical and can therefore be arbitrarily combined or further split according to the functions they implement.

[0042] In other embodiments, the data processing apparatus provided in this application can be implemented in hardware. As an example, the data processing apparatus provided in this application can be a processor in the form of a hardware decoding processor, which is programmed to execute the data processing method provided in this application. For example, the processor in the form of a hardware decoding processor can be one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field-programmable gate arrays (FPGAs), or other electronic components.

[0043] In some embodiments, the terminal or server can implement the data processing method provided in this application by running a computer program. For example, the computer program can be a native program or software module in an operating system; it can be a native application (APP), that is, a program that needs to be installed in the operating system to run, such as an instant messaging APP or a web browser APP; it can also be a mini-program, that is, a program that only needs to be downloaded into a browser environment to run; or it can be a mini-program that can be embedded in any APP. In short, the above-mentioned computer program can be any form of application, module or plugin.

[0044] Based on the foregoing description of the data processing system and electronic device provided in the embodiments of this application, the data processing method provided in the embodiments of this application will be described below. In actual implementation, the data processing method provided in the embodiments of this application can be implemented by a terminal or a server alone, or by a terminal and a server working together, so that... Figure 1 The following description uses the example of server 200 executing the data processing method provided in this application embodiment alone. See also... Figure 3 , Figure 3 This is a flowchart illustrating the data processing method provided in the embodiments of this application, which will be combined with... Figure 3 The steps shown are explained.

[0045] Step 101: The server responds to the development object's data retrieval request for the original data and retrieves the development object's associated information and the original data.

[0046] In actual implementation, the server first receives the data acquisition request for raw data from the development object. This data acquisition request can be for the raw data corresponding to the function to be developed. After receiving the data acquisition request for raw data from the development object, the server can obtain the associated information and raw data of the development object based on the data acquisition request.

[0047] It should be noted that when a data retrieval request for raw data is received from a development object, in some embodiments, the data retrieval request carries the development object's associated information. In this case, the development object's associated information can be directly retrieved based on the data retrieval request. In other embodiments, the data retrieval request does not carry the development object's associated information, as the development object's associated information is already stored locally. Therefore, it is only necessary to obtain the object identifier corresponding to the development object, and the associated information of the development object can be retrieved from the locally stored associated information based on the object identifier. Based on this, there can be two methods for retrieving the development object's associated information. The following sections will describe these two methods.

[0048] In some embodiments, after receiving a data acquisition request for raw data from a development object, the data acquisition request is parsed to obtain the associated information of the development object carried in the data acquisition request. Here, the associated information includes at least one of the following: the identity information of the development object, the generation time of the data acquisition request, and the permission level corresponding to the development object.

[0049] In other embodiments, after receiving a data acquisition request from the development object for the original data, the object identifier corresponding to the development object can be directly obtained, and the associated information index can be performed based on the object identifier to obtain the associated information of the development object.

[0050] Step 102: Based on the association information, generate the confusion factor corresponding to the original data, and divide the original data into data blocks to obtain at least two data blocks.

[0051] In practice, the first step is to obtain the obfuscation factor key and its corresponding encryption method. Then, based on the obfuscation factor key, the associated information is encrypted using the encryption method to generate the obfuscation factor corresponding to the original data. Here, the obfuscation factor key is a predefined key corresponding to the development object. This key is stored internally and is not publicly disclosed. The corresponding encryption method can be a one-way compression function such as an Advanced Encryption Standard (AES) encryptor, etc. (See [link to documentation]). Figure 4 , Figure 4 This is an optional schematic diagram of the generation of confusion factors provided in the embodiments of this application, based on Figure 4 After obtaining the associated information, the obfuscation factor key, and the corresponding encryption method, the associated information is encrypted using the corresponding encryption method based on the obfuscation factor key to generate the corresponding obfuscation factor.

[0052] It should be noted that the obfuscation factor generated here is reversible, meaning that the obfuscation factor can be decrypted using the corresponding obfuscation factor key to obtain the associated information corresponding to the obfuscation factor.

[0053] In actual implementation, the raw data obtained in response to the development object's request for raw data can be stored in various forms, such as in the form of a list. Depending on the storage form of the raw data, when the raw data includes at least one row of data, the number of data blocks corresponding to each row of data is obtained. The number of data blocks is not less than two. Based on the number of data blocks, the row of data is divided into a corresponding number of data blocks to obtain at least two data blocks.

[0054] It should be noted that the number of data blocks corresponding to the row data obtained here can be preset by the development object or determined directly by the server. For example, the server can determine the number of data blocks corresponding to the row data based on the size of the row data.

[0055] Step 103: For at least one of the at least two data blocks, generate obfuscated data for the corresponding data block based on the obfuscation factor.

[0056] In practice, after obtaining at least two data blocks, these two data blocks can form a data block sequence. After forming the data block sequence, see [link to relevant documentation]. Figure 5 , Figure 5 This is a flowchart illustrating the process of generating obfuscated data provided in an embodiment of this application, based on... Figure 3 Step 103 can also be performed in the following way: Step 1031: Obtain the data block number corresponding to each data block in the data block sequence.

[0057] In practice, after the data block sequence is formed, the data block number corresponding to each data block in the data block sequence is obtained according to the order of each data block in the data block sequence.

[0058] Step 1032: Generate obfuscated data for the corresponding data block based on the obfuscation factor and the data block number.

[0059] In practice, after determining the obfuscation factor and data block number, obfuscated data for the corresponding data block is generated based on the obfuscation factor and data block number. (See [link to documentation]). Figure 6 , Figure 6 This is a flowchart illustrating the process of generating obfuscated data provided in an embodiment of this application, based on... Figure 5 Step 1032 can also be performed in the following way: Step 10321: Obtain the data block digest corresponding to each data block.

[0060] In practice, after obtaining at least two data blocks, digest processing is performed on the data blocks to obtain the data block digests corresponding to each data block. The digest processing performed on the data blocks can be hash processing to obtain the data block digests corresponding to each data block, such as MD5 (Message-Digest Algorithm) value, SHA (Secure Hash Algorithm) value, etc.

[0061] As an example, suppose the original data row has n fields, such as Col1, Col2, Col3, ..., Coln, and the corresponding data blocks are data_1-1, data_1-2, data_1-3, data_1-4, ..., data_1-n. Here, data_1-1 is the first data block of the first row, data_1-2 is the second data block of the first row, and so on. Then, a string processing hash function RSHash is defined, which can use either the MD5 or SHA message digest algorithm. Next, this string processing hash function is used to hash each data block, converting the string content into a number, such as M. 1-1 =RSHash(data_1-1), where M 1-1 This is the hash of the first data block in the first row, which is the data block digest corresponding to the first data block in the first row.

[0062] Step 10322: For each data block, perform a product of the confusion factor, data block summary, and data block number to obtain the confusion sub-data corresponding to each data block.

[0063] In practice, the process of multiplying the obfuscation factor, data block summary, and data block number for each data block to obtain the obfuscated sub-data for each data block is as follows: First, the obfuscation factor is transformed to obtain the target obfuscation factor. (See [link to relevant documentation]). Figure 7 , Figure 7 This is a schematic diagram illustrating the target transformation of the confusion factor provided in an embodiment of this application, based on... Figure 7 The obfuscation factor is converted to ASCII code to obtain the target obfuscation factor, i.e., TN = ASCII(factor). Then, for each data block, the target obfuscation factor, the data block digest, and the data block number are multiplied to obtain the obfuscated sub-data corresponding to each data block. For example, for the first data block in the first row, the target obfuscation factor is TN, and the data block digest is M. 1-1 If the data block number is 1, then the corresponding obfuscated sub-data MN is... 1-1 For TN M 1-1 1; For the Nth data block in the first row, the target confusion factor is TN, and the data block digest is M. 1-N If the data block number is N, then the corresponding obfuscated sub-data MN is... 1-N For TN M 1-N N.

[0064] Step 10323: Sum the obfuscated sub-data corresponding to each data block to obtain the obfuscated data of the corresponding data block.

[0065] In practice, after obtaining the obfuscated sub-data corresponding to each data block, the obfuscated sub-data corresponding to each data block is summed to obtain the obfuscated data for the corresponding data block. Continuing with the example above, after obtaining the obfuscated sub-data MN corresponding to each data block... 1-1 MN 1-2 ... MN 1-N Then, the obfuscated sub-data corresponding to each data block are summed to obtain the obfuscated data MN1 of the corresponding data block, i.e., MN1 = MN 1-1 +MN 1-2 +……+MN 1-N .

[0066] It should be noted that the obfuscated data of each data block in the same row is the same. That is, the obfuscated data of the first data block in the first row is MN1, the obfuscated data of the Nth data block in the first row is also MN1, and the obfuscated data of each data block in the Nth row is MN1. N See Figure 8 , Figure 8 This is a schematic diagram of the obfuscated data corresponding to each data block provided in the embodiments of this application, based on Figure 8 The obfuscated data of each data block in the same row is the same, while the obfuscated data of data blocks in different rows are different. For example, the obfuscated data of each data block in the first row is MN1, the obfuscated data of each data block in the second row is MN2, the obfuscated data of each data block in the third row is MN3, and the obfuscated data of each data block in the fourth row is MN4.

[0067] In practice, after determining the obfuscated data corresponding to each data block, the data blocks that need to be obfuscated are also determined. This process specifically includes determining an insertion identifier for the data block used to indicate the insertion of obfuscated data. This insertion identifier corresponds to the data block number in the data block sequence. The following sections will explain the two processes for determining the insertion identifier for the data block used to indicate the insertion of obfuscated data.

[0068] In some embodiments, see Figure 9 , Figure 9 This is a flowchart illustrating the process of determining an insertion identifier for a data block used to indicate the insertion of obfuscated data, provided in an embodiment of this application. Figure 3 After step 103, the following can also be executed: Step 201: The server performs target data processing on the obfuscated data and the data block numbers of each data block to obtain the target processing results for each data block.

[0069] In actual implementation, the process of the server performing target data processing on the obfuscated data and the data block numbers of each data block to obtain the target processing results for each data block specifically includes the server performing a division operation on the obfuscated data and the data block numbers of each data block to obtain the operation results for each data block.

[0070] Step 202: For each data block, perform modulo processing on the target processing result to obtain the modulo result for each data block.

[0071] In practical implementation, the process of performing modulo operations on the target processing result for each data block to obtain the modulo result for each data block specifically includes: after obtaining the calculation result for each data block, performing modulo operations on the calculation result for each data block to obtain the modulo result for each data block. For example, here the obfuscated data is MN. N If the data block number is N, then the modulo result for each data block is Pos = MN. N mod(N).

[0072] Step 203: Based on the modulo result corresponding to each data block, determine the insertion identifier. The insertion identifier is used to indicate the data block into which the obfuscated data is inserted.

[0073] In practical implementation, after obtaining the modulo results for each data block, the process of determining the insertion identifier based on these results specifically includes: determining whether there are at least two identical modulo results among the modulo results for each data block; and determining the insertion identifier based on the determination result. The following section explains the two processes: determining whether there are at least two identical modulo results among the modulo results for each data block, and determining the insertion identifier based on the determination result.

[0074] In some embodiments, when there are at least two identical modulo results in the modulo results corresponding to each data block, the duplicate modulo results are filtered out, and the remaining modulo results are used as the target modulo results; based on the target modulo results, the insertion identifier is determined.

[0075] As an example, there are 6 modulo results, and the 6 modulo results are 1, 1, 1, 3, 4, 3. Here, there are duplicate modulo results. Therefore, the duplicate modulo results are filtered out to obtain the remaining modulo results 1, 3, 4. The remaining modulo results are used as the target modulo results. Then, based on the target modulo results 1, 3, 4, the insertion identifier is determined to be 1, 3, 4.

[0076] In other embodiments, when there are no at least two identical modulo results in the modulo results for each data block, an insertion identifier is determined based on the modulo results.

[0077] As an example, there are 6 modulo results, and the 6 modulo results are 1, 2, 3, 4, 5, and 6. Since there are no at least two identical modulo results, the insertion identifier is determined directly based on the modulo results as 1, 2, 3, 4, 5, and 6.

[0078] In some embodiments, see Figure 10 , Figure 10 This is a flowchart illustrating the process of determining an insertion identifier for a data block used to indicate the insertion of obfuscated data, provided in an embodiment of this application. Figure 3 After step 103, the following can also be executed: Step 301: The server obtains the pre-defined insertion rules, which are used to indicate the insertion position of obfuscated data in the data block sequence.

[0079] In actual implementation, the server first obtains the pre-set insertion rules. These insertion rules are used to indicate the insertion position of the obfuscated data in the data block sequence. For example, the insertion rule may be that the obfuscated data needs to be inserted into the data block with an odd number in the data block sequence, or it may be that the obfuscated data needs to be inserted into the data block with an even number in the data block sequence.

[0080] Step 302: Based on the insertion rules, determine the insertion identifier, which is used to indicate the data block into which the obfuscated data is inserted.

[0081] In actual implementation, after obtaining the pre-set insertion rules, the insertion identifier is determined based on the insertion rules. Continuing with the example above, when the insertion rule is that obfuscated data needs to be inserted into data blocks with odd numbers in the data block sequence, assuming there are 6 data blocks, the corresponding data block numbers are 1, 2, 3, 4, 5, and 6. Based on the insertion rules, it is determined that the obfuscated data needs to be inserted into data blocks with odd numbers in the data block sequence, i.e., the insertion identifiers are 1, 3, and 5. When the insertion rule is that obfuscated data needs to be inserted into data blocks with even numbers in the data block sequence, assuming there are 6 data blocks, the corresponding data block numbers are 1, 2, 3, 4, 5, and 6. Based on the insertion rules, it is determined that the obfuscated data needs to be inserted into data blocks with even numbers in the data block sequence, i.e., the insertion identifiers are 2, 4, and 6.

[0082] Step 104: Insert the obfuscated data into the corresponding data block in the original data to obtain the target data corresponding to the original data, and return the target data to the terminal corresponding to the development object.

[0083] In actual implementation, the process of inserting obfuscated data into the corresponding data block of the original data to obtain the target data of the corresponding original data specifically includes: after determining the insertion identifier, inserting obfuscated data into the corresponding data block based on the insertion identifier to obtain the target data of the corresponding original data.

[0084] In some embodiments, only one insertion identifier can be determined for each row of data. Based on the insertion identifier, the obfuscated data is inserted into the corresponding data block to obtain the target data corresponding to the original data. Here, the insertion identifier determined for each row of data can be different. For example, see [link to example]. Figure 11 , Figure 11 This is a schematic diagram illustrating the target data obtained from the corresponding original data provided in the embodiments of this application, based on... Figure 11 Here, the insertion identifier for the first row of data is 1, the insertion identifier for the second row of data is 2, the insertion identifier for the third row of data is 3, and the insertion identifier for the fourth row of data is 4. After determining the insertion identifier, based on the insertion identifier, the obfuscated data MN1 corresponding to the first row of data is inserted into the corresponding data block, i.e., the first data block of the first row; the obfuscated data MN2 corresponding to the second row of data is inserted into the corresponding data block, i.e., the second data block of the second row; the obfuscated data MN3 corresponding to the third row of data is inserted into the corresponding data block, i.e., the third data block of the third row; and the obfuscated data MN4 corresponding to the fourth row of data is inserted into the corresponding data block, i.e., the fourth data block of the fourth row. In this way, the target data corresponding to the original data is obtained.

[0085] In other embodiments, multiple insertion identifiers can be determined for each row of data. Based on these insertion identifiers, obfuscated data is inserted into the corresponding data block to obtain the target data corresponding to the original data. For example, see [link to relevant documentation]. Figure 12 , Figure 12 This is a schematic diagram illustrating the target data obtained from the corresponding original data provided in the embodiments of this application, based on... Figure 12 The insertion identifiers obtained here for each row of data are 1, 2, 3, and 4. Based on the insertion identifiers, the obfuscated data MN1 corresponding to the first row of data is inserted into the corresponding data block, that is, each data block of the first row. The obfuscated data MN2 corresponding to the second row of data is inserted into the corresponding data block, that is, each data block of the second row. The obfuscated data MN3 corresponding to the third row of data is inserted into the corresponding data block, that is, each data block of the third row. The obfuscated data MN4 corresponding to the fourth row of data is inserted into the corresponding data block, that is, each data block of the fourth row. In this way, the target data corresponding to the original data is obtained.

[0086] It should be noted that the insertion identifier also carries insertion position information indicating the insertion location of the obfuscated data in the data block. This insertion position information can be preset by the developer to obtain the target data corresponding to the original data. Specifically, after determining the insertion identifier, the obfuscated data is inserted into the corresponding position of the corresponding data block based on the insertion identifier, thereby obtaining the target data corresponding to the original data. For example, the developer can preset the position where the obfuscated data needs to be inserted into the last position of the data block. Based on this, after obtaining the insertion identifier, the obfuscated data is inserted into the last position of the corresponding data block based on the insertion identifier, thereby obtaining the target data corresponding to the original data. Here, the developer can also insert the insertion position information at the beginning of the data block; this embodiment of the application does not limit this.

[0087] In actual implementation, after obtaining the target data corresponding to the original data, the target data is returned to the terminal corresponding to the development object, so that the development object can carry out corresponding data development based on the received target data.

[0088] In some embodiments, see Figure 13 , Figure 13 This is a flowchart illustrating the target data presentation process provided in the embodiments of this application, based on Figure 3 After step 104, the following can also be executed: Step 401: The server determines the viewing permission level corresponding to the development object based on the association information of the development object.

[0089] In practice, the viewing permission level of a development object is determined based on the acquired association information. For example, the process of determining the viewing permission level based on the development object's identity information could be as follows: if the development object is a leader, the viewing permission level is determined to be high; if the development object is an outsourced employee, the viewing permission level is determined to be low. Alternatively, the process of determining the viewing permission level based on the generation time of the data acquisition request could be as follows: if the data acquisition request is generated in the early morning, the viewing permission level is determined to be low; if the data acquisition request is generated during working hours, the viewing permission level is determined to be high. Or, the process of determining the viewing permission level based on the development object's permission level could be as follows: if the development object's permission level is high, the viewing permission level is determined to be high; if the development object's permission level is low, the viewing permission level is determined to be low.

[0090] It should be noted that when there are multiple related information, if the viewing permission level of the development object is low for one type of related information, but the viewing permission level of the development object is high for other related information, then the viewing permission level of the development object itself will still be low.

[0091] Step 402: Based on the viewing permission level, the target data is presented on the terminal in the target display format, where different viewing permission levels correspond to different display formats of the target data.

[0092] In actual implementation, after determining the viewing permission level of the development object, the target data is presented on the terminal in the target display format based on the viewing permission level. Here, the different display formats of the target data corresponding to different viewing permission levels mean that the display content of the target data is different for different viewing permission levels. That is, the target data is obfuscated and output accordingly based on different viewing permission levels.

[0093] As an example, when the viewing permission level of the object being developed is low, the obfuscated target data is presented directly. See [link / reference]. Figure 14 , Figure 14 This is a schematic diagram illustrating the display of report data provided in an embodiment of this application, based on Figure 14 Since the viewing permission level corresponding to the development object is low, the data in the "Statistical Indicators" and "3-Day User Count" columns is obfuscated and encrypted, so the development object cannot be viewed.

[0094] As an example, when the viewing permission level corresponding to the developed object is high, the original data corresponding to the target data is retrieved, and then the original data is displayed. See [link to relevant documentation]. Figure 15 , Figure 15 This is a schematic diagram illustrating the display of report data provided in an embodiment of this application, based on Figure 15 The development object has a high level of viewing permission, which allows it to directly display the original data corresponding to the target data, so that the development object can view all the data.

[0095] In this way, by obfuscating the presented results, different developers will see different levels of obfuscation, which effectively ensures data security and reduces the risk of sensitive data leakage.

[0096] It should be noted that, in addition to the case of list results, the target data can also be presented as a graphical report. When the target data is presented as a graphical report, obfuscated data can be embedded by adding a watermark to display the obfuscated target data.

[0097] In some embodiments, after obtaining the target data, reverse calculation of data features can be performed based on the target data to determine the association information of the development object. Specifically, firstly, each target data block in the target data is obtained, where the target data block is a data block that has undergone obfuscation. Then, the insertion position information is obtained, and based on the insertion position information, the obfuscated data MN of each data block is determined. N Then, using a predefined string processing hash function, a digest for each data block is determined, which hashes the string content into a number, such as M. 1-1 =RSHash(data_1-1), where M 1-1 This is the hash of the first data block in the first row, i.e., the data block digest corresponding to the first data block in the first row; then, the target obfuscation factor TN is obtained through division, such as TN = MN1 / (M 1-1 1+M 1-2 2+M 1-3 3+……+M 1-N N), where the target confusion factor TN is the same for each row of data; after determining the target confusion factor, a corresponding inverse target transformation process is performed on the target confusion factor to obtain the confusion factor, see [link to documentation]. Figure 16 , Figure 16 This is a schematic diagram illustrating the inverse process of target conversion for the target confusion factor provided in the embodiments of this application, based on... Figure 16 The target obfuscation factor is decoded using ASCII codes to obtain the obfuscation factor; see finally. Figure 17 , Figure 17 This is a schematic diagram illustrating the decryption process of the obfuscation factor provided in an embodiment of this application, based on... Figure 17 It obtains the pre-set obfuscation factor key and the corresponding encryption method, and then determines the corresponding decryption method based on the encryption method. It then decrypts the obfuscation factor based on the obfuscation factor key to obtain the associated information corresponding to the development object.

[0098] In some embodiments, besides generating obfuscation factors based on the association information corresponding to the development object to obfuscate the corresponding data and obtain the corresponding target data, obfuscation factors can also be generated based on the association information of the original data itself to obfuscate the corresponding data and obtain the corresponding target data. Correspondingly, after generating obfuscation factors based on the association information of the original data itself to obfuscate the corresponding data and obtain the corresponding target data, data features can also be reverse-calculated based on the target data to determine the association information of the original data itself. Here, the association information of the original data itself may include the generation time, sensitivity, and identity information of the user corresponding to the data segment in the original data. Thus, when a data segment is leaked, the data block corresponding to the leaked data segment is first determined, then the insertion position information is obtained, and based on the insertion position information, the obfuscated data of the data block is determined. See [link to relevant documentation]. Figure 18 , Figure 18 This is a schematic diagram of a leaked data fragment provided in an embodiment of this application, based on Figure 18 The leaked data fragment here is data_2-2+MN2, and the insertion position information is the last position of the data block. Therefore, it can be determined that the obfuscated data of this data block is MN2. Then, by using the set string processing hash function, the digest M of this data block can be determined. 2-2 M 2-2 =RSHash(data_2-2); then obtain the target obfuscation factor TN through division, such as TN=MN2 / (M 2-1 1+M 2-2 2+M 2-3 3+……+M 2-N N); after determining the target obfuscation factor, the target obfuscation factor is subjected to the corresponding target transformation inverse process to obtain the obfuscation factor, thereby decrypting the obfuscation factor to obtain the associated information corresponding to the obfuscation factor, that is, the associated information of the leaked data segment.

[0099] In this way, when there is a leak in the obfuscation rules or obfuscation locations, the relevant information of the leaked content can be determined by reverse calculation through data features, and timely and effective adjustments can be made to the relevant information, thereby better enhancing data security.

[0100] It should be noted that in some embodiments, in addition to dividing each row of data into data blocks, the data segments can also be directly obfuscated. This avoids the situation where the number of data blocks or the number of original data rows is too large, resulting in excessive redundancy in the obfuscation operation, and improves the efficiency of the obfuscation process.

[0101] In some embodiments, the data acquisition request from the developer object for the original data may also be the original data corresponding to the function to be developed in the game application. For example, it could be the update of the map in the game scene or the update of the operation function items in the game display interface. After receiving the data acquisition request from the developer object for the original data, the associated information and original data of the developer object are obtained based on the data acquisition request. Based on the associated information, an obfuscation factor for the corresponding original data is generated, and the original data is divided into data blocks. Based on the data blocks obtained after the division and the obfuscation factor generated according to the associated information of the developer object, the obfuscated data for the corresponding data block is determined. The determined obfuscated data is then inserted into the corresponding data block to obtain the corresponding target data, so that the developer object can develop the corresponding function based on the obfuscated target data. It should be noted that during the process of the developer object developing the corresponding function based on the obfuscated target data, the server backend will perform reverse calculation of data features based on the target data to determine the original data before obfuscation, and then develop the corresponding function based on the deobfuscated original data. In this way, the development of the corresponding function to be developed in the target application is realized through the obfuscation process and the deobfuscation process, which improves the data security during the development process.

[0102] By applying the above embodiments of this application, data is divided into data blocks. Based on the data blocks obtained after the division and the obfuscation factor generated according to the association information of the development object, the obfuscated data of the corresponding data block is determined. The determined obfuscated data is then inserted into the corresponding data block to realize the obfuscation operation of the data. In this way, not only is the security level of the data effectively improved, but the data development process is also made more open and controllable.

[0103] The following will describe an exemplary application of the embodiments of this application in a real-world application scenario.

[0104] In related technologies, traditional report data development typically involves two approaches. One approach is to develop logical algorithms using SQL on the production log server. (See [link to relevant documentation]). Figure 19 , Figure 19 This is an optional schematic diagram provided in this application embodiment for development on a production log server, based on... Figure 19The first approach directly connects to the production log server, allowing developers to perform development and debugging on the production server's interface using the code input panel. While this provides reliable data, it suffers from low performance and high data security risks. The second approach involves fetching partial data from the production log server to the development log server and then performing development and debugging there. This offers high performance, but the data is incomplete and still presents data security risks. (See [link to relevant documentation]). Figure 20 , Figure 20 This is an optional schematic diagram of development on a development log server provided in an embodiment of this application, based on... Figure 20 The developer uses the "Re-fetch" control in the interface to fetch 10 data entries from the production log server, then sends these 10 entries to the development log server, where development and debugging are performed based on this fetched data. Based on this, this application provides a data processing method that creates an independent obfuscated database on top of the production development database. This obfuscated database has independent permissions and is not coupled to the production development database. The data source for the obfuscated database is the data fetch operation of the data processing system; see [link to relevant documentation]. Figure 21 , Figure 21 This is a schematic diagram of the data retrieval operation of the data processing system provided in this application embodiment, based on Figure 21 The developer uses the "Please select sensitive tags" control in the interface to determine the sensitive tags, which correspond to the sensitive data. This allows for the filtering of sensitive fields and the obfuscation of sensitive data during the data retrieval process. The data is then written to the obfuscated database through an interface, enabling the developer to develop based on the obfuscated database. Thus, through the embodiments provided in this application, effective system support is provided for the deployment isolation of the development environment, the maintenance and management of keys, and the maintenance of personnel permission levels. Not only are key fields and key information in sensitive data obfuscated during the development stage, but the amount of data extracted is also limited, thereby protecting sensitive data at the source of development. This effectively improves the level of data security and makes the data development process more open and controllable.

[0105] The data processing method provided in this application mainly includes four main processes: confusion factor generation, data confusion, confusion data display, and the reverse process of data confusion.

[0106] The process of generating the obfuscation factor in the above embodiments of this application specifically involves first obtaining the developer account, the time of occurrence, the developer's permission level, a predefined private key (i.e., the obfuscation factor key), and a corresponding one-way compression function (such as the symmetric encryption function AES). Then, the obfuscation factor is generated by using the one-way compression function to extract the strings "developer account," "time of occurrence," and "developer's permission level." It should be noted that the private key is stored internally and not publicly disclosed, and the obfuscation factor is reversible, meaning it can be decrypted using the private key.

[0107] The data obfuscation process in the above embodiments of this application is specifically as follows: First, the generated obfuscation factor is encoded using ASCII to obtain the corresponding ASCII code, TN = ASCII(factor). Simultaneously, for each row of data to be obfuscated, each row is divided into N data blocks according to a pre-set value N (data block number). Then, a string processing hash function RSHash is defined to hash the string content corresponding to each data block into a number. For example, assuming a report has n fields, Col1, Col2, Col3, ..., Coln, and the data blocks corresponding to the row are data_1-1, data_1-2, data_1-3, data_1-4, ..., data_1-n, where data_1-1 is the first data block of the first row, data_1-2 is the second data block of the first row, and so on. Then, a string processing hash function RSHash is defined to hash each data block, hashing the string content into a number, such as M. 1-1 =RSHash(data_1-1), where M 1-1 This is the hashed number of the first data block in the first row. Then, the hash value corresponding to the data block and the pre-set value N are multiplied to obtain the obfuscated sub-data for each data block. For example, for the first data block in the first row, the obfuscated sub-data MN is... 1-1 For TN M 1-1 1; For the Nth data block in the first row, the corresponding obfuscated sub-data MN 1-N For TN M 1-N N. Next, the obfuscated sub-data corresponding to each data block is summed to obtain the obfuscated data for that data block, such as the obfuscated sub-data MN corresponding to each data block. 1-1 MN 1-2 ... MN 1-NThen, the obfuscated sub-data corresponding to each data block are summed to obtain the obfuscated data MN1 of the corresponding data block, i.e., MN1 = MN 1-1 +MN 1-2 +……+MN 1-N It should be noted that the obfuscated data is the same for all data blocks within the same row, but the obfuscated data is different for data blocks in different rows. That is, the obfuscated data of the first data block in row 1 is MN1, the obfuscated data of the Nth data block in row 1 is also MN1, while the obfuscated data of all data blocks in row 2 is MN2, the obfuscated data of all data blocks in row 3 is MN3, and the obfuscated data of all data blocks in row 4 is MN2. 4, The scrambled data for each data block in the Nth row is MN. N .

[0108] In practice, after determining the obfuscated data corresponding to each data block, the data blocks that need to be obfuscated are also identified. This process specifically includes determining the remainder code (i.e., insertion identifier) ​​used to indicate the insertion of obfuscated data into the data block. This remainder code corresponds to a pre-set value N. Specifically, the obfuscated data and the pre-set value N for each data block are moduloed to obtain the modulo result for each data block. For example, here the obfuscated data is MN. N If the data block number is N, then the modulo result for each data block is Pos = MN. N mod(N), and then based on the modulo result, determine the remainder code of the data block used to indicate the insertion of the obfuscated data. Then, based on the remainder code, insert the obfuscated data into the corresponding data block to obtain the corresponding target data.

[0109] The process of obfuscating data display in the above embodiments of this application specifically involves obfuscating the retrieved data and then presenting the resulting target data as formal report data. This ensures that different users see slightly different results, with lower-privilege users receiving results that include traces of obfuscated information. Here, the presentation of formal report data can be in the form of list results or graphical reports. When the target data is presented as a list, obfuscated data can be embedded using asterisks to display the obfuscated target data. When the target data is presented as a graphical report, obfuscated data can be embedded using watermarks to display the obfuscated target data. In this way, by obfuscating the presented results, different developers see different levels of obfuscation, effectively ensuring data security and reducing the risk of sensitive data leakage.

[0110] The reverse process of data obfuscation in the above embodiments of this application is as follows: after displaying the obfuscated data (i.e., obtaining the obfuscated data table), when a data segment is leaked, the data block corresponding to the leaked data segment is first determined, then the insertion position information is obtained, and based on the insertion position information, the obfuscated data of that data block is determined. (See [link to relevant documentation]). Figure 18 The leaked data fragment here is data_2-2+MN2, and the insertion position information is the last position of the data block. Therefore, it can be determined that the obfuscated data of this data block is MN2. Then, by using the set string processing hash function, the digest M of this data block can be determined. 2-2 M 2-2 =RSHash(data_2-2); then obtain the target obfuscation factor TN through division, such as TN=MN2 / (M 2-1 1+M 2-2 2+M 2-3 3+……+M 2-N (N) After determining the target obfuscation factor, a corresponding target transformation inverse process is performed on the target obfuscation factor to obtain the obfuscation factor itself. This obfuscation factor is then decrypted to obtain the associated information corresponding to it, i.e., the associated information of the leaked data fragment, such as the user account, time, and permission level of the data fragment. Thus, when obfuscation rules or obfuscation locations are leaked, relevant information about the leaked content can be determined through reverse calculation using data features. This allows for timely and effective adjustments to the relevant information, thereby enhancing data security.

[0111] It should be noted that in some embodiments, in addition to dividing each row of data into data blocks, the data segments can also be directly obfuscated. This avoids the situation where the number of data blocks or the number of original data rows is too large, resulting in excessive redundancy in the obfuscation operation, and improves the efficiency of the obfuscation process.

[0112] By applying the above embodiments of this application, data is divided into data blocks. Based on the data blocks obtained after the division and the obfuscation factor generated according to the association information of the development object, the obfuscated data of the corresponding data block is determined. The determined obfuscated data is then inserted into the corresponding data block to realize the obfuscation operation of the data. In this way, not only is the security level of the data effectively improved, but the data development process is also made more open and controllable.

[0113] The following description continues to illustrate the exemplary structure of the data processing apparatus 455 provided in the embodiments of this application as a software module. In some embodiments, such as Figure 2 As shown, the software modules stored in the data processing device 455 of the memory 450 may include: The acquisition module 4551 is used to respond to a data acquisition request from a development object for raw data, and acquire the associated information of the development object and the raw data. The first generation module 4552 is used to generate a confusion factor corresponding to the original data based on the association information, and to divide the original data into data blocks to obtain at least two data blocks; The second generation module 4553 is used to generate obfuscated data corresponding to at least one of the at least two data blocks based on the obfuscation factor; The obfuscation module 4554 is used to insert the obfuscated data into the corresponding data block of the original data to obtain the target data corresponding to the original data, and return the target data to the terminal corresponding to the development object.

[0114] In some embodiments, the acquisition module 4551 is further configured to parse the data acquisition request to obtain the association information of the development object carried by the data acquisition request, wherein the association information includes at least one of the identity information of the development object, the generation time of the data acquisition request, and the permission level corresponding to the development object; or, to obtain the object identifier corresponding to the development object, and to perform association information indexing based on the object identifier to obtain the association information of the development object.

[0115] In some embodiments, the first generation module 4552 is further configured to obtain a confusion factor key and a corresponding encryption method; based on the confusion factor key, the associated information is encrypted using the encryption method to generate a confusion factor corresponding to the original data.

[0116] In some embodiments, the first generation module 4552 is further configured to perform the following operations for each row of data in the original data when the original data includes at least one row of data: obtain the number of data blocks corresponding to the row of data; wherein the number of data blocks is not less than two; and divide the row of data into a corresponding number of data blocks based on the number of data blocks to obtain at least two data blocks.

[0117] In some embodiments, the at least two data blocks constitute a data block sequence, and the second generation module 4553 is further configured to obtain the data block number corresponding to each data block in the data block sequence; and generate obfuscated data corresponding to the data block based on the obfuscation factor and the data block number.

[0118] In some embodiments, the second generation module 4553 is further configured to obtain a data block digest corresponding to each data block; for each data block, perform a product operation on the confusion factor, the data block digest, and the data block number to obtain the confusion sub-data corresponding to each data block; and perform a sum operation on the confusion sub-data corresponding to each data block to obtain the confusion data corresponding to the data block.

[0119] In some embodiments, the apparatus further includes an insertion module, which is configured to perform target data processing on the obfuscated data and the data block numbers of each data block to obtain target processing results corresponding to each data block; perform modulo processing on the target processing results for each data block to obtain modulo results corresponding to each data block; determine an insertion identifier based on the modulo results corresponding to each data block, the insertion identifier being used to indicate the data block into which the obfuscated data is inserted; the obfuscation module 4554 is further configured to insert the obfuscated data into the corresponding data block based on the insertion identifier to obtain target data corresponding to the original data.

[0120] In some embodiments, the insertion module is further configured to, when there are at least two identical modulo results in the modulo results corresponding to each of the data blocks, filter out duplicate modulo results and take the remaining modulo results as target modulo results; and determine the insertion identifier based on the target modulo results.

[0121] In some embodiments, the insertion module is further configured to obtain a pre-defined insertion rule, the insertion rule being used to indicate the insertion position of the obfuscated data in the data block sequence; based on the insertion rule, determine an insertion identifier, the insertion identifier being used to indicate the data block into which the obfuscated data is inserted; the obfuscation module 4554 is further configured to insert the obfuscated data into the corresponding data block based on the insertion identifier, thereby obtaining target data corresponding to the original data.

[0122] In some embodiments, the device further includes a presentation module, which is configured to determine the viewing permission level corresponding to the development object based on the association information of the development object; and to present the target data on the terminal in a target display format based on the viewing permission level; wherein different viewing permission levels correspond to different display formats of the target data.

[0123] This application provides a computer program product or computer program that includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the data processing method described in this application.

[0124] This application provides a computer-readable storage medium storing executable instructions. When these executable instructions are executed by a processor, they cause the processor to execute a data processing method provided in this application. For example, ... Figure 3 The data processing method is shown.

[0125] In some embodiments, the computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, flash memory, magnetic surface memory, optical disk, or CD-ROM; or it may be a variety of devices including one or any combination of the above-mentioned memories.

[0126] In some embodiments, executable instructions may take the form of a program, software, software module, script, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.

[0127] As an example, executable instructions may, but do not necessarily, correspond to files in a file system. They may be stored as part of a file that holds other programs or data, for example, in one or more scripts in a Hyper Text Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple collaborating files (e.g., a file that stores one or more modules, subroutines, or code sections).

[0128] As an example, executable instructions can be deployed to execute on a single computing device, or on multiple computing devices located in one location, or on multiple computing devices distributed across multiple locations and interconnected via a communication network.

[0129] In summary, the embodiments of this application have the following beneficial effects: (1) By dividing the data into data blocks, based on the data blocks obtained after the division and the obfuscation factor generated according to the association information of the development object, the obfuscated data of the corresponding data block is determined, and the determined obfuscated data is inserted into the corresponding data block to realize the obfuscation operation of the data. In this way, not only is the security level of the data effectively improved, but the data development process is also more open and controllable.

[0130] (2) By obfuscating the presented results, different development objects see different levels of obfuscation, which effectively ensures data security and reduces the risk of sensitive data leakage.

[0131] (3) When there is a leak in the obfuscation rules or obfuscation location, the relevant information of the leaked content is determined by reverse calculation through data features, so as to make timely and effective adjustments to the relevant information, thereby better enhancing the security of the data.

[0132] (4) By directly obfuscating the data fragments, the obfuscation operation is not too redundant due to the large number of data blocks or original data rows, thus improving the efficiency of the obfuscation process.

[0133] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, and improvements made within the spirit and scope of this application are included within the scope of protection of this application.

Claims

1. A data processing method, characterized in that, The method includes: In response to a data acquisition request from a development object for raw data, obtain the associated information of the development object and the raw data; Based on the confusion factor key, the associated information is encrypted using an encryption method to generate a confusion factor corresponding to the original data. When the original data includes at least one row of data, for each row of data in the original data, the following operations are performed: obtain the number of data blocks corresponding to the row of data; wherein, the number of data blocks is not less than two. Based on the number of data blocks, the row data is divided into a corresponding number of data blocks to obtain at least two data blocks; the at least two data blocks constitute a data block sequence. Obtain the data block number corresponding to each data block in the data block sequence; obtain the data block digest corresponding to each data block; for each data block, perform product processing on the confusion factor, the data block digest, and the data block number to obtain the confusion sub-data corresponding to each data block; perform sum processing on the confusion sub-data corresponding to each data block in the row data to obtain the same confusion data corresponding to each data block in the row data; The obfuscated data is divided by the data block number of each data block to obtain the operation result for each data block; for each data block, the operation result is moduloed to obtain the modulo result for each data block. When there are at least two identical modulo results in the modulo results corresponding to each of the data blocks, the duplicate modulo results are filtered out, and the remaining modulo results are taken as the target modulo result; Based on the target modulo result, an insertion identifier is determined, which is used to indicate the data block into which the obfuscated data is inserted; based on the insertion identifier, the obfuscated data is inserted into the corresponding data block to obtain the target data corresponding to the original data, and the target data is returned to the terminal corresponding to the development object.

2. The method as described in claim 1, characterized in that, The step of obtaining the association information of the development object includes: Parse the data acquisition request to obtain the association information of the development object carried in the data acquisition request. The association information includes at least one of the following: the identity information of the development object, the generation time of the data acquisition request, and the permission level corresponding to the development object. Alternatively, obtain the object identifier corresponding to the development object, and perform an association information index based on the object identifier to obtain the association information of the development object.

3. The method as described in claim 1, characterized in that, After summing the obfuscated sub-data corresponding to each data block in the row data to obtain obfuscated data identical to each data block in the row data, the method further includes: Obtain a pre-defined insertion rule, which indicates the insertion position of the obfuscated data in the data block sequence; Based on the insertion rules, the insertion identifier is determined.

4. The method as described in claim 1, characterized in that, After returning the target data to the terminal corresponding to the development object, the method further includes: Based on the association information of the development object, determine the viewing permission level corresponding to the development object; Based on the viewing permission level, the target data will be presented on the terminal in a target display format; Different viewing permission levels correspond to different display formats of the target data.

5. A data processing apparatus, characterized in that, The device includes: The acquisition module is used to respond to a data acquisition request from a development object for raw data, and to acquire the associated information of the development object and the raw data. The first generation module is used to encrypt the associated information using an encryption method based on the confusion factor key, generate a confusion factor corresponding to the original data, and when the original data includes at least one row of data, perform the following operations for each row of data in the original data: obtain the number of data blocks corresponding to the row of data; wherein the number of data blocks is not less than two; divide the row of data into a corresponding number of data blocks based on the number of data blocks to obtain at least two data blocks; the at least two data blocks constitute a data block sequence; The second generation module is used to obtain the data block number corresponding to each data block in the data block sequence; obtain the data block digest corresponding to each data block; for each data block, perform product processing on the confusion factor, the data block digest and the data block number to obtain the confusion sub-data corresponding to each data block; and perform sum processing on the confusion sub-data corresponding to each data block in the row data to obtain the same confusion data corresponding to each data block in the row data. An insertion module is used to perform a division operation on the obfuscated data and the data block number of each data block to obtain the operation result corresponding to each data block; for each data block, the operation result is subjected to modulo processing to obtain the modulo result corresponding to each data block; The insertion module is further configured to, when there are at least two identical modulo results in the modulo results corresponding to each of the data blocks, filter out the duplicate modulo results and use the remaining modulo results as the target modulo result; The insertion module is further configured to determine an insertion identifier based on the target modulo result, the insertion identifier being used to indicate the data block into which the obfuscated data is inserted; The obfuscation module is used to insert the obfuscated data into the corresponding data block based on the insertion identifier, obtain the target data corresponding to the original data, and return the target data to the terminal corresponding to the development object.

6. The apparatus according to claim 5, characterized in that, The acquisition module is further configured to parse the data acquisition request to obtain the association information of the development object carried by the data acquisition request. The association information includes at least one of the following: the identity information of the development object, the generation time of the data acquisition request, and the permission level corresponding to the development object. Alternatively, obtain the object identifier corresponding to the development object, and perform an association information index based on the object identifier to obtain the association information of the development object.

7. The apparatus according to claim 5, characterized in that, The insertion module is further configured to perform summation processing on the obfuscated sub-data corresponding to each data block in the row data to obtain obfuscated data that is the same for each data block in the row data, and then obtain a pre-set insertion rule, which is used to indicate the insertion position of the obfuscated data in the data block sequence; and determine an insertion identifier based on the insertion rule.

8. The apparatus according to claim 5, characterized in that, The device further includes: The presentation module is used to, after returning the target data to the terminal corresponding to the development object, determine the viewing permission level corresponding to the development object based on the association information of the development object; and present the target data on the terminal in a target display format based on the viewing permission level. Different viewing permission levels correspond to different display formats of the target data.

9. An electronic device, characterized in that, include: Memory, used to store executable instructions; A processor, when executing executable instructions stored in the memory, implements the data processing method according to any one of claims 1 to 4.

10. A computer-readable storage medium, characterized in that, It stores executable instructions for causing a processor to execute, thereby implementing the data processing method according to any one of claims 1 to 4.

11. A computer program product, comprising a computer program or instructions, characterized in that, When the computer program or instructions are executed by a processor, they implement the data processing method according to any one of claims 1 to 4.

Images