A dynamic data desensitization method and system based on Oracle

Abstract

The present invention proposes a dynamic data desensitization system based on Oracle, which includes the following modules: (1) a desensitization scheme management module, which is used to configure the system user level and the sensitive data level; (3) a data desensitization module, which determines the desensitization rules of different system users for data according to the configured desensitization scheme, and uses JVM-SandBox to monitor the JDBC request submitted by the user. If there are defined sensitive fields, the sensitive fields are desensitized using the corresponding rules; (4) a log management module, which monitors the Select statement in JDBC, and if there are defined sensitive fields, the sensitive fields and result set information in the Select are recorded in the system log. After adopting the present invention, it is not necessary to modify the application structure of the existing program, and dynamic desensitization can be performed directly on the basis of the existing program. The present invention is not only applicable to Oracle databases, but other types of databases can also be designed accordingly according to the same method.

Description

Technical Field

[0001] The present invention relates to a dynamic data desensitization method and system, and in particular to an Oracle-based dynamic data desensitization method and system, and belongs to the field of database data security. Background Art

[0002] The storage and application of large-scale data has become the norm in all industries in today's society. Data storage is only one aspect. The ultimate goal of storing data is to use it effectively. The huge scale of data increases the difficulty of data organization, management and utilization. When using this data, users should not be overwhelmed by massive data, nor should sensitive data be provided to irrelevant users. Therefore, high requirements are placed on data access control. In the data application system, different data views are provided for different user levels to ensure data security and effectively protect user privacy data.

[0003] Traditionally, formulating reasonable access control strategies can achieve hierarchical access control of data. In this type of method, system users are divided into different levels; correspondingly, data is also divided into multiple levels. A mapping relationship is established between user level and data level to restrict the access of low-level users to high-level data. This implementation method is simple and effective, and can achieve access control to a certain extent, but the granularity of data processing is coarse. Access to data is either authorized or unauthorized, and there is no intermediate state selection. In fact, as users' demand for data access continues to increase, the granularity of access control is becoming finer and finer. For example, the address information of a user is stored in the database. According to the traditional access control method, users in the system either have the authority to see the complete address or have no authority to access any information about the address. In actual application environments, users prefer to see address information with different access control effects. For example, authorized users can see the complete address, and unauthorized users also want to see an approximate address, or a false address, rather than empty information.

[0004] Desensitization refers to the process of transforming sensitive information into data using desensitization rules to achieve reliable protection of sensitive privacy data. Common sensitive information includes the following categories: (1) Name: mainly includes name, and other names such as company name; (2) Address: mainly includes home address, and other addresses such as company address; (3) Contact information: mainly includes phone number, and other contact information such as email address; (4) ID number: mainly includes ID number, and other ID numbers such as work ID number; (5) Other information: such as bank card number, date of birth, etc.

[0005] During the desensitization process, on the one hand, it is necessary to ensure that the desensitized data can retain the meaning before desensitization. The desensitized data should have the same format but different content as before desensitization and cannot be unrealistic. On the other hand, it is necessary to ensure the security of the data and minimize the reverse cracking of the desensitized data.

[0006] Data desensitization is divided into static data desensitization and dynamic data desensitization. The former is mainly to isolate the production environment and the test environment. When moving data from the production environment to the test environment, in order to ensure data security, the data needs to be persisted; the latter mainly occurs when sensitive data in the system is accessed, and different data is returned according to different desensitization rules based on different user levels.

[0007] In traditional desensitization methods, data security is highly valued. Sensitive information such as addresses and contact information undergo complex desensitization processing, but the correlation between data is easily overlooked. In fact, in some desensitization methods such as replacement, simply replacing information such as addresses with other addresses ensures data security, but the rationality of the data is affected. Therefore, in data such as addresses and contact information that have similar geographical correlations, the correlation between data should be considered as the focus, so as to ensure that the rationality of the data is higher. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 It is a composition structure diagram of the present invention.

[0009] Figure 2 It is a multi-tree tree structure diagram. Summary of the invention

[0010] In order to solve the above technical problems, the present invention proposes a dynamic data desensitization system based on Oracle, which includes the following modules:

[0011] (1) Desensitization solution management module, which is used to configure system user levels and sensitive data levels; system users are divided into three levels: administrator, ordinary user and visitor; sensitive data are divided into three levels: original data, masked data and replaced data;

[0012] (2) Desensitization algorithm module, which defines the desensitization rules for different types of sensitive data.

[0013] (3) Data desensitization module: This module determines the desensitization rules for data of different system users based on the configured desensitization scheme, and uses JVM-SandBox to monitor the JDBC requests submitted by users. If there are defined sensitive fields in them, the corresponding rules are used to desensitize the sensitive fields.

[0014] (4) Log management module, which monitors the Select statement in JDBC. If there are defined sensitive fields in the statement, the sensitive fields and result set information in the Select statement will be recorded in the system log.

[0015] Furthermore, in the desensitization algorithm module, the original data does not need to be desensitized and is directly provided to the administrator; for the masked data, the following masking rules are formulated respectively:

[0016] ① For user names, the first letter of the name is retained during the masking process, and each letter after the first letter is replaced by an "*" symbol. In the Oracle database, the REGEXP_REPLACE function is used to mask the name;

[0017] ② For address information, the first three characters of the address are retained during the masking process, and each subsequent character is replaced by a "*" symbol. In the Oracle database, the REGEXP_REPLACE function is used to mask the address information.

[0018] ③Contact information includes phone number and email address. For phone number information, the 4th to 7th digits of the phone number are replaced with the "****" symbol during the masking process. In the Oracle database, the REPLACE function is used to mask the phone number information. For email address information, the characters before the "@" symbol in the email address are replaced with the "******" symbol during the masking process. In the Oracle database, the REGEXP_REPLACE function is used to mask the email address information.

[0019] ④ The certificate number includes the ID card number and the work card number. For the ID card number information, the first 6 digits of the ID card number are retained during the masking process, and the 7th and subsequent digits are replaced by a "*" symbol. In the Oracle database, the REGEXP_REPLACE function is used to mask the ID card number information; for the work card number information, the first 1 / 3 of the digits of the work card number are retained during the masking process, and the last 2 / 3 of the digits are replaced by a "*" symbol. When the length of the work card number cannot be divided by 3, the quotient is rounded, and the number of digits in front of the work card number is retained according to the rounded number. In the Oracle database, the REGEXP_REPLACE function is used to mask the work card number information.

[0020] ⑤ Other information includes bank card number, date of birth, etc., and the same processing method as work ID number is used during the masking process.

[0021] For replacing data, a multi-Trie tree method is used. The steps of data replacement based on the multi-Trie tree method are as follows:

[0022] a) A basic Trie tree A is established based on official administrative division information. The first layer of tree A is the root node; the second layer is the provincial address, including provinces, autonomous regions, municipalities directly under the central government, and special administrative regions; the third layer is the city address, including autonomous prefectures, cities, and districts and counties of municipalities directly under the central government; the fourth layer is the county address, including counties and districts; the fifth layer is the township address, including townships, ethnic townships, towns, etc.; Trie tree A includes N nodes and M edges The nodes Contains the administrative division code of the node and the name of the node;

[0023] b) A basic Trie tree B is established based on the mobile phone number segment. The first layer of the tree B is the root node; the second layer to the eighth layer correspond to the first 7 digits of the mobile phone number respectively; the Trie tree B includes S nodes and T edge

[0024] c) According to the mobile phone number segment attribution database, traverse all leaf nodes of Trie tree B and establish a mapping relationship between each leaf node and the corresponding address node in Trie tree A. These address nodes in Trie tree A are mainly municipal addresses at the third level or municipalities and special administrative regions at the second level of provincial addresses;

[0025] d) Calculate the average number of mobile phone number segments associated with the home location, avg, Where M represents the number of places of origin, m Indicates the number of mobile phone number segments associated with the mth location.

[0026] Based on the multi-Trie tree method, the following replacement rules are formulated for sensitive information types:

[0027] ① For the user name, during the replacement process, a new name is randomly generated for display based on the established name database;

[0028] ② For the address information ADDINFO, first find the administrative region where ADDINFO is located in the Trie tree A, locate the third-level address corresponding to ADDINFO, that is, the city-level address, and count the number of mobile phone number segments Seg associated with the address; if it is a municipality or a special administrative region, locate the second-level address and count the number of mobile phone number segments Seg associated with the address; if Seg>avg, within the second-level provincial address range of the Trie tree A, randomly select an address containing five layers of information and return it to the user; if Seg>avg, within the entire range of the Trie tree A, randomly select an address containing five layers of information and return it to the user.

[0029] ③Contact information includes telephone number and email address, etc. For telephone number information, during the replacement process, a number segment is randomly selected based on the mobile phone number segment associated with the address returned to the user, and a mobile phone number is randomly generated and returned to the user; for email address information, during the replacement process, the characters before the "@" symbol in the email address are replaced with the randomly generated Chinese pinyin corresponding to the user's name, and the characters after the "@" symbol are randomly generated.

[0030] ④ The document number includes the ID card number and work ID card number, etc. For the ID card number information, it is generated based on the replaced address information during the replacement process. The address information in the Trie tree A contains the administrative division code, and the second, third and fourth layers in the Trie tree A correspond to the provincial address, municipal address and county address respectively. The first 6 digits of the ID card number are generated according to the three-layer administrative division code; 7 to 18 digits of the ID card number are randomly generated; for the work ID card number information, it is randomly generated.

[0031] ⑤Other information: Date of birth is consistent with the randomly generated date of birth in the above ID number, and other information is randomly generated.

[0032] Based on the above system, the present invention further proposes a dynamic data desensitization method based on Oracle, which includes the following steps:

[0033] (1) Desensitization solution management, which is used to configure system user levels and sensitive data levels; system users are divided into three levels: administrators, ordinary users, and visitors; sensitive data are divided into three levels: original data, masked data, and replaced data;

[0034] (2) Define desensitization rules for different types of sensitive data;

[0035] (3) Data desensitization: According to the configured desensitization scheme, the desensitization rules for data of different system users are determined. JVM-SandBox is used to monitor the JDBC requests submitted by users. If there are defined sensitive fields, the corresponding rules are used to desensitize the sensitive fields.

[0036] (4) Log management: monitor the Select statement in JDBC. If there are defined sensitive fields in it, the sensitive fields and result set information in the Select will be recorded in the system log.

[0037] Furthermore, when defining desensitization rules for different types of sensitive data, the original data does not need to be desensitized and is directly provided to the administrator; for masked data, the following masking rules are formulated respectively:

[0038] ① For user names, the first letter of the name is retained during the masking process, and each letter after the first letter is replaced by an "*" symbol. In the Oracle database, the REGEXP_REPLACE function is used to mask the name;

[0039] ② For address information, the first three characters of the address are retained during the masking process, and each subsequent character is replaced by a "*" symbol. In the Oracle database, the REGEXP_REPLACE function is used to mask the address information.

[0040] ③Contact information includes phone number and email address. For phone number information, the 4th to 7th digits of the phone number are replaced with the "****" symbol during the masking process. In the Oracle database, the REPLACE function is used to mask the phone number information. For email address information, the characters before the "@" symbol in the email address are replaced with the "******" symbol during the masking process. In the Oracle database, the REGEXP_REPLACE function is used to mask the email address information.

[0041] ④ The certificate number includes the ID card number and the work card number. For the ID card number information, the first 6 digits of the ID card number are retained during the masking process, and the 7th and subsequent digits are replaced by a "*" symbol. In the Oracle database, the REGEXP_REPLACE function is used to mask the ID card number information; for the work card number information, the first 1 / 3 of the digits of the work card number are retained during the masking process, and the last 2 / 3 of the digits are replaced by a "*" symbol. When the length of the work card number cannot be divided by 3, the quotient is rounded, and the number of digits in front of the work card number is retained according to the rounded number. In the Oracle database, the REGEXP_REPLACE function is used to mask the work card number information.

[0042] ⑤ Other information includes bank card number, date of birth, etc., and the same processing method as work ID number is used during the masking process.

[0043] For replacing data, a multi-Trie tree method is used. The steps of data replacement based on the multi-Trie tree method are as follows:

[0044] a) A basic Trie tree A is established based on official administrative division information. The first layer of tree A is the root node; the second layer is the provincial address, including provinces, autonomous regions, municipalities directly under the central government, and special administrative regions; the third layer is the city address, including autonomous prefectures, cities, and districts and counties of municipalities directly under the central government; the fourth layer is the county address, including counties and districts; the fifth layer is the township address, including townships, ethnic townships, towns, etc.; Trie tree A includes N nodes and M edges The nodes Contains the administrative division code of the node and the name of the node;

[0045] b) A basic Trie tree B is established based on the mobile phone number segment. The first layer of the tree B is the root node; the second layer to the eighth layer correspond to the first 7 digits of the mobile phone number respectively; the Trie tree B includes S nodes and T edge

[0046] c) According to the mobile phone number segment attribution database, traverse all leaf nodes of Trie tree B and establish a mapping relationship between each leaf node and the corresponding address node in Trie tree A. These address nodes in Trie tree A are mainly municipal addresses at the third level or municipalities and special administrative regions at the second level of provincial addresses;

[0047] d) Calculate the average number of mobile phone number segments associated with the home location, avg, Where M represents the number of places of origin, m Indicates the number of mobile phone number segments associated with the mth location.

[0048] Based on the multi-Trie tree method, the following replacement rules are formulated for sensitive information types:

[0049] ① For the user name, during the replacement process, a new name is randomly generated for display based on the established name database;

[0050] ② For the address information ADDINFO, first find the administrative region where ADDINFO is located in the Trie tree A, locate the third-level address corresponding to ADDINFO, that is, the city-level address, and count the number of mobile phone number segments Seg associated with the address; if it is a municipality or a special administrative region, locate the second-level address and count the number of mobile phone number segments Seg associated with the address; if Seg>avg, within the second-level provincial address range of the Trie tree A, randomly select an address containing five layers of information and return it to the user; if Seg>avg, within the entire range of the Trie tree A, randomly select an address containing five layers of information and return it to the user.

[0051] ③Contact information includes telephone number and email address, etc. For telephone number information, during the replacement process, a number segment is randomly selected based on the mobile phone number segment associated with the address returned to the user, and a mobile phone number is randomly generated and returned to the user; for email address information, during the replacement process, the characters before the "@" symbol in the email address are replaced with the randomly generated Chinese pinyin corresponding to the user's name, and the characters after the "@" symbol are randomly generated.

[0052] ④ The document number includes the ID card number and work ID card number, etc. For the ID card number information, it is generated based on the replaced address information during the replacement process. The address information in the Trie tree A contains the administrative division code, and the second, third and fourth layers in the Trie tree A correspond to the provincial address, municipal address and county address respectively. The first 6 digits of the ID card number are generated according to the three-layer administrative division code; 7 to 18 digits of the ID card number are randomly generated; for the work ID card number information, it is randomly generated.

[0053] ⑤Other information: Date of birth is consistent with the randomly generated date of birth in the above ID number, and other information is randomly generated.

[0054] After adopting the present invention, it is not necessary to modify the application structure of the existing program, and dynamic desensitization can be directly performed on the basis of the existing program. The present invention is not only applicable to Oracle databases, but other types of databases can also be designed accordingly according to the same method. DETAILED DESCRIPTION

[0055] The present invention designs a dynamic data desensitization system based on Oracle database. Figure 1 The system does not need to modify the application structure of the existing program, and can directly perform dynamic desensitization based on the existing program. Other types of databases can be designed accordingly in the same way. The system mainly includes the following modules:

[0056] (1) Desensitization solution management module: This module mainly completes two parts. The first part is the configuration of user levels, that is, setting different levels for different users in the system. According to actual business needs, system users can be divided into three levels: administrators, ordinary users and visitors:

[0057] 1) The administrator has the highest level and can see the complete original data in the system;

[0058] 2) Ordinary users have a lower level than administrators and can see some data with some content obscured;

[0059] 3) Visitors with the lowest level can only see the replaced data.

[0060] The second part is the configuration of sensitive data levels. According to actual business needs, when sensitive data is provided to users, it is divided into three levels by default: original data, masked data, and replaced data:

[0061] 1) Raw data means sensitive data that does not need to be desensitized and is directly provided to administrator users;

[0062] 2) Masked data means that part of the sensitive data is masked and provided to ordinary users of the system;

[0063] 3) Replacement data means that the content of sensitive data is replaced and provided to the guest users of the system.

[0064] There are two ways to configure sensitive data: manual configuration and automatic configuration. Manual configuration means that the administrator manually specifies which fields in which tables in the database are sensitive data; automatic configuration means that the program automatically identifies sensitive fields.

[0065] (2) Desensitization algorithm module: This module mainly defines the desensitization rules for different types of sensitive data. Because sensitive data includes three levels: original data, masked data, and replaced data, and the original data displayed to administrator users does not need to be desensitized, the following details the specific desensitization methods and rules for the masked data and replaced data levels.

[0066] 1) Masking data

[0067] For ordinary users, some sensitive information may affect data security if it is completely exposed without any processing, but on the other hand, it is not necessary to hide all the information. Therefore, it is an ideal method to mask part of the data and provide the masked data to the user. For common types of sensitive information, the masking rules are as follows:

[0068] ① Name: For user names, the first letter of the name is retained during the masking process, and each letter after the first letter is replaced by an "*" symbol. In the Oracle database, the REGEXP_REPLACE function is used to mask the name.

[0069] ② Address: For address information, the first three characters of the address are retained during the masking process, and each subsequent character is replaced with a "*" symbol. In Oracle database, the REGEXP_REPLACE function is used to mask address information.

[0070] ③Contact information: mainly includes phone number and email address. For phone number information, the 4th to 7th digits of the phone number are replaced with "****" during the masking process. In the Oracle database, the REPLACE function is used to mask the phone number information.

[0071] For email information, the characters before the "@" symbol in the email address are replaced with the "******" symbol during the masking process. In the Oracle database, the REGEXP_REPLACE function is used to mask the email information.

[0072] ④ Document number: mainly includes ID number and work ID number, etc. For ID number information, the first 6 digits of the ID number are retained during the masking process, and the 7th and subsequent digits are replaced by a "*" symbol. In the Oracle database, the REGEXP_REPLACE function is used to mask the ID number information.

[0073] For the work ID number information, considering that the length of the work ID number is not fixed, the first 1 / 3 of the digits of the work ID number will be retained during the masking process, and the last 2 / 3 of the digits will be replaced by a "*" symbol. When the length of the work ID number cannot be divided by 3, the quotient will be rounded down, and the number of digits in front of the work ID number will be retained according to the rounded number. In the Oracle database, the REGEXP_REPLACE function is used to mask the work ID number information.

[0074] ⑤Other information: such as bank card number, date of birth, etc. This type of information is masked in the same way as the work ID number, that is, the first 1 / 3 of the information is retained, and the last 2 / 3 of the information is replaced by a "*" symbol. When the length of the information cannot be divided by 3, the quotient is rounded down, and the number of characters in the front of the information is retained according to the rounded number.

[0075] 2) Replace data

[0076] For tourists, sensitive information must not be exposed, but if all sensitive information is covered with the "*" symbol, it will seriously affect the user experience. Therefore, replacing sensitive information and presenting it to users not only ensures data security, but also provides a better user experience.

[0077] In order to ensure that the data after replacement has a high degree of rationality on the surface, a multi-Trie tree algorithm was designed in this part of the implementation to ensure that the address, ID number, mobile phone number, etc. have a unified place of belonging, avoiding the situation where the address, ID number, and mobile phone number generated completely randomly are inconsistent in their place of belonging.

[0078] The Trie tree is also called a dictionary lookup tree. Its main features include: ① The root node does not contain any content, and other nodes only contain a single word; ② All words on the path from the root node to a certain node are connected to form the string corresponding to the node; ③ All child nodes of each node contain different strings.

[0079] The main steps of the data replacement process based on the multi-Trie tree algorithm are as follows:

[0080] a) Based on the official administrative division information, a basic Trie tree A is established. The first layer of tree A is the root node; the second layer is the provincial address, including provinces, autonomous regions, municipalities directly under the central government, and special administrative regions; the third layer is the city address, including autonomous prefectures, cities, and districts and counties of municipalities directly under the central government; the fourth layer is the county address, including counties and districts; the fifth layer is the township address, including townships, ethnic townships, towns, etc. After the Trie tree A is established, it includes N nodes and M edges

[0081] The nodes Contains the administrative division code of the node and the name of the node;

[0082] b) A basic Trie tree B is established based on the mobile phone number segment. The first layer of the tree B is the root node; the second layer to the eighth layer correspond to the first 7 digits of the mobile phone number respectively; after the Trie tree B is established, it includes S nodes and T edge

[0083] c) According to the mobile phone number segment attribution database, traverse all leaf nodes of Trie tree B and establish a mapping relationship between each leaf node and the corresponding address node in Trie tree A. These address nodes in Trie tree A are mainly third-level city addresses, and may also be municipalities and special administrative regions in the second-level provincial addresses;

[0084] d) Calculate the average number of mobile phone number segments associated with the place of origin, avg. The place of origin here refers to the third-level city address for provincial addresses in provinces and autonomous regions; for provincial addresses such as municipalities and special administrative regions, it refers to the second-level provincial address itself; when calculating avg, use the following calculation formula:

[0085]

[0086] Where M represents the number of places of origin, m Indicates the number of mobile phone number segments associated with the mth location;

[0087] Based on the multi-Trie tree algorithm, the replacement rules for common types of sensitive information are as follows:

[0088] ① Name: For the user name, during the replacement process, a new name is randomly generated for display based on the established name database;

[0089] ② Address: For the address information ADDINFO, first find the administrative region where ADDINFO is located in the Trie tree A, locate the third-level address corresponding to ADDINFO, that is, the city-level address, and count the number of mobile phone number segments Seg associated with the address; if it is a municipality or a special administrative region, locate the second-level address, and count the number of mobile phone number segments Seg associated with the address; if Seg>avg, it means that the address is associated with more mobile phone number segments, the address popularity is high, and a small disturbance to the address can achieve the desensitization effect. Therefore, in the process of address disturbance, within the second-level provincial address range of the Trie tree A, randomly select an address containing five layers of information and return it to the user; if Seg>avg, it means that the address is associated with fewer mobile phone number segments, the address popularity is low, and a large disturbance to the address can achieve the desensitization effect. Therefore, in the process of address disturbance, within the entire range of the Trie tree A, randomly select an address containing five layers of information and return it to the user.

[0090] ③Contact information: mainly includes phone number and email address, etc. For phone number information, during the replacement process, a number segment is randomly selected based on the mobile phone number segment associated with the address returned to the user, and a mobile phone number is randomly generated and returned to the user;

[0091] For email information, during the replacement process, the characters before the "@" symbol in the email address are replaced with the randomly generated Chinese pinyin of the user's name, and the characters after the "@" symbol are randomly generated.

[0092] ④ Document number: mainly includes ID card number and work card number, etc. For the ID card number information, it is generated based on the replaced address information during the replacement process, because the address information in Trie tree A contains the administrative division code, and the second, third and fourth layers in Trie tree A correspond to the provincial address, municipal address and county address respectively. The first 6 digits of the ID card number can be generated according to the administrative division codes of these three layers; the 7th to 14th digits of the ID card number represent the date of birth, which are generated randomly; the 15th to 18th digits of the ID card number are also generated randomly;

[0093] As for the work ID number information, considering that the length of the work ID number is not fixed, it is generated completely randomly during the replacement process.

[0094] ⑤Other information: such as bank card number, date of birth, etc. The date of birth must be consistent with the randomly generated date of birth in the above ID number, and other information can be randomly generated;

[0095] (3) Data desensitization module:

[0096] Determine the desensitization rules for different users based on the configured desensitization scheme. Use JVM-SandBox to monitor the JDBC requests submitted by users. If there are defined sensitive fields, use the corresponding rules to desensitize the sensitive fields.

[0097] (4) Log management module:

[0098] Monitor the Select statement in JDBC. If there are defined sensitive fields in it, the sensitive fields and result set information in the Select will be recorded in the system log.

[0099] The desensitization algorithm module is the core of the present invention. Specific embodiments of masking data and replacing data in the module are listed below.

[0100] 1) Masking data

[0101] ① Name: For user names, the first letter of the name is retained during the masking process, and each letter after the first letter is replaced by an "*" symbol. In the Oracle database, the REGEXP_REPLACE function is used to mask the name.

[0102] Assume that the original SQL statement for reading the name is:

[0103] SELECT NAME FROM STUDENT;

[0104] Here, STUDENT is the name of the database table, and NAME is the name field in the table.

[0105] After the masking operation, the SQL statement is modified to:

[0106] SELECT REGEXP_REPLACE(NAME,'(.)','*',2)AS NAME FROM STUDENT;

[0107] For example, the name "Zhang San" becomes "Zhang*" after masking;

[0108] ② Address: For address information, the first three characters of the address are retained during the masking process, and each subsequent character is replaced with a "*" symbol. In Oracle database, the REGEXP_REPLACE function is used to mask address information.

[0109] Assume that the original SQL statement for reading the address is:

[0110] SELECT ADD FROM STUDENT;

[0111] Among them, STUDENT is the name of the database table, and ADD is the address field in the table.

[0112] After the masking operation, the SQL statement is modified to:

[0113] SELECT REGEXP_REPLACE(ADD,'(.)','*',2)AS ADD FROM STUDENT;

[0114] For example, the address "Ruipu Building, Hongjunying South Road, Chaoyang District, Beijing" becomes "Beijing **************" after masking;

[0115] ③Contact information: mainly includes phone number and email address. For phone number information, the 4th to 7th digits of the phone number are replaced with "****" during the masking process. In the Oracle database, the REPLACE function is used to mask the phone number information.

[0116] Assume that the original SQL statement for reading the phone number is:

[0117] SELECT TEL FROM STUDENT;

[0118] STUDENT is the name of the database table, and TEL is the telephone number field in the table.

[0119] After the masking operation, the SQL statement is modified to:

[0120] SELECT REPLACE(TEL,SUBSTR(TEL,4,4),'****')AS TEL FROM STUDENT;

[0121] For example, the telephone number "01234567890" becomes "012****7890" after masking;

[0122] For email information, the characters before the "@" symbol in the email address are replaced with the "******" symbol during the masking process. In the Oracle database, the REGEXP_REPLACE function is used to mask the email information.

[0123] Assume that the original SQL statement for reading mailbox information is:

[0124] SELECT EMAIL FROM STUDENT;

[0125] Among them, STUDENT is the name of the database table, and EMAIL is the email information field in the table.

[0126] After the masking operation, the SQL statement is modified to:

[0127] SELECT REGEXP_REPLACE(EMAIL,'[a-zA-z0-9.]*@','******@',1)AS EMAILFROM STUDENT;

[0128] For example, the email address "zhangsan@test.com" becomes "******@test.com" after masking;

[0129] ④ Document number: mainly includes ID number and work ID number, etc. For ID number information, the first 6 digits of the ID number are retained during the masking process, and the 7th and subsequent digits are replaced by a "*" symbol. In the Oracle database, the REGEXP_REPLACE function is used to mask the ID number information.

[0130] Assume that the original SQL statement for reading the ID number is:

[0131] SELECT ID FROM STUDENT;

[0132] Here, STUDENT is the name of the database table, and ID is the ID number field in the table.

[0133] After the masking operation, the SQL statement is modified to:

[0134] SELECT REGEXP_REPLACE(ID,'(.)','*',7)AS ID FROM STUDENT;

[0135] For example: the ID number "123456123456781234" becomes "123456************" after masking.

[0136] For the work ID number information, considering that the length of the work ID number is not fixed, the first 1 / 3 of the digits of the work ID number will be retained during the masking process, and the last 2 / 3 of the digits will be replaced by a "*" symbol. When the length of the work ID number cannot be divided by 3, the quotient will be rounded down, and the number of digits in front of the work ID number will be retained according to the rounded number. In the Oracle database, the REGEXP_REPLACE function is used to mask the work ID number information.

[0137] Assume that the original SQL statement for reading the work permit number information is:

[0138] SELECT CARDID FROM STUDENT;

[0139] Among them, STUDENT is the database table name, and CARDID is the work ID number information field in the table.

[0140] After the masking operation, the SQL statement is modified to:

[0141] SELECT REGEXP_REPLACE(CARDID,'(.)','*',FLOOR(LENGTH(CARDID) / 3))ASCARDID FROM STUDENT;

[0142] For example, the work ID number "312025332244" becomes "3120********" after masking;

[0143] ⑤Other information: such as bank card number, date of birth, etc. This type of information is processed in the same way as the work ID number during the masking process.

[0144] For example, the bank card number "1234567891234567" becomes "12345***********" after masking;

[0145] The date of birth "123456" becomes "12****" after masking;

[0146] 2) Replace data

[0147] In this part of the implementation, a multi-Trie tree algorithm was designed to ensure that the address, ID number, mobile phone number, etc. have a unified location, avoiding the situation where the completely randomly generated address, ID number, and mobile phone number have inconsistent locations.

[0148] Figure 2 The left side is part of Trie tree A, and the right side is part of Trie tree B. Figure 2 The node "Zhengzhou City" in the Trie tree A in the figure establishes a mapping relationship with the leaf node in the Trie tree B in the figure, which is represented by a dotted line in the figure; assuming that the average number of mobile phone number segments associated with each place of origin is 10, and assuming that the number of mobile phone number segments associated with Zhengzhou City is 12, because only a part of it is shown in the figure, there are only 3 in the figure.

[0149] For the following user information:

[0150] Name Zhang San address Henan University of Technology Community Residents Committee, Linshanzhai Street, Zhongyuan District, Zhengzhou City, Henan Province phone number 12345678901 Mail zhangsan@test.com ID number 410102112233445566 Work ID number 312025332244 Bank card number 9876543211234567 Date of Birth 11223344

[0151] Based on the established multi-Trie tree, the replacement rules are as follows:

[0152] ① Name: For the user name, during the replacement process, a new name is randomly generated for display based on the established name database; for example, the name "Zhang San" becomes "Li Ziming" after replacement;

[0153] ② Address: For the address information ADDINFO, first find the administrative region where ADDINFO is located in the Trie tree A, locate the third-level address corresponding to ADDINFO, that is, the city-level address, and count the number of mobile phone number segments Seg associated with the address; if it is a municipality or a special administrative region, locate the second-level address, and count the number of mobile phone number segments Seg associated with the address; if Seg>avg, it means that the address is associated with more mobile phone number segments, the address popularity is high, and a small disturbance to the address can achieve the desensitization effect. Therefore, in the process of address disturbance, within the second-level provincial address range of the Trie tree A, randomly select an address containing five layers of information and return it to the user; if Seg>avg, it means that the address is associated with fewer mobile phone number segments, the address popularity is low, and a large disturbance to the address can achieve the desensitization effect. Therefore, in the process of address disturbance, within the entire range of the Trie tree A, randomly select an address containing five layers of information and return it to the user.

[0154] For example, the address "Henan Gongda Community Residents Committee, Linshanzhai Street, Zhongyuan District, Zhengzhou City, Henan Province" can be located in the Trie tree A to the corresponding administrative division address, namely "Linshanzhai Street, Zhongyuan District, Zhengzhou City, Henan Province". Because the number of mobile phone number segments associated with Zhengzhou City is 12, which is greater than the average value of 10, random perturbation is performed within the second-level provincial address range, that is, within the range of "Henan Province". The replaced address may be "Baolian Temple Town, Wenfeng District, Anyang City, Henan Province";

[0155] ③Contact information: mainly includes phone number and email address, etc. For phone number information, during the replacement process, a number segment is randomly selected based on the mobile phone number segment associated with the address returned to the user, and a mobile phone number is randomly generated and returned to the user;

[0156] For example, when generating a phone number based on the address information above, a number segment is randomly selected from the mobile phone number segments associated with Anyang City, Henan Province, such as 7654321, and a complete mobile phone number is randomly generated, such as 76543211234;

[0157] For email information, during the replacement process, the characters before the "@" symbol in the email address are replaced with the randomly generated Chinese pinyin of the user's name, and the characters after the "@" symbol are randomly generated.

[0158] For example, the email address of the above user is replaced with "liziming@a3bsa4.com";

[0159] ④ Document number: mainly includes ID card number and work card number, etc. For the ID card number information, it is generated based on the replaced address information during the replacement process, because the address information in Trie tree A contains the administrative division code, and the second, third and fourth layers in Trie tree A correspond to the provincial address, municipal address and county address respectively. The first 6 digits of the ID card number can be generated according to the administrative division codes of these three layers; the 7th to 14th digits of the ID card number represent the date of birth, which are generated randomly; the 15th to 18th digits of the ID card number are also generated randomly;

[0160] For example, the ID number of the user mentioned above can be generated in this way, because the administrative division code of Wenfeng District, Anyang City, Henan Province is 410502, and then a date of birth such as 22334455 is randomly generated, and the 15-18 digits of the ID number such as 6677 are randomly generated, based on which the ID number can be generated as 410502223344556677;

[0161] As for the work ID number information, considering that the length of the work ID number is not fixed, it is generated completely randomly during the replacement process.

[0162] For example, the work permit number "312025332244" becomes "4592834" after replacement;

[0163] ⑤Other information: such as bank card number, date of birth, etc. The date of birth must be consistent with the randomly generated date of birth in the above ID number, and other information can be randomly generated;

[0164] For example, the bank card number "9876543211234567" becomes "1234567897654321" after replacement; the date of birth "112233" becomes "223344" after masking.

Claims

1. A dynamic data desensitization system based on Oracle, characterized in that: The system includes the following modules: (1) Desensitization solution management module, which is used to configure system user levels and sensitive data levels; system users are divided into three levels: administrator, ordinary user and visitor; sensitive data are divided into three levels: original data, masked data and replaced data; (2) Desensitization algorithm module, which defines desensitization rules for different types of sensitive data; (3) Data desensitization module: This module determines the desensitization rules of different system users based on the configured desensitization scheme, and uses JVM-SandBox to monitor the JDBC requests submitted by users. If there are defined sensitive fields in them, the corresponding rules are used to desensitize the sensitive fields; (4) Log management module, which monitors the Select statement in JDBC. If there are defined sensitive fields in the statement, the sensitive fields and result set information in the Select statement will be recorded in the system log. In the desensitization algorithm module, the original data does not need to be desensitized and is directly provided to the administrator; for masked data, the following masking rules are formulated: ① For user names, the first letter of the name is retained during the masking process, and each letter after the first letter is replaced by a "*" symbol. In the Oracle database, the REGEXP_REPLACE function is used to mask the name; ② For address information, the first three characters of the address are retained during the masking process, and each subsequent character is replaced by a "*" symbol. In the Oracle database, the REGEXP_REPLACE function is used to mask the address information. ③ The contact information includes phone number and email address. For phone number information, the 4th to 7th digits of the phone number are replaced with "****" during the masking process. In Oracle database, the REPLACE function is used to mask the phone number information. For email address information, the characters before the "@" symbol in the email address are replaced with "******" during the masking process. In Oracle database, the REGEXP_REPLACE function is used to mask the email address information. ④ The certificate number includes the ID card number and the work card number. For the ID card number information, the first 6 digits of the ID card number are retained during the masking process, and the 7th and subsequent digits are replaced by a "*" symbol. In the Oracle database, the REGEXP_REPLACE function is used to mask the ID card number information; for the work card number information, the first 1 / 3 of the digits of the work card number are retained during the masking process, and the last 2 / 3 of the digits are replaced by a "*" symbol; when the length of the work card number cannot be divided by 3, the quotient is rounded up, and the number of digits in front of the work card number is retained according to the rounded-down number. In the Oracle database, the REGEXP_REPLACE function is used to mask the work card number information; ⑤ The bank card number and date of birth are masked in the same way as the work ID number; In the desensitization algorithm module, a multi-Trie tree method is used to replace data. The steps of data replacement based on the multi-Trie tree method are as follows: a) A basic Trie tree A is established based on official administrative division information. The first layer of tree A is the root node; the second layer is the provincial address, including provinces, autonomous regions, municipalities directly under the central government, and special administrative regions; the third layer is the city address, including autonomous prefectures, cities, and districts and counties of municipalities directly under the central government; the fourth layer is the county address, including counties and districts; the fifth layer is the township address, including townships, ethnic townships, and towns; Trie tree A includes N nodes and M edges The nodes Contains the administrative division code of the node and the name of the node, 1≤i≤N, 1≤j≤M; b) A basic Trie tree B is established based on the mobile phone number segment. The first layer of the tree B is the root node; the second layer to the eighth layer correspond to the first 7 digits of the mobile phone number respectively; the Trie tree B includes S nodes and T edge 1≤x≤S, 1≤y≤T; c) According to the mobile phone number segment attribution database, traverse all leaf nodes of Trie tree B and establish a mapping relationship between each leaf node and the corresponding address node in Trie tree A. These address nodes in Trie tree A are the third-level city-level addresses or the municipalities and special administrative regions in the second-level provincial addresses; d) Calculate the average number of mobile phone number segments associated with the home location, avg, Where M represents the number of places of origin, m Indicates the number of mobile phone number segments associated with the mth location; Based on the multi-Trie tree method, the following replacement rules are formulated for sensitive information types: ① For the user name, during the replacement process, a new name is randomly generated for display based on the established name database; ② For the address information ADDINFO, first find the administrative region where ADDINFO is located in Trie tree A, locate the third-level address corresponding to ADDINFO, that is, the city-level address, and count the number of mobile phone number segments Seg associated with the address; if it is a municipality or special administrative region, locate the second-level address and count the number of mobile phone number segments Seg associated with the address; if Seg>avg, randomly select an address containing five layers of information within the second-level provincial address range of Trie tree A and return it to the user; if Seg>avg, randomly select an address containing five layers of information within the entire range of Trie tree A and return it to the user; ③ The contact information includes phone number and email address. For phone number information, during the replacement process, a number segment is randomly selected based on the mobile phone number segment associated with the address returned to the user, and a mobile phone number is randomly generated and returned to the user; For email information, during the replacement process, the characters before the "@" symbol in the email address are replaced with the randomly generated full pinyin of the user's name, and the characters after the "@" symbol are randomly generated; ④ The ID number includes the ID card number and the work ID card number. The ID card number is generated based on the replaced address information during the replacement process. The address information in Trie tree A contains the administrative division code, and the second, third and fourth layers of Trie tree A correspond to the provincial address, municipal address and county address respectively. The first 6 digits of the ID card number are generated according to the three-layer administrative division code; the 7th to 18th digits of the ID card number are randomly generated; the work ID card number is randomly generated; ⑤ The date of birth is consistent with the randomly generated date of birth in the above ID number, and the bank card number is randomly generated.

2. A dynamic data desensitization method based on Oracle, the method comprising the following steps: (1) Desensitization solution management, used to configure system user levels and sensitive data levels; System users are divided into three levels: administrators, ordinary users and visitors; Sensitive data is divided into three levels: original data, masked data, and replaced data; (2) Define desensitization rules for different types of sensitive data; (3) Data desensitization: According to the configured desensitization scheme, the desensitization rules for data of different system users are determined, and JVM-SandBox is used to monitor the JDBC requests submitted by users. If there are defined sensitive fields, the sensitive fields are desensitized using the corresponding rules; (4) Log management: monitor the Select statement in JDBC. If there are defined sensitive fields, the sensitive fields and result set information in the Select statement will be recorded in the system log. For masked data, the following masking rules are formulated: ① For user names, the first letter of the name is retained during the masking process, and each letter after the first letter is replaced by a "*" symbol. In the Oracle database, the REGEXP_REPLACE function is used to mask the name; ② For address information, the first three characters of the address are retained during the masking process, and each subsequent character is replaced by a "*" symbol. In the Oracle database, the REGEXP_REPLACE function is used to mask the address information. ③ The contact information includes phone number and email address. For phone number information, the 4th to 7th digits of the phone number are replaced with "****" during the masking process. In Oracle database, the REPLACE function is used to mask the phone number information. For email address information, the characters before the "@" symbol in the email address are replaced with "******" during the masking process. In Oracle database, the REGEXP_REPLACE function is used to mask the email address information. ④ The certificate number includes the ID card number and the work card number. For the ID card number information, the first 6 digits of the ID card number are retained during the masking process, and the 7th and subsequent digits are replaced by a "*" symbol. In the Oracle database, the REGEXP_REPLACE function is used to mask the ID card number information; for the work card number information, the first 1 / 3 of the digits of the work card number are retained during the masking process, and the last 2 / 3 of the digits are replaced by a "*" symbol; when the length of the work card number cannot be divided by 3, the quotient is rounded up, and the number of digits in front of the work card number is retained according to the rounded-down number. In the Oracle database, the REGEXP_REPLACE function is used to mask the work card number information; ⑤ The bank card number and date of birth are masked in the same way as the work ID number; For replacing data, a multi-Trie tree method is used. The steps of data replacement based on the multi-Trie tree method are as follows: a) A basic Trie tree A is established based on official administrative division information. The first layer of tree A is the root node; the second layer is the provincial address, including provinces, autonomous regions, municipalities directly under the central government, and special administrative regions; the third layer is the city address, including autonomous prefectures, cities, and districts and counties of municipalities directly under the central government; the fourth layer is the county address, including counties and districts; the fifth layer is the township address, including townships, ethnic townships, and towns; Trie tree A includes N nodes and M edges The nodes Contains the administrative division code of the node and the name of the node, 1≤i≤N, 1≤j≤M; b) A basic Trie tree B is established based on the mobile phone number segment. The first layer of the tree B is the root node; the second layer to the eighth layer correspond to the first 7 digits of the mobile phone number respectively; the Trie tree B includes S nodes and T edge 1≤x≤S, 1≤y≤T; c) According to the mobile phone number segment attribution database, traverse all leaf nodes of Trie tree B and establish a mapping relationship between each leaf node and the corresponding address node in Trie tree A. These address nodes in Trie tree A are the third-level city-level addresses or the municipalities and special administrative regions in the second-level provincial addresses; d) Calculate the average number of mobile phone number segments associated with the home location, avg, Where M represents the number of places of origin, m Indicates the number of mobile phone number segments associated with the mth location; Based on the multi-Trie tree method, the following replacement rules are formulated for sensitive information types: ① For the user name, during the replacement process, a new name is randomly generated for display based on the established name database; ② For the address information ADDINFO, first find the administrative region where ADDINFO is located in Trie tree A, locate the third-level address corresponding to ADDINFO, that is, the city-level address, and count the number of mobile phone number segments Seg associated with the address; if it is a municipality or special administrative region, locate the second-level address and count the number of mobile phone number segments Seg associated with the address; if Seg>avg, randomly select an address containing five layers of information within the second-level provincial address range of Trie tree A and return it to the user; if Seg>avg, randomly select an address containing five layers of information within the entire range of Trie tree A and return it to the user; ③ The contact information includes phone number and email address. For phone number information, during the replacement process, a number segment is randomly selected based on the mobile phone number segment associated with the address returned to the user, and a mobile phone number is randomly generated and returned to the user; For email information, during the replacement process, the characters before the "@" symbol in the email address are replaced with the randomly generated full Chinese pinyin of the user's name, and the characters after the "@" symbol are randomly generated; ④ The ID number includes the ID card number and the work ID card number. The ID card number is generated based on the replaced address information during the replacement process. The address information in Trie tree A contains the administrative division code, and the second, third and fourth layers of Trie tree A correspond to the provincial address, municipal address and county address respectively. The first 6 digits of the ID card number are generated according to the three-layer administrative division code; the 7th to 18th digits of the ID card number are randomly generated; the work ID card number is randomly generated; ⑤ The date of birth is consistent with the randomly generated date of birth in the above ID number, and the bank card number is randomly generated.

Images