A Kafka server data desensitization method and system based on ACL

Abstract

A Kafka server-side data desensitization method and system based on ACL belongs to the field of data desensitization technology, including configuring a service interface on the Kafka server and adding ACL configuration through the service interface. When a consumer client requests Topic data, the ACL configuration is queried, and desensitization is implemented based on the consumer identity and the required Topic, judging whether it has read permission and corresponding desensitization rules, thereby achieving real-time desensitization of data pull within the Kafka cluster. This application reduces additional storage outside the Kafka cluster, can process data in real time, reduce the time delay from data generation to data processing, reduce the use of intermediate resources, reduce the authorization of intermediate results, is simple and efficient, and increases data security.

Description

Technical Field

[0001] The present application relates to the field of data desensitization, and specifically to a Kafka server-side data desensitization method and system based on ACL implementation. Background Art

[0002] Real-time business raw data needs to be saved in Kafka. Different downstream data consumers need to set different security access rules for data access according to business needs. Data desensitization for sensitive data in raw data is an important means to protect business secrets and privacy data. Through data desensitization, you can effectively control the access to confidential data within the enterprise, prevent the abuse of privacy data, and prevent sensitive data from flowing out of the enterprise without desensitization. It is necessary for enterprises to protect confidential and private data while maintaining regulatory compliance and meeting corporate compliance. Topics in the Kafka cluster have business sharing scenarios, that is, multiple business users need to consume the same Topic data. However, different business users have different security permissions for data use. Some businesses need to desensitize raw data, and sensitive data needs to be desensitized. For example, personal identity information, mobile phone numbers, bank card information, etc. need to achieve reliable protection of sensitive privacy data.

[0003] In response to the above data desensitization requirements, the first existing solution refers to Figure 1 The steps of the real-time data desensitization method include: step a1, the producer client produces a message and stores it in the original Topic of Kafka cluster 1. Step a2, the Flink job inside the data center consumes the Kafka data for desensitization processing. Step a3, the desensitized data is rewritten into the desensitized Topic of Kafkacluster 2. The Kafka cluster 2 storing the desensitized data may not be the Kafkacluster 1 storing the original data. Step a4, the consumer client reads the desensitized Topic data.

[0004] The disadvantages of the first real-time data desensitization method include: 1. It is necessary to open computing resources to run Flink jobs. 2. It increases the desensitized topic and its storage space. 3. When the data center runs internal jobs, it needs to configure read permissions for it to read the original topic from Kafka cluster 1, and configure write permissions for it to write the desensitized topic to Kafkacluster 2. The read permission opened for the business is used to read the desensitized topic from Kafka cluster 2, which requires multiple authorizations. 4. The extension of the link increases the processing delay.

[0005] In response to the above data desensitization requirements, the second existing solution refers to Figure 2The steps of the real-time data desensitization method include: step b2, writing into an offline data warehouse system (offline data warehouse for short), such as Hive. Step b3, desensitizing is achieved through permission control when the consumer client reads the Hive table, such as using Ranger to desensitize the Hive data.

[0006] The disadvantages of the second offline data desensitization method include: 1. Reading data from offline lengthens the data link and significantly increases the latency. 2. In the batch data processing scenario, the original topics in the Kafka cluster are stored in batches in the offline data warehouse system, which cannot meet the real-time processing requirements. Summary of the invention

[0007] The present application provides a Kafka server-side data desensitization method and system based on ACL, which can solve the technical problems of poor real-time performance of desensitization operations and large consumption of storage resources in the prior art.

[0008] In a first aspect, an embodiment of the present application provides a Kafka server data desensitization method based on ACL, the method comprising:

[0009] Configure a service interface for the Kafka server, and add an access control list (ACL) configuration through the interface. The ACL configuration contains the mapping relationship between consumer identity information, original Topic name, sensitive information field, and desensitization strategy;

[0010] After receiving the message pull request sent by the consumer client, the Kafka server queries the ACL configuration according to the consumer identity information and the original Topic name contained in the message pull request to determine whether the consumer client has read permission and the desensitization strategy when it has read permission;

[0011] When the Kafka server determines that the consumer client has read permission, it obtains the corresponding original Topic data and desensitizes it using a desensitization strategy to obtain desensitized Topic data;

[0012] The Kafka server responds the desensitized Topic data to the consumer client.

[0013] In combination with the first aspect, in one implementation, the ACL configuration also includes original Topic content; and the method further includes:

[0014] When the Kafka server determines that the consumer client has read permission, it obtains the corresponding original Topic data and processes it using the desensitizing strategy and the original Topic content to obtain a desensitized Topic.

[0015] In combination with the first aspect, in one implementation, the method further includes:

[0016] The relevant information of the ACL configuration is stored in the ZooKeeper of the Kafka server.

[0017] In combination with the first aspect, in one implementation, the ACL configuration further includes Topic Schema information; and the method further includes:

[0018] After obtaining the message pull request, the Kafka server deserializes the corresponding original Topic data according to the Topic Schema information, desensitizes the sensitive information field using the desensitization rule, and re-serializes according to the Topic Schema information after desensitization to obtain the desensitized Topic data.

[0019] In combination with the first aspect, in one implementation, the desensitization rule includes multiple sub-rules, and each sensitive data field corresponds to a sub-rule;

[0020] The sub-rule is to use x to mask all letter characters in the original Topic data, and to use n to mask all numeric characters in the original Topic;

[0021] The sub-rule is to display the last four characters in the original Topic data, and all characters except the last four characters are replaced by *;

[0022] The sub-rule is to display the first four characters in the original Topic data, and replace all characters except the first four characters with *;

[0023] The sub-rule is to replace the original value with the hash value of the original value;

[0024] The sub-rule is to replace the original value with the special indicator NULL value of the original value;

[0025] The sub-rule is to display the year portion of a date string, with the month and day defaulted to 01 / 01.

[0026] In a second aspect, an embodiment of the present application provides a Kafka server data desensitization system based on ACL, the system comprising:

[0027] The configuration module is set in the Kafka server and is used to configure the service interface for the Kafka server and add the access control list ACL configuration through the interface. The ACL configuration contains the mapping relationship between consumer identity information, original Topic name, sensitive information field and desensitization strategy;

[0028] The processing module is arranged in the Kafka server and is used for, after receiving the message pull request sent by the consumer client, querying the ACL configuration according to the consumer identity information and the original Topic name contained in the message pull request, to determine whether the consumer client has read permission and the desensitization strategy when it has read permission; it is also used for, when it is determined that the consumer client has read permission, obtaining the corresponding original Topic data and desensitizing it using the desensitization strategy to obtain desensitized Topic data; it is also used for responding the desensitized Topic data to the consumer client.

[0029] In conjunction with the second aspect, in one implementation, the ACL configuration further includes original Topic content;

[0030] When the processing module determines that the consumer client has the read permission, it obtains the corresponding original Topic data and processes it using the desensitization strategy and the original Topic content to obtain the desensitized Topic data.

[0031] In combination with the second aspect, in one implementation, the configuration module stores the relevant information of the ACL configuration in ZooKeeper of the Kafka server.

[0032] In combination with the second aspect, in one embodiment, the ACL configuration also includes Topic Schema information; after obtaining the message pull request, the processing module deserializes the corresponding original Topic data according to the Topic Schema information, and desensitizes the sensitive information field using desensitization rules, and re-serializes it according to the Topic Schema information after desensitization to obtain desensitized Topic data.

[0033] In conjunction with the second aspect, in one implementation, the desensitization rule includes a plurality of sub-rules, and each sensitive data field corresponds to a sub-rule;

[0034] The sub-rule is to use x to mask all letter characters in the original Topic data, and to use n to mask all numeric characters in the original Topic data;

[0035] The sub-rule is to display the last four characters in the original Topic data, and all characters except the last four characters are replaced by *;

[0036] The sub-rule is to display the first four characters in the original Topic data, and replace all characters except the first four characters with *;

[0037] The sub-rule is to replace the original value with the hash value of the original value;

[0038] The sub-rule is to replace the original value with the special indicator NULL value of the original value;

[0039] The sub-rule is to display the year portion of a date string, with the month and day defaulted to 01 / 01.

[0040] The beneficial effects brought by the technical solution provided in the embodiments of the present application include:

[0041] By configuring the service interface on the Kafka server (i.e., Kafka cluster) and adding ACL configuration through the service interface, and adding desensitization rules during the ACL authorization process, when the consumer client requests Topic data, the ACL configuration is queried, and the consumer identity and the required Topic are used to determine whether it has read permission and the corresponding desensitization rules are used to implement desensitization, thereby achieving real-time desensitization of data pull within the Kafka cluster, reducing additional storage outside the Kafka cluster, enabling real-time data processing, reducing the time delay from data generation to data processing, reducing the use of intermediate resources, reducing the authorization of intermediate results, and being simple and efficient. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is a flow chart of the prior art solution 1;

[0043] Figure 2 It is a flow chart of the second prior art solution;

[0044] Figure 3 This is a flow chart of the Kafka server data desensitization method implemented based on ACL in this application;

[0045] Figure 4 This is a flow chart of configuring the service interface in the Kafka server-side data desensitization method implemented based on ACL in this application;

[0046] Figure 5 This is a flowchart of data desensitization in the Kafka server-side data desensitization method implemented based on ACL in this application. DETAILED DESCRIPTION

[0047] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0048] First, some technical terms in the present application are explained to facilitate those skilled in the art to understand the present application.

[0049] As an open source stream processing platform, Kafka is widely used for its high throughput, sustainability, horizontal scalability, support for stream data processing and other features. It has three characteristics: 1. Similar to a messaging system, it provides publishing and subscription of event streams, that is, it has data injection function. 2. The nodes storing event stream data are fault-tolerant, that is, they have data storage function. 3. It can process and analyze real-time event streams in a streaming manner, that is, it has stream processing function.

[0050] The Kafka architecture includes several Producers, Broker Servers, Consumers, and a ZooKeeper cluster. The ZooKeeper cluster is used by Kafka to manage cluster metadata, elect controllers, and other operations. The Producer sends messages to the Broker Server, which is responsible for writing the received messages to the disk in sequence, while the Consumer is responsible for subscribing to and consuming messages from the Broker Server. Messages in Kafka are classified by Topic. Producers are responsible for sending messages to specific topics, while consumers are responsible for subscribing to topics and consuming.

[0051] In order to make the objectives, technical solutions and advantages of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0052] In a first aspect, an embodiment of the present application provides a Kafka server data desensitization method based on ACL (Access Control List).

[0053] In one embodiment, referring to Figure 3 , Figure 3 This is a flow chart of an embodiment of a Kafka server data desensitization method based on ACL implemented in this application. Figure 3 As shown in the figure, the Kafka server data desensitization methods based on ACL include:

[0054] Step S1: Configure a service interface for the Kafka server, and add an access control list (ACL) configuration through the interface. The ACL configuration contains a mapping relationship between consumer identity information, original Topic name, sensitive information field, and desensitization strategy;

[0055] Step S2: After receiving the message pull request sent by the consumer client, the Kafka server queries the ACL configuration according to the consumer identity information and the original Topic name contained in the message pull request to determine whether the consumer client has read permission and the desensitization strategy when it has read permission;

[0056] Step S3: When the Kafka server determines that the consumer client has read permission, it obtains the corresponding original Topic data and desensitizes it using a desensitization strategy to obtain desensitized Topic data;

[0057] Step S4: The Kafka server responds the desensitized Topic data to the consumer client.

[0058] In this embodiment, by adding desensitization rule configuration in the ACL authorization process and the Kafka server performing data desensitization processing in the data pulling process, data desensitization is directly implemented in the process of users consuming original Topic data, avoiding the use of additional storage resources, reducing job maintenance, shortening the data processing link, ensuring real-time performance, and implementing data desensitization flexibly and economically.

[0059] Furthermore, in one embodiment, the ACL configuration also includes the original Topic content; and the method further includes:

[0060] When the Kafka server determines that the consumer client has read permission, it obtains the corresponding original Topic data and processes it using the desensitizing strategy and the original Topic content to obtain a desensitized Topic.

[0061] In this embodiment, the original Topic content is used to describe the original Topic data content under the original Topic. For example, the original Topic content may be Topic Schema information and other related information used to describe the original Topic data.

[0062] Furthermore, in one embodiment, the ACL configuration also includes Topic Schema information; the method also includes:

[0063] After receiving the message pull request, the above-mentioned Kafka server deserializes the corresponding original Topic data according to the Topic Schema information, desensitizes the sensitive information fields using the desensitization rules, and re-serializes according to the Topic Schema information after desensitization to obtain the desensitized Topic data. The Kafka server can identify the format of the original Topic data according to the Topic Schema information, and then deserialize it. After deserialization, it searches for the fields that need to be desensitized according to the sensitive field information and the desensitization strategy to perform the corresponding desensitization operation. By storing the Topic Schema information on the Kafka server, the Kafka server is supported to independently complete data reading and desensitization, and consumers can directly obtain the desensitized data that can be directly transmitted.

[0064] Store the above ACL configuration information in ZooKeeper on the Kafka server.

[0065] In this embodiment, refer to Figure 4 The data center administrator sets the ACL through the authorization management service interface, including the user's access rights and access rules to the original Topic. AclAuthorizer is the core of the authentication module implementation in the Kafka server, which is used to implement the authentication when the consumer client sends a message pull request.

[0066] Specifically, the above settings include the user's read permission for the original Topic data, Topic Schema information, fields that need to be desensitized, and desensitization policies. The above information is stored in the relevant ZooKeeper nodes.

[0067] Reference for the transformed data production and consumption process Figure 5 , the producer client produces messages and stores them in the original Topic of the Kafka server. When the consumer client pulls Topic data, after sending a FetchRequest request to the Kafka server, the authentication module determines whether the user has Topic read permission based on the user information, Topic name and ACL configuration. If the user has read permission, it is also necessary to determine whether the target Topic (the original Topic required by the consumer) needs to be desensitized for the pulling user.

[0068] If desensitization is required, the desensitization rules for the target Topic-related fields are determined according to the ACL configuration on ZooKeeper; the Kafka server reads the data, deserializes the read data, and applies the desensitization rules if there are any, and then serializes the data. A FetchResponse is sent to return the desensitized data to the user.

[0069] In summary, the method of implementing data desensitization based on ACL configuration on the Kafka server is a real-time data desensitization method that reduces the usage of storage resources, shortens the data link, reduces processing delays, and increases data security.

[0070] Furthermore, in one embodiment, the above-mentioned desensitizing rules support multiple built-in rule types, and the rules corresponding to each field can be selected for configuration; each sensitive data field corresponds to a sub-rule. Specifically, the desensitizing rules support multiple built-in rule types, and the rules corresponding to each sensitive information field can be selected for configuration. One of the six sub-rules is selected according to the field, and multiple sub-rules can be selected if there are multiple fields.

[0071] The above sub-rule is to use x to mask all alphabetic characters in the original Topic data, and to use n to mask all numeric characters in the original Topic data;

[0072] The above sub-rule is to display the last four characters in the original Topic data, and all characters except the last four characters are replaced by *;

[0073] The above sub-rule is to display the first four characters in the original Topic data, and all characters except the first four characters are replaced by *;

[0074] The above sub-rule is to replace the original value with the hash value of the original value;

[0075] The above sub-rule is to replace the original value with the special indicator NULL value of the original value;

[0076] The above sub-rule displays the year portion of a date string, with the month and day defaulted to 01 / 01.

[0077] In this embodiment, if there is read permission and desensitization rules exist: the server reads the data, deserializes the data, and desensitizes it according to the desensitization rules. The data of each partition is processed at the node where the primary copy of the partition is located, and the processed data is serialized.

[0078] In a specific embodiment, first, a data pull request for a target Topic in a specified Kafka server is received, wherein the target Topic is used to store original data that is not desensitized, and a data pull request for the target data is obtained, wherein the data pull request includes at least user information and the target Topic name corresponding to the pulled target data.

[0079] Then, based on the user information and the target Topic name, determine from the configured ACL whether the user has the permission to read the target data. If the user has the permission to read the target data, determine whether the target data needs to be desensitized for the user. If the target data needs to be desensitized for the user, determine the configured desensitization strategy. Obtain the original data (that is, the original Topic data) from the original Topic, desensitize the original data according to the desensitization rules, and output the desensitized target data to the user. In this way, by storing the original data in the specified original Topic, determine whether the user has the permission to pull the original data according to the pull request. If the user has the permission to read the original data, determine whether the original data needs to be desensitized for the user. If the original data needs to be desensitized for the user, determine the desensitization rules for the pulling user in the original data, then obtain the original data, desensitize the original data, and return the desensitized target data to the user. In this way, there is no need to desensitize data in the traditional way of processing through desensitization rules before sending the data to the user through real-time desensitization processing and secondary storage or offline query after offline storage. Instead, the data desensitization process is placed in the data pulling process, and the data is output based on the pull request and desensitized in real time, which will not occupy additional storage resources (no storage and computing resources other than the Kafka server are required) and reduce data processing delays. It will not affect the original data, and at the same time, different users can view different data content for the same data.

[0080] In the second aspect, the embodiment of the present application also provides a Kafka server-side data desensitization system based on ACL.

[0081] In one embodiment, the Kafka server data desensitization system implemented based on ACL includes:

[0082] The configuration module is set in the Kafka server and is used to configure the service interface for the Kafka server and add the access control list ACL configuration through the interface. The ACL configuration contains the mapping relationship between consumer identity information, original Topic name, sensitive information field and desensitization strategy;

[0083] The processing module is set in the Kafka server and is used to query the ACL configuration according to the consumer identity information and the original Topic name contained in the message pull request after the above-mentioned Kafka server receives the message pull request sent by the consumer client, to determine whether the consumer client has read permission and the desensitization strategy when it has read permission; it is also used to obtain the corresponding original Topic data and desensitize it using the desensitization strategy to obtain desensitized Topic data when it is determined that the above-mentioned consumer client has read permission; it is also used to respond the desensitized Topic data to the above-mentioned consumer client.

[0084] In this embodiment, by modifying the Kafka server and adding the above-mentioned data desensitization system, the Kafka server can perform data desensitization efficiently and in real time.

[0085] Specifically, by configuring the service interface on the Kafka server (i.e., Kafka cluster) and adding ACL configuration to the service interface, and adding desensitization rules in the ACL authorization process, when the consumer client requests Topic data, the ACL configuration is queried, and the consumer identity and the required Topic are used to determine whether it has read permission and the corresponding desensitization rules are used to implement desensitization, thereby achieving real-time desensitization of data pulling within the Kafka cluster, reducing additional storage and computing resources outside the Kafka cluster, and enabling real-time data processing, reducing the time delay from data generation to data processing, reducing the use of intermediate resources, reducing the authorization of intermediate results, and being simple and efficient.

[0086] Furthermore, in one embodiment, the above ACL configuration also includes the original Topic content;

[0087] When the processing module determines that the consumer client has the read permission, it obtains the corresponding original Topic data and processes it using the desensitizing strategy and the original Topic content to obtain the desensitized Topic data.

[0088] Furthermore, in one embodiment, the configuration module stores the relevant information of the ACL configuration in the ZooKeeper of the Kafka server.

[0089] Furthermore, in one embodiment, the above-mentioned ACL configuration also includes Topic Schema information; after obtaining the message pull request, the above-mentioned processing module deserializes the corresponding original Topic data according to the Topic Schema information, desensitizes the sensitive information field using desensitization rules, and re-serializes according to the Topic Schema information after desensitization to obtain desensitized Topic data.

[0090] In this embodiment, refer to Figure 4 The data center administrator sets the ACL through the authorization management service interface, including the user's access rights and access rules to the original Topic. Acl Authorizer is the core of the authentication module in the Kafka server, which is used to implement authentication when the consumer client sends a message pull request.

[0091] Specifically, the above settings include the user's read permission for the original Topic data, Topic Schema information, fields that need to be desensitized, and desensitization policies. The above information is stored in the relevant ZooKeeper nodes.

[0092] Reference for the transformed data production and consumption process Figure 5 , the producer client produces messages and stores them in the original Topic of the Kafka server. When the consumer client pulls Topic data, after sending a FetchRequest request to the Kafka server, the authentication module determines whether the user has Topic read permission based on the user information, Topic name and ACL configuration. If the user has read permission, it is also necessary to determine whether the target Topic (the original Topic required by the consumer) needs to be desensitized for the pulling user.

[0093] If desensitization is required, the desensitization rules for the target Topic-related fields are determined according to the ACL configuration on ZooKeeper; the Kafka server reads the data, deserializes the read data, and applies the desensitization rules if there are any, and then serializes the data. A FetchResponse is sent to return the desensitized data to the user.

[0094] In summary, the method of implementing data desensitization based on ACL configuration on the Kafka server is a real-time data desensitization method that reduces the usage of storage resources, reduces processing delays, and increases data security.

[0095] Furthermore, in one embodiment, the above desensitization rule includes multiple sub-rules, and the desensitization rule supports multiple built-in rule types, and the rule corresponding to each field can be selected for configuration;

[0096] The above sub-rule is to use x to mask all alphabetic characters in the original Topic data, and to use n to mask all numeric characters in the original Topic data;

[0097] The above sub-rule is to display the last four characters in the original Topic data, and all characters except the last four characters are replaced by *;

[0098] The above sub-rule is to display the first four characters in the original Topic data, and all characters except the first four characters are replaced by *;

[0099] The above sub-rule is to replace the original value with the hash value of the original value;

[0100] The above sub-rule is to replace the original value with the special indicator NULL value of the original value;

[0101] The above sub-rule displays the year portion of a date string, with the month and day defaulted to 01 / 01.

[0102] Among them, the functional implementation of each module in the above-mentioned Kafka server-side data desensitization system based on ACL corresponds to the steps in the above-mentioned Kafka server-side data desensitization method embodiment based on ACL, and its functions and implementation process will not be repeated here one by one.

[0103] It should be noted that the serial numbers of the above-mentioned embodiments of the present application are only for description and do not represent the advantages or disadvantages of the embodiments.

[0104] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, disk, CD) as mentioned above, and includes a number of instructions for a terminal device to execute the above-mentioned methods of each embodiment of the present application.

[0105] The terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above drawings are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device comprising a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units that are not listed, or may optionally include other steps or units that are inherent to these processes, methods, products or devices.

[0106] In the description of the embodiments of the present application, "exemplary", "for example" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary", "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary", "for example" or "for example" is intended to present related concepts in a specific way.

[0107] In the description of the embodiments of the present application, "plurality" refers to two or more than two.

[0108] In some processes described in the embodiments of the present application, multiple operations or steps that appear in a specific order are included, but it should be understood that these operations or steps may not be executed in the order in which they appear in the embodiments of the present application or in parallel, and the sequence number of the operation is only used to distinguish the different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed in sequence or in parallel, and these operations or steps may be combined.

[0109] The above are only preferred embodiments of the present application, and are not intended to limit the patent scope of the present application. Any equivalent structure or equivalent process transformation made using the contents of the present application specification and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present application.

Claims

1. A Kafka server data desensitization method based on ACL, characterized in that: The method comprises: Configure a service interface for the Kafka server, and add an access control list (ACL) configuration through the interface. The ACL configuration contains the mapping relationship between consumer identity information, original Topic name, sensitive information field, and desensitization strategy; After receiving the message pull request sent by the consumer client, the Kafka server queries the ACL configuration according to the consumer identity information and the original Topic name contained in the message pull request to determine whether the consumer client has read permission and the desensitization strategy when it has read permission; When the Kafka server determines that the consumer client has read permission, it obtains the corresponding original Topic data and desensitizes it using a desensitization strategy to obtain desensitized Topic data; The Kafka server responds the desensitized Topic data to the consumer client.

2. The Kafka server data desensitization method based on ACL as claimed in claim 1, characterized in that: The ACL configuration also includes the original Topic content; the method also includes: When the Kafka server determines that the consumer client has read permission, it obtains the corresponding original Topic data and processes it using the desensitizing strategy and the original Topic content to obtain desensitized Topic data.

3. The Kafka server data desensitization method based on ACL as claimed in claim 1, characterized in that: The method further comprises: The relevant information of the ACL configuration is stored in the ZooKeeper of the Kafka server.

4. The Kafka server data desensitization method based on ACL as claimed in claim 1, characterized in that: The ACL configuration also includes Topic Schema information; the method also includes: After obtaining the message pull request, the Kafka server deserializes the corresponding original Topic data according to the Topic Schema information, desensitizes the sensitive information field using the desensitization rule, and re-serializes according to the Topic Schema information after desensitization to obtain the desensitized Topic data.

5. The Kafka server data desensitization method based on ACL as claimed in claim 1, characterized in that: The desensitization rule includes multiple sub-rules, and each sensitive data field corresponds to a sub-rule; The sub-rule is to use x to mask all letter characters in the original Topic data, and to use n to mask all numeric characters in the original Topic; The sub-rule is to display the last four characters in the original Topic data, and all characters except the last four characters are replaced by *; The sub-rule is to display the first four characters in the original Topic data, and replace all characters except the first four characters with *; The sub-rule is to replace the original value with the hash value of the original value; The sub-rule is to replace the original value with the special indicator NULL value of the original value; The sub-rule is to display the year portion of a date string, with the month and day defaulted to 01 / 01.

6. A Kafka server data desensitization system based on ACL, characterized in that: The system comprises: The configuration module is set in the Kafka server and is used to configure the service interface for the Kafka server and add the access control list ACL configuration through the interface. The ACL configuration contains the mapping relationship between consumer identity information, original Topic name, sensitive information field and desensitization strategy; The processing module is arranged in the Kafka server and is used for, after receiving the message pull request sent by the consumer client, querying the ACL configuration according to the consumer identity information and the original Topic name contained in the message pull request, to determine whether the consumer client has read permission and the desensitization strategy when it has read permission; it is also used for, when it is determined that the consumer client has read permission, obtaining the corresponding original Topic data and desensitizing it using the desensitization strategy to obtain desensitized Topic data; it is also used for responding the desensitized Topic data to the consumer client.

7. The Kafka server data desensitization system based on ACL as claimed in claim 6, characterized in that: The ACL configuration also includes the original Topic content; When the processing module determines that the consumer client has the read permission, it obtains the corresponding original Topic data and processes it using the desensitization strategy and the original Topic content to obtain the desensitized Topic data.

8. The Kafka server data desensitization system based on ACL as claimed in claim 6, characterized in that: The configuration module stores the relevant information of the ACL configuration in the ZooKeeper of the Kafka server.

9. The Kafka server data desensitization system based on ACL as claimed in claim 6, characterized in that: The ACL configuration also includes Topic Schema information; after obtaining the message pull request, the processing module deserializes the corresponding original Topic data according to the Topic Schema information, desensitizes the sensitive information field using the desensitization rule, and re-serializes according to the Topic Schema information after desensitization to obtain the desensitized Topic data.

10. The Kafka server data desensitization system based on ACL as claimed in claim 6, characterized in that: The desensitization rule includes multiple sub-rules, and each sensitive data field corresponds to a sub-rule; The sub-rule is to use x to mask all letter characters in the original Topic data, and to use n to mask all numeric characters in the original Topic data; The sub-rule is to display the last four characters in the original Topic data, and all characters except the last four characters are replaced by *; The sub-rule is to display the first four characters in the original Topic data, and replace all characters except the first four characters with *; The sub-rule is to replace the original value with the hash value of the original value; The sub-rule is to replace the original value with the special indicator NULL value of the original value; The sub-rule is to display the year portion of a date string, with the month and day defaulted to 01 / 01.

Images