A data access method based on data authority and data security desensitization

Abstract

The present invention relates to the field of data security technology, and in particular to a data access method based on data authority and data security desensitization. The present invention determines the location information of a parsing field corresponding to a query request, compares the location information of each record field in a query record of a database terminal with the parsing field, so as to construct a field set, determines the number of fields with the same authority level as the parsing field in the field set, determines whether the parsing field is a parsing field for avoiding desensitization, determines an effective replacement position, performs character replacement on the field at the effective replacement position for avoiding the desensitizing parsing field, and finally outputs the parsing field with the character replacement completed, thereby realizing the identification of data theft, and effectively avoiding the leakage of sensitive data that may be caused by the association analysis of multiple desensitized data samples for stealing sensitive data, thereby improving the security of data access.

Description

Technical Field

[0001] The present invention relates to the field of data security technology, and in particular to a data access method based on data authority and data security desensitization. Background Art

[0002] Data security is of great significance to individuals, companies and countries. The safe, reasonable and efficient use of data information is conducive to industrial development and empowers industrial applications. The current era of digitalization and intelligence requires effective maintenance of massive amounts of data. User privacy and the opening, sharing, aggregation, trading and access of core data assets all require effective data management and control. All links face a variety of data theft methods.

[0003] In the data access link, preventing data theft mainly relies on data permission restrictions and data desensitization measures. However, in the face of the increasing diversification of data theft methods, it is urgent to enrich data permission restrictions and data desensitization measures to meet the data security challenges faced by the data access link.

[0004] For example, China Patent Publication No.: CN116049884A, the invention discloses a data desensitization method, system and medium based on role access control, the method includes: classifying users according to the login information of registered login users to determine the user type; assigning roles and granting permissions to logged-in users to achieve role and permission management; matching data desensitization algorithms with sensitive data fields of user query content to achieve desensitization calculation processing at different levels of sensitive data fields; returning the data desensitization results to the user.

[0005] The prior art still has the following problems:

[0006] The existing technology does not consider the possible leakage of sensitive data caused by the correlation analysis of multiple desensitized data samples with different desensitization strategies. The existing technology cannot identify data theft behavior based on the permission characteristics and field characteristics of data access, and cannot effectively avoid the theft of desensitized data samples of sensitive data, affecting the security of data access. Summary of the invention

[0007] To this end, the present invention provides a data access method based on data permissions and data security desensitization, so as to overcome the problems in the prior art that data theft behavior cannot be identified based on data access permission characteristics and field characteristics, and cannot effectively avoid the theft of desensitized data samples of sensitive data.

[0008] To achieve the above object, the present invention provides a data access method based on data authority and data security desensitization, comprising:

[0009] In response to a query request sent by a logged-in user, determine location information of a parsed field corresponding to the query request, wherein the location information includes a library name and a table name;

[0010] Acquire query records of the database terminal within a preset time period, compare the position information of each record field in the query record with the parsed field, and construct a field set according to the result of the position information comparison, wherein the field set includes the parsed field and a plurality of record fields;

[0011] Obtaining a query request corresponding to the parsed field, determining the permission level corresponding to the logged-in user who sent the query request, and determining the number of fields in the field set that have the same permission level as the logged-in user corresponding to the parsed field, so as to determine whether the parsed field is a parsed field for avoiding desensitization;

[0012] Wherein, the permission level is set based on the data reading range;

[0013] Determine a replacement position where characters are replaced in each record field in the field set, determine an effective replacement position based on the adoption frequency of the replacement position, and perform character replacement on the field at the effective replacement position of the field for avoiding desensitization parsing;

[0014] wherein the replacement position and the valid replacement position include a column name;

[0015] Outputs the parsed field with character replacement completed.

[0016] Furthermore, the step of determining the location information of the parsed field corresponding to the query request includes:

[0017] Establishing in advance the association between each query request and the corresponding parsing field;

[0018] Determine the parsing field corresponding to the query request based on the association relationship;

[0019] Determine a target table and a target database involving the parsed field;

[0020] The table name of the target table and the library name of the target database are determined as the location information.

[0021] Furthermore, the step of obtaining the query record of the database terminal within a preset time period includes:

[0022] In response to the database terminal receiving the query request, determining the time corresponding to the query request as a reference time;

[0023] Determine a time period of a preset length with the reference time as the end point of the time period;

[0024] Get the query records within the time period and the record fields in the query records.

[0025] Furthermore, the process of building a field collection includes:

[0026] Compare the position information of each record field in the query record with the parsed field;

[0027] If the position information of the record field is the same as that of the parsed field, the record field is added to the field set, and a data set constructed by a number of record fields having the same position information as that of the parsed field and the parsed field is determined as the field set.

[0028] Furthermore, the process of determining the permission level corresponding to the logged-in user includes:

[0029] The user ID of the logged-in user corresponding to the query request is obtained, and based on the pre-built association relationship between the user ID and the permission level, the permission level corresponding to the current user ID is queried.

[0030] Furthermore, the step of determining the number of fields includes:

[0031] Determine the query request corresponding to each record field in the field set, and determine the authority level corresponding to the logged-in user who sends the query request;

[0032] Marking the record fields whose authority level is the same as the authority level of the logged-in user corresponding to the parsed field;

[0033] The number of record fields to be marked is determined as the field number.

[0034] Furthermore, the process of determining whether the parsing field is a desensitization circumvention parsing field includes:

[0035] Calculating a ratio of the number of fields to the total number of fields in the field set, and comparing the ratio with a preset ratio threshold;

[0036] If the ratio is greater than the ratio threshold, the parsing field is determined to be a desensitization avoidance parsing field.

[0037] Furthermore, the process of determining the replacement position where the characters of each record field are replaced includes:

[0038] The fields for character replacement of each record field in the field set are determined, the column names corresponding to the fields are determined based on the naming rules preset by the database terminal, and the column names are determined as the replacement positions.

[0039] Further, the process of determining the effective replacement position includes:

[0040] The frequency of each replacement position is determined based on the replacement positions for character replacement in each record field, and the replacement position corresponding to the maximum frequency is determined as the effective replacement position.

[0041] Furthermore, the process of replacing characters in the desensitization parsing avoidance field includes:

[0042] Determine the column name corresponding to the effective replacement position of the field for avoiding desensitization parsing, and replace the data in the field corresponding to the column name with preset characters.

[0043] Compared with the prior art, the beneficial effect of the present invention lies in that the present invention determines the location information of the parsing field corresponding to the query request, compares the location information of each record field in the query record of the database terminal with the parsing field to construct a field set, determines the number of fields with the same permission level as the parsing field in the field set, determines whether the parsing field is a parsing field for avoiding desensitization, determines the effective replacement position, performs character replacement on the field at the effective replacement position for avoiding the desensitizing parsing field, and finally, outputs the parsing field with the character replacement completed, thereby realizing the identification of data theft behavior according to the permission characteristics and field characteristics of data access, and effectively avoids the theft of desensitized data samples of sensitive data and the leakage of sensitive data that may be caused by the association analysis of multiple desensitized data samples, thereby improving the security of data access.

[0044] In particular, the present invention determines the location information of the resolution field corresponding to the query request. Those skilled in the art can understand that the location of the resolution field corresponding to the query request can be accurately located by the library name, table name and column name. The present invention can quickly locate the location of the resolution content corresponding to the query request by determining the library name and table name where the resolution field is located, which is convenient for subsequent analysis and comparison.

[0045] In particular, the present invention constructs a field set based on the result of comparing the position information of each record field in the query record with the parsed field. Those skilled in the art can understand that in the actual data access process, multiple access requests to data in the same library name and the same table name may result in desensitized data samples obtained by different data desensitization methods. The behavior of obtaining desensitized data samples in the same library name and the same table name multiple times in a short period of time is suspected of stealing desensitized data samples of sensitive data. The present invention constructs a set of fields in the same library name and the same table name corresponding to the fields of the access request, thereby realizing the screening of data with obvious data representativeness.

[0046] In particular, the present invention determines whether the parsing field is a desensitization circumvention parsing field by determining the number of fields with the same permission level as the parsing field in the field set. Those skilled in the art can understand that data theft can obtain multiple desensitized data samples and perform correlation analysis and correlation inference with other information, and may deduce the format and content of sensitive data, resulting in the leakage of privacy data. In order to achieve joint analysis of multiple desensitized data samples, the desensitization degree of multiple desensitized data samples needs to be similar. Multiple desensitized data samples with similar desensitization degrees can be obtained by issuing query requests by logged-in users with the same permission level. The present invention compares the permission levels of users who issue query requests corresponding to fields in the same library name and the same table name, and calculates the ratio of the number of fields with the same permission level as the logged-in user corresponding to the parsing field in the field set to the total number of fields. The larger the ratio, the larger the number of desensitized data samples with similar desensitization degrees obtained, and the easier it is to circumvent data desensitization protection measures by correlation analysis and correlation inference of multiple desensitized data samples. The present invention effectively identifies data theft behavior and improves the security of data access based on the permission characteristics and field characteristics of data access.

[0047] In particular, the present invention determines the effective replacement position by the frequency of the replacement position where the characters are replaced in each record field in the field set. It can be understood by those skilled in the art that the position of the parsed field can be accurately located by the library name, table name and column name. The higher the frequency of character replacement in the record field at the current column name position, the more desensitized data samples in the representation query record that perform character replacement at the current column name position, the fewer data samples for data disclosure at the current column name position, the fewer desensitized data samples at a certain position in multiple desensitized data samples, the greater the difficulty of performing association analysis and association inference of desensitized data samples. The present invention determines the column name with a high frequency of character replacement as the effective replacement position and performs character replacement, thereby realizing the identification of data theft behavior according to the permission characteristics and field characteristics of data access, and effectively avoiding the theft of desensitized data samples of sensitive data and the leakage of sensitive data that may be caused by association analysis of multiple desensitized data samples, thereby improving the security of data access. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A step diagram of a data access method based on data authority and data security desensitization according to an embodiment of the present invention;

[0049] Figure 2 A diagram showing the steps of determining the location information of the parsed field corresponding to the query request according to an embodiment of the present invention;

[0050] Figure 3 A diagram showing the steps of obtaining query records of a database terminal within a preset time period according to an embodiment of the present invention;

[0051] Figure 4 A diagram of the steps for determining the number of fields according to an embodiment of the present invention;

[0052] Figure 5 The present invention provides a logic flow chart for determining whether a parsed field is a field for avoiding desensitization parsing according to an embodiment of the present invention. DETAILED DESCRIPTION

[0053] In order to make the objects and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with embodiments; it should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0054] The preferred embodiments of the present invention are described below with reference to the accompanying drawings. It should be understood by those skilled in the art that these embodiments are only used to explain the technical principles of the present invention and are not intended to limit the protection scope of the present invention.

[0055] It should be noted that, in the description of the present invention, terms such as "lower" and "inner" indicating directions or positional relationships are based on the directions or positional relationships shown in the drawings. This is only for the convenience of description and does not indicate or imply that the device or element must have a specific orientation, be constructed and operated in a specific orientation. Therefore, it cannot be understood as a limitation on the present invention.

[0056] See also Figure 1 As shown, it is a step diagram of a data access method based on data authority and data security desensitization according to an embodiment of the present invention. A data access method based on data authority and data security desensitization according to the present invention includes:

[0057] Step S100, in response to a query request sent by a logged-in user, determining location information of a parsed field corresponding to the query request, wherein the location information includes a library name and a table name;

[0058] Step S200, obtaining query records of the database terminal within a preset time period, performing position information comparison between each record field in the query record and the parsing field, and constructing a field set according to the result of the position information comparison, wherein the field set includes the parsing field and a plurality of record fields;

[0059] Step S300, obtaining a query request corresponding to the parsed field, determining the authority level corresponding to the logged-in user who sends the query request, and determining the number of fields in the field set that have the same authority level as the logged-in user corresponding to the parsed field, so as to determine whether the parsed field is a parsed field for avoiding desensitization;

[0060] Wherein, the permission level is set based on the data reading range;

[0061] Step S400, determining a replacement position where characters are replaced in each record field in the field set, determining an effective replacement position based on the adoption frequency of the replacement position, and performing character replacement on the field at the effective replacement position of the desensitization parsing avoidance field;

[0062] wherein the replacement position and the valid replacement position include a column name;

[0063] Step S500, outputting the parsed field after completing the character replacement.

[0064] Specifically, the permission level can be set according to the data reading scope. Those skilled in the art can understand that in a database management system, permission management is a core function, which allows system administrators or database administrators to assign different access rights according to the needs of users or user groups. The following are some common methods for setting permission levels according to data reading scopes. For example, a user ID with a high permission level has full access to all data. As the permission level decreases, the access content of the data can only be partially presented, and the inaccessible part increases. In the prior art, an appropriate permission control mechanism can be implemented according to pre-defined permission levels and user IDs. This can be achieved through access control lists (ACLs), role-based access control (RBAC) or other identity authentication and authorization mechanisms. This is a prior art and will not be repeated here.

[0065] Specifically, see Figure 2 As shown, it is a step diagram of determining the location information of the parsed field corresponding to the query request according to an embodiment of the present invention, and the step of determining the location information of the parsed field corresponding to the query request includes:

[0066] Step S101, pre-establishing an association relationship between each query request and a corresponding parsing field;

[0067] Step S102, determining the parsing field corresponding to the query request based on the association relationship;

[0068] Step S103, determining the target table and target database involved in the parsing field;

[0069] Step S104: determine the table name of the target table and the library name of the target database as the location information.

[0070] Specifically, in an embodiment of the present invention, the parsed field can be in a list of a SELECT statement, by parsing the FROM clause in the query request to determine the table name of the target table involved in the query request, or by using a metadata query function provided by a database management system, such as a system table, an information model, or a metadata view, to obtain the library name of the target database where the parsed field is located and the table name of the target table.

[0071] Specifically, the present invention determines the location information of the parsed field corresponding to the query request. Those skilled in the art can understand that the location of the parsed field corresponding to the query request can be accurately located by the library name, table name and column name. The present invention can quickly locate the location of the parsed content corresponding to the query request by determining the library name and table name where the parsed field is located, which is convenient for subsequent analysis and comparison.

[0072] Specifically, see Figure 3 As shown, it is a step diagram of obtaining query records of a database terminal within a preset time period according to an embodiment of the present invention. The step of obtaining query records of a database terminal within a preset time period includes:

[0073] Step S201, in response to the database terminal receiving the query request, determining the time corresponding to the query request as a reference time;

[0074] Step S202, determining a time period of a preset duration with the reference time as the end point of the time period;

[0075] Step S203, obtaining query records within the time period and record fields in the query records.

[0076] In the embodiment of the present invention, the preset duration of the time period can be set by a person skilled in the art according to the number of records obtained. Preferably, the preset duration can be set in the range of [1,6], with the unit being h.

[0077] Specifically, the process of building a field collection includes:

[0078] Compare the position information of each record field in the query record with the parsed field;

[0079] If the position information of the record field is different from that of the parsed field, no operation is performed on the record field;

[0080] If the position information of the record field is the same as that of the parsed field, the record field is added to the field set, and a data set constructed by a number of record fields having the same position information as that of the parsed field and the parsed field is determined as the field set.

[0081] Specifically, the present invention constructs a field set according to the result of comparing the position information of each record field in the query record with the parsed field. Those skilled in the art can understand that in the actual data access process, multiple access requests to data in the same library name and the same table name may result in desensitized data samples obtained by different data desensitization methods. The behavior of obtaining desensitized data samples in the same library name and the same table name multiple times in a short period of time is suspected of stealing desensitized data samples of sensitive data. The present invention constructs a set of fields in the same library name and the same table name corresponding to the access request, thereby realizing the screening of data with obvious data representativeness.

[0082] Specifically, the process of determining the corresponding permission level of the logged-in user includes:

[0083] The user ID of the logged-in user corresponding to the query request is obtained, and based on the pre-built association relationship between the user ID and the permission level, the permission level corresponding to the current user ID is queried.

[0084] Specifically, see Figure 4 As shown, it is a step diagram of determining the number of fields in an embodiment of the present invention, and the step of determining the number of fields includes:

[0085] Step S301, determining the query request corresponding to each record field in the field set, and determining the authority level corresponding to the login user who sends the query request;

[0086] Step S302, marking the record fields whose authority level is the same as the authority level of the logged-in user corresponding to the parsed field;

[0087] Step S303: determine the number of record fields to be marked as the field number.

[0088] Specifically, the present invention determines whether the parsing field is a desensitization circumvention parsing field by determining the number of fields with the same permission level as the parsing field in the field set. It can be understood by those skilled in the art that data theft can be carried out by obtaining multiple desensitized data samples and performing correlation analysis and correlation inference with other information, and it is possible to deduce the format and content of sensitive data, resulting in the leakage of privacy data. In order to realize the joint analysis of multiple desensitized data samples, the desensitization degree of multiple desensitized data samples needs to be similar. Multiple desensitized data samples with similar desensitization degree can be obtained by issuing query requests by logged-in users with the same permission level. The present invention compares the permission levels of users who issue query requests corresponding to the fields in the same library name and the same table name, and calculates the ratio of the number of fields with the same permission level as the logged-in user corresponding to the parsing field in the field set to the total number of fields. The larger the ratio, the larger the number of desensitized data samples with similar desensitization degree, and the easier it is to circumvent data desensitization protection means by correlation analysis and correlation inference of multiple desensitized data samples. The present invention effectively identifies data theft behavior and improves the security of data access based on the permission characteristics and field characteristics of data access.

[0089] Specifically, see Figure 5 As shown, it is a logic flow chart of determining whether a parsing field is a desensitization-avoiding parsing field according to an embodiment of the present invention. The process of determining whether the parsing field is a desensitization-avoiding parsing field includes:

[0090] Calculating a ratio of the number of fields to the total number of fields in the field set, and comparing the ratio with a preset ratio threshold;

[0091] If the ratio is less than or equal to the ratio threshold, it is determined that the parsing field is not a desensitization avoidance parsing field;

[0092] If the ratio is greater than the ratio threshold, the parsing field is determined to be a desensitization avoidance parsing field.

[0093] Preferably, in the embodiment of the present invention, the value range of the ratio threshold is [10%, 25%].

[0094] Specifically, the process of determining the replacement position where the characters in each record field are to be replaced includes:

[0095] The fields for character replacement of each record field in the field set are determined, the column names corresponding to the fields are determined based on the naming rules preset by the database terminal, and the column names are determined as the replacement positions.

[0096] Specifically, the naming rules of the database terminal need to keep the database clear and maintainable. Technical personnel in this field can try to ensure the consistency of table names and column names by using lowercase letters, using underscores to separate, etc. The naming rules of the database terminal are well known to technical personnel in this field and will not be repeated here.

[0097] Specifically, the process of determining effective replacement locations includes:

[0098] The frequency of each replacement position is determined based on the replacement positions for character replacement in each record field, and the replacement position corresponding to the maximum frequency is determined as the effective replacement position.

[0099] Specifically, the replacement position for character replacement in a record field can be accurately located by the library name, table name and column name of the database. Preferably, the column name information corresponding to the replacement position can be obtained by using an SQL statement, and the column names corresponding to the replacement position are counted to obtain the frequency of replacement of different column names in the replacement position for character replacement in several record fields.

[0100] Specifically, the present invention determines an effective replacement position by the frequency of use of the replacement position where characters are replaced in each record field in a field set. Those skilled in the art can understand that the position of the parsed field can be accurately located by the library name, table name and column name. The higher the frequency of character replacement in the record field at the current column name position, the more desensitized data samples in the representation query record that perform character replacement at the current column name position, the fewer data samples for data disclosure at the current column name position, the fewer desensitized data samples at a certain position in multiple desensitized data samples, and the greater the difficulty in performing association analysis and association inference of desensitized data samples. The present invention determines the column name with a high frequency of character replacement as an effective replacement position and performs character replacement, thereby realizing the identification of data theft behavior according to the permission characteristics and field characteristics of data access, and effectively avoiding the theft of desensitized data samples of sensitive data and the leakage of sensitive data that may be caused by association analysis of multiple desensitized data samples, thereby improving the security of data access.

[0101] Specifically, the process of replacing characters in the desensitization parsing avoidance field includes:

[0102] Determine the column name corresponding to the effective replacement position of the field for avoiding desensitization parsing, and replace the data in the field corresponding to the column name with preset characters.

[0103] Specifically, in an embodiment of the present invention, the preset character may be “*”, which is a commonly used character replacement method for data desensitization. This is a prior art and will not be described in detail here.

[0104] So far, the technical solutions of the present invention have been described in conjunction with the preferred embodiments shown in the accompanying drawings. However, it is easy for those skilled in the art to understand that the protection scope of the present invention is obviously not limited to these specific embodiments. Without departing from the principle of the present invention, those skilled in the art can make equivalent changes or substitutions to the relevant technical features, and the technical solutions after these changes or substitutions will fall within the protection scope of the present invention.

[0105] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A data access method based on data authority and data security desensitization, characterized in that: include: In response to a query request sent by a logged-in user, determine location information of a parsed field corresponding to the query request, wherein the location information includes a library name and a table name; Acquire query records of the database terminal within a preset time period, compare the position information of each record field in the query record with the parsed field, and construct a field set according to the result of the position information comparison, wherein the field set includes the parsed field and a plurality of record fields; Obtaining a query request corresponding to the parsed field, determining the permission level corresponding to the logged-in user who sent the query request, and determining the number of fields in the field set that have the same permission level as the logged-in user corresponding to the parsed field, so as to determine whether the parsed field is a parsed field for avoiding desensitization; Wherein, the permission level is set based on the data reading range; Determine a replacement position where characters are replaced in each record field in the field set, determine an effective replacement position based on the adoption frequency of the replacement position, and perform character replacement on the field at the effective replacement position of the field for avoiding desensitization parsing; wherein the replacement position and the valid replacement position include a column name; Outputs the parsed field with character replacement completed.

2. The data access method based on data authority and data security desensitization according to claim 1 is characterized in that: The step of determining the location information of the parsed field corresponding to the query request includes: Establishing in advance the association between each query request and the corresponding parsing field; Determine the parsing field corresponding to the query request based on the association relationship; Determine a target table and a target database involving the parsed field; The table name of the target table and the library name of the target database are determined as the location information.

3. The data access method based on data authority and data security desensitization according to claim 1 is characterized in that: The steps of obtaining the query records of the database terminal within a preset time period include: In response to the database terminal receiving the query request, determining the time corresponding to the query request as a reference time; Determine a time period of a preset length with the reference time as the end point of the time period; Get the query records within the time period and the record fields in the query records.

4. The data access method based on data authority and data security desensitization according to claim 3 is characterized in that: The process of building a field collection includes: Compare the position information of each record field in the query record with the parsed field; If the position information of the record field is the same as that of the parsed field, the record field is added to the field set, and a data set constructed by a number of record fields having the same position information as that of the parsed field and the parsed field is determined as the field set.

5. The data access method based on data authority and data security desensitization according to claim 1 is characterized in that: The process of determining the corresponding permission level of the logged-in user includes: The user ID of the logged-in user corresponding to the query request is obtained, and based on the pre-built association relationship between the user ID and the permission level, the permission level corresponding to the current user ID is queried.

6. The data access method based on data authority and data security desensitization according to claim 5 is characterized in that: The step of determining the number of fields comprises: Determine the query request corresponding to each record field in the field set, and determine the authority level corresponding to the logged-in user who sends the query request; Marking the record fields whose authority level is the same as the authority level of the logged-in user corresponding to the parsed field; The number of record fields to be marked is determined as the field number.

7. The data access method based on data authority and data security desensitization according to claim 6 is characterized in that: The process of determining whether the parsing field is a desensitization circumvention parsing field includes: Calculating a ratio of the number of fields to the total number of fields in the field set, and comparing the ratio with a preset ratio threshold; If the ratio is greater than the ratio threshold, the parsing field is determined to be a desensitization avoidance parsing field.

8. The data access method based on data authority and data security desensitization according to claim 1 is characterized in that: The process of determining the replacement position for each record field where character replacement is performed includes: The fields for character replacement of each record field in the field set are determined, the column names corresponding to the fields are determined based on the naming rules preset by the database terminal, and the column names are determined as the replacement positions.

9. The data access method based on data authority and data security desensitization according to claim 8 is characterized in that: The process of determining valid replacement locations includes: The frequency of each replacement position is determined based on the replacement positions for character replacement in each record field, and the replacement position corresponding to the maximum frequency is determined as the effective replacement position.

10. The data access method based on data authority and data security desensitization according to claim 9 is characterized in that: The process of replacing characters in the desensitization parsing avoidance field includes: Determine the column name corresponding to the effective replacement position of the field for avoiding desensitization parsing, and replace the data in the field corresponding to the column name with preset characters.

Images