Sensitive field desensitization method, device, equipment, storage medium and product

Abstract

The present application discloses a sensitive field desensitization method, apparatus, equipment, storage medium and product, relates to the field of computer technology, and discloses a sensitive field desensitization method, including: receiving desensitization configuration information sent by a target tenant terminal, wherein the target tenant terminal is any tenant terminal in the tenant terminal cluster; based on the desensitization configuration information, generating a target desensitization scheme for the target tenant terminal; based on the target desensitization scheme, desensitizing the sensitive fields of the target tenant terminal to obtain a desensitization result. The present application proposes a multi-tenant desensitization platform that provides each enterprise tenant with a flexibly configurable desensitization scheme by receiving the tenant-personalized desensitization configuration information sent by the target tenant terminal and generating a corresponding target desensitization scheme, so that the desensitization scheme is applicable to software programs with different logical architectures, thereby improving the applicability of the sensitive field desensitization scheme.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to methods, devices, equipment, storage media, and products for desensitizing sensitive fields. Background Art

[0002] With the development of the software industry, more and more companies are implementing desensitization for sensitive internal data, such as usernames, mobile phone numbers, license plates, addresses, and ID numbers, driven by data security needs. Companies typically add desensitization features during software development to desensitize the data within their applications.

[0003] In the related art, enterprise software programs typically use sensitive field masking solutions developed by developers to mask sensitive fields within the program. However, these sensitive field masking solutions are often only applicable to software programs with a fixed logical architecture within the enterprise. When the logical architecture of the enterprise data changes, or when software programs with different logical architectures require masking, these sensitive field masking solutions are not applicable. In other words, the applicability of the sensitive field masking solutions in the related art is poor.

[0004] The above content is only used to assist in understanding the technical solution of this application and does not constitute an admission that the above content is prior art. Summary of the Invention

[0005] The main purpose of this application is to provide a sensitive field desensitization method, aiming to solve the technical problem of poor applicability of sensitive field desensitization methods in related technologies.

[0006] To achieve the above objectives, the present application proposes a method for desensitizing sensitive fields, which includes:

[0007] Applied to a multi-tenant desensitization platform, the multi-tenant desensitization platform is communicatively connected to a tenant terminal cluster, the tenant terminal cluster includes multiple tenant terminals, and the sensitive field desensitization method includes:

[0008] Receiving desensitization configuration information sent by a target tenant terminal, wherein the target tenant terminal is any tenant terminal in the tenant terminal cluster;

[0009] Based on the desensitization configuration information, generating a target desensitization solution for the target tenant terminal;

[0010] Based on the target desensitization scheme, the sensitive fields of the target tenant terminal are desensitized to obtain a desensitization result.

[0011] Optionally, the step of performing desensitization processing on the sensitive fields of the target tenant terminal based on the target desensitization scheme to obtain a desensitization result includes:

[0012] receiving a user access request, wherein the user access request includes access interface information of the target tenant terminal, and the access interface information refers to information of an interface through which the user requires access to the target tenant terminal;

[0013] Determining, based on the user access request, interface data of a corresponding access interface in the access interface information;

[0014] Based on the target desensitization scheme, the sensitive fields of the interface data are located to obtain the sensitive fields of the target tenant terminal, and the sensitive fields of the target tenant terminal are desensitized to obtain a desensitization result.

[0015] Optionally, the target desensitization scheme includes desensitization conditions and desensitization rules. The step of locating sensitive fields of the interface data based on the target desensitization scheme, obtaining sensitive fields of the target tenant terminal, and desensitizing the sensitive fields of the target tenant terminal to obtain a desensitization result includes:

[0016] Determining whether the fields of the interface data meet the desensitization condition, and using the fields of the interface data that meet the desensitization condition as sensitive fields of the target tenant terminal;

[0017] Based on the desensitization rule, data is overwritten on the sensitive fields of the target tenant terminal through a preset rule executor to obtain the field result after data overwriting;

[0018] Perform a desensitization test on the field result after the data is covered to obtain a test result. If the test result is that the desensitization is successful, the field result that is successfully desensitized is used as the desensitization result.

[0019] Optionally, before the step of receiving a user access request, the method includes:

[0020] Extracting the interface interception annotation of the target tenant terminal from the target desensitization scheme;

[0021] The interface interception annotation is injected into the aspect-oriented programming (AOP) interface of the target tenant terminal, so as to intercept the user access request when the user access request is received.

[0022] Optionally, the step of performing desensitization processing on the sensitive fields of the target tenant terminal based on the target desensitization scheme to obtain a desensitization result includes:

[0023] Based on the target desensitization solution, the interface data of the target tenant terminal is subjected to layer-by-layer classification field identification to obtain target classification fields at each layer;

[0024] Performing a positioning operation on the parameter fields under the target classification fields of each level to obtain the parameter fields corresponding to the target classification fields of each level, performing sensitive field matching on the parameter fields to obtain the sensitive fields corresponding to the target classification fields of each level;

[0025] Desensitization is performed on the sensitive fields corresponding to the target classification fields at each level to obtain a desensitization result.

[0026] Optionally, the step of generating a target desensitization scheme for the target tenant terminal based on the desensitization configuration information includes:

[0027] Obtaining an initial desensitization configuration, wherein the initial request configuration includes an initial desensitization condition, an initial desensitization rule, and an initial desensitization field;

[0028] Based on the desensitization configuration information, the initial desensitization configuration is adjusted to obtain the target desensitization condition, target desensitization rule, and target desensitization field of the target tenant terminal;

[0029] The target desensitization condition, the target desensitization rule, and the target desensitization field are combined to generate a target desensitization solution for the target tenant terminal.

[0030] In addition, to achieve the above-mentioned purpose, the present application also proposes a sensitive field desensitization device, which includes:

[0031] A receiving module, configured to receive desensitization configuration information sent by a target tenant terminal, wherein the target tenant terminal is any tenant terminal in the tenant terminal cluster;

[0032] A generating module, configured to generate a target desensitization scheme for the target tenant terminal based on the desensitization configuration information;

[0033] The desensitization module is used to perform desensitization processing on the sensitive fields of the target tenant terminal based on the target desensitization scheme to obtain a desensitization result.

[0034] In addition, to achieve the above-mentioned purpose, the present application also proposes a sensitive field desensitization device, which includes: a memory, a processor, and a computer program stored on the memory and runnable on the processor, and the computer program is configured to implement the steps of the sensitive field desensitization method described above.

[0035] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium. A computer program is stored on the storage medium, and when the computer program is executed by the processor, the steps of the sensitive field desensitization method described above are implemented.

[0036] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements the steps of the sensitive field desensitization method described above.

[0037] One or more technical solutions proposed in this application have at least the following technical effects:

[0038] In the related art, enterprise software programs usually use sensitive field desensitization scripts developed by developers to desensitize sensitive fields within their programs. However, this sensitive field desensitization script is often only applicable to software programs with fixed logical architectures within the enterprise. When the logical architecture of the data within the enterprise changes, or when software programs with other different logical architectures require desensitization, the sensitive field desensitization script cannot be applied, that is, the poor applicability of the sensitive field desensitization method in the related art, this application receives the desensitization configuration information of the tenant's personalized configuration sent by the target tenant terminal through a multi-tenant desensitization platform, and generates a corresponding target desensitization scheme for the target tenant terminal. Finally, based on the target desensitization scheme, the sensitive fields of the target tenant terminal are desensitized to obtain a desensitization result. It is understandable that this application proposes a multi-tenant desensitization platform that provides a flexible desensitization scheme to each enterprise tenant by receiving the desensitization configuration information of the tenant's personalized configuration sent by the target tenant terminal and generating a corresponding target desensitization scheme. That is, the corresponding desensitization scheme is generated according to the desensitization configuration of the enterprise tenant's needs, so that its desensitization scheme is applicable to software programs with different logical architectures, thereby improving the applicability of the sensitive field desensitization scheme. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0040] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0041] Figure 1 A flowchart of the first embodiment of the sensitive field desensitization method provided in this application;

[0042] Figure 2 This is a schematic diagram of the functional module structure of the target desensitization solution in the sensitive field desensitization method of this application;

[0043] Figure 3 This is a schematic diagram of the desensitization process in the sensitive field desensitization method of this application;

[0044] Figure 4 A flowchart of the second embodiment of the sensitive field desensitization method provided in this application;

[0045] Figure 5 This is a schematic diagram of the module structure of the sensitive field desensitization device according to an embodiment of the present application;

[0046] Figure 6 This is a schematic diagram of the device structure of the hardware operating environment involved in the sensitive field desensitization method in the embodiment of the present application.

[0047] The purpose, features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0048] It should be understood that the specific embodiments described herein are merely used to explain the technical solutions of the present application and are not intended to limit the present application.

[0049] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0050] The main solution of the embodiment of the present application is: receiving desensitization configuration information sent by the target tenant terminal, wherein the target tenant terminal is any tenant terminal in the tenant terminal cluster; based on the desensitization configuration information, generating a target desensitization scheme for the target tenant terminal; based on the target desensitization scheme, desensitizing the sensitive fields of the target tenant terminal to obtain a desensitization result.

[0051] In this embodiment, the multi-tenant desensitizing platform is used as the execution entity.

[0052] In related art, enterprise software programs typically use developer-developed sensitive field desensitization solutions to desensitize sensitive fields within the program. However, these solutions are often only applicable to software programs with a fixed logical architecture within the enterprise. When the logical architecture of the enterprise data changes, or when desensitization is required for software programs with different logical architectures, these solutions are not applicable. This means that related art sensitive field desensitization solutions have poor applicability.

[0053] This application provides a solution to achieve desensitization of sensitive fields and improve the applicability of the sensitive field desensitization solution.

[0054] It can be seen from the above embodiments that the present application receives the desensitizing configuration information of the tenant's personalized configuration sent by the target tenant terminal through the multi-tenant desensitizing platform, and generates a corresponding target desensitizing scheme for the target tenant terminal, and finally desensitizes the sensitive fields of the target tenant terminal based on the target desensitizing scheme to obtain a desensitizing result. It is understandable that the present application proposes that the multi-tenant desensitizing platform provides each enterprise tenant with a flexibly configurable desensitizing scheme by receiving the desensitizing configuration information of the tenant's personalized configuration sent by the target tenant terminal and generating a corresponding target desensitizing scheme, that is, generating a corresponding desensitizing scheme according to the desensitizing configuration required by the enterprise tenant, so that its desensitizing scheme is applicable to software programs with different logical architectures, thereby improving the applicability of the sensitive field desensitization scheme.

[0055] It should be noted that the execution subject of this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, mobile phone, etc., or an electronic device or terminal system capable of implementing the above functions. The following uses a multi-tenant desensitization platform as an example to illustrate this embodiment and the following embodiments.

[0056] Based on this, the embodiment of the present application provides a method for desensitizing sensitive fields, referring to Figure 1 , Figure 1 This is a flowchart of the first embodiment of the sensitive field desensitization method of this application.

[0057] In this embodiment, the sensitive field desensitization method includes steps S100 to S300:

[0058] Step S100: receiving desensitization configuration information sent by a target tenant terminal, wherein the target tenant terminal is any tenant terminal in the tenant terminal cluster;

[0059] It should be noted that the sensitive field desensitization method of the present application is applied to a multi-tenant desensitization platform, and the multi-tenant desensitization platform is communicatively connected to a tenant terminal cluster, and the tenant terminal cluster includes multiple tenant terminals. It is understandable that the above multi-tenant desensitization platform adopts a multi-tenant shared application and data storage method, and logically isolates data access between tenants. Specifically, due to the fact that tenants with high data security such as military industry, banks and tenants of large group enterprises have different security levels of business sensitive information management and control methods, the present application proposes a multi-tenant desensitization platform to realize tenant-level enterprises to configure general or personalized desensitization solutions for different business sensitive information. The multi-tenant desensitization platform has the function of supporting tenant-level business sensitive data desensitization isolation, different users viewing customized desensitization, customized desensitization method for sensitive data, and back-end interface level data desensitization.

[0060] In a specific implementation, the target tenant terminal is any tenant terminal in the tenant terminal cluster, and the desensitization configuration information is the personalized desensitization configuration provided to the multi-tenant desensitization platform by an enterprise tenant that requires personalized configuration or a desensitization solution. The desensitization configuration information generally refers to the rules, policies, and technical means set during the data desensitization process. These configurations ensure the safe use of sensitive data in non-production environments or specific scenarios, preventing the risk of data leakage.

[0061] Step S200: generating a target desensitization solution for the target tenant terminal based on the desensitization configuration information;

[0062] In specific implementations, the target desensitization solution usually refers to a series of strategies and methods designed for specific data desensitization needs. The purpose is to properly process sensitive data while ensuring data security so that real information will not be leaked when used in non-production environments.

[0063] Specifically, refer to Figure 2 The target desensitization scheme is composed of a configuration module, a parsing module, and a desensitization module. The configuration module provides desensitization configuration, supports adding, modifying, and deleting desensitization configurations, and can configure desensitization conditions, desensitization fields, and desensitization rules. Through this module, tenant levels can be implemented, different desensitization rules can be configured, and tenant configuration can be personalized to meet the data security requirements and controls of the military, banking, and government industries. By configuring different desensitization conditions, user access to sensitive information can be desensitized, and different users can be supported to view data and return different desensitization methods. By configuring desensitization rules, personalized desensitization methods can be implemented, and the extension of desensitization rules can be supported. By configuring interface desensitization fields, custom interface return field desensitization can be implemented, and interface data desensitization can be quickly implemented.

[0064] Parsing module: used for parsing interface parameters, parsing return data fields, conditional parsing, parsing interface input parameters, returns and conditional rules.

[0065] Desensitization module: This module is used for annotation definition, AOP interface injection, loading the context for rule execution, and obtaining rule configurations that meet the conditions from the rule factory. This module is the core execution module, linking configuration and data parsing to complete the desensitization function.

[0066] It is understandable that the desensitizing configuration information only includes personalized desensitizing conditions, desensitizing rules, desensitizing fields and other information, and the target desensitizing scheme is to combine its desensitizing configuration information into an operational desensitizing scheme with data logic.

[0067] In a specific implementation, the multi-tenant desensitization platform generates a target desensitization solution for the target tenant terminal based on the desensitization configuration information, including:

[0068] Obtain an initial desensitization configuration, wherein the initial request configuration includes initial desensitization conditions, initial desensitization rules, and initial desensitization fields; based on the desensitization configuration information, adjust the initial desensitization configuration to obtain the target desensitization conditions, target desensitization rules, and target desensitization fields of the target tenant terminal; merge the target desensitization conditions, the target desensitization rules, and the target desensitization fields to generate a target desensitization scheme for the target tenant terminal.

[0069] In a specific implementation, the initial desensitization configuration is a universal desensitization configuration provided by a multi-tenant desensitization platform, that is, the configuration included in the universal desensitization configuration is a commonly used desensitization configuration, such as displaying only the first three and last four characters of a mobile phone number, displaying the surname of a two-character name, displaying the first and last one of a name with more than three characters, displaying the first three and last four characters of an ID card, displaying the first and last four characters of an email address, displaying the first and all characters after @, and displaying the first six and last four characters of a bank card. Specifically, the initial request configuration includes initial desensitization conditions, initial desensitization rules, and initial desensitization fields.

[0070] It should be noted that the initial desensitization configuration is a desensitization configuration proposed manually based on experiments or historical data. For multiple and different enterprise tenants, only minor adjustments need to be made to the initial desensitization configuration. There is no need to reconfigure and fill in multiple interfaces to be tested from scratch to achieve the generation of the target desensitization scheme, thereby improving the generation efficiency and accuracy of the target desensitization scheme. Specifically, the multi-tenant desensitization platform adjusts the initial desensitization configuration based on the desensitization configuration information, obtains the target desensitization conditions, target desensitization rules and target desensitization fields of the target tenant terminal, merges the target desensitization conditions, the target desensitization rules and the target desensitization fields, and generates the target desensitization scheme for the target tenant terminal.

[0071] Step S300: Based on the target desensitization solution, desensitize the sensitive fields of the target tenant terminal to obtain a desensitization result.

[0072] In a specific implementation, after generating a target desensitization scheme for the target tenant terminal, the multi-tenant desensitization platform desensitizes the sensitive fields of the target tenant terminal based on the target desensitization scheme to obtain a desensitization result. Data desensitization is an information security technology used to protect sensitive information and private data and prevent unauthorized access or leakage. It strategically modifies or replaces the original data to create a data copy that looks similar to the original data but does not contain real sensitive details for safe use in non-production environments such as development, testing, analysis or training. The purposes of data desensitization include protecting privacy, meeting compliance requirements, security testing, and reducing risks.

[0073] Furthermore, data desensitization is mainly divided into static data desensitization (Static Data Masking, SDM) and dynamic data desensitization (Dynamic Data Masking, DDM). Static data desensitization is usually used in non-real-time scenarios, such as desensitizing data in a production environment for use in a test environment. Dynamic data desensitization is often used in real-time scenarios such as production environments. It is desensitized while users access sensitive data. Different levels and types of desensitization are required when reading unified sensitive data according to different situations. This application is preferably dynamic data desensitization.

[0074] There are various implementation options for data desensitization, including but not limited to invalidation, random replacement, data substitution, symmetric encryption, averaging, offsetting, and rounding. These options can be selected and adjusted based on different business needs and data types to ensure that the desensitized data is both secure and meets business needs.

[0075] In a specific implementation, the step of performing desensitization processing on the sensitive fields of the target tenant terminal based on the target desensitization scheme to obtain a desensitization result includes:

[0076] Receive a user access request, wherein the user access request includes access interface information of the target tenant terminal, and the access interface information refers to information of the interface through which the user needs to access the target tenant terminal; based on the user access request, determine interface data of the corresponding access interface in the access interface information; based on the target desensitization scheme, locate sensitive fields of the interface data to obtain sensitive fields of the target tenant terminal, and desensitize the sensitive fields of the target tenant terminal to obtain a desensitization result.

[0077] In the specific implementation, the present application is specifically for dynamic interface data desensitization, that is, desensitization is performed while the user accesses sensitive data. First, after receiving the user access request, the multi-tenant desensitization platform starts data desensitization of the access interface required by the user access request. Specifically, the multi-tenant desensitization platform determines the interface data of the corresponding access interface in the access interface information, and finally locates the sensitive fields of the interface data based on the target desensitization scheme, obtains the sensitive fields of the target tenant terminal, and desensitizes the sensitive fields of the target tenant terminal to obtain the desensitization results, where the desensitization results specifically refer to the data results after desensitization.

[0078] In a specific implementation, the target desensitization scheme includes desensitization conditions and desensitization rules. Based on the target desensitization scheme, the sensitive fields of the interface data are located to obtain the sensitive fields of the target tenant terminal, and the sensitive fields of the target tenant terminal are desensitized to obtain the desensitization results. The steps include:

[0079] Determine whether the fields of the interface data meet the desensitization conditions, and use the fields of the interface data that meet the desensitization conditions as the sensitive fields of the target tenant terminal; based on the desensitization rules, perform data overwriting on the sensitive fields of the target tenant terminal through a preset rule executor to obtain the field results after data overwriting; perform desensitization detection on the field results after data overwriting to obtain a detection result. If the detection result is that the desensitization is successful, the field result of the successful desensitization is used as the desensitization result.

[0080] In a specific implementation, the target desensitization scheme includes desensitization conditions and desensitization rules, wherein the data desensitization conditions are a series of requirements and standards that need to be met when performing data desensitization to ensure that the data not only protects personal privacy and sensitive information during the desensitization process, but also meets business needs and compliance with laws and regulations; the desensitization rules are a set of strategies or standards in the data desensitization process, which are used to determine which data needs to be desensitized and how to perform the desensitization processing.

[0081] In a specific implementation, the multi-tenant desensitizing platform first determines whether the fields of the interface data meet the desensitizing conditions, and uses the fields of the interface data that meet the desensitizing conditions as the sensitive fields of the target tenant terminal, and then based on the desensitizing rules, the sensitive fields of the target tenant terminal are overwritten with data through a preset rule executor to obtain the field results after data coverage, wherein the field results after data coverage refer to the desensitized interface data. After determining the field results after data coverage, the multi-tenant desensitizing platform also needs to detect whether the field results after data coverage comply with the desensitizing rules and meet user needs. Only after the field results after data coverage are detected to be successfully desensitized, will it be used as the desensitized result.

[0082] In a specific implementation, before the step of the multi-tenant desensitization platform receiving the user access request, the method includes:

[0083] Extract the interface interception annotation of the target tenant terminal from the target desensitization scheme; inject the interface interception annotation into the aspect-oriented programming AOP interface of the target tenant terminal to intercept the user access request when the user access request is received.

[0084] In practice, annotation-based AOP interface injection typically refers to the use of annotations to identify and implement aspect-oriented programming (AOP). AOP is a key feature in the Spring Framework, allowing developers to separate cross-cutting concerns (such as logging and transaction management) from business logic, thereby reducing code coupling and improving code maintainability and reusability.

[0085] Furthermore, the target desensitization scheme has been configured with the interface interception annotation of the target tenant terminal. The multi-tenant desensitization platform extracts it and injects the aspect-oriented programming AOP interface of the target tenant terminal to intercept the user access request when it is received.

[0086] In the specific implementation, refer to Figure 3 , after the multi-tenant desensitizing platform injects the interface interception annotation into the aspect-oriented programming AOP interface of the target tenant terminal, when the user sends a user access request to the multi-tenant desensitizing platform, the user access request is intercepted and the interface data of the corresponding access interface in the access interface information is parsed (the interface data includes input parameters and output parameters), and then the user information (user permissions and other information) in the user access request is loaded into the context, where the context usually contains all the resources required by the application, such as database connections, message queues, service interfaces, etc., as well as the dependencies between them. The process of loading the context is to load these components and configuration information into memory, assemble them, and establish connections between them so that the application can run normally.

[0087] Furthermore, the desensitization conditions are obtained from the target desensitization scheme, and it is determined whether the fields of the interface data meet the desensitization conditions. The fields of the interface data that meet the desensitization conditions are used as the sensitive fields of the target tenant terminal. Then, the desensitization rules are obtained from the target desensitization scheme, and the sensitive fields of the target tenant terminal are overwritten with data through a preset rule executor to obtain the field results after data overwriting, and finally the field results after data overwriting are returned to the user end.

[0088] In the related art, enterprise software programs usually use sensitive field desensitization scripts developed by developers to desensitize sensitive fields within their programs. However, this sensitive field desensitization script is often only applicable to software programs with fixed logical architectures within the enterprise. When the logical architecture of the data within the enterprise changes, or when software programs with other different logical architectures require desensitization, the sensitive field desensitization script cannot be applied, that is, the poor applicability of the sensitive field desensitization method in the related art, this application receives the desensitization configuration information of the tenant's personalized configuration sent by the target tenant terminal through a multi-tenant desensitization platform, and generates a corresponding target desensitization scheme for the target tenant terminal. Finally, based on the target desensitization scheme, the sensitive fields of the target tenant terminal are desensitized to obtain a desensitization result. It is understandable that this application proposes a multi-tenant desensitization platform that provides a flexible desensitization scheme to each enterprise tenant by receiving the desensitization configuration information of the tenant's personalized configuration sent by the target tenant terminal and generating a corresponding target desensitization scheme. That is, the corresponding desensitization scheme is generated according to the desensitization configuration of the enterprise tenant's needs, so that its desensitization scheme is applicable to software programs with different logical architectures, thereby improving the applicability of the sensitive field desensitization scheme.

[0089] This application further proposes another embodiment based on the above first embodiment. Referring to the figure, the sensitive field desensitization method includes:

[0090] In a specific implementation, the multi-tenant desensitization platform desensitizes the sensitive fields of the target tenant terminal based on the target desensitization scheme, and obtains the desensitization result, including:

[0091] Step A100: Based on the target desensitization solution, perform layer-by-layer classification field identification on the interface data of the target tenant terminal to obtain target classification fields at each layer;

[0092] It should be noted that the interface data structure in the application programming interface design is usually nested or hierarchical. This data structure allows information to be logically grouped and can clearly represent complex relationships and attributes, that is, multi-level interface data. Taking into account the complexity of the multi-level interface data, this application proposes a multi-tenant desensitization platform to desensitize the interface data layer by layer to improve the accuracy of the interface data desensitization in order to prevent the omission of individual interface data in the multi-level structure.

[0093] In a specific implementation, the multi-tenant desensitizing platform performs layer-by-layer classification field identification on the interface data of the target tenant terminal based on the target desensitizing scheme to obtain the target classification fields at each layer, wherein the layer-by-layer classification field identification refers to the test platform identifying the fields about classification attributes in the interface data at each layer. For example, the interface data includes: class, Class 3, Grade 7, name, Zhang San, wherein the "class" and "name" fields are both target classification fields, and the "class" field is the target classification field of the first layer, and the "name" field is the target classification field of the second layer.

[0094] Step A200: performing a positioning operation on the parameter fields under the target classification fields of each level to obtain the parameter fields corresponding to the target classification fields of each level, performing sensitive field matching on the parameter fields to obtain the sensitive fields corresponding to the target classification fields of each level;

[0095] In a specific implementation, each target classification field is followed by one or more parameter fields. The test platform performs field matching on the parameter fields to obtain the parameter fields corresponding to the target classification fields at each level. The parameter fields are the demand desensitization fields. In this embodiment, the multi-tenant desensitization platform matches or locates all the parameter fields at each level successfully, and then performs sensitive field matching on the parameter fields to obtain the sensitive fields corresponding to the target classification fields at each level.

[0096] Step A300: Desensitizing the sensitive fields corresponding to the target classification fields at each level to obtain desensitizing results.

[0097] In the specific implementation, the multi-tenant desensitization platform desensitizes the sensitive fields corresponding to the target classification fields at each level to obtain the desensitization results, that is, it desensitizes the interface data layer by layer, thereby improving the accuracy of interface data desensitization.

[0098] It should be noted that the above examples are only used to understand this application and do not constitute a limitation on the method for desensitizing sensitive fields of this application. More simple transformations based on this technical concept are all within the scope of protection of this application.

[0099] This application also provides a sensitive field desensitization device, please refer to Figure 5 , the sensitive field desensitization device includes:

[0100] A receiving module 10 is configured to receive desensitization configuration information sent by a target tenant terminal, wherein the target tenant terminal is any tenant terminal in the tenant terminal cluster;

[0101] A generating module 20, configured to generate a target desensitization solution for the target tenant terminal based on the desensitization configuration information;

[0102] The desensitization module 30 is configured to perform desensitization processing on the sensitive fields of the target tenant terminal based on the target desensitization solution to obtain a desensitization result.

[0103] Optionally, the desensitization module 30 includes:

[0104] a request receiving module, configured to receive a user access request, wherein the user access request includes access interface information of the target tenant terminal, and the access interface information refers to information about the interface through which the user requires access to the target tenant terminal;

[0105] a determination module, configured to determine interface data of a corresponding access interface in the access interface information based on the user access request;

[0106] A positioning module is used to locate the sensitive fields of the interface data based on the target desensitization scheme, obtain the sensitive fields of the target tenant terminal, and desensitize the sensitive fields of the target tenant terminal to obtain a desensitization result.

[0107] Optionally, the positioning module includes:

[0108] a judgment module, configured to judge whether the fields of the interface data meet the desensitization condition, and use the fields of the interface data that meet the desensitization condition as sensitive fields of the target tenant terminal;

[0109] A covering module is used to cover the sensitive fields of the target tenant terminal based on the desensitization rule through a preset rule executor to obtain a field result after data coverage;

[0110] The detection module is used to perform desensitization detection on the field results after the data is covered to obtain a detection result. If the detection result is that the desensitization is successful, the field result that is successfully desensitized is used as the desensitization result.

[0111] Optionally, the sensitive field desensitizing device further includes:

[0112] An extraction module, configured to extract the interface interception annotation of the target tenant terminal from the target desensitization solution;

[0113] The injection module is used to inject the interface interception annotation into the aspect-oriented programming (AOP) interface of the target tenant terminal, so as to intercept the user access request when the user access request is received.

[0114] Optionally, the desensitization module 30 further includes:

[0115] A field identification module is used to perform layer-by-layer classification field identification on the interface data of the target tenant terminal based on the target desensitization scheme to obtain target classification fields at each layer;

[0116] A field locating module is used to perform a locating operation on the parameter fields under the target classification fields of each level to obtain the parameter fields corresponding to the target classification fields of each level, and perform sensitive field matching on the parameter fields to obtain the sensitive fields corresponding to the target classification fields of each level;

[0117] The sensitive field desensitization module is used to desensitize the sensitive fields corresponding to the target classification fields of each level to obtain desensitization results.

[0118] Optionally, the generating module 20 includes:

[0119] A configuration acquisition module is used to obtain an initial desensitization configuration, wherein the initial request configuration includes an initial desensitization condition, an initial desensitization rule, and an initial desensitization field;

[0120] An adjustment module, configured to adjust the initial desensitization configuration based on the desensitization configuration information to obtain a target desensitization condition, a target desensitization rule, and a target desensitization field for the target tenant terminal;

[0121] A merging module is used to merge the target desensitization condition, the target desensitization rule and the target desensitization field to generate a target desensitization solution for the target tenant terminal.

[0122] The sensitive field desensitization device provided in this application adopts the sensitive field desensitization method in the above-mentioned embodiment to solve the technical problem of sensitive field desensitization. Compared with the prior art, the beneficial effects of the sensitive field desensitization device provided in this application are the same as those of the sensitive field desensitization method provided in the above-mentioned embodiment, and the other technical features of the sensitive field desensitization device are the same as those disclosed in the above-mentioned embodiment method, and are not further described here.

[0123] The present application provides a sensitive field desensitizing device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the sensitive field desensitizing method in the above-mentioned embodiment one.

[0124] Reference below Figure 6, which shows a schematic structural diagram of a sensitive field desensitization device suitable for implementing an embodiment of the present application. The sensitive field desensitization device in the embodiment of the present application may include, but is not limited to, mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 6 The sensitive field desensitizing device shown is merely an example and should not impose any limitations on the functions and scope of use of the embodiments of the present application.

[0125] like Figure 6 As shown, the sensitive field desensitization device may include a processing device 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes based on programs stored in a read-only memory (ROM) 1002 or programs loaded from a storage device 1003 into a random access memory (RAM) 1004. RAM 1004 also stores various programs and data required for the operation of the sensitive field desensitization device. The processing device 1001, ROM 1002, and RAM 1004 are connected to each other via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the sensitive field desensitization device to communicate wirelessly or wired with other devices to exchange data. Although the figure shows a sensitive field desensitization device with various systems, it should be understood that it is not required to implement or have all of the systems shown. More or fewer systems can be implemented or provided instead.

[0126] In particular, according to the embodiments disclosed in the present application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, the embodiments disclosed in the present application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program comprising program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network via a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0127] The sensitive field desensitization device provided in this application adopts the sensitive field desensitization method in the above embodiment to solve the technical problem of sensitive field desensitization. Compared with the prior art, the beneficial effects of the sensitive field desensitization device provided in this application are the same as the beneficial effects of the sensitive field desensitization method provided in the above embodiment, and the other technical features of the sensitive field desensitization device are the same as those disclosed in the method of the previous embodiment, and are not further described here.

[0128] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0129] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0130] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, a computer program) stored thereon, and the computer-readable program instructions are used to execute the sensitive field desensitization method in the above-mentioned embodiment.

[0131] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0132] The above-mentioned computer-readable storage medium may be included in the sensitive field desensitizing device; or it may exist independently without being assembled into the sensitive field desensitizing device.

[0133] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by the sensitive field desensitizing device, the sensitive field desensitizing device can perform the following steps: desensitize the sensitive field.

[0134] Computer program code for performing the operations of the present application may be written in one or more programming languages, or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on the remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0135] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram can represent a module, program segment or a part of code, and the module, program segment or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order than that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the specified function or operation, or can be implemented by a combination of dedicated hardware and computer instructions.

[0136] The modules described in the embodiments of the present application may be implemented in software or hardware, wherein the name of a module does not necessarily limit the unit itself.

[0137] The readable storage medium provided in this application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., a computer program) for executing the above-mentioned sensitive field desensitization method, and can solve the technical problem of sensitive field desensitization. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the sensitive field desensitization method provided in the above embodiment, and will not be repeated here.

[0138] The present application also provides a computer program product, including a computer program, which implements the steps of the sensitive field desensitization method as described above when executed by a processor.

[0139] The computer program product provided in this application can solve the technical problem of desensitizing sensitive fields. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the sensitive field desensitization method provided in the above embodiment, and will not be repeated here.

[0140] The above description is only part of the embodiments of the present application and does not limit the patent scope of the present application. All equivalent structural transformations made by using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect application in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A method for desensitizing sensitive fields, characterized in that: Applied to a multi-tenant desensitization platform, the multi-tenant desensitization platform is communicatively connected to a tenant terminal cluster, the tenant terminal cluster includes multiple tenant terminals, and the sensitive field desensitization method includes: Receiving desensitization configuration information sent by a target tenant terminal, wherein the target tenant terminal is any tenant terminal in the tenant terminal cluster; Based on the desensitization configuration information, generating a target desensitization solution for the target tenant terminal; Based on the target desensitization scheme, desensitizing the sensitive fields of the target tenant terminal to obtain a desensitization result; The step of performing desensitization processing on the sensitive fields of the target tenant terminal based on the target desensitization scheme to obtain a desensitization result includes: receiving a user access request, wherein the user access request includes access interface information of the target tenant terminal, and the access interface information refers to information of an interface through which the user requires access to the target tenant terminal; Determining, based on the user access request, interface data of a corresponding access interface in the access interface information; Based on the target desensitization scheme, locating sensitive fields of the interface data to obtain sensitive fields of the target tenant terminal, and desensitizing the sensitive fields of the target tenant terminal to obtain a desensitization result; Before the step of receiving a user access request, the method includes: Extracting the interface interception annotation of the target tenant terminal from the target desensitization scheme; Injecting the interface interception annotation into the aspect-oriented programming (AOP) interface of the target tenant terminal to intercept the user access request when receiving the user access request; The step of performing desensitization processing on the sensitive fields of the target tenant terminal based on the target desensitization scheme to obtain a desensitization result includes: Based on the target desensitization solution, the interface data of the target tenant terminal is subjected to layer-by-layer classification field identification to obtain target classification fields at each layer; Performing a positioning operation on the parameter fields under the target classification fields of each level to obtain the parameter fields corresponding to the target classification fields of each level, performing sensitive field matching on the parameter fields to obtain the sensitive fields corresponding to the target classification fields of each level; Desensitization is performed on the sensitive fields corresponding to the target classification fields at each level to obtain a desensitization result.

2. The sensitive field desensitization method according to claim 1, characterized in that: The target desensitization scheme includes desensitization conditions and desensitization rules. The steps of locating sensitive fields of the interface data based on the target desensitization scheme, obtaining sensitive fields of the target tenant terminal, and desensitizing the sensitive fields of the target tenant terminal to obtain a desensitization result include: Determining whether the fields of the interface data meet the desensitization condition, and using the fields of the interface data that meet the desensitization condition as sensitive fields of the target tenant terminal; Based on the desensitization rule, data is overwritten on the sensitive fields of the target tenant terminal through a preset rule executor to obtain the field result after data overwriting; Perform a desensitization test on the field result after the data is covered to obtain a test result. If the test result is that the desensitization is successful, the field result that is successfully desensitized is used as the desensitization result.

3. The sensitive field desensitization method according to claim 1, characterized in that: The step of generating a target desensitization solution for the target tenant terminal based on the desensitization configuration information includes: Obtaining an initial desensitization configuration, wherein the initial desensitization configuration includes an initial desensitization condition, an initial desensitization rule, and an initial desensitization field; Based on the desensitization configuration information, the initial desensitization configuration is adjusted to obtain the target desensitization condition, target desensitization rule, and target desensitization field of the target tenant terminal; The target desensitization condition, the target desensitization rule, and the target desensitization field are combined to generate a target desensitization solution for the target tenant terminal.

4. A sensitive field desensitization device, characterized in that: The device comprises: A receiving module, configured to receive desensitization configuration information sent by a target tenant terminal, wherein the target tenant terminal is any tenant terminal in the tenant terminal cluster; A generating module, configured to generate a target desensitization scheme for the target tenant terminal based on the desensitization configuration information; A desensitization module, configured to perform desensitization processing on the sensitive fields of the target tenant terminal based on the target desensitization scheme to obtain a desensitization result; The step of performing desensitization processing on the sensitive fields of the target tenant terminal based on the target desensitization scheme to obtain a desensitization result includes: receiving a user access request, wherein the user access request includes access interface information of the target tenant terminal, and the access interface information refers to information of an interface through which the user requires access to the target tenant terminal; Determining, based on the user access request, interface data of a corresponding access interface in the access interface information; Based on the target desensitization scheme, locating sensitive fields of the interface data to obtain sensitive fields of the target tenant terminal, and desensitizing the sensitive fields of the target tenant terminal to obtain a desensitization result; Before the step of receiving the user access request, the method includes: Extracting the interface interception annotation of the target tenant terminal from the target desensitization scheme; Injecting the interface interception annotation into the aspect-oriented programming (AOP) interface of the target tenant terminal to intercept the user access request when receiving the user access request; The step of performing desensitization processing on the sensitive fields of the target tenant terminal based on the target desensitization scheme to obtain a desensitization result includes: Based on the target desensitization solution, the interface data of the target tenant terminal is subjected to layer-by-layer classification field identification to obtain target classification fields at each layer; Performing a positioning operation on the parameter fields under the target classification fields of each level to obtain the parameter fields corresponding to the target classification fields of each level, performing sensitive field matching on the parameter fields to obtain the sensitive fields corresponding to the target classification fields of each level; Desensitization is performed on the sensitive fields corresponding to the target classification fields at each level to obtain a desensitization result.

5. A sensitive field desensitization device, characterized in that: The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the sensitive field desensitization method according to any one of claims 1 to 3.

6. A storage medium, characterized in that The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the sensitive field desensitization method according to any one of claims 1 to 3 are implemented.

7. A computer program product, characterized in that The computer program product includes a computer program, and when the computer program is executed by a processor, the steps of the sensitive field desensitization method according to any one of claims 1 to 3 are implemented.

Images