Data desensitization method and device, computing equipment and computer readable storage medium

Abstract

The embodiment of the invention provides a data desensitization method and device, computing equipment and a computer readable storage medium, and the method comprises the steps: monitoring a target operation on a file in a kernel, and determining a sensitive file corresponding to the monitored target operation; wherein the target operation can enable a file to carry sensitive data; searching sensitive data in the sensitive file; and performing desensitization processing on the sensitive data in the sensitive file. The method can improve the data desensitization effect.

Description

Technical Field

[0001] The embodiments of this specification relate to the field of computer technology, and in particular to a data desensitization method, as well as a data desensitization apparatus, a computing device, a computer-readable storage medium, and a computer program product. Background Art

[0002] With the development of computer technology, various applications are widely used, and different objects can use applications to transmit different types of data.

[0003] The normal operation of the application requires the support of the corresponding backend server. When the backend server opens a file or writes data to a file based on the application, it is very likely to carry sensitive data such as passwords and access keys, and the transmission of the file will lead to the leakage of sensitive data. In the related art, after the backend server opens a file or writes data to a file based on the application, it will manually check whether each file contains sensitive data, and then desensitize the sensitive data found.

[0004] However, due to the high frequency of file operations based on applications in the back-end server and the large number of files operated, the efficiency of data desensitization by manually checking files is low, and there is a high possibility of omissions, resulting in poor data desensitization results. Summary of the invention

[0005] The embodiments of this specification provide a data desensitization method, which can improve the data desensitization effect. One or more embodiments of this specification also relate to a data desensitization device, a computing device, a computer-readable storage medium and a computer program product.

[0006] According to one aspect of an embodiment of this specification, a data desensitization method is provided, including:

[0007] Monitoring a target operation performed on a file in the kernel, and determining a sensitive file targeted by the monitored target operation; wherein the target operation can cause the file to carry sensitive data;

[0008] Searching for sensitive data in the sensitive files;

[0009] Desensitizing is performed on the sensitive data in the sensitive file.

[0010] According to another aspect of an embodiment of this specification, a data desensitization device is provided, including:

[0011] A monitoring module, used to monitor target operations performed on files in the kernel, and determine sensitive files targeted by the monitored target operations; wherein the target operations can cause the files to carry sensitive data;

[0012] A search module, used to search for sensitive data in the sensitive file;

[0013] A processing module is used to perform desensitization processing on the sensitive data in the sensitive file.

[0014] According to another aspect of the embodiments of this specification, there is provided a computing device, including: a memory and a processor;

[0015] The memory is used to store computer programs / instructions, and the processor is used to execute the computer programs / instructions. When the computer programs / instructions are executed by the processor, the steps of the above method are implemented.

[0016] According to another aspect of the embodiments of this specification, a computer-readable storage medium is provided, which stores a computer program / instruction, and the steps of the above method are implemented when the computer program / instruction is executed by a processor.

[0017] According to another aspect of the embodiments of this specification, a computer program product is provided, including a computer program / instruction, and when the computer program / instruction in the computer program product is executed in a processor, the steps of the above method are implemented.

[0018] In one embodiment of the present specification, the target operation on the file can be monitored in the kernel, the monitored sensitive file can be determined, and then the sensitive data in the sensitive file can be desensitized. In this way, when operating on the file, the sensitive file with sensitive data can be directly located, and the file identification can be performed in the kernel, which can ensure the accuracy of the identified file, and then the sensitive data can be desensitized, which can perform data desensitization faster and more accurately, and improve the data desensitization effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 It is a flow chart of a data desensitization method provided by an embodiment of this specification;

[0020] Figure 2 It is a structural schematic diagram of a data desensitization device provided by an embodiment of this specification;

[0021] Figure 3 It is a structural block diagram of a computing device provided by an embodiment of this specification. DETAILED DESCRIPTION

[0022] Many specific details are described in the following description to facilitate a full understanding of this specification. However, this specification can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of this specification, so this specification is not limited to the specific implementation disclosed below.

[0023] The terms used in one or more embodiments of this specification are for the purpose of describing specific embodiments only and are not intended to limit one or more embodiments of this specification. The singular forms of "one", "said" and "the" used in one or more embodiments of this specification and the appended claims are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in one or more embodiments of this specification refers to and includes any or all possible combinations of one or more associated listed items. The term "at least one" in one or more embodiments of this specification refers to "one or more", and "multiple" refers to "two or more". The term "including" is an open description and should be understood as "including but not limited to", and may include other content on the basis of the content already described.

[0024] It should be understood that although the terms "first", "second", etc. may be used to describe various information in one or more embodiments of this specification, this information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of one or more embodiments of this specification, "first" may also be referred to as "second", and similarly, "second" may also be referred to as "first". Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0025] In addition, the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in one or more embodiments of this specification are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant standards and requirements, and corresponding operation entrances are provided for users to choose to authorize or refuse.

[0026] At present, the code development of applications relies on a large number of third-party code libraries, and the behavior of third-party code libraries is not completely controlled. Some of them will inevitably output sensitive information such as passwords and access keys to log files when the application starts the code. There is a risk of leaking sensitive data of the application. For example, the normal operation of an application usually relies on the support provided by the service running in its corresponding back-end server. When the back-end server opens a file or writes data to a file based on the application, it is very likely to carry sensitive data such as passwords and access keys, causing the leakage of sensitive data. In related technologies, the application will be modified to replace components with security risks; or after the application is started, the files operated by it will be manually located to check whether they have sensitive data, and then the sensitive data found will be deleted.

[0027] However, in these solutions, the transformation of applications will require a longer release cycle, and some components may not be replaced. The transformation of old applications is also difficult, so the effect of reducing the risk of sensitive data leakage through this method is poor. The method of manually locating sensitive data after the application is started and then manually deleting it will cause the application to have a delay of several minutes, accompanied by problems such as missed deletion and accidental deletion. At the same time, the operator will also become a risk point for sensitive data leakage, so the effect of reducing the risk of sensitive data leakage through this method is also poor.

[0028] Secondly, the manual operation solution is not suitable for containerized applications. Due to the characteristics of elastic expansion and contraction, the files generated by containerized applications will be directly deleted when they are fully loaded or fail, and a new file will be rebuilt. The file identification will also change dynamically, making it difficult to accurately determine the files to be checked manually. Due to the deletion and reconstruction of containers, the behavior of opening or writing sensitive logs will be more frequent, which will lead to a higher risk of sensitive data leakage in files. In addition, the number of files in containerized applications is huge, and the workload of manually checking each file one by one is too large. In addition, containerized applications may be started and stopped unplanned, which further increases the difficulty of manual cleanup.

[0029] The embodiments of this specification provide a data desensitization method, which can improve the data desensitization effect. This specification also relates to a data desensitization device, a computing device, a computer-readable storage medium and a computer program product, which will be described in detail one by one in the following embodiments. The data desensitization method can be performed by the data desensitization device or computing device. The data desensitization device and computing device can be a server-side device, such as a back-end server corresponding to an application, and the back-end server is connected to the terminal device for communication, and is used to provide support for the operation of the application installed in the terminal device. The data desensitization device and computing device may not correspond to the application installed in the terminal device, which is not limited here. The back-end server may run a service corresponding to the application to provide corresponding information to the terminal device to realize the various functions of the application. Or the data desensitization device or computing device may also be a terminal device such as a smart phone, a desktop computer or a laptop computer.

[0030] Figure 1 1 is a flow chart of a data desensitization method provided in an embodiment of this specification, which can be applied to a data desensitization device. Figure 1 As shown, the data desensitization method includes the following steps 102 to 106.

[0031] Step 102: monitor the target operation on the file in the kernel, and determine the sensitive file targeted by the monitored target operation; wherein the target operation can cause the file to carry sensitive data.

[0032] The data desensitization device can first determine the target operation that can cause the file to carry sensitive data. For example, the target operation can be pre-specified by business personnel, or it can be obtained based on the analysis of the generation of historical sensitive data. Afterwards, file monitoring is performed based on the target operation, and the target operation performed on the file is monitored in the operating system kernel of the data desensitization device. This monitoring is to monitor the system call corresponding to the target operation, that is, to monitor the file that has undergone the target operation. The file can be a file in text format, and optionally, it can also include files in other formats, which are not limited here. By monitoring the data desensitization device, the files that have undergone the target operation can be determined. The files that have undergone the target operation are considered to have the risk of carrying sensitive data, and these monitored files can be determined as sensitive files.

[0033] In some embodiments, the target operation may be triggered by an application, such as a data desensitizing device as a back-end server corresponding to an application installed in a terminal device, and the target operation may be triggered by the operation of a service in the data desensitizing device for supporting the application. The data desensitizing device may not be a back-end server corresponding to a certain application, and an application may be installed in the data desensitizing device, and the target operation may be triggered by the application. This description embodiment takes the target operation including an open operation and / or a write operation as an example. Accordingly, in step 102, the data desensitizing device may monitor the open operation and / or write operation performed on the file based on the application in the kernel. Since some codes of the application may use codes in a third-party code library, these codes may bring the risk of leakage of sensitive data, and these codes may open files or write data in files when running, so the data desensitizing device may monitor sensitive files based on the application and the open and write operations. The application may perform target operations on files based on paths in the form of open or openat.

[0034] In some embodiments, the application may be a containerized application, and accordingly, monitoring the target operation on the file based on the application in the kernel in step 102 includes: monitoring the target operation on the file based on the containerized application in the kernel. The containerized application may be orchestrated and generated based on the Kubernetes platform, which is an open source platform for managing containerized workloads and services.

[0035] In the embodiments of this specification, the data desensitization device can be a host machine (Host Machine). The host machine refers to a physical computer or server running virtualization software (such as VMware, VirtualBox, Docker, etc.). In a virtualized environment, the host machine is responsible for providing hardware resources (such as CPU, memory, disk, network, etc.) to the virtual machine (Guest Machine) for use. The virtual machine is a simulated computer running on the host machine. It has its own operating system and application, but all operations are performed on the resources provided by the host machine. In the embodiments of this specification, the application (such as a containerized application) targeted by the monitoring target operation can be an application installed on the virtual machine.

[0036] Since each container corresponding to the containerized application is virtualized on the host machine's operating system, all containerized files generated by the server's operating system will eventually fall on the operating system's hard disk through virtualization technology. By monitoring the target operations of the containerized application on the file from the operating system kernel, the impact of the file operation on the physical space can be directly located, avoiding changes in the container file's identification and deletion and reconstruction of the container, which makes it impossible to accurately locate the file at the container level. In this way, sensitive files that may contain sensitive data can also be accurately determined for containerized applications, ensuring the accuracy of sensitive file determination and reducing the complexity of determination.

[0037] In the embodiment of this specification, the monitoring module running in the kernel state of the data desensitization device can be used to monitor the target operation. When a task (process) executes a system call and falls into the kernel code for execution, the process is said to be in the kernel running state (referred to as kernel state). When the process is executing the user's own code, it is said to be in the user running state (referred to as user state). In the embodiment of this specification, the target operation for the file is a system call. Optionally, the monitoring module can be implemented based on the eBPF (Extended Berkeley Packet Filter) program. eBPF is a powerful programming framework designed to run sandbox programs safely in the Linux kernel without modifying the kernel code. It is widely used in the fields of next-generation network implementation, observability and security functions. For example, the eBPF program can be used to insert piles for monitoring in each stage of the kernel of the operating system of the data desensitization device.

[0038] In the embodiments of this specification, the format of the file targeted by the target operation can also be limited, such as the file can be a text file, which has a greater risk of data leakage. Optionally, the file can also be in other formats, such as video format or audio format, which is not limited here.

[0039] In some embodiments, the file information required for sensitive files with a high probability of containing sensitive data can be pre-set, and the data desensitization device can perform file monitoring in combination with the file information and the target operation to determine more accurate sensitive files. Accordingly, before monitoring the target operation performed on the file in the kernel in step 102, the data desensitization method can also include: obtaining the file information possessed by the file containing sensitive data; accordingly, monitoring the target operation performed on the file in the kernel in step 102 includes: monitoring the target operation in the kernel for the file containing the file information. In this way, the data desensitization device can only perform targeted monitoring on some files to avoid wasting computing resources. For example, the file information may include a file identifier, such as a file name. The file name can be derived based on an analysis of the historical existence of sensitive data.

[0040] In the embodiments of the present specification, files with specified file information are monitored directly based on the monitoring module installed in the kernel without traversing all files on the disk, thereby avoiding adding additional overhead to the operating system of the data desensitizing device or the entire server, ensuring that the monitoring speed of sensitive files is faster and reducing monitoring overhead.

[0041] Step 104: Search for sensitive data in sensitive files.

[0042] After the data desensitizing device determines the sensitive file that may contain sensitive data by monitoring the target operation in the kernel, it can further detect the content of the sensitive file to determine whether the sensitive file actually contains sensitive data.

[0043] In some implementations, a data format that the sensitive data satisfies may be preset, and the data format may be obtained based on analysis of historical sensitive data. Accordingly, before step 104, the data desensitization method may further include: obtaining a sensitive data format; accordingly, searching for sensitive data in a sensitive file in step 104 includes: searching for sensitive data that satisfies the sensitive data format in the sensitive file.

[0044] Step 106: Desensitize the sensitive data in the sensitive file.

[0045] After determining the sensitive data in the sensitive file, the data desensitization device can replace the sensitive data with non-sensitive characters to achieve desensitization of the sensitive data. For example, the character string used for replacement can be pre-specified by a business person, or can also be generated randomly or in a set manner by the data desensitization device.

[0046] In some embodiments, the desensitization device can monitor sensitive files using a monitoring module running in kernel state, and desensitize sensitive data in sensitive files using a desensitization module running in user state. Accordingly, in step 102, the target operation performed on the file is monitored in the kernel, and the sensitive file targeted by the monitored target operation is determined, including: using a monitoring module running in kernel state, monitoring the target operation performed on the file in the kernel, and determining the sensitive file targeted by the monitored target operation.

[0047] The data desensitization method provided in the embodiment of this specification also includes: using the monitoring module to transmit the information of the sensitive file to the desensitization module running in the user state. For example, the monitoring module can transmit the information of the sensitive file to the desensitization module running in the user state through the shared storage space. The monitoring module can store the information of the sensitive file in the shared storage space, and the desensitization module obtains the information of the sensitive file stored in the shared storage space, so that the monitoring module can transmit the information of the sensitive file to the desensitization module running in the user state.

[0048] Step 104 and step 106 are performed by the desensitization module. In step 104, searching for sensitive data in sensitive files may include: using the desensitization module to determine sensitive files based on information of sensitive files, and searching for sensitive data in sensitive files. In step 106, performing desensitization processing on sensitive data in sensitive files may include: using the desensitization module to perform desensitization processing on sensitive data in sensitive files.

[0049] In some embodiments, the information of the sensitive file obtained by the monitoring module may include at least one of: information of the application to which the sensitive file belongs, the file name of the sensitive file, and the file handle of the sensitive file. After monitoring the sensitive file, the monitoring module may analyze the sensitive file, or obtain relevant information of the sensitive file to obtain the required information of the sensitive file. For example, the information of the application to which the sensitive file belongs may be carried in the storage path information or name of the sensitive file, and the monitoring module may obtain the information of the application to which the sensitive file belongs based on the conventional setting location of the information of the application. The file name of the sensitive file can be directly obtained after the sensitive file is determined.

[0050] The monitoring module can monitor sensitive files based on file names, and the monitoring results may show that the same file name exists in different file paths. The monitoring module can determine the file handle corresponding to the file name under each file path, and transmit these file handles as the file information of the sensitive file corresponding to the file name to the desensitizing module. The desensitizing module can quickly and accurately find the corresponding files based on each file handle, and then open these files, and find out whether there is sensitive data that meets these data rules in the specific content of the file based on sensitive data rules. Desensitization is performed after the sensitive data is found.

[0051] In the embodiment of this specification, the business application in the data desensitization device generates a corresponding system call when performing a target operation (such as opening a file) on a file. The monitoring module (such as a system call built based on an eBPF program) is located in the kernel state, and is used to monitor the system call for opening the file, and based on the file information possessed by the sensitive file, the file corresponding to the system call is preliminarily filtered to obtain the sensitive file, and the relevant information of the sensitive file (such as the information of the application to which it belongs, the file name, and the file handle) is sent to the desensitization module in the user state. The desensitization module receives the information sent by the monitoring module through the storage space shared with the monitoring module, and further confirms whether the sensitive file needs to be desensitized based on the received information. The desensitization module can open the corresponding sensitive file based on the file handle, and search for sensitive information in the sensitive file based on the data rules of the sensitive data, and then perform the corresponding desensitization processing.

[0052] In the embodiments of this specification, the eBPF technology can be used to monitor the system calls of the application to open or write files in the host operating system kernel, and the desensitization operation can be automatically triggered. There is no need to modify the application, it is non-invasive to the existing business programs, and data desensitization can be achieved through simple configuration, and the usage method is highly flexible. And there is no need for manual intervention and investigation, it can be compatible with containerized applications and non-containerized applications, and can achieve desensitization in seconds, greatly reducing the risk of sensitive data leakage.

[0053] In summary, in the data desensitization method provided in the embodiment of this specification, the target operation on the file can be monitored in the kernel, the monitored sensitive file can be determined, and then the sensitive data in the sensitive file can be desensitized. In this way, when operating on the file, the sensitive file with sensitive data can be directly located, and the file identification is performed in the kernel, which can ensure the accuracy of the identified file, and then the sensitive data can be desensitized, which can perform data desensitization faster and more accurately, and improve the data desensitization effect.

[0054] Corresponding to the above method embodiment, this specification also provides a data desensitization device embodiment, Figure 2 FIG. 1 shows a schematic diagram of a data desensitization device provided by an embodiment of the present specification. Figure 2 As shown, the data desensitization device includes:

[0055] A monitoring module 202 is used to monitor the target operation performed on the file in the kernel, and determine the sensitive file targeted by the monitored target operation; wherein the target operation can cause the file to carry sensitive data;

[0056] A search module 204, used to search for sensitive data in sensitive files;

[0057] The processing module 206 is used to perform desensitization processing on the sensitive data in the sensitive file.

[0058] Optionally, the monitoring module 202 is used to: monitor in the kernel target operations performed on the file based on the application, wherein the target operations include open operations and / or write operations.

[0059] Optionally, the monitoring module 202 is used to: monitor in the kernel target operations performed on files based on the containerized application.

[0060] Optionally, the monitoring module 202 is used to: monitor the target operation on the file in the kernel by using the monitoring module running in the kernel state, and determine the sensitive file targeted by the monitored target operation;

[0061] The data desensitization device also includes:

[0062] A transmission module, used to transmit the information of sensitive files to a desensitizing module running in user mode by using the monitoring module;

[0063] The search module 204 is used to: determine the sensitive file based on the information of the sensitive file using the desensitization module, and search for sensitive data in the sensitive file;

[0064] The processing module 206 is used to: utilize the desensitization module to perform desensitization processing on the sensitive data in the sensitive file.

[0065] Optionally, the sensitive file information includes: at least one of information about an application to which the sensitive file belongs, a file name of the sensitive file, and a file handle of the sensitive file.

[0066] Optionally, the transmission module is used to: utilize the monitoring module to transmit the information of the sensitive file to the desensitizing module running in the user state through the shared storage space.

[0067] Optionally, the data desensitization device further includes:

[0068] A first acquisition module is used to acquire file information of a file containing sensitive data before monitoring a target operation on the file in the kernel;

[0069] The monitoring module 202 is used to monitor target operations on files containing file information in the kernel.

[0070] Optionally, the data desensitization device further includes:

[0071] The second acquisition module is used to obtain the sensitive data format before searching for sensitive data in sensitive files;

[0072] The search module 204 is used to search for sensitive data that meets the sensitive data format in sensitive files.

[0073] In summary, in the data desensitization device provided in the embodiment of this specification, the target operation on the file can be monitored in the kernel, the monitored sensitive file can be determined, and then the sensitive data in the sensitive file can be desensitized. In this way, when operating on the file, the sensitive file with sensitive data can be directly located, and the file identification is performed in the kernel, which can ensure the accuracy of the identified file, and then the sensitive data can be desensitized, which can perform data desensitization faster and more accurately, and improve the data desensitization effect.

[0074] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. As for the data desensitization device, since it is basically similar to the data desensitization method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the data desensitization method embodiment.

[0075] Figure 3 300 is a block diagram of a computing device provided in an embodiment of the present specification. The components of the computing device 300 include but are not limited to a memory 310 and a processor 320. The processor 320 is connected to the memory 310 via a bus 330, and the database 350 is used to store data.

[0076] The computing device 300 also includes an access device 340 that enables the computing device 300 to communicate via one or more networks 360. Examples of these networks include a public switched telephone network (PSTN), a local area network (LAN), a wide area network (WAN), a personal area network (PAN), or a combination of communication networks such as the Internet. The access device 340 may include one or more of any type of network interface (e.g., a network interface card (NIC)) that is wired or wireless, such as an IEEE 802.11 wireless local area network (WLAN) wireless interface, a world-wide interoperability for microwave access (Wi-MAX) interface, an Ethernet interface, a universal serial bus (USB) interface, a cellular network interface, a Bluetooth interface, and a near field communication (NFC).

[0077] In one embodiment of the present specification, the above components of the computing device 300 and Figure 3 Other components not shown in the figure may also be connected to each other, for example, via a bus. It should be understood that Figure 3 The computing device structure block diagram shown is only for the purpose of illustration, and is not intended to limit the scope of this specification. Those skilled in the art can add or replace other components as needed.

[0078] The computing device 300 may be any type of stationary or mobile computing device, including a mobile computer or mobile computing device (e.g., a tablet computer, a personal digital assistant, a laptop computer, a notebook computer, a netbook, etc.), a mobile phone (e.g., a smart phone), a wearable computing device (e.g., a smart watch, smart glasses, etc.), or other types of mobile devices, or a stationary computing device such as a desktop computer or a personal computer (PC). The computing device 300 may also be a mobile or stationary server.

[0079] The processor 320 is used to execute computer programs / instructions, which, when executed by the processor, implement the above Figure 1 The method shown.

[0080] As for the computing device embodiment, since it is basically similar to the data desensitization method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the data desensitization method embodiment.

[0081] One embodiment of the present specification also provides a computer-readable storage medium, which stores computer instructions, and the steps of the above-mentioned data desensitization method are implemented when the computer instructions are executed by the processor. The computer instructions include computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form, etc. The computer-readable storage medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, disk, optical disk, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable storage medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction. For example, in some jurisdictions, according to legislation and patent practice, computer-readable storage media do not include electric carrier signals and telecommunication signals.

[0082] One embodiment of the present specification also provides a computer program product, including a computer program / instruction, which implements the steps of the above-mentioned data desensitization method when the computer program / instruction is executed in a processor.

[0083] As for the computer-readable storage medium embodiment and the computer program product embodiment, since they are basically similar to the data desensitization method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the data desensitization method embodiment.

[0084] The above is a description of a specific embodiment of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0085] The computer instructions include computer program codes, which may be in source code form, object code form, executable files or some intermediate forms, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable medium may be appropriately increased or decreased according to the requirements of patent practice. For example, in some regions, according to patent practice, computer-readable media do not include electric carrier signals and telecommunication signals.

[0086] It should be noted that the above is a description of a specific embodiment of the present specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the embodiments of the present specification.

[0087] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0088] The preferred embodiments of this specification disclosed above are only used to help explain this specification. The optional embodiments do not describe all the details in detail, nor do they limit the invention to the specific implementation methods described. Obviously, many modifications and changes can be made according to the content of the embodiments of this specification. This specification selects and specifically describes these embodiments in order to better explain the principles and practical applications of the embodiments of this specification, so that technicians in the relevant technical field can understand and use this specification well.

Claims

1. A data desensitization method, characterized in that: The method comprises: Monitoring a target operation performed on a file in the kernel, and determining a sensitive file targeted by the monitored target operation; wherein the target operation can cause the file to carry sensitive data; Searching for sensitive data in the sensitive files; Desensitizing is performed on the sensitive data in the sensitive file.

2. The method according to claim 1, characterized in that The target operation performed on the file is monitored in the kernel, including: A target operation performed on a file based on an application is monitored in a kernel, wherein the target operation includes an open operation and / or a write operation.

3. The method according to claim 2, characterized in that The monitoring of target operations performed on files by applications in the kernel includes: Monitor targeted file operations performed by containerized applications in the kernel.

4. The method according to any one of claims 1 to 3, characterized in that: The monitoring of the target operation on the file in the kernel and determining the sensitive file targeted by the monitored target operation includes: Using a monitoring module running in kernel state, the target operation on the file is monitored in the kernel, and the sensitive file targeted by the monitored target operation is determined; The method further comprises: Using the monitoring module to transmit the information of the sensitive file to a desensitizing module running in user mode; The searching for sensitive data in the sensitive file includes: Determine the sensitive file based on the information of the sensitive file using the desensitization module, and search for sensitive data in the sensitive file; The desensitizing the sensitive data in the sensitive file includes: The desensitizing module is used to perform desensitization processing on the sensitive data in the sensitive file.

5. The method according to claim 4, characterized in that The information of the sensitive file includes: at least one of information of an application to which the sensitive file belongs, a file name of the sensitive file, and a file handle of the sensitive file.

6. The method according to claim 4, characterized in that The step of using the monitoring module to transmit the information of the sensitive file to the desensitizing module running in the user state includes: The monitoring module is used to transmit the information of the sensitive file to the desensitizing module running in the user state through the shared storage space.

7. The method according to any one of claims 1 to 3, characterized in that: Before monitoring the target operation on the file in the kernel, the method further includes: Obtain file information for files containing sensitive data; The target operation performed on the file is monitored in the kernel, including: A target operation is monitored in the kernel for a file containing the file information.

8. The method according to any one of claims 1 to 3, characterized in that: Before searching for sensitive data in the sensitive file, the method further includes: Get sensitive data format; The searching for sensitive data in the sensitive file includes: Search the sensitive file for sensitive data that satisfies the sensitive data format.

9. A data desensitization device, characterized in that: include: A monitoring module, used to monitor target operations performed on files in the kernel, and determine sensitive files targeted by the monitored target operations; wherein the target operations can cause the files to carry sensitive data; A search module, used to search for sensitive data in the sensitive file; A processing module is used to perform desensitization processing on the sensitive data in the sensitive file.

10. A computing device, characterized in that include: Memory and processor; The memory is used to store computer programs / instructions, and the processor is used to execute the computer programs / instructions. When the computer program / instructions are executed by the processor, the method according to any one of claims 1 to 8 is implemented.

11. A computer-readable storage medium, characterized in that: A computer program / instruction is stored, and when the computer program / instruction is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

12. A computer program product, characterized in that The method comprises a computer program / instruction, which implements the method according to any one of claims 1 to 8 when the computer program / instruction is executed in a processor.

Images