Data desensitization method and device

Abstract

The invention provides a data desensitization method and device, and relates to the technical field of data processing. When the method is executed, a desensitization rule is defined firstly, the desensitization rule comprises a field ID, a starting position and an ending position, then a desensitization tool class is constructed, the desensitization tool class is used for indicating a data desensitization process, when desensitization is conducted on data to be desensitized, the desensitization rule is selected firstly to obtain a target desensitization rule, and the target desensitization rule is used for desensitizing the data to be desensitized. And desensitizing the to-be-desensitized data according to the target desensitization rule and the desensitization tool class. Thus, only the desensitization rule needs to be defined, only the desensitization rule needs to be selected when the data to be desensitized is desensitized, the desensitization code does not need to be edited every time, and then the data desensitization efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data desensitization method and device. Background Art

[0002] In the process of building a personal business system group, since a large amount of sensitive data of customers is involved, the back-end application system needs to desensitize the data. Different desensitization rules need to be developed for different fields. For example, the desensitization rule for mobile phone numbers is to display only the first three and the last two digits, and the ID number is to display only the first six and the last two digits, and the remaining digits are displayed as *. The naming rules of various fields in the application systems are also different. For example, some systems call the ID number certNo, and some call it certId. Desensitization codes need to be developed for different fields. The development workload is cumbersome, and most of the codes are repeated, resulting in low data desensitization efficiency.

[0003] In summary, how to improve the efficiency of data desensitization is an urgent problem that technical personnel in this field need to solve. Summary of the invention

[0004] In view of this, the present application provides a data desensitization method and device, aiming to improve the efficiency of data desensitization.

[0005] In a first aspect, the present application provides a data desensitization method, comprising:

[0006] Defining desensitization rules; the desensitization rules include field ID, starting position and ending position;

[0007] Construct a desensitization tool class; the desensitization tool class is used to indicate the data desensitization process;

[0008] Select the desensitization rule to obtain the target desensitization rule;

[0009] The data to be desensitized is desensitized according to the target desensitization rule and the desensitization tool class.

[0010] Optionally, the construction of the desensitization tool class includes:

[0011] Determine the data desensitization process for strings;

[0012] Determine the data desensitization process for singled-out data;

[0013] Determine the data desensitization process for collection type data.

[0014] Optionally, desensitizing the data to be desensitized according to the target desensitization rule and the desensitization tool class includes:

[0015] If the data to be desensitized is a string, determine the start and end superscripts of the string; the string corresponds to the field ID; the start superscript corresponds to the starting position; and the end superscript corresponds to the ending position;

[0016] The character string is desensitized according to the target desensitization rule.

[0017] Optionally, desensitizing the data to be desensitized according to the target desensitization rule and the desensitization tool class includes:

[0018] When the data to be desensitized is a single piece of data, the target desensitization rule is used to desensitize the field ID corresponding to the target desensitization rule in the single piece of data.

[0019] Optionally, desensitizing the data to be desensitized according to the target desensitization rule and the desensitization tool class includes:

[0020] When the data to be desensitized is set type data, traverse all the objects to be desensitized in the set type data;

[0021] Desensitize all the objects to be desensitized using the target desensitization rule.

[0022] Optionally, after desensitizing the data to be desensitized according to the target desensitization rule and the desensitization tool class, the method further includes:

[0023] The desensitization rule is selected again.

[0024] In a second aspect, the present application provides a data desensitization device, comprising:

[0025] A definition module, used to define desensitization rules; the desensitization rules include field ID, starting position and ending position;

[0026] A construction module is used to construct a desensitization tool class; the desensitization tool class is used to indicate the data desensitization process;

[0027] The first selection module is used to select the desensitization rule to obtain the target desensitization rule;

[0028] The desensitizing module is used to desensitize the data to be desensitized according to the target desensitizing rule and the desensitizing tool class.

[0029] Optionally, the building block includes:

[0030] A first determining unit, used to determine a data desensitization process for a character string;

[0031] The second determination unit is used to determine the data desensitization process for the single challenge data;

[0032] The third determining unit is used to determine the data desensitization process for the collection type data.

[0033] Optionally, the desensitization module includes:

[0034] A fourth determining unit, for determining, if the data to be desensitized is a string, a start superscript and an end superscript of the string; the string corresponds to the field ID; the start superscript corresponds to the starting position; and the end superscript corresponds to the ending position;

[0035] The first desensitization unit is used to desensitize the character string according to the target desensitization rule.

[0036] Optionally, the desensitization module includes:

[0037] The second desensitizing unit is used to desensitize the field ID corresponding to the target desensitizing rule in the single data by using the target desensitizing rule when the data to be desensitized is a single data.

[0038] Optionally, the desensitization module includes:

[0039] A traversal unit, used for traversing all objects to be desensitized in the collection type data when the data to be desensitized is collection type data;

[0040] The third desensitization unit is used to desensitize all the objects to be desensitized by using the target desensitization rule.

[0041] Optionally, the device further comprises:

[0042] The second selection module is used to reselect the desensitization rule.

[0043] In a third aspect, an embodiment of the present application provides a computer device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the data desensitization method described in any one of the implementation methods in the first aspect of the embodiment of the present application.

[0044] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, in which instructions are stored. When the instructions are executed on a terminal device, the terminal device executes the data desensitization method described in any one of the implementation methods in the first aspect of the embodiment of the present application.

[0045] The present application provides a data desensitization method. When executing the method, the desensitization rules are first defined, wherein the desensitization rules include field ID, starting position and end position, and then a desensitization tool class is constructed, which is used to indicate the data desensitization process. When desensitizing the desensitized data, the desensitization rules are first selected to obtain the target desensitization rules, and the desensitized data is desensitized according to the target desensitization rules and the desensitization tool class. In this way, it is only necessary to define the desensitization rules, and when desensitizing the desensitized data, it is only necessary to select the desensitization rules, and there is no need to edit the desensitization code every time, thereby improving the desensitization efficiency of the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in this embodiment or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 A flowchart of a data desensitization method provided in an embodiment of the present application;

[0048] Figure 2 A schematic diagram of the structure of a data desensitization device provided in an embodiment of the present application;

[0049] Figure 3 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. A data desensitization method and device provided by the present application are used in the field of data processing technology. The above is only an example and does not limit the application field of the method and device name provided by the present application.

[0051] In the process of building a personal business system group, since a large amount of sensitive data of customers is involved, the back-end application system needs to desensitize the data. Different desensitization rules need to be developed for different fields. For example, the desensitization rule for mobile phone numbers is to display only the first three and the last two digits, and the ID number is to display only the first six and the last two digits, and the remaining digits are displayed as *. The naming rules of various fields in the application systems are also different. For example, some systems call the ID number certNo, and some call it certId. Desensitization codes need to be developed for different fields. The development workload is cumbersome, and most of the codes are repeated, resulting in low data desensitization efficiency.

[0052] After research, the inventor proposed the technical solution of this application. First, the desensitization rules are defined, wherein the desensitization rules include field ID, starting position and end position, and then a desensitization tool class is constructed. The desensitization tool class is used to indicate the data desensitization process. When desensitizing the data to be desensitized, the desensitization rules are first selected to obtain the target desensitization rules, and the desensitized data is desensitized according to the target desensitization rules and the desensitization tool class. In this way, only the desensitization rules need to be defined, and when desensitizing the data to be desensitized, only the desensitization rules need to be selected, and there is no need to edit the desensitization code every time, thereby improving the desensitization efficiency of the data.

[0053] In order to enable those skilled in the art to better understand the present application, the present application is further described in detail below in conjunction with the accompanying drawings and specific implementation methods. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in the field without making creative work are within the scope of protection of the present application. It should be noted that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings. In the absence of conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.

[0054] See also Figure 1 , Figure 1 A flowchart of a data desensitization method provided in an embodiment of the present application includes:

[0055] S101: Define desensitization rules.

[0056] First, define the masking rule, that is, the masking rule object MaskField. The MaskField object includes: field ID, starting position, and end position. For example, to mask the first three and last eight digits of the mobile number (mobileNo) field, you only need to construct the object new MaskField(mobileNo,3,8) through the constructor.

[0057] S102: Build a desensitization tool class.

[0058] Construct the masking tool class MaskUtil. The tool class MaskUtil mainly includes the following three main methods:

[0059] (1) String mask processing: Mask the string according to the string, start subscript, and end subscript, where the string corresponds to the field ID in the desensitization rule, the start subscript corresponds to the starting position in the desensitization rule, and the end subscript corresponds to the ending position in the desensitization rule. The main implementation methods are as follows:

[0060]

[0061]

[0062] (2) Desensitize a single piece of data: convert the object into a JSONObject, and then pack the object into a Map<String,Object> By traversing the Map object, find the field name corresponding to the corresponding desensitization rule and perform field desensitization. The main implementation methods are as follows:

[0063]

[0064]

[0065] (3) List collection type data is also processed uniformly. First, we will determine if the object type is List, and then loop through the list objects to desensitize each object. At the same time, we also consider the case where the object is a JSONObject and contains list members. We will take out the list members in the JSONObject object and then desensitize them in a loop. The main implementation methods are as follows:

[0066]

[0067]

[0068] S103: Select a desensitization rule to obtain a target desensitization rule.

[0069] When you need to desensitize the data, you only need to configure the corresponding desensitization rules, that is, initialize the MaskField object. The main implementation methods are as follows:

[0070]

[0071]

[0072] When using it, you can:

[0073] MaskUtil.maskDataRow(date,InclmsCustMaskUtil.DEFAULT_MASK_FIELDS); directly desensitize the data without the need for secondary development.

[0074] S104: Desensitize the data to be desensitized according to the target desensitization rules and desensitization tool types.

[0075] According to the target desensitization rule selected in step S103 and the desensitization tool class provided in step S102, the data to be desensitized is desensitized, which will not be described in detail here.

[0076] In an embodiment of the present application, a desensitization rule is first defined, wherein the desensitization rule includes a field ID, a starting position, and an end position, and then a desensitization tool class is constructed, which is used to indicate the data desensitization process. When desensitizing the data to be desensitized, the desensitization rule is first selected to obtain the target desensitization rule, and the desensitized data is desensitized according to the target desensitization rule and the desensitization tool class. In this way, only the desensitization rule needs to be defined, and only the desensitization rule needs to be selected when desensitizing the data to be desensitized, and there is no need to edit the desensitization code every time, thereby improving the desensitization efficiency of the data.

[0077] The above are some specific implementations of the data desensitization method provided in the embodiments of the present application. Based on this, the present application also provides a corresponding device. The device provided in the embodiments of the present application will be introduced from the perspective of functional modularization.

[0078] See also Figure 2 , Figure 2 A schematic diagram of the structure of a data desensitization device provided in an embodiment of the present application, the data desensitization device 200 includes:

[0079] A definition module 210 is used to define a desensitization rule; the desensitization rule includes a field ID, a start position, and an end position;

[0080] A construction module 220 is used to construct a desensitization tool class; the desensitization tool class is used to indicate a data desensitization process;

[0081] A first selection module 230 is used to select a desensitization rule to obtain a target desensitization rule;

[0082] The desensitizing module 240 is used to desensitize the data to be desensitized according to the target desensitizing rule and the desensitizing tool class.

[0083] Optionally, the construction module 220 includes:

[0084] A first determining unit, used to determine a data desensitization process for a character string;

[0085] The second determination unit is used to determine the data desensitization process for the single challenge data;

[0086] The third determining unit is used to determine the data desensitization process for the collection type data.

[0087] Optionally, the desensitization module 240 includes:

[0088] A fourth determining unit, for determining, if the data to be desensitized is a string, a start superscript and an end superscript of the string; the string corresponds to the field ID; the start superscript corresponds to the starting position; and the end superscript corresponds to the ending position;

[0089] The first desensitization unit is used to desensitize the character string according to the target desensitization rule.

[0090] Optionally, the desensitization module 240 includes:

[0091] The second desensitizing unit is used to desensitize the field ID corresponding to the target desensitizing rule in the single data by using the target desensitizing rule when the data to be desensitized is a single data.

[0092] Optionally, the desensitization module 240 includes:

[0093] A traversal unit, used for traversing all objects to be desensitized in the collection type data when the data to be desensitized is collection type data;

[0094] The third desensitization unit is used to desensitize all the objects to be desensitized by using the target desensitization rule.

[0095] Optionally, the device 200 further includes:

[0096] The second selection module is used to reselect the desensitization rule.

[0097] The embodiments of the present application also provide corresponding devices and computer storage media for implementing the solutions provided by the embodiments of the present application.

[0098] like Figure 3 As shown, the computer device 01 is in the form of a general computing device. The components of the computer device 01 may include but are not limited to: one or more processors or processing units 03, a system memory 08, and a bus 04 connecting different system components (including the system memory 08 and the processing unit 03).

[0099] Bus 04 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor or a local bus using any of a variety of bus structures. For example, these architectures include but are not limited to Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus and Peripheral Component Interconnect (PCI) bus.

[0100] The computer device 01 typically includes a variety of computer system readable media. These media can be any available media that can be accessed by the computer device 01, including volatile and non-volatile media, removable and non-removable media.

[0101] The system memory 08 may include computer system readable media in the form of volatile memory, such as random access memory (RAM) 09 and / or cache memory 10. The computer device 01 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 11 may be used to read and write non-removable, non-volatile magnetic media ( Figure 3 not shown, usually called a "hard drive"). Although Figure 3 Not shown in the figure, a disk drive for reading and writing a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 04 via one or more data medium interfaces. The memory 08 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present invention.

[0102] A program / utility 12 having a set (at least one) of program modules 13 may be stored, for example, in the memory 08, such program modules 13 including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination thereof may include an implementation of a network environment. The program modules 13 generally perform the functions and / or methods of the embodiments described herein.

[0103] The computer device 01 may also communicate with one or more external devices 02 (e.g., keyboard, pointing device, display 07, etc.), one or more devices that enable a user to interact with the computer device 01, and / or any device that enables the computer device 01 to communicate with one or more other computing devices (e.g., network card, modem, etc.). Such communication may be performed via input / output (I / O) interface 06. Furthermore, the computer device 01 may also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN) and / or public network, such as the Internet) via network adapter 05. Figure 3 As shown, the network adapter 05 communicates with other modules of the computer device 01 via the bus 04. It should be understood that although Figure 3 Not shown, other hardware and / or software modules may be used in conjunction with computer device 01, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0104] The processor unit 03 executes various functional applications and data processing by running programs stored in the system memory 08, such as implementing a data desensitization method provided in an embodiment of the present application.

[0105] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0106] Through the description of the above implementation methods, it can be known that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment method can be implemented by means of software plus a general hardware platform. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a storage medium, such as a read-only memory (ROM) / RAM, a magnetic disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in each embodiment of the present application or some parts of the embodiments.

[0107] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.

[0108] The above description is merely an exemplary embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. A data desensitization method, characterized in that: include: Define desensitization rules; The desensitization rules include field ID, starting position and ending position; Build desensitization tool class; The desensitization tool class is used to indicate the data desensitization process; Selecting the desensitization rule to obtain a target desensitization rule; The data to be desensitized is desensitized according to the target desensitization rule and the desensitization tool class.

2. The method according to claim 1, characterized in that The desensitization tool class is constructed, including: Determine the data desensitization process for strings; Determine the data desensitization process for singled-out data; Determine the data desensitization process for collection type data.

3. The method according to claim 2, characterized in that Desensitizing the data to be desensitized according to the target desensitization rule and the desensitization tool class includes: If the data to be desensitized is a string, determine the start and end superscripts of the string; the string corresponds to the field ID; the start superscript corresponds to the starting position; and the end superscript corresponds to the ending position; The character string is desensitized according to the target desensitization rule.

4. The method according to claim 2, characterized in that: Desensitizing the data to be desensitized according to the target desensitization rule and the desensitization tool class includes: When the data to be desensitized is a single piece of data, the target desensitization rule is used to desensitize the field ID corresponding to the target desensitization rule in the single piece of data.

5. The method according to claim 2, characterized in that: Desensitizing the data to be desensitized according to the target desensitization rule and the desensitization tool class includes: When the data to be desensitized is set type data, traverse all the objects to be desensitized in the set type data; Desensitize all the objects to be desensitized using the target desensitization rule.

6. The method according to claim 1, characterized in that After desensitizing the data to be desensitized according to the target desensitization rule and the desensitization tool class, the method further includes: The desensitization rule is selected again.

7. A data desensitization device, characterized in that: include: Definition module, used to define desensitization rules; The desensitization rules include field ID, starting position and ending position; Construction module, used to build desensitization tool class; The desensitization tool class is used to indicate the data desensitization process; A first selection module is used to select the desensitization rule to obtain a target desensitization rule; The desensitizing module is used to desensitize the data to be desensitized according to the target desensitizing rule and the desensitizing tool class.

8. The device according to claim 7, characterized in that The building blocks include: A first determining unit, used to determine a data desensitization process for a character string; The second determination unit is used to determine the data desensitization process for the single challenge data; The third determining unit is used to determine the data desensitization process for the collection type data.

9. A computer device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the data desensitization method according to any one of claims 1 to 6 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores instructions, and when the instructions are executed on a terminal device, the terminal device executes the data desensitization method according to any one of claims 1 to 6.

Images