Business data masking method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a business data masking method and device, electronic equipment and a storage medium, and belongs to the technical field of financial science and technology. The method comprises: in response to a service access request, obtaining original service data, the original service data comprising an original service attribute key and an original service attribute value, obtaining service mask data according to a resource positioning identifier, the service mask data comprising a service attribute field and a mask configuration parameter of the service attribute field, performing key data legality verification on the original service attribute key to obtain a candidate service attribute key, performing value data legality verification on the original service attribute value to obtain a candidate service attribute value, obtaining a service attribute field of the candidate service attribute key, obtaining a target service attribute, and obtaining a mask configuration parameter of the target service attribute; and obtaining a target mask parameter, and masking the candidate service attribute value according to the target mask parameter. According to the embodiment of the invention, the dynamic adjustment of the data mask strategy can be realized.

Description

Technical Field

[0001] The present application relates to the field of financial technology, and in particular to a business data masking method and device, an electronic device and a storage medium. Background Art

[0002] Business systems usually record business data in relevant business scenarios. For example, financial institutions usually record business data such as object identity information and business transaction information in order to provide business services to users, such as financial management recommendation services. In order to improve the security of business data and prevent unauthorized users from obtaining real business data, business data needs to be protected. In related technologies, static masking methods are used to mask business data, and masking strategies cannot be adjusted dynamically. Summary of the invention

[0003] The main purpose of the embodiments of the present application is to propose a business data masking method and device, an electronic device and a storage medium, aiming to dynamically adjust the data masking strategy of business data.

[0004] To achieve the above-mentioned purpose, a first aspect of an embodiment of the present application proposes a service data masking method, the method comprising:

[0005] Obtaining a service access request; wherein the service access request includes a resource location identifier;

[0006] In response to the service access request, original service data is acquired; wherein the original service data includes an original service attribute key and an original service attribute value;

[0007] Acquire service mask data according to the resource location identifier; wherein the service mask data includes a service attribute field and a mask configuration parameter of the service attribute field;

[0008] Performing a key data legitimacy check on the original business attribute key to obtain a candidate business attribute key;

[0009] Performing a value data legitimacy check on the original service attribute value to obtain a candidate service attribute value;

[0010] Acquire the business attribute field of the candidate business attribute key to obtain a target business attribute;

[0011] Obtaining a mask configuration parameter of the target service attribute to obtain a target mask parameter;

[0012] The candidate service attribute value is masked according to the target mask parameter.

[0013] In some embodiments, the target mask parameter includes a mask switch parameter and a mask position parameter, and masking the candidate service attribute value according to the target mask parameter includes:

[0014] Acquire the data display format of the candidate service attribute value according to the mask switch parameter to obtain a target display format;

[0015] The candidate service attribute values ​​are masked according to the target display format and the mask position parameters.

[0016] In some embodiments, the data display format includes a ciphertext display format, and masking the candidate service attribute value according to the target display format and the mask position parameter includes:

[0017] If the target display format is a ciphertext display format, determining a mask start position and a mask target position according to the mask position parameter;

[0018] The candidate service attribute value is masked according to the mask start position and the mask target position.

[0019] In some embodiments, determining the mask start position and the mask target position according to the mask position parameter includes:

[0020] If the mask position parameter is a null value, the position of the first character of the candidate service attribute value is used as the mask start position, and the position of the last character of the candidate service attribute value is used as the mask target position;

[0021] If the mask position parameter is a non-null value, the parameter quantity of the mask position parameter is obtained, and the mask start position and the mask target position are determined according to the parameter quantity.

[0022] In some embodiments, determining the mask starting position and the mask target position according to the number of parameters includes:

[0023] If the number of parameters is one, a legality check is performed on the mask position parameter to obtain a first legality check result; wherein the first legality check result is used to indicate the legality of the mask position parameter;

[0024] If the first legality check result indicates that the mask position parameter is legal, the mask position parameter is used as the mask start position, and the position of the last character of the candidate service attribute value is used as the mask target position;

[0025] If the first legality check result indicates that the mask position parameter is illegal, the position of the first character of the candidate service attribute value is used as the mask starting position, and the position of the last character of the candidate service attribute value is used as the mask target position.

[0026] In some embodiments, determining the mask starting position and the mask target position according to the number of parameters includes:

[0027] If the number of parameters is two, perform parameter extraction on the mask position parameter to obtain a first position parameter and a second position parameter, perform a legitimacy check on the first position parameter to obtain a second legitimacy check result, and perform a legitimacy check on the second position parameter to obtain a third legitimacy check result; wherein the second legitimacy check result is used to indicate the legitimacy of the first position parameter, and the third legitimacy check result is used to indicate the legitimacy of the second position parameter;

[0028] The mask starting position is determined according to the second legality check result and the third legality check result, and the mask target position is determined according to the second legality check result and the third legality check result.

[0029] In some embodiments, determining the mask starting position according to the second legitimacy check result and the third legitimacy check result, and determining the mask target position according to the second legitimacy check result and the third legitimacy check result, includes:

[0030] If the second legality check result indicates that the first position parameter is legal, and the third legality check result indicates that the second position parameter is legal, the first position parameter is used as the mask starting position, and the second position parameter is used as the mask target position;

[0031] If the second legitimacy check result indicates that the first position parameter is illegal, or the third legitimacy check result indicates that the second position parameter is illegal, the position of the first character of the candidate business attribute value is used as the mask starting position, and the position of the last character of the candidate business attribute value is used as the mask target position.

[0032] To achieve the above-mentioned purpose, a second aspect of an embodiment of the present application proposes a service data masking device, the device comprising:

[0033] A request acquisition module, used to acquire a service access request; wherein the service access request includes a resource location identifier;

[0034] A response module, configured to obtain original business data in response to the business access request; wherein the original business data includes an original business attribute key and an original business attribute value;

[0035] A mask data acquisition module, used to acquire service mask data according to the resource location identifier; wherein the service mask data includes a service attribute field and a mask configuration parameter of the service attribute field;

[0036] A key data verification module, used to verify the key data legitimacy of the original business attribute key to obtain a candidate business attribute key;

[0037] A value data verification module, used to perform value data legitimacy verification on the original business attribute value to obtain a candidate business attribute value;

[0038] A field acquisition module, used to acquire the business attribute field of the candidate business attribute key to obtain a target business attribute;

[0039] A parameter acquisition module, used to acquire the mask configuration parameters of the target service attributes to obtain target mask parameters;

[0040] A masking module is used to mask the candidate service attribute value according to the target masking parameter.

[0041] To achieve the above-mentioned purpose, the third aspect of an embodiment of the present application proposes an electronic device, which includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method described in the first aspect is implemented.

[0042] To achieve the above-mentioned purpose, the fourth aspect of an embodiment of the present application proposes a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in the first aspect is implemented.

[0043] The service data masking method, service data masking device, electronic device and storage medium proposed in the embodiment of the present application obtain the original service data in response to the service access request by obtaining the service access request. In order to protect the original service data and realize the dynamic acquisition of the masking rule, the service mask data is obtained according to the resource location identifier, so as to dynamically mask the original service data of the corresponding resource location based on the service mask data. Legal service data usually involves a large amount of key service information. In order to locate the key information in the service data, the key data legitimacy check is performed on the original service attribute key to obtain the candidate service attribute key, and the value data legitimacy check is performed on the original service attribute value to obtain the candidate service attribute value. In order to improve the masking efficiency of service data, only the key service attribute information is masked. In order to dynamically mask different service attribute information, the service attribute field of the candidate service attribute key is obtained to obtain the target service attribute so that the candidate service attribute key matches the service attribute field. The mask configuration parameter of the target service attribute is obtained to obtain the target mask parameter, so that the candidate service attribute value can be dynamically matched to the appropriate mask configuration parameter, rather than using the same mask configuration parameter for all candidate service attribute values. The candidate service attribute values ​​are masked according to the target mask parameters, thereby realizing dynamic masking of the candidate service attribute values. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 is a flow chart of a service data masking method provided in an embodiment of the present application;

[0045] Figure 2 yes Figure 1 Flow chart of step S180 in FIG.

[0046] Figure 3 yes Figure 2 Flow chart of step S220 in FIG.

[0047] Figure 4 yes Figure 3 Flow chart of step S310 in FIG.

[0048] Figure 5 yes Figure 4 Flow chart of step S420 in FIG.

[0049] Figure 6 yes Figure 4 Another flow chart of step S420 in FIG.

[0050] Figure 7 yes Figure 6 Flowchart of step S620 in FIG.

[0051] Figure 8 It is a structural diagram of a service data masking device provided in an embodiment of the present application;

[0052] Fig. 9 It is a schematic diagram of the hardware structure of the electronic device provided in the embodiment of the present application. DETAILED DESCRIPTION

[0053] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0054] It should be noted that, although the functional modules are divided in the device schematic diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first", "second", etc. in the specification, claims and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0055] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0056] Business systems usually record business data in relevant business scenarios. For example, financial institutions usually record business data such as object identity information and business transaction information in order to provide business services to users, such as financial management recommendation services. In order to improve the security of business data and prevent unauthorized users from obtaining real business data, business data needs to be protected. In related technologies, static masking methods are used to mask business data, and masking strategies cannot be adjusted dynamically.

[0057] Based on this, the embodiments of the present application provide a service data masking method and device, an electronic device and a storage medium, aiming to achieve dynamic adjustment of the masking strategy.

[0058] The business data masking method and device, electronic device and storage medium provided in the embodiments of the present application are specifically described through the following embodiments. First, the business data masking method in the embodiments of the present application is described.

[0059] The business data masking method provided in the embodiment of the present application relates to the field of financial technology. The business data masking method provided in the embodiment of the present application can be applied to a terminal, can be applied to a server side, or can be software running in a terminal or a server side. In some embodiments, the terminal can be a smart phone, a tablet computer, a laptop computer, a desktop computer, etc.; the server side can be configured as an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application that implements the business data masking method, etc., but is not limited to the above forms.

[0060] The present application can be used in many general or special computer system environments or configurations. For example: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, distributed computing environments including any of the above systems or devices, etc. The present application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present application can also be practiced in distributed computing environments, in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules can be located in local and remote computer storage media including storage devices.

[0061] It should be noted that in each specific implementation of the present application, when it comes to the need to perform relevant processing based on data related to user identity or characteristics such as user information, user behavior data, user historical data, and user location information, the user's permission or consent will be obtained first, and the collection, use, and processing of these data will comply with relevant laws, regulations, and standards. In addition, when the embodiment of the present application needs to obtain the user's sensitive personal information, the user's separate permission or consent will be obtained through a pop-up window or by jumping to a confirmation page. After clearly obtaining the user's separate permission or consent, the necessary user-related data for the normal operation of the embodiment of the present application will be obtained.

[0062] Figure 1 is an optional flowchart of the service data masking method provided in an embodiment of the present application. Figure 1 The method may include but is not limited to steps S110 to S180.

[0063] Step S110, obtaining a service access request; wherein the service access request includes a resource location identifier;

[0064] Step S120, in response to the service access request, obtaining original service data; wherein the original service data includes an original service attribute key and an original service attribute value;

[0065] Step S130, acquiring service mask data according to the resource location identifier; wherein the service mask data includes a service attribute field and a mask configuration parameter of the service attribute field;

[0066] Step S140, performing a key data validity check on the original business attribute key to obtain a candidate business attribute key;

[0067] Step S150, performing a value data legitimacy check on the original service attribute value to obtain a candidate service attribute value;

[0068] Step S160, obtaining the business attribute field of the candidate business attribute key to obtain the target business attribute;

[0069] Step S170, obtaining the mask configuration parameters of the target service attributes to obtain the target mask parameters;

[0070] Step S180: Mask the candidate service attribute values ​​according to the target mask parameter.

[0071] In steps S110 to S180 shown in the embodiment of the present application, in a business data masking scenario, masking rules can be dynamically defined and adjusted according to changing actual business needs. Compared with static masking, the flexibility and scalability of business data masking are guaranteed, thereby reducing the management cost of business data.

[0072] In step S110 of some embodiments, the business access request is a request initiated by the client to the server-side business system. The business access request includes a request method, a resource location identifier, a request header, and a request body. The request method is used to define the type of request, such as GET and POST in the HTTP protocol. The resource location identifier is a Uniform Resource Locator (URL), which is used to specify the resource location of the request, including the protocol, domain name, and port. The request header is used to provide additional information about the request, such as user authentication information, the type of content that the client can receive, user agent information, etc. The request body is used to carry data that the client needs to send to the server, such as user identity information.

[0073] In step S120 of some embodiments, the business system receives a business access request from the client, and obtains original business data in response to the business access request. Original business data is business data that the client requests the business system to access. Business data is various types of data generated by the business system during business processing. Business data includes user identity information, user transaction information, business product information, etc. User identity information includes name, address, contact information, etc. User transaction information includes transaction order, transaction amount, payment information, and transaction time, etc. Business product information includes product price, product sales quantity, product inventory information, etc. For example, in the field of insurance claims, business data may include policy number, insurance period, insurance amount, vehicle identification number, etc. The original business data is a key-value pair structure, including at least one key-value pair. The key of the key-value pair in the original business data is used as the original business attribute key, and the value associated with the original business attribute key is used as the original business attribute value. The original business attribute key is used to indicate the business feature type of the business data, and the original business attribute value is the specific content of the business feature type. If the original business data is represented as {name: aa, age: 21}, then the name and age are both original business attribute keys, aa is the original business attribute value associated with the name, and 21 is the original business attribute value associated with the age.

[0074] In step S130 of some embodiments, the traditional masking method usually uses a fixed masking rule to hide sensitive fields in the business data, so that unauthorized users cannot obtain real business data, which is convenient for data protection of business data. This solidified masking method adopts the same masking strategy for all business attributes, which lacks flexibility and cannot adapt to the data security requirements of different business attributes or different business scenarios. The traditional masking method only supports static masking and cannot dynamically adjust the masking strategy according to the actual business situation. With the development and changes of the business, the masking strategy needs to be frequently updated and adjusted according to the changes in sensitive fields or business logic. If the masking scheme lacks scalability and maintainability, it will lead to an increase in the masking management cost of business data and it is difficult to adapt to the changing business needs. In order to ensure the flexibility and scalability of the masking scheme and realize the dynamic masking of business data, the masking range is accurately set to each field of each interface of the business system, and the masking rules are customized for the fields by dynamically configuring the fields and the masking types used by the fields. For example, if the field is a telephone number and the masking type is a telephone number masking rule, the telephone number is masked using the telephone number masking rule.

[0075] The configured masking rules are stored in a database, and the resource location identifier can locate a specific interface of the business system. After obtaining the business data of the specific interface, the database is queried according to the resource location identifier to verify whether the specific interface is configured with a masking rule. If the masking rule corresponding to the resource location identifier can be queried from the database, it means that the specific interface is configured with a masking rule, and the masking rule is used as the business mask data, and the business data is dynamically masked according to the business mask data. If the masking rule corresponding to the resource location identifier is not queried from the database, it means that the specific interface is not configured with a masking rule, and the business data of the specific interface is not masked, and the business data is directly returned to the client. The business mask data includes a business attribute field and a mask configuration parameter of the business attribute field. The business attribute field is used to indicate the business attribute characteristics of the business data, such as name, age, telephone number, etc., and the mask configuration parameter is used to indicate the masking rule of the business attribute field.

[0076] In step S140 of some embodiments, business data that meets established standards such as data integrity and data correctness usually involves a large amount of business-critical information. In order to locate the business-critical information and facilitate subsequent masking of the business-critical information, the original business attribute key is checked for key data legitimacy. If the original business attribute key is a non-null value, the original business attribute key is used as a candidate business attribute key. If the original business attribute key is a null value, the original business attribute value associated with the original business attribute key is not masked.

[0077] In step S150 of some embodiments, if the original business attribute key is a non-null value, the value data legitimacy check is performed on the original business attribute value. If the original business attribute value is a non-null value, the original business attribute value is used as a candidate business attribute value; if the original business attribute value is a null value, the original business attribute value is not masked.

[0078] In step S160 of some embodiments, in order to obtain the mask type corresponding to the candidate business attribute key, the business attribute field matching the candidate business attribute key is obtained to obtain the target business attribute. For example, if the candidate business attribute key is name and its matching business attribute field is NAME, NAME is used as the target business attribute. If the business attribute field corresponding to the candidate business attribute key does not exist in the business mask data, the candidate business attribute value is not masked.

[0079] In step S170 of some embodiments, the mask configuration parameter includes a mask switch configuration and a mask position configuration, the mask switch configuration is used to control whether to mask the candidate service attribute value, and the mask position configuration is used to indicate the mask data bit of the candidate service attribute value. The mask switch configuration of the target service attribute is obtained to obtain the mask switch parameter. The mask position configuration of the target service attribute is obtained to obtain the mask position parameter. The mask position parameter is an integer.

[0080] See also Figure 2 In some embodiments, step S180 may include but is not limited to steps S210 to S220:

[0081] Step S210, obtaining the data display format of the candidate service attribute value according to the mask switch parameter to obtain the target display format;

[0082] Step S220: Mask the candidate service attribute values ​​according to the target display format and the mask position parameters.

[0083] In step S210 of some embodiments, the data display format includes a ciphertext display format and a plaintext display format. The ciphertext display format displays the candidate business attribute values ​​in an encrypted manner, and the plaintext display format displays the candidate business attribute values ​​in an unencrypted original manner. The target display format is a ciphertext display format or a plaintext display format. Whether to mask the candidate business attribute values ​​is determined by the mask switch parameter. If the mask switch parameter is a non-empty value and the mask switch parameter is a specific character such as Y, the target display format is a plaintext display format, and the candidate business attribute values ​​are displayed in a plaintext display format without masking the candidate business attribute values. If the mask switch parameter is an empty value, or the mask switch parameter is a character other than a specific character, the target display format is a ciphertext display format, and the candidate business attribute values ​​are displayed in a ciphertext display format.

[0084] The same candidate business attribute value has different business protection requirements in different business scenarios. Taking name as an example, it needs to be protected in the financial transaction business scenario, but not in the performance appraisal scenario. The encryption status of the candidate business attribute value can be flexibly controlled through the mask switch parameter to meet the data protection requirements of different business scenarios.

[0085] In step S220 of some embodiments, if the target display format is a ciphertext display format, the candidate service attribute value is masked according to the mask position parameter.

[0086] Through the above steps S210 to S220, the data display format of the candidate service attribute values ​​can be flexibly controlled to meet the mask requirements in different service scenarios.

[0087] See also Figure 3 In some embodiments, step S220 may include but is not limited to steps S310 to S320:

[0088] Step S310, if the target display format is a ciphertext display format, determining the mask start position and the mask target position according to the mask position parameter;

[0089] Step S320: Mask the candidate service attribute value according to the mask start position and the mask target position.

[0090] In step S310 of some embodiments, if the target display format is a ciphertext display format, indicating that the candidate service attribute value needs to be masked, the mask start position and the mask target position are determined according to the mask position parameter. The mask start position is the start position of the mask operation on the candidate service attribute value. The mask target position is the end position of the mask operation on the candidate service attribute value.

[0091] In step S320 of some embodiments, the candidate service attribute value is in the form of a character string, with the character at the mask start position in the candidate service attribute value as the start character, and the character at the mask target position in the candidate service attribute value as the end character, and the start character, the end character, and the characters between the start character and the end character are replaced with mask characters, and the mask character can be *. For example, if the candidate service attribute value is 2022111415, the mask start position is 1, and the mask target position is 4, then all the first to fourth characters are replaced with mask characters, and the candidate service attribute value after masking is ****111415.

[0092] Through the above steps S310 to S320, the mask position of the candidate service attribute value can be dynamically adjusted through the mask position parameter to adapt to the mask requirements of different service scenarios and different service attributes on the service attribute value.

[0093] See also Figure 4 In some embodiments, step S310 may include but is not limited to step S410 or step S420:

[0094] Step S410: If the mask position parameter is a null value, the position of the first character of the candidate service attribute value is used as the mask start position, and the position of the last character of the candidate service attribute value is used as the mask target position;

[0095] Step S420: If the mask position parameter is a non-null value, the parameter quantity of the mask position parameter is obtained, and the mask start position and the mask target position are determined according to the parameter quantity.

[0096] In step S410 of some embodiments, if the mask position parameter is a null value, indicating that the mask position parameter is not configured and the candidate business attribute value needs to be fully masked, the position of the first character of the candidate business attribute value is used as the mask start position, and the position of the last character of the candidate business attribute value is used as the mask target position. It should be noted that if the candidate business attribute value contains only one character, the mask start position and the mask target position are the same.

[0097] In step S420 of some embodiments, if the mask position parameter is a non-null value, indicating that the mask position parameter has been configured, the number of parameters of the mask position parameter is obtained. The number of parameters is one or two. The mask start position and the mask target position are determined according to the number of parameters.

[0098] Through the above steps S410 to S420, the mask positions of different service attribute values ​​are dynamically adjusted, which greatly improves the flexibility and scalability of the service data mask compared with the static mask.

[0099] See also Figure 5 In some embodiments, step S420 may include but is not limited to steps S510 to S530:

[0100] Step S510: If the number of parameters is one, a validity check is performed on the mask position parameter to obtain a first validity check result; wherein the first validity check result is used to indicate the validity of the mask position parameter;

[0101] Step S520: If the first legality check result indicates that the mask position parameter is legal, the mask position parameter is used as the mask start position, and the position of the last character of the candidate service attribute value is used as the mask target position;

[0102] Step S530: If the first validity check result indicates that the mask position parameter is illegal, the position of the first character of the candidate service attribute value is used as the mask start position, and the position of the last character of the candidate service attribute value is used as the mask target position.

[0103] In step S510 of some embodiments, if the number of parameters is one, it means that the mask position parameter is only used to specify the starting position of the mask. In order to ensure the accuracy of the mask position parameter, the mask position parameter is subjected to a validity check to obtain a first validity check result. The first validity check result is used to indicate that the mask position parameter is legal or that the mask position parameter is illegal. Specifically, if the mask position parameter is less than or equal to 0, or the mask position parameter is greater than the string length of the candidate business attribute value, the mask position parameter is illegal. Conversely, if the mask position parameter is greater than 0 and less than or equal to the string length of the candidate business attribute value, the mask position parameter is legal. The string length is the number of characters in the candidate business attribute value.

[0104] In step S520 of some embodiments, if the first legality check result indicates that the mask position parameter is legal, the mask position parameter is used as the mask start position, and the position of the last character of the candidate business attribute value is used as the mask target position. For example, if the candidate business attribute value is 2022111415, and its string length is 10, if the mask position parameter is 3, the mask start position is 3, and the mask target position is 10.

[0105] In step S530 of some embodiments, if the first validity check result indicates that the mask position parameter is illegal, the position of the first character of the candidate business attribute value is used as the mask start position, and the position of the last character of the candidate business attribute value is used as the mask target position. For example, if the candidate business attribute value is 2022111415 and its string length is 10, if the mask position parameter is 14, the mask start position is 1 and the mask target position is 10.

[0106] Through the above steps S510 to S530, when the mask position parameter is illegal, the service attribute value can be fully masked, thereby ensuring the security of the service data. When the mask position parameter is legal, the mask position of the service attribute value can be dynamically adjusted according to the mask position parameter.

[0107] See also Figure 6 In some embodiments, step S420 may include but is not limited to steps S610 to S620:

[0108] Step S610: if the number of parameters is two, extract the parameters of the mask position parameters to obtain the first position parameter and the second position parameter, perform a validity check on the first position parameter to obtain a second validity check result, perform a validity check on the second position parameter to obtain a third validity check result; wherein the second validity check result is used to indicate the validity of the first position parameter, and the third validity check result is used to indicate the validity of the second position parameter;

[0109] Step S620, determining the mask starting position according to the second and third legitimacy check results, and determining the mask target position according to the second and third legitimacy check results.

[0110] In step S610 of some embodiments, if the number of parameters is two, the mask position parameter is extracted to obtain a first position parameter and a second position parameter, wherein the first position parameter is used to specify the mask starting position, and the second position parameter is used to specify the mask target position. The second position parameter has a positive number representation and a negative number representation, and these two representations are used to specify the string traversal direction of the candidate business attribute value. If the second position parameter is a positive number, it means that the string traversal direction is positive, that is, from left to right. If the second position parameter is a negative number, it means that the string traversal direction is reverse, that is, from right to left. For example, if the second position parameter is 2, the candidate business attribute value is traversed from left to right, and the position where the second character is located is the second position parameter. If the second position parameter is -2, the candidate business attribute value is traversed from right to left, and the position where the second character is located is the second position parameter.

[0111] In order to ensure the accuracy of the first position parameter and the second position parameter, the first position parameter and the second position parameter are subjected to a validity check. When the second position parameter is greater than 0, if the first position parameter is greater than or equal to the string length of the candidate service attribute value, or the first position parameter is greater than or equal to the second position parameter, or the mask position parameter is less than or equal to 0, the second validity check result is determined to be that the first position parameter is illegal; if the first position parameter is greater than 0 and less than the string length of the candidate service attribute value, and the first position parameter is less than the second position parameter, the second validity check result is determined to be that the first position parameter is legal. When the second position parameter is greater than 0, if the second position parameter is greater than the string length of the candidate service attribute value, or the second position parameter is less than or equal to the first position parameter, the third validity check result is determined to be that the second position parameter is illegal; otherwise, if the second position parameter is greater than the first position parameter, and the second position parameter is less than or equal to the string length of the candidate service attribute value, the third validity check result is determined to be that the second position parameter is legal.

[0112] When the second position parameter is equal to 0, the third validity check result is determined to be that the second position parameter is illegal. The second validity check result can be obtained by referring to the case where it is greater than 0, which will not be repeated here.

[0113] In the case where the second position parameter is less than 0, if the first position parameter is greater than or equal to the string length of the candidate business attribute value, or the mask position parameter is less than or equal to 0, the second legitimacy check result is determined to be that the first position parameter is illegal. If the mask position parameter is greater than 0 and less than the string length, the second legitimacy check result is determined to be that the first position parameter is legal. If the sum of the absolute values ​​of the first position parameter and the second position parameter is greater than the string length, compare the absolute value of the second position parameter and the string length. If the absolute value of the second position parameter is greater than the string length, the third legitimacy check result is determined to be that the second position parameter is illegal. If the absolute value of the second position parameter is less than or equal to the string length, the third legitimacy check result is determined to be that the second position parameter is legal.

[0114] In step S620 of some embodiments, in order to ensure the accuracy of the mask starting position and the mask target position, the influence of the second legitimacy check result and the third legitimacy check result on the position calculation result is comprehensively considered, the mask starting position is determined according to the second legitimacy check result and the third legitimacy check result, and the mask target position is determined according to the second legitimacy check result and the third legitimacy check result.

[0115] Through the above steps S610 to S620, the mask start position and mask target position of the service attribute value can be dynamically adjusted according to the first position parameter and the second position parameter, thereby increasing the flexibility of the service data mask.

[0116] See also Figure 7 In some embodiments, step S620 may include but is not limited to step S710 or step S720:

[0117] Step S710, if the second legality check result indicates that the first position parameter is legal, and the third legality check result indicates that the second position parameter is legal, the first position parameter is used as the mask start position, and the second position parameter is used as the mask target position;

[0118] Step S720: If the second legitimacy check result indicates that the first position parameter is illegal, or the third legitimacy check result indicates that the second position parameter is illegal, the position of the first character of the candidate business attribute value is used as the mask starting position, and the position of the last character of the candidate business attribute value is used as the mask target position.

[0119] In step S710 of some embodiments, if the second legality check result indicates that the first position parameter is legal, and the third legality check result indicates that the second position parameter is legal, the first position parameter is used as the mask starting position, and the second position parameter is used as the mask target position.

[0120] In step S720 of some embodiments, if the second legitimacy check result indicates that the first position parameter is illegal, or the third legitimacy check result indicates that the second position parameter is illegal, the candidate business attribute value is completely masked, and the position of the first character of the candidate business attribute value is used as the mask starting position, and the position of the last character of the candidate business attribute value is used as the mask target position.

[0121] Through the above steps S710 to S720, a suitable mask strategy can be formulated for the candidate service attribute value whether the mask position parameter is legal or illegal, thereby greatly improving the security of the candidate service attribute value.

[0122] The business data masking method of the embodiment of the present application includes: receiving a business access request from a client, and obtaining original business data in response to the business access request, wherein the original business data includes an original business attribute key and an original business attribute value. Business mask data is obtained according to the request URL of the business access request, and the business mask data includes a business attribute field and a mask configuration parameter of the business attribute field, and the mask configuration parameter includes a mask switch configuration and a mask position configuration. If the original business attribute key is a non-null value and the original business attribute value is a non-null value, the business attribute field matched by the original business attribute key is obtained to obtain the target business attribute. The mask switch configuration of the target business attribute is obtained to obtain the switch configuration parameter. If the switch configuration parameter is a null value, or the switch configuration parameter is a character other than a specific character, the mask position configuration of the target business attribute is obtained to obtain the position configuration parameter. The original business attribute value is masked according to the position configuration parameter. The business data masking method of the embodiment of the present application can reduce the repetitive development of interface sensitive information masking, reduce the redundancy and complexity of the code, improve development efficiency, and reduce development costs. In addition, the business data masking method can be refined to the masking rules of specific interfaces and specific business fields. It is highly flexible and scalable, and can be configured and adjusted in real time according to actual needs. It can be adapted to the security requirements of different business attributes and different business scenarios, reducing the intrusion into the business interface code and improving the efficiency and security of interface business data masking.

[0123] See also Figure 8 The embodiment of the present application further provides a service data masking device, which can implement the above service data masking method, and the device includes:

[0124] The request acquisition module 810 is used to acquire a service access request; wherein the service access request includes a resource location identifier;

[0125] The response module 820 is used to obtain original business data in response to the business access request; wherein the original business data includes an original business attribute key and an original business attribute value;

[0126] The mask data acquisition module 830 is used to acquire the service mask data according to the resource location identifier; wherein the service mask data includes the service attribute field and the mask configuration parameters of the service attribute field;

[0127] The key data verification module 840 is used to verify the key data legitimacy of the original business attribute key to obtain a candidate business attribute key;

[0128] The value data verification module 850 is used to verify the legitimacy of the value data of the original business attribute value to obtain a candidate business attribute value;

[0129] A field acquisition module 860 is used to acquire the business attribute field of the candidate business attribute key to obtain the target business attribute;

[0130] The parameter acquisition module 870 is used to acquire the mask configuration parameters of the target service attributes to obtain the target mask parameters;

[0131] The masking module 880 is used to mask the candidate service attribute values ​​according to the target masking parameters.

[0132] The specific implementation of the service data masking device is basically the same as the specific implementation of the service data masking method described above, and will not be repeated here.

[0133] The embodiment of the present application also provides an electronic device, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor implements the above-mentioned service data masking method when executing the computer program. The electronic device can be any intelligent terminal including a tablet computer, a car computer, etc.

[0134] See also Fig. 9 , Fig. 9 The hardware structure of an electronic device of another embodiment is illustrated, and the electronic device includes:

[0135] The processor 910 may be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present application.

[0136] The memory 920 can be implemented in the form of a read-only memory (ROM), a static storage device, a dynamic storage device, or a random access memory (RAM). The memory 920 can store an operating system and other applications. When the technical solution provided in the embodiment of this specification is implemented by software or firmware, the relevant program code is stored in the memory 920, and the processor 910 calls and executes the service data masking method of the embodiment of this application;

[0137] Input / output interface 930, used to implement information input and output;

[0138] Communication interface 940, used to realize communication interaction between the device and other devices, which can be realized through wired mode (such as USB, network cable, etc.) or wireless mode (such as mobile network, WI FI, Bluetooth, etc.);

[0139] bus 950 , which transmits information between the various components of the device (e.g., processor 910 , memory 920 , input / output interface 930 , and communication interface 940 );

[0140] The processor 910 , the memory 920 , the input / output interface 930 , and the communication interface 940 are connected to each other in communication within the device via a bus 950 .

[0141] An embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned business data masking method is implemented.

[0142] The memory, as a non-transient computer-readable storage medium, can be used to store non-transient software programs and non-transient computer executable programs. In addition, the memory may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some embodiments, the memory may optionally include a memory remotely disposed relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0143] The business data masking method and device, electronic device and storage medium provided in the embodiments of the present application can dynamically define and adjust masking rules according to changing actual business needs in business data masking scenarios. Compared with static masking, the flexibility and scalability of business data masking are guaranteed, thereby reducing the management cost of business data.

[0144] The embodiments described in the embodiments of the present application are intended to more clearly illustrate the technical solutions of the embodiments of the present application and do not constitute a limitation on the technical solutions provided in the embodiments of the present application. Those skilled in the art will appreciate that with the evolution of technology and the emergence of new application scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0145] Those skilled in the art will appreciate that the technical solutions shown in the figures do not constitute a limitation on the embodiments of the present application, and may include more or fewer steps than shown in the figures, or a combination of certain steps, or different steps.

[0146] The device embodiments described above are merely illustrative, and the units described as separate components may or may not be physically separated, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0147] Those skilled in the art will appreciate that all or some of the steps in the methods disclosed above, and the functional modules / units in the systems and devices may be implemented as software, firmware, hardware, or a suitable combination thereof.

[0148] The terms "first", "second", "third", "fourth", etc. (if any) in the specification of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0149] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.

[0150] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the above units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0151] The units described above as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0152] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0153] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including multiple instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (Read-Only Memory, referred to as ROM), random access memory (Random Access Memory, referred to as RAM), disk or optical disk and other media that can store programs.

[0154] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A service data masking method, characterized in that: The method comprises: Obtaining a service access request; wherein the service access request includes a resource location identifier; In response to the service access request, original service data is acquired; wherein the original service data includes an original service attribute key and an original service attribute value; Acquire service mask data according to the resource location identifier; wherein the service mask data includes a service attribute field and a mask configuration parameter of the service attribute field; Performing a key data legitimacy check on the original business attribute key to obtain a candidate business attribute key; Performing a value data legitimacy check on the original service attribute value to obtain a candidate service attribute value; Acquire the business attribute field of the candidate business attribute key to obtain a target business attribute; Obtaining a mask configuration parameter of the target service attribute to obtain a target mask parameter; The candidate service attribute value is masked according to the target mask parameter.

2. The method according to claim 1, characterized in that The target mask parameter includes a mask switch parameter and a mask position parameter, and the step of masking the candidate service attribute value according to the target mask parameter includes: Acquire the data display format of the candidate service attribute value according to the mask switch parameter to obtain a target display format; The candidate service attribute values ​​are masked according to the target display format and the mask position parameters.

3. The method according to claim 2, characterized in that The data display format includes a ciphertext display format, and masking the candidate service attribute value according to the target display format and the mask position parameter includes: If the target display format is a ciphertext display format, determining a mask start position and a mask target position according to the mask position parameter; The candidate service attribute value is masked according to the mask start position and the mask target position.

4. The method according to claim 3, characterized in that The step of determining the mask starting position and the mask target position according to the mask position parameter comprises: If the mask position parameter is a null value, the position of the first character of the candidate service attribute value is used as the mask start position, and the position of the last character of the candidate service attribute value is used as the mask target position; If the mask position parameter is a non-null value, the parameter quantity of the mask position parameter is obtained, and the mask start position and the mask target position are determined according to the parameter quantity.

5. The method according to claim 4, characterized in that The determining the mask starting position and the mask target position according to the number of parameters includes: If the number of parameters is one, a legality check is performed on the mask position parameter to obtain a first legality check result; wherein the first legality check result is used to indicate the legality of the mask position parameter; If the first legality check result indicates that the mask position parameter is legal, the mask position parameter is used as the mask start position, and the position of the last character of the candidate service attribute value is used as the mask target position; If the first legality check result indicates that the mask position parameter is illegal, the position of the first character of the candidate service attribute value is used as the mask starting position, and the position of the last character of the candidate service attribute value is used as the mask target position.

6. The method according to claim 4, characterized in that The determining the mask starting position and the mask target position according to the number of parameters includes: If the number of parameters is two, perform parameter extraction on the mask position parameter to obtain a first position parameter and a second position parameter, perform a legitimacy check on the first position parameter to obtain a second legitimacy check result, and perform a legitimacy check on the second position parameter to obtain a third legitimacy check result; wherein the second legitimacy check result is used to indicate the legitimacy of the first position parameter, and the third legitimacy check result is used to indicate the legitimacy of the second position parameter; The mask starting position is determined according to the second legality check result and the third legality check result, and the mask target position is determined according to the second legality check result and the third legality check result.

7. The method according to claim 6, characterized in that The step of determining the mask starting position according to the second legality check result and the third legality check result, and determining the mask target position according to the second legality check result and the third legality check result, comprises: If the second legality check result indicates that the first position parameter is legal, and the third legality check result indicates that the second position parameter is legal, the first position parameter is used as the mask starting position, and the second position parameter is used as the mask target position; If the second legitimacy check result indicates that the first position parameter is illegal, or the third legitimacy check result indicates that the second position parameter is illegal, the position of the first character of the candidate business attribute value is used as the mask starting position, and the position of the last character of the candidate business attribute value is used as the mask target position.

8. A service data masking device, characterized in that: The device comprises: A request acquisition module, used to acquire a service access request; wherein the service access request includes a resource location identifier; A response module, configured to obtain original business data in response to the business access request; wherein the original business data includes an original business attribute key and an original business attribute value; A mask data acquisition module, used to acquire service mask data according to the resource location identifier; wherein the service mask data includes a service attribute field and a mask configuration parameter of the service attribute field; A key data verification module, used to verify the key data legitimacy of the original business attribute key to obtain a candidate business attribute key; A value data verification module, used to perform value data legitimacy verification on the original business attribute value to obtain a candidate business attribute value; A field acquisition module, used to acquire the business attribute field of the candidate business attribute key to obtain a target business attribute; A parameter acquisition module, used to acquire the mask configuration parameters of the target service attributes to obtain target mask parameters; A masking module is used to mask the candidate service attribute value according to the target masking parameter.

9. An electronic device, characterized in that: The electronic device comprises a memory and a processor, the memory stores a computer program, and the processor implements the method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images