Sensitive information processing method and device, computer equipment and storage medium

Abstract

The invention belongs to the field of data processing and financial science and technology, and relates to a sensitive information processing method and device, computer equipment and a storage medium, and the method comprises the steps: triggering a scanning task to establish a connection with a specified database when the current time reaches regular scanning time; performing field content collection on the specified database to obtain field content; performing sensitive information identification on the field content based on a regular matching rule to obtain sensitive information; performing length verification on the sensitive information based on the field length of the sensitive information; if the sensitive information passes the length verification, generating a correctness verification result corresponding to the sensitive information based on a context verification rule; if the content of the correctness verification result is that correctness verification is passed, alarm information is generated based on the sensitive information; and sending the alarm information to related personnel. In addition, the sensitive information can be stored in the block chain. According to the method and the device, the recognition efficiency and the recognition accuracy of the sensitive information in the specified database are effectively improved.

Description

Technical Field

[0001] The present application relates to the fields of data processing technology and financial technology, and in particular to methods, devices, computer equipment and storage media for processing sensitive information. Background Art

[0002] With the deepening development of the digital age, the amount of data in the financial industry has exploded, especially sensitive information such as customer information and transaction data, which has become the core asset of financial institutions. The security and privacy of this sensitive information is directly related to the reputation, business stability and legal risks of financial institutions. Therefore, financial institutions are paying more and more attention to data security management, and the encrypted storage of sensitive information has become a key means to prevent data leakage and illegal access.

[0003] However, the current storage management of sensitive information faces many challenges. First, the identification of sensitive information in the database mainly relies on the experience of developers or manual identification, which is not only inefficient but also prone to errors, making it difficult to ensure that all sensitive information is accurately identified. Summary of the invention

[0004] The purpose of the embodiments of the present application is to propose a method, apparatus, computer equipment and storage medium for processing sensitive information, so as to solve the technical problem that the identification of sensitive information in the existing database mainly relies on the experience and judgment of developers or manual identification, which is not only inefficient but also prone to errors and it is difficult to ensure that all sensitive information is accurately identified.

[0005] In order to solve the above technical problems, the embodiment of the present application provides a method for processing sensitive information, which adopts the following technical solution:

[0006] When the current time reaches the preset regular scanning time, the scanning task is triggered to establish a connection with the specified database;

[0007] Performing field content collection and processing on the designated database to obtain corresponding field content;

[0008] Based on a preset regular matching rule, sensitive information identification processing is performed on the field content to obtain corresponding sensitive information;

[0009] Obtaining the field length of the sensitive information, and performing length verification on the sensitive information based on the field length;

[0010] If the sensitive information passes the length verification, generating a correctness verification result corresponding to the sensitive information based on a preset context verification rule;

[0011] If the content of the correctness verification result is that the correctness verification is passed, generating corresponding warning information based on the sensitive information;

[0012] The warning information is sent to relevant personnel.

[0013] Furthermore, the step of verifying the length of the sensitive information based on the field length specifically includes:

[0014] Performing data analysis on the sensitive information to obtain an initial sensitive information type corresponding to the sensitive information;

[0015] Obtaining a standard length corresponding to the initial sensitive information type;

[0016] Determining whether the field length is equal to the standard length;

[0017] If so, determining that the sensitive information passes length verification;

[0018] If not, it is determined that the sensitive information fails the length verification.

[0019] Furthermore, the step of generating a correctness verification result corresponding to the sensitive information based on a preset context verification rule specifically includes:

[0020] Collecting specified context information corresponding to the sensitive information based on a preset collection strategy;

[0021] Invoking the context validation rule;

[0022] Verifying the correctness of the sensitive information based on the specified context information and the context verification rule;

[0023] If the sensitive information passes the correctness verification, the generated content is a correctness verification result that passes the correctness verification;

[0024] If the sensitive information fails the correctness verification, the generated content is a correctness verification result that fails the correctness verification.

[0025] Furthermore, the step of generating corresponding warning information based on the sensitive information specifically includes:

[0026] Obtaining a first sensitive information type, storage location, and discovery time corresponding to the sensitive information;

[0027] Call the preset alarm notification template;

[0028] Filling the alarm notification template based on the first sensitive information type, the storage location, and the discovery time to obtain a filled alarm notification template;

[0029] The filled alarm notification template is used as the alarm information.

[0030] Furthermore, the step of collecting and processing the field content of the designated database to obtain the corresponding field content specifically includes:

[0031] Get the preset field query strategy;

[0032] Performing field recognition processing on the designated database based on the field query strategy to obtain corresponding recognition results;

[0033] The field content is generated based on the recognition result.

[0034] Furthermore, after the step of generating corresponding warning information based on the sensitive information, the method further includes:

[0035] Acquire a second sensitive information type corresponding to the sensitive information;

[0036] Call the preset desensitization rule library;

[0037] Querying a designated desensitization rule corresponding to the second sensitive information type from the desensitization rule library;

[0038] Call the preset desensitization tool;

[0039] Based on the desensitizing tool, the sensitive information in the designated database is desensitized according to the designated desensitizing rules.

[0040] Furthermore, the method for processing sensitive information further includes:

[0041] Determining whether a sensitive information query request for the designated database triggered by a user is received; wherein the sensitive information query request carries user information of the user;

[0042] If yes, extract the user information from the sensitive information query request, and determine the target role corresponding to the user based on the user information;

[0043] Obtaining target permissions corresponding to the target role;

[0044] Determining whether the target permissions include a designated operation permission corresponding to a database query operation;

[0045] If so, respond to the sensitive information query request; otherwise, limit the response to the sensitive information query request.

[0046] In order to solve the above technical problems, the embodiment of the present application further provides a sensitive information processing device, which adopts the following technical solution:

[0047] A trigger module, used for triggering a scanning task to establish a connection with a specified database when the current time reaches a preset periodic scanning time;

[0048] A collection module, used to collect and process the field content of the specified database to obtain the corresponding field content;

[0049] An identification module, used to perform sensitive information identification processing on the field content based on a preset regular matching rule to obtain corresponding sensitive information;

[0050] A verification module, used to obtain the field length of the sensitive information and perform length verification on the sensitive information based on the field length;

[0051] A first generating module, configured to generate a correctness verification result corresponding to the sensitive information based on a preset context verification rule if the sensitive information passes the length verification;

[0052] A second generating module, configured to generate corresponding warning information based on the sensitive information if the content of the correctness verification result passes the correctness verification;

[0053] The sending module is used to send the warning information to relevant personnel.

[0054] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution:

[0055] When the current time reaches the preset regular scanning time, the scanning task is triggered to establish a connection with the specified database;

[0056] Performing field content collection and processing on the designated database to obtain corresponding field content;

[0057] Based on a preset regular matching rule, sensitive information identification processing is performed on the field content to obtain corresponding sensitive information;

[0058] Obtaining the field length of the sensitive information, and performing length verification on the sensitive information based on the field length;

[0059] If the sensitive information passes the length verification, generating a correctness verification result corresponding to the sensitive information based on a preset context verification rule;

[0060] If the content of the correctness verification result is that the correctness verification is passed, generating corresponding warning information based on the sensitive information;

[0061] The warning information is sent to relevant personnel.

[0062] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:

[0063] When the current time reaches the preset regular scanning time, the scanning task is triggered to establish a connection with the specified database;

[0064] Performing field content collection and processing on the designated database to obtain corresponding field content;

[0065] Based on a preset regular matching rule, sensitive information identification processing is performed on the field content to obtain corresponding sensitive information;

[0066] Obtaining the field length of the sensitive information, and performing length verification on the sensitive information based on the field length;

[0067] If the sensitive information passes the length verification, generating a correctness verification result corresponding to the sensitive information based on a preset context verification rule;

[0068] If the content of the correctness verification result is that the correctness verification is passed, generating corresponding warning information based on the sensitive information;

[0069] The warning information is sent to relevant personnel.

[0070] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0071] When the current time reaches the preset periodic scanning time, the present application triggers a scanning task to establish a connection with a designated database; then the field content of the designated database is collected and processed to obtain the corresponding field content; then the field content is processed for sensitive information identification based on the preset regular matching rule to obtain the corresponding sensitive information; subsequently, the field length of the sensitive information is obtained, and the length of the sensitive information is verified based on the field length; if the sensitive information passes the length verification, a correctness verification result corresponding to the sensitive information is generated based on the preset context verification rule; if the content of the correctness verification result is that the correctness verification is passed, a corresponding alarm information is generated based on the sensitive information; finally, the alarm information is sent to relevant personnel. When the current time reaches the preset periodic scanning time, the present application automatically triggers a scanning task to establish a connection with a designated database, and the field content of the designated database is collected and processed to obtain the corresponding field content, and then based on the combined use of regular matching rules, length verification strategies and context verification rules, the sensitive information existing in the designated database can be automatically and accurately identified, which greatly reduces the workload of manual identification, effectively improves the efficiency of identifying sensitive information in the designated database, and can ensure the accuracy of the identified sensitive information. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0073] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0074] Figure 2 A flowchart of an embodiment of a method for processing sensitive information according to the present application;

[0075] Figure 3 is a structural schematic diagram of an embodiment of a sensitive information processing device according to the present application;

[0076] Figure 4 It is a structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0077] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0078] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0079] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0080] like Figure 1As shown, the system architecture 100 may include a terminal device 101, a network 102 and a server 103. The terminal device 101 may be a laptop 1011, a tablet computer 1012 or a mobile phone 1013. The network 102 is used to provide a medium for a communication link between the terminal device 101 and the server 103. The network 102 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0081] The user can use the terminal device 101 to interact with the server 103 through the network 102 to receive or send messages, etc. Various communication client applications can be installed on the terminal device 101, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0082] The terminal device 101 can be various electronic devices with a display screen and supporting web browsing. In addition to the laptop computer 1011, the tablet computer 1012 or the mobile phone 1013, the terminal device 101 can also be an e-book reader, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 (Moving Picture Experts Group Audio Layer IV) player, a laptop computer, a desktop computer, etc.

[0083] The server 103 may be a server that provides various services, such as a background server that provides support for a web page displayed on the terminal device 101 .

[0084] It should be noted that the method for processing sensitive information provided in the embodiments of the present application is generally executed by a server / terminal device, and accordingly, the device for processing sensitive information is generally set in the server / terminal device.

[0085] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0086] Continue to refer Figure 2, showing a flowchart of an embodiment of a method for processing sensitive information according to the present application. According to different requirements, the order of the steps in the flowchart can be changed, and some steps can be omitted. The method for processing sensitive information provided in the embodiment of the present application can be applied to any scenario where sensitive information processing is required, and the method for processing sensitive information can be applied to products in these scenarios, for example, sensitive information processing in the financial insurance field. The method for processing sensitive information includes the following steps:

[0087] Step S201 : when the current time reaches the preset periodic scanning time, a scanning task is triggered to establish a connection with a designated database.

[0088] In this embodiment, the sensitive information processing method is executed on the electronic device (eg Figure 1 The server / terminal device shown in the figure) can obtain the current time through a wired connection or a wireless connection. It should be noted that the above-mentioned wireless connection methods may include but are not limited to 3G / 4G / 5G connection, Wi-Fi connection, Bluetooth connection, Wi MAX connection, Zigbee connection, UWB (Ultra Wi DeBand) connection, and other wireless connection methods currently known or to be developed in the future. The executive subject of this application is specifically a sensitive information processing system, or simply referred to as the system. The system is deployed in advance to a server or cloud environment to ensure that the system can run stably and is compatible with other database systems. And enter all database asset information that needs to be monitored in the system, including database type, address, port, user name, password, etc., and maintain the current status of the database assets and the person in charge information. In the business application scenario of financial insurance, the above-mentioned designated database is all the database assets that need to be maintained corresponding to the financial insurance company.

[0089] Among them, a regular scanning time is pre-set in the system, such as daily, weekly or monthly, to ensure that all maintained database assets are scanned periodically. Then the system automatically starts the scanning task according to the set scanning plan, that is, when it is detected that the current time has reached the regular scanning time, the scanning task connects to the specified database through the configured database connection information (such as IP address, port, user name, password, etc.). Subsequently, the specified database is fully scanned to identify all tables, fields and their contents to obtain the field content. In addition, the above scanning plan may include: the specific time of the scan (such as 1 am every day), the scanning range (such as all production databases), the scanning depth (such as only scanning specific tables or fields), etc.

[0090] Step S202, performing field content collection processing on the designated database to obtain corresponding field content.

[0091] In this embodiment, the above-mentioned specific implementation process of collecting and processing the field content of the designated database to obtain the corresponding field content will be further described in detail in subsequent specific embodiments of the present application and will not be elaborated on here.

[0092] Step S203: Perform sensitive information identification processing on the field content based on a preset regular matching rule to obtain corresponding sensitive information.

[0093] In this embodiment, the configured regular matching rules can be used to perform a matching check on the collected field content to obtain the corresponding sensitive information. Among them, according to actual business needs and security standards, a series of regular matching rules are pre-defined. These regular matching rules are regular expression rules that can cover all sensitive information types that need to be identified, such as mobile phone numbers, ID card numbers, bank card numbers, etc. In addition, an interface can be reserved to add detection rules for other sensitive fields later.

[0094] Step S204: Obtain the field length of the sensitive information, and perform length verification on the sensitive information based on the field length.

[0095] In this embodiment, the specific implementation process of the length verification of the sensitive information based on the field length will be described in further detail in subsequent specific embodiments of the present application and will not be elaborated on here.

[0096] Step S205: If the sensitive information passes the length verification, a correctness verification result corresponding to the sensitive information is generated based on a preset context verification rule.

[0097] In this embodiment, the specific implementation process of generating the correctness verification result corresponding to the sensitive information based on the preset context verification rules will be further described in detail in subsequent specific embodiments of the present application, and will not be elaborated on here.

[0098] Step S206: If the content of the correctness verification result is that the correctness verification has been passed, a corresponding warning message is generated based on the sensitive information.

[0099] In this embodiment, the specific implementation process of generating corresponding alarm information based on the sensitive information will be described in further detail in subsequent specific embodiments of the present application, and will not be elaborated on here.

[0100] Step S207: sending the warning information to relevant personnel.

[0101] In this embodiment, the above-mentioned relevant personnel may be the person in charge of encryption storage, the person in charge of database development, etc. In addition, the warning information may be sent to the relevant personnel by using various methods such as email, SMS, system notification, etc.

[0102] When the current time reaches the preset periodic scanning time, the present application triggers a scanning task to establish a connection with a designated database; then the field content of the designated database is collected and processed to obtain the corresponding field content; then the field content is processed for sensitive information identification based on the preset regular matching rule to obtain the corresponding sensitive information; subsequently, the field length of the sensitive information is obtained, and the length of the sensitive information is verified based on the field length; if the sensitive information passes the length verification, a correctness verification result corresponding to the sensitive information is generated based on the preset context verification rule; if the content of the correctness verification result is that the correctness verification is passed, a corresponding alarm information is generated based on the sensitive information; finally, the alarm information is sent to relevant personnel. When the current time reaches the preset periodic scanning time, the present application automatically triggers a scanning task to establish a connection with a designated database, and the field content of the designated database is collected and processed to obtain the corresponding field content, and then based on the combined use of regular matching rules, length verification strategies and context verification rules, the sensitive information existing in the designated database can be automatically and accurately identified, which greatly reduces the workload of manual identification, effectively improves the efficiency of identifying sensitive information in the designated database, and can ensure the accuracy of the identified sensitive information.

[0103] In some optional implementations, step S204 includes the following steps:

[0104] Perform data analysis on the sensitive information to obtain an initial sensitive information type corresponding to the sensitive information.

[0105] In this embodiment, a designated regular matching rule matching the above sensitive information can be obtained, and then the designated regular matching rule can be analyzed to obtain the initial sensitive information type corresponding to the sensitive information. The initial sensitive information type may include a mobile phone number, an ID card number, etc.

[0106] Obtain a standard length corresponding to the initial sensitive information type.

[0107] In this embodiment, for the initial sensitive information type, its length is a fixed standard length. For example, if the initial sensitive information type is a mobile phone number, the corresponding standard length is 11. If the initial sensitive information type is an ID card number, the corresponding standard length is 18.

[0108] Determine whether the field length is equal to the standard length.

[0109] In this embodiment, the field length and the standard length may be numerically compared to obtain a corresponding numerical comparison result, wherein the numerical comparison result includes that the field length is equal to the standard length, or that the field length is not equal to the standard length.

[0110] If so, it is determined that the sensitive information passes the length verification.

[0111] In this embodiment, if the field length is equal to the standard length, it is determined that the sensitive information passes the length verification.

[0112] If not, it is determined that the sensitive information fails the length verification.

[0113] In this embodiment, if the field length is not equal to the standard length, the possibility that the field corresponding to the sensitive information is correct sensitive information can be ruled out, and then it is determined that the sensitive information has not passed the length verification.

[0114] In addition, you can also check whether the field name corresponding to sensitive information contains specific keywords. For example, if the field name contains words such as "phone" or "mobile", then the field is likely to contain a mobile phone number.

[0115] The present application performs data analysis on the sensitive information to obtain the initial sensitive information type corresponding to the sensitive information; then obtains the standard length corresponding to the initial sensitive information type; subsequently determines whether the field length is equal to the standard length; if so, determines that the sensitive information has passed the length verification; if not, determines that the sensitive information has not passed the length verification. The present application performs data analysis on the sensitive information to obtain the initial sensitive information type corresponding to the sensitive information, and obtains the standard length corresponding to the initial sensitive information type, and then compares the field length with the standard length numerically, so that the length verification result corresponding to the sensitive information can be quickly and accurately generated according to the obtained numerical comparison result, effectively ensuring the accuracy of the generated length verification result.

[0116] In some optional implementations of this embodiment, step S205 includes the following steps:

[0117] The specified context information corresponding to the sensitive information is collected based on a preset collection strategy.

[0118] In this embodiment, the above-mentioned collection strategy is a collection strategy for corresponding context information, and its strategy content includes: collecting context information related to sensitive information, which may specifically include: content around the field, associated fields, and timestamps. Among them, content around the field: analyze the text content before and after the sensitive information field to obtain context clues. Associated fields: search for other fields associated with the sensitive information field, such as user ID, order ID, etc., to obtain more comprehensive context information. Timestamp: record the time when the sensitive information is captured so as to combine it with user behavior analysis.

[0119] Invoke the context validation rule.

[0120] In this embodiment, the above-mentioned context validation rules are rules constructed according to actual business needs. Specifically, the rule content of the context validation rules includes: Business logic: understand business processes and rules. For example, the mobile phone number should be valid and in the correct format in the order details, but it is unlikely to appear in the user nickname. Data pattern: analyze the structure and pattern of the data. For example, the ID card number should match a specific field format (such as fixed length, number + check code) in the database and should not appear in the descriptive text field. User behavior: consider the user's behavior pattern. For example, a user who frequently changes his mobile phone number in a short period of time may be abnormal behavior.

[0121] The correctness of the sensitive information is verified based on the specified context information and the context verification rule.

[0122] In this embodiment, sensitive information is verified by combining the collected specified context information with the preset context verification rules, including format verification, association verification and behavior analysis verification. Among them, format verification includes: ensuring that sensitive information complies with its due format requirements, and checking whether there are unreasonable characters or format errors. Association verification includes: comparing sensitive information with associated fields to confirm whether the logical relationship between them is reasonable. Behavior analysis verification: combining user behavior patterns and timestamp information to analyze whether changes in sensitive information are within the normal range.

[0123] If the sensitive information passes the correctness verification, the generated content is a correctness verification result that passes the correctness verification.

[0124] In this embodiment, if the above sensitive information has passed format verification, association verification and behavior analysis verification, it is determined that the sensitive information has passed correctness verification, and it is confirmed that the information is correct sensitive information, and then a correctness verification result is generated that indicates that the content has passed correctness verification.

[0125] If the sensitive information fails the correctness verification, the generated content is a correctness verification result that fails the correctness verification.

[0126] In this embodiment, if the sensitive information fails at least one of the format verification, association verification, and behavior analysis verification, it is determined that the sensitive information fails the correctness verification, and a correctness verification result indicating that the correctness verification fails is generated. In addition, the sensitive information may be marked as a false positive or requires further review.

[0127] The present application collects the specified context information corresponding to the sensitive information based on a preset collection strategy; then calls the context verification rule; subsequently verifies the correctness of the sensitive information based on the specified context information and the context verification rule; if the sensitive information passes the correctness verification, the generated content is a correctness verification result that passes the correctness verification; and if the sensitive information fails the correctness verification, the generated content is a correctness verification result that fails the correctness verification. The present application collects the specified context information corresponding to the sensitive information based on a preset collection strategy, and then verifies the correctness of the sensitive information in combination with the use of the specified context information and the context verification rule, thereby effectively improving the accuracy of the correctness verification of the sensitive information, thereby effectively ensuring the accuracy and security of the sensitive information.

[0128] In some optional implementations, step S206 includes the following steps:

[0129] Obtain a first sensitive information type, storage location, and discovery time corresponding to the sensitive information.

[0130] In this embodiment, the first sensitive information type may include a mobile phone number, ID card number, etc. The storage location refers to the storage location of the sensitive information in a specified database, such as a database name, table name, field name, etc. The discovery time refers to the timestamp information of identifying the sensitive information. Among them, by reminding relevant personnel according to the discovery time, which are newly added and which are historically discovered fields, it is convenient for relevant personnel to confirm and schedule the latest fields.

[0131] Call the preset alarm notification template.

[0132] In this embodiment, a unified alarm notification template can be pre-built according to actual alarm notification requirements for sensitive information to ensure clarity, accuracy and consistency of the alarm information.

[0133] The alarm notification template is filled based on the first sensitive information type, the storage location, and the discovery time to obtain a filled alarm notification template.

[0134] In this embodiment, the first sensitive information type, the storage location, and the discovery time may be filled into corresponding positions in the above-mentioned alarm notification template, thereby generating a corresponding filled alarm notification template.

[0135] The filled alarm notification template is used as the alarm information.

[0136] This application obtains the first sensitive information type, storage location and discovery time corresponding to the sensitive information; then calls a preset alarm notification template; then fills the alarm notification template based on the first sensitive information type, storage location and discovery time to obtain a filled alarm notification template; and subsequently uses the filled alarm notification template as the alarm information. This application uses the alarm notification template to fill the alarm notification template with the first sensitive information type, storage location and discovery time corresponding to the sensitive information, so as to automatically and accurately generate alarm information corresponding to the sensitive information, thereby improving the efficiency and intelligence of generating alarm information.

[0137] In some optional implementations, step S202 includes the following steps:

[0138] Get the preset field query strategy.

[0139] In this embodiment, the above field query strategy can adopt a paging query strategy. If the amount of data in the data table is large, querying all the data at one time may consume a lot of memory and time. Therefore, by adopting a paging query strategy, the query results are processed in pages, and only a small part of the data is queried each time. This can be achieved by adding LIMIT and OFFSET clauses in the SQL query statement.

[0140] Based on the field query strategy, field recognition processing is performed on the designated database to obtain corresponding recognition results.

[0141] In this embodiment, the field identification process of the designated database may be performed according to the policy content of the paging query policy, thereby obtaining the corresponding query result.

[0142] The field content is generated based on the recognition result.

[0143] In this embodiment, the query result is usually returned in the form of a result set, and the result set can be traversed and field contents can be extracted by using corresponding library functions.

[0144] The present application obtains a preset field query strategy; then performs field recognition processing on the specified database based on the field query strategy to obtain a corresponding recognition result; and subsequently generates the field content based on the recognition result. The present application performs field recognition processing on the specified database based on the use of a field query strategy, so as to quickly and accurately obtain the corresponding field content, effectively improve the processing efficiency of field content collection, and ensure the data accuracy of the obtained field content.

[0145] In some optional implementations of this embodiment, after step S207, the electronic device may further perform the following steps:

[0146] Obtain a second sensitive information type corresponding to the sensitive information.

[0147] In this embodiment, after the sensitive information is detected to have passed the correctness verification, a second sensitive information type corresponding to the sensitive information may be further obtained. Exemplarily, the second sensitive information type may include a mobile phone number, an ID card number, and the like.

[0148] Call the preset desensitization rule library.

[0149] In the present embodiment, the above-mentioned desensitization rule library is a pre-built database storing a variety of sensitive information types and desensitization rules corresponding to various sensitive information types. Among them, for sensitive information of different sensitive information types, desensitization rules corresponding to the sensitive information types can be pre-set according to factors such as the sensitivity, storage requirements, and transmission requirements of the sensitive information. Among them, the desensitization rules may at least include partial hiding, desensitization, hashing, replacement and other rules. Exemplarily, if the sensitive information type is a mobile phone number, the corresponding desensitization rule is: write a desensitization function for the mobile phone number, and desensitize the bank card number according to the desensitization function. If the sensitive information type is an ID card number, the corresponding desensitization rule is: write a partially hidden hidden function for the ID card number, and desensitize the ID card number according to the hidden function.

[0150] A designated desensitization rule corresponding to the second sensitive information type is queried from the desensitization rule library.

[0151] In this embodiment, the designated sensitive data type matching the second sensitive information type can be queried from the desensitization rule library, and then the desensitization rule corresponding to the designated sensitive data type can be found from the desensitization rule library to obtain the designated desensitization rule.

[0152] Call the preset desensitization tool.

[0153] In this embodiment, the above-mentioned desensitization tool is a pre-built tool for desensitizing the sensitive information to be processed according to the defined desensitization rules.

[0154] Based on the desensitizing tool, the sensitive information in the designated database is desensitized according to the designated desensitizing rules.

[0155] In this embodiment, the above-mentioned designated desensitization rules are input into the above-mentioned desensitization tool, and then the desensitization tool performs desensitization processing on the sensitive information in the designated database according to the designated desensitization rules.

[0156] The present application obtains the second sensitive information type corresponding to the sensitive information; then calls a preset desensitizing rule library; then queries the specified desensitizing rule corresponding to the second sensitive information type from the desensitizing rule library; subsequently calls a preset desensitizing tool; and finally, based on the desensitizing tool, desensitizes the sensitive information in the specified database according to the specified desensitizing rule. The present application can quickly and accurately query the specified desensitizing rule corresponding to the second sensitive information type of sensitive information based on the use of a desensitizing rule library, thereby improving the efficiency and accuracy of obtaining the specified desensitizing rule. Furthermore, by using a desensitizing tool and desensitizing the sensitive information in the specified database according to the specified encryption rules, the standardization and intelligence of the desensitizing processing of the sensitive information in the specified database are effectively improved.

[0157] In some optional implementations of this embodiment, the electronic device may further perform the following steps:

[0158] Determine whether a sensitive information query request for the designated database triggered by a user is received; wherein the sensitive information query request carries user information of the user.

[0159] In this embodiment, the sensitive information query request is a request triggered by a user to query sensitive information in a specified database. The user information includes the user's name.

[0160] If so, the user information is extracted from the sensitive information query request, and a target role corresponding to the user is determined based on the user information.

[0161] In this embodiment, the corresponding user information can be extracted by parsing the sensitive information query request. According to business needs and security requirements, different user roles are pre-divided for each user, and corresponding permissions are assigned to each role. There is a one-to-one correspondence between the user information of the user and the role corresponding to the user. The matching user role, i.e., the target role, can be queried based on the user information of the user.

[0162] Get the target permission corresponding to the target role.

[0163] In this embodiment, access rights to database resources are pre-assigned to each role, including rights to read, write, modify and delete data. There is a one-to-one correspondence between the user's role and the user's rights. All access rights that match the target role, i.e., the target rights, can be queried based on the target role.

[0164] It is determined whether the target permissions include a designated operation permission corresponding to the database query operation.

[0165] In this embodiment, the database query operation is a permission corresponding to data reading of database resources. All access permissions included in the target permission can be analyzed to detect whether the specified operation permission corresponding to the database query operation is included in all the access permissions.

[0166] If so, respond to the sensitive information query request; otherwise, limit the response to the sensitive information query request.

[0167] In this embodiment, if the target permissions include the specified operation permissions corresponding to the database query operation, it is determined that the current user has the operation permissions to perform database queries, and the sensitive information query request is responded to. If the target permissions do not include the specified operation permissions corresponding to the database query operation, it is determined that the current user does not have the operation permissions to perform database queries, and the response to the sensitive information query request is restricted, that is, the sensitive information query request is not responded to.

[0168] The present application determines whether a sensitive information query request for the specified database triggered by a user is received; if so, the user information is extracted from the sensitive information query request, and the target role corresponding to the user is determined based on the user information; then the target permission corresponding to the target role is obtained; and subsequently, it is determined whether the target permission includes the specified operation permission corresponding to the database query operation; if so, the sensitive information query request is responded to, otherwise the sensitive information query request is restricted. When the present application receives a sensitive information query request for the specified database triggered by a user, the user's target role is determined according to the user information carried in the sensitive information query request, and then the target permission corresponding to the target role is detected to include the specified operation permission corresponding to the database query operation. Only when the specified operation permission corresponding to the database query operation is detected, the sensitive information query request is subsequently responded to, which effectively ensures the intelligent processing and standard processing of the sensitive information query request, strengthens the access control policy for the specified database, restricts the access rights to the sensitive information in the specified database, and is conducive to ensuring the access security of the specified database.

[0169] In some optional implementations, the user information obtained is subject to the user's consent and complies with relevant laws and policies.

[0170] In addition, the non-Company software tools or components that appear in the embodiments of the present application are merely examples and do not represent actual use.

[0171] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0172] It should be emphasized that in order to further ensure the privacy and security of the above sensitive information, the above sensitive information can also be stored in a blockchain node.

[0173] The blockchain referred to in this application is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, platform product service layer, and application service layer.

[0174] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Artificial Intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0175] AI basic technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, etc. AI software technologies mainly include computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0176] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0177] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0178] Further references Figure 3 , as a response to the above Figure 2 The present application provides an embodiment of a sensitive information processing device, and the device embodiment is similar to Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0179] like Figure 3As shown, the sensitive information processing device 300 described in this embodiment includes: a trigger module 301, a collection module 302, an identification module 303, a verification module 304, a first generation module 305, a second generation module 306 and a sending module 307. Among them:

[0180] The trigger module 301 is used to trigger the scanning task to establish a connection with a specified database when the current time reaches the preset regular scanning time;

[0181] The collection module 302 is used to collect and process the field content of the specified database to obtain the corresponding field content;

[0182] An identification module 303 is used to perform sensitive information identification processing on the field content based on a preset regular matching rule to obtain corresponding sensitive information;

[0183] A verification module 304, configured to obtain a field length of the sensitive information and perform length verification on the sensitive information based on the field length;

[0184] A first generating module 305, configured to generate a correctness verification result corresponding to the sensitive information based on a preset context verification rule if the sensitive information passes the length verification;

[0185] A second generating module 306, configured to generate corresponding warning information based on the sensitive information if the content of the correctness verification result passes the correctness verification;

[0186] The sending module 307 is used to send the warning information to relevant personnel.

[0187] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the sensitive information processing method in the aforementioned implementation mode, and are not described in detail here.

[0188] In some optional implementations of this embodiment, the verification module 304 includes:

[0189] An analysis submodule, used to perform data analysis on the sensitive information to obtain an initial sensitive information type corresponding to the sensitive information;

[0190] A first acquisition submodule, used to acquire a standard length corresponding to the initial sensitive information type;

[0191] A judging submodule, used for judging whether the field length is equal to the standard length;

[0192] A first determination submodule, configured to determine that if yes, the sensitive information passes the length verification;

[0193] The second determination submodule is used to determine if the sensitive information fails the length verification.

[0194] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the sensitive information processing method in the aforementioned implementation mode, and are not described in detail here.

[0195] In some optional implementations of this embodiment, the first generating module 305 includes:

[0196] A collection submodule, used to collect specified context information corresponding to the sensitive information based on a preset collection strategy;

[0197] A first calling submodule, used for calling the context verification rule;

[0198] A verification submodule, configured to verify the correctness of the sensitive information based on the specified context information and the context verification rule;

[0199] A first generating submodule, configured to generate a correctness verification result indicating that the sensitive information passes the correctness verification if the sensitive information passes the correctness verification;

[0200] The second generating submodule is used to generate a correctness verification result indicating that the sensitive information has not passed the correctness verification if the sensitive information has not passed the correctness verification.

[0201] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the sensitive information processing method in the aforementioned implementation mode, and are not described in detail here.

[0202] In some optional implementations of this embodiment, the second generating module 306 includes:

[0203] A second acquisition submodule, used to acquire a first sensitive information type, a storage location, and a discovery time corresponding to the sensitive information;

[0204] The second calling submodule is used to call a preset alarm notification template;

[0205] A filling submodule, configured to fill the alarm notification template based on the first sensitive information type, the storage location, and the discovery time to obtain a filled alarm notification template;

[0206] The first determining submodule is used to use the filled alarm notification template as the alarm information.

[0207] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the sensitive information processing method in the aforementioned implementation mode, and are not described in detail here.

[0208] In some optional implementations of this embodiment, the collection module 302:

[0209] The third acquisition submodule is used to obtain a preset field query strategy;

[0210] An identification submodule, used to perform field identification processing on the specified database based on the field query strategy to obtain a corresponding identification result;

[0211] The second determination submodule is used to generate the field content based on the recognition result.

[0212] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the sensitive information processing method in the aforementioned implementation mode, and are not described in detail here.

[0213] In some optional implementations of this embodiment, the sensitive information processing device further includes:

[0214] A first acquisition module, used to acquire a second sensitive information type corresponding to the sensitive information;

[0215] The first calling module is used to call the preset desensitization rule library;

[0216] A query module, used to query the specified desensitization rule corresponding to the second sensitive information type from the desensitization rule library;

[0217] The second calling module is used to call the preset desensitization tool;

[0218] A desensitizing module is used to desensitize the sensitive information in the specified database based on the desensitizing tool and in accordance with the specified desensitizing rules.

[0219] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the sensitive information processing method in the aforementioned implementation mode, and are not described in detail here.

[0220] In some optional implementations of this embodiment, the sensitive information processing device further includes:

[0221] A first judgment module is used to judge whether a sensitive information query request for the specified database triggered by a user is received; wherein the sensitive information query request carries user information of the user;

[0222] a processing module, configured to extract the user information from the sensitive information query request, and determine a target role corresponding to the user based on the user information;

[0223] A second acquisition module is used to acquire the target permission corresponding to the target role;

[0224] A second judgment module is used to judge whether the target permissions include a designated operation permission corresponding to the database query operation;

[0225] The response module is used to respond to the sensitive information query request if yes, and otherwise limit the response to the sensitive information query request.

[0226] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the sensitive information processing method in the aforementioned implementation mode, and are not described in detail here.

[0227] To solve the above technical problems, the present application also provides a computer device. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0228] The computer device 4 includes a memory 41, a processor 42, and a network interface 43 that are interconnected through a system bus. It should be noted that the figure only shows a computer device 4 with components 41-43, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital processors (DSPs), embedded devices, etc.

[0229] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may interact with a user through a keyboard, a mouse, a remote controller, a touch pad, or a voice control device.

[0230] The memory 41 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 41 can be an internal storage unit of the computer device 4, such as a hard disk or memory of the computer device 4. In other embodiments, the memory 41 can also be an external storage device of the computer device 4, such as a plug-in hard disk equipped on the computer device 4, a smart memory card (Smart Med ia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. Of course, the memory 41 can also include both the internal storage unit of the computer device 4 and its external storage device. In this embodiment, the memory 41 is generally used to store the operating system and various application software installed on the computer device 4, such as computer-readable instructions of a method for processing sensitive information. In addition, the memory 41 can also be used to temporarily store various types of data that have been output or are to be output.

[0231] The processor 42 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor 42 is generally used to control the overall operation of the computer device 4. In this embodiment, the processor 42 is used to run computer-readable instructions stored in the memory 41 or process data, such as computer-readable instructions for running the sensitive information processing method.

[0232] The network interface 43 may include a wireless network interface or a wired network interface. The network interface 43 is generally used to establish a communication connection between the computer device 4 and other electronic devices.

[0233] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0234] In an embodiment of the present application, when the current time reaches the preset periodic scanning time, a scanning task is automatically triggered to establish a connection with a specified database, and field content collection and processing is performed on the specified database to obtain corresponding field content. Then, based on the combined use of regular matching rules, length verification strategies, and context verification rules, it is possible to automatically and accurately identify sensitive information existing in the specified database, greatly reducing the workload of manual identification, effectively improving the efficiency of identifying sensitive information in the specified database, and ensuring the accuracy of the identified sensitive information.

[0235] The present application also provides another embodiment, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the sensitive information processing method as described above.

[0236] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0237] In an embodiment of the present application, when the current time reaches the preset periodic scanning time, a scanning task is automatically triggered to establish a connection with a specified database, and field content collection and processing is performed on the specified database to obtain corresponding field content. Then, based on the combined use of regular matching rules, length verification strategies, and context verification rules, it is possible to automatically and accurately identify sensitive information existing in the specified database, greatly reducing the workload of manual identification, effectively improving the efficiency of identifying sensitive information in the specified database, and ensuring the accuracy of the identified sensitive information.

[0238] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0239] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to perform equivalent replacement of some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. A method for processing sensitive information, characterized in that: The steps include: When the current time reaches the preset regular scanning time, the scanning task is triggered to establish a connection with the specified database; Performing field content collection and processing on the designated database to obtain corresponding field content; Based on a preset regular matching rule, sensitive information identification processing is performed on the field content to obtain corresponding sensitive information; Obtaining the field length of the sensitive information, and performing length verification on the sensitive information based on the field length; If the sensitive information passes the length verification, generating a correctness verification result corresponding to the sensitive information based on a preset context verification rule; If the content of the correctness verification result is that the correctness verification is passed, generating corresponding warning information based on the sensitive information; The warning information is sent to relevant personnel.

2. The method for processing sensitive information according to claim 1, characterized in that: The step of verifying the length of the sensitive information based on the field length specifically includes: Performing data analysis on the sensitive information to obtain an initial sensitive information type corresponding to the sensitive information; Obtaining a standard length corresponding to the initial sensitive information type; Determining whether the field length is equal to the standard length; If so, determining that the sensitive information passes length verification; If not, it is determined that the sensitive information fails the length verification.

3. The method for processing sensitive information according to claim 1, characterized in that: The step of generating a correctness verification result corresponding to the sensitive information based on a preset context verification rule specifically includes: Collecting specified context information corresponding to the sensitive information based on a preset collection strategy; Invoking the context validation rule; Verifying the correctness of the sensitive information based on the specified context information and the context verification rule; If the sensitive information passes the correctness verification, the generated content is a correctness verification result that passes the correctness verification; If the sensitive information fails the correctness verification, the generated content is a correctness verification result that fails the correctness verification.

4. The method for processing sensitive information according to claim 1, characterized in that: The step of generating corresponding warning information based on the sensitive information specifically includes: Obtaining a first sensitive information type, storage location, and discovery time corresponding to the sensitive information; Call the preset alarm notification template; Filling the alarm notification template based on the first sensitive information type, the storage location, and the discovery time to obtain a filled alarm notification template; The filled alarm notification template is used as the alarm information.

5. The method for processing sensitive information according to claim 1, characterized in that: The step of collecting and processing the field content of the designated database to obtain the corresponding field content specifically includes: Get the preset field query strategy; Performing field recognition processing on the designated database based on the field query strategy to obtain corresponding recognition results; The field content is generated based on the recognition result.

6. The method for processing sensitive information according to claim 1, characterized in that: After the step of generating corresponding warning information based on the sensitive information, the method further includes: Acquire a second sensitive information type corresponding to the sensitive information; Call the preset desensitization rule library; Querying a designated desensitization rule corresponding to the second sensitive information type from the desensitization rule library; Call the preset desensitization tool; Based on the desensitizing tool, the sensitive information in the designated database is desensitized according to the designated desensitizing rules.

7. The method for processing sensitive information according to claim 1, characterized in that: The method for processing sensitive information further includes: Determining whether a sensitive information query request for the designated database triggered by a user is received; wherein the sensitive information query request carries user information of the user; If yes, extract the user information from the sensitive information query request, and determine the target role corresponding to the user based on the user information; Obtaining target permissions corresponding to the target role; Determining whether the target permissions include a designated operation permission corresponding to a database query operation; If so, respond to the sensitive information query request; otherwise, limit the response to the sensitive information query request.

8. A sensitive information processing device, characterized in that: include: A trigger module, used for triggering a scanning task to establish a connection with a specified database when the current time reaches a preset periodic scanning time; A collection module, used to collect and process the field content of the specified database to obtain the corresponding field content; An identification module, used to perform sensitive information identification processing on the field content based on a preset regular matching rule to obtain corresponding sensitive information; A verification module, used to obtain the field length of the sensitive information and perform length verification on the sensitive information based on the field length; A first generating module, configured to generate a correctness verification result corresponding to the sensitive information based on a preset context verification rule if the sensitive information passes the length verification; A second generating module, configured to generate corresponding warning information based on the sensitive information if the content of the correctness verification result passes the correctness verification; The sending module is used to send the warning information to relevant personnel.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the method for processing sensitive information as described in any one of claims 1 to 7 when executing the computer-readable instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the method for processing sensitive information as described in any one of claims 1 to 7.

Images