Method for supporting online configurable desensitization strategy to improve quick delivery capacity of desensitization product

Abstract

The invention relates to a method for supporting online configuration of a desensitization strategy to improve the quick delivery capacity of a desensitization product. The method comprises the steps that database connection is obtained, and an original SQL statement is intercepted in an agent or interceptor mode; based on a sensitive field defined in the desensitization platform, the JDBC driver searches whether the sensitive field exists in the original SQL statement or not; if the sensitive field exists in the original SQL statement, the JDBC driver replaces the sensitive field in the original SQL statement with a desensitization strategy corresponding to the sensitive field based on the desensitization strategy corresponding to the sensitive field pre-configured in a desensitization platform, and the desensitization strategy is used as a new query field to generate a desensitization SQL statement; the desensitized SQL statement is sent to a database, and the JDBC driver executes the desensitized SQL statement and returns a query result. By means of the method, different desensitization strategies can be configured online, secondary development and transformation do not need to be conducted on bottom-layer codes after configuration, and the rapid delivery capacity of desensitization products is improved while the desensitization requirements of customers for different service scenes are met.

Description

Technical Field

[0001] The present invention belongs to the technical field of data desensitization, and in particular relates to a method for supporting online configurable desensitization strategies to improve the ability to quickly deliver desensitized products. Background Art

[0002] Existing data desensitization technologies are mostly based on desensitization strategies that have been developed in advance to support desensitization capabilities. If a new desensitization strategy is required, the original code must be modified to support the new desensitization logic, which is time-consuming and labor-intensive. It cannot quickly respond to customers' desensitization needs in different business scenarios, which in turn leads to low product delivery efficiency. It is no longer suitable for the rapid delivery rhythm and application requirements of enterprise products. Summary of the invention

[0003] In order to overcome the defects of existing data desensitization technology that it is time-consuming and labor-intensive to change desensitization strategies, the response speed is slow, and the product delivery efficiency is low, the present invention proposes a new method that supports online configuration of desensitization strategies to improve the rapid delivery capability of desensitized products. Through this method, desensitization strategies for different sensitive fields can be flexibly configured in the desensitization platform, and after configuration, different sensitive fields can be used for different desensitization scenarios without secondary development and modification of the underlying code, which can not only meet the desensitization needs of customers for different business scenarios, but also improve the rapid delivery capability of desensitized products, so as to better adapt to the ever-changing business market.

[0004] Specifically, the present invention provides a method for supporting online configurable desensitization strategies to improve the ability to quickly deliver desensitized products, such as Figure 4 As shown, the method comprises the following steps: S1. Obtain database connection and intercept original SQL statements through proxy or interceptor; S2. Based on the sensitive fields defined in the desensitizing platform, the JDBC driver searches for the sensitive fields in the original SQL statement. S3. If the sensitive field exists in the original SQL statement, the JDBC driver replaces the sensitive field in the original SQL statement with the desensitization policy corresponding to the sensitive field pre-configured in the desensitization platform, and generates a desensitized SQL statement as a new query field; S4. Send the desensitized SQL statement to the database, and the JDBC driver executes the desensitized SQL statement and returns the query result.

[0005] Furthermore, the method of the present invention that supports online configuration of desensitization strategies to improve the ability to quickly deliver desensitized products also includes: pre-modifying the JDBC driver, configuring a unified SQL statement modification code in the JDBC driver, and the modified JDBC driver supports SQL statement modification for different desensitization strategies for different databases.

[0006] Furthermore, the present invention supports a method for improving the rapid delivery capability of desensitized products by configuring desensitization strategies online. When the business system operates the database, the business system replaces the JDBC driver referenced by itself with the modified JDBC driver, and then uses the modified JDBC driver to perform the desensitization task. The implementation process is as follows: 1) The business system replaces the JDBC driver it references with the modified JDBC driver; 2) The modified JDBC driver extracts the original SQL statement. If a sensitive field is found in the original SQL statement, the desensitizing policy corresponding to the sensitive field configured in the desensitizing platform is used to replace the sensitive field to obtain a desensitized SQL statement, which is then executed.

[0007] Furthermore, the present invention supports the method of online configuration of desensitization strategies to improve the rapid delivery capability of desensitized products. The desensitization platform described in step S2 adopts different desensitization strategies for different sensitive fields.

[0008] Furthermore, the present invention supports the method of online configurable desensitization strategy to improve the rapid delivery capability of desensitized products. In step S2, the JDBC driver identifies and searches for sensitive fields in the original SQL statement based on the principle of classification and grading.

[0009] Furthermore, the present invention supports the method of online configuration of desensitization strategy to improve the rapid delivery capability of desensitized products. The desensitization strategy corresponding to the sensitive field pre-configured in the desensitization platform described in step S3, if the sensitive field is name, and the original SQL statement is SELECT name from users where id = 1, then the following desensitization strategies are included: 1) Keep the first n and the last m SELECT CASE WHEN LENGTH(name)>n + m THEN LEFT(name, n) || RPAD('*',LENGTH(name) - n - m, '*') || RIGHT(name, m) ELSE name END AS name from userswhere id = 1; 2) Keep from x to y SELECT CASE WHEN LENGTH(col_name)>n - 1 THEN RPAD('*', n - 1, '*') ||SUBSTRING(col_name FROM n FOR m- n + 1) || RPAD('*', LENGTH(col_name) - m,'*')ELSE RPAD('*', LENGTH(col_name), '*') END AS name from users where id =1; 3) Cover the front n and the back m SELECT CASE WHEN LENGTH(col_name)>n + m THEN RPAD('*', n, '*') ||SUBSTRING(col_name FROM n + 1 FOR LENGTH(col_name) - n - m) || RPAD('*',m,'*') ELSE RPAD('*', LENGTH(col_name), '*') END AS name from users where id= 1; 4) Cover from x to y SELECT CASE WHEN LENGTH(col_name) = x THEN CONCAT(LEFT(col_name, x -1), RPAD('*', y - x + 1, '*')) WHEN LENGTH(col_name)>x THEN CONCAT(LEFT(col_name, x - 1), RPAD('*', y - x + 1, '*'), SUBSTRING(col_nameFROM y + 1)) ELSEcol_name END AS name from users where id = 1.

[0010] Furthermore, the present invention supports the method of online configuration of desensitization strategy to improve the rapid delivery capability of desensitized products. The desensitization strategy corresponding to the sensitive field pre-configured in the desensitization platform described in step S3, if the sensitive field is name, the original SQL statement is SELECT name from users where id = 1, and also includes the following desensitization strategy: 1) Mask before special characters; 2) Mask after special characters.

[0011] On the other hand, the present invention also provides a system that supports online configurable desensitization strategies to improve the rapid delivery capability of desensitized products. When the system is running, the steps of the method for supporting online configurable desensitization strategies to improve the rapid delivery capability of desensitized products are implemented.

[0012] In addition, the present invention also provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the steps of the above-mentioned method of supporting online configurable desensitization strategies to improve the rapid delivery capability of desensitized products are implemented.

[0013] In summary, different desensitization strategies can be configured online through the method of the present invention, without the need for secondary development and transformation of desensitization products. While meeting customers' desensitization needs for different business scenarios, the rapid delivery capability of desensitization products is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments of the present invention. Obviously, the following drawings are only some embodiments recorded in the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0015] Figure 1 This is a logic diagram of the JDBC driver parsing (transforming) SQL in the method of the present invention.

[0016] Figure 2 This is the overall business logic diagram of the method of the present invention.

[0017] Figure 3 This is an integrated logic diagram of the JDBC driver in the method of the present invention.

[0018] Figure 4 It is a schematic diagram of the implementation process of the method of the present invention. DETAILED DESCRIPTION

[0019] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of them. The present invention can also be implemented or applied through other different specific implementation methods. The details in this specification can also be modified or changed in various ways based on different viewpoints and applications without departing from the spirit of the present invention.

[0020] At the same time, it should be understood that the protection scope of the present invention is not limited to the specific embodiments described below; it should also be understood that the terms used in the embodiments of the present invention are for describing specific embodiments rather than for limiting the protection scope of the present invention.

[0021] Embodiment: A method for supporting online configurable desensitization strategies and improving the ability to quickly deliver desensitized products This solution requires the database JDBC driver to be modified first, that is, before executing the original SQL statement, the original SQL statement is extracted and the sensitive fields in the original SQL statement are found, and replaced with the desensitizing strategy of the sensitive field configured in the desensitizing platform (for example, the name field is processed as "keep the first n and the last m": CASE WHEN LENGTH(name)>n + m THENLEFT(name, n) || RPAD('*', LENGTH(name) - n - m, '*') || RIGHT(name, m) ELSEname END), so that the original data for querying the sensitive field becomes the data after the field is desensitized in the desensitization method. The JDBC driver finally executes the modified SQL statement (hereinafter referred to as desensitizing SQL), thereby achieving the effect of dynamic desensitization.

[0022] As mentioned above, in the JDBC driver, you only need to unify the code for SQL statement transformation to support SQL parsing transformation of different databases with different desensitization strategies, thereby achieving the ability of one-time development and permanent application. The logic of JDBC driver parsing (transforming) SQL in this method is as follows Figure 1 shown.

[0023] It should be noted that the desensitizing platform adopts different desensitizing strategies based on different sensitive fields. The JDBC driver can identify which fields in the SQL statement are sensitive fields based on the classification and grading principle, and then replace the sensitive fields in the SQL statement with the desensitizing strategy of the sensitive field configured in the desensitizing platform as the query field, thereby generating desensitized SQL.

[0024] When the business system operates the database, it usually performs database operations based on the open source JDBC driver. As mentioned above, with the modified (enhanced) JDBC driver, the business system can replace the JDBC driver it references with the enhanced JDBC driver. The specific integration steps are as follows: 1) The business system replaces the original database JDBC driver with the enhanced JDBC driver described above.

[0025] 2) The enhanced JDBC driver extracts the original query SQL statement. If a sensitive field is found in the original SQL statement, the original sensitive field is replaced with the desensitizing policy of the sensitive field configured in the desensitizing platform and queried as a new query field.

[0026] Desensitized SQL example (for select statements), such as Figure 2and Figure 3 As shown: 1) Original SQL (assuming name is a sensitive field): SELECT name from users where id = 1 2) Desensitized SQL (examples of 4 different desensitization strategies): a) Keep the first n and the last m SELECT CASE WHEN LENGTH(name)>n + m THEN LEFT(name, n) || RPAD('*',LENGTH(name) - n - m, '*') || RIGHT(name, m) ELSE name END AS name from userswhere id = 1 Example: Keep the first n and the last m (n=3, m=4) Before desensitization: 13911112222 After desensitization: 139****2222 b) Keep from x to y SELECT CASE WHEN LENGTH(col_name)>n - 1 THEN RPAD('*', n - 1, '*') ||SUBSTRING(col_name FROM n FOR m- n + 1) || RPAD('*', LENGTH(col_name) - m,'*')ELSE RPAD('*', LENGTH(col_name), '*') END AS name from users where id = 1 Example: Keep from x to y (x=3, y=4) Before desensitization: 13911112222 After desensitization: **91******* c) Cover the first n and the last m SELECT CASE WHEN LENGTH(col_name)>n + m THEN RPAD('*', n, '*') ||SUBSTRING(col_name FROM n + 1 FOR LENGTH(col_name) - n - m) || RPAD('*',m,'*') ELSE RPAD('*', LENGTH(col_name), '*') END AS name from users where id= 1 Example: Cover the first n and the last m (n=3, m=4) Before desensitization: 13911112222 After desensitization: ***1111**** d) Cover from x to y SELECT CASE WHEN LENGTH(col_name) = x THEN CONCAT(LEFT(col_name, x -1), RPAD('*', y - x + 1, '*')) WHEN LENGTH(col_name)>x THEN CONCAT(LEFT(col_name, x - 1), RPAD('*', y - x + 1, '*'), SUBSTRING(col_nameFROM y + 1)) ELSEcol_name END AS name from users where id = 1 Example: Mask from x to y (x=2, y=8) Before desensitization: 13911112222 After desensitization: 1*******222 In addition, this method can also develop extended algorithms online, for example: 1) Mask before special characters (assuming the special character is &) Before desensitization: test&ddd After desensitization: ****&ddd 2) Mask after special characters (assuming the special character is &) Before desensitization: test&ddd After desensitization: test&*** The JDBC driver extracts the original SQL, replaces and assembles the fields that need to be desensitized based on the desensitization strategy to generate desensitized SQL. When operating the database, the desensitized SQL is ultimately executed.

[0027] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Any technician familiar with the profession can make some changes or modifications to the technical contents disclosed above without departing from the scope of the technical solution of the present invention to obtain equivalent embodiments of equivalent changes. However, any simple modification, equivalent changes and modifications made to the above embodiments based on the technical essence of the present invention without departing from the content of the technical solution of the present invention should be included in the scope of protection of the claims of the present invention.

Claims

1. A method for supporting online configurable desensitization strategies to improve the rapid delivery capability of desensitized products, characterized in that: The method comprises: S1. Obtain database connection and intercept original SQL statements through proxy or interceptor; S2. Based on the sensitive fields defined in the desensitizing platform, the JDBC driver searches for the sensitive fields in the original SQL statement. S3. If the sensitive field exists in the original SQL statement, the JDBC driver replaces the sensitive field in the original SQL statement with the desensitization policy corresponding to the sensitive field pre-configured in the desensitization platform, and generates a desensitized SQL statement as a new query field; S4. Send the desensitized SQL statement to the database, and the JDBC driver executes the desensitized SQL statement and returns the query result.

2. The method for supporting online configurable desensitization strategies to improve the rapid delivery capability of desensitized products according to claim 1, characterized in that: The method also includes: modifying the JDBC driver in advance, configuring a unified SQL statement modification code in the JDBC driver, and the modified JDBC driver supports SQL statement modification of different databases with different desensitization strategies.

3. The method for supporting online configurable desensitization strategies to improve the rapid delivery capability of desensitized products according to claim 2, characterized in that: When the business system operates the database, it replaces the JDBC driver it references with the modified JDBC driver, and then uses the modified JDBC driver to perform the desensitization task. The implementation process is as follows: 1) The business system replaces the JDBC driver it references with the modified JDBC driver; 2) The modified JDBC driver extracts the original SQL statement. If a sensitive field is found in the original SQL statement, the desensitizing policy corresponding to the sensitive field configured in the desensitizing platform is used to replace the sensitive field to obtain a desensitized SQL statement, which is then executed.

4. The method for supporting online configurable desensitization strategies to improve the rapid delivery capability of desensitized products according to claim 1, characterized in that: The desensitization platform described in step S2 adopts different desensitization strategies for different sensitive fields.

5. The method for supporting online configurable desensitization strategies to improve the rapid delivery capability of desensitized products according to claim 1, characterized in that: In step S2, the JDBC driver identifies and searches for sensitive fields in the original SQL statement based on the classification and grading principle.

6. The method for supporting online configurable desensitization strategies to improve the ability to quickly deliver desensitized products according to claim 1, characterized in that: The desensitization strategy corresponding to the sensitive field pre-configured in the desensitization platform in step S3 includes the following desensitization strategies if the sensitive field is name and the original SQL statement is SELECT name from users where id = 1: 1) Keep the first n and the last m SELECT CASE WHEN LENGTH(name) > n + m THEN LEFT(name, n) || RPAD('*',LENGTH(name) - n - m, '*') || RIGHT(name, m) ELSE name END AS name from userswhere id = 1; 2) Keep from x to y SELECT CASE WHEN LENGTH(col_name) > n - 1 THEN RPAD('*', n - 1, '*') ||SUBSTRING(col_name FROM n FOR m- n + 1) || RPAD('*', LENGTH(col_name) - m,'*') ELSE RPAD('*', LENGTH(col_name), '*') END AS name from users where id =1; 3) Cover the front n and the back m SELECT CASE WHEN LENGTH(col_name) > n + m THEN RPAD('*', n, '*') ||SUBSTRING(col_name FROM n + 1 FOR LENGTH(col_name) - n - m) || RPAD('*', m,'*') ELSE RPAD('*', LENGTH(col_name), '*') END AS name from users where id =1; 4) Cover from x to y SELECT CASE WHEN LENGTH(col_name) = x THEN CONCAT(LEFT(col_name, x - 1),RPAD('*', y - x + 1, '*')) WHEN LENGTH(col_name) > x THEN CONCAT(LEFT(col_name, x - 1), RPAD('*', y - x + 1, '*'), SUBSTRING(col_name FROM y + 1)) ELSEcol_name END AS name from users where id = 1.

7. The method for supporting online configurable desensitization strategies to improve the ability to quickly deliver desensitized products according to claim 1, characterized in that: The desensitization strategy corresponding to the sensitive field pre-configured in the desensitization platform in step S3, if the sensitive field is name, and the original SQL statement is SELECT name from users where id = 1, also includes the following desensitization strategies: 1) Mask before special characters; 2) Mask after special characters.

8. A system that supports online configuration of desensitization strategies to improve the ability to quickly deliver desensitized products, characterized in that: When the system is running, the steps of the method for supporting online configurable desensitization strategies to improve the rapid delivery capability of desensitized products as described in any one of claims 1 to 7 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the steps of the method for supporting online configurable desensitization strategies to improve the rapid delivery capability of desensitized products as described in any one of claims 1 to 7.

Images