Sensitive data identification method and device

Abstract

The invention provides a sensitive data recognition method and device.The method comprises the steps that in response to task creation operation, a sensitive data recognition task is created on a task creation page, and the data recognition task comprises a target data source and a target sensitive data recognition rule; the target sensitive data identification rule is obtained based on target data classification and at least one target data security grading configuration; in response to a trigger operation of the target control, executing a sensitive data identification task to obtain to-be-identified data from the target data source; and identifying the target sensitive data from the to-be-identified data by adopting the target sensitive data identification rule, thereby realizing the target sensitive data identification rule obtained by flexibly specifying a target data source in a task creation page and performing configuration based on target data classification and target data security classification by a user according to actual requirements. The pertinence and the accuracy of a sensitive data identification task are ensured, so that the high efficiency and the accuracy of sensitive data identification are improved.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing technology, and in particular to a method and device for identifying sensitive data. Background Art

[0002] With the deepening of digital transformation and the explosive growth of data volume, financial institutions are facing increasingly severe data security challenges. In order to protect customer privacy, comply with strict financial regulatory requirements, and prevent data leakage and abuse risks, financial institutions must strengthen the identification and management of sensitive data. By accurately identifying sensitive data, financial institutions can formulate targeted protection measures to ensure the security and compliance of data in all links such as collection, storage, processing, transmission and sharing. Therefore, how to accurately identify sensitive data is very important. Summary of the invention

[0003] The present disclosure provides a method and device for identifying sensitive data to at least solve one of the technical problems in the related art to a certain extent. The technical solution of the present disclosure is as follows:

[0004] According to a first aspect of an embodiment of the present disclosure, a method for identifying sensitive data is provided, comprising: in response to a task creation operation, creating a sensitive data identification task on a task creation page, wherein the sensitive data identification task includes a target data source and a target sensitive data identification rule, and the target sensitive data identification rule is obtained based on a target data classification and at least one target data security classification configuration; in response to a triggering operation of a target control in the task creation page, executing the sensitive data identification task to obtain data to be identified from the target data source; and using the target sensitive data identification rule to identify target sensitive data from the data to be identified.

[0005] According to a second aspect of an embodiment of the present disclosure, a sensitive data identification device is provided, comprising: a creation module, for creating a sensitive data identification task on a task creation page in response to a task creation operation, wherein the sensitive data identification task includes a target data source and a target sensitive data identification rule, and the target sensitive data identification rule is obtained based on a target data classification and at least one target data security classification configuration; an execution module, for executing the sensitive data identification task in response to a triggering operation of a target control in the task creation page to obtain data to be identified from the target data source; and an identification module, for identifying target sensitive data from the data to be identified using the target sensitive data identification rule.

[0006] According to a third aspect of an embodiment of the present disclosure, there is provided an electronic device, comprising: a processor; and a memory for storing instructions executable by the processor; wherein the processor is configured to execute the instructions to implement a method for identifying sensitive data as described in the embodiment of the first aspect of the present disclosure.

[0007] According to the fourth aspect of an embodiment of the present disclosure, a computer-readable storage medium is provided. When instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to execute the sensitive data identification method as described in the embodiment of the first aspect of the present disclosure.

[0008] According to a fifth aspect of an embodiment of the present disclosure, a computer program product is provided, comprising: a computer program, wherein when the computer program is executed by a processor, the method for identifying sensitive data as described in the embodiment of the first aspect of the present disclosure is implemented.

[0009] The technical solution provided by the embodiments of the present disclosure brings at least the following beneficial effects:

[0010] In the present technical scheme, by responding to the task creation operation, a sensitive data identification task is created on the task creation page, wherein the sensitive data identification task includes a target data source and a target sensitive data identification rule, and the target sensitive data identification rule is obtained based on the target data classification and at least one target data security classification configuration, so that the user can flexibly specify the target data source and the target sensitive data identification rule configured based on the target data classification and the target data security classification on the task creation page according to actual needs, thereby ensuring the pertinence and accuracy of the sensitive data identification task. Furthermore, in response to the triggering operation of the target control on the task creation page, the sensitive data identification task is executed to obtain the data to be identified from the target data source, so that the sensitive data identification task can be started through a simple control triggering operation, and the data to be identified can be quickly obtained from the target data source, thereby avoiding tedious manual operations and improving work efficiency. Finally, the target sensitive data identification rule is adopted to identify the target sensitive data from the data to be identified, so that the target sensitive data can be efficiently and accurately identified from the data to be identified using the above-mentioned target sensitive data identification rule, which is helpful to timely discover and process potential The data leakage risk of financial institutions is reduced, and the security and compliance of financial institutions' data are ensured; among them, when the data to be identified are the fields in each data table, sensitive data identification is performed on each field in the data table by traversing multiple first identification sub-rules in sequence, ensuring that each possible sensitive data type is fully considered, avoiding the missed identification of sensitive data, and at the same time, matching the currently traversed sub-rule with each field in the data to be identified, accurately locating the first target field containing sensitive information, not only ensuring the accuracy of sensitive data, but also avoiding the misjudgment of non-sensitive data, and improving the accuracy and efficiency of sensitive data identification; in addition, when sensitive data is identified for the data table in the data to be identified, multiple second identification sub-rules under the sensitive data identification rule are traversed in sequence, and the currently traversed second identification sub-rule is matched with each data table and its fields in the data to be identified, improving the accuracy and pertinence of sensitive data identification, not only can the target data table containing sensitive information be quickly located, but also which fields in these tables are sensitive data can be directly determined, thereby realizing the security management of sensitive data and avoiding the missed identification of sensitive data.

[0011] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The drawings herein are incorporated into and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the description are used to explain the principles of the present disclosure, and do not constitute improper limitations on the present disclosure.

[0013] Figure 1is a flowchart of a method for identifying sensitive data shown in the first embodiment of the present disclosure;

[0014] Figure 2 is a flowchart of a method for identifying sensitive data according to a second embodiment of the present disclosure;

[0015] Figure 3 is a flowchart of a method for identifying sensitive data shown in the third embodiment of the present disclosure;

[0016] Figure 4 is a flowchart of a method for identifying sensitive data according to a fourth embodiment of the present disclosure;

[0017] Figure 5 is a flowchart of a method for identifying sensitive data according to a fifth embodiment of the present disclosure;

[0018] Figure 6 It is a schematic diagram of the principle of the sensitive data identification method shown in the embodiment of the present disclosure;

[0019] Figure 7 is a schematic diagram of a data classification page shown in an embodiment of the present disclosure;

[0020] Figure 8 is a schematic diagram of a data classification page shown in an embodiment of the present disclosure;

[0021] Fig. 9 is a schematic diagram of a sensitive data identification rule configuration page shown in an embodiment of the present disclosure;

[0022] Fig.10 is a schematic diagram of a task creation page shown in an embodiment of the present disclosure;

[0023] Fig.11 is a schematic diagram of a data hierarchical supplementary page shown in an embodiment of the present disclosure;

[0024] Fig.12 is a schematic diagram of the structure of a sensitive data identification device shown in the sixth embodiment of the present disclosure;

[0025] Fig.13 It is a schematic structural diagram of an electronic device shown in an exemplary embodiment of the present disclosure. DETAILED DESCRIPTION

[0026] In order to enable ordinary persons in the art to better understand the technical solutions of the present disclosure, the technical solutions in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the accompanying drawings.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims.

[0028] It should be noted that in the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision and disclosure of user personal information are all carried out with the user's consent, and are in compliance with relevant laws and regulations and do not violate public order and good morals.

[0029] In related technologies, data resources are sorted out according to the manually configured classification system and the management and control requirements of data security classification, and the elements in the data resources are archived against the classification system. The security level is matched according to the sensitivity of the data, so as to realize the construction of the data resource security system. However, the above manual method is time-consuming, labor-intensive, and inefficient, and requires a large amount of manpower and material resources. Data identification is a long-term task, and continuous resource allocation is required to ensure the accuracy and timeliness of the security system;

[0030] In addition, in related technologies, security management tools can also be used to match data resources with the classification system based on the security classification system and classification strategy through tool capabilities, and to confirm the level in combination with the hierarchical management and control requirements, so as to achieve the goal of classifying and grading data resources. However, conventional security management tools greatly reduce the accuracy and completeness of data identification due to identification algorithms, data resource complexity, business element dependency, etc.

[0031] In addition, the security classification of data resources in related technologies is usually based on the field level, and each field in the data table is managed at a hierarchical level, making it impossible to perform comprehensive hierarchical management of the data table.

[0032] Therefore, in order to solve the above problems, the present disclosure proposes a method and device for identifying sensitive data.

[0033] The following describes the method and device for identifying sensitive data in embodiments of the present disclosure with reference to the accompanying drawings.

[0034] Figure 1 It is a flowchart of the sensitive data identification method shown in the first embodiment of the present disclosure.

[0035] like Figure 1As shown, the sensitive data identification method includes the following steps:

[0036] Step 101: In response to a task creation operation, a sensitive data identification task is created on a task creation page.

[0037] Among them, the sensitive data identification task includes a target data source and a target sensitive data identification rule, and the target sensitive data identification rule is obtained based on a target data classification and at least one target data security classification configuration.

[0038] In order to improve the accuracy and efficiency of sensitive data identification, as a possible implementation method, a sensitive data identification task is created on the task creation page according to the actual needs of the user, so that the target sensitive data can be identified by executing the sensitive data identification task.

[0039] As an example, according to the actual needs of the user, the target data source and the target sensitive data identification rules configured based on data classification and security classification are specified on the task creation page, so as to generate a sensitive data identification task based on the target data source and the target sensitive data identification rules.

[0040] Step 102, in response to a triggering operation of a target control in the task creation page, execute a sensitive data identification task to obtain data to be identified from a target data source.

[0041] In order to improve the efficiency of sensitive data identification, as an example, in response to the user's triggering operation of the target control in the task creation page (e.g., clicking the "OK" control in the task creation page), the sensitive data identification task is executed, and the data to be identified is obtained from the target data source based on the target sensitive data identification rule. The data to be identified can be each data table of the data source or each field in each data table.

[0042] Step 103: Use target sensitive data identification rules to identify target sensitive data from the data to be identified.

[0043] In order to further improve the accuracy and security of sensitive data identification, as an example, the target sensitive data identification rules are used to parse the data to be identified to identify the target sensitive data.

[0044] In summary, by responding to the task creation operation, a sensitive data identification task is created on the task creation page, wherein the data identification task includes a target data source and a target sensitive data identification rule, and the target sensitive data identification rule is obtained based on the target data classification and at least one target data security classification configuration, so that the user can flexibly specify the target data source and the sensitive data identification rule configured based on the target data classification and the target data security classification on the task creation page according to actual needs, thereby ensuring the pertinence and accuracy of the sensitive data identification task. Furthermore, in response to the triggering operation of the target control on the task creation page, the sensitive data identification task is executed to obtain the data to be identified from the target data source, so that the identification task can be started through a simple control triggering operation, and the data to be identified can be quickly obtained from the target data source, thereby avoiding tedious manual operations and improving the efficiency of sensitive data identification. Finally, by adopting the target sensitive data identification rule, the target sensitive data is identified from the data to be identified, so that the target sensitive data can be efficiently and accurately identified from the data to be identified using the above-mentioned sensitive data identification rule, thereby helping to timely discover and deal with potential data leakage risks and ensuring the security and compliance of the data of financial institutions.

[0045] It should be understood that the data to be identified may be each data table of the data source or each field in each data table. As an example, when performing sensitive data identification on each field in the data table, the target sensitive data identification rule may include a first identification sub-rule for multiple fields. The target sensitive data is identified from the data to be identified based on the multiple first identification sub-rules. Figure 2 The embodiments are described in detail.

[0046] Figure 2 It is a flowchart of a method for identifying sensitive data shown in the second embodiment of the present disclosure.

[0047] like Figure 2 As shown, the sensitive data identification method includes the following steps:

[0048] Step 201: In response to a task creation operation, a sensitive data identification task is created on a task creation page.

[0049] Among them, the sensitive data identification task includes a target data source and a target sensitive data identification rule, and the target sensitive data identification rule is obtained based on a target data classification and at least one target data security classification configuration.

[0050] Step 202: In response to a triggering operation of a target control in the task creation page, a sensitive data identification task is executed to obtain data to be identified from a target data source.

[0051] Step 203, traverse the multiple first identification sub-rules under the target sensitive data identification rule in sequence.

[0052] It should be understood that the target sensitive data identification rules may include first identification sub-rules for multiple fields, wherein the first identification sub-rules may include corresponding content identification sub-rules and field matching sub-rules, wherein the content identification sub-rules include regular custom sub-rules and structured query language custom sub-rules, etc., and the field matching sub-rules include specified field sub-rules and field fuzzy matching sub-rules, etc.

[0053] In order to avoid missing identification of sensitive data, as an example, multiple first identification sub-rules under the target sensitive data identification rule are traversed and applied in sequence to identify sensitive data.

[0054] Step 204 , matching the first identification sub-rule currently traversed with each field in the data to be identified, to obtain a matching result of the first identification sub-rule currently traversed.

[0055] In order to improve the accuracy and comprehensiveness of sensitive data identification, as an example, the first identification sub-rule currently traversed is compared and matched with each field in the data to be identified one by one to obtain the matching results of the first identification sub-rule currently traversed and each field.

[0056] Step 205 : In response to the matching result of the first identification sub-rule currently traversed indicating that the first target field exists in each field, the first target field is obtained from each field.

[0057] The first target field is a field that matches the first identification sub-rule currently traversed.

[0058] In order to quickly locate sensitive data, as an example, when the matching result of the currently traversed first identification sub-rule indicates that there is a first target field matching the currently traversed first identification sub-rule in each field, the first target field is obtained from each field.

[0059] Step 206: Determine the target sensitive data according to the first target field and the field value under the first target field.

[0060] In order to avoid misjudgment of non-sensitive data and to improve the accuracy of sensitive data identification, as a possible implementation method, suspected sensitive data is determined based on the first target field and the field value under the first target field, and the target sensitive data is determined based on the audit results of the suspected sensitive data.

[0061] As an example, the first target field and the field value under the first target field are regarded as suspected sensitive data; the suspected sensitive data is dispatched to the target audit object to audit the suspected sensitive data and obtain an audit result; the audit result sent by the target audit object is received, and based on the audit result, the target sensitive data is determined from the suspected sensitive data.

[0062] That is to say, the first target field and its field value obtained by matching are marked as suspected sensitive data; then, these suspected sensitive data are sent to the relevant target audit object for audit; after the audit is completed, the audit result returned by the target audit object is received, and based on the audit result, the real target sensitive data is accurately screened out from the original suspected sensitive data.

[0063] It should be noted that the execution process of steps 201 to 202 can be implemented in any manner in the embodiments of the present disclosure, and the embodiments of the present disclosure do not limit this and will not be described in detail.

[0064] In summary, by traversing multiple first identification sub-rules under the target sensitive data identification rule in sequence; matching the currently traversed first identification sub-rule with each field in the data to be identified to obtain the matching result of the currently traversed first identification sub-rule; in response to the matching result of the currently traversed first identification sub-rule indicating that the first target field exists in each field, the first target field is obtained from each field; wherein the first target field is a field matched with the currently traversed first identification sub-rule; according to the first target field and the field value under the first target field, the target sensitive data is determined. Thus, by traversing multiple first identification sub-rules in sequence, it is ensured that each possible sensitive data type is fully taken into account, and the missed identification of sensitive data is avoided. At the same time, the currently traversed sub-rule is matched with each field in the data to be identified, so that the first target field containing sensitive information can be accurately located, which not only ensures the accuracy of sensitive data, but also avoids the misjudgment of non-sensitive data, thereby improving the accuracy and efficiency of sensitive data identification.

[0065] As another example, when performing sensitive data identification on a data table in the data to be identified, the target sensitive data identification rule may include a plurality of data tables and a second identification sub-rule for a plurality of fields in the data table, and the target sensitive data is identified from the data to be identified based on the plurality of second identification sub-rules. Figure 3 The embodiments are described in detail.

[0066] Figure 3 It is a flowchart of a method for identifying sensitive data shown in the third embodiment of the present disclosure.

[0067] like Figure 3 As shown, the sensitive data identification method includes the following steps:

[0068] Step 301: In response to a task creation operation, a sensitive data identification task is created on a task creation page.

[0069] Among them, the sensitive data identification task includes a target data source and a target sensitive data identification rule, and the target sensitive data identification rule is obtained based on a target data classification and at least one target data security classification configuration.

[0070] Step 302: In response to a triggering operation of a target control in the task creation page, a sensitive data identification task is executed to obtain data to be identified from a target data source.

[0071] Step 303, traverse the multiple second identification sub-rules under the sensitive data identification rule in sequence.

[0072] It should be noted that the target sensitive data identification rule may include a second identification sub-rule for multiple data tables and multiple fields in the data table, and the rule content of the second identification sub-rule is different from that of the first identification sub-rule.

[0073] In order to avoid missing identification of sensitive data, as an example, multiple second identification sub-rules under the target sensitive data identification rule are traversed and applied in sequence to identify sensitive data.

[0074] Step 304 : Match the second identification sub-rule currently traversed with each data table in the data to be identified and a plurality of fields in each data table to obtain a matching result of the second identification sub-rule currently traversed.

[0075] In order to improve the accuracy and comprehensiveness of sensitive data identification, as an example, the second identification sub-rule currently traversed is matched with each data table in the data to be identified and multiple fields in each data table, and a matching result between the second identification sub-rule currently traversed and each data table and multiple fields in each data table is obtained.

[0076] Step 305 , in response to the matching result of the currently traversed second identification sub-rule indicating that a target data table exists in the data to be identified, target sensitive data is determined according to a plurality of second target fields in the target data table.

[0077] The target data table and a plurality of second target fields in the target data table match the second identification sub-rule currently traversed.

[0078] In order to quickly locate sensitive data, as an example, the matching result of the currently traversed second identification sub-rule indicates that there is a target data table in the data to be identified, and the target sensitive data is determined based on multiple second target fields in the target data table, wherein the target data table and the multiple second target fields in the target data table match the currently traversed second identification sub-rule.

[0079] As an example, a target data table and the field values ​​under multiple second target fields under the target data table are regarded as suspected sensitive data; the suspected sensitive data is dispatched to a target audit object to audit the suspected sensitive data and obtain an audit result; the audit result sent by the target audit object is received, and based on the audit result, the target sensitive data is determined from the suspected sensitive data.

[0080] It should be noted that the execution process of steps 301 to 302 can be implemented in any manner in the embodiments of the present disclosure, and the embodiments of the present disclosure do not limit this and will not be described in detail.

[0081] In summary, by traversing multiple second identification sub-rules under the sensitive data identification rule in sequence; matching the currently traversed second identification sub-rule with each data table in the data to be identified and multiple fields in each data table to obtain the matching result of the currently traversed second identification sub-rule; in response to the matching result of the currently traversed second identification sub-rule indicating that there is a target data table in the data to be identified, determining the target sensitive data according to the multiple second target fields in the target data table; wherein the target data table and the multiple second target fields in the target data table match the currently traversed second identification sub-rule, thereby, by traversing multiple second identification sub-rules under the sensitive data identification rule in sequence, the currently traversed second identification sub-rule is matched with each data table and its fields in the data to be identified, thereby improving the accuracy and pertinence of sensitive data identification, not only can the target data table containing sensitive information be quickly located, but also which fields in these tables can be directly determined to be sensitive data, thereby realizing the security management of sensitive data and avoiding the missed identification of sensitive data.

[0082] In order to clearly illustrate how the above embodiments are configured to obtain target sensitive data identification rules, the present disclosure proposes another sensitive data identification method.

[0083] Figure 4 It is a flowchart of a method for identifying sensitive data shown in the fourth embodiment of the present disclosure.

[0084] like Figure 4 As shown, based on any of the above embodiments, the target sensitive data identification rule can be configured by the following steps:

[0085] Step 401 , in response to a data classification selection operation, select a target data classification from a plurality of candidate data classifications in a sensitive data identification rule configuration page.

[0086] The target data classification is used to indicate the data category to which the target sensitive data to be identified belongs.

[0087] To improve the flexibility of sensitive data identification, as an example, users can specify the specific category (i.e., target data classification) of the sensitive data to be identified on the sensitive data identification rule configuration page based on actual needs, so as to ensure that the sensitive data identification process is more accurate and facilitate subsequent data processing and compliance management.

[0088] Step 402 , in response to a data classification selection operation, select a target data security classification under at least one classification system from a plurality of candidate data security classifications under at least one classification system in a sensitive data identification rule configuration page.

[0089] Among them, the target data security classification is used to indicate the security level of the target sensitive data under the corresponding classification system.

[0090] In order to implement differentiated data protection measures for sensitive data of different security levels, as an example, the user selects the target data security classification from at least one classification system in the sensitive data identification rule configuration page, such as confidential, secret, and internal use. This ensures that sensitive data is assigned a corresponding security level based on its importance and sensitivity, helps to implement differentiated data protection measures, ensures that key sensitive data receives a higher level of protection, and also promotes the efficient use and management of data resources.

[0091] Among them, it should be noted that in order to realize the selection of target data classification and target data security level in the sensitive data identification rule configuration page, before selecting the target data classification from multiple candidate data classifications in the sensitive data identification rule configuration page, and selecting the target data security level from at least one classification system and multiple candidate data security levels under at least one classification system, it is necessary to configure multiple candidate data classifications and at least one classification system and multiple candidate data security levels under at least one classification system.

[0092] As an example, in response to a data classification configuration operation, multiple candidate data classifications are configured in a data classification page; the multiple candidate data classifications are synchronized to a sensitive data identification rule configuration page; in response to a data classification configuration operation, at least one classification system and multiple candidate data security classifications under at least one classification system are configured in the data classification page; at least one classification system and multiple candidate data security classifications under at least one classification system are synchronized to the sensitive data identification rule configuration page.

[0093] That is to say, the user performs data classification configuration operations in the data classification page to configure multiple candidate data classifications. The candidate data classifications achieve data differentiation based on factors such as the nature, purpose or source of the data. Then, after the candidate data classification configuration is completed, the candidate data classification is automatically synchronized to the sensitive data identification rule configuration page; then, through the data classification configuration operation, at least one classification system is set in the data classification page, and each classification system is configured with multiple candidate data security classifications. The above at least one classification system and the candidate data security classifications under at least one classification system are used to further refine the sensitivity of the data so as to take corresponding levels of protection measures. After the configuration is completed, the above classification system and the candidate data security classifications under it are synchronized to the sensitive data identification rule configuration page. The above process ensures the flexibility and consistency of data classification and classification, and provides a basis for subsequent security measures such as sensitive data identification, storage, desensitization and access control.

[0094] Step 403, in response to the identification condition configuration operation, configure the identification condition of the target sensitive data on the sensitive data identification rule configuration page.

[0095] It should be noted that the identification conditions are used to define and determine which data meets the standards of sensitive data, such as keyword matching, format verification, data source verification, etc. In order to improve the accuracy and efficiency of sensitive data identification, as an example, the identification conditions of the target sensitive data are configured on the sensitive data identification rule configuration page. Based on the identification conditions configured in the sensitive data identification rules, data items that meet the sensitive data standards can be automatically and quickly screened out, thereby improving the efficiency of sensitive data identification.

[0096] Step 404: Generate target data sensitive data identification rules according to the target data classification, at least one target data security classification, and identification conditions in the sensitive data identification rule configuration page.

[0097] In order to improve the comprehensiveness and accuracy of sensitive data identification, as an example, in the sensitive data identification rule configuration page, the target sensitive data identification rules are generated by selecting the target data classification, target data security classification and configuring the identification conditions.

[0098] In order to improve data security, as an example, after identifying the target sensitive data from the data to be identified using the target sensitive data identification rules, the sensitive data is stored in a storage system corresponding to the target data classification and the target data security level, so as to obtain the target sensitive data from the storage system and desensitize the target sensitive data.

[0099] That is to say, after adopting the target sensitive data identification rules to efficiently identify the target sensitive data from the data to be identified, the target sensitive data is automatically stored in the corresponding storage system according to the pre-defined target data classification and corresponding security classification. Subsequently, when the target sensitive data needs to be further analyzed or used from these storage systems, these data are strictly desensitized to eliminate or reduce the sensitive information in the data, thereby meeting the needs of data utilization while protecting data privacy and security.

[0100] In addition, it should be noted that for some manually identified sensitive data, or irregular sensitive data, manual calibration can be used to complete the classification and grading of sensitive data to achieve secure management and control of data resources.

[0101] In summary, in response to the data classification selection operation, a target data classification is selected from a plurality of candidate data classifications in the sensitive data identification rule configuration page; wherein the target data classification is used to indicate the data category to which the target sensitive data to be identified belongs; in response to the data classification selection operation, a target data security classification under at least one classification system is selected from a plurality of candidate data security classifications under at least one classification system in the sensitive data identification rule configuration page; wherein the target data security classification is used to indicate the security level of the target sensitive data under the corresponding classification system; in response to the identification condition configuration operation, the identification condition of the target sensitive data is configured in the sensitive data identification rule configuration page; according to the target data classification, at least one target data security classification and the identification condition in the sensitive data identification rule configuration page, a target sensitive data identification rule is generated, thereby, based on the data classification selection, the data classification selection and the identification condition configuration, a target sensitive data identification rule is generated in the sensitive data identification rule configuration page, thereby adopting the target sensitive data identification rule to identify sensitive data, thereby improving the comprehensiveness and accuracy of sensitive data identification, while improving the efficiency of data management and enhancing the security of data protection.

[0102] In order to clearly illustrate how the above embodiment creates a sensitive data identification task on a task creation page in response to a task creation operation, the present disclosure proposes another sensitive data identification method.

[0103] Figure 5 It is a flowchart of a method for identifying sensitive data shown in the fifth embodiment of the present disclosure.

[0104] like Figure 5 As shown, the method for identifying sensitive data includes the following steps:

[0105] Step 501 : In response to a data source selection operation, a target data source is selected from a plurality of candidate data sources in a task creation page.

[0106] The candidate data source is a data source associated with a financial institution.

[0107] To improve the flexibility of sensitive data identification, as an example, a user selects one or more candidate data sources as target data sources from multiple candidate data sources provided on a task creation page, where the candidate data sources are data sources associated with financial institutions, such as business data, information on various units in a financial institution, and customer information within a financial institution.

[0108] Step 502 , in response to a rule selection operation, select a target sensitive data identification rule from a plurality of candidate sensitive data identification rules in a task creation page.

[0109] In order to identify sensitive data according to user needs, as an example, the user selects a target sensitive data identification rule that meets the user needs from multiple candidate sensitive data identification rules in the task creation page.

[0110] Step 503: Generate a sensitive data identification task according to the target data source and the target sensitive data identification rule.

[0111] In order to improve the pertinence, accuracy and timeliness of sensitive data identification, as a possible implementation method, sensitive data identification tasks are automatically generated and configured according to the target data source, sensitive data identification rules, execution cycle and data scanning method selected by the user to achieve regular or on-demand sensitive data identification.

[0112] As an example, in response to an execution cycle selection operation, a target task execution cycle is selected from multiple candidate task execution cycles in a task creation page; wherein the target task execution cycle is used to indicate the frequency of executing the sensitive data identification task; in response to a scanning mode selection operation, a target data scanning mode is selected from multiple candidate data scanning modes in the task creation page; and the sensitive data identification task is generated according to the target data source, the target sensitive data identification rule, the target task execution cycle and the target data scanning mode.

[0113] That is to say, during the task creation process, the user will first select a target task execution cycle from multiple candidate task execution cycles according to actual needs, where the target task execution cycle defines the frequency at which the sensitive data identification task will be automatically executed, such as daily, weekly, monthly or at a specific time interval, to meet the needs of continuous monitoring and identification of sensitive data; then, the user selects from multiple candidate data scanning methods provided on the task creation page to determine the target data scanning method; where the selection of the target scanning method depends on factors such as the data storage location, data format, data access rights, and system resources. For example, the user can choose a full scan to cover the data in all target data sources, or choose an incremental scan to focus only on the data that has changed since the last scan, thereby improving scanning efficiency and reducing system burden; finally, based on the above information, namely the target data source, target sensitive data identification rules, target task execution cycle, and target data scanning method, a complete sensitive data identification task is generated. When the sensitive data identification task is executed, the target data source can be identified and detected regularly or on demand according to the execution cycle and scanning method specified by the user.

[0114] Step 504 , in response to a triggering operation of a target control in the task creation page, executing a sensitive data identification task to obtain data to be identified from a target data source.

[0115] Step 505: Use target sensitive data identification rules to identify target sensitive data from the data to be identified.

[0116] It should be noted that the execution process of steps 504 to 505 can be implemented in any manner in the embodiments of the present disclosure, and the embodiments of the present disclosure do not limit this and will not be described in detail.

[0117] In summary, by responding to the data source selection operation, a target data source is selected from multiple candidate data sources in the task creation page; in response to the rule selection operation, a target sensitive data identification rule is selected from multiple candidate sensitive data identification rules in the task creation page; a sensitive data identification task is generated according to the target data source and the target sensitive data identification rule. Thus, by generating the sensitive data identification task based on the target data source and the target sensitive data identification rule selected on the task creation page, the pertinence and efficiency of the identification task are improved. Thus, by executing the sensitive data identification task and adopting the target sensitive data identification rule, the target sensitive data is identified, which improves the accuracy and efficiency of the target sensitive data identification.

[0118] Based on any embodiment of the present disclosure, Figure 6 As shown, the method for identifying sensitive data of the embodiment of the present disclosure can also be implemented based on the following steps:

[0119] Step 1: Assemble the metadata repository

[0120] As an example, inventory and sort out the data resources within the organization to form a unified data resource list.

[0121] Step 2: Definition of a cross-industry security classification system

[0122] The data classification system is based on the actual business structure of enterprises and institutions, and divides and classifies business data areas according to the principle that actual business is easy to manage and use. Figure 7 As shown, multiple candidate data classifications are configured in the data classification page.

[0123] Step 3: Build a multi-system security hierarchy

[0124] According to relevant requirements and internal data security management methods of the organization, the generated or collected data is classified and graded. There are generally multiple security classification systems. Combined with the requirements of different management agencies for the granularity of security classification, data control objectives, etc., define the data security classification under each system. Figure 8 As shown, at least one grading system and a plurality of candidate data security gradings under at least one grading system are configured in the data grading page.

[0125] Step 4: Define sensitive data identification rules

[0126] Clarifying the granularity of data classification is a key factor in identification and classification. Based on the established data security classification and grading system, the keyword information of sensitive data information is determined. The scanned object takes the metadata resource list as the core, and the sensitive information is matched with the names, notes and other element information of tables and fields. This is one of the important means of sensitive data identification. Another way is to scan the data content, match the data content in the data table through data matching and identification algorithms such as regular expressions, and discover suspected sensitive data tables and sensitive field items.

[0127] As an example, Fig. 9 As shown, a target sensitive data identification rule is generated based on the selected target data classification, at least one target data security classification, and the configured identification conditions in the sensitive data identification rule configuration page.

[0128] Step 5: Identify Task Management and Execution

[0129] It is important to understand that data resources are dynamically expanded according to the continuous development of the business, and the discovery and identification of sensitive data is also a dynamic process. For the defined sensitive data discovery rules, temporary or regular scans of data update frequency, importance, and usage scope are required to ensure that sensitive elements of new data resources are discovered in a timely manner to avoid missing sensitive data and causing data security issues.

[0130] As an example, Fig.10 As shown, the definition of sensitive data identification tasks sets the execution cycle (year, month, day, etc.), execution time, scanning rules, and the source and scope of the scanned data, etc., to meet the timeliness requirements of sensitive data discovery.

[0131] Step 6: Calibration and review of the hierarchical classification and identification results of data resources

[0132] As an example, after the identification rules are executed through tasks, a list of suspected sensitive data is discovered. According to the identification rule definition, the security classification and security rating of the archive are recommended, including the recommended desensitizing algorithm, etc. After manual review and calibration, a security classification and grading resource library for data resources is formed to provide a management and control basis and benchmark for data collection, data development, and data services. In different data application scenarios, users of different security levels are provided with equal data usage rights and desensitizing algorithm support.

[0133] Step 7: Supplement the data classification model through manual calibration

[0134] like Fig.11 As shown, in the daily sensitive data identification process, sensitive data that has been manually identified, or sensitive data with irregular patterns, can be classified and graded for archiving through manual calibration, thereby maximizing the security classification and grading control of data resources through various forms, and achieving comprehensive data resource security control.

[0135] Step 8: Column-related identification strategy for data tables

[0136] Multi-source data fusion technology refers to the technology that uses relevant means to integrate all the information obtained through investigation and analysis, and uniformly evaluates the information to finally obtain unified information. The purpose of developing this technology is to integrate various different data information, absorb the characteristics of different data sources, and then extract unified, better and richer information from them than single data. Based on this technical theory, the different security levels of each field in the same data table are classified; double-field or multi-field combination evaluation is performed at the table level, and the data table is re-classified for security in combination with the correlation of data between columns to ensure data security. That is, the second identification sub-rules of multiple data tables and multiple fields in the data table in the target sensitive data identification rule are used to identify the target data table from the data to be identified, and the target sensitive data is determined based on the multiple second target fields in the target data table.

[0137] 9. Data desensitization

[0138] The target sensitive data is stored in a storage system corresponding to the target data classification and the target data security classification, so as to obtain the target sensitive data from the storage system and desensitize the target sensitive data using relevant desensitization rules.

[0139] Corresponding to the method for identifying sensitive data provided in the above-mentioned embodiment, the present disclosure also provides a device for identifying sensitive data. Since the device for identifying sensitive data provided in the embodiment of the present disclosure corresponds to the method for identifying sensitive data provided in the above-mentioned embodiment, the implementation method of the method for identifying sensitive data is also applicable to the device for identifying sensitive data provided in the embodiment of the present disclosure, and will not be described in detail in the embodiment of the present disclosure.

[0140] Fig.12 It is a schematic diagram of the structure of a sensitive data identification device shown in the sixth embodiment of the present disclosure.

[0141] like Fig.12 As shown, the sensitive data identification device 1200 includes: a creation module 1210, an execution module 1220 and an identification module 1230.

[0142] Among them, the creation module 1210 is used to create a sensitive data identification task on the task creation page in response to the task creation operation, wherein the sensitive data identification task includes a target data source and a target sensitive data identification rule, and the target sensitive data identification rule is obtained based on the target data classification and at least one target data security classification configuration; the execution module 1220 is used to execute the sensitive data identification task in response to the triggering operation of the target control in the task creation page to obtain the data to be identified from the target data source; the identification module 1230 is used to adopt the target sensitive data identification rule to identify the target sensitive data from the data to be identified.

[0143] As a possible implementation method of an embodiment of the present disclosure, the target sensitive data identification rule includes a first identification sub-rule for multiple fields, and the identification module 1220 is used to traverse the multiple first identification sub-rules under the target sensitive data identification rule in sequence; match the currently traversed first identification sub-rule with each field in the data to be identified to obtain the matching result of the currently traversed first identification sub-rule; in response to the matching result of the currently traversed first identification sub-rule indicating that the first target field exists in each field, obtain the first target field from each field; wherein the first target field is a field that matches the currently traversed first identification sub-rule; determine the target sensitive data according to the first target field and the field value under the first target field.

[0144] As a possible implementation method of the embodiment of the present disclosure, the identification module 1220 is used to treat the first target field and the field value under the first target field as suspected sensitive data; schedule the suspected sensitive data to the target audit object to audit the suspected sensitive data and obtain an audit result; receive the audit result sent by the target audit object, and determine the target sensitive data from the suspected sensitive data based on the audit result.

[0145] As a possible implementation method of an embodiment of the present disclosure, a target sensitive data identification rule includes a second identification sub-rule for multiple data tables and multiple fields in the data table, and an identification module 1220 is used to traverse the multiple second identification sub-rules under the target sensitive data identification rule in sequence; match the currently traversed second identification sub-rule with each data table in the data to be identified and multiple fields in each data table to obtain a matching result of the currently traversed second identification sub-rule; in response to the matching result of the currently traversed second identification sub-rule indicating that there is a target data table in the data to be identified, determine the target sensitive data according to the multiple second target fields in the target data table; wherein, the target data table and the multiple second target fields in the target data table match the currently traversed second identification sub-rule.

[0146] As a possible implementation method of the embodiment of the present disclosure, the target sensitive data identification rule is configured using the following steps: in response to a data classification selection operation, a target data classification is selected from a plurality of candidate data classifications in a sensitive data identification rule configuration page; wherein the target data classification is used to indicate the data category to which the target sensitive data to be identified belongs; in response to a data classification selection operation, a target data security classification under at least one classification system is selected from a plurality of candidate data security classifications under at least one classification system in the sensitive data identification rule configuration page; wherein the target data security classification is used to indicate the security level of the target sensitive data under the corresponding classification system; in response to an identification condition configuration operation, identification conditions for the target sensitive data are configured in the sensitive data identification rule configuration page; and a target sensitive data identification rule is generated according to the target data classification, at least one target data security classification, and the identification conditions in the sensitive data identification rule configuration page.

[0147] As a possible implementation of the embodiment of the present disclosure, the sensitive data identification device 1200 further includes: a storage module.

[0148] Among them, the storage module is used to store the target sensitive data in a storage system corresponding to the target data classification and the target data security classification, so as to obtain the target sensitive data from the storage system and desensitize the target sensitive data.

[0149] As a possible implementation manner of the embodiment of the present disclosure, the sensitive data identification device 1200 further includes: a synchronization module.

[0150] Among them, the synchronization module is used to configure multiple candidate data classifications in the data classification page in response to the data classification configuration operation; synchronize the multiple candidate data classifications to the sensitive data identification rule configuration page; configure at least one classification system and multiple candidate data security classifications under at least one classification system in the data classification page in response to the data classification configuration operation; synchronize at least one classification system and multiple candidate data security classifications under at least one classification system to the sensitive data identification rule configuration page.

[0151] As a possible implementation method of the embodiment of the present disclosure, a creation module 1210 is used to select a target data source from multiple candidate data sources in a task creation page in response to a data source selection operation; wherein the candidate data source is a data source associated with a financial institution; in response to a rule selection operation, select a target sensitive data identification rule from multiple candidate sensitive data identification rules in the task creation page; and generate the sensitive data identification task according to the target data source and the target sensitive data identification rule.

[0152] As a possible implementation method of the embodiment of the present disclosure, the sensitive data identification task also includes a target task execution cycle and a target data scanning method. A creation module 1210 is used to select a target task execution cycle from multiple candidate task execution cycles in a task creation page in response to an execution cycle selection operation; wherein the target task execution cycle is used to indicate the frequency of executing the sensitive data identification task; in response to a scanning method selection operation, a target data scanning method is selected from multiple candidate data scanning methods in the task creation page; and a sensitive data identification task is generated according to the target data source, the target sensitive data identification rule, the target task execution cycle and the target data scanning method.

[0153] The sensitive data identification device of the disclosed embodiment creates a sensitive data identification task on a task creation page in response to a task creation operation, wherein the sensitive data identification task includes a target data source and a target sensitive data identification rule, and the target sensitive data identification rule is configured based on the target data classification and at least one target data security classification, so that the user can flexibly specify the target data source and the target sensitive data identification rule configured based on the target data classification and the target data security classification on the task creation page according to actual needs, thereby ensuring the pertinence and accuracy of the sensitive data identification task. Furthermore, in response to the triggering operation of the target control on the task creation page, the sensitive data identification task is executed to obtain the data to be identified from the target data source, thereby enabling the sensitive data identification task to be started through a simple control triggering operation, and rapidly obtaining the data to be identified from the target data source, thereby avoiding tedious manual operations and improving work efficiency. Finally, by adopting the target sensitive data identification rule, the target sensitive data is identified from the data to be identified, thereby enabling the target sensitive data to be efficiently and accurately identified from the data to be identified using the above target sensitive data identification rule, thereby facilitating timely discovery and handling of potential data leakage risks, and ensuring the security and compliance of the data of financial institutions.

[0154] In an exemplary embodiment, an electronic device is also provided.

[0155] Among them, electronic equipment includes:

[0156] processor;

[0157] a memory for storing processor-executable instructions;

[0158] The processor is configured to execute instructions to implement the sensitive data identification method proposed in any of the aforementioned embodiments.

[0159] As an example, Fig.13 is a schematic diagram of the structure of an electronic device 1300 shown in an exemplary embodiment of the present disclosure, such as Fig.13As shown, the electronic device 1300 may further include:

[0160] The memory 1310 and the processor 1320, a bus 1330 connecting different components (including the memory 1310 and the processor 1320), the memory 1310 stores a computer program, and when the processor 1320 executes the program, the method for identifying sensitive data described in the embodiment of the present disclosure is implemented.

[0161] Bus 1330 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, a processor or a local bus using any of a variety of bus architectures. For example, these architectures include but are not limited to Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MAC) bus, Enhanced ISA bus, Video Electronics Standards Association (VESA) local bus and Peripheral Component Interconnect (PCI) bus.

[0162] The electronic device 1300 typically includes a variety of electronic device readable media. These media can be any available media that can be accessed by the electronic device 1300, including volatile and non-volatile media, removable and non-removable media.

[0163] The memory 1310 may also include computer system readable media in the form of volatile memory, such as random access memory (RAM) 1340 and / or cache memory 1350. The server 1300 may further include other removable / non-removable, volatile / non-volatile computer system storage media. By way of example only, the storage system 1360 may be used to read and write non-removable, non-volatile magnetic media ( Fig.13 not shown, usually called a "hard drive"). Although Fig.13 Not shown, a disk drive for reading and writing to a removable non-volatile disk (e.g., a "floppy disk"), and an optical disk drive for reading and writing to a removable non-volatile optical disk (e.g., a CD-ROM, a DVD-ROM, or other optical media) may be provided. In these cases, each drive may be connected to the bus 1330 via one or more data medium interfaces. The memory 1310 may include at least one program product having a set (e.g., at least one) of program modules that are configured to perform the functions of the various embodiments of the present disclosure.

[0164] A program / utility 1380 having a set (at least one) of program modules 1370 may be stored, for example, in the memory 1310, such program modules 1370 including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment. The program modules 1370 generally perform the functions and / or methods of the embodiments described in the present disclosure.

[0165] The electronic device 800 may also communicate with one or more external devices 1390 (e.g., keyboard, pointing device, display 1391, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 1300, and / or communicate with any device that enables the electronic device 1300 to communicate with one or more other computing devices (e.g., network card, modem, etc.). Such communication may be performed through an input / output (I / O) interface 1392. In addition, the electronic device 1300 may also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN) and / or public network, such as the Internet) through a network adapter 1393. As shown, the network adapter 1393 communicates with other modules of the electronic device 1300 through a bus 1330. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 1300, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0166] The processor 1320 executes various functional applications and data processing by running the programs stored in the memory 1310 .

[0167] It should be noted that the implementation process and technical principles of the electronic device of this embodiment refer to the aforementioned explanation of the sensitive data identification method of the embodiment of the present disclosure, and will not be repeated here.

[0168] In an exemplary embodiment, a computer-readable storage medium including instructions is also provided, such as a memory including instructions, and the above instructions can be executed by a processor of an electronic device to complete the sensitive data identification method proposed in any of the above embodiments. Optionally, the computer-readable storage medium can be a ROM, a random access memory (RAM), a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, etc.

[0169] In an exemplary embodiment, a computer program product is also provided, including a computer program / instruction, characterized in that when the computer program / instruction is executed by a processor, the method for identifying sensitive data proposed in any of the above embodiments is implemented.

[0170] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure that follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are to be considered exemplary only, and the true scope and spirit of the present disclosure are indicated by the following claims.

[0171] It should be understood that the present disclosure is not limited to the exact structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present disclosure is limited only by the appended claims.

Claims

1. A method for identifying sensitive data, characterized in that: include: In response to the task creation operation, a sensitive data identification task is created on the task creation page, wherein the sensitive data identification task includes a target data source and a target sensitive data identification rule, and the target sensitive data identification rule is obtained based on a target data classification and at least one target data security classification configuration; In response to a triggering operation of a target control in the task creation page, executing the sensitive data identification task to obtain the data to be identified from the target data source; The target sensitive data identification rule is adopted to identify the target sensitive data from the data to be identified.

2. The method according to claim 1, characterized in that The target sensitive data identification rule includes a first identification sub-rule of multiple fields, The adopting target sensitive data identification rules to identify target sensitive data from the data to be identified includes: Sequentially traverse multiple first identification sub-rules under the target sensitive data identification rule; Matching the currently traversed first identification sub-rule with each field in the data to be identified to obtain a matching result of the currently traversed first identification sub-rule; In response to the matching result of the currently traversed first identification sub-rule indicating that each of the fields contains a first target field, obtaining the first target field from each of the fields; wherein the first target field is a field that matches the currently traversed first identification sub-rule; The target sensitive data is determined according to the first target field and the field value under the first target field.

3. The method according to claim 2, characterized in that The determining the target sensitive data according to the first target field and the field value under the first target field includes: The first target field and the field value under the first target field are regarded as suspected sensitive data; Dispatching the suspected sensitive data to a target audit object to audit the suspected sensitive data and obtain an audit result; Receive the audit result sent by the target audit object, and determine the target sensitive data from the suspected sensitive data based on the audit result.

4. The method according to claim 1, characterized in that: The target sensitive data identification rule includes a plurality of data tables and a second identification sub-rule for a plurality of fields in the data tables, The adopting target sensitive data identification rules to identify target sensitive data from the data to be identified includes: Sequentially traverse multiple second identification sub-rules under the target sensitive data identification rule; Matching the currently traversed second identification sub-rule with each data table in the data to be identified and a plurality of fields in each data table to obtain a matching result of the currently traversed second identification sub-rule; In response to the matching result of the currently traversed second identification sub-rule indicating that there is a target data table in the data to be identified, the target sensitive data is determined based on multiple second target fields in the target data table; wherein the target data table and the multiple second target fields in the target data table match the currently traversed second identification sub-rule.

5. The method according to claim 1, characterized in that The target sensitive data identification rule is configured by the following steps: In response to the data classification selection operation, the target data classification is selected from a plurality of candidate data classifications in the sensitive data identification rule configuration page; wherein the target data classification is used to indicate the data category to which the target sensitive data to be identified belongs; In response to the data classification selection operation, a target data security classification under at least one classification system is selected from a plurality of candidate data security classifications under at least one classification system in the sensitive data identification rule configuration page; wherein the target data security classification is used to indicate the security level of the target sensitive data under the corresponding classification system; In response to the identification condition configuration operation, configuring the identification condition of the target sensitive data on the sensitive data identification rule configuration page; The target sensitive data identification rule is generated according to the target data classification, the at least one target data security classification and the identification condition in the sensitive data identification rule configuration page.

6. The method according to claim 5, characterized in that The method further comprises: The target sensitive data is stored in a storage system corresponding to the target data classification and the target data security classification, so as to obtain the target sensitive data from the storage system and perform desensitization processing on the target sensitive data.

7. The method according to claim 5, characterized in that The method further comprises: In response to the data classification configuration operation, configuring a plurality of candidate data classifications in the data classification page; Synchronizing the multiple candidate data classifications to the sensitive data identification rule configuration page; In response to the data classification configuration operation, configuring at least one classification system and a plurality of candidate data security classifications under the at least one classification system in the data classification page; The at least one classification system and a plurality of candidate data security classifications under the at least one classification system are synchronized to the sensitive data identification rule configuration page.

8. The method according to claim 1, characterized in that In response to the task creation operation, creating a sensitive data identification task on the task creation page includes: In response to the data source selection operation, the target data source is selected from a plurality of candidate data sources in the task creation page; wherein the candidate data source is a data source associated with a financial institution; In response to a rule selection operation, selecting the target sensitive data identification rule from a plurality of candidate sensitive data identification rules in the task creation page; The sensitive data identification task is generated according to the target data source and the target sensitive data identification rule.

9. The method according to claim 8, characterized in that The sensitive data identification task also includes a target task execution cycle and a target data scanning method. The generating the sensitive data identification task according to the target data source and the target sensitive data identification rule includes: In response to the execution cycle selection operation, a target task execution cycle is selected from a plurality of candidate task execution cycles in the task creation page; wherein the target task execution cycle is used to indicate a frequency of executing the sensitive data identification task; In response to a scanning mode selection operation, selecting the target data scanning mode from a plurality of candidate data scanning modes in the task creation page; The sensitive data identification task is generated according to the target data source, the target sensitive data identification rule, the target task execution cycle and the target data scanning method.

10. A sensitive data identification device, characterized in that: include: A creation module, configured to create a sensitive data identification task on a task creation page in response to a task creation operation, wherein the sensitive data identification task includes a target data source and a target sensitive data identification rule, and the target sensitive data identification rule is obtained based on a target data classification and at least one target data security classification configuration; An execution module, configured to execute the sensitive data identification task in response to a triggering operation of a target control in the task creation page, so as to obtain the data to be identified from the target data source; An identification module is used to adopt the target sensitive data identification rule to identify the target sensitive data from the data to be identified.

Images