Data dynamic desensitization method and related device

Abstract

The embodiment of the invention discloses a data dynamic desensitization method and a related device, and relates to the technical field of computers. The method comprises the following steps: receiving a data acquisition request from target equipment, and detecting whether the data acquisition request carries a preset desensitization processing identifier or not; when it is determined that the data acquisition request carries the desensitization processing identifier, representing data of the target request acquisition request as plaintext data, performing restoration processing on the data acquisition request to obtain a restored data acquisition request, forwarding the restored data acquisition request to a data storage server, and storing the restored data in the data storage server; the data storage server responds to the restored data acquisition request to search the target data; and receiving the target data from the data storage server, and forwarding the target data to the target device, the target data being plaintext data which is not subjected to desensitization processing at the moment.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a data dynamic desensitization method and related devices. Background Art

[0002] Desensitization usually refers to the process of modifying sensitive information to protect privacy or confidentiality when processing such information. The desensitized data can still meet the needs of testing, development or other environments without leaking the original information.

[0003] As an intermediate device between the user end and the data storage end, the desensitizing proxy server is mainly used to perform processing such as caching, filtering, load balancing and desensitization. The desensitizing proxy server can check the data packets flowing into and out of the desensitizing proxy server and identify sensitive information from them, such as personal identity information (PII), financial information or other types of information that need to be protected. Once sensitive information is detected, the proxy server can modify the data, such as replacing, encrypting or deleting sensitive information in the data. It can also use more complex algorithms to encrypt the data to achieve data desensitization processing to ensure that sensitive information will not be leaked.

[0004] However, the desensitizing service currently provided by the desensitizing proxy server is relatively simple and cannot meet the needs of complex data desensitizing scenarios. Summary of the invention

[0005] The embodiments of this specification provide a data dynamic desensitization method and related devices, which can solve the above problems. The technical solution is as follows:

[0006] In a first aspect, an embodiment of the present specification provides a method for dynamic data desensitization, wherein the execution subject of the method for dynamic data desensitization is a desensitization proxy server, and the method comprises:

[0007] Receiving a data acquisition request from a target device, and detecting whether the data acquisition request carries a preset desensitization processing identifier;

[0008] When it is determined that the data acquisition request carries the desensitization processing identifier, performing restoration processing on the data acquisition request to obtain a restored data acquisition request;

[0009] Sending the restored data acquisition request to the data storage server, so that the data storage server searches for the target data in response to the restored data acquisition request;

[0010] Receive target data from the data storage server, and forward the target data to the target device.

[0011] In a second aspect, an embodiment of this specification provides a method for dynamic data desensitization, wherein the execution subject of the method for dynamic data desensitization is a target device, and the method includes:

[0012] Receiving a first instruction instructing to obtain target data, and creating a data acquisition request for the target data and carrying a desensitization processing identifier;

[0013] Sending a data acquisition request for the target data and carrying a desensitization processing identifier to a desensitization proxy server, so that the data proxy server executes the data dynamic desensitization method as described in the first aspect;

[0014] Receive target data from the desensitizing proxy server.

[0015] In a third aspect, an embodiment of the present specification provides a data dynamic desensitization device, which is arranged on a desensitization proxy server, and the device includes:

[0016] A first desensitizing proxy module, configured to receive a data acquisition request from a target device and detect whether the data acquisition request carries a preset desensitizing processing identifier;

[0017] A second desensitizing proxy module is used to restore the data acquisition request to obtain a restored data acquisition request when it is determined that the data acquisition request carries the desensitizing processing identifier;

[0018] A third desensitizing proxy module is used to send the restored data acquisition request to the data storage server, so that the data storage server searches for the target data in response to the restored data acquisition request;

[0019] The fourth desensitizing proxy module is used to receive the target data from the data storage server and forward the target data to the target device.

[0020] In a fourth aspect, an embodiment of the present specification provides a data dynamic desensitization device, wherein the data dynamic desensitization device is disposed on a target device, and the method includes:

[0021] A first data acquisition module, configured to instruct receiving a first instruction to acquire target data, and to create a data acquisition request for the target data and carrying a desensitization processing identifier;

[0022] A second data acquisition module is used to send a data acquisition request for the target data and carrying a desensitization processing identifier to the desensitization proxy server, so that the data proxy server executes the data dynamic desensitization method as described in the first aspect;

[0023] The third data acquisition module is used to receive target data from the desensitizing proxy server.

[0024] In a fifth aspect, an embodiment of the present specification provides a computer storage medium, wherein the computer storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the above-mentioned method steps.

[0025] In a sixth aspect, an embodiment of the present specification provides a computer program product, wherein the computer program product stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the above-mentioned method steps.

[0026] In a seventh aspect, an embodiment of the present specification provides an electronic device, which may include: a processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the above-mentioned method steps.

[0027] The beneficial effects brought by the technical solutions provided by some embodiments of this specification include at least:

[0028] In this specification, a data acquisition request is received from a target device, and it is detected whether the data acquisition request carries a preset desensitizing identification; when it is determined that the data acquisition request carries a desensitizing identification, the data representing the target acquisition request is plain text data, the data acquisition request is restored to obtain a restored data acquisition request, and the restored data acquisition request is forwarded to a data storage server, so that the data storage server searches for the target data in response to the restored data acquisition request; the target data is received from the data storage server, and the target data is forwarded to the target device, at which time the target data is plain text data that has not been desensitized. In other words, in the embodiments of this specification, the data acquisition request is associated with whether the target data is desensitized, and the user determines whether the acquired data is plain text data or desensitized data by sending a data acquisition request through the target device, which has a high degree of freedom and meets the user's usage needs. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the embodiments of this specification or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0030] Figure 1 It is a schematic diagram of the architecture of a data dynamic desensitization method provided in an embodiment of this specification;

[0031] Figure 2 It is a flowchart of a data dynamic desensitization method provided in an embodiment of this specification;

[0032] Figure 3It is a flowchart of a data dynamic desensitization method provided in an embodiment of this specification;

[0033] Figure 4 It is a flowchart of a data dynamic desensitization method provided in an embodiment of this specification;

[0034] Figure 5 It is a flowchart of a data dynamic desensitization method provided in an embodiment of this specification;

[0035] Figure 6 It is a structural schematic diagram of a data dynamic desensitization device provided in an embodiment of this specification;

[0036] Figure 7 It is a structural schematic diagram of a data dynamic desensitization device provided in an embodiment of this specification;

[0037] Figure 8 It is a structural schematic diagram of an electronic device provided in an embodiment of this specification. DETAILED DESCRIPTION

[0038] The following will be combined with the drawings in the embodiments of this specification to clearly and completely describe the technical solutions in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this specification.

[0039] In the description of this specification, it should be understood that the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In the description of this specification, it should be noted that, unless otherwise clearly specified and limited, "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally also includes steps or units that are not listed, or optionally also includes other steps or units inherent to these processes, methods, products or devices. For those of ordinary skill in the art, the specific meanings of the above terms in this specification can be understood in specific circumstances. In addition, in the description of this specification, unless otherwise specified, "multiple" refers to two or more. "And / or" describes the association relationship of associated objects, indicating that there can be three relationships, for example, A and / or B, which can represent: A exists alone, A and B exist at the same time, and B exists alone. The character " / " generally indicates that the associated objects before and after are an "or" relationship.

[0040] The present specification is described in detail below with reference to specific embodiments.

[0041] It should be noted that the information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in the embodiments of this specification are all authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of relevant countries and regions. For example, the features, information and data involved in this specification are all obtained with full authorization.

[0042] Desensitization usually refers to the process of modifying sensitive information to protect privacy or confidentiality when processing such information. The desensitized data can still meet the needs of testing, development or other environments without leaking the original information.

[0043] As an intermediate device between the user end and the data storage end, the desensitizing proxy server is mainly used to perform processing such as caching, filtering, load balancing and desensitization. The desensitizing proxy server can check the data packets flowing into and out of the desensitizing proxy server and identify sensitive information from them, such as personal identity information (PII), financial information or other types of information that need to be protected. Once sensitive information is detected, the proxy server can modify the data, such as replacing, encrypting or deleting sensitive information in the data. It can also use more complex algorithms to encrypt the data to achieve data desensitization processing to ensure that sensitive information will not be leaked.

[0044] However, the desensitizing service currently provided by the desensitizing proxy server is relatively simple and cannot meet the needs of complex data desensitizing scenarios.

[0045] In view of the above problems, the present application embodiment proposes a method for dynamic data desensitization to solve them. Figure 1 As shown, Figure 1 It is a schematic diagram of the architecture of a data dynamic desensitization method provided in an embodiment of this specification. Figure 1 The system includes a plurality of electronic devices, wherein the plurality of electronic devices at least include a plurality of target devices, a desensitizing proxy server 101, and a plurality of data storage servers. The plurality of target devices at least include a target device 1021, a target device 1022, and a target device 1023, and the plurality of data storage servers at least include a data storage server 1031 and a data storage server 1032. It is understandable that Figure 1 The number of target devices and data storage servers shown in the figure is for illustration only and this application does not impose any limitation on this.

[0046] The above-mentioned electronic devices include but are not limited to physical or virtual processors, mobile stations (MS), mobile terminals, mobile phones, handsets and portable equipment, Bluetooth headsets, smart watches and other types. The electronic devices can communicate with one or more core networks via a radio access network (RAN).

[0047] For example, the desensitizing proxy server 101 is a plurality of physical servers, and the plurality of physical servers are independent in hardware. Alternatively, the desensitizing proxy server 101 is a plurality of virtual servers, and the plurality of virtual servers are deployed in the same hardware resource pool, and the deployment methods of the virtual servers include but are not limited to: VMware, Virtual Box, and Virtual PC.

[0048] It is understandable that the desensitizing proxy server 101 also has other service capabilities and functions to complete the tasks in the following embodiments. For example, the desensitizing proxy server 101 also provides portal services, resource management services, and CI / CD services.

[0049] In the embodiment of the present application, a display device may be installed on the target device 1021, the target device 1022 or the target device 1023, and the display device may be any device capable of realizing a display function, for example, the display device may be a cathode ray tube display (Cathode ray tube display, referred to as CR), a light-emitting diode display (Light-emitting diode display, referred to as LED), an electronic ink screen, a liquid crystal display (Liquid crystal display, referred to as LCD), a plasma display panel (Plasma display panel, referred to as PDP), etc. For example, a user may use the display device on the electronic device 101 to interact with an application, or view a sample set similar to the target sample set obtained after the electronic device 1011 executes the sample screening method of the embodiment of the present specification.

[0050] Multiple target devices, desensitizing proxy server 101 and multiple data storage servers can communicate through a communication link established by a communication protocol, such as the gRPC protocol. gRPC is a high-performance, general-purpose open source remote processor call (RPC) framework, which is mainly designed for mobile application development and based on the HTTP / 2 protocol standard, based on the protocol buffer (PB) serialization protocol development, and supports many development languages. In addition, the communication link can also be a wireless communication link or a wired communication link, for example: a wired communication link includes an optical fiber, a twisted pair or a coaxial cable, and a wireless communication link includes a Bluetooth communication link, a wireless fidelity (WIreless-FIdelity, Wi-Fi) communication link or a microwave communication link, etc.

[0051] The database corresponding to the data storage server is at least one of a relational database, a non-relational database (NoSQL Databases) and a key-value database (Key-Value Stores). The types of databases corresponding to the data storage server 1031 and the data storage server 1032 can be the same or different, and the database addresses corresponding to the data storage server 1031 and the data storage server are different.

[0052] Relational databases are table-based databases that are connected to each other through relationships (such as foreign keys), support structured data, and are queried and operated through SQL (Structured Query Language). Common relational database management systems (RDBMS) include MySQL, PostgreSQL, SQL Server, etc. Non-relational databases (NoSQL Databases), also known as NoSQL databases, are designed to solve the diversity problem of large-scale data collections. Instead of relying on tables or relationships, they use different data models such as key-value pairs, column families, documents, or graphs to store data. Common NoSQL databases include MongoDB (document database), Cassandra (column family database), Redis (key-value database), and Neo4j (graph database). Key-value databases are one of the simplest types of NoSQL databases. They store data in key-value pairs, where each key is mapped to a unique value. Key-value databases are very suitable for application scenarios that need to find and read data quickly because they provide very low latency. The common key-value database Redis is a very popular example of a key-value database.

[0053] In actual applications, data storage servers may adopt a hybrid storage solution, that is, deploying both relational databases and non-relational databases (including key-value databases) to fully utilize the advantages of each database type. For example, an application may use a relational database to store structured data and ensure data consistency and integrity; and use a key-value database to cache hot data to improve reading speed and system responsiveness.

[0054] In one embodiment, Figure 2 As shown, it is a schematic diagram of a data dynamic desensitization method provided by an embodiment of this specification, and the execution subject of the data dynamic desensitization method is a desensitization proxy server. The method can be implemented by a computer program and can be run on a data dynamic desensitization device based on the von Neumann system. The computer program can be integrated in an application or run as an independent tool application.

[0055] Specifically, the data dynamic desensitization method includes:

[0056] S102: Receive a data acquisition request from a target device, and detect whether the data acquisition request carries a preset desensitization processing identifier.

[0057] A data acquisition request is used to instruct the acquisition of target data. Specifically, a data acquisition request specifies the type, range, format, and possible other parameters of the target data to be acquired. A data acquisition request can be issued by a target device in a variety of ways, including but not limited to API calls, database queries, web form submissions, etc. A data acquisition request usually contains enough information so that the data storage server can accurately locate and retrieve the requested target data.

[0058] The desensitization processing identifier is used to indicate that the desensitization proxy server does not perform desensitization processing on the target data. In other words, the data acquisition request carrying the desensitization processing identifier instructs the desensitization proxy server not to perform desensitization processing on the target data.

[0059] The desensitization processing identifier can be an identifier agreed upon between any target device and the desensitization proxy server. The desensitization processing identifier can be a string of more than 16 characters, so as to be distinguished from the string representing the target data included in the data acquisition request.

[0060] The desensitization identification can also be associated with the device information of the target device. In one embodiment, before receiving a data acquisition request from the target device and detecting whether the data acquisition request carries a preset desensitization identification, it also includes: receiving a desensitization identification application request from the target device; responding to the desensitization identification application request, verifying the device information of the target device; when the device information of the target device passes the verification, creating and storing the desensitization identification corresponding to the target device, and sending the desensitization identification to the target device.

[0061] The desensitization identification application request is used to apply for a desensitization processing identification associated with the target device. The device information of the target device is used to distinguish different target devices. The device information of the target device may include information such as the device name, model, manufacturer, serial number, etc. The device information of the target device may also include the identity information obtained by the target device through the agreement with the desensitization proxy server.

[0062] The desensitizing proxy server verifies the device information of the target device. When the device information of the target device passes the verification, it creates and stores a desensitizing processing identifier corresponding to the target device, and sends the desensitizing processing identifier to the target device, so that the target device can choose whether to carry the desensitizing processing identifier when sending a data acquisition request.

[0063] In this embodiment, the desensitizing processing identifier of the target device is determined through the device information of the target device. The desensitizing processing identifier is uniquely associated with the target device, so that when a data acquisition request is received, a desensitizing strategy for desensitizing the target data is determined based on the desensitizing processing identifier.

[0064] S104: When it is determined that the data acquisition request carries a desensitization processing identifier, restore the data acquisition request to obtain a restored data acquisition request.

[0065] Restoring a data acquisition request can be understood as restoring the original form or intent of a captured, recorded or stored data acquisition request, so that the data storage server can determine the required target data based on the restored data acquisition request. Restoring a data acquisition request includes but is not limited to HTTP requests, database queries, API calls, etc.

[0066] The types of data acquisition requests include, but are not limited to, HTTP requests (such as HTTP methods such as GET, POST, PUT, and DELETE), database queries (such as SQL queries), and API calls (such as data interaction requests made through interfaces such as RESTful API and GraphQL).

[0067] According to the type of data acquisition request and / or the desensitizing processing identifier carried by the data acquisition request, the steps of restoring the data acquisition request are determined. In one embodiment, when it is determined that the data acquisition request carries the desensitizing processing identifier, the data acquisition request is restored to obtain a restored data acquisition request, including: when it is determined that the data acquisition request carries the desensitizing processing identifier, the desensitizing processing identifier included in the data acquisition request is deleted to obtain a restored data acquisition request corresponding to the data acquisition request.

[0068] For example, the desensitizing processing identifier agreed and stored between the desensitizing proxy server and the target device is token=xxx, and the data acquisition request sent by the target device is "select account_no from tablename where userid=111". The corresponding data acquisition request after the data acquisition request carries the desensitizing processing identifier is "selectaccount_no from tablename where userid=111xxx". When the desensitizing proxy server receives the data acquisition request, it deletes the desensitizing processing identifier in the data acquisition request to perform desensitization processing on the data acquisition request, and obtains the restored data request as "select account_no from tablename where userid=111".

[0069] In this embodiment, the method for restoring a data acquisition request includes deleting a desensitizing processing identifier included in the data acquisition request. The restoration processing steps are simple and have little impact on the data acquisition request, thereby improving the accuracy of the data storage server in searching for target data based on the restored data acquisition request.

[0070] For example, the target device 1021 sends a data acquisition request to the desensitizing proxy server 101. When the desensitizing proxy server 101 determines that the data acquisition request carries a desensitizing processing identifier, it restores the data acquisition request, determines that the data storage server storing the target data is the data storage server 1031 based on the restored data acquisition request, and forwards the restored data acquisition request to the data storage service 1031, so that the data storage server 1031 searches for the target data in the database in response to the restored data acquisition request, and sends the target data to the desensitizing proxy server 101.

[0071] S106: Send a request for obtaining restored data to the data storage server, so that the data storage server searches for target data in response to the request for obtaining restored data.

[0072] The desensitizing proxy server sends a restore data request to the data storage server according to the communication link between the desensitizing proxy server and the data storage server, so that the data storage server searches for the target data in response to the association information between the target data and the data acquisition request. And the data storage server sends the target data to the desensitizing proxy server.

[0073] S106: Receive target data from the data storage server, and forward the target data to the target device.

[0074] When receiving target data from the data storage server, the desensitizing proxy server forwards the target data as plain text data to the target device.

[0075] For example, if the target data is the salary data of a certain month, and the salary data displayed by the target device is desensitized data that does not involve sensitive information such as user information and salary conversion rules, when the user clicks the control to query the plain text data on the page where the target device displays the work data, the target device sends a data acquisition request with a desensitization processing identifier to the desensitization proxy device. The data acquisition request is used to obtain the plain text data related to the salary data as desensitized data. The desensitization processing server executes as follows Figure 2 The data dynamic desensitization method shown obtains the plaintext data that has not been desensitized, that is, the plaintext data including sensitive information such as user information and salary conversion rules, and sends it to the target device so that the target device displays the plaintext data to the user for viewing.

[0076] In this specification, a data acquisition request is received from a target device, and it is detected whether the data acquisition request carries a preset desensitizing identification; when it is determined that the data acquisition request carries a desensitizing identification, the data representing the target acquisition request is plain text data, the data acquisition request is restored to obtain a restored data acquisition request, and the restored data acquisition request is forwarded to a data storage server, so that the data storage server searches for the target data in response to the restored data acquisition request; the target data is received from the data storage server, and the target data is forwarded to the target device, at which time the target data is plain text data that has not been desensitized. In other words, in the embodiments of this specification, the data acquisition request is associated with whether the target data is desensitized, and the user determines whether the acquired data is plain text data or desensitized data by sending a data acquisition request through the target device, which has a high degree of freedom and meets the user's usage needs.

[0077] In one embodiment, Figure 3As shown, it is a schematic diagram of a data dynamic desensitization method provided by an embodiment of this specification, and the execution subject of the data dynamic desensitization method is a desensitization proxy server. The method can be implemented by a computer program and can be run on a data dynamic desensitization device based on the von Neumann system. The computer program can be integrated in an application or run as an independent tool application.

[0078] Specifically, the data dynamic desensitization method includes:

[0079] S202: Receive a data acquisition request from a target device, and detect whether the data acquisition request carries a preset desensitization processing identifier.

[0080] See the above S102, which will not be described again here.

[0081] S204: When it is determined that the data acquisition request does not carry a desensitization processing identifier, forward the data acquisition request to a data storage server.

[0082] When the desensitizing proxy server determines that the data acquisition request does not carry a desensitizing processing identifier, it forwards the data acquisition request to the data storage server according to the data storage server associated with the data acquisition request, so that the data storage server searches for the target data in response to the data acquisition request.

[0083] For example, the target device 1021 sends a data acquisition request to the desensitizing proxy server 101. When the desensitizing proxy server 101 determines that the data acquisition request does not carry a desensitizing processing identifier, it determines that the data storage server storing the target data is the data storage server 1031 based on the data acquisition request, and forwards the data acquisition request to the data storage service 1031, so that the data storage server 1031 searches for the target data in the database in response to the data acquisition request, and sends the target data to the desensitizing proxy server 101.

[0084] S206, receiving target data from the data storage server, desensitizing the target data to obtain desensitized data, and forwarding the desensitized data to the target device.

[0085] Desensitizing the target data is an important means to protect sensitive data from being leaked. Desensitizing mainly deforms or hides sensitive information to ensure that the target data can maintain its transaction rules and data relevance while not leaking sensitive content.

[0086] Desensitization includes one or more of the following processes: replacement method, replacing specific characters or character sequences with other symbols (such as an asterisk "*") or specific strings; masking method, retaining some features of the data to maintain its basic structure, such as a credit card number often retains the first six digits and the last four digits, and replaces the middle part with asterisks; encryption method, using complex mathematical algorithms to encode sensitive data, such as AES, RSA and other encryption algorithms; data perturbation, introducing small, random changes in the data set to keep the overall data distribution, correlation and trend unchanged; data segmentation, splitting sensitive data into multiple parts and storing them in different physical or logical locations; pseudo-data generation, creating false data that is highly similar to real data in statistical characteristics but has no actual correspondence; data shielding, limiting the user's viewing scope and operation rights on sensitive data by defining data access rights, roles and rules.

[0087] In one embodiment, when it is determined that the data acquisition request carries a desensitizing processing identifier, after restoring the data acquisition request to obtain a restored data acquisition request, it also includes: determining a desensitizing strategy based on the data acquisition request, receiving target data from a data storage server, and desensitizing the target data to obtain desensitized data, including: receiving target data from a data storage server, and desensitizing the target data according to the desensitizing strategy to obtain desensitized data.

[0088] The desensitization strategy includes at least one desensitization processing method, and the desensitization strategy of the target data is determined according to the type of the data acquisition request and / or the device information of the target device corresponding to the data acquisition request.

[0089] For example, the desensitization policy rules corresponding to the data acquisition request are matched through the mounted database dynamic desensitization plug-in. In this step, the policy synchronization program places the user-configured desensitization policy in the shared memory. When executing the data acquisition request built based on the SQL statement, the database dynamic desensitization plug-in will be used to match the specific user information, table information, and column information involved in the SQL statement execution process with the desensitization policy in the shared memory. The same parsing process is used for views related to the desensitized table and stored procedures with result sets. In the process of executing SQL statements, the database dynamic desensitization plug-in can make the data acquisition process not only come from the data stored in the database itself, but also be subject to the detailed rules for the fields in the policy configuration machine, and finally obtain the desensitized data of the target data pair, and send the desensitized data to the target device.

[0090] S208. When it is determined that the data acquisition request carries a desensitization processing identifier, restore the data acquisition request to obtain a restored data acquisition request.

[0091] See the above S104, which will not be described again here.

[0092] S210: Send a request for obtaining restored data to a data storage server, so that the data storage server searches for target data in response to the request for obtaining restored data.

[0093] See the above S106, which will not be repeated here.

[0094] S212: Receive target data from the data storage server, and send the target data to the target device.

[0095] See the above S108, which will not be repeated here.

[0096] In this specification, a data acquisition request is received from a target device, and it is detected whether the data acquisition request carries a preset desensitizing identification; when it is determined that the data acquisition request carries a desensitizing identification, the data representing the target acquisition request is plain text data, the data acquisition request is restored to obtain a restored data acquisition request, and the restored data acquisition request is forwarded to a data storage server, so that the data storage server searches for the target data in response to the restored data acquisition request; the target data is received from the data storage server, and the target data is forwarded to the target device, at which time the target data is plain text data that has not been desensitized. In other words, in the embodiments of this specification, the data acquisition request is associated with whether the target data is desensitized, and the user determines whether the acquired data is plain text data or desensitized data by sending a data acquisition request through the target device, which has a high degree of freedom and meets the user's usage needs.

[0097] In one embodiment, Figure 4 As shown, it is a schematic diagram of a data dynamic desensitization method provided by an embodiment of this specification, and the execution subject of the data dynamic desensitization method is a target device. The method can be implemented by a computer program and can be run on a data dynamic desensitization device based on the von Neumann system. The computer program can be integrated in an application or run as an independent tool application.

[0098] Specifically, the data dynamic desensitization method includes:

[0099] S302: The target device receives a first instruction to obtain target data, and creates a data acquisition request for the target data and carrying a desensitization processing identifier.

[0100] The target device obtains a first instruction for the target data input by the user by presenting a display page including a plurality of controls to the user. In response to the first instruction, a data acquisition request including information associated with the target data and a desensitization processing identifier is created.

[0101] For example, the target data is the salary data of a certain month, and the salary data displayed by the target device is desensitized data that does not involve sensitive information such as user information and salary conversion rules. When the user clicks on the control for querying plaintext data on the page where the target device displays work data, the target device creates a data acquisition request carrying a desensitizing processing identifier in response to the triggering of the control. The data acquisition request is used to obtain plaintext data related to the salary data that is desensitized data.

[0102] S304: Send a data acquisition request for the target data and the shoelace desensitization processing identifier to the desensitization proxy server.

[0103] The target device sends a data acquisition request for the target data and carrying the desensitization processing mark to the desensitization proxy server through the communication link between the target device and the desensitization proxy server. The desensitization proxy server receives the data acquisition request and executes the following steps: Figure 2-3 The method for dynamic data desensitization shown obtains the target data as plaintext data.

[0104] S306: Receive target data from the desensitizing proxy server.

[0105] The target device receives the target data as plain text data sent from the desensitizing proxy server. For example, the target data is the salary data of a certain month, and the salary data displayed by the target device through the display page is desensitized data that does not involve sensitive information such as user information and salary conversion rules. When the user clicks on the control for querying plain text data on the page where the target device displays work data, the target device creates a data acquisition request carrying a desensitizing processing identifier in response to the triggering of the control. The data acquisition request is used to obtain plain text data related to the salary data as desensitized data. The target device receives the target data from the desensitizing proxy server and displays the plain text data of sensitive information such as user information and salary conversion rules through the display page.

[0106] In one embodiment, a second instruction instructing to obtain desensitized data corresponding to the target data is received, and a data acquisition request for the target data is created; a data acquisition request for the target data is sent to a desensitizing proxy server; and desensitized data is received from the desensitizing proxy server. The desensitized data is data obtained by desensitizing the target data by the desensitizing proxy server. The second instruction is used to instruct the target device to create a data acquisition request instructing the desensitizing proxy server to obtain the target data, and the data acquisition request does not carry a desensitizing processing identifier.

[0107] For example, the target device receives a second instruction input by the user through a control with the content "View Salary" on the display page, creates a data acquisition request for target data including salary information in response to the second instruction, and sends the data acquisition request to the desensitizing proxy server. The desensitizing proxy server receives the data acquisition request and forwards the data acquisition request to the data storage server to obtain the target data including salary information, thereby desensitizing the target data to obtain desensitized data that does not involve sensitive information such as user information and salary conversion rules. The target device displays the desensitized data through the display page, thereby protecting the privacy data from being leaked.

[0108] In this specification, a data acquisition request is received from a target device, and it is detected whether the data acquisition request carries a preset desensitizing identification; when it is determined that the data acquisition request carries a desensitizing identification, the data representing the target acquisition request is plain text data, the data acquisition request is restored to obtain a restored data acquisition request, and the restored data acquisition request is forwarded to a data storage server, so that the data storage server searches for the target data in response to the restored data acquisition request; the target data is received from the data storage server, and the target data is forwarded to the target device, at which time the target data is plain text data that has not been desensitized. In other words, in the embodiments of this specification, the data acquisition request is associated with whether the target data is desensitized, and the user determines whether the acquired data is plain text data or desensitized data by sending a data acquisition request through the target device, which has a high degree of freedom and meets the user's usage needs.

[0109] In one embodiment, Figure 5 As shown, it is a schematic diagram of a data dynamic desensitization method provided by an embodiment of this specification, and the execution subject of the data dynamic desensitization method includes a target device, a desensitization proxy server and a data storage server. The method can be implemented by a computer program and can be run on a data dynamic desensitization device based on the von Neumann system. The computer program can be integrated in an application or run as an independent tool application.

[0110] Specifically, the data dynamic desensitization method includes:

[0111] S402: The target device receives a first instruction or a second instruction instructing to obtain the target device.

[0112] See the above S302, which will not be described again here.

[0113] S404: The target device sends a data acquisition request for the target data to the desensitizing proxy server.

[0114] The first instruction is used to instruct the target device to create a data acquisition request for the target data and carrying a desensitization identification. The second instruction is used to instruct the target device to create a data acquisition request for the target data, and the data acquisition request does not carry a desensitization identification.

[0115] S406. The desensitizing proxy server receives a data acquisition request from the target device and detects whether the data acquisition request carries a preset desensitizing processing identifier.

[0116] See the above S102, which will not be described again here.

[0117] S408. When the desensitizing proxy server determines that the data acquisition request does not carry a desensitizing processing identifier, the desensitizing proxy server forwards the data acquisition request to the data storage server.

[0118] See the above S204, which will not be described again here.

[0119] S410 . The data storage server searches for target data in response to a data acquisition request.

[0120] The data storage server receives the data acquisition request, searches for corresponding target data based on information associated with the target data in the data acquisition request, and sends the target data to the desensitizing proxy server.

[0121] S412, the desensitizing proxy server receives the target data from the data storage server, desensitizes the target data to obtain desensitized data, and sends the desensitized data to the target device.

[0122] See the above S206, which will not be described again here.

[0123] S414. The desensitizing proxy server performs restoration processing on the data acquisition request to obtain a restored data acquisition request.

[0124] See the above S206, which will not be described again here.

[0125] S416. The desensitizing proxy server sends a request to obtain restored data to the data storage server.

[0126] See the above S208, which will not be repeated here.

[0127] S418: The data storage server searches for target data in response to the restore data acquisition request.

[0128] The data storage server receives the restore data acquisition request, searches for corresponding target data based on information associated with the target data in the restore data acquisition request, and sends the target data to the desensitizing proxy server.

[0129] S420, the desensitizing proxy server receives the target data from the data storage server, and sends the target data to the target device.

[0130] See the above S212, which will not be repeated here.

[0131] S422. The target device receives target data from the desensitizing proxy server.

[0132] In this specification, a data acquisition request is received from a target device, and it is detected whether the data acquisition request carries a preset desensitizing identification; when it is determined that the data acquisition request carries a desensitizing identification, the data representing the target acquisition request is plain text data, the data acquisition request is restored to obtain a restored data acquisition request, and the restored data acquisition request is forwarded to a data storage server, so that the data storage server searches for the target data in response to the restored data acquisition request; the target data is received from the data storage server, and the target data is forwarded to the target device, at which time the target data is plain text data that has not been desensitized. In other words, in the embodiments of this specification, the data acquisition request is associated with whether the target data is desensitized, and the user determines whether the acquired data is plain text data or desensitized data by sending a data acquisition request through the target device, which has a high degree of freedom and meets the user's usage needs.

[0133] The following are device embodiments of this specification, which can be used to implement the method embodiments of this specification. For details not disclosed in the device embodiments of this specification, please refer to the method embodiments of this specification.

[0134] See also Figure 6 , which shows a schematic diagram of the structure of a data dynamic desensitization device provided by an exemplary embodiment of this specification. The data dynamic desensitization device can be implemented as all or part of the device through software, hardware or a combination of both, and the data dynamic desensitization device is arranged on a desensitization proxy server. The data dynamic desensitization device includes a first desensitization proxy module 502, a second desensitization proxy module 504, a third desensitization proxy module 506, and a fourth desensitization proxy module 508.

[0135] The first desensitizing agent module 502 is used to receive a data acquisition request from a target device and detect whether the data acquisition request carries a preset desensitizing processing identifier;

[0136] The second desensitizing proxy module 504 is used to restore the data acquisition request to obtain a restored data acquisition request when it is determined that the data acquisition request carries the desensitizing processing identifier;

[0137] A third desensitizing agent module 506 is used to send the restored data acquisition request to the data storage server, so that the data storage server searches for the target data in response to the restored data acquisition request;

[0138] The fourth desensitizing agent module 508 is used to receive the target data from the data storage server and forward the target data to the target device.

[0139] In one embodiment, the data dynamic desensitization device further includes:

[0140] a fifth desensitizing proxy module, configured to forward the data acquisition request to the data storage server when it is determined that the data acquisition request does not carry the desensitizing processing identifier, so that the data storage server searches for the target data in response to the data acquisition request;

[0141] The sixth desensitizing agent module is used to receive the target data from the data storage server, perform desensitizing processing on the target data to obtain desensitized data, and send the desensitized data to the target device.

[0142] In one embodiment, the second desensitization agent module 504 includes:

[0143] The restoration processing unit is used to delete the desensitizing processing identifier included in the data acquisition request when it is determined that the data acquisition request carries the desensitizing processing identifier, and obtain a restored data acquisition request corresponding to the data acquisition request.

[0144] In one embodiment, the data dynamic desensitization device further includes:

[0145] A seventh desensitization proxy module, used to determine a desensitization strategy according to the data acquisition request;

[0146] The sixth desensitizing agent module includes:

[0147] The desensitizing processing unit is used to receive the target data from the data storage server, perform desensitizing processing on the target data according to the desensitizing strategy to obtain desensitized data, and send the desensitized data to the target device.

[0148] In one embodiment, the data dynamic desensitization device further includes:

[0149] An eighth desensitizing agent module, configured to receive a desensitizing identification application request from the target device;

[0150] A ninth desensitizing agent module, configured to respond to the desensitizing identification application request and verify the device information of the target device;

[0151] The tenth desensitizing agent module is used to create and store a desensitizing processing identifier corresponding to the target device when the device information of the target device passes the verification, and send the desensitizing processing identifier to the target device.

[0152] In this specification, a data acquisition request is received from a target device, and it is detected whether the data acquisition request carries a preset desensitizing identification; when it is determined that the data acquisition request carries a desensitizing identification, the data representing the target acquisition request is plain text data, the data acquisition request is restored to obtain a restored data acquisition request, and the restored data acquisition request is forwarded to a data storage server, so that the data storage server searches for the target data in response to the restored data acquisition request; the target data is received from the data storage server, and the target data is forwarded to the target device, at which time the target data is plain text data that has not been desensitized. In other words, in the embodiments of this specification, the data acquisition request is associated with whether the target data is desensitized, and the user determines whether the acquired data is plain text data or desensitized data by sending a data acquisition request through the target device, which has a high degree of freedom and meets the user's usage needs.

[0153] See also Figure 7 , which shows a schematic diagram of the structure of a data dynamic desensitization device provided by an exemplary embodiment of this specification. The data dynamic desensitization device can be implemented as all or part of the device through software, hardware or a combination of both. The data dynamic desensitization device is set on the target device. The data dynamic desensitization device includes a first data acquisition module 602, a second data acquisition module 604, and a third data acquisition module 606.

[0154] A first data acquisition module 602, configured to receive a first instruction for acquiring target data and create a data acquisition request for the target data and carrying a desensitization processing identifier;

[0155] The second data acquisition module 604 is used to send a data acquisition request for the target data and carrying a desensitization processing identifier to the desensitization proxy server, so that the data proxy server executes the data dynamic desensitization method according to any one of claims 1 to 5;

[0156] The third data acquisition module 608 is used to receive target data from the desensitizing proxy server.

[0157] In one embodiment, the data dynamic desensitization device further includes:

[0158] A fourth data acquisition module, configured to receive a second instruction instructing to acquire desensitized data corresponding to target data, and create a data acquisition request for the target data;

[0159] A fifth data acquisition module, used for sending a data acquisition request for the target data to the desensitizing proxy server;

[0160] The sixth data acquisition module is used to receive the desensitized data from the desensitizing proxy server.

[0161] In this specification, a data acquisition request is received from a target device, and it is detected whether the data acquisition request carries a preset desensitizing identification; when it is determined that the data acquisition request carries a desensitizing identification, the data representing the target acquisition request is plain text data, the data acquisition request is restored to obtain a restored data acquisition request, and the restored data acquisition request is forwarded to a data storage server, so that the data storage server searches for the target data in response to the restored data acquisition request; the target data is received from the data storage server, and the target data is forwarded to the target device, at which time the target data is plain text data that has not been desensitized. In other words, in the embodiments of this specification, the data acquisition request is associated with whether the target data is desensitized, and the user determines whether the acquired data is plain text data or desensitized data by sending a data acquisition request through the target device, which has a high degree of freedom and meets the user's usage needs.

[0162] It should be noted that the data dynamic desensitization device provided in the above embodiment only uses the division of the above-mentioned functional modules as an example when executing the data dynamic desensitization method. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the data dynamic desensitization device provided in the above embodiment and the data dynamic desensitization method embodiment belong to the same concept, and the implementation process thereof is detailed in the method embodiment, which will not be repeated here.

[0163] The serial numbers of the embodiments of this specification are for description only and do not represent the advantages or disadvantages of the embodiments.

[0164] The present specification also provides a computer storage medium, which can store multiple instructions, and the instructions are suitable for being loaded and executed by a processor as described above. Figure 1 - Figure 5 The data dynamic desensitization method of the embodiment shown in the figure can be found in the specific execution process. Figure 1 - Figure 5 The specific description of the illustrated embodiment will not be repeated here.

[0165] The present specification also provides a computer program product, which stores at least one instruction, and the at least one instruction is loaded and executed by the processor as described above. Figure 1 - Figure 5The data dynamic desensitization method of the embodiment shown in the figure can be found in the specific execution process. Figure 1 - Figure 5 The specific description of the illustrated embodiment will not be repeated here.

[0166] See also Figure 7 , is a schematic diagram of the structure of an electronic device provided in the embodiment of this specification. Figure 7 As shown, the electronic device 700 may include: at least one processor 701 , at least one network interface 704 , a user interface 703 , a memory 705 , and at least one communication bus 702 .

[0167] The communication bus 702 is used to realize the connection and communication between these components.

[0168] The user interface 703 may include a display screen (Display) and a camera (Camera), and the optional user interface 703 may also include a standard wired interface and a wireless interface.

[0169] The network interface 704 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0170] Among them, the processor 701 may include one or more processing cores. The processor 701 uses various interfaces and lines to connect various parts within the entire server 700, and executes various functions and processes data of the server 700 by running or executing instructions, programs, code sets or instruction sets stored in the memory 705, and calling data stored in the memory 705. Optionally, the processor 701 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 701 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 701, and it can be implemented by a single chip.

[0171] Among them, the memory 705 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory). Optionally, the memory 705 includes a non-transitory computer-readable storage medium. The memory 705 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 705 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned method embodiments, etc.; the data storage area may store data involved in the above-mentioned method embodiments, etc. The memory 705 may optionally be at least one storage device located away from the aforementioned processor 701. As Figure 7 As shown, the memory 705 as a computer storage medium may include an operating system, a network communication module, a user interface module, and a data dynamic desensitization application.

[0172] exist Figure 7 In the electronic device 700 shown, the user interface 703 is mainly used to provide an input interface for the user and obtain the data input by the user; and the processor 701 can be used to call the data dynamic desensitization application stored in the memory 705, and specifically perform the following operations:

[0173] Receiving a data acquisition request from a target device, and detecting whether the data acquisition request carries a preset desensitization processing identifier;

[0174] When it is determined that the data acquisition request carries the desensitization processing identifier, performing restoration processing on the data acquisition request to obtain a restored data acquisition request;

[0175] Sending the restored data acquisition request to the data storage server, so that the data storage server searches for the target data in response to the restored data acquisition request;

[0176] Receive target data from the data storage server, and forward the target data to the target device.

[0177] In one embodiment, after the processor 701 receives the data acquisition request from the target device and detects whether the data acquisition request carries a preset desensitization processing identifier, it further executes:

[0178] When it is determined that the data acquisition request does not carry the desensitization processing identifier, forwarding the data acquisition request to the data storage server, so that the data storage server searches for the target data in response to the data acquisition request;

[0179] Receive target data from the data storage server, perform desensitization processing on the target data to obtain desensitized data, and send the desensitized data to the target device.

[0180] In one embodiment, the processor 701 performs, when determining that the data acquisition request carries the desensitization processing identifier, restoring the data acquisition request to obtain a restored data acquisition request, specifically performing:

[0181] When it is determined that the data acquisition request carries the desensitizing processing identifier, the desensitizing processing identifier included in the data acquisition request is deleted to obtain a restored data acquisition request corresponding to the data acquisition request.

[0182] In one embodiment, after the processor 701 performs the process of restoring the data acquisition request to obtain a restored data acquisition request when determining that the data acquisition request carries the desensitization processing identifier, it further performs:

[0183] Determine a desensitization strategy according to the data acquisition request;

[0184] The processor 701 executes the receiving of the target data from the data storage server, desensitizing the target data to obtain desensitized data, and sending the desensitized data to the target device, specifically executing:

[0185] Receive target data from the data storage server, perform desensitization processing on the target data according to the desensitization strategy to obtain desensitized data, and send the desensitized data to the target device.

[0186] In one embodiment, before the processor 701 receives the data acquisition request from the target device and detects whether the data acquisition request carries a preset desensitization processing identifier, it further executes:

[0187] Receiving a desensitization identification application request from the target device;

[0188] In response to the desensitizing identification application request, verifying the device information of the target device;

[0189] When the device information of the target device passes the verification, a desensitizing identification corresponding to the target device is created and stored, and the desensitizing identification is sent to the target device.

[0190] In one embodiment, the processor 701 may be used to call the data dynamic desensitization application stored in the memory 705, and specifically perform the following operations:

[0191] Receiving a first instruction instructing to obtain target data, and creating a data acquisition request for the target data and carrying a desensitization processing identifier;

[0192] Sending a data acquisition request for the target data and carrying a desensitization processing identifier to a desensitization proxy server, so that the data proxy server executes the data dynamic desensitization method as described in any one of claims 1 to 5;

[0193] Receive target data from the desensitizing proxy server.

[0194] In one embodiment, the processor 701 further executes:

[0195] receiving a second instruction instructing to obtain desensitized data corresponding to target data, and creating a data acquisition request for the target data;

[0196] Sending a data acquisition request for the target data to the desensitizing proxy server;

[0197] Receive desensitized data from the desensitizing proxy server.

[0198] In this specification, a data acquisition request is received from a target device, and it is detected whether the data acquisition request carries a preset desensitizing identification; when it is determined that the data acquisition request carries a desensitizing identification, the data representing the target acquisition request is plain text data, the data acquisition request is restored to obtain a restored data acquisition request, and the restored data acquisition request is forwarded to a data storage server, so that the data storage server searches for the target data in response to the restored data acquisition request; the target data is received from the data storage server, and the target data is forwarded to the target device, at which time the target data is plain text data that has not been desensitized. In other words, in the embodiments of this specification, the data acquisition request is associated with whether the target data is desensitized, and the user determines whether the acquired data is plain text data or desensitized data by sending a data acquisition request through the target device, which has a high degree of freedom and meets the user's usage needs.

[0199] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing related hardware through a computer program, and the program can be stored in a computer-readable storage medium, and when the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The storage medium can be a disk, an optical disk, a read-only storage memory, or a random access memory, etc.

[0200] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0201] The above disclosure is only the preferred embodiment of this specification, which certainly cannot be used to limit the scope of rights of this specification. Therefore, equivalent changes made according to the claims of this specification are still within the scope covered by this specification.

Claims

1. A method for dynamic data desensitization, wherein the execution subject of the method is a desensitization proxy server, and the method comprises: Receiving a data acquisition request from a target device, and detecting whether the data acquisition request carries a preset desensitization processing identifier; When it is determined that the data acquisition request carries the desensitization processing identifier, performing restoration processing on the data acquisition request to obtain a restored data acquisition request; Sending the restored data acquisition request to the data storage server, so that the data storage server searches for the target data in response to the restored data acquisition request; Receive target data from the data storage server, and forward the target data to the target device.

2. According to the data dynamic desensitization method of claim 1, after receiving the data acquisition request from the target device and detecting whether the data acquisition request carries a preset desensitization processing identifier, the method further comprises: When it is determined that the data acquisition request does not carry the desensitization processing identifier, forwarding the data acquisition request to the data storage server, so that the data storage server searches for the target data in response to the data acquisition request; Receive target data from the data storage server, perform desensitization processing on the target data to obtain desensitized data, and send the desensitized data to the target device.

3. According to the data dynamic desensitization method of claim 1, when it is determined that the data acquisition request carries the desensitization processing identifier, the data acquisition request is restored to obtain a restored data acquisition request, comprising: When it is determined that the data acquisition request carries the desensitizing processing identifier, the desensitizing processing identifier included in the data acquisition request is deleted to obtain a restored data acquisition request corresponding to the data acquisition request.

4. The data dynamic desensitization method according to claim 2, wherein when it is determined that the data acquisition request carries the desensitization processing identifier, after restoring the data acquisition request to obtain a restored data acquisition request, the method further comprises: Determine a desensitization strategy according to the data acquisition request; The receiving target data from the data storage server, performing desensitization processing on the target data to obtain desensitized data, and sending the desensitized data to the target device includes: Receive target data from the data storage server, perform desensitization processing on the target data according to the desensitization strategy to obtain desensitized data, and send the desensitized data to the target device.

5. According to the data dynamic desensitization method of claim 1, before receiving the data acquisition request from the target device and detecting whether the data acquisition request carries a preset desensitization processing identifier, it also includes: Receiving a desensitization identification application request from the target device; In response to the desensitizing identification application request, verifying the device information of the target device; When the device information of the target device passes the verification, a desensitizing identification corresponding to the target device is created and stored, and the desensitizing identification is sent to the target device.

6. A method for dynamic data desensitization, wherein the execution subject of the method is a target device, and the method comprises: Receiving a first instruction instructing to obtain target data, and creating a data acquisition request for the target data and carrying a desensitization processing identifier; Sending a data acquisition request for the target data and carrying a desensitization processing identifier to a desensitization proxy server, so that the data proxy server executes the data dynamic desensitization method as described in any one of claims 1 to 5; Receive target data from the desensitizing proxy server.

7. The data dynamic desensitization method according to claim 1, further comprising: receiving a second instruction instructing to obtain desensitized data corresponding to target data, and creating a data acquisition request for the target data; Sending a data acquisition request for the target data to the desensitizing proxy server; Receive desensitized data from the desensitizing proxy server.

8. A data dynamic desensitization device, which is arranged on a desensitization proxy server, and comprises: A first desensitizing proxy module, configured to receive a data acquisition request from a target device and detect whether the data acquisition request carries a preset desensitizing processing identifier; A second desensitizing proxy module is used to restore the data acquisition request to obtain a restored data acquisition request when it is determined that the data acquisition request carries the desensitizing processing identifier; A third desensitizing proxy module is used to send the restored data acquisition request to the data storage server, so that the data storage server searches for the target data in response to the restored data acquisition request; The fourth desensitizing proxy module is used to receive the target data from the data storage server and forward the target data to the target device.

9. A data dynamic desensitization device, the data dynamic desensitization device is arranged on a target device, and the data dynamic desensitization device comprises: A first data acquisition module, configured to instruct receiving a first instruction to acquire target data, and to create a data acquisition request for the target data and carrying a desensitization processing identifier; A second data acquisition module, used for sending a data acquisition request for the target data and carrying a desensitization processing identifier to a desensitization proxy server, so that the data proxy server executes the data dynamic desensitization method as described in any one of claims 1 to 5; The third data acquisition module is used to receive target data from the desensitizing proxy server.

10. A computer storage medium storing a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the method steps according to any one of claims 1 to 7.

11. A computer program product, wherein the computer storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the method steps according to any one of claims 1 to 7.

12. An electronic device, characterized in that: include: A processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the method steps as claimed in any one of claims 1 to 7.

Images