Sensitive data processing method and device, computer equipment and storage medium

Abstract

The invention belongs to the field of data processing and financial science and technology, and relates to a sensitive data processing method and device, computer equipment and a storage medium, and the method comprises the steps: screening sensitive data corresponding to a sensitive data type from a source data table; determining a target migration strategy based on the data volume of the sensitive data; migrating the sensitive data into the desensitization table based on the target migration strategy; after migration of the sensitive data is completed, performing data verification on the desensitization table based on the source data table; if the desensitization table passes the data verification, for each piece of data in the desensitization table, obtaining a specified sensitive data type corresponding to the data; and acquiring a specified encryption rule corresponding to the specified sensitive data type, and encrypting the data based on the specified encryption rule. In addition, the invention also relates to a block chain technology, and the desensitization table can be stored in a block chain. According to the method, centralized desensitization processing on the sensitive data is realized based on the use of the desensitization table, and the maintenance cost of the sensitive data is effectively reduced.

Description

Technical Field

[0001] The present application relates to the fields of data processing technology and financial technology, and in particular to methods, devices, computer equipment and storage media for processing sensitive data. Background Art

[0002] With the rapid development of the financial technology industry, customer data security and privacy protection has become one of the indispensable core competitiveness of financial institutions. In the wave of digital transformation, financial institutions have accumulated a large amount of data containing personal sensitive data, such as identity information, financial information, transaction records, etc. These data are not only the basis of business operations, but also potential security risks.

[0003] In order to meet this challenge, financial institutions currently generally adopt a strategy based on data table desensitization columns to protect sensitive data. Specifically, this method creates one or more additional columns in each table in the database containing sensitive data to store the desensitized data version. The original intention of this method is to reduce the risk of data leakage to a certain extent by replacing the original sensitive data with information that cannot directly identify personal identity (such as encryption, masking, etc.). However, with the expansion of business scale and the surge in data volume, the number of data tables that financial institutions need to maintain has increased dramatically. If each data table needs to be processed separately and desensitized columns are added, the data management architecture will become extremely complicated, increasing the workload and error probability of data administrators. At the same time, this decentralized management method is not conducive to the unified monitoring and auditing of data, resulting in high maintenance costs for sensitive data. Summary of the invention

[0004] The purpose of the embodiments of the present application is to propose a method, apparatus, computer device and storage medium for processing sensitive data, so as to solve the technical problem that the existing method of protecting sensitive data based on the strategy of desensitizing columns in data tables has high maintenance costs for sensitive data.

[0005] In order to solve the above technical problems, the present application embodiment provides a method for processing sensitive data, which adopts the following technical solution:

[0006] Filter out sensitive data corresponding to preset sensitive data types from the source data table;

[0007] Obtaining the amount of the sensitive data;

[0008] Determining a corresponding target migration strategy based on the data volume;

[0009] Migrating the sensitive data to a preset desensitization table based on the target migration strategy;

[0010] After completing the migration of the sensitive data, performing data verification on the desensitized table based on the source data table;

[0011] If the desensitization table passes the data verification, for each data in the desensitization table, obtaining the specified sensitive data type corresponding to the data;

[0012] Obtain a specified encryption rule corresponding to the specified sensitive data type, and encrypt the data based on the specified encryption rule.

[0013] Furthermore, the step of determining a corresponding target migration strategy based on the data volume specifically includes:

[0014] Get the preset quantity threshold;

[0015] Determining whether the data volume is less than the quantity threshold;

[0016] If the data volume is less than the quantity threshold, obtaining a preset script migration strategy, and using the script migration strategy as the target migration strategy;

[0017] If the data volume is greater than the quantity threshold, a preset tool migration strategy is obtained, and the tool migration strategy is used as the target migration strategy.

[0018] Furthermore, the step of performing data verification on the desensitized table based on the source data table specifically includes:

[0019] Obtaining a specified amount of data from the desensitization table;

[0020] Determining whether the data amount is the same as the specified data amount;

[0021] If the data volume is the same as the specified data volume, a sampling test is performed on the desensitized table based on the source data table;

[0022] If the desensitized form passes the sampling test, then the desensitized form is subjected to integrity test;

[0023] If the desensitized table passes the integrity test, it is determined that the desensitized table passes the data verification; otherwise, it is determined that the desensitized table fails the data verification.

[0024] Furthermore, the step of obtaining a specified encryption rule corresponding to the specified sensitive data type and encrypting the data based on the specified encryption rule specifically includes:

[0025] Call the preset encryption rule library;

[0026] Querying a target encryption rule corresponding to the specified sensitive data type from the encryption rule library, and using the target encryption rule as the specified encryption rule;

[0027] Call the preset desensitization tool;

[0028] Based on the desensitizing tool, the data is encrypted according to the specified encryption rules.

[0029] Furthermore, after the step of obtaining a specified encryption rule corresponding to the specified sensitive data type and encrypting the data based on the specified encryption rule, the method further includes:

[0030] Get the preset backup strategy;

[0031] Call the preset backup tool;

[0032] Based on the backup strategy, use the backup tool to perform data backup processing on the desensitized table to obtain a corresponding target desensitized table;

[0033] Performing backup verification on the target desensitization table;

[0034] If the target desensitized table passes the backup verification, the target desensitized table is stored.

[0035] Furthermore, after the step of obtaining a specified encryption rule corresponding to the specified sensitive data type and encrypting the data based on the specified encryption rule, the method further includes:

[0036] Call the preset monitoring tool;

[0037] Performing monitoring processing on the desensitized table based on the monitoring tool to obtain corresponding monitoring data;

[0038] Performing data analysis on the monitoring data to determine whether there is abnormal data in the monitoring data;

[0039] If yes, obtain the preset abnormal alarm strategy;

[0040] An alarm process corresponding to the abnormal data is performed based on the abnormal alarm strategy.

[0041] Furthermore, after the step of obtaining a specified encryption rule corresponding to the specified sensitive data type and encrypting the data based on the specified encryption rule, the method further includes:

[0042] Setting an association key in the desensitization table;

[0043] Call the preset business table;

[0044] An association process is performed with the business table based on the association key.

[0045] In order to solve the above technical problems, the embodiment of the present application further provides a sensitive data processing device, which adopts the following technical solution:

[0046] A screening module is used to screen out sensitive data corresponding to a preset sensitive data type from a source data table;

[0047] A first acquisition module, used to acquire the data volume of the sensitive data;

[0048] A determination module, configured to determine a corresponding target migration strategy based on the data volume;

[0049] A migration module, used to migrate the sensitive data to a preset desensitization table based on the target migration strategy;

[0050] A verification module, used to perform data verification on the desensitized table based on the source data table after completing the migration of the sensitive data;

[0051] A second acquisition module is used to acquire, for each data in the desensitization table, a specified sensitive data type corresponding to the data if the desensitization table passes the data verification;

[0052] The encryption module is used to obtain a specified encryption rule corresponding to the specified sensitive data type and encrypt the data based on the specified encryption rule.

[0053] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution:

[0054] Filter out sensitive data corresponding to preset sensitive data types from the source data table;

[0055] Obtaining the amount of the sensitive data;

[0056] Determining a corresponding target migration strategy based on the data volume;

[0057] Migrating the sensitive data to a preset desensitization table based on the target migration strategy;

[0058] After completing the migration of the sensitive data, performing data verification on the desensitized table based on the source data table;

[0059] If the desensitization table passes the data verification, for each data in the desensitization table, obtaining the specified sensitive data type corresponding to the data;

[0060] Obtain a specified encryption rule corresponding to the specified sensitive data type, and encrypt the data based on the specified encryption rule.

[0061] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:

[0062] Filter out sensitive data corresponding to preset sensitive data types from the source data table;

[0063] Obtaining the amount of the sensitive data;

[0064] Determining a corresponding target migration strategy based on the data volume;

[0065] Migrating the sensitive data to a preset desensitization table based on the target migration strategy;

[0066] After completing the migration of the sensitive data, performing data verification on the desensitized table based on the source data table;

[0067] If the desensitization table passes the data verification, for each data in the desensitization table, obtaining the specified sensitive data type corresponding to the data;

[0068] Obtain a specified encryption rule corresponding to the specified sensitive data type, and encrypt the data based on the specified encryption rule.

[0069] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0070] This application first filters out sensitive data corresponding to a preset sensitive data type from a source data table; then obtains the data volume of the sensitive data; and determines the corresponding target migration strategy based on the data volume; then migrates the sensitive data to a preset desensitization table based on the target migration strategy; after completing the migration of the sensitive data, the desensitization table is data verified based on the source data table; if the desensitization table passes the data verification, then for each data in the desensitization table, obtain the specified sensitive data type corresponding to the data; finally, obtain the specified encryption rule corresponding to the specified sensitive data type, and encrypt the data based on the specified encryption rule. In this way, this application realizes centralized desensitization processing of sensitive data based on the use of desensitization tables, effectively reduces the complexity of desensitized data management, makes the maintenance of desensitized data more efficient, and reduces the maintenance cost of sensitive data. In addition, the centralized desensitization processing of sensitive data based on desensitization tables can reduce the risk of data inconsistency and ensure the accuracy and consistency of data. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0072] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0073] Figure 2 A flowchart of an embodiment of a method for processing sensitive data according to the present application;

[0074] Figure 3 is a schematic structural diagram of an embodiment of a sensitive data processing device according to the present application;

[0075] Figure 4 It is a structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0076] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0077] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0078] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0079] like Figure 1As shown, the system architecture 100 may include a terminal device 101, a network 102 and a server 103. The terminal device 101 may be a laptop 1011, a tablet computer 1012 or a mobile phone 1013. The network 102 is used to provide a medium for a communication link between the terminal device 101 and the server 103. The network 102 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0080] The user can use the terminal device 101 to interact with the server 103 through the network 102 to receive or send messages, etc. Various communication client applications can be installed on the terminal device 101, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0081] The terminal device 101 can be various electronic devices with a display screen and supporting web browsing. In addition to the laptop computer 1011, the tablet computer 1012 or the mobile phone 1013, the terminal device 101 can also be an e-book reader, an MP3 player (Moving Picture Experts Group Audio Layer III), an MP4 (Moving Picture Experts Group Audio Layer IV) player, a laptop computer, a desktop computer, etc.

[0082] The server 103 may be a server that provides various services, such as a background server that provides support for a web page displayed on the terminal device 101 .

[0083] It should be noted that the sensitive data processing method provided in the embodiments of the present application is generally executed by a server / terminal device, and accordingly, the sensitive data processing device is generally set in the server / terminal device.

[0084] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0085] Continue to refer Figure 2, showing a flowchart of an embodiment of a method for processing sensitive data according to the present application. According to different requirements, the order of the steps in the flowchart can be changed, and some steps can be omitted. The method for processing sensitive data provided in the embodiment of the present application can be applied to any scenario where sensitive data processing is required, and the method for processing sensitive data can be applied to products in these scenarios, for example, sensitive data encryption in the financial insurance field. The method for processing sensitive data comprises the following steps:

[0086] Step S201: Filter out sensitive data corresponding to preset sensitive data types from a source data table.

[0087] In this embodiment, the sensitive data processing method is executed on the electronic device (eg Figure 1 The server / terminal device shown in the figure) can obtain sensitive data through a wired connection or a wireless connection. It should be noted that the above-mentioned wireless connection method may include but is not limited to 3G / 4G / 5G connection, Wi-Fi connection, Bluetooth connection, Wi MAX connection, Zigbee connection, UWB (Ultra Wi DeBand) connection, and other wireless connection methods currently known or to be developed in the future. The execution subject of this application is specifically a sensitive data processing system. In the field of financial technology, for the security and privacy protection scenarios of customer data, the above-mentioned sensitive data types are the data types that need to be desensitized, such as ID number, name, address, telephone number, email address, bank account number, etc., which are pre-identified and classified according to actual desensitization needs. The above-mentioned source data table is a pre-constructed storage of some data that needs to be desensitized, and an existing data table storing business data, and the number of the source data table may include multiple. Exemplarily, in the business scenario of financial insurance, the above-mentioned business data may include transaction data, payment data, and the like.

[0088] Step S202, obtaining the data volume of the sensitive data.

[0089] In this embodiment, the amount of sensitive data can be obtained by performing quantitative statistics on the above sensitive data.

[0090] Step S203: determining a corresponding target migration strategy based on the data volume.

[0091] In this embodiment, the specific implementation process of determining the corresponding target migration strategy based on the data volume will be further described in detail in subsequent specific embodiments of the present application, and will not be elaborated on here.

[0092] Step S204: Migrate the sensitive data to a preset desensitization table based on the target migration strategy.

[0093] In this embodiment, the above-mentioned desensitization table is a new database table created in advance, and the desensitization table is specifically used to store desensitized sensitive data. Among them, the desensitization table contains fields such as: unique key (such as customer ID), sensitive data type field (such as name, ID number, etc.), encrypted sensitive data field, timestamp, etc. By using the desensitization table, sensitive data can be centrally managed and the data management process can be simplified. In addition, by executing the above-mentioned target migration strategy, the sensitive data can be migrated to the desensitization table.

[0094] Step S205: After completing the migration of the sensitive data, data verification is performed on the desensitized table based on the source data table.

[0095] In this embodiment, the specific implementation process of performing data verification on the desensitized table based on the source data table will be described in further detail in subsequent specific embodiments of the present application and will not be elaborated on here.

[0096] Step S206: If the desensitized table passes the data verification, for each data in the desensitized table, obtain the specified sensitive data type corresponding to the data.

[0097] In this embodiment, for each data in the desensitization table, by performing sensitive data type analysis on each data, the designated sensitive data type corresponding to the data can be obtained.

[0098] Step S207: obtaining a specified encryption rule corresponding to the specified sensitive data type, and encrypting the data based on the specified encryption rule.

[0099] In this embodiment, the specific implementation process of obtaining the specified encryption rules corresponding to the specified sensitive data type and encrypting the data based on the specified encryption rules will be further described in detail in the subsequent specific embodiments of this application, and will not be elaborated on here. Among them, by optimizing the data storage structure to achieve encryption processing of sensitive data, the security and privacy protection level of sensitive data are improved, which helps to build customer trust and corporate image.

[0100] This application first filters out sensitive data corresponding to a preset sensitive data type from a source data table; then obtains the data volume of the sensitive data; and determines the corresponding target migration strategy based on the data volume; then migrates the sensitive data to a preset desensitization table based on the target migration strategy; after completing the migration of the sensitive data, the desensitization table is data verified based on the source data table; if the desensitization table passes the data verification, then for each data in the desensitization table, obtain the specified sensitive data type corresponding to the data; finally, obtain the specified encryption rule corresponding to the specified sensitive data type, and encrypt the data based on the specified encryption rule. In this way, this application realizes centralized desensitization processing of sensitive data based on the use of desensitization tables, effectively reduces the complexity of desensitized data management, makes the maintenance of desensitized data more efficient, and reduces the maintenance cost of sensitive data. In addition, the centralized desensitization processing of sensitive data based on desensitization tables can reduce the risk of data inconsistency and ensure the accuracy and consistency of data.

[0101] In some optional implementations, step S203 includes the following steps:

[0102] Get the preset quantity threshold.

[0103] In this embodiment, there is no specific limitation on the value of the quantity threshold, which can be set according to actual business processing requirements.

[0104] Determine whether the data volume is less than the volume threshold.

[0105] In this embodiment, the data volume can be numerically compared with the quantity threshold to obtain a corresponding numerical comparison result, wherein the numerical comparison result includes that the data volume is less than the quantity threshold or that the data volume is greater than the quantity threshold.

[0106] If the data volume is less than the quantity threshold, a preset script migration strategy is obtained, and the script migration strategy is used as the target migration strategy.

[0107] In this embodiment, the script migration strategy is a strategy for data migration based on a pre-built SQL script. If the amount of data is not large or the migration logic is relatively simple, a SQL script is directly written for data migration. The script SQL includes a SELECT statement to extract data and an INSERT statement to insert data into the desensitized table.

[0108] If the data volume is greater than the quantity threshold, a preset tool migration strategy is obtained, and the tool migration strategy is used as the target migration strategy.

[0109] In this embodiment, the above script migration strategy is a strategy for data migration based on the pre-built ETL (Extract, Transform, Load) tool. If the amount of data is large or the migration logic is complex, the ETL tool can be used for data migration. In the ETL tool, the data source (source data table), transformation logic (such as data cleaning, type conversion, etc.) and target (desensitized table) are configured according to actual needs.

[0110] The present application obtains a preset quantity threshold; then determines whether the data volume is less than the quantity threshold; if the data volume is less than the quantity threshold, obtains a preset script migration strategy, and uses the script migration strategy as the target migration strategy; and if the data volume is greater than the quantity threshold, obtains a preset tool migration strategy, and uses the tool migration strategy as the target migration strategy. The present application compares the data volume of sensitive data with the preset quantity threshold, and then selects a matching script migration strategy or script migration strategy as the corresponding target migration strategy based on the obtained numerical comparison result, which effectively improves the intelligence and accuracy of the target migration strategy selection.

[0111] In some optional implementations of this embodiment, step S205 includes the following steps:

[0112] Get the specified amount of data of the desensitized table.

[0113] In this embodiment, after completing the migration of the sensitive data, the data volume of all the data included in the above-mentioned desensitization table can be counted to obtain the above-mentioned specified data volume.

[0114] It is determined whether the data amount is the same as the specified data amount.

[0115] In this embodiment, the data volume can be numerically compared with the specified data volume to determine whether the data volume and the specified data volume are the same. If the data volume and the specified data volume are the same, it indicates that data loss has occurred in the desensitized table after the migration process, and the desensitized table is directly determined to have failed the data verification.

[0116] If the data volume is the same as the specified data volume, a sampling test is performed on the desensitized table based on the source data table.

[0117] In this embodiment, the above-mentioned sampling test refers to randomly extracting a portion of data and comparing whether the data in the source table and the desensitized table are consistent. If the desensitized table fails the sampling test, the desensitized table after the migration process has a data mismatch, and then it will be directly determined that the desensitized table has failed the data verification.

[0118] If the desensitized form passes the sampling test, an integrity test is performed on the desensitized form.

[0119] In this embodiment, the above-mentioned integrity detection refers to a detection process for ensuring that there is no data loss or data damage, especially the integrity of key fields (such as unique keys).

[0120] If the desensitized table passes the integrity test, it is determined that the desensitized table passes the data verification; otherwise, it is determined that the desensitized table fails the data verification.

[0121] In this embodiment, only if the desensitized table passes the data volume detection, sampling verification and integrity detection at the same time, will it be judged that the desensitized table has passed the data verification. If the desensitized table fails the integrity detection, it indicates that the desensitized table after the migration process has data loss or data corruption, and then it will be directly judged that the desensitized table has failed the data verification.

[0122] This application obtains the specified data volume of the desensitized table; then determines whether the data volume is the same as the specified data volume; if the data volume is the same as the specified data volume, then performs sampling detection on the desensitized table based on the source data table; if the desensitized table passes the sampling detection, then performs integrity detection on the desensitized table; if the desensitized table passes the integrity detection, then it is determined that the desensitized table has passed the data verification, otherwise it is determined that the desensitized table has not passed the data verification. After completing the migration of the sensitive data, this application will intelligently perform data volume detection, sampling verification and integrity detection on the desensitized table based on the use of the source data table. Only after ensuring that the desensitized table has passed the data volume detection, sampling verification and integrity detection at the same time, will it be determined that the desensitized table has passed the data verification later, which effectively improves the processing accuracy of the data verification of the desensitized table and ensures the data integrity and data accuracy of the desensitized table.

[0123] In some optional implementations, step S207 includes the following steps:

[0124] Call the preset encryption rule library.

[0125] In this embodiment, the encryption rule base is a pre-built database storing a variety of sensitive data types and encryption rules corresponding to various sensitive data types. Among them, for sensitive data of different sensitive data types, encryption rules corresponding to the sensitive data types can be pre-set according to factors such as the sensitivity, storage requirements, and transmission requirements of the sensitive data. Among them, the encryption rules may at least include partial hiding, encryption, hashing, replacement, etc. Exemplarily, if the sensitive data type is an ID card number, the corresponding encryption rule is: write a partially hidden hidden function for the ID card number, and encrypt the ID card number according to the hidden function. If the sensitive data type is a bank card number, the corresponding encryption rule is: write an encryption function for the bank card number, and encrypt the bank card number according to the encryption function.

[0126] In addition, the centralized desensitizing table can make changes to encryption rules easier to manage. Rules only need to be updated in one place (desensitizing table) without modifying multiple data tables, avoiding repeated operations on multiple data tables, saving system resources, and greatly reducing resource consumption and operational complexity.

[0127] A target encryption rule corresponding to the designated sensitive data type is searched from the encryption rule library, and the target encryption rule is used as the designated encryption rule.

[0128] In this embodiment, the target sensitive data type that matches the specified sensitive data type can be queried from the encryption rule library, and then the encryption rule corresponding to the target sensitive data type can be found from the encryption rule library, thereby obtaining the target encryption rule. By storing the encryption rules in the encryption rule library, the security and accessibility of these encryption rules can be effectively ensured.

[0129] Call the preset desensitization tool.

[0130] In this embodiment, the desensitizing tool is a pre-built tool for encrypting sensitive data according to defined encryption rules.

[0131] Based on the desensitizing tool, the data is encrypted according to the specified encryption rules.

[0132] In this embodiment, the above-mentioned specified encryption rules and the above-mentioned data are input into a desensitizing tool, so that the data is encrypted according to the specified encryption rules through the desensitizing tool.

[0133] This application calls a preset encryption rule library; then queries the target encryption rule corresponding to the specified sensitive data type from the encryption rule library, and uses the target encryption rule as the specified encryption rule; then calls a preset desensitizing tool; and subsequently encrypts the data according to the specified encryption rule based on the desensitizing tool. This application can quickly and accurately query the specified encryption rule corresponding to the specified sensitive data type based on the use of the encryption rule library, thereby improving the efficiency and accuracy of obtaining the specified encryption rule. Furthermore, by using the desensitizing tool, the data is encrypted according to the specified encryption rule that matches the specified sensitive data type of the data, effectively improving the standardization and intelligence of the encryption processing of the data.

[0134] In some optional implementations, after step S207, the electronic device may further perform the following steps:

[0135] Get the preset backup policy.

[0136] In this embodiment, according to the importance of the data, the recovery time target and the recovery point target, a backup strategy matching the above-mentioned desensitized table is formulated, which may include backup frequency, backup method (full backup, incremental backup, differential backup), backup storage location, etc. Among them, the settings of the above-mentioned backup frequency, backup method and backup storage location can be determined according to the actual backup needs. Exemplarily, the backup frequency can be set to once a day, the backup method can be set to full backup, incremental backup, differential backup, mirror backup, etc., and the backup storage location can include local databases, cloud network disks, blockchains and other storage locations.

[0137] Invoke the preset backup tool.

[0138] In this embodiment, the backup tool may use a backup tool provided by the database, or may use third-party backup software.

[0139] Based on the backup strategy, the backup tool is used to perform data backup processing on the desensitized table to obtain a corresponding target desensitized table.

[0140] In this embodiment, according to the backup strategy, the backup tool can be used to regularly perform backup processing on the desensitized table to obtain the target desensitized table after the backup is completed.

[0141] The target desensitization table is backed up and verified.

[0142] In this embodiment, backup verification is performed on the target desensitized table to ensure that the backup data can be successfully restored.

[0143] If the target desensitized table passes the backup verification, the target desensitized table is stored.

[0144] In this embodiment, there is no specific limitation on the storage processing of the above-mentioned target desensitized table. It is only necessary to ensure the safe storage of the backup data, including physical security (such as fire prevention, waterproofing, and anti-theft) and logical security (such as encrypted storage and access control).

[0145] In addition, a detailed data recovery plan corresponding to the desensitized table can be further formulated, including recovery steps, required resources, estimated recovery time, etc. Data recovery drills should be conducted regularly to verify the feasibility and effectiveness of the recovery plan. By formulating a data recovery plan for the desensitized table, it can effectively ensure that data can be quickly recovered in the event of an unexpected situation.

[0146] The present application obtains a preset backup strategy; then calls a preset backup tool; then based on the backup strategy, uses the backup tool to perform data backup processing on the desensitized table to obtain a corresponding target desensitized table; subsequently performs backup verification on the target desensitized table; if the target desensitized table passes the backup verification, the target desensitized table is stored. The present application obtains a target desensitized table by performing data backup processing on the desensitized table based on the backup strategy and the use of the backup tool, and automatically stores the target desensitized table when it is detected that the target desensitized table passes the backup verification, which can effectively prevent data loss or data corruption in the target desensitized table and ensure the storage intelligence and data security of the target desensitized table.

[0147] In some optional implementations of this embodiment, after step S207, the electronic device may further perform the following steps:

[0148] Call the preset monitoring tool.

[0149] In this embodiment, a suitable tool with monitoring function can be selected as the above monitoring tool according to the system environment and monitoring requirements. The monitoring tool can support real-time monitoring of the desensitized table and can be seamlessly integrated with the system.

[0150] The desensitized table is monitored and processed based on the monitoring tool to obtain corresponding monitoring data.

[0151] In this embodiment, monitoring items corresponding to the desensitized table are pre-set. When the monitoring tool is used to monitor the desensitized table later, monitoring data corresponding to the monitoring items will be collected synchronously. Among them, the above monitoring items can be set according to actual monitoring needs, for example, they may include access frequency, query response time, abnormal operation behavior, etc.

[0152] Perform data analysis on the monitoring data to determine whether there is abnormal data in the monitoring data.

[0153] In this embodiment, a monitoring threshold for performing data analysis on monitoring data is preset. For example, if the access frequency exceeds a certain threshold, the query response time exceeds a preset time, etc., it is regarded as abnormal data.

[0154] If yes, obtain the preset abnormal alarm strategy.

[0155] In this embodiment, the policy content of the above abnormal alarm strategy includes: when the monitoring tool detects abnormal data, the alarm process is automatically triggered. By generating alarm information and selecting appropriate alarm methods, such as email, SMS, phone notification, etc., and configuring alarm recipients, it is ensured that relevant personnel can be notified in time when abnormal data occurs. Among them, the alarm information contains detailed information of the abnormal data, such as the time of occurrence, operation type, operation object, etc., so that relevant personnel can quickly locate the problem and take measures.

[0156] An alarm process corresponding to the abnormal data is performed based on the abnormal alarm strategy.

[0157] In this embodiment, the alarm processing for the above abnormal data can be automatically triggered according to the policy content of the above abnormal alarm policy.

[0158] This application calls a preset monitoring tool; then monitors and processes the desensitized table based on the monitoring tool to obtain corresponding monitoring data; then performs data analysis on the monitoring data to determine whether there is abnormal data in the monitoring data; if so, obtains a preset abnormal alarm strategy; and subsequently performs alarm processing corresponding to the abnormal data based on the abnormal alarm strategy. After completing the data encryption processing for the desensitized table, this application will intelligently monitor and process the desensitized table based on the use of the monitoring tool, and will perform data analysis on the obtained monitoring data. If abnormal data is detected in the monitoring data, it will intelligently perform alarm processing corresponding to the abnormal data based on the preset abnormal alarm strategy, so that when an abnormality occurs in the system, the relevant personnel can be notified in time, and the relevant personnel can quickly locate the problem and take measures, which is conducive to ensuring the safe and stable operation of the system and improving the work experience of the relevant personnel.

[0159] In some optional implementations of this embodiment, after step S207, the electronic device may further perform the following steps:

[0160] An association key is set in the desensitization table.

[0161] In this embodiment, the association key in the desensitized table is determined according to actual business needs, and specifically, the field used as the primary key or foreign key in other business tables can be used, for example, user ID, order number (policy number, claim number), etc.

[0162] Call the preset business table.

[0163] In this embodiment, the business table may be a financial business table that uses the association key as a primary key or a foreign key, such as a policy business table, a claim business table, etc. After the association key in the desensitized table is set, the accuracy of the association key may be further verified. Specifically, by writing a query statement, the association key in the desensitized table is compared with the corresponding field in the business table to ensure that they are consistent.

[0164] An association process is performed with the business table based on the association key.

[0165] In this embodiment, by using the association key to associate with the business table, it is helpful to ensure that the data in the desensitized table can maintain business relevance with other business tables during and after the desensitization process. In addition, in order to improve query performance, an index can be further created for the association key field in the desensitized table. The index can speed up the query speed based on the association key, especially when processing a large amount of data.

[0166] The present application sets an association key in the desensitizing table, and then calls a preset business table; and then performs association processing with the business table based on the association key. The present application sets an association key in the desensitizing table, and then performs association processing with the preset business table based on the association key, so as to achieve efficient retrieval and association of data in the desensitizing table, and effectively ensures that the data in the desensitizing table can maintain business relevance with other business tables during and after the desensitization process.

[0167] In some optional implementations, the user information obtained is subject to the user's consent and complies with relevant laws and policies.

[0168] In addition, the non-Company software tools or components that appear in the embodiments of the present application are merely examples and do not represent actual use.

[0169] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0170] It should be emphasized that in order to further ensure the privacy and security of the above-mentioned desensitized table, the above-mentioned desensitized table can also be stored in a node of a blockchain.

[0171] The blockchain referred to in this application is a new application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanism, encryption algorithm, etc. Blockchain is essentially a decentralized database, a string of data blocks generated by cryptographic methods. Each data block contains a batch of network transaction information, which is used to verify the validity of its information (anti-counterfeiting) and generate the next block. Blockchain can include the underlying blockchain platform, platform product service layer, and application service layer.

[0172] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Artificial Intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0173] AI basic technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing technology, operation / interaction systems, mechatronics, etc. AI software technologies mainly include computer vision technology, robotics technology, biometrics technology, speech processing technology, natural language processing technology, and machine learning / deep learning.

[0174] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through computer-readable instructions, and the computer-readable instructions can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0175] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0176] Further references Figure 3 , as a response to the above Figure 2 The present application provides an embodiment of a sensitive data processing device, and the device embodiment is similar to Figure 2 Corresponding to the method embodiment shown, the device can be specifically applied to various electronic devices.

[0177] like Figure 3 As shown, the sensitive data processing device 300 described in this embodiment includes: a screening module 301, a first acquisition module 302, a determination module 303, a migration module 304, a verification module 305, a second acquisition module 306 and an encryption module 307. Among them:

[0178] A screening module 301 is used to screen out sensitive data corresponding to a preset sensitive data type from a source data table;

[0179] A first acquisition module 302 is used to acquire the amount of the sensitive data;

[0180] A determination module 303, configured to determine a corresponding target migration strategy based on the data volume;

[0181] A migration module 304, configured to migrate the sensitive data to a preset desensitization table based on the target migration strategy;

[0182] A verification module 305 is used to perform data verification on the desensitized table based on the source data table after completing the migration of the sensitive data;

[0183] A second acquisition module 306 is configured to acquire, for each data in the desensitization table, a specified sensitive data type corresponding to the data if the desensitization table passes the data verification;

[0184] The encryption module 307 is used to obtain a specified encryption rule corresponding to the specified sensitive data type, and encrypt the data based on the specified encryption rule.

[0185] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the sensitive data processing method in the aforementioned implementation mode, and are not described in detail here.

[0186] In some optional implementations of this embodiment, the determining module 303 includes:

[0187] A first acquisition submodule is used to acquire a preset quantity threshold;

[0188] A first judgment submodule, used to judge whether the data volume is less than the quantity threshold;

[0189] A first determination submodule is used to obtain a preset script migration strategy if the data volume is less than the quantity threshold, and use the script migration strategy as the target migration strategy;

[0190] The second determination submodule is used to obtain a preset tool migration strategy if the data volume is greater than the quantity threshold, and use the tool migration strategy as the target migration strategy.

[0191] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the sensitive data processing method in the aforementioned implementation mode, and are not described in detail here.

[0192] In some optional implementations of this embodiment, the verification module 305 includes:

[0193] A second acquisition submodule is used to obtain a specified amount of data of the desensitization table;

[0194] A second judgment submodule is used to judge whether the data amount is the same as the specified data amount;

[0195] A first detection submodule, configured to perform a sampling detection on the desensitized table based on the source data table if the data amount is the same as the specified data amount;

[0196] A second detection submodule is used to perform integrity detection on the desensitized table if the desensitized table passes the sampling detection;

[0197] The determination submodule is used to determine that the desensitized table has passed the data verification if the desensitized table has passed the integrity test, otherwise, determine that the desensitized table has not passed the data verification.

[0198] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the sensitive data processing method in the aforementioned implementation mode, and are not described in detail here.

[0199] In some optional implementations of this embodiment, the encryption module 307 includes:

[0200] The first calling submodule is used to call a preset encryption rule library;

[0201] A query submodule, used to query the target encryption rule corresponding to the specified sensitive data type from the encryption rule library, and use the target encryption rule as the specified encryption rule;

[0202] The second calling submodule is used to call the preset desensitization tool;

[0203] The encryption submodule is used to encrypt the data based on the desensitizing tool and in accordance with the specified encryption rules.

[0204] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the sensitive data processing method in the aforementioned implementation mode, and are not described in detail here.

[0205] In some optional implementations of this embodiment, the sensitive data processing device further includes:

[0206] The third acquisition module is used to obtain a preset backup strategy;

[0207] A first calling module is used to call a preset backup tool;

[0208] A backup module, used to perform data backup processing on the desensitized table using the backup tool based on the backup strategy to obtain a corresponding target desensitized table;

[0209] A backup verification module, used to perform backup verification on the target desensitization table;

[0210] A storage module is used to store the target desensitization table if the target desensitization table passes the backup verification.

[0211] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the sensitive data processing method in the aforementioned implementation mode, and are not described in detail here.

[0212] In some optional implementations of this embodiment, the sensitive data processing device further includes:

[0213] The second calling module is used to call a preset monitoring tool;

[0214] A monitoring module, used to monitor and process the desensitized table based on the monitoring tool to obtain corresponding monitoring data;

[0215] An analysis module is used to analyze the monitoring data and determine whether there is abnormal data in the monitoring data;

[0216] A fourth acquisition module is used to obtain a preset abnormal alarm strategy if yes;

[0217] An alarm module is used to execute alarm processing corresponding to the abnormal data based on the abnormal alarm strategy.

[0218] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the sensitive data processing method in the aforementioned implementation mode, and are not described in detail here.

[0219] In some optional implementations of this embodiment, the sensitive data processing device further includes:

[0220] A setting module, used for setting an association key in the desensitization table;

[0221] The third calling module is used to call the preset business table;

[0222] An association module is used to perform association processing with the business table based on the association key.

[0223] In this embodiment, the operations performed by the above modules or units correspond one-to-one to the steps of the sensitive data processing method in the aforementioned implementation mode, and are not described in detail here.

[0224] To solve the above technical problems, the present application also provides a computer device. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0225] The computer device 4 includes a memory 41, a processor 42, and a network interface 43 that are interconnected through a system bus. It should be noted that the figure only shows a computer device 4 with components 41-43, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), digital processors (DSPs), embedded devices, etc.

[0226] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may interact with a user through a keyboard, a mouse, a remote controller, a touch pad, or a voice control device.

[0227] The memory 41 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 41 can be an internal storage unit of the computer device 4, such as a hard disk or memory of the computer device 4. In other embodiments, the memory 41 can also be an external storage device of the computer device 4, such as a plug-in hard disk equipped on the computer device 4, a smart memory card (Smart Med ia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. Of course, the memory 41 can also include both the internal storage unit of the computer device 4 and its external storage device. In this embodiment, the memory 41 is generally used to store the operating system and various application software installed on the computer device 4, such as computer-readable instructions of a method for processing sensitive data. In addition, the memory 41 can also be used to temporarily store various types of data that have been output or are to be output.

[0228] The processor 42 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor 42 is generally used to control the overall operation of the computer device 4. In this embodiment, the processor 42 is used to run the computer-readable instructions stored in the memory 41 or process data, such as computer-readable instructions for running the sensitive data processing method.

[0229] The network interface 43 may include a wireless network interface or a wired network interface. The network interface 43 is generally used to establish a communication connection between the computer device 4 and other electronic devices.

[0230] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0231] In an embodiment of the present application, firstly, sensitive data corresponding to a preset sensitive data type is screened out from a source data table; then the data volume of the sensitive data is obtained; and the corresponding target migration strategy is determined based on the data volume; then, the sensitive data is migrated to a preset desensitization table based on the target migration strategy; after completing the migration of the sensitive data, the desensitization table is data verified based on the source data table; if the desensitization table passes the data verification, then for each data in the desensitization table, the specified sensitive data type corresponding to the data is obtained; finally, the specified encryption rule corresponding to the specified sensitive data type is obtained, and the data is encrypted based on the specified encryption rule. In this way, the present application realizes centralized desensitization processing of sensitive data based on the use of desensitization tables, effectively reduces the complexity of desensitized data management, makes the maintenance of desensitized data more efficient, and reduces the maintenance cost of sensitive data. In addition, the centralized desensitization processing of sensitive data based on the desensitization table can reduce the risk of data inconsistency and ensure the accuracy and consistency of the data.

[0232] The present application also provides another embodiment, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the sensitive data processing method as described above.

[0233] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0234] In an embodiment of the present application, firstly, sensitive data corresponding to a preset sensitive data type is screened out from a source data table; then the data volume of the sensitive data is obtained; and the corresponding target migration strategy is determined based on the data volume; then, the sensitive data is migrated to a preset desensitization table based on the target migration strategy; after completing the migration of the sensitive data, the desensitization table is data verified based on the source data table; if the desensitization table passes the data verification, then for each data in the desensitization table, the specified sensitive data type corresponding to the data is obtained; finally, the specified encryption rule corresponding to the specified sensitive data type is obtained, and the data is encrypted based on the specified encryption rule. In this way, the present application realizes centralized desensitization processing of sensitive data based on the use of desensitization tables, effectively reduces the complexity of desensitized data management, makes the maintenance of desensitized data more efficient, and reduces the maintenance cost of sensitive data. In addition, the centralized desensitization processing of sensitive data based on the desensitization table can reduce the risk of data inconsistency and ensure the accuracy and consistency of the data.

[0235] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0236] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to perform equivalent replacement of some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. A method for processing sensitive data, characterized in that: The steps include: Filter out sensitive data corresponding to preset sensitive data types from the source data table; Obtaining the amount of the sensitive data; Determining a corresponding target migration strategy based on the data volume; Migrating the sensitive data to a preset desensitization table based on the target migration strategy; After completing the migration of the sensitive data, performing data verification on the desensitized table based on the source data table; If the desensitization table passes the data verification, for each data in the desensitization table, obtaining the specified sensitive data type corresponding to the data; Obtain a specified encryption rule corresponding to the specified sensitive data type, and encrypt the data based on the specified encryption rule.

2. The method for processing sensitive data according to claim 1, characterized in that: The step of determining the corresponding target migration strategy based on the data volume specifically includes: Get the preset quantity threshold; Determining whether the data volume is less than the quantity threshold; If the data volume is less than the quantity threshold, obtaining a preset script migration strategy, and using the script migration strategy as the target migration strategy; If the data volume is greater than the quantity threshold, a preset tool migration strategy is obtained, and the tool migration strategy is used as the target migration strategy.

3. The method for processing sensitive data according to claim 1, characterized in that: The step of performing data verification on the desensitized table based on the source data table specifically includes: Obtaining a specified amount of data from the desensitization table; Determining whether the data amount is the same as the specified data amount; If the data volume is the same as the specified data volume, a sampling test is performed on the desensitized table based on the source data table; If the desensitized form passes the sampling test, then the desensitized form is subjected to integrity test; If the desensitized table passes the integrity test, it is determined that the desensitized table passes the data verification; otherwise, it is determined that the desensitized table fails the data verification.

4. The method for processing sensitive data according to claim 1, characterized in that: The step of obtaining a specified encryption rule corresponding to the specified sensitive data type and encrypting the data based on the specified encryption rule specifically includes: Call the preset encryption rule library; Querying a target encryption rule corresponding to the specified sensitive data type from the encryption rule library, and using the target encryption rule as the specified encryption rule; Call the preset desensitization tool; Based on the desensitizing tool, the data is encrypted according to the specified encryption rules.

5. The method for processing sensitive data according to claim 1, characterized in that: After the step of obtaining the specified encryption rule corresponding to the specified sensitive data type and encrypting the data based on the specified encryption rule, the method further includes: Get the preset backup strategy; Call the preset backup tool; Based on the backup strategy, use the backup tool to perform data backup processing on the desensitized table to obtain a corresponding target desensitized table; Performing backup verification on the target desensitization table; If the target desensitized table passes the backup verification, the target desensitized table is stored.

6. The method for processing sensitive data according to claim 1, characterized in that: After the step of obtaining the specified encryption rule corresponding to the specified sensitive data type and encrypting the data based on the specified encryption rule, the method further includes: Call the preset monitoring tool; Performing monitoring processing on the desensitized table based on the monitoring tool to obtain corresponding monitoring data; Performing data analysis on the monitoring data to determine whether there is abnormal data in the monitoring data; If yes, obtain the preset abnormal alarm strategy; An alarm process corresponding to the abnormal data is performed based on the abnormal alarm strategy.

7. The method for processing sensitive data according to claim 1, characterized in that: After the step of obtaining the specified encryption rule corresponding to the specified sensitive data type and encrypting the data based on the specified encryption rule, the method further includes: Setting an association key in the desensitization table; Call the preset business table; An association process is performed with the business table based on the association key.

8. A sensitive data processing device, characterized in that: include: A screening module is used to screen out sensitive data corresponding to a preset sensitive data type from a source data table; A first acquisition module, used to acquire the data volume of the sensitive data; A determination module, configured to determine a corresponding target migration strategy based on the data volume; A migration module, used to migrate the sensitive data to a preset desensitization table based on the target migration strategy; A verification module, used to perform data verification on the desensitized table based on the source data table after completing the migration of the sensitive data; A second acquisition module is used to acquire, for each data in the desensitization table, a specified sensitive data type corresponding to the data if the desensitization table passes the data verification; The encryption module is used to obtain a specified encryption rule corresponding to the specified sensitive data type and encrypt the data based on the specified encryption rule.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the steps of the method for processing sensitive data as claimed in any one of claims 1 to 7 when executing the computer-readable instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the method for processing sensitive data according to any one of claims 1 to 7.

Images