System, method and device for realizing dynamic configurable service data desensitization under distributed architecture, processor and readable storage medium thereof

Abstract

The invention relates to a system for realizing dynamic configurable service data desensitization under a distributed architecture, and the system comprises a service management module which collects an application list and a service list under a distributed architecture application system; the service data desensitization information definition module is used for managing data desensitization rule definition of specific services; the service data desensitization information management module is used for managing persistent service data desensitization rules; the service data desensitization information agent module and the management module load a service data desensitization rule; and the service data desensitization execution module is used for executing a service data desensitization rule on the returned service data. The invention also relates to a method for realizing dynamic configurable service data desensitization under the distributed architecture. By adopting the system, the method, the device, the processor and the computer readable storage medium for realizing the dynamic configurable service data desensitization under the distributed architecture, the service data desensitization and the service code decoupling are realized, the complexity of the service code is reduced, the readability of the code is improved, and the availability of the system is enhanced.

Description

Technical Field

[0001] The present invention relates to the field of computers, and in particular to the field of distributed architecture, and specifically refers to a system, method, device, processor and computer-readable storage medium for implementing dynamically configurable service data desensitization under a distributed architecture. Background Art

[0002] With the demand for digital transformation, enterprise IT application architecture has shifted from traditional monolithic architecture to distributed architecture applications. Due to the natural scalability of distributed architecture applications, it is easier to support large-scale user requests and meet the growing demands of users. By breaking down applications and services into smaller, loosely coupled components, they can be more easily upgraded and expanded, and different components can implement business scenarios through mutual calls and access. In the process of distributed calls, in order to ensure the security and compliance of business data, it is necessary to desensitize the distributed service data to ensure that the output business data meets the requirements of security audits of different roles; and with the development of the business, the rules for desensitizing service data are constantly changing. The distributed architecture system needs to provide a dynamic adjustment of service data desensitization capabilities to meet the ever-changing demands of enterprise security.

[0003] For data desensitization, the common practice is to implement it by manually coding the data objects returned by the service; for different data objects returned, desensitization rules are hard-coded for different fields in accordance with data security requirements; the service finally returns the desensitized data objects to the business front end to implement the data desensitization capability of the service call.

[0004] Example of implementing service data desensitization through hard coding:

[0005]

[0006]

[0007] For order names, only the first two digits of the order name are retained and displayed, and the other digits are desensitized;

[0008] All order prices are displayed in anonymized form;

[0009] All order quantities are displayed in an anonymized form;

[0010] For order addresses, only the country, province, city, and county levels are retained, and other detailed information is displayed in an anonymized form;

[0011] According to the above example, the return data of the service queryPersonalOrder(String orderID) is desensitized by hard-coding Java in the business logic.

[0012] The following is an analysis of the shortcomings of the above technical implementation methods:

[0013] Disadvantage 1: Strong coupling between data desensitization rules and business codes: Data desensitization codes are mixed with business codes, resulting in a high degree of coupling between data desensitization rules and business codes, which is highly invasive to business codes;

[0014] Disadvantage 2: Data desensitization rules cannot be dynamically configured and hot-updated during operation: During the operation of a business, as the business is adjusted, different data desensitization rules need to be used for different services or even different callers of the same service. The business code needs to be modified and repackaged, compiled, and deployed, causing the business system to shut down due to changes in data desensitization rules, greatly increasing the unavailability of the system.

[0015] Disadvantage 3: Data desensitization rules are decentralized and cannot be centrally configured and managed: Since data desensitization rules are distributed in different business codes, it is impossible to achieve unified and centralized management, which is not conducive to the operation and maintenance of the system in the later stage;

[0016] Disadvantage 4: Data desensitization rules cannot be flexibly configured: The desensitization rules of data objects cannot be flexibly configured in accordance with the relationship with the business party, and cannot be flexibly configured according to the service caller and calling scenario. Summary of the invention

[0017] The purpose of the present invention is to overcome the shortcomings of the above-mentioned prior art and to provide a dynamically configurable service data desensitization system, method, device, processor and computer-readable storage medium thereof in a distributed architecture that has good availability, low complexity and a wide range of applications.

[0018] In order to achieve the above objectives, the system, method, device, processor and computer-readable storage medium for implementing dynamically configurable service data desensitization under the distributed architecture of the present invention are as follows:

[0019] The main features of the dynamically configurable service data desensitization system implemented under the distributed architecture are as follows:

[0020] The service management module is used to collect the application list and service list under the distributed architecture application system, persist the collected information, and provide a query management interface;

[0021] A service data desensitization information definition module, connected to the service management module, is used to manage the data desensitization rule definition of specific services and notify the service data desensitization information proxy module of the change notification of the service data desensitization rule;

[0022] A service data desensitization information management module, connected to the service data desensitization information definition module, is used to manage persistent service data desensitization rules and provide a management interface for service data desensitization rules;

[0023] A service data desensitization information proxy module, connected to the service data desensitization information definition module and the service data desensitization information management module, for receiving a change notification from the service data desensitization information definition module, loading the service data desensitization rules from the service data desensitization information management module, and caching them;

[0024] The service data desensitization execution module is connected to the service data desensitization information management module and the service data desensitization information agent module, and is used to execute the service data desensitization rules on the returned business data according to the specific service request and the corresponding service data desensitization rules, and return the desensitized business data to the caller.

[0025] Preferably, the service management module collects the application list and the service list and persists the collected information, specifically including the following steps:

[0026] (1.1) Find all application lists and application details from the microservice registration center;

[0027] (1.2) From the collected microservice applications, scan the microservice applications one by one according to the service annotations, and collect the service list and service details under the microservice applications;

[0028] (1.3) Persist the collected application and service information;

[0029] (1.4) Query application list interface, query application information details interface according to application ID and service information list interface, query service information details interface according to service ID.

[0030] Preferably, the operation process of the service data desensitization information definition module specifically includes the following steps:

[0031] (2.1) Query the application list;

[0032] (2.2) Specify the application that needs to be desensitized from the list of all queried applications;

[0033] (2.3) According to the specified application, query all service lists from the service management module;

[0034] (2.4) Select the specific service that requires data desensitization from the service list found;

[0035] (2.5) According to the service data desensitization rule model, select the service data model that needs to be desensitized and define specific service data desensitization rules;

[0036] (2.6) Persist the defined service data desensitization rules in the service data desensitization information management module;

[0037] (2.7) Notify the service data desensitizing information proxy module of the corresponding application, and the service data desensitizing information proxy module reloads the changed service data desensitizing rules from the service data desensitizing information management module.

[0038] Preferably, the operation process of the service data desensitization information management module specifically includes the following steps:

[0039] (3.1) Query all service data desensitization rules under the application based on the application ID;

[0040] (3.2) Based on the service ID, query all service data desensitization rules under the service;

[0041] (3.3) Query detailed information of service desensitization rules based on service ID and business ID;

[0042] (3.4) Added new service data desensitization rules;

[0043] (3.5) Update service data desensitization rules;

[0044] (3.6) Delete service data desensitization rules.

[0045] Preferably, the service data desensitizing information proxy module also monitors the addition, modification and deletion operations of the service data desensitizing rules in the service data desensitizing information definition module, and reloads the changed service data desensitizing rules from the service data desensitizing information management module.

[0046] Preferably, the operation process of the service data desensitization information proxy module specifically includes the following steps:

[0047] (4.1) Start the service data desensitization proxy module;

[0048] (4.2) Query all service data desensitization rules under the current application from the service data desensitization information management module;

[0049] (4.3) Desensitizing the service data being searched for and storing it in a local cache or distributed cache;

[0050] (4.4) Monitor the service data desensitization rule change notification sent by the service data desensitization information definition module. If a notification is received, execute (4.5); otherwise, continue to monitor;

[0051] (4.5) Determine the type of service data desensitization rule notification received. If it is a new addition or modification type, execute (4.6); if it is a deletion type, execute (4.7);

[0052] (4.6) According to the changed service identifier and business identifier, query the changed service data desensitization rules from the service data desensitization information management module and update the cache;

[0053] (4.7) According to the changed service ID and business ID, delete the corresponding service data desensitization rules in the cache.

[0054] Preferably, the service data desensitization execution module uses dynamic proxy technology to intercept all service requests, and determines whether the current service requires data desensitization based on all service data proxy rules loaded in the service data desensitization information proxy module; if data desensitization is required, the returned service data is desensitized; if data desensitization is not required, the specific business logic is directly executed and the service data is returned.

[0055] Preferably, the operation process of the service data desensitization execution module specifically includes the following steps:

[0056] (5.1) Dynamic proxy interception through service proxy;

[0057] (5.2) All service data desensitization rules are loaded and the business logic of service calls is executed;

[0058] (5.3) Determine whether the current service ID and business ID have a service data desensitization rule definition. If so, call the service data desensitization rule to desensitize the returned service data; if not, execute (5.4);

[0059] (5.4) Return the service data to the service caller and end the service call.

[0060] The method for dynamically configurable service data desensitization processing in a distributed architecture based on the above system is mainly characterized in that the method comprises the following steps:

[0061] (1) Collect the application list and service list under the distributed architecture application system, persist the collected information, and provide a query management interface;

[0062] (2) Manage the definition of data desensitization rules for specific services and notify the service data desensitization information proxy module of changes to the service data desensitization rules;

[0063] (3) Manage persistent service data desensitization rules and provide a management interface for service data desensitization rules;

[0064] (4) receiving a change notification from the service data desensitization information definition module, loading the service data desensitization rules from the service data desensitization information management module, and caching them;

[0065] (5) Based on the specific service request and the corresponding service data desensitization rules, the service data desensitization rules are executed on the returned business data, and the desensitized business data is returned to the caller.

[0066] Preferably, the step (1) specifically comprises the following steps:

[0067] (1.1) Find all application lists and application details from the microservice registration center;

[0068] (1.2) From the collected microservice applications, scan the microservice applications one by one according to the service annotations, and collect the service list and service details under the microservice applications;

[0069] (1.3) Persist the collected application and service information;

[0070] (1.4) Query application list interface, query application information details interface according to application ID and service information list interface, query service information details interface according to service ID.

[0071] Preferably, the step (2) specifically comprises the following steps:

[0072] (2.1) Query the application list;

[0073] (2.2) Specify the application that needs to be desensitized from the list of all queried applications;

[0074] (2.3) According to the specified application, query all service lists from the service management module;

[0075] (2.4) Select the specific service that requires data desensitization from the service list found;

[0076] (2.5) According to the service data desensitization rule model, select the service data model that needs to be desensitized and define specific service data desensitization rules;

[0077] (2.6) Persist the defined service data desensitization rules in the service data desensitization information management module;

[0078] (2.7) Notify the service data desensitizing information proxy module of the corresponding application, and the service data desensitizing information proxy module reloads the changed service data desensitizing rules from the service data desensitizing information management module.

[0079] Preferably, the step (3) specifically comprises the following steps:

[0080] (3.1) Query all service data desensitization rules under the application based on the application ID;

[0081] (3.2) Based on the service ID, query all service data desensitization rules under the service;

[0082] (3.3) Query detailed information of service desensitization rules based on service ID and business ID;

[0083] (3.4) Added new service data desensitization rules;

[0084] (3.5) Update service data desensitization rules;

[0085] (3.6) Delete service data desensitization rules.

[0086] Preferably, the step (4) specifically comprises the following steps:

[0087] (4.1) Start the service data desensitization proxy module;

[0088] (4.2) Query all service data desensitization rules under the current application from the service data desensitization information management module;

[0089] (4.3) Desensitizing the service data being searched for and storing it in a local cache or distributed cache;

[0090] (4.4) Monitor the service data desensitization rule change notification sent by the service data desensitization information definition module. If a notification is received, execute (4.5); otherwise, continue to monitor;

[0091] (4.5) Determine the type of service data desensitization rule notification received. If it is a new addition or modification type, execute (4.6); if it is a deletion type, execute (4.7);

[0092] (4.6) According to the changed service identifier and business identifier, query the changed service data desensitization rules from the service data desensitization information management module and update the cache;

[0093] (4.7) According to the changed service ID and business ID, delete the corresponding service data desensitization rules in the cache.

[0094] Preferably, the step (5) specifically comprises the following steps:

[0095] (5.1) Dynamic proxy interception through service proxy;

[0096] (5.2) All service data desensitization rules are loaded and the business logic of service calls is executed;

[0097] (5.3) Determine whether the current service ID and business ID have a service data desensitization rule definition. If so, call the service data desensitization rule to desensitize the returned service data; if not, execute (5.4);

[0098] (5.4) Return the service data to the service caller and end the service call.

[0099] The main feature of the device for implementing dynamically configurable service data desensitization processing under a distributed architecture is that the device comprises:

[0100] a processor configured to execute computer-executable instructions;

[0101] A memory stores one or more computer executable instructions. When the computer executable instructions are executed by the processor, the various steps of the dynamically configurable service data desensitization method under the above-mentioned distributed architecture are implemented.

[0102] The processor for implementing dynamically configurable service data desensitization processing under a distributed architecture has the main feature that the processor is configured to execute computer-executable instructions. When the computer-executable instructions are executed by the processor, the various steps of the method for implementing dynamically configurable service data desensitization under the above-mentioned distributed architecture are implemented.

[0103] The main feature of this computer-readable storage medium is that a computer program is stored thereon, and the computer program can be executed by a processor to implement the various steps of the dynamically configurable service data desensitization method under the above-mentioned distributed architecture.

[0104] The system, method, device, processor and computer-readable storage medium for dynamically configurable service data desensitization under the distributed architecture of the present invention are adopted. Since a mechanism for separating service data desensitization rules from business codes is implemented, and centralized dynamic configuration, hot update capabilities, and dynamic proxy technology are provided, service data desensitization and business code are decoupled, the problem of strong intrusion of service data desensitization rules into business codes is solved, the complexity of business codes is reduced, the readability of codes is improved, and different service data desensitization rules are defined in multiple business scenarios, which is completely transparent and friendly to client service calls; at the same time, the ability to dynamically adjust service data desensitization rules without stopping the business system is implemented, thereby enhancing system availability; in addition, a centralized management method for service data desensitization rules is provided, which supports service governance from a global perspective on service data desensitization of microservice applications under the distributed architecture of an enterprise, and has very strong promotion value. BRIEF DESCRIPTION OF THE DRAWINGS

[0105] Figure 1A schematic diagram of the structure of a dynamically configurable service data desensitization system implemented under the distributed architecture of the present invention.

[0106] Figure 2 A flowchart of the steps for operating a service management module of a dynamically configurable service data desensitization system under the distributed architecture of the present invention.

[0107] Figure 3 A schematic flow chart of the steps for defining service data desensitization information of a dynamically configurable service data desensitization system under the distributed architecture of the present invention.

[0108] Figure 4 A schematic flow chart of the steps of implementing a service data desensitizing information proxy module of a dynamically configurable service data desensitizing system under the distributed architecture of the present invention.

[0109] Figure 5 The present invention is a schematic diagram of the operation flow of the service data desensitization execution module of the dynamically configurable service data desensitization system implemented under the distributed architecture of the present invention. DETAILED DESCRIPTION

[0110] In order to more clearly describe the technical content of the present invention, further description is given below in conjunction with specific embodiments.

[0111] The distributed architecture of the present invention implements a dynamically configurable service data desensitization system, which includes:

[0112] The service management module is used to collect the application list and service list under the distributed architecture application system, persist the collected information, and provide a query management interface;

[0113] A service data desensitization information definition module, connected to the service management module, is used to manage the data desensitization rule definition of specific services and notify the service data desensitization information proxy module of the change notification of the service data desensitization rule;

[0114] A service data desensitization information management module, connected to the service data desensitization information definition module, is used to manage persistent service data desensitization rules and provide a management interface for service data desensitization rules;

[0115] A service data desensitization information proxy module, connected to the service data desensitization information definition module and the service data desensitization information management module, for receiving a change notification from the service data desensitization information definition module, loading the service data desensitization rules from the service data desensitization information management module, and caching them;

[0116] The service data desensitization execution module is connected to the service data desensitization information management module and the service data desensitization information agent module, and is used to execute the service data desensitization rules on the returned business data according to the specific service request and the corresponding service data desensitization rules, and return the desensitized business data to the caller.

[0117] As a preferred embodiment of the present invention, the service management module collects the application list and the service list and persists the collected information, which specifically includes the following steps:

[0118] (1.1) Find all application lists and application details from the microservice registration center;

[0119] (1.2) From the collected microservice applications, scan the microservice applications one by one according to the service annotations, and collect the service list and service details under the microservice applications;

[0120] (1.3) Persist the collected application and service information;

[0121] (1.4) Query application list interface, query application information details interface according to application ID and service information list interface, query service information details interface according to service ID.

[0122] As a preferred embodiment of the present invention, the operation process of the service data desensitization information definition module specifically includes the following steps:

[0123] (2.1) Query the application list;

[0124] (2.2) Specify the application that needs to be desensitized from the list of all queried applications;

[0125] (2.3) According to the specified application, query all service lists from the service management module;

[0126] (2.4) Select the specific service that requires data desensitization from the service list found;

[0127] (2.5) According to the service data desensitization rule model, select the service data model that needs to be desensitized and define specific service data desensitization rules;

[0128] (2.6) Persist the defined service data desensitization rules in the service data desensitization information management module;

[0129] (2.7) Notify the service data desensitizing information proxy module of the corresponding application, and the service data desensitizing information proxy module reloads the changed service data desensitizing rules from the service data desensitizing information management module.

[0130] As a preferred embodiment of the present invention, the operation process of the service data desensitization information management module specifically includes the following steps:

[0131] (3.1) Query all service data desensitization rules under the application based on the application ID;

[0132] (3.2) Based on the service ID, query all service data desensitization rules under the service;

[0133] (3.3) Query detailed information of service desensitization rules based on service ID and business ID;

[0134] (3.4) Added new service data desensitization rules;

[0135] (3.5) Update service data desensitization rules;

[0136] (3.6) Delete service data desensitization rules.

[0137] As a preferred embodiment of the present invention, the service data desensitizing information agent module also monitors the addition, modification and deletion operations of the service data desensitizing rules in the service data desensitizing information definition module, and reloads the changed service data desensitizing rules from the service data desensitizing information management module.

[0138] As a preferred embodiment of the present invention, the operation process of the service data desensitization information agent module specifically includes the following steps:

[0139] (4.1) Start the service data desensitization proxy module;

[0140] (4.2) Query all service data desensitization rules under the current application from the service data desensitization information management module;

[0141] (4.3) Desensitizing the service data being searched for and storing it in a local cache or distributed cache;

[0142] (4.4) Monitor the service data desensitization rule change notification sent by the service data desensitization information definition module. If a notification is received, execute (4.5); otherwise, continue to monitor;

[0143] (4.5) Determine the type of service data desensitization rule notification received. If it is a new addition or modification type, execute (4.6); if it is a deletion type, execute (4.7);

[0144] (4.6) According to the changed service identifier and business identifier, query the changed service data desensitization rules from the service data desensitization information management module and update the cache;

[0145] (4.7) According to the changed service ID and business ID, delete the corresponding service data desensitization rules in the cache.

[0146] As a preferred embodiment of the present invention, the service data desensitization execution module uses dynamic proxy technology to intercept all service requests, and determines whether the current service requires data desensitization based on all service data proxy rules loaded in the service data desensitization information proxy module; if data desensitization is required, the returned service data is desensitized; if data desensitization is not required, the specific business logic is directly executed and the service data is returned.

[0147] As a preferred embodiment of the present invention, the operation process of the service data desensitization execution module specifically includes the following steps:

[0148] (5.1) Dynamic proxy interception through service proxy;

[0149] (5.2) All service data desensitization rules are loaded and the business logic of service calls is executed;

[0150] (5.3) Determine whether the current service ID and business ID have a service data desensitization rule definition. If so, call the service data desensitization rule to desensitize the returned service data; if not, execute (5.4);

[0151] (5.4) Return the service data to the service caller and end the service call.

[0152] The present invention implements a method for dynamically configurable service data desensitization processing under a distributed architecture based on the above system, wherein the method comprises the following steps:

[0153] (1) Collect the application list and service list under the distributed architecture application system, persist the collected information, and provide a query management interface;

[0154] (2) Manage the definition of data desensitization rules for specific services and notify the service data desensitization information proxy module of changes to the service data desensitization rules;

[0155] (3) Manage persistent service data desensitization rules and provide a management interface for service data desensitization rules;

[0156] (4) receiving a change notification from the service data desensitization information definition module, loading the service data desensitization rules from the service data desensitization information management module, and caching them;

[0157] (5) Based on the specific service request and the corresponding service data desensitization rules, the service data desensitization rules are executed on the returned business data, and the desensitized business data is returned to the caller.

[0158] As a preferred embodiment of the present invention, the step (1) specifically comprises the following steps:

[0159] (1.1) Find all application lists and application details from the microservice registration center;

[0160] (1.2) From the collected microservice applications, scan the microservice applications one by one according to the service annotations, and collect the service list and service details under the microservice applications;

[0161] (1.3) Persist the collected application and service information;

[0162] (1.4) Query application list interface, query application information details interface according to application ID and service information list interface, query service information details interface according to service ID.

[0163] As a preferred embodiment of the present invention, the step (2) specifically comprises the following steps:

[0164] (2.1) Query the application list;

[0165] (2.2) Specify the application that needs to be desensitized from the list of all queried applications;

[0166] (2.3) According to the specified application, query all service lists from the service management module;

[0167] (2.4) Select the specific service that requires data desensitization from the service list found;

[0168] (2.5) According to the service data desensitization rule model, select the service data model that needs to be desensitized and define specific service data desensitization rules;

[0169] (2.6) Persist the defined service data desensitization rules in the service data desensitization information management module;

[0170] (2.7) Notify the service data desensitizing information proxy module of the corresponding application, and the service data desensitizing information proxy module reloads the changed service data desensitizing rules from the service data desensitizing information management module.

[0171] As a preferred embodiment of the present invention, the step (3) specifically comprises the following steps:

[0172] (3.1) Query all service data desensitization rules under the application based on the application ID;

[0173] (3.2) Based on the service ID, query all service data desensitization rules under the service;

[0174] (3.3) Query detailed information of service desensitization rules based on service ID and business ID;

[0175] (3.4) Added new service data desensitization rules;

[0176] (3.5) Update service data desensitization rules;

[0177] (3.6) Delete service data desensitization rules.

[0178] As a preferred embodiment of the present invention, the step (4) specifically comprises the following steps:

[0179] (4.1) Start the service data desensitization proxy module;

[0180] (4.2) Query all service data desensitization rules under the current application from the service data desensitization information management module;

[0181] (4.3) Desensitizing the service data being searched for and storing it in a local cache or distributed cache;

[0182] (4.4) Monitor the service data desensitization rule change notification sent by the service data desensitization information definition module. If a notification is received, execute (4.5); otherwise, continue to monitor;

[0183] (4.5) Determine the type of service data desensitization rule notification received. If it is a new addition or modification type, execute (4.6); if it is a deletion type, execute (4.7);

[0184] (4.6) According to the changed service identifier and business identifier, query the changed service data desensitization rules from the service data desensitization information management module and update the cache;

[0185] (4.7) According to the changed service ID and business ID, delete the corresponding service data desensitization rules in the cache.

[0186] As a preferred embodiment of the present invention, the step (5) specifically comprises the following steps:

[0187] (5.1) Dynamic proxy interception through service proxy;

[0188] (5.2) All service data desensitization rules are loaded and the business logic of service calls is executed;

[0189] (5.3) Determine whether the current service ID and business ID have a service data desensitization rule definition. If so, call the service data desensitization rule to desensitize the returned service data; if not, execute (5.4);

[0190] (5.4) Return the service data to the service caller and end the service call.

[0191] The device for implementing dynamically configurable service data desensitization processing under a distributed architecture of the present invention, wherein the device comprises:

[0192] a processor configured to execute computer-executable instructions;

[0193] A memory stores one or more computer executable instructions. When the computer executable instructions are executed by the processor, the various steps of the dynamically configurable service data desensitization method under the above-mentioned distributed architecture are implemented.

[0194] The processor of the present invention is used to implement dynamically configurable service data desensitization processing under a distributed architecture, wherein the processor is configured to execute computer-executable instructions, and when the computer-executable instructions are executed by the processor, the various steps of the method for dynamically configurable service data desensitization under the above-mentioned distributed architecture are implemented.

[0195] The computer-readable storage medium of the present invention stores a computer program thereon, and the computer program can be executed by a processor to implement the various steps of the dynamically configurable service data desensitization method under the above-mentioned distributed architecture.

[0196] In a specific embodiment of the present invention, a system and method for realizing dynamically configurable service data desensitization under a distributed architecture provide a mechanism for separating the service data desensitization configuration from the business code, thereby decoupling the service data desensitization rules from the business code, thereby solving the problem of strong intrusion of the service data desensitization rules into the business code, and at the same time reducing the complexity of the business code and improving readability.

[0197] The present invention provides dynamic configuration and hot update capabilities for service data desensitization, supports real-time configuration of service data desensitization rules and hot update effectiveness during the operation of the business system, does not need to stop the business system, realizes dynamic adjustment of service data desensitization rules, enhances system availability, and avoids invalid downtime.

[0198] The present invention provides a centralized management method for service data desensitization rules, providing a global management perspective of services and service data desensitization rules.

[0199] The present invention provides flexible configuration of service data desensitization rules, supports configuration of different service data desensitization rules according to service callers and business scenarios, and friendly supports configuration of various business scenarios.

[0200] The present invention realizes dynamic configuration, hot update and centralized management of service data desensitization rules, has strong adaptability to changes in service data desensitization caused by changes in business data desensitization rules, improves the development and operation and maintenance efficiency of distributed architecture application service data desensitization, and has a wide range of uses in the field of distributed architecture.

[0201] like Figure 1 As shown, the present invention is divided into a service management module, a service data desensitizing information definition module, a service data desensitizing information management module, a service data desensitizing information proxy module, and a service data desensitizing execution module.

[0202] The service management module is responsible for managing the application list and service list under the distributed architecture application system; the service data desensitization information definition module manages the data desensitization rule definition of specific services and notifies the service data desensitization information agent module of the change notification of the service data desensitization rules; the service data desensitization information management module is responsible for persisting the service data desensitization rules; the service data desensitization information agent module accepts the change notification issued by the "service data desensitization information definition module", loads the service data desensitization rules from the "service data desensitization information management module", and caches them, supporting full loading and partial loading modes; the service data desensitization execution module executes the service data desensitization rules on the returned business data according to the specific service request and the corresponding service data desensitization rules, and returns the desensitized business data to the caller.

[0203] The service management module, service data desensitizing information definition module, service data desensitizing information management module, service data desensitizing information proxy module and service data desensitizing execution module will be described in detail below.

[0204] 1. Service Management Module

[0205] The service management module collects all application lists and service lists under the distributed architecture; persists the collected information and provides a query management interface. The "service data desensitization information definition module" queries the application list and service list under the application that need to be managed based on this interface;

[0206] like Figure 2 As shown, the steps of the service management module operation are as follows:

[0207] Step 1: Collect application list: Find all application lists and application details from the microservice registration center. The collected application information includes: application ID (globally unique), application name, application description, and application registration time.

[0208] Step 2: Collect service list: From the microservice applications collected in step 1, scan the microservice applications one by one according to the service annotation @Service, collect the service list and service details under the microservice application, and the collected service details include: service ID (the service ID is globally unique within the same application), service name, service full path, method name, parameter list information, and return value information;

[0209] Step 3: Information persistence: Persist the application and service information collected in steps 1 and 2; for example, persist it in a relational database or a file system;

[0210] Step 4: Query management interface: Provides a query management interface for the persistent information in step 3, mainly including:

[0211] Query application list interface;

[0212] Query application information details interface based on application ID;

[0213] Query service information list interface based on application ID;

[0214] Interface for querying service information details based on service ID.

[0215] 2. Service data desensitization information definition module

[0216] The service data desensitization information definition module mainly provides the following capabilities: defining service data desensitization rule models; defining data desensitization rules for specific services for applications and services collected in the "service management module"; after the service data desensitization rules are defined, the "service data desensitization information proxy module" of the application where the service is located is notified to dynamically refresh the service data desensitization rules;

[0217] The service data desensitization rule model mainly includes: service identification, business identification, service data model, and desensitization rules corresponding to the service data model.

[0218] 1. Service ID: a unique ID used to identify the service;

[0219] 2. Business ID: used to identify business scenarios. The business end can define different service data desensitization rules based on the business ID;

[0220] 3. Service data model: used for service data models that need to be desensitized;

[0221] 4. Data desensitization rules corresponding to the service data model: For each field in the service data model, define the data desensitization rules for the field based on the type.

[0222] like Figure 3 As shown, the steps for defining service data desensitization information are as follows:

[0223] Step 1: Query the application list: Query all collected applications from the "Service Management Module";

[0224] Step 2: Select applications: Select the applications that need to be desensitized from the list of all applications queried in "Step 1";

[0225] Step 3: Query the service list: According to the application specified in "Step 2", query all service lists from the "Service Management Module";

[0226] Step 4: Select service: From the service list found in "Step 3", select the specific service that needs data desensitization;

[0227] Step 5: Define service data desensitization rules: According to the service data desensitization rule model, select the service data model that needs to be desensitized, and define specific service data desensitization rules;

[0228] Step 6: Persist the desensitization rules: Persist the service data desensitization rules defined in "Step 5" in the "Service Data Desensitization Information Management Module";

[0229] Step 7: Notify the proxy module: After "Step 6" is persisted, notify the "Service Data Desensitizing Information Proxy Module" of the corresponding application that the service data desensitizing rules under it have changed, and the "Service Data Desensitizing Information Proxy Module" will reload the changed service data desensitizing rules from the "Service Data Desensitizing Information Management Module".

[0230] 3. Service data desensitization information management module

[0231] The service data desensitization information management module is responsible for persisting the service data desensitization rules defined in the "service data desensitization information definition module" and providing a management interface for service data desensitization rules. The main operations provided are:

[0232] 1) Based on the application ID, query all service data desensitization rules under the application;

[0233] 2) According to the service ID, query all service data desensitization rules under the service;

[0234] 3) Query detailed information of service desensitization rules based on service ID and business ID;

[0235] 4) Added new service data desensitization rules;

[0236] 5) Update service data desensitization rules;

[0237] 6) Delete the service data desensitization rules.

[0238] 4. Service data desensitization information proxy module

[0239] The service data desensitization information proxy module loads and caches all service data desensitization rules from the "service data desensitization information management module" to improve the operating efficiency of service data desensitization; monitors the addition, modification, and deletion operations of service data desensitization rules in the "service data desensitization information definition module", and reloads the changed service data desensitization rules from the "service data desensitization information management module", adopts a local loading mode, and improves the overall operating efficiency;

[0240] like Figure 4 As shown, the steps of the service data desensitization information proxy module are as follows:

[0241] Step 1: Start the service data desensitization proxy module: Start the service data desensitization proxy module during application startup;

[0242] Step 2: Query all service data desensitization rules: Query all service data desensitization rules under the current application from the "Service Data Desensitization Information Management Module";

[0243] Step 3: Cache service data desensitization rules: Store the service data desensitization rules found in "Step 2" through local cache or distributed cache to improve the efficiency of application access to service data desensitization rules;

[0244] Step 4: Monitor service data desensitization rule changes: Monitor the service data desensitization rule change notification sent by the "Service Data Desensitization Information Definition Module". If a notification is received, execute "Step 5". If not, continue to monitor.

[0245] Step 5: Determine the type of service data desensitization rule change: Determine the type of service data desensitization rule notification received. If it is a new addition or modification type, execute "Step 6"; if it is a deletion type, execute "Step 7";

[0246] Step 6: Update service data desensitization rules: According to the changed service ID and business ID, query the changed service data desensitization rules from the "service data desensitization information management module" and update the cache;

[0247] Step 7: Delete service data desensitization rules: Clear the corresponding service data desensitization rules in the cache according to the changed service ID and business ID.

[0248] Five: Service data desensitization execution module

[0249] The service data desensitization execution module uses dynamic proxy technology to intercept all service requests, and determines whether the current service requires data desensitization based on all service data proxy rules loaded in the "service data desensitization information proxy module"; if data desensitization is required, the returned service data is desensitized; if data desensitization is not required, the specific business logic is directly executed and the service data is returned.

[0250] like Figure 5 As shown, the steps of the service data desensitization execution module are as follows:

[0251] Step 1: Proxy all services: After the service request enters the application, it is dynamically intercepted by the service proxy, which is completely transparent and imperceptible to the client call;

[0252] Step 2: Determine whether the service requires data desensitization: Based on all the service data desensitization rules loaded in "Step 1", determine whether the current service ID and business ID have service data desensitization rule definitions;

[0253] Step 3: Execute service logic: execute the business logic of service call;

[0254] Step 4: Service data desensitization: Based on the judgment in "Step 2", if there is a service data desensitization rule definition, the service data desensitization rule is called to desensitize the returned service data; if there is no service data desensitization rule, execute "Step 5";

[0255] Step 5: Return service data: Return the service data to the service caller and end the service call.

[0256] In a specific embodiment of the present invention, a housing application application based on a microservice architecture is taken as an example.

[0257] The housing application application "HouseApp" provides housing application functions to the outside world, and provides interfaces such as housing application and housing application detail query. When different applicants query housing application details, it is necessary to desensitize part of the returned housing information data based on the applicant and the query business scenario.

[0258] Next, according to the method of the present invention, a system and method for implementing dynamically configurable service data desensitization under a distributed architecture are used to implement the above business scenario, and the advantages of simplicity and convenience of the present invention will be clearly felt.

[0259] 1. Service Management Module

[0260] The service management module is responsible for collecting application information of the housing application application "HouseApp" and all service lists under the housing application application "HouseApp", and persisting all collected data. This example uses a relational database for storage and provides a query management interface. The "Service Data Desensitization Information Definition Module" queries the application list and service list that need to be managed based on this interface.

[0261] The specific implementation of this module is as follows:

[0262] 1. Collect application list: Collect all automatically registered applications from the application registration center. In this example, the collected application list information is: {"HouseApp"}; and collect meta information such as application ID, application name, application description, and application registration time. In this example, the information collected for the housing application application is: {"Application ID: HouseApp"; "Application name: Housing application application"; "Application description: Application for housing application management"; "Application registration time: 2024-9-15 12:58:59"};

[0263] 2. Collect service list: This module automatically scans the annotation @Service under the housing application application "HouseApp" to obtain all service lists. The service information includes metadata such as service ID (the service ID is globally unique within the same application), service name, service full path, method name, parameter list information, and return value information. In this example, the housing application application "HouseApp" collects 2 services. For specific service information, see the following table:

[0264]

[0265] 3. Information persistence: persist the application list and service list information collected in "step 1" and "step 2". In this example, the collected information is persisted in a relational database;

[0266] 4. Query management interface: This module provides a query API management interface. See the following table for the query API management interface provided:

[0267] / / Query the application list

[0268] public List <appinfo>queryAllApps();

[0269] / / Query application information details based on application ID

[0270] public AppInfo queryAppDetail(String appID);

[0271] / / Query the service information list based on the application ID

[0272] public List <services>queryAllService(String appID);

[0273] / / Query service information details based on service ID

[0274] public Services queryServiceDetail(String serviceID);

[0275] 2. Service data desensitization information definition module

[0276] In terms of scenarios, this module is mainly responsible for defining data desensitization rules for the service "housing application details query" in the housing application application "HouseApp". Specific desensitization scenarios: The returned housing application details do not need to be desensitized if you are querying your own application record information; if you are querying other people's application records, the returned application record information needs to be desensitized;

[0277] For the above scenario, define the service data desensitization rule model, which mainly includes:

[0278] 1. The service identifier is "com.primeton.IHouseApplyManage.queryHouseApplyBeans(HouseQueryBean)";

[0279] 2. Business identifiers are divided into two categories. The first category is "person", which means to query your own housing application details, and the second category is "other", which means to query other people's housing application details;

[0280] 3. Service data model: The service data model that needs to be desensitized in this scenario is "com.primeton.HouseApplyBean", which mainly includes housing application ID, housing applicant name, housing applicant phone number, housing applicant age, housing applicant length of service, housing application time, whether the housing application is approved, house location, house area, house floor, and house model;

[0281] The definition of the service data model "com.primeton.HouseApplyBean" is as follows:

[0282]

[0283] 4. Data desensitization rules corresponding to the service data model: For the service data model "com.primeton.HouseApplyBean", it is defined that the name, phone number and age of the housing applicant need to be desensitized. The desensitization rules are as follows:

[0284] Housing applicant's name: the first digit is displayed normally, and the others are displayed in an anonymous manner;

[0285] Housing applicant’s phone number: the first and last digits are displayed normally, and the others are displayed in an anonymized manner;

[0286] Age of housing applicants: all displayed in anonymized form.

[0287] The steps for defining service data desensitization information are as follows:

[0288] 1. Query the application list: Use the "Query application list" interface provided by the "Service Management Module" to query all application lists. The application list queried in this example is: {"HouseApp"};

[0289] 2. Select an application: From the application list queried in "Step 1", select the housing application application "HouseApp" for which service data desensitization is required;

[0290] 3. Query the service list: Use the "Query service information list based on application ID" interface provided by the "Service Management Module" to query the list of all services under the housing application application "HouseApp". The service list queried in this example is as follows:

[0291] com.primeton.IHouseApplyManage.houseApply(HouseApplyBean)

[0292] com.primeton.IHouseApplyManage.queryHouseApplyBeans(HouseQueryBean)

[0293] 4. Select service: In this example, select the housing application details query service "com.primeton.IHouseApplyManage.queryHouseApplyBeans(HouseQueryBean)" to define the service data desensitization rules in the subsequent steps;

[0294] 5. Define service data desensitization rules: In this example, the data desensitization rules for the service "housing application details query" are defined. When the business identifier is "other", the data model "com.primeton.HouseApplyBean" returned by the service "housing application details query" is desensitized. The fields that need to be desensitized include: housing applicant's name, housing applicant's phone number, and housing applicant's age;

[0295] The following table shows an example of setting a masked field, as well as examples before and after masking:

[0296] Name of housing applicant: Desensitization rule-NameRule; before desensitization-Zhang San; after desensitization-Zhang*

[0297] Housing applicant phone number: desensitization rule-PhoneRule; before desensitization-12345678901; after desensitization: 1*********1

[0298] Age of housing applicants: Desensitization rule-AgeRule; Before desensitization-30; After desensitization-**

[0299] 6. Persistent desensitization rules: This example persists the service data desensitization rules defined in "Step 5" into the relational database. The corresponding instantiation data is: {serviceID:com.primeton.IHouseApplyManage.queryHouseApplyBeans(HouseQueryBean); businessID:other; dataModel:com.primeton.HouseApplyBean; applicantName:NameRule; applicantPhone:PhoneRule; applicantAge:AgeRule};

[0300] Field Description:

[0301] serviceID: service ID, the corresponding value is: com.primeton.IHouseApplyManage.queryHouseApplyBeans(HouseQueryBean);

[0302] businessID: business ID, the corresponding value is: other;

[0303] dataModel: data model, the corresponding value is: com.primeton.HouseApplyBean;

[0304] applicantName: field housing applicant name, corresponding value: NameRule;

[0305] applicantPhone: field housing applicant phone number, corresponding value: PhoneRule;

[0306] applicantAge: field housing applicant age, corresponding value: AgeRule;

[0307] 7. Notify the proxy module: After persisting the data desensitization rule of the service "com.primeton.IHouseApplyManage.queryHouseApplyBeans(HouseQueryBean)" in "Step 6", the "Service Data Desensitization Information Proxy Module" will be automatically notified that a new service data desensitization rule has been added; the "Service Data Desensitization Information Proxy Module" loads the service data desensitization rule of the service "com.primeton.IHouseApplyManage.queryHouseApplyBeans(HouseQueryBean)" from the "Service Data Desensitization Information Management Module" into memory;

[0308] 3. Service data desensitization information management module

[0309] In this example, a relational database is used to store the service data desensitization rule information. It is responsible for persisting the service data desensitization rule information defined in the "service data desensitization information definition module": {serviceID:com.primeton.IHouseApplyManage.queryHouseApplyBeans(HouseQueryBean); businessID:other; dataModel:com.primeton.HouseApplyBean; applicantName:NameRule; applicantPhone:PhoneRule; applicantAge:AgeRule}, and provides a service data desensitization rule management interface.

[0310] The management API interface implementation provided by the service data desensitization information management module is shown in the following table:

[0311] / / Based on the application ID, query all service data desensitization rules under the application

[0312] public List <desensitizationrule>queryDesensitizationRules(StringappID);

[0313] / / Based on the service ID, query all service data desensitization rules under the service

[0314] public List <desensitizationrule>queryDesensitizationRules(StringappID,String serviceID);

[0315] / / Query detailed information of service desensitization rules according to service ID and business ID

[0316] public DesesitizationRule queryDesensitizationRuleDetail(StringserviceID,String businessID);

[0317] / / Add new service data desensitization rules

[0318] public Boolean addDesensizationRule(DesesitizationRuledesensitizationRule);

[0319] / / Update service data desensitization rules

[0320] public Boolean updateDesensizationRule(DesesitizationRuledesensitizationRule);

[0321] / / Delete service data desensitization rules

[0322] public Boolean deleteDesensizationRule(DesesitizationRuledesensitizationRule);

[0323] 4. Service data desensitization information proxy module

[0324] In this example, the service data desensitization information proxy module is started with the housing application application "HouseApp" as part of the application; and all service data desensitization rules under the application are loaded from the "service data desensitization information management module" using the application ID ("HouseApp") and cached inside the housing application application "HouseApp". This example uses a local cache method, and a distributed cache Redis can also be used for storage; the housing application application "HouseApp" is responsible for monitoring the change notifications of the service data desensitization rules in the "service data desensitization information definition module", re-locally loading the changed service data desensitization rules from the "service data desensitization information management module", and updating the local cache;

[0325] The steps for the service data desensitization information proxy module are as follows:

[0326] 1. Start the service data desensitization proxy module: During the startup of the housing application application "HouseApp", call the entry class com.primeton.ServiceDesesitizationProxyModule to start the service data desensitization proxy module. When the application loads this class, it will automatically trigger its internal static code block and start the service data desensitization proxy module by calling the start() operation;

[0327] The sample code of the service data desensitization proxy module entry class ServiceDesesitizationProxyModule is as follows:

[0328]

[0329] 2. Query all service data desensitization rules: Through the "publicList <desensitizationrule>queryDesensitizationRules(String appID)" interface to find all service data desensitization rules under the housing application application "HouseApp". According to the above scenario definition, a total of 1 service data desensitization rule is found. The query code and query results are shown in the following table:

[0330] / / Query code

[0331] List <desensitizationrule>rules=ServiceManage.queryDesensitizationRules("HouseApp");

[0332] / / Query results

[0333] 1, '{serviceID:com.primeton.IHouseApplyManage.queryHouseApplyBeans(HouseQueryBean); businessID:other; dataModel:com.primeton.HouseApplyBean; applicantName:NameRule; applicantPhone:PhoneRule; applicantAge:AgeRule}'

[0334] 3. Cache service data desensitization rules: store the service data desensitization rule found in "Step 2" in the housing application application "HouseApp" in a local cache;

[0335] 4. Monitor service data desensitization rule changes: Monitor service data desensitization rule change notifications sent by the "Service Data Desensitization Information Definition Module" (when the "Service Data Desensitization Information Definition Module" adds, modifies, or deletes service data desensitization rule definitions, service data desensitization rule change notifications of the types "add insert", "modify update", and "delete" will be generated respectively). If a change notification is received, proceed to the next step; otherwise, continue to monitor and wait in this step;

[0336] 5. Determine the change type of service data desensitization rules: Update the service data desensitization rules through the "Service Data Desensitization Information Definition Module", change the "Housing Applicant Phone" desensitization rule to "***********" for all desensitization, and the new desensitization rule is "PhoneRuleAll". The modified service data desensitization rule sample data of the housing application details query service "com.primeton.IHouseApplyManage.queryHouseApplyBeans(HouseQueryBean)" is as follows:

[0337] / / Housing application details query service, service data desensitization rules before modification

[0338] {serviceID:com.primeton.IHouseApplyManage.queryHouseApplyBeans(HouseQueryBean); businessID:other; dataModel:com.primeton.HouseApplyBean; applicantName:NameRule; applicantPhone:PhoneRule; applicantAge:AgeRule}

[0339] / / Housing application details query service, modified service data desensitization rules

[0340] {serviceID:com.primeton.IHouseApplyManage.queryHouseApplyBeans(HouseQueryBean); businessID:other; dataModel:com.primeton.HouseApplyBean; applicantName:NameRule; applicantPhone:PhoneRuleAll; applicantAge:AgeRule}

[0341] In this scenario, the service rules are updated, and the change type of the service data desensitization rule is determined to be: "modify update";

[0342] 6. Update service data desensitization rules: For the service data desensitization rules with service ID "com.primeton.IHouseApplyManage.queryHouseApplyBeans(HouseQueryBean)" and business ID "other", call the public DesesitizationRulequeryDesensitizationRuleDetail(String serviceID,String businessID) interface from the "Service Data Desensitization Information Management Module" to query the specific changed service data desensitization rules and update them to the local cache;

[0343] 7. Delete the service data desensitization rule: In this scenario, the service data desensitization change type is "modify update", which will not trigger the execution of this step.

[0344] Five: Service data desensitization execution module

[0345] In this example, the service data desensitization execution module dynamically proxy intercepts all services marked with the annotation @Service in the housing application application "HouseApp"; when the client service calls all services in the housing application application "HouseApp", the service data desensitization execution function will be automatically triggered; when the service is called, all service data desensitization rules loaded in the "service data desensitization information proxy module" are used to determine whether the current service call data needs to be desensitized; if desensitization is required, the specific matching desensitization rule is called; otherwise, the specific business logic result is directly returned; the proxy technology is used to realize the transparent call of the service API;

[0346] The steps of the service data desensitization execution module are as follows:

[0347] 1. Proxy all services: Provide a service proxy class "com.primeton.ServiceDesesitizationExecuteProxy" for all services in the housing application application "HouseApp", which is responsible for dynamically intercepting all service calls under the housing application application;

[0348]

[0349] The service proxy class com.primeton.ServiceDesesitizationExecuteProxy schematic code is shown in the following table:

[0350] List <houseapplybean>queryResults=new ArrayList <houseapplybean>();

[0351] HouseQueryBean houseQueryBean=new HouseQueryBean();

[0352] houseQueryBean.setServiceID("com.primeton.IHouseApplyManage.queryHouseApplyBeans(HouseQueryBean)");

[0353] houseQueryBean.setBusinessID("other");

[0354] queryResults=this.queryHouseApplyBeans(houseQueryBean);

[0355] return queryResults;

[0356] The createServiceDesesitizationExecuteProxy() operation creates dynamic interception capabilities for all service calls;

[0357] 2. Determine whether the service requires data desensitization: When the user accesses the "housing application details query" interface, the service data desensitization rules are defined for the service in the "service data desensitization information definition module". In this example, the judgment result is: the current service call requires data desensitization;

[0358] The sample code of the user access interface "housing application details query" is shown in the following table:

[0359] List <houseapplybean>queryResults=new ArrayList <houseapplybean>();

[0360] HouseQueryBean houseQueryBean=new HouseQueryBean();

[0361] houseQueryBean.setServiceID("com.primeton.IHouseApplyManage.queryHouseApplyBeans(HouseQueryBean)");

[0362] houseQueryBean.setBusinessID("other");

[0363] queryResults=this.queryHouseApplyBeans(houseQueryBean);

[0364] return queryResults;

[0365] Set the calling service ID to "com.primeton.IHouseApplyManage.queryHouseApplyBeans(HouseQueryBean)";

[0366] Set the calling service ID to "other";

[0367] 3. Execute service logic: Continue to call the service interface "housing application details query", query the actual business return result and continue to the next step;

[0368] 4. Service data desensitization: According to the judgment in "Step 2", this example scenario requires data desensitization. According to the service identifier ("com.primeton.IHouseApplyManage.queryHouseApplyBeans(HouseQueryBean)") and business identifier ("other") of this call, the specific service data desensitization rule is called. The above execution is automatically completed by dynamic proxy, without writing any business code;

[0369] The sample code for dynamic proxy execution of business logic and dynamic data desensitization is shown in the following table:

[0370] / / Query the service data desensitization rules based on the service ID and business ID

[0371] DesesitizationRule desesitizationRule=ServiceManage.queryDesensitizationRuleDetail("com.primeton.

[0372] IHouseApplyManage.queryHouseApplyBeans(HouseQueryBean)","other");

[0373] / / Execute the actual business logic and return the actual business data businessData

[0374] Object businessData=Business.query();

[0375] / / Desensitize the actual business data businessData and generate desensitized business data desesitizationBusinessData

[0376] Object desesitizationBusinessData=desesitizationRule.executeDesesitization(businessData);

[0377] 5. Return service data: This example returns the anonymized service data to the service caller and ends the service call.

[0378] Following the above steps, the definition and management of housing application application service data desensitization rules can be flexibly implemented according to business needs. Developers only need to configure the service data desensitization rules according to the above steps.

[0379] The specific implementation scheme of this embodiment can refer to the relevant description in the above embodiment, which will not be repeated here.

[0380] It can be understood that the same or similar parts of the above embodiments can be referenced to each other, and the contents not described in detail in some embodiments can refer to the same or similar contents in other embodiments.

[0381] It should be noted that, in the description of the present invention, the terms "first", "second", etc. are only used for descriptive purposes and cannot be understood as indicating or implying relative importance. In addition, in the description of the present invention, unless otherwise specified, the meaning of "plurality" refers to at least two.

[0382] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, segment or portion of code that includes one or more executable instructions for implementing the steps of a specific logical function or process, and the scope of the preferred embodiments of the present invention includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by those skilled in the art to which the embodiments of the present invention belong.

[0383] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution device. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0384] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the corresponding program may be stored in a computer-readable storage medium, which, when executed, includes one of the steps of the method embodiment or a combination thereof.

[0385] In addition, each functional unit in each embodiment of the present invention may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0386] The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.

[0387] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner.

[0388] The system, method, device, processor and computer-readable storage medium for dynamically configurable service data desensitization under the distributed architecture of the present invention are adopted. Since a mechanism for separating service data desensitization rules from business codes is implemented, and centralized dynamic configuration, hot update capabilities, and dynamic proxy technology are provided, service data desensitization and business code are decoupled, the problem of strong intrusion of service data desensitization rules into business codes is solved, the complexity of business codes is reduced, the readability of codes is improved, and different service data desensitization rules are defined in multiple business scenarios, which is completely transparent and friendly to client service calls; at the same time, the ability to dynamically adjust service data desensitization rules without stopping the business system is implemented, thereby enhancing system availability; in addition, a centralized management method for service data desensitization rules is provided, which supports service governance from a global perspective on service data desensitization of microservice applications under the distributed architecture of an enterprise, and has very strong promotion value.

[0389] In this specification, the present invention has been described with reference to specific embodiments thereof. However, it is apparent that various modifications and variations may be made without departing from the spirit and scope of the present invention. Therefore, the specification and drawings should be regarded as illustrative rather than restrictive.< / houseapplybean> < / houseapplybean> < / houseapplybean> < / houseapplybean> < / desensitizationrule> < / desensitizationrule> < / desensitizationrule> < / desensitizationrule> < / services> < / appinfo>

Claims

1. A dynamically configurable service data desensitization system implemented in a distributed architecture, characterized in that: The system comprises: The service management module is used to collect the application list and service list under the distributed architecture application system, persist the collected information, and provide a query management interface; A service data desensitization information definition module, connected to the service management module, is used to manage the data desensitization rule definition of specific services and notify the service data desensitization information proxy module of the change notification of the service data desensitization rule; A service data desensitization information management module, connected to the service data desensitization information definition module, is used to manage persistent service data desensitization rules and provide a management interface for service data desensitization rules; A service data desensitization information proxy module, connected to the service data desensitization information definition module and the service data desensitization information management module, for receiving a change notification from the service data desensitization information definition module, loading the service data desensitization rules from the service data desensitization information management module, and caching them; The service data desensitization execution module is connected to the service data desensitization information management module and the service data desensitization information agent module, and is used to execute the service data desensitization rules on the returned business data according to the specific service request and the corresponding service data desensitization rules, and return the desensitized business data to the caller.

2. The dynamically configurable service data desensitization system implemented under the distributed architecture according to claim 1, characterized in that: The service management module collects the application list and service list and persists the collected information, which specifically includes the following steps: (1.1) Find all application lists and application details from the microservice registration center; (1.2) From the collected microservice applications, scan the microservice applications one by one according to the service annotations, and collect the service list and service details under the microservice applications; (1.3) Persist the collected application and service information; (1.4) Query application list interface, query application information details interface according to application ID and service information list interface, query service information details interface according to service ID.

3. The dynamically configurable service data desensitization system implemented under the distributed architecture according to claim 1 is characterized in that: The operation process of the service data desensitization information definition module specifically includes the following steps: (2.1) Query the application list; (2.2) Specify the application that needs to be desensitized from the list of all queried applications; (2.3) According to the specified application, query all service lists from the service management module; (2.4) Select the specific service that requires data desensitization from the service list found; (2.5) According to the service data desensitization rule model, select the service data model that needs to be desensitized and define specific service data desensitization rules; (2.6) Persist the defined service data desensitization rules in the service data desensitization information management module; (2.7) Notify the service data desensitizing information proxy module of the corresponding application, and the service data desensitizing information proxy module reloads the changed service data desensitizing rules from the service data desensitizing information management module.

4. The dynamically configurable service data desensitization system implemented under the distributed architecture according to claim 1, characterized in that: The operation process of the service data desensitization information management module specifically includes the following steps: (3.1) Query all service data desensitization rules under the application based on the application ID; (3.2) Based on the service ID, query all service data desensitization rules under the service; (3.3) Query detailed information of service desensitization rules based on service ID and business ID; (3.4) Added new service data desensitization rules; (3.5) Update service data desensitization rules; (3.6) Delete service data desensitization rules.

5. The dynamically configurable service data desensitization system implemented under the distributed architecture according to claim 1, characterized in that: The service data desensitizing information proxy module also monitors the addition, modification, and deletion operations of the service data desensitizing rules in the service data desensitizing information definition module, and reloads the changed service data desensitizing rules from the service data desensitizing information management module.

6. The dynamically configurable service data desensitization system implemented under the distributed architecture according to claim 1, characterized in that: The operation process of the service data desensitization information proxy module specifically includes the following steps: (4.1) Start the service data desensitization proxy module; (4.2) Query all service data desensitization rules under the current application from the service data desensitization information management module; (4.3) Desensitizing the service data being searched for and storing it in a local cache or distributed cache; (4.4) Monitor the service data desensitization rule change notification sent by the service data desensitization information definition module. If a notification is received, execute (4.5); otherwise, continue to monitor; (4.5) Determine the type of service data desensitization rule notification received. If it is a new addition or modification type, execute (4.6); if it is a deletion type, execute (4.7); (4.6) According to the changed service identifier and business identifier, query the changed service data desensitization rules from the service data desensitization information management module and update the cache; (4.7) According to the changed service ID and business ID, delete the corresponding service data desensitization rules in the cache.

7. The dynamically configurable service data desensitization system implemented under a distributed architecture according to claim 1, characterized in that: The service data desensitization execution module uses dynamic proxy technology to intercept all service requests, and determines whether the current service requires data desensitization based on all service data proxy rules loaded in the service data desensitization information proxy module; If data desensitization is required, the returned service data will be desensitized; If data desensitization is not required, directly execute the specific business logic and return the service data.

8. The dynamically configurable service data desensitization system implemented under a distributed architecture according to claim 1, characterized in that: The operation process of the service data desensitization execution module specifically includes the following steps: (5.1) Dynamic proxy interception through service proxy; (5.2) All service data desensitization rules are loaded and the business logic of service calls is executed; (5.3) Determine whether the current service ID and business ID have a service data desensitization rule definition. If so, call the service data desensitization rule to desensitize the returned service data; if not, execute (5.4); (5.4) Return the service data to the service caller and end the service call.

9. A method for dynamically configurable service data desensitization processing in a distributed architecture based on the system of claim 1, characterized in that: The method comprises the following steps: (1) Collect the application list and service list under the distributed architecture application system, persist the collected information, and provide a query management interface; (2) Manage the definition of data desensitization rules for specific services and notify the service data desensitization information proxy module of changes to the service data desensitization rules; (3) Manage persistent service data desensitization rules and provide a management interface for service data desensitization rules; (4) receiving a change notification from the service data desensitization information definition module, loading the service data desensitization rules from the service data desensitization information management module, and caching them; (5) Based on the specific service request and the corresponding service data desensitization rules, the service data desensitization rules are executed on the returned business data, and the desensitized business data is returned to the caller.

10. The method for implementing dynamically configurable service data desensitization under a distributed architecture according to claim 1, characterized in that: The step (1) specifically comprises the following steps: (1.1) Find all application lists and application details from the microservice registration center; (1.2) From the collected microservice applications, scan the microservice applications one by one according to the service annotations, and collect the service list and service details under the microservice applications; (1.3) Persist the collected application and service information; (1.4) Query application list interface, query application information details interface according to application ID and service information list interface, query service information details interface according to service ID.

11. The method for implementing dynamically configurable service data desensitization under a distributed architecture according to claim 1, characterized in that: The step (2) specifically comprises the following steps: (2.1) Query the application list; (2.2) Specify the application that needs to be desensitized from the list of all queried applications; (2.3) According to the specified application, query all service lists from the service management module; (2.4) Select the specific service that requires data desensitization from the service list found; (2.5) According to the service data desensitization rule model, select the service data model that needs to be desensitized and define specific service data desensitization rules; (2.6) Persist the defined service data desensitization rules in the service data desensitization information management module; (2.7) Notify the service data desensitizing information proxy module of the corresponding application, and the service data desensitizing information proxy module reloads the changed service data desensitizing rules from the service data desensitizing information management module.

12. The method for implementing dynamically configurable service data desensitization under a distributed architecture according to claim 1, characterized in that: The step (3) specifically comprises the following steps: (3.1) Query all service data desensitization rules under the application based on the application ID; (3.2) Based on the service ID, query all service data desensitization rules under the service; (3.3) Query detailed information of service desensitization rules based on service ID and business ID; (3.4) Added new service data desensitization rules; (3.5) Update service data desensitization rules; (3.6) Delete service data desensitization rules.

13. The method for implementing dynamically configurable service data desensitization in a distributed architecture according to claim 1, characterized in that: The step (4) specifically comprises the following steps: (4.1) Start the service data desensitization proxy module; (4.2) Query all service data desensitization rules under the current application from the service data desensitization information management module; (4.3) Desensitizing the service data being searched for and storing it in a local cache or distributed cache; (4.4) Monitor the service data desensitization rule change notification sent by the service data desensitization information definition module. If a notification is received, execute (4.5); otherwise, continue to monitor; (4.5) Determine the type of service data desensitization rule notification received. If it is a new addition or modification type, execute (4.6); if it is a deletion type, execute (4.7); (4.6) According to the changed service identifier and business identifier, query the changed service data desensitization rules from the service data desensitization information management module and update the cache; (4.7) According to the changed service ID and business ID, delete the corresponding service data desensitization rules in the cache.

14. The method for implementing dynamically configurable service data desensitization in a distributed architecture according to claim 1, characterized in that: The step (5) specifically comprises the following steps: (5.1) Dynamic proxy interception through service proxy; (5.2) All service data desensitization rules are loaded and the business logic of service calls is executed; (5.3) Determine whether the current service ID and business ID have a service data desensitization rule definition. If so, call the service data desensitization rule to desensitize the returned service data; if not, execute (5.4); (5.4) Return the service data to the service caller and end the service call.

15. A device for implementing dynamically configurable service data desensitization processing in a distributed architecture, characterized in that: The device comprises: a processor configured to execute computer executable instructions; A memory storing one or more computer executable instructions, which, when executed by the processor, implements the various steps of the dynamically configurable service data desensitization method under the distributed architecture described in any one of claims 9 to 14.

16. A processor for implementing dynamically configurable service data desensitization processing in a distributed architecture, characterized in that: The processor is configured to execute computer-executable instructions. When the computer-executable instructions are executed by the processor, the various steps of the dynamically configurable service data desensitization method under the distributed architecture described in any one of claims 9 to 14 are implemented.

17. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and the computer program can be executed by a processor to implement the various steps of the dynamically configurable service data desensitization method under the distributed architecture described in any one of claims 9 to 14.

Images