Data desensitization method and device based on dynamic configuration, equipment and medium
Through the use of dynamic configuration methods in the process of data desensitization, dynamically adjust the rules of desensitization, solve the problem of low data desensitization efficiency and poor flexibility in the existing technology, and achieve more efficient and flexible data desensitization effects.
Patent Information
- Application Number
- CN202411464684.0
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-10-18
- Publication Date
- 2025-01-28
AI Technical Summary
The prior art is inefficient and poor in the process of data desensitization, especially when using third-party systems or passive codes, it is difficult to achieve efficient data desensitization.
The data desensitization method based on dynamic configuration is used to determine the desensitization rules through the preset desensitization interceptor, and dynamically adjust the desensitization rules after receiving the user modification instruction to meet the desensitization requirements of different data types.
It improves the efficiency and flexibility of data desensitization, so that without changing the code, it can also define specific desensitization rules for different data and simplify the data desensitization process.
Smart Images
Figure HDA0005093423260000011 
Figure HDA0005093423260000012 
Figure HDA0005093423260000021
Abstract
Description
Technical Field
[0001] The present application relates to the fields of information security and financial technology, and in particular to a data desensitization method, device, equipment and medium based on dynamic configuration. Background Art
[0002] With the development of computer technology, various financial apps are widely used in the promotion and sales of financial products. In the process of selling financial products, users' personal data is needed, which may contain sensitive information fields such as ID card number, bank card number, mobile phone number, address, etc. If these sensitive information is directly transmitted or stored in the APP interface without desensitization, once the interface is illegally accessed or the data is leaked, the user's personal privacy will face great risks. Therefore, it is necessary to desensitize sensitive data so that the data no longer displays real sensitive information during transmission and storage, thereby greatly reducing the risk of data leakage. However, due to the diversity and complexity of data types, in order to adapt to different needs, a variety of desensitization tools should be used to process the code. For large and complex systems, a lot of transformation work is required, such as system-wide investigation, finding un-desensitized interfaces, and transforming interfaces one by one and fields one by one, resulting in reduced efficiency of data desensitization; secondly, if the enterprise uses a third-party system or does not have source code, the difficulty of desensitization transformation will be further increased, reducing the flexibility of data desensitization. Therefore, how to improve the flexibility and efficiency of data desensitization has become an urgent problem to be solved. Summary of the invention
[0003] The present application provides a data desensitization method, apparatus, device and medium based on dynamic configuration to improve the flexibility and efficiency of data desensitization.
[0004] In a first aspect, the present application provides a data desensitization method based on dynamic configuration, the method comprising:
[0005] When receiving a service access request, determining a desensitization rule corresponding to the service access request based on a preset desensitization interceptor;
[0006] Upon receiving a desensitization rule modification instruction from a user, obtaining modification parameters, and processing the desensitization rule based on the modification parameters to obtain a target desensitization rule;
[0007] When responding to the service access request, the data corresponding to the service access request is processed based on the target desensitization rule to obtain the data in a desensitized form.
[0008] In a second aspect, the present application also provides a data desensitization device based on dynamic configuration, the device comprising:
[0009] A desensitization rule determination module, used to determine the desensitization rule corresponding to the service access request based on a preset desensitization interceptor when receiving a service access request;
[0010] A desensitization rule modification module is used to obtain modification parameters when receiving a desensitization rule modification instruction from a user, and process the desensitization rule based on the modification parameters to obtain a target desensitization rule;
[0011] The data desensitization processing module is used to process the data corresponding to the service access request based on the target desensitization rule when responding to the service access request to obtain the data in a desensitized form.
[0012] In a third aspect, the present application also provides a computer device, comprising a memory and a processor; the memory is used to store a computer program; the processor is used to execute the computer program and implement the data desensitization method based on dynamic configuration as described above when executing the computer program.
[0013] In a fourth aspect, the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the processor implements the data desensitization method based on dynamic configuration as described above.
[0014] The present application discloses a data desensitization method, device, equipment and medium based on dynamic configuration. When a service access request is received, the desensitization rule corresponding to the service access request is determined based on a preset desensitization interceptor; when a user's desensitization rule modification instruction is received, the modification parameters are obtained, and based on the modification parameters, the desensitization rule is processed to obtain the target desensitization rule; when responding to the service access request, the data corresponding to the service access request is processed based on the target desensitization rule to obtain the data in a desensitized form. The present application can use a desensitization interceptor for unified processing and dynamically apply different desensitization rules, so that specific desensitization rules can be defined for different data without changing the code, thereby improving the efficiency of data desensitization. Secondly, when the desensitization rules need to be modified, the desensitization rules are modified according to the modification parameters, thereby realizing the dynamic configuration of the desensitization rules, and the field desensitization configuration can be dynamically adjusted at any stage, thereby improving the flexibility of data desensitization. BRIEF DESCRIPTION OF THE DRAWINGS
[0015] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.
[0016] Figure 1 This is a schematic flow chart of a first embodiment of a data desensitization method based on dynamic configuration provided by an embodiment of the present application;
[0017] Figure 2 is a schematic flow chart of a second embodiment of a data desensitization method based on dynamic configuration provided by an embodiment of the present application;
[0018] Figure 3 is a schematic flow chart of a third embodiment of a data desensitization method based on dynamic configuration provided by an embodiment of the present application;
[0019] Figure 4 A schematic block diagram of a data desensitization device based on dynamic configuration provided in an embodiment of the present application;
[0020] Figure 5 A schematic block diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0021] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.
[0022] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.
[0023] It should be understood that the terms used in this application specification are only for the purpose of describing specific embodiments and are not intended to limit the application. As used in this application specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.
[0024] It should be further understood that the term “and / or” used in the specification and appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes these combinations.
[0025] Embodiments of the present application provide a method, device, equipment and medium for data desensitization based on dynamic configuration. Among them, the data desensitization method based on dynamic configuration can be applied to a server, and unified processing is performed by using a desensitizing interceptor, and different desensitization rules are dynamically applied, so that specific desensitization rules can be defined for different data without changing the code, thereby improving the efficiency of data desensitization. Secondly, when the desensitization rules need to be modified, the desensitization rules are modified according to the modified parameters, and the dynamic configuration of the desensitization rules is realized, and the field desensitization configuration can be dynamically adjusted at any stage, thereby improving the flexibility of data desensitization. Among them, the server can be an independent server or a server cluster.
[0026] In conjunction with the accompanying drawings, some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.
[0027] See also Figure 1 , Figure 1 It is a schematic flow chart of a data desensitization method based on dynamic configuration provided by an embodiment of the present application. The data desensitization method based on dynamic configuration can be applied to a server, and is used for unified processing by using a desensitizing interceptor, and dynamically applying different desensitization rules, so that specific desensitization rules can be defined for different data without changing the code, thereby improving data desensitization efficiency. Secondly, when the desensitization rules need to be modified, the desensitization rules are modified according to the modification parameters, and the dynamic configuration of the desensitization rules is realized, and the field desensitization configuration can be dynamically adjusted at any stage, thereby improving the flexibility of data desensitization.
[0028] like Figure 1 As shown, the data desensitization method based on dynamic configuration specifically includes steps S101 to S103.
[0029] S101. When receiving a service access request, determine a desensitization rule corresponding to the service access request based on a preset desensitization interceptor;
[0030] In one embodiment, when the service receives an access request, an interceptor intervenes in the process. The interceptor checks the URL (Uniform Resource Locator) or other features of the request and matches it with the preset desensitization rules to determine the desensitization rules applicable to the request.
[0031] In one embodiment, the anonymization rules can be stored in a database, a configuration file, or a memory. The rules can be defined based on factors such as URL patterns, request types, and user roles.
[0032] In one embodiment, the interceptor compares the requested URL and request header information to find a matching desensitization rule.
[0033] Furthermore, when a service access request is received, the desensitization rules corresponding to the service access request are determined based on a preset desensitizing interceptor, and the method also includes: when the service access request is received, obtaining an interface corresponding to the service access request; searching for an interceptor that matches the interface in the preset interceptors as the desensitizing interceptor, so as to determine the desensitization rules corresponding to the service access request based on the desensitizing interceptor.
[0034] In one embodiment, the technical specifications used by the backend service framework usually define a general interceptor, or the backend frameworks commonly used in enterprises, such as springMvc, springboot, etc., provide HandlerInterceptor interface, ResponseBodyAdvice interface, etc. Different interfaces can set different interceptors to intercept the service access requests they receive. In actual projects, appropriate interceptors can be selected as needed to intercept interface responses.
[0035] S102: upon receiving a desensitization rule modification instruction from a user, obtaining modification parameters, and processing the desensitization rule based on the modification parameters to obtain a target desensitization rule;
[0036] Furthermore, the processing of the desensitizing rule based on the modification parameter to obtain the target desensitizing rule includes: reconfiguring the desensitizing rule in a desensitizing rule configuration center based on the modification parameter to obtain the target desensitizing rule.
[0037] In one embodiment, when a user's desensitization rule modification instruction is received, it is necessary to obtain modification parameters and update the desensitization rules according to these parameters.
[0038] In one embodiment, the user can submit a modification request including new desensitization rules or modification instructions through an interface (such as a management interface, API (Application Programming Interface), etc.), and upload the modification parameters to the desensitization rule configuration center.
[0039] In one embodiment, the modification parameters are parsed and the desensitization rules in the memory are updated, which may include adding new rules, deleting old rules, or modifying existing rules.
[0040] In one embodiment, in the desensitization rule configuration center, desensitization rules can be defined and managed, including which fields need to be desensitized, the desensitization method, etc. Desensitization policies are dynamically generated according to the rules of the configuration center, and these policies are applied when processing requests.
[0041] S103. When responding to the service access request, based on the target desensitization rule, the data corresponding to the service access request is processed to obtain data in a desensitized form.
[0042] In one embodiment, when processing a response, the sensitive fields in the response data are traversed, and the values of the sensitive fields are desensitized according to the target desensitization rules, such as by replacing with asterisks, leaving blanks, or other methods.
[0043] The above-mentioned embodiments provide a data desensitization method, device, equipment and medium based on dynamic configuration. When a service access request is received, the desensitization rule corresponding to the service access request is determined based on a preset desensitization interceptor; when a user's desensitization rule modification instruction is received, the modification parameters are obtained, and based on the modification parameters, the desensitization rule is processed to obtain the target desensitization rule; when responding to the service access request, the data corresponding to the service access request is processed based on the target desensitization rule to obtain the data in a desensitized form. The present application can use a desensitization interceptor for unified processing and dynamically apply different desensitization rules, so that specific desensitization rules can be defined for different data without changing the code, thereby improving the efficiency of data desensitization. Secondly, when the desensitization rules need to be modified, the desensitization rules are modified according to the modification parameters, thereby realizing the dynamic configuration of the desensitization rules, and the field desensitization configuration can be dynamically adjusted at any stage, thereby improving the flexibility of data desensitization.
[0044] See also Figure 2 , Figure 2 This is a schematic flow chart of a data desensitization method based on dynamic configuration provided by an embodiment of the present application. The data desensitization method based on dynamic configuration can be applied to a server to desensitize each field through different desensitization strategies corresponding to each field, thereby improving the flexibility of data desensitization. At the same time, there is no need to process the business / interface code, so that interface development and desensitization processing are decoupled.
[0045] like Figure 2 As shown, the data desensitization method based on dynamic configuration specifically includes steps S201 to S202.
[0046] S201. Determine at least one desensitizing field based on the target desensitizing rule and the data corresponding to the service access request, and search for a desensitizing policy corresponding to each of the desensitizing fields;
[0047] S202. Perform desensitization processing on the desensitized field based on the desensitization strategy to obtain data in a desensitized form.
[0048] In one embodiment, according to the target desensitization rule, it is determined which fields in the data corresponding to the service access request need to be desensitized, which can be identified based on the field name, field type, field content or other features. For example, if the rule specifies that "telephone number" and "ID number" need to be desensitized, then these fields in the data need to be identified.
[0049] In one embodiment, after the desensitized fields are determined, the desensitization policy corresponding to each field is searched. The desensitization policy defines how to desensitize the field, such as replacing it with an asterisk, leaving it blank, using specific characters, etc. The desensitization policy can be stored in a configuration file, a database, or dynamically configured through a management interface.
[0050] In one embodiment, for each desensitized field, processing is performed according to the desensitization policy found. For example, if the policy is to use asterisk replacement, the system will replace some or all characters in the field value with asterisks. Desensitization processing can be performed on the entire field value or only on a part of the field value.
[0051] In one embodiment, the desensitized field value will replace the corresponding field value in the original data to generate new desensitized data, thereby ensuring that sensitive information is effectively hidden while maintaining the structure and format of the data.
[0052] Furthermore, based on the target desensitization rule and the data corresponding to the service access request, at least one desensitized field is determined, and a desensitization strategy corresponding to each desensitized field is searched, including: based on a preset matching rule, matching the preset desensitized field in the target desensitization rule with the field in the interface data to obtain a matching degree; the field whose matching degree is greater than or equal to a preset threshold is used as the desensitized field.
[0053] In one embodiment, the matching rule defines how to identify the matching relationship between the fields in the interface data and the fields defined in the preset desensitization rule. It can be defined based on the field name, field type, field content or other features, including fuzzy matching and exact matching.
[0054] In one embodiment, all preset desensitization fields are extracted from the target desensitization rule, including information such as field name and field type.
[0055] In one embodiment, all fields in the data are traversed. For each field, the degree of match between it and the preset desensitized field is calculated. The degree of match can be calculated in a variety of ways, for example: Complete match: The field name completely matches the name of the preset desensitized field. Fuzzy match: The field name partially matches the name of the preset desensitized field (for example, using a regular expression). Content match: The field content conforms to a specific pattern of the preset desensitized field (for example, using a regular expression to match the field value).
[0056] In one embodiment, a preset threshold is used to determine whether the fields are similar enough to be considered a match. The threshold can be adjusted according to actual needs.
[0057] In one embodiment, according to the calculated matching degree, fields whose matching degree is greater than or equal to a preset threshold are screened out, and the screened out fields are marked as desensitized fields.
[0058] Furthermore, the desensitizing fields are desensitized based on the desensitizing strategy to obtain data in a desensitized form, including: based on a preset desensitizing processor, the data corresponding to the service access request is traversed, and when the desensitized fields are traversed, the field values corresponding to the desensitized fields are desensitized according to the desensitizing strategies corresponding to the desensitized fields to obtain data in a desensitized form.
[0059] In one embodiment, the interface return parameter fields are traversed and the field values are processed according to the desensitization rules. Several desensitization fields can be defined in each desensitization rule, and a desensitization strategy can be specified for each field. During the data processing process, the fields defined in the rules support matching with the interface fields, and the desensitization strategy can be configured to be empty, replaced by the middle *, replaced by the last *, replaced by all characters *, etc., depending on the specific needs.
[0060] For example, the JSON data structure of the desensitization rule is as follows:
[0061] {
[0062] "urlPattern":" / api / url / demo",
[0063] "fields":[
[0064] {
[0065] "fieldName": "field name",
[0066] "matchType": "match accuracy",
[0067] “rule”: “desensitization strategy”
[0068] } ]
[0070] }
[0071] In one embodiment, the desensitization rules support hot update, dynamically adding / modifying / deleting desensitization rules during program execution, and making the rules effective.
[0072] The desensitization strategy may include: leaving it blank, retaining the first few digits and setting all other fields to *, retaining the last few digits and setting all other fields to *, retaining the first few digits and the last few digits and setting all other fields to *, or other desensitization strategies set as needed.
[0073] In one embodiment, the data fields returned by the interface are traversed. For example, in a project using Java as the backend development language, the Java reflection feature can be used to dynamically obtain the name and field value of the returned field when the program is running, and change the field value. In the process of traversing the fields, if there are fields of collection type or object type, its subfields need to be recursively traversed. In the process of recursively traversing the fields, the preset number of recursive layers should be obtained to prevent the occurrence of an infinite loop traversal.
[0074] In one embodiment, during the loop traversal process, the interface return field comparison processing strategy is checked and processed, and after the traversal is completed, the entire interface sensitive field desensitization processing is completed.
[0075] In the above embodiment, each field can correspond to a different desensitization strategy, which improves the flexibility of data desensitization. At the same time, there is no need to process the business / interface code, so that the interface development and desensitization processing are decoupled.
[0076] See also Figure 3 , Figure 3 It is a schematic flow chart of a data desensitization method based on dynamic configuration provided by an embodiment of the present application. The data desensitization method based on dynamic configuration can be applied in a server, for using a desensitization interceptor, different desensitization rules can be dynamically applied according to different URLs, so that specific desensitization rules can also be defined for different data without changing the code, and the desensitization rules can be centrally managed, and are easy to maintain and update. Secondly, by centrally managing the desensitization rules, and uniformly processing by an interceptor, code duplication can be reduced, development and maintenance work can be simplified, and desensitization efficiency is improved.
[0077] like Figure 3 As shown, the data desensitization method based on dynamic configuration specifically includes steps S301 to S304.
[0078] S301, based on the desensitizing interceptor, obtaining the uniform resource identifier of the service access request, and parsing the characteristics of the uniform resource identifier;
[0079] S302, matching the feature with a preset interception rule to obtain a matching result;
[0080] S303: When the matching result is that the uniform resource identifier has the same features as the interception rule, a search identifier of the desensitization rule is generated according to the same features;
[0081] S304: Query a preset rule database based on the search identifier to determine a desensitization rule corresponding to the service access request.
[0082] In one embodiment, when a service access request is received, first, the URL (Uniform Resource Identifier) of the request is obtained through a desensitizing interceptor. The URL usually contains the requested resource path and possible query parameters. Then, the URL is parsed to extract key features, which may include the path part of the URL, query parameters, fragment identifiers, etc.
[0083] In one embodiment, the interception rules are usually defined in a configuration file or in a database. Each rule may contain a specific URL pattern, query parameter pattern, etc.
[0084] In one embodiment, the parsed URL features are matched with preset interception rules, which can be achieved through regular expressions, string matching or other pattern matching techniques.
[0085] In one embodiment, if the feature of the URL matches the interception rule, a search identifier is generated. This identifier is usually based on the matched feature and is used to quickly locate the specific desensitization rule in the rule database.
[0086] In a specific embodiment, the current request URL is obtained in the response interceptor, and matched with the pre-configured interception rules according to the URL characteristics. During the matching process, tools such as AntPathMatcher can be used to obtain the rule ID with the best matching degree (i.e., the query identifier, usually the one with the highest URL matching degree) according to the matching priority.
[0087] In a specific embodiment, the interception rule may include one or more URL patterns and corresponding processing strategies (such as desensitization rules, permission checks, etc.). For example, when the URL contains / api / user / , the desensitization strategy is applied to protect user data.
[0088] Example, interception rule:
[0089] / api / user / **: matches all URLs starting with / api / user / .
[0090] / api / **: matches all URLs starting with / api / .
[0091] In the response interceptor, get the URL of the current request and use AntPathMatcher to check whether the URL matches the predefined rules. The matching process usually involves the following steps: Get the full URL of the request from the request object. For each rule, use the match method of AntPathMatcher to check whether the current URL matches the rule. If there are multiple rules that match the current URL, select the rule with the highest match (that is, the most specific match). For example, if / api / user / profile matches both / api / user / ** and / api / **, then / api / user / ** is selected because / api / user / ** is more specific.
[0092] In one embodiment, the search identifier may be a simple string or a complex structure, depending on the specific requirements of the desensitization rule. For example, it may include a combination of the path portion of the URL and the query parameters.
[0093] In one embodiment, the generated search identifier is used to query in a preset rule database. This database contains all possible desensitization rules and their corresponding processing strategies. Specifically, the desensitization rule details are queried according to the matched rule ID. To speed up the query, it is usually possible to query from a cache (such as Redis), or from a local configuration file or database.
[0094] In one embodiment, the desensitization rule corresponding to the service access request is determined according to the query result. If a matching desensitization rule is found, the rule will be used for subsequent data processing.
[0095] In the above embodiment, by using a desensitization interceptor, different desensitization rules can be dynamically applied according to different URLs, so that specific desensitization rules can be defined for different data without changing the code, and the desensitization rules can be centrally managed for easy maintenance and updating. Secondly, by centrally managing the desensitization rules and uniformly processing them through the interceptor, code duplication can be reduced, development and maintenance work can be simplified, and data desensitization efficiency can be improved.
[0096] See also Figure 4 , Figure 4 The embodiment of the present application provides a schematic block diagram of a data desensitization device based on dynamic configuration, and the data desensitization device based on dynamic configuration is used to execute the aforementioned data desensitization method based on dynamic configuration. The data desensitization device based on dynamic configuration can be configured on a server.
[0097] like Figure 4 As shown, the data desensitization device 400 based on dynamic configuration includes:
[0098] The desensitization rule determination module 401 is used to determine the desensitization rule corresponding to the service access request based on a preset desensitization interceptor when receiving the service access request;
[0099] The desensitization rule modification module 402 is used to obtain modification parameters when receiving a desensitization rule modification instruction from a user, and process the desensitization rule based on the modification parameters to obtain a target desensitization rule;
[0100] The data desensitization processing module 403 is used to process the data corresponding to the service access request based on the target desensitization rule when responding to the service access request to obtain the data in a desensitized form.
[0101] Furthermore, the data desensitization processing module 403 includes:
[0102] A desensitizing field determining unit, configured to determine at least one desensitizing field based on the target desensitizing rule and the data corresponding to the service access request, and to search for a desensitizing policy corresponding to each of the desensitizing fields;
[0103] The data desensitization unit is used to perform desensitization processing on the desensitized field based on the desensitization strategy to obtain data in a desensitized form.
[0104] Furthermore, the desensitized field determination unit includes:
[0105] A matching degree obtaining subunit, used for matching the preset desensitization field in the target desensitization rule with the field in the interface data based on a preset matching rule to obtain a matching degree;
[0106] The desensitized field determination subunit is used to use the field whose matching degree is greater than or equal to a preset threshold as the desensitized field.
[0107] Furthermore, the data desensitizing unit is specifically used to traverse the data corresponding to the service access request based on a preset desensitizing processor, and when traversing to the desensitized field, desensitize the field value corresponding to the desensitized field according to the desensitization strategy corresponding to each desensitized field to obtain data in a desensitized form.
[0108] Furthermore, the desensitization rule determination module 401 includes:
[0109] A uniform resource identifier acquisition unit, used to acquire the uniform resource identifier of the service access request based on the desensitizing interceptor, and parse the characteristics of the uniform resource identifier;
[0110] A matching result obtaining unit, used to match the feature with a preset interception rule to obtain a matching result;
[0111] A search indication generating unit, configured to generate a search indication of a desensitization rule according to the same characteristics when the matching result indicates that the uniform resource identifier has the same characteristics as the interception rule;
[0112] The desensitization rule determination unit is used to query in a preset rule database based on the search identifier to determine the desensitization rule corresponding to the service access request.
[0113] Furthermore, the desensitization rule determination module 401 further includes:
[0114] An interface acquisition unit, configured to acquire an interface corresponding to the service access request upon receiving the service access request;
[0115] The interceptor determination unit is used to search for an interceptor matching the interface in preset interceptors as the desensitizing interceptor, so as to determine the desensitizing rule corresponding to the service access request based on the desensitizing interceptor.
[0116] Furthermore, the desensitization rule modification module 402 is specifically used to reconfigure the desensitization rule in the desensitization rule configuration center based on the modification parameters to obtain the target desensitization rule.
[0117] It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described device and each module can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.
[0118] The above-mentioned device can be implemented in the form of a computer program. Figure 5 Runs on the computer device shown.
[0119] See also Figure 5 , Figure 5 1 is a schematic block diagram of a computer device provided in an embodiment of the present application. The computer device may be a server.
[0120] See also Figure 5 The computer device includes a processor, a memory and a network interface connected through a system bus, wherein the memory may include a non-volatile storage medium and an internal memory.
[0121] The non-volatile storage medium can store an operating system and a computer program. The computer program includes program instructions, which, when executed, can cause a processor to execute any data desensitization method based on dynamic configuration.
[0122] The processor is used to provide computing and control capabilities and support the operation of the entire computer equipment.
[0123] The internal memory provides an environment for the operation of the computer program in the non-volatile storage medium. When the computer program is executed by the processor, the processor can execute any data desensitization method based on dynamic configuration.
[0124] The network interface is used for network communication, such as sending assigned tasks, etc. Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.
[0125] It should be understood that the processor may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.
[0126] In one embodiment, the processor is used to run a computer program stored in the memory to implement the following steps:
[0127] When receiving a service access request, determining a desensitization rule corresponding to the service access request based on a preset desensitization interceptor;
[0128] Upon receiving a desensitization rule modification instruction from a user, obtaining modification parameters, and processing the desensitization rule based on the modification parameters to obtain a target desensitization rule;
[0129] When responding to the service access request, the data corresponding to the service access request is processed based on the target desensitization rule to obtain the data in a desensitized form.
[0130] In one embodiment, when the processor processes the data corresponding to the service access request based on the target desensitization rule to obtain the desensitized data, it is used to implement:
[0131] Based on the target desensitization rule and the data corresponding to the service access request, determine at least one desensitization field, and search for a desensitization policy corresponding to each of the desensitization fields;
[0132] The desensitized field is desensitized based on the desensitization strategy to obtain data in a desensitized form.
[0133] In one embodiment, when the processor determines at least one desensitizing field based on the target desensitizing rule and the data corresponding to the service access request, and searches for the desensitizing policy corresponding to each of the desensitizing fields, the processor is used to implement:
[0134] Based on a preset matching rule, matching the preset desensitization field in the target desensitization rule with the field in the interface data to obtain a matching degree;
[0135] The field whose matching degree is greater than or equal to the preset threshold is used as the desensitized field.
[0136] In one embodiment, when the processor performs desensitization processing on the desensitized field based on the desensitization strategy to obtain data in a desensitized form, the processor is used to implement:
[0137] Based on the preset desensitizing processor, the data corresponding to the service access request is traversed. When the desensitized field is traversed, the field value corresponding to the desensitized field is desensitized according to the desensitization strategy corresponding to each desensitized field to obtain the data in desensitized form.
[0138] In one embodiment, when the processor determines the desensitization rule corresponding to the service access request based on a preset desensitization interceptor, it is used to implement:
[0139] Based on the desensitizing interceptor, obtaining the uniform resource identifier of the service access request, and parsing the characteristics of the uniform resource identifier;
[0140] Matching the features with preset interception rules to obtain matching results;
[0141] When the matching result is that the uniform resource identifier has the same features as the interception rule, a search identifier of the desensitization rule is generated according to the same features;
[0142] Based on the search identifier, a query is performed in a preset rule database to determine the desensitization rule corresponding to the service access request.
[0143] In one embodiment, when the processor determines the desensitization rule corresponding to the service access request based on a preset desensitization interceptor when receiving the service access request, it is also used to implement:
[0144] Upon receiving the service access request, obtaining an interface corresponding to the service access request;
[0145] An interceptor matching the interface is searched in preset interceptors as the desensitizing interceptor, so as to determine a desensitizing rule corresponding to the service access request based on the desensitizing interceptor.
[0146] In one embodiment, when the processor processes the desensitization rule based on the modification parameter to obtain the target desensitization rule, it is used to implement:
[0147] Based on the modified parameters, the desensitization rules are reconfigured in a desensitization rule configuration center to obtain the target desensitization rules.
[0148] A computer-readable storage medium is also provided in an embodiment of the present application, wherein the computer-readable storage medium stores a computer program, wherein the computer program includes program instructions, and the processor executes the program instructions to implement any data desensitization method based on dynamic configuration provided in an embodiment of the present application.
[0149] The computer-readable storage medium may be an internal storage unit of the computer device described in the foregoing embodiment, such as a hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a smart memory card (SmartMedia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc., equipped on the computer device.
[0150] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.
Claims
1. A data desensitization method based on dynamic configuration, characterized in that: include: When receiving a service access request, determining a desensitization rule corresponding to the service access request based on a preset desensitization interceptor; Upon receiving a desensitization rule modification instruction from a user, obtaining modification parameters, and processing the desensitization rule based on the modification parameters to obtain a target desensitization rule; When responding to the service access request, the data corresponding to the service access request is processed based on the target desensitization rule to obtain the data in a desensitized form.
2. The data desensitization method based on dynamic configuration according to claim 1 is characterized in that: The processing of the data corresponding to the service access request based on the target desensitization rule to obtain the data in a desensitized form includes: Based on the target desensitization rule and the data corresponding to the service access request, determine at least one desensitization field, and search for a desensitization policy corresponding to each of the desensitization fields; The desensitizing field is desensitized based on the desensitizing strategy to obtain data in a desensitized form.
3. The data desensitization method based on dynamic configuration according to claim 2 is characterized in that: The determining at least one desensitizing field based on the target desensitizing rule and the data corresponding to the service access request, and searching for a desensitizing policy corresponding to each of the desensitizing fields, includes: Based on a preset matching rule, matching the preset desensitization field in the target desensitization rule with the field in the interface data to obtain a matching degree; The field whose matching degree is greater than or equal to the preset threshold is used as the desensitized field.
4. The data desensitization method based on dynamic configuration according to claim 2 is characterized in that: The desensitizing the desensitized field based on the desensitizing strategy to obtain the data in a desensitized form includes: Based on the preset desensitizing processor, the data corresponding to the service access request is traversed. When the desensitized field is traversed, the field value corresponding to the desensitized field is desensitized according to the desensitization strategy corresponding to each desensitized field to obtain the data in desensitized form.
5. The data desensitization method based on dynamic configuration according to claim 1 is characterized in that: The step of determining the desensitization rule corresponding to the service access request based on the preset desensitization interceptor includes: Based on the desensitizing interceptor, obtaining the uniform resource identifier of the service access request, and parsing the characteristics of the uniform resource identifier; Matching the features with preset interception rules to obtain matching results; When the matching result is that the uniform resource identifier has the same features as the interception rule, a search identifier of the desensitization rule is generated according to the same features; Based on the search identifier, a query is performed in a preset rule database to determine the desensitization rule corresponding to the service access request.
6. The data desensitization method based on dynamic configuration according to claim 1, characterized in that: The method of determining, upon receiving a service access request, a desensitization rule corresponding to the service access request based on a preset desensitization interceptor, further includes: Upon receiving the service access request, obtaining an interface corresponding to the service access request; An interceptor matching the interface is searched in preset interceptors as the desensitizing interceptor, so as to determine a desensitizing rule corresponding to the service access request based on the desensitizing interceptor.
7. The data desensitization method based on dynamic configuration according to any one of claims 1 to 6, characterized in that: The step of processing the desensitization rule based on the modification parameter to obtain a target desensitization rule includes: Based on the modified parameters, the desensitization rules are reconfigured in a desensitization rule configuration center to obtain the target desensitization rules.
8. A data desensitization device based on dynamic configuration, characterized in that: include: A desensitization rule determination module is used to determine the desensitization rule corresponding to the service access request based on a preset desensitization interceptor when receiving a service access request; A desensitization rule modification module is used to obtain modification parameters when receiving a desensitization rule modification instruction from a user, and process the desensitization rule based on the modification parameters to obtain a target desensitization rule; The data desensitization processing module is used to process the data corresponding to the service access request based on the target desensitization rule when responding to the service access request to obtain the data in a desensitized form.
9. A computer device, characterized in that: The computer device includes a memory and a processor; The memory is used to store computer programs; The processor is used to execute the computer program and implement the data desensitization method based on dynamic configuration as described in any one of claims 1 to 7 when executing the computer program.
10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, which, when executed by a processor, enables the processor to implement the data desensitization method based on dynamic configuration as described in any one of claims 1 to 7.