Personal sensitive information processing method and device, electronic equipment and storage medium

Abstract

The invention provides a personal sensitive information processing method and device, electronic equipment and a storage medium, and the method comprises the steps: receiving target configuration information sent by a server; according to the target configuration information, performing personal sensitive information scanning on the to-be-scanned file to obtain a sensitive information scanning result; wherein the sensitive information scanning result comprises file information of a sensitive file in the to-be-scanned file and statistical information of personal sensitive information in the sensitive file; sending a sensitive information scanning result to a server; receiving a processing strategy of the sensitive file sent by the server; wherein the processing strategy is determined by the server side according to a sensitive information scanning result and a sensitive file record in a database; and according to the disposal strategy, performing disposal operation on the sensitive file. According to the method, the sensitive file is processed according to the processing strategy issued by the server based on the sensitive information scanning result, so that the processing accuracy and processing efficiency of the sensitive file can be improved, and the security of personal sensitive information is improved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method, device, electronic device and storage medium for processing personal sensitive information. Background Art

[0002] With the accelerated development of Internet information technology, more and more attention is paid to data security, and more and more attention is paid to the security of personal sensitive information. In related technologies, employees can be responsible for deleting electronic materials containing personal sensitive information of customers on their personal terminals within one month from the date of obtaining customer data, but this processing method is time-consuming and labor-intensive, and has low accuracy. Summary of the invention

[0003] The present application aims to solve one of the technical problems in the related art at least to some extent.

[0004] To this end, the first purpose of this application is to propose a method for processing personal sensitive information to achieve accurate and timely disposal of sensitive files.

[0005] The second objective of this application is to provide a device for processing personal sensitive information.

[0006] The third objective of the present application is to provide an electronic device.

[0007] A fourth objective of the present application is to provide a computer-readable storage medium.

[0008] A fifth object of the present application is to provide a computer program product.

[0009] To achieve the above objectives, the first embodiment of the present application proposes a method for processing personal sensitive information, including:

[0010] Receive target configuration information sent by the server;

[0011] According to the target configuration information, the file to be scanned is scanned for personal sensitive information to obtain a sensitive information scanning result; wherein the sensitive information scanning result includes file information of sensitive files in the file to be scanned and statistical information of personal sensitive information in the sensitive files;

[0012] Sending the sensitive information scanning result to the server;

[0013] Receiving a disposal strategy for the sensitive file sent by the server; wherein the disposal strategy is determined by the server according to the sensitive information scanning result and the sensitive file record in the database;

[0014] According to the disposal policy, a disposal operation is performed on the sensitive file.

[0015] To achieve the above purpose, the second embodiment of the present application proposes a method for processing personal sensitive information, including:

[0016] Send target configuration information to the client;

[0017] Receiving a sensitive information scanning result sent by the client; wherein the sensitive information scanning result is obtained by scanning the file to be scanned for personal sensitive information according to the target configuration information, and the sensitive information scanning result includes file information of the sensitive file in the file to be scanned and statistical information of personal sensitive information in the sensitive file;

[0018] Determine a disposal strategy for the sensitive files based on the sensitive information scanning results and the sensitive file records in the database;

[0019] The processing policy is sent to the client, so that the client performs a processing operation on the sensitive file according to the processing policy.

[0020] To achieve the above-mentioned purpose, the third aspect of the present application proposes a device for processing personal sensitive information, including:

[0021] A receiving module, used for receiving target configuration information sent by the server;

[0022] A scanning module, used to scan the files to be scanned for personal sensitive information according to the target configuration information, so as to obtain sensitive information scanning results; wherein the sensitive information scanning results include file information of sensitive files in the files to be scanned and statistical information of personal sensitive information in the sensitive files;

[0023] A sending module, used to send the sensitive information scanning result to the server;

[0024] The receiving module is further used to receive a disposal strategy for the sensitive file sent by the server; wherein the disposal strategy is determined by the server according to the sensitive information scanning result and the sensitive file record in the database;

[0025] A disposal module is used to perform a disposal operation on the sensitive file according to the disposal strategy.

[0026] To achieve the above-mentioned purpose, the fourth aspect of the present application proposes a device for processing personal sensitive information, including:

[0027] A sending module, used for sending target configuration information to the client;

[0028] A receiving module, configured to receive a sensitive information scanning result sent by the client; wherein the sensitive information scanning result is obtained by scanning the file to be scanned for personal sensitive information according to the target configuration information, and the sensitive information scanning result includes file information of sensitive files in the file to be scanned and statistical information of personal sensitive information in the sensitive file;

[0029] A determination module, used to determine a disposal strategy for the sensitive file according to the sensitive information scanning result and the sensitive file records in the database;

[0030] The sending module is further used to send the processing strategy to the client, so that the client performs a processing operation on the sensitive file according to the processing strategy.

[0031] To achieve the above-mentioned purpose, a fifth aspect of the present application provides an electronic device, including:

[0032] A processor, and a memory communicatively connected to the processor;

[0033] The memory stores computer-executable instructions;

[0034] The processor executes the computer-executable instructions stored in the memory to implement the method as described in the first aspect embodiment above, or implements the method as described in the second aspect embodiment above.

[0035] To achieve the above-mentioned objectives, the sixth aspect embodiment of the present application proposes a computer-readable storage medium, in which computer execution instructions are stored. When the computer execution instructions are executed by a processor, they are used to implement the method described in the first aspect embodiment above, or to implement the method described in the second aspect embodiment above.

[0036] To achieve the above objectives, the seventh aspect of the present application proposes a computer program product, which, when executed by a processor, implements the method described in the first aspect, or implements the method described in the second aspect.

[0037] The personal sensitive information processing method, device, electronic device and storage medium provided by the present application perform personal sensitive information scanning on the scanned file according to the target configuration information received from the server, obtain the sensitive information scanning result, send the sensitive information scanning result to the server, receive the sensitive information disposal strategy determined by the server based on the sensitive information scanning result, and perform disposal operations on the sensitive file based on the disposal strategy. Therefore, by disposing sensitive files according to the disposal strategy issued by the server based on the sensitive information scanning result, the accuracy, timeliness and disposal efficiency of sensitive file disposal can be improved, thereby improving the security of personal sensitive information. In addition, personal sensitive information scanning based on the target configuration information is highly flexible and can meet the personalized needs of personal sensitive information scanning.

[0038] Additional aspects and advantages of the present application will be given in part in the description below, and in part will become apparent from the description below, or will be learned through the practice of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] The above and / or additional aspects and advantages of the present application will become apparent and easily understood from the following description of the embodiments in conjunction with the accompanying drawings, in which:

[0040] Figure 1 A flowchart of a method for processing personal sensitive information provided in an embodiment of the present application;

[0041] Figure 2 A flowchart of another method for processing personal sensitive information provided in an embodiment of the present application;

[0042] Figure 3 A flowchart of another method for processing personal sensitive information provided in an embodiment of the present application;

[0043] Figure 4 A schematic diagram of a process for processing personal sensitive information provided in an embodiment of the present application;

[0044] Figure 5 A schematic diagram of the structure of a device for processing personal sensitive information provided in an embodiment of the present application;

[0045] Figure 6 A schematic diagram of the structure of another device for processing personal sensitive information provided in an embodiment of the present application. DETAILED DESCRIPTION

[0046] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to be used to explain the present application, and should not be construed as limiting the present application.

[0047] The following describes the method and device for processing personal sensitive information in an embodiment of the present application with reference to the accompanying drawings.

[0048] Figure 1 A flowchart of a method for processing personal sensitive information provided in an embodiment of the present application. The method for processing personal sensitive information in an embodiment of the present application can be executed by a client.

[0049] like Figure 1 As shown, the method for processing the personal sensitive information includes the following steps:

[0050] Step 101: Receive target configuration information sent by a server.

[0051] In the present application, the target configuration information may refer to the configuration information of the client, and the target configuration information may be used by the client to scan the personal sensitive information on the terminal where the client is located. That is to say, the client may use the target configuration information to scan the personal sensitive information on the terminal where the client is located.

[0052] Exemplarily, the target configuration information may include scanning strategies, sensitivity thresholds, system thresholds, etc. Among them, the scanning strategies may include scanning intervals, etc., the sensitivity thresholds may be used to determine whether a file containing personal sensitive information is a sensitive file, and the system thresholds may be used to determine whether the performance of the terminal where the client is located can meet the personal sensitive information scanning requirements.

[0053] In this application, after the client on the terminal is started, it can send a configuration information acquisition request to the server. After receiving the configuration information acquisition request, the server can determine the target configuration information of the client and send the target configuration information to the client. Optionally, the server can actively send the target configuration information to the client, so that the client receives the target configuration information sent by the server.

[0054] Step 102: Scan the file to be scanned for personal sensitive information according to the target configuration information to obtain a sensitive information scanning result.

[0055] Exemplarily, the target configuration information includes a scanning strategy such as a scanning interval, and the client can use the personal sensitive identification rule to perform a personal sensitive information scan on the files to be scanned on the terminal to which the client belongs to determine the sensitive information scanning result. The files to be scanned here can be all files on the terminal, or files of a specified type or a specified location, which is not limited.

[0056] The sensitive information scanning results may include file information of sensitive files in the files to be scanned and statistical information of personal sensitive information in sensitive files. File information may include file signatures of sensitive files, attribute information of sensitive files, etc. The attribute information of sensitive files may include, for example, the name, type, location, size, creation time, modification time, etc. of sensitive files. Statistical information of personal sensitive information refers to the number of each type of personal sensitive information contained in sensitive files.

[0057] Exemplarily, the sensitive information scanning result may be represented by a record. For example, one record corresponds to one sensitive file. The record may include file information of the sensitive file, statistical information of personal sensitive information in the sensitive file, etc.

[0058] It should be noted that there can be one or more sensitive files in the files to be scanned, and there is no limitation on this.

[0059] Step 103: Send the sensitive information scanning result to the server.

[0060] In this application, the client can send the sensitive information scanning results to the server, and the server can update the database based on the sensitive information scanning results. For example, if a sensitive file in the sensitive information scanning results is not recorded in the database, the file information of the sensitive file and the statistical information of personal sensitive information can be added to the database.

[0061] Step 104: Receive a sensitive file handling strategy sent by the server.

[0062] In this application, the server can also determine the disposal strategy of the currently scanned sensitive files according to the sensitive information scanning results, and send the disposal strategy to the client. The disposal strategy may include deletion, no action, action reminder, etc.

[0063] Step 105: Perform disposal operations on sensitive files according to the disposal policy.

[0064] Exemplarily, if the handling policy of sensitive files is deletion, the sensitive files can be deleted. If the handling policy of sensitive files is no action, the sensitive files are retained. Exemplarily, if the handling policy of sensitive files is deletion reminder, deletion prompt information can be displayed to prompt the user to perform the deletion operation. The deletion prompt information may include file information, deletion time limit, etc. The deletion time limit may be, for example, a time before which the file is to be deleted.

[0065] In the embodiment of the present application, personal sensitive information is scanned on the scanned file according to the target configuration information received from the server, the sensitive information scanning result is obtained, and the sensitive information scanning result is sent to the server, the sensitive information disposal strategy determined by the server based on the sensitive information scanning result is received, and the disposal operation is performed on the sensitive file based on the disposal strategy. Therefore, the sensitive file is disposed according to the disposal strategy issued by the server based on the sensitive information scanning result, which can improve the accuracy, timeliness and disposal efficiency of sensitive file disposal, thereby improving the security of personal sensitive information. In addition, personal sensitive information scanning based on the target configuration information is highly flexible and can meet the personalized needs of personal sensitive information scanning.

[0066] Figure 2 A flowchart of another method for processing personal sensitive information provided in an embodiment of the present application.

[0067] like Figure 2 As shown, the method for processing personal sensitive information may include the following steps:

[0068] Step 201: Receive target configuration information sent by the server.

[0069] In the present application, step 201 can be implemented in any of the embodiments of the present application, so it will not be described in detail here.

[0070] Exemplarily, the client may send a configuration information acquisition request to the server, wherein the configuration information acquisition request may include identification information of the terminal to which the client belongs. The server stores configuration information set for the client on the terminal according to each belonging level of the terminal. After receiving the configuration information acquisition request, the server may obtain the configuration information of each belonging level of the terminal and the configuration priority of each belonging level based on the identification information, and then determine which belonging level's configuration information to use according to the configuration information and configuration priority of each belonging level, and send the configuration information to the client.

[0071] Exemplarily, the client sends a configuration information acquisition request to the server after startup, or the client can send a configuration information acquisition request to the server every preset time. For example, the client can be set to start automatically when it is powered on, and after startup, it first sends a configuration information acquisition request to the server.

[0072] Therefore, the client can reduce and save resources by sending a configuration information request to the server to obtain the target configuration information, and the target configuration information is determined based on the configuration information and configuration priority of each belonging level. Therefore, personal sensitive information scanning based on the target configuration information can meet personalized needs.

[0073] Step 202: Scan the file to be scanned for personal sensitive information to determine the quantity of various types of personal sensitive information contained in the file to be scanned.

[0074] In this application, the client can use personal sensitive information identification rules to scan the files to be scanned for personal sensitive information to determine which personal sensitive information is included in the files to be scanned and the amount of each type of personal sensitive information.

[0075] For example, types of sensitive personal information may include ID number, mobile phone number, license plate number, etc.

[0076] Exemplarily, the target configuration information may include a load threshold, and the client may obtain the current load of the central processing unit (CPU) of the terminal to which the client belongs. If the current load is less than the load threshold, the file to be scanned may be scanned for personal sensitive information to determine the amount of various types of personal sensitive information contained in the file to be scanned. If the current load is greater than the load threshold, the file to be scanned is sent to the server, and the server performs the personal sensitive information scan on the file to be scanned on behalf of the client to obtain the sensitive information scan result, and sends the sensitive information scan result to the client, and the client receives the sensitive information scan result sent by the server.

[0077] Therefore, when the current load of the CPU is relatively large, the server replaces the client to scan personal sensitive information, which reduces the burden on the terminal and saves terminal resources.

[0078] It should be noted that if the current load of the CPU is equal to the load threshold, the client can scan the scanned file for personal sensitive information, or it can be sent to the server, and the server will scan the scanned file for personal sensitive information instead of the client. The specific choice can be made according to actual needs, and this application does not limit this.

[0079] Exemplarily, the target configuration information may include a utilization threshold, and the client may obtain the current utilization of the CPU of the terminal to which the client belongs. If the current utilization is less than the utilization threshold, the file to be scanned may be scanned for personal sensitive information to determine the amount of various types of personal sensitive information contained in the file to be scanned. If the current utilization is greater than the utilization threshold, the client may send the file to be scanned to the server, and the server will perform the personal sensitive information scan on the file to be scanned on behalf of the client to obtain the sensitive information scan result, and send the sensitive information scan result to the client, and the client receives the sensitive information scan result sent by the server.

[0080] Therefore, when the CPU utilization is relatively high, the server replaces the client to scan personal sensitive information, which reduces the burden on the terminal and saves terminal resources.

[0081] It should be noted that if the current CPU utilization is equal to the utilization threshold, the client can scan the scanned file for personal sensitive information, or it can be sent to the server, and the server will scan the scanned file for personal sensitive information instead of the client. The specific choice can be made according to actual needs, and this application does not limit this.

[0082] Step 203: In response to the sum of the quantities of various types of personal sensitive information being greater than a sensitivity threshold, the file to be scanned is determined to be a sensitive file.

[0083] In the present application, the target configuration information may include a sensitivity threshold. If the sum of the quantities of various types of personal sensitive information in a file to be scanned is greater than the sensitivity threshold, the scanned file may be determined as a sensitive file, thereby identifying which files in the file to be scanned are sensitive files.

[0084] Optionally, the target configuration information may include sensitivity thresholds for various types of personal sensitive information. If the amount of any type of personal sensitive information in a file to be scanned is greater than the sensitivity threshold for such type of personal sensitive information, the file to be scanned may be determined to be a sensitive file.

[0085] Step 204, obtaining the sensitive information scanning result according to the file information of the sensitive file and the quantity of various types of personal sensitive information.

[0086] In this application, a file signature of a sensitive file can be generated based on the content of the sensitive file, and the file information of the sensitive file can be obtained based on the file signature and the attribute information of the sensitive file. Then, based on the file information, the number of various types of personal sensitive information, etc., the sensitive information scanning result can be obtained.

[0087] Step 205: Send the sensitive information scanning result to the server.

[0088] Step 206: Receive the sensitive file handling strategy sent by the server.

[0089] Step 207: Perform disposal operations on the sensitive files according to the disposal policy.

[0090] In the present application, steps 205 to 207 may be implemented in any of the embodiments of the present application, and therefore will not be described in detail herein.

[0091] In an embodiment of the present application, the client can determine sensitive files from the files to be scanned based on the number of various types of personal sensitive information contained in the files to be scanned and the sensitivity threshold in the target configuration information, thereby improving the accuracy and flexibility of sensitive file identification. In addition, based on the file information of the sensitive files and the number of various types of personal sensitive information in the sensitive files, the sensitive information scanning results are obtained, which enriches the scanning results and improves the accuracy of the scanning results.

[0092] Figure 3 A flowchart of another method for processing sensitive personal information provided in an embodiment of the present application. The method for processing sensitive personal information in an embodiment of the present application can be executed by a server.

[0093] like Figure 3 As shown, the method for processing personal sensitive information may include the following steps:

[0094] Step 301: Send target configuration information to the client.

[0095] In this application, scanning configuration can be performed in advance for the client on each terminal. Configuration items may include management strategy, scanning strategy, sensitivity threshold, load threshold, etc. The management strategy is used to manage the client, such as version management, whether to upgrade, whether to retain a certain version, etc. Thus, the server can send the target configuration information of the pre-configured client to the client.

[0096] Optionally, each terminal can be connected to a desktop management system, and the server can obtain the terminal's ownership information through the desktop management system, such as which person the terminal belongs to, which team the person belongs to, which department the team belongs to, which organization the department belongs to, and other ownership level information. Based on the terminal's ownership level information, the client's scanning configuration can be dynamically configured at different granularities, such as scanning configuration of the client at the individual granularity, or scanning configuration of the client at the team granularity, or scanning configuration of the client at the department granularity, etc., so that the configuration information of each ownership level can be obtained. Therefore, the server can send the configuration information of each ownership level to the client, and the client decides which level of configuration information to use, or the server sends the configuration information of one of the ownership levels to the client. The specific selection can be based on actual needs and is not limited to this.

[0097] It should be noted that if the terminal has multiple belonging levels, the client can be scanned and configured on some or all of the belonging levels, and there is no limitation on this.

[0098] For example, terminals have four affiliation levels: individual, team, department, and organization. Clients can be scanned and configured at these three levels: team, department, and organization.

[0099] Optionally, the configuration priority of each attribution level can also be set, that is, the priority of the configuration information of each attribution level can be set. The server can determine the target attribution level with the highest priority according to the configuration priority of each attribution level, and send the configuration information of the target attribution level as the target configuration information to the client. For example, the configuration priority of each attribution level of a terminal is in the order of individual, team, department, and organization from high to low. If the configuration information of the terminal at the individual granularity is configured, the configuration information at the individual granularity can be sent to the client as the target configuration information.

[0100] Therefore, by using the configuration priority of each belonging level and determining the target configuration information according to the configuration priority, conflicts between configuration information of different granularities can be avoided.

[0101] In addition, you can also define attribution levels and set their priorities. For example, if you define the attribution level of "project", the priorities of each attribution level are in the order of individual, project, department, and organization from high to low.

[0102] It should be noted that the belonging levels of different terminals may be the same or different, and there is no limitation on this.

[0103] Exemplarily, the server receives a configuration information acquisition request sent by the client, wherein the configuration information acquisition request includes identification information of the terminal to which the client belongs. The server obtains the configuration information of each belonging level of the terminal and the configuration priority of each belonging level of the terminal based on the identification information of the terminal to which the client belongs, and determines the target belonging level with the highest priority among the belonging levels based on the configuration priority, determines the configuration information of the target belonging level as the target configuration information, and sends the target configuration information to the client.

[0104] It should be noted that the server may actively send the target configuration information to the client, or may send the target configuration information to the client after receiving a configuration information acquisition request sent by the client. The specific method may be determined according to actual needs and is not limited thereto.

[0105] Step 302: Receive the sensitive information scanning result sent by the client.

[0106] In the present application, the sensitive information scanning result may be obtained by scanning the personal sensitive information of the scanned file according to the target configuration information. Exemplarily, the sensitive information scanning result may be obtained by the client itself scanning the scanned file for personal sensitive information, or by the server instead of the client scanning the scanned file for personal sensitive information, without limitation.

[0107] For example, if the performance of the terminal to which the client belongs is insufficient, such as the current load of the terminal's CPU is greater than a load threshold, or the current utilization is greater than a utilization threshold, the client can send the file to be scanned to the server, and the server scans the file to be scanned for personal sensitive information on behalf of the client, obtains the sensitive information scanning results, and sends the sensitive information scanning results to the client, and the client then sends the sensitive information scanning results to the server.

[0108] Step 303, determining a disposal strategy for sensitive files based on the sensitive information scanning results and sensitive file records in the database.

[0109] In this application, a sensitive file record in the database can be used to record information of a sensitive file, such as recording file information of the sensitive file, the amount of various types of sensitive information of the sensitive file, the first discovery time of the sensitive file, the processing status of the sensitive file, etc. Among them, the first discovery time of a sensitive file can refer to the time when the sensitive file is first discovered by scanning.

[0110] In this application, it is possible to determine whether a sensitive file exceeds the disposal period in the target configuration information based on the comparison results of the sensitive information scan results and the sensitive file records in the database, and determine the disposal strategy for the sensitive file based on whether the disposal period has exceeded. If the sensitive file exceeds the disposal authority, the disposal strategy for the sensitive file is determined to be deletion; if it does not exceed the disposal authority, the disposal strategy is no action.

[0111] Exemplarily, the file information of a sensitive file includes a file signature of the sensitive file, which is referred to as the first file signature for the sake of distinction. The first file signature of the sensitive file in the sensitive information scan result can be compared with the file signature in the sensitive file record in the database to determine whether the first file signature exists in the database. If the first file signature matches the second file signature in the database, it can be determined that the first file signature exists in the database. If the time interval between the current time and the first discovery time of the first file signature recorded in the database is greater than the time threshold in the target configuration information, it can be determined that the disposal policy for the sensitive file is deletion. The time threshold here can be understood as the disposal period.

[0112] Optionally, if the disposal policy for sensitive files is deletion, the sensitive files can be marked in the database to mark that the sensitive files have been deleted, such as "processed" or "deleted", etc. The specific marking form can be determined according to actual needs and is not limited to this. Thus, marking the sensitive files deleted by the client in the database can facilitate subsequent backtracking.

[0113] If the first file signature exists in the database, and the time interval between the current time and the first discovery time of the first file signature recorded in the database is less than the time threshold, it can be determined that the disposal policy for the sensitive file is no action.

[0114] If the first file signature is inconsistent with any file signature in the database, it means that the first file signature does not exist in the database, and the file information of the sensitive file in the sensitive information scanning result and the statistical information of the personal sensitive information can be added to the database, and the current time is recorded as the first discovery time of the first file signature. In this way, the information of the newly scanned sensitive file is stored in the database, and the database is updated, so as to facilitate the subsequent disposal of the sensitive file.

[0115] Step 304: Send the processing policy to the client, so that the client performs processing operations on the sensitive file according to the processing policy.

[0116] In this application, the disposal strategy of each sensitive file in the sensitive information scanning result can be sent to the client, and the client performs disposal operations on each sensitive file according to the disposal strategy of each sensitive file. If the disposal strategy is to delete, the sensitive file is deleted from the terminal, and if the disposal strategy is to take no action, the sensitive file on the terminal is retained.

[0117] For example, if the disposal policy for sensitive files is a deletion reminder, a deletion reminder message may be displayed to prompt the user to perform a deletion operation.

[0118] In the embodiment of the present application, by sending the target configuration information to the client, the client performs a personal sensitive information scan on the file to be scanned according to the target configuration information, receives the sensitive information scan result sent by the client, and determines the disposal strategy of the sensitive file in combination with the sensitive information file record in the database, and sends it to the client. Thus, based on the sensitive information scan result, combined with the sensitive information file record in the database, the disposal strategy of the sensitive file is determined, which can improve the accuracy, timeliness and disposal efficiency of the sensitive file disposal, thereby improving the security of personal sensitive information. In addition, by sending the target configuration information to the client, it is convenient for the client to scan personal sensitive information based on the target configuration information, which is highly flexible and can meet the personalized needs of personal sensitive information scanning.

[0119] In order to facilitate understanding of the processing method of personal sensitive information of this application, Figure 4 To explain, Figure 4 A schematic diagram of a process for processing personal sensitive information provided in an embodiment of the present application.

[0120] like Figure 4 As shown, the process of processing personal sensitive information is as follows:

[0121] Step 401, obtaining the ownership information of the personal terminal.

[0122] The server obtains the ownership information of the personal terminal from the desktop management system. For example, the ownership information of the personal terminal may include information at the level of individual, team, department, organization, etc.

[0123] Step 402: parameter configuration management.

[0124] System administrators can dynamically configure management policies, scanning policies, sensitivity thresholds, load thresholds, disposal behaviors and other configuration items at different granularities (such as individuals, teams, departments, and institutions) on the server side, and obtain configuration information at each granularity, that is, the configuration information at each level mentioned above. In addition, configuration priorities can be introduced, such as individuals, teams, departments, and institutions in descending order, so as to resolve conflicts in parameter configurations at different granularities.

[0125] Step 403, request configuration information.

[0126] The client can request configuration information from the server. For example, the client can be set to start automatically after booting, and after startup, the client first requests the server to obtain configuration information.

[0127] Step 404: Send target configuration information.

[0128] The server can determine the target configuration information of the client and send it to the client based on the configuration priority and configuration information of each granularity.

[0129] Step 405: Report the sensitive information scanning result.

[0130] The client can scan personal sensitive information according to the target configuration information, obtain the sensitive information scanning results and send them to the server.

[0131] The client can execute different scanning strategies according to the different configurations sent by the server, dynamically read the local files to be scanned at intervals configured according to the current CPU load being lower than the configured load threshold, perform sensitive information identification according to the identification rule table information sent, determine sensitive files, and generate file signatures for sensitive files, and send file information such as file signatures, file names, file locations, and statistical information on various types of personal sensitive information in sensitive files to the server.

[0132] In the case of insufficient client performance, the client can send the files to be scanned to the server. The server can assist the client in making sensitive information judgments through the sensitive information identification rules of the customer management system to obtain sensitive information scanning results, delete the files to be scanned and return the sensitive information scanning results to the client.

[0133] Step 406, updating the database and updating the handling strategy.

[0134] For each personal terminal, the server receives the sensitive information scanning results. If the file signature of the sensitive file in the sensitive information scanning results does not exist in the database, the current time is recorded as the first discovery time and stored in the database. If the file signature already exists in the database, it is determined whether the time interval between the current time and the first discovery exceeds the configured time threshold. If it exceeds the time threshold, the disposal policy of the sensitive file is updated to deletion. Otherwise, the disposal policy of the sensitive file is determined to be no action.

[0135] Step 407: Send the disposal strategy.

[0136] The server can send the disposal strategy of each sensitive file in the sensitive information scanning result to the client.

[0137] Step 408, view the sensitive file report.

[0138] The server can generate a list of sensitive files and statistical reports at each level to form a corresponding ledger, and personnel at each level can view the sensitive file reports at the corresponding level. Among them, the sensitive file reports at each level can include a list of sensitive files, such as file information, statistical information of sensitive data, etc., and can also include statistical data, such as statistical information of various types of personal sensitive information at the corresponding level.

[0139] For example, an individual can query the list of sensitive files and statistics of his or her personal terminal, a team manager can query the sensitive file scanning list and statistics of the team, a department manager can query the list of sensitive files and statistics of the department, and a manager of an organization can query the list of sensitive files and statistics of the organization.

[0140] In addition, in addition to maintaining the configuration information of the client on all personal terminals, the server can also maintain a table of identification rules for personal sensitive information of customers. It can summarize and analyze the sensitive information of personal terminals, dynamically update the identification rules of sensitive information and send them to the client.

[0141] The method for handling personal sensitive information in the embodiment of the present application can be combined with the processing capabilities of the server, through the configuration information management strategies of different granularities, to identify the files containing the customer's personal sensitive information on the personal terminal, establish an electronic ledger, and form lists and reports at all levels.

[0142] In order to implement the above embodiments, the present application also proposes a device for processing personal sensitive information.

[0143] Figure 5 A schematic diagram of the structure of a device for processing personal sensitive information provided in an embodiment of the present application.

[0144] like Figure 5 As shown, the personal sensitive information processing device 500 includes:

[0145] Receiving module 510, used to receive target configuration information sent by the server;

[0146] The scanning module 520 is used to scan the files to be scanned for personal sensitive information according to the target configuration information to obtain sensitive information scanning results; wherein the sensitive information scanning results include file information of sensitive files in the files to be scanned and statistical information of personal sensitive information in the sensitive files;

[0147] A sending module 530, configured to send the sensitive information scanning result to the server;

[0148] The receiving module 510 is further used to receive the disposal strategy of the sensitive file sent by the server; wherein the disposal strategy is determined by the server according to the sensitive information scanning result and the sensitive file record in the database;

[0149] The disposal module 540 is used to perform a disposal operation on the sensitive file according to the disposal policy.

[0150] Furthermore, in a possible implementation of the embodiment of the present application, the target configuration information includes a sensitivity threshold, and the scanning module 520 is used to:

[0151] Scanning the file to be scanned for personal sensitive information to determine the quantity of various types of personal sensitive information contained in the file to be scanned;

[0152] In response to the sum of the quantities of the various types of personal sensitive information being greater than the sensitivity threshold, determining the file to be scanned as the sensitive file;

[0153] The sensitive information scanning result is obtained according to the file information of the sensitive file and the quantity of the various types of personal sensitive information.

[0154] Furthermore, in a possible implementation of the embodiment of the present application, the target configuration information further includes a load threshold, and the scanning module 520 is configured to:

[0155] Get the current load of the central processing unit CPU;

[0156] In response to the current load being less than the load threshold, scanning the to-be-scanned file for personal sensitive information to obtain the sensitive information scanning result;

[0157] In response to the current load being greater than the load threshold, the file to be scanned is sent to the server, and the sensitive information scanning result sent by the server is received, where the sensitive information scanning result is obtained by the server scanning the file to be scanned for personal sensitive information.

[0158] Furthermore, in a possible implementation of the embodiment of the present application, the receiving module 510 is configured to:

[0159] Sending a configuration information acquisition request to the server; wherein the configuration information acquisition request includes identification information of the terminal to which the client belongs;

[0160] Receive target configuration information sent by the server; wherein the target configuration information is determined by the server according to the configuration information of each belonging level of the terminal obtained based on the identification information and the configuration priority of each belonging level.

[0161] It should be noted that the explanation of the aforementioned embodiment of the method for processing personal sensitive information on the client side is also applicable to the personal sensitive information processing device of this embodiment, and will not be repeated here.

[0162] In the embodiment of the present application, personal sensitive information is scanned for the scanned file according to the target configuration information received from the server, the sensitive information scanning result is obtained, and the sensitive information scanning result is sent to the server, the sensitive information disposal strategy determined by the server based on the sensitive information scanning result is received, and the disposal operation is performed on the sensitive file based on the disposal strategy. Thus, the sensitive file is disposed according to the disposal strategy issued by the server based on the sensitive information scanning result, which can improve the accuracy, timeliness and disposal efficiency of sensitive file disposal, thereby improving the security of personal sensitive information. In addition, personal sensitive information scanning based on the target configuration information is highly flexible and can meet the personalized needs of personal sensitive information scanning.

[0163] In order to implement the above embodiments, the present application also proposes a device for processing personal sensitive information.

[0164] Figure 6 A schematic diagram of the structure of another device for processing personal sensitive information provided in an embodiment of the present application.

[0165] like Figure 6 As shown, the personal sensitive information processing device 600 includes:

[0166] The sending module 610 is used to send target configuration information to the client;

[0167] The receiving module 620 is used to receive the sensitive information scanning result sent by the client; wherein the sensitive information scanning result is obtained by scanning the personal sensitive information of the file to be scanned according to the target configuration information, and the sensitive information scanning result includes the file information of the sensitive file in the file to be scanned and the statistical information of the personal sensitive information in the sensitive file;

[0168] A determination module 630, configured to determine a disposal strategy for the sensitive file according to the sensitive information scanning result and the sensitive file record in the database;

[0169] The sending module 610 is further configured to send the processing strategy to the client, so that the client performs a processing operation on the sensitive file according to the processing strategy.

[0170] Furthermore, in a possible implementation of the embodiment of the present application, the file information includes a first file signature of the sensitive file, and the determination module 630 is configured to:

[0171] comparing the first file signature with a file signature in the sensitive file record to determine whether the first file signature exists in the database;

[0172] In response to the presence of the first file signature in the database, and the time interval between the current time and the first discovery time of the first file signature recorded in the database is greater than the time threshold in the target configuration information, determining that the disposal strategy for the sensitive file is deletion;

[0173] In response to the first file signature existing in the database and the time interval being less than the time threshold, determining that the handling policy for the sensitive file is no action.

[0174] Furthermore, in a possible implementation of the embodiment of the present application, the device further includes:

[0175] The storage module is used for adding the file information and the statistical information to the database in response to the first file signature not existing in the database, and recording the current time as the first discovery time of the first file signature.

[0176] Furthermore, in a possible implementation of the embodiment of the present application, the sending module 610 is configured to:

[0177] Receiving a configuration information acquisition request sent by the client; wherein the configuration information acquisition request includes identification information of the terminal to which the client belongs;

[0178] Acquire, according to the identification information, configuration information of each belonging level of the terminal and configuration priority of each belonging level of the terminal;

[0179] Determining a target belonging hierarchy with the highest priority among the belonging hierarchies according to the configuration priority;

[0180] The configuration information of the target belonging level is determined as the target configuration information.

[0181] It should be noted that the explanation of the aforementioned server-side method for processing personal sensitive information is also applicable to the personal sensitive information processing device of this embodiment, and will not be repeated here.

[0182] In the embodiment of the present application, by sending the target configuration information to the client, the client performs a personal sensitive information scan on the file to be scanned according to the target configuration information, receives the sensitive information scan result sent by the client, and determines the disposal strategy of the sensitive file in combination with the sensitive information file record in the database, and sends it to the client. Thus, based on the sensitive information scan result, combined with the sensitive information file record in the database, the disposal strategy of the sensitive file is determined, which can improve the accuracy, timeliness and disposal efficiency of the sensitive file disposal, thereby improving the security of personal sensitive information. In addition, by sending the target configuration information to the client, it is convenient for the client to scan personal sensitive information based on the target configuration information, which is highly flexible and can meet the personalized needs of personal sensitive information scanning.

[0183] In order to implement the above embodiments, the present application also proposes an electronic device, comprising: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method provided by the above embodiments.

[0184] In order to implement the above embodiments, the present application also proposes a computer-readable storage medium, in which computer-executable instructions are stored. When the computer-executable instructions are executed by a processor, they are used to implement the methods provided by the above embodiments.

[0185] In order to implement the above embodiments, the present application also proposes a computer program product, including a computer program, which implements the methods provided by the above embodiments when executed by a processor.

[0186] The collection, storage, use, processing, transmission, provision and disclosure of user personal information involved in this application are in compliance with relevant laws and regulations and do not violate public order and good morals.

[0187] It should be noted that personal information from users should be collected for legitimate and reasonable purposes and should not be shared or sold outside of these legitimate uses. In addition, such collection / sharing should be carried out after receiving the user's informed consent, including but not limited to notifying the user to read the user agreement / user notice and sign the agreement / authorization including authorization of relevant user information before the user uses the function. In addition, any necessary steps should be taken to protect and safeguard access to such personal information data and ensure that others who have access to personal information data comply with its privacy policy and procedures.

[0188] The present application is expected to provide an implementation scheme for users to selectively block the use or access of personal information data. That is, the present disclosure is expected to provide hardware and / or software to prevent or block access to such personal information data. Once the personal information data is no longer needed, the risk can be minimized by limiting data collection and deleting the data. In addition, when applicable, such personal information is de-identified to protect the privacy of the user.

[0189] In the description of the aforementioned embodiments, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0190] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of this application, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0191] Any process or method description in a flowchart or otherwise described herein may be understood to represent a module, fragment or portion of code comprising one or more executable instructions for implementing the steps of a custom logical function or process, and the scope of the preferred embodiments of the present application includes alternative implementations in which functions may not be performed in the order shown or discussed, including performing functions in a substantially simultaneous manner or in the reverse order depending on the functions involved, which should be understood by technicians in the technical field to which the embodiments of the present application belong.

[0192] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute the instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purpose of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0193] It should be understood that the various parts of the present application can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0194] A person skilled in the art may understand that all or part of the steps in the method for implementing the above-mentioned embodiment may be completed by instructing related hardware through a program, and the program may be stored in a computer-readable storage medium, which, when executed, includes one or a combination of the steps of the method embodiment.

[0195] In addition, each functional unit in each embodiment of the present application may be integrated into a processing module, or each unit may exist physically separately, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. If the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0196] The storage medium mentioned above may be a read-only memory, a magnetic disk or an optical disk, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present application. A person of ordinary skill in the art may change, modify, replace and modify the above embodiments within the scope of the present application.

Claims

1. A method for processing personal sensitive information, characterized in that: The following steps are involved: Receive target configuration information sent by the server; According to the target configuration information, the file to be scanned is scanned for personal sensitive information to obtain a sensitive information scanning result; wherein the sensitive information scanning result includes file information of sensitive files in the file to be scanned and statistical information of personal sensitive information in the sensitive files; Sending the sensitive information scanning result to the server; Receiving a disposal strategy for the sensitive file sent by the server; wherein the disposal strategy is determined by the server according to the sensitive information scanning result and the sensitive file record in the database; According to the disposal policy, a disposal operation is performed on the sensitive file.

2. The method according to claim 1, characterized in that The target configuration information includes a sensitivity threshold, and scanning the file to be scanned for personal sensitive information according to the target configuration information to obtain a sensitive information scanning result includes: Scanning the file to be scanned for personal sensitive information to determine the quantity of various types of personal sensitive information contained in the file to be scanned; In response to the sum of the quantities of the various types of personal sensitive information being greater than the sensitivity threshold, determining the file to be scanned as the sensitive file; The sensitive information scanning result is obtained according to the file information of the sensitive file and the quantity of the various types of personal sensitive information.

3. The method according to claim 2, characterized in that The target configuration information also includes a load threshold. The scanning of the to-be-scanned file for personal sensitive information according to the target configuration information to obtain a sensitive information scanning result includes: Get the current load of the central processing unit CPU; In response to the current load being less than the load threshold, scanning the to-be-scanned file for personal sensitive information to obtain the sensitive information scanning result; In response to the current load being greater than the load threshold, the file to be scanned is sent to the server, and the sensitive information scanning result sent by the server is received, where the sensitive information scanning result is obtained by the server scanning the file to be scanned for personal sensitive information.

4. The method according to any one of claims 1 to 3, characterized in that The receiving target configuration information sent by the server includes: Sending a configuration information acquisition request to the server; wherein the configuration information acquisition request includes identification information of the terminal to which the client belongs; Receive target configuration information sent by the server; wherein the target configuration information is determined by the server according to the configuration information of each belonging level of the terminal obtained based on the identification information and the configuration priority of each belonging level.

5. A method for processing personal sensitive information, characterized in that: The following steps are involved: Send target configuration information to the client; Receiving a sensitive information scanning result sent by the client; wherein the sensitive information scanning result is obtained by scanning the file to be scanned for personal sensitive information according to the target configuration information, and the sensitive information scanning result includes file information of the sensitive file in the file to be scanned and statistical information of personal sensitive information in the sensitive file; Determine a disposal strategy for the sensitive files based on the sensitive information scanning results and the sensitive file records in the database; The processing policy is sent to the client, so that the client performs a processing operation on the sensitive file according to the processing policy.

6. The method according to claim 5, characterized in that The file information includes a first file signature of the sensitive file, and determining a disposal strategy for the sensitive file according to the sensitive information scanning result and the sensitive file record in the database includes: comparing the first file signature with a file signature in the sensitive file record to determine whether the first file signature exists in the database; In response to the presence of the first file signature in the database, and the time interval between the current time and the first discovery time of the first file signature recorded in the database is greater than the time threshold in the target configuration information, determining that the disposal strategy for the sensitive file is deletion; In response to the first file signature existing in the database and the time interval being less than the time threshold, determining that the handling policy for the sensitive file is no action.

7. The method according to claim 6, characterized in that Also includes: In response to the first file signature not existing in the database, the file information and the statistical information are added to the database, and the current time is recorded as the first discovery time of the first file signature.

8. The method according to any one of claims 5 to 7, characterized in that The sending of target configuration information to the client includes: Receiving a configuration information acquisition request sent by the client; wherein the configuration information acquisition request includes identification information of the terminal to which the client belongs; Acquire, according to the identification information, configuration information of each belonging level of the terminal and configuration priority of each belonging level of the terminal; Determining a target belonging hierarchy with the highest priority among the belonging hierarchies according to the configuration priority; The configuration information of the target belonging level is determined as the target configuration information.

9. A device for processing personal sensitive information, characterized in that: include: A receiving module, used for receiving target configuration information sent by the server; A scanning module, used to scan the files to be scanned for personal sensitive information according to the target configuration information, so as to obtain sensitive information scanning results; wherein the sensitive information scanning results include file information of sensitive files in the files to be scanned and statistical information of personal sensitive information in the sensitive files; A sending module, used to send the sensitive information scanning result to the server; The receiving module is further used to receive a disposal strategy for the sensitive file sent by the server; wherein the disposal strategy is determined by the server according to the sensitive information scanning result and the sensitive file record in the database; A disposal module is used to perform a disposal operation on the sensitive file according to the disposal strategy.

10. A device for processing personal sensitive information, characterized in that: include: A sending module, used for sending target configuration information to the client; A receiving module, configured to receive a sensitive information scanning result sent by the client; wherein the sensitive information scanning result is obtained by scanning the file to be scanned for personal sensitive information according to the target configuration information, and the sensitive information scanning result includes file information of sensitive files in the file to be scanned and statistical information of personal sensitive information in the sensitive file; A determination module, used to determine a disposal strategy for the sensitive file according to the sensitive information scanning result and the sensitive file records in the database; The sending module is further used to send the processing strategy to the client, so that the client performs a processing operation on the sensitive file according to the processing strategy.

11. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 4, or implements the method according to any one of claims 5 to 8.

12. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method according to any one of claims 1 to 4, or to implement the method according to any one of claims 5 to 8.

13. A computer program product, characterized in that The invention comprises a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 4, or implements the method according to any one of claims 5 to 8.

Images