Data desensitization method and device

Abstract

The invention discloses a data desensitization method and device, and relates to the technical field of privacy computing. A specific embodiment of the method comprises the following steps: in response to starting of a target application program, obtaining current sensitive field information from a remote server; in response to the fact that the page of the target application program is created, when it is detected that the page is a sensitive page with sensitive data in a specific control, registration of a desensitization component is executed on the page; when screen recording is executed based on a preset screen recording component, if any sensitive page is in a running state in a screen window, sensitive data in the sensitive page is subjected to desensitization processing by utilizing a desensitization strategy corresponding to a sensitive field to which the sensitive data belongs and a specific control type to which the sensitive data belongs; the sensitive data is not contained in a screen recording file generated through screen recording; and responding to the destroying of any sensitive page, and executing the logout of the desensitization component on the sensitive page. According to the embodiment, efficient and lightweight page-level data desensitization can be executed for the screen recording scene.

Description

Technical Field

[0001] The present invention relates to the field of privacy computing technology, and in particular to a data desensitization method and device. Background Art

[0002] In some business scenarios, users need to record related operations in the form of screen recording to achieve business goals. For example, users record their operation process in a certain application in the form of screen recording, provide the generated screen recording file to the service provider, and seek the service provider's help to solve related problems. Screen recording files often contain sensitive data stipulated by relevant laws and regulations, such as user privacy data such as user name and ID number. It is necessary to desensitize these sensitive data to prevent sensitive data leakage during the transmission of screen recording files. At present, image and video desensitization technology is generally used to perform sensitive data detection and desensitization processing on each frame of the screen recording file after it is generated. The workload is very large and puts great pressure on the precious computing resources of user terminals (such as mobile phones). Therefore, it is necessary to provide a lightweight data desensitization solution for screen recording scenarios. Summary of the invention

[0003] In view of this, an embodiment of the present invention provides a data desensitization method and device, which can perform efficient and lightweight page-level data desensitization for screen recording scenarios.

[0004] To achieve the above objective, according to one aspect of the present invention, a data desensitization method is provided.

[0005] The data desensitization method of the embodiment of the present invention is executed by a desensitization component pre-introduced into the target application; the method includes: in response to the start of the target application, obtaining the current sensitive field information from the remote server and storing it locally; in response to any page of the target application being created, when detecting that the page is a sensitive page containing sensitive data in a specific control, registering the desensitization component on the page; wherein the sensitive data is data belonging to the sensitive field; when performing screen recording based on a preset screen recording component, if any sensitive page is in a running state in the screen window, desensitizing the sensitive data using a preset desensitization strategy corresponding to the sensitive field to which the sensitive data in the sensitive page belongs and the specific control type, so that the screen recording file generated by the screen recording does not contain the sensitive data; in response to any sensitive page being destroyed, deregistering the desensitization component on the sensitive page.

[0006] Optionally, when screen recording is performed based on a preset screen recording component, if any sensitive page is in a running state in the screen window, the sensitive data is desensitized using a preset desensitization strategy corresponding to the sensitive field to which the sensitive data in the sensitive page belongs and the specific control type, including: when any sensitive page is in a running state in the screen window, in response to the screen recording component entering a startup state, desensitizing the sensitive data in the sensitive page; the screen recording component enters a working state after the desensitization process is completed to generate the screen recording file.

[0007] Optionally, when screen recording is performed based on a preset screen recording component, if any sensitive page is in a running state in the screen window, the sensitive data is desensitized using a preset desensitization strategy corresponding to the sensitive field to which the sensitive data in the sensitive page belongs and the specific control type, including: when the screen recording component is in a working state, in response to any sensitive page being created, the sensitive data in the sensitive page is desensitized before the sensitive page enters a visible state; and the sensitive page is in a running state after entering the visible state.

[0008] Optionally, the specific control types include text controls and image controls; and the desensitizing processing of the sensitive data in the sensitive page includes: for the sensitive data in the text control of the sensitive page, performing mask processing on the sensitive data using a desensitizing strategy corresponding to the sensitive field to which the sensitive data belongs; for the sensitive data in the image control of the sensitive page, determining a location area of ​​the sensitive data in the image to which it belongs, and overwriting or erasing the determined location area.

[0009] Optionally, the method further includes: in response to the end of the screen recording, restoring the sensitive data in the sensitive page that has been desensitized to the sensitive page, and instructing the sensitive page to perform a refresh.

[0010] Optionally, the method further includes: after detecting that any page is a sensitive page, marking sensitive data in the page and a specific control containing the sensitive data; and the screen recording component is built into the target application.

[0011] To achieve the above objective, according to another aspect of the present invention, a data desensitization device is provided.

[0012] The data desensitization device of the embodiment of the present invention is set in a desensitization component that is pre-introduced into a target application; the device includes: a data pulling unit, which is used to: in response to the start of the target application, obtain the current sensitive field information from a remote server and store it locally; a page registration unit, which is used to: in response to any page of the target application being created, when detecting that the page is a sensitive page containing sensitive data in a specific control, perform registration of the desensitization component on the page; wherein the sensitive data is data belonging to the sensitive field; the desensitization unit is used to: when performing screen recording based on a preset screen recording component, if any sensitive page is in a running state in the screen window, desensitize the sensitive data using a preset desensitization strategy corresponding to the sensitive field to which the sensitive data in the sensitive page belongs and the specific control type, so that the screen recording file generated by the screen recording does not contain the sensitive data; a logout unit, which is used to: in response to any sensitive page being destroyed, perform logout of the desensitization component on the sensitive page.

[0013] Optionally, the desensitizing unit is further used to: when any sensitive page is in a running state in the screen window, in response to the screen recording component entering a startup state, desensitize the sensitive data in the sensitive page; the screen recording component enters a working state after the desensitization is completed to generate the screen recording file.

[0014] To achieve the above objective, according to another aspect of the present invention, an electronic device is provided.

[0015] An electronic device of the present invention includes: one or more processors; a storage device for storing one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement the data desensitization method provided by the present invention.

[0016] To achieve the above objective, according to yet another aspect of the present invention, a computer-readable storage medium is provided.

[0017] A computer-readable storage medium of the present invention stores a computer program, which, when executed by a processor, implements the data desensitization method provided by the present invention.

[0018] According to the technical solution of the present invention, the embodiments of the above invention have the following advantages or beneficial effects:

[0019] A page-level data desensitization solution for screen recording scenarios is provided. Specifically, a desensitization component is pre-bound to the target application that needs to perform screen recording desensitization processing. The desensitization component only pulls the latest sensitive field information from the remote server after the target application is started. In addition, no other actions are performed at the application level. The main desensitization actions are performed at the page level of the target application. When any page of the target application is created, the desensitization component performs registration on the page if it determines that the page is a sensitive page containing sensitive data, otherwise, it does not register. Afterwards, when the sensitive page is in operation, screen recording is started or a sensitive page is created during the screen recording process. The registered desensitizing component identifies the sensitive data of specific controls in the sensitive page and performs corresponding desensitizing processing. After the screen recording is completed, the original data is restored. After the sensitive page is destroyed, the desensitizing component previously registered on the page is cancelled. In this way, data desensitization before generating the screen recording file is achieved without affecting the user experience, avoiding the huge workload of desensitization after the screen recording is completed in the prior art. In addition, the sensitive fields targeted for desensitization are pulled from the remote server in real time by the desensitizing component after the target application is started, ensuring strict compliance with relevant laws, regulations and provisions to ensure data security and user privacy protection. More importantly, in order to reduce the amount of computation and computing resources occupied by the data desensitization process, the desensitization component only performs desensitization actions on a limited number of sensitive pages of the target application through a precisely positioned registration and deregistration mechanism, and does not perform major desensitization actions on non-sensitive pages of the target application. Compared with the desensitization solution executed at the application level, it can reduce the amount of computation of the desensitization program to the greatest extent, ensuring that the computing resources of the user terminal will not be largely occupied by the data desensitization process. It has high availability at a time when computing resources of mobile smart terminals are becoming increasingly precious.

[0020] The further effects of the above-mentioned non-conventional optional manner will be described below in conjunction with the specific implementation manner. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The accompanying drawings are used to better understand the present invention and do not constitute an improper limitation of the present invention.

[0022] Figure 1 It is a schematic diagram of the main steps of the data desensitization method in an embodiment of the present invention;

[0023] Figure 2 is a schematic diagram of the system architecture of the data desensitization method in an embodiment of the present invention;

[0024] Figure 3 It is a schematic diagram of specific execution steps of the data desensitization method in an embodiment of the present invention;

[0025] Figure 4 It is a schematic diagram of components of a data desensitization device in an embodiment of the present invention;

[0026] Figure 5 is an exemplary system architecture diagram in which embodiments of the present invention may be applied;

[0027] Figure 6 It is a schematic diagram of the structure of an electronic device used to implement the data desensitization method in an embodiment of the present invention. DETAILED DESCRIPTION

[0028] The following is a description of exemplary embodiments of the present invention in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to facilitate understanding, which should be considered as merely exemplary. Therefore, it should be recognized by those of ordinary skill in the art that various changes and modifications may be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and conciseness, the description of well-known functions and structures is omitted in the following description.

[0029] It should be pointed out that the embodiments of the present invention and the technical features therein may be combined with each other without conflict.

[0030] Figure 1 It is a schematic diagram of the main steps of the data desensitization method according to an embodiment of the present invention. The method of the present invention is executed by a desensitization component that is pre-introduced into the target application and is used to perform data desensitization. The target application can be any application on the user terminal such as a mobile phone, such as a mobile APP. The desensitization component can be specially developed and then introduced into the application that needs to perform data desensitization, or it can be used as a part of the application in the development stage. The method of the present invention can be executed in Android and iOS systems, and the following is explained using the Android system as an example.

[0031] like Figure 1 As shown, the data desensitization method of the embodiment of the present invention can be specifically performed according to the following steps. The relevant system architecture can be found in Figure 2 .

[0032] Step S101: In response to the target application being started, current sensitive field information is obtained from a remote server and stored locally.

[0033] In actual applications, when the target application pre-loaded with the desensitizing component is started, the desensitizing component acquires sensitive field information based on the real-time interaction between the user terminal and the remote server. Among them, the remote server refers to any server that can interact with the user terminal, which can be set up on the server side or cloud that provides the corresponding service. Sensitive field information is used to characterize the type and scope of sensitive data that needs to be desensitized in accordance with the latest laws, regulations, and provisions to prevent data leakage. It can be field names, field identifiers, etc. used to indicate relevant data of sensitive fields. After the desensitizing component obtains the sensitive field information, it can store the sensitive field information in the cache of the user terminal (such as Redis, database, etc.) for subsequent use. The way for the desensitizing component to obtain sensitive field information can be that the desensitizing component actively pulls it, or it can be actively pushed by the remote server. It is worth noting that the desensitizing component only performs the above data acquisition actions when the target application is started, and its main data desensitization actions are page-level actions, that is, the desensitization processing logic is executed for a specific page rather than the target application as a whole.

[0034] Step S102: In response to any page of the target application being created, when the page is detected to be a sensitive page containing sensitive data in a specific control, registering a desensitizing component on the page.

[0035] In the page-level desensitization scheme of the embodiment of the present invention, the desensitization component executes the desensitization logic for a specific page in the target application. The corresponding page can be registered before this to facilitate the subsequent execution of the desensitization logic. The page that has not been registered with the desensitization component or has been unregistered after the desensitization component is registered will not execute the main desensitization logic.

[0036] In this step, when any page of the target application is created, the desensitizing component performs registration of the desensitizing component on the page when the page is detected to be a sensitive page. Exemplarily, in Android system, the above page refers to activity (activity), and the life cycle state of the page is successively: created (onCreate), started (onStart), visible (onResume), paused (onPause), stopped (onStop), destroyed (onDestroy). When the page enters the visible state, it appears in the foreground of the user terminal software system, and the page is in the running state. The page in the running state is visible on the desktop taskbar and is running in the CPU (Central Processing Unit, central processing unit), and can respond to the user's operation so as to interact with the user. Relative to the foreground, background operation refers to the operating mode in which the application can continue to run the related service slightly after closing, and the page running in the background is in a non-operating state.

[0037] It can be understood that at any time, a user terminal can have at most one page in the above running state, that is, appearing in the foreground to interact with the user; at any time, a user terminal can have multiple pages in a non-running state, that is, running in the background and unable to respond to user operations, and this is true for both single-interface and multi-interface user terminal display modes. In a single-interface display mode, the currently displayed page is in the foreground, in a running state, and can interact with the user; other pages can run in the background, in a non-running state, and cannot interact with the user at the current moment; for display modes such as four-grid and nine-grid with multiple interfaces at the same time, among the multiple pages currently displayed, only one page is in the foreground, in a running state, and can interact with the user; although the other one or more pages are displayed on the user terminal interface, they are all running in the background, in a non-running state, and cannot interact with the user at the current moment.

[0038] The way that the desensitizing component detects sensitive pages is to detect whether the page contains sensitive data indicated by sensitive fields, that is, the relevant data of the sensitive fields obtained in step S101. In practical applications, the above sensitive data generally exist in several specific controls, and these specific controls may include text controls (TextView) and image controls (ImageView). The above text controls and image controls may be independent controls or list items contained in a list control (ListView). It can be understood that specific control types may also include other applicable control types. In this way, in this step, the desensitizing component can focus on the detection of sensitive data for specific controls in the page, and after detecting the sensitive data, the corresponding page is determined to be a sensitive page.

[0039] In an optional manner, after detecting that any page is a sensitive page, the desensitizing component may mark the sensitive data in the page and the specific controls containing the sensitive data to facilitate searching for the sensitive data and the specific controls to which it belongs in subsequent steps.

[0040] Step S103: When screen recording is performed based on the preset screen recording component, if any sensitive page is in a running state in the screen window, the sensitive data is desensitized using a desensitization strategy so that the screen recording file generated by the screen recording does not contain the sensitive data.

[0041] Preferably, the above screen recording component is a built-in component of the target application, and the screen recording component can also be a component outside the target application in actual application. In this step, when the screen recording action and the screen recording process involve sensitive pages, the desensitizing component registered in the sensitive page based on steps S102 and S103 performs desensitization on the sensitive data in the sensitive page, so that the user terminal window does not display sensitive data, and finally the screen recording file generated by the screen recording does not contain sensitive data. There are two scenarios for its specific execution: in the first scenario, when a sensitive page of the target application is in a running state, the screen recording component starts the screen recording (the screen recording component enters the startup state at this time), and the desensitizing component needs to perform desensitization on the sensitive data that has been displayed in the target terminal window, and display it in the window after the desensitization process, and the desensitization process action needs to be completed before the screen recording is formally executed (the screen recording component enters the working state at this time). The above startup state and working state are the preset life cycle states of the screen recording component. The role of the startup state is similar to the aforementioned creation (onCreate), and some initialization operations of the screen recording component can be performed. The role of the startup state is similar to the aforementioned visibility (onResume). When entering this state, the screen recording component officially starts recording the screen and captures the frame sequence of the current window. In actual applications, other life cycle states can also be set as needed.

[0042] That is to say, in the first scenario, when any sensitive page is in the running state, in response to the screen recording component entering the startup state, the desensitizing component performs desensitization processing on the sensitive data in the sensitive page; after the desensitization processing is completed, the screen recording component enters the working state to generate a screen recording file. In specific applications, the desensitizing component can locate the relevant specific controls and the sensitive data in the sensitive page according to the previous markings, and then perform desensitization on the sensitive data.

[0043] In the second scenario, when the screen recording component starts recording, the foreground task is not a sensitive page of the target application, but a sensitive page is created during the recording process. At this time, the desensitizing component needs to desensitize the sensitive page before it enters the visible state. That is, when the screen recording component is in the working state, in response to any sensitive page being created, the desensitizing component desensitizes the sensitive data in the sensitive page before the sensitive page enters the visible state, and the sensitive page appears in the foreground after entering the visible state.

[0044] Through the above steps, it can be ensured that there is no sensitive data of any sensitive pages in the screen recording file.

[0045] The desensitization processing strategy of the embodiment of the present invention is as follows. First, relevant personnel can configure the corresponding desensitization strategy in combination with sensitive fields and specific control types. For example, the ID number in the image control is overwritten, the name in the image control is erased, the ID number in the text control is "displayed as the first digit + consecutive * + last digit", and the name in the text control is "surname + consecutive * (can be one *)". It can be understood that the two desensitization methods for text controls in the example are both masking methods.

[0046] Based on the above configuration, for sensitive data in the text control of the sensitive page, the desensitizing component uses the desensitizing strategy corresponding to the sensitive field to which the sensitive data belongs to perform mask processing on the sensitive data. For sensitive data in the image control of the sensitive page, the desensitizing component determines the location area of ​​the sensitive data in the image to which it belongs, and overwrites or erases the determined location area.

[0047] In actual applications, at the end of screen recording, the desensitization component can restore the sensitive data in the sensitive page that has been desensitized to the sensitive page, and instruct the sensitive page to refresh, so as to avoid affecting the normal use of the user. For sensitive pages that have been in the foreground at the end of screen recording or for a period of time before, the above data recovery steps are performed at the end of screen recording; for sensitive pages that have been destroyed during the screen recording process, the data recovery steps need to be completed before the desensitization component is deregistered (which will be explained below).

[0048] Through the above steps, the desensitization strategy finally adopted is adapted to and determined by the sensitive fields and specific control types at the same time, thereby realizing a highly targeted and flexible desensitization mode. It should be noted that if the current laws, regulations, and provisions have requirements for the desensitization strategy, the desensitization strategy of the embodiment of the present invention needs to be configured in accordance with the laws, regulations, and provisions. In addition, the above steps realize the data desensitization before generating the screen recording file without affecting the user experience, avoiding the huge workload of desensitization after the screen recording is completed in the prior art, and the sensitive fields targeted by the desensitization are pulled from the remote server in real time by the desensitization component after the target application is started, ensuring strict compliance with relevant laws, regulations, and provisions, and ensuring data security and user privacy protection.

[0049] Step S104: In response to any sensitive page being destroyed, deregistering the desensitizing component on the sensitive page.

[0050] In this step, regardless of whether it is in the screen recording process, when any sensitive page is destroyed, the desensitizing component can execute the logout on the sensitive page to end the binding with the page, thereby realizing the data desensitization solution at the page level. The page-level data desensitization solution can reduce the amount of computation and computing resources occupied by the data desensitization process. The desensitizing component only performs desensitization actions on a limited number of sensitive pages of the target application through a precisely located registration and logout mechanism, and does not perform the main desensitization actions on the non-sensitive pages of the target application. Compared with the desensitization solution executed at the application level, it can reduce the amount of computation of the desensitization program to the greatest extent, ensuring that the computing resources of the user terminal will not be occupied by a large amount of the data desensitization process, and has high availability at a time when computing resources of mobile smart terminals are becoming increasingly valuable.

[0051] Figure 3 is a schematic diagram of specific execution steps of the data desensitization method in an embodiment of the present invention, see Figure 3 . In step S301, the target application is started; in step S302, the desensitizing component obtains sensitive field information from the remote server; in step S303, any page of the target application is created; in step S304, the desensitizing component performs sensitive page detection; in step S305, the desensitizing component marks sensitive data in sensitive pages and their specific controls; in step S306, the desensitizing component is registered in sensitive pages; in step S307, the screen recording component starts to perform screen recording; in step S308, the desensitizing component performs desensitization processing on sensitive data in sensitive pages involved in screen recording; in step S309, the screen recording ends and forms a screen recording file; in step S310, the desensitizing component performs data recovery and refresh of sensitive pages for which desensitization processing has been performed at the end of screen recording or before logout; in step S311, the desensitizing component performs logout when the sensitive page is destroyed.

[0052] In the technical solution of the embodiment of the present invention, a page-level data desensitization solution for screen recording scenarios is provided. Specifically, a desensitization component is pre-bound to a target application that needs to perform screen recording desensitization processing. The desensitization component only pulls the latest sensitive field information from the remote server after the target application is started. In addition, no other actions are performed at the application level. The main desensitization actions are performed at the page level of the target application. When any page of the target application is created, the desensitization component performs registration on the page if it determines that the page is a sensitive page containing sensitive data, otherwise, no registration is performed. Afterwards, when the sensitive page is in operation, screen recording is started or a sensitive page is created during the screen recording process. The registered desensitizing component identifies the sensitive data of specific controls in the sensitive page and performs corresponding desensitizing processing. After the screen recording is completed, the original data is restored. After the sensitive page is destroyed, the desensitizing component previously registered on the page is cancelled. In this way, data desensitization before generating the screen recording file is achieved without affecting the user experience, avoiding the huge workload of desensitization after the screen recording is completed in the prior art. In addition, the sensitive fields targeted for desensitization are pulled from the remote server in real time by the desensitizing component after the target application is started, ensuring strict compliance with relevant laws, regulations and provisions to ensure data security and user privacy protection. More importantly, in order to reduce the amount of computation and computing resources occupied by the data desensitization process, the desensitization component only performs desensitization actions on a limited number of sensitive pages of the target application through a precisely positioned registration and deregistration mechanism, and does not perform major desensitization actions on non-sensitive pages of the target application. Compared with the desensitization solution executed at the application level, it can reduce the amount of computation of the desensitization program to the greatest extent, ensuring that the computing resources of the user terminal will not be largely occupied by the data desensitization process. It has high availability at a time when computing resources of mobile smart terminals are becoming increasingly precious.

[0053] It should be noted that the collection, collection, updating, analysis, processing, use, transmission, storage and other aspects of user personal information involved in the technical solution of the present invention are in compliance with the provisions of relevant laws and regulations, are used for legitimate purposes, and do not violate public order and good morals. Necessary measures are taken for user personal information to prevent illegal access to user personal information data and maintain the security of user personal information, network security and national security.

[0054] For the above-mentioned method embodiments, for the convenience of description, they are expressed as a series of action combinations, but those skilled in the art should know that the present invention is not limited by the order of the actions described, and some steps can actually be performed in other orders or simultaneously. In addition, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily necessary to implement the present invention.

[0055] In order to better implement the above-mentioned solution of the embodiment of the present invention, relevant devices for implementing the above-mentioned solution are also provided below.

[0056] See also Figure 4 As shown, the data desensitization device 400 provided by the embodiment of the present invention is set in a desensitization component pre-introduced into the target application, and may include: a data pulling unit 401, a page registration unit 402, a desensitization unit 403 and a deregistration unit 404.

[0057] Among them, the data pulling unit 401 can be used to: in response to the start of the target application, obtain the current sensitive field information from the remote server and store it locally; the page registration unit 402 can be used to: in response to any page of the target application being created, when it is detected that the page is a sensitive page containing sensitive data in a specific control, perform registration of the desensitizing component on the page; wherein the sensitive data is data belonging to the sensitive field; the desensitizing unit 403 can be used to: when screen recording is performed based on a preset screen recording component, if any sensitive page is in a running state in the screen window, desensitize the sensitive data using a preset desensitization strategy corresponding to the sensitive field to which the sensitive data in the sensitive page belongs and the specific control type, so that the screen recording file generated by the screen recording does not contain the sensitive data; the logout unit 404 can be used to: in response to any sensitive page being destroyed, perform logout of the desensitizing component on the sensitive page.

[0058] In an embodiment of the present invention, the desensitizing unit 403 can be further used for: when any sensitive page is in a running state in the screen window, in response to the screen recording component entering a startup state, desensitizing the sensitive data in the sensitive page; the screen recording component enters a working state after the desensitizing process is completed to generate the screen recording file.

[0059] In a specific application, the desensitizing unit 403 can be further used for: when the screen recording component is in a working state, in response to any sensitive page being created, desensitizing the sensitive data in the sensitive page before the sensitive page enters a visible state; and the sensitive page is in a running state after entering a visible state.

[0060] As a preferred solution, the specific control types include text controls and image controls; and the desensitizing unit 403 can be further used to: for the sensitive data in the text control of the sensitive page, perform mask processing on the sensitive data using the desensitizing strategy corresponding to the sensitive field to which the sensitive data belongs; for the sensitive data in the image control of the sensitive page, determine the location area of ​​the sensitive data in the image to which it belongs, and overwrite or erase the determined location area.

[0061] Preferably, the desensitizing unit 403 may be further used for: in response to the end of the screen recording, restoring the sensitive data in the desensitized sensitive page to the sensitive page, and instructing the sensitive page to perform a refresh.

[0062] In addition, in an embodiment of the present invention, the page registration unit 402 can be further used to: after detecting that any page is a sensitive page, mark the sensitive data in the page and the specific control containing the sensitive data; and the screen recording component is built into the target application.

[0063] According to the technical solution of the embodiment of the present invention, a page-level data desensitization solution for screen recording scenarios is provided. Specifically, a desensitization component is pre-bound to a target application that needs to perform screen recording desensitization processing. The desensitization component only pulls the latest sensitive field information from the remote server after the target application is started. In addition, no other actions are performed at the application level. The main desensitization actions are performed at the page level of the target application. When any page of the target application is created, the desensitization component performs registration on the page if it determines that the page is a sensitive page containing sensitive data, otherwise, no registration is performed. Afterwards, when the sensitive page is in operation, screen recording is started or a sensitive page is created during the screen recording process. The registered desensitizing component identifies the sensitive data of specific controls in the sensitive page and performs corresponding desensitizing processing. After the screen recording is completed, the original data is restored. After the sensitive page is destroyed, the desensitizing component previously registered on the page is cancelled. In this way, data desensitization before generating the screen recording file is achieved without affecting the user experience, avoiding the huge workload of desensitization after the screen recording is completed in the prior art. In addition, the sensitive fields targeted for desensitization are pulled from the remote server in real time by the desensitizing component after the target application is started, ensuring strict compliance with relevant laws, regulations and provisions to ensure data security and user privacy protection. More importantly, in order to reduce the amount of computation and computing resources occupied by the data desensitization process, the desensitization component only performs desensitization actions on a limited number of sensitive pages of the target application through a precisely positioned registration and deregistration mechanism, and does not perform major desensitization actions on non-sensitive pages of the target application. Compared with the desensitization solution executed at the application level, it can reduce the amount of computation of the desensitization program to the greatest extent, ensuring that the computing resources of the user terminal will not be largely occupied by the data desensitization process. It has high availability at a time when computing resources of mobile smart terminals are becoming increasingly precious.

[0064] Figure 5 An exemplary system architecture 500 is shown to which the data desensitization method or data desensitization device according to the embodiment of the present invention can be applied.

[0065] like Figure 5As shown, the system architecture 500 may include terminal devices 501, 502, 503, a network 504 and a server 505 (this architecture is only an example, and the components included in the specific architecture may be adjusted according to the specific application). The network 504 is used to provide a medium for communication links between the terminal devices 501, 502, 503 and the server 505. The network 504 may include various connection types, such as wired, wireless communication links or optical fiber cables.

[0066] The user can use the terminal devices 501, 502, 503 to interact with the server 505 through the network 504 to receive or send messages, etc. Various client applications, such as target application programs (only examples), can be installed on the terminal devices 501, 502, 503.

[0067] The terminal devices 501 , 502 , and 503 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, and the like.

[0068] The server 505 may be a server that provides various services, such as a remote server (only an example) that supports a target application operated by a user using the terminal devices 501, 502, 503. The remote server may process the received sensitive field acquisition request and feed back the processing result (such as the latest sensitive field name - only an example) to the terminal devices 501, 502, 503.

[0069] It should be noted that the data desensitization method provided in the embodiment of the present invention is generally executed by the terminal devices 501 , 502 , and 503 , and accordingly, the data desensitization device is generally arranged in the terminal devices 501 , 502 , and 503 .

[0070] It should be understood that Figure 5 The number of terminal devices, networks and servers in the embodiment is only for illustration. Any number of terminal devices, networks and servers may be provided according to implementation requirements.

[0071] The present invention also provides an electronic device. The electronic device of an embodiment of the present invention includes: one or more processors; a storage device for storing one or more programs, and when the one or more programs are executed by the one or more processors, the one or more processors implement the data desensitization method provided by the present invention.

[0072] Reference below Figure 6 , which shows a schematic diagram of the structure of a computer system 600 of an electronic device suitable for implementing an embodiment of the present invention. Figure 6 The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present invention.

[0073] like Figure 6 As shown, the computer system 600 includes a central processing unit (CPU) 601, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 602 or a program loaded from a storage part 608 into a random access memory (RAM) 603. In the RAM 603, various programs and data required for the operation of the computer system 600 are also stored. The CPU 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0074] The following components are connected to the I / O interface 605: an input section 606 including a keyboard, a mouse, etc.; an output section 607 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage section 608 including a hard disk, etc.; and a communication section 609 including a network interface card such as a LAN card, a modem, etc. The communication section 609 performs communication processing via a network such as the Internet. A drive 610 is also connected to the I / O interface 605 as needed. A removable medium 611, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 610 as needed so that a computer program read therefrom is installed into the storage section 608 as needed.

[0075] In particular, according to the embodiments disclosed in the present invention, the process described in the main step diagram above can be implemented as a computer software program. For example, an embodiment of the present invention includes a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program contains program code for executing the method shown in the main step diagram. In the above embodiment, the computer program can be downloaded and installed from the network through the communication part 609, and / or installed from the removable medium 611. When the computer program is executed by the central processing unit 601, the above functions defined in the system of the present invention are executed.

[0076] It should be noted that the computer-readable medium shown in the present invention may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, device or device. In the present invention, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0077] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the above-mentioned module, program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0078] The units involved in the embodiments of the present invention may be implemented by software or hardware. The units described may also be provided in a processor, for example, may be described as: a processor including a data pulling unit, a page registration unit, a desensitizing unit, and a deregistration unit. The names of these units do not, in some cases, constitute limitations on the units themselves, for example, the data pulling unit may also be described as a "unit that provides sensitive field information to the page registration unit".

[0079] As another aspect, the present invention also provides a computer-readable medium, which may be included in the device described in the above embodiment; or it may exist independently and not be assembled into the device. The above computer-readable medium carries one or more programs, and when the above one or more programs are executed by the device, the steps executed by the device include: in response to the start of the target application, the current sensitive field information is obtained from the remote server and stored locally; in response to any page of the target application being created, in the case of detecting that the page is a sensitive page containing sensitive data in a specific control, the registration of the desensitizing component is performed on the page; wherein the sensitive data is data belonging to the sensitive field; when performing screen recording based on the preset screen recording component, if any sensitive page is in a running state in the screen window, the sensitive data is desensitized using a preset desensitization strategy corresponding to the sensitive field to which the sensitive data in the sensitive page belongs and the specific control type, so that the screen recording file generated by the screen recording does not contain the sensitive data; in response to any sensitive page being destroyed, the desensitization component is deregistered in the sensitive page.

[0080] In the technical solution of the embodiment of the present invention, a page-level data desensitization solution for screen recording scenarios is provided. Specifically, a desensitization component is pre-bound to a target application that needs to perform screen recording desensitization processing. The desensitization component only pulls the latest sensitive field information from the remote server after the target application is started. In addition, no other actions are performed at the application level. The main desensitization actions are performed at the page level of the target application. When any page of the target application is created, the desensitization component performs registration on the page if it determines that the page is a sensitive page containing sensitive data, otherwise, no registration is performed. Afterwards, when the sensitive page is in operation, screen recording is started or a sensitive page is created during the screen recording process. The registered desensitizing component identifies the sensitive data of specific controls in the sensitive page and performs corresponding desensitizing processing. After the screen recording is completed, the original data is restored. After the sensitive page is destroyed, the desensitizing component previously registered on the page is cancelled. In this way, data desensitization before generating the screen recording file is achieved without affecting the user experience, avoiding the huge workload of desensitization after the screen recording is completed in the prior art. In addition, the sensitive fields targeted for desensitization are pulled from the remote server in real time by the desensitizing component after the target application is started, ensuring strict compliance with relevant laws, regulations and provisions to ensure data security and user privacy protection. More importantly, in order to reduce the amount of computation and computing resources occupied by the data desensitization process, the desensitization component only performs desensitization actions on a limited number of sensitive pages of the target application through a precisely positioned registration and deregistration mechanism, and does not perform major desensitization actions on non-sensitive pages of the target application. Compared with the desensitization solution executed at the application level, it can reduce the amount of computation of the desensitization program to the greatest extent, ensuring that the computing resources of the user terminal will not be largely occupied by the data desensitization process. It has high availability at a time when computing resources of mobile smart terminals are becoming increasingly precious.

[0081] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions may occur depending on design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A data desensitization method, characterized in that: The method is performed by a desensitization component pre-introduced into the target application; the method includes: In response to the target application being started, obtaining current sensitive field information from a remote server and storing it locally; In response to any page of the target application being created, in the case where the page is detected to be a sensitive page containing sensitive data in a specific control, registering the desensitizing component on the page; wherein the sensitive data is data belonging to the sensitive field; When performing screen recording based on a preset screen recording component, if any sensitive page is in a running state in the screen window, the sensitive data is desensitized using a preset desensitization strategy corresponding to the sensitive field to which the sensitive data in the sensitive page belongs and the specific control type, so that the screen recording file generated by the screen recording does not contain the sensitive data; In response to any sensitive page being destroyed, the desensitizing component is unregistered on the sensitive page.

2. The method according to claim 1, characterized in that: When performing screen recording based on a preset screen recording component, if any sensitive page is in a running state in the screen window, the sensitive data is desensitized using a preset desensitization strategy corresponding to the sensitive field to which the sensitive data in the sensitive page belongs and the specific control type, including: When any sensitive page is in a running state in the screen window, in response to the screen recording component entering the startup state, the sensitive data in the sensitive page is desensitized; after the desensitization is completed, the screen recording component enters the working state to generate the screen recording file.

3. The method according to claim 1, characterized in that When performing screen recording based on a preset screen recording component, if any sensitive page is in a running state in the screen window, the sensitive data is desensitized using a preset desensitization strategy corresponding to the sensitive field to which the sensitive data in the sensitive page belongs and the specific control type, including: When the screen recording component is in a working state, in response to any sensitive page being created, the sensitive data in the sensitive page is desensitized before the sensitive page enters a visible state; and the sensitive page is in a running state after entering the visible state.

4. The method according to claim 2 or 3, characterized in that: The specific control types include text controls and image controls; and the desensitizing the sensitive data in the sensitive page includes: For the sensitive data in the text control of the sensitive page, mask processing is performed on the sensitive data using a desensitization strategy corresponding to the sensitive field to which the sensitive data belongs; For the sensitive data in the image control of the sensitive page, the location area of ​​the sensitive data in the corresponding image is determined, and the determined location area is overwritten or erased.

5. The method according to claim 1, characterized in that The method further comprises: In response to the end of the screen recording, the sensitive data in the sensitive page that has been desensitized is restored to the sensitive page, and the sensitive page is instructed to perform a refresh.

6. The method according to claim 1, characterized in that The method further comprises: After detecting that any page is a sensitive page, marking the sensitive data in the page and the specific control containing the sensitive data; And, the screen recording component is built into the target application.

7. A data desensitization device, characterized in that: A desensitizing component is provided in advance for introducing a target application program; the device comprises: A data pulling unit, used to: in response to the target application being started, obtain current sensitive field information from a remote server and store it locally; A page registration unit, configured to: in response to any page of the target application being created, register the desensitizing component on the page when detecting that the page is a sensitive page containing sensitive data in a specific control; wherein the sensitive data is data belonging to the sensitive field; A desensitization unit is used to: when performing screen recording based on a preset screen recording component, if any sensitive page is in a running state in the screen window, perform desensitization processing on the sensitive data using a preset desensitization strategy corresponding to the sensitive field to which the sensitive data in the sensitive page belongs and the specific control type, so that the screen recording file generated by the screen recording does not contain the sensitive data; The deregistration unit is used to: in response to any sensitive page being destroyed, execute the deregistration of the desensitizing component on the sensitive page.

8. The device according to claim 7, characterized in that The desensitization unit is further used for: When any sensitive page is in a running state in the screen window, in response to the screen recording component entering a startup state, desensitizing sensitive data in the sensitive page; The screen recording component enters a working state to generate the screen recording file after the desensitization process is completed.

9. An electronic device, characterized in that: include: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors implement the method according to any one of claims 1 to 6.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images