Desensitization data query method and related device
By obtaining the query value of the desensitized data and querying the target backup data from the backup data, the problem of difficulty in querying the original data of the desensitized data is solved, and query efficiency and traceability are improved.
Patent Information
- Application Number
- CN202411650077.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-18
- Publication Date
- 2025-02-25
AI Technical Summary
In the prior art, it is difficult to query the corresponding original data after processing, resulting in the inability to trace the original data in some business scenarios.
By obtaining the query request and query conditions for the target desensitization data, the query value of the target desensitization data is obtained, and the target backup data is obtained from the backup data based on the query value. The backup data is the original data for backup before desensitization.
It realizes rapid positioning and querying the original data corresponding to desensitized data, improves query efficiency, and meets the traceability needs in business scenarios such as complaints.
Smart Images
Figure CN119513135A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of computer technology, and in particular to a desensitized data query method and related devices. Background Art
[0002] With the rapid development of insurance brokerage, finance and other industries, the data generated by enterprise systems during operation are becoming increasingly important. These data not only include performance indicators such as system working status and abnormal conditions, but also include a large amount of original data that must be prevented from being leaked, such as customer names, transaction records, contact information, etc.
[0003] In the related technology, the original data is usually desensitized, so that only the desensitized data can be viewed in business scenarios such as query and browsing, and the complete original data cannot be viewed.
[0004] However, in business scenarios such as case complaints, there is a need to query the original data corresponding to the desensitized data, but it is difficult to query the original data after the desensitization process. Summary of the invention
[0005] In response to the above problems, the present application provides a desensitized data query method and related devices to solve the problem that it is difficult to query the original data corresponding to the desensitized data.
[0006] Based on this, this application discloses the following technical solutions:
[0007] In a first aspect, an embodiment of the present application provides a method for querying desensitized data, the method comprising:
[0008] Obtain a query request and query conditions for target desensitized data, wherein the target desensitized data is desensitized data to be queried among multiple desensitized data, and the desensitized data is data obtained by desensitizing the original data. The query conditions are used to query backup data corresponding to the target desensitized data, and the backup data is data obtained by backing up the original data;
[0009] Based on the query condition, obtaining a query value of the target desensitized data, where the query value is a value of the target desensitized data corresponding to the query condition;
[0010] According to the query value, target backup data corresponding to the query value is obtained from the backup data, and the target backup data is backup data corresponding to original data before desensitizing the target desensitized data.
[0011] Optionally, if the query condition is a common data attribute, and the common data attribute is a data attribute included in both the backup data and the desensitized data, then the original data includes the common data attribute, and the desensitized data and the backup data are obtained in the following manner:
[0012] Acquiring the original data;
[0013] Desensitizing the original data to obtain the desensitized data;
[0014] Classifying the original data according to the common data attribute to obtain a plurality of data sets, wherein the original data in each of the data sets has the same data attribute value;
[0015] storing the multiple data sets to obtain the backup data;
[0016] The obtaining, based on the query condition, a query value of the target desensitized data includes:
[0017] Based on the common data attribute, obtaining a common data attribute value of the target desensitized data, wherein the common data attribute value is an attribute value of the target desensitized data corresponding to the common data attribute;
[0018] The acquiring, according to the query value, target backup data corresponding to the query value from the backup data includes:
[0019] According to the common data attribute value, target backup data corresponding to the common data attribute value is acquired from the backup data.
[0020] Optionally, desensitizing the original data to obtain the desensitized data includes:
[0021] Obtaining a desensitization correspondence relationship, where the desensitization correspondence relationship is used to describe a correspondence relationship between the original data and the desensitization operation;
[0022] Based on the desensitization correspondence relationship, determine the target desensitization operation corresponding to the original data;
[0023] According to the target desensitization operation, the original data is desensitized to obtain the desensitized data.
[0024] Optionally, if the query condition is non-masked data, obtaining a query value of the target masked data based on the query condition includes:
[0025] Based on the un-massified data, obtain keywords of the target masked data, where the keywords are data used for query in the un-massified data;
[0026] The acquiring, according to the query value, target backup data corresponding to the query value from the backup data includes:
[0027] According to the keyword, target backup data including the keyword is acquired from the backup data.
[0028] Optionally, the common data attribute value includes a first common data attribute value and a second common data attribute value, and acquiring, from the backup data, target backup data corresponding to the common data attribute value according to the common data attribute value, includes:
[0029] Obtaining the first common data attribute value;
[0030] According to the first common data attribute value, acquiring a backup data set from the backup data, the backup data set including a plurality of backup data satisfying the first common data attribute value;
[0031] Obtaining the second common data attribute value;
[0032] According to the second common data attribute value, obtaining target backup data from the backup data set; or,
[0033] Obtaining the first common data attribute value and the second common data attribute value;
[0034] According to the first common data attribute value and the second common data attribute value, target backup data is acquired from the backup data.
[0035] Optionally, the query request includes a target account identifier, and the method further includes:
[0036] Obtain the authentication correspondence between the account identifier and the permission information;
[0037] Determine the target permission information corresponding to the target account identifier according to the authentication correspondence relationship;
[0038] The acquiring, according to the query value, target backup data corresponding to the query value from the backup data includes:
[0039] If the target permission information can query the target desensitized data, then according to the query value, the target backup data corresponding to the query value is obtained from the backup data.
[0040] In a second aspect, an embodiment of the present application provides a desensitized data query device, the device comprising: a request unit, an acquisition unit and a query unit;
[0041] The request unit is used to obtain a query request and query conditions for target desensitized data, wherein the target desensitized data is desensitized data to be queried among multiple desensitized data, and the desensitized data is data obtained by desensitizing the original data. The query conditions are used to query backup data corresponding to the target desensitized data, and the backup data is data obtained by backing up the original data;
[0042] The acquisition unit is used to acquire a query value of the target desensitized data based on the query condition, where the query value is a value of the target desensitized data corresponding to the query condition;
[0043] The query unit is used to obtain target backup data corresponding to the query value from the backup data according to the query value, and the target backup data is backup data corresponding to the original data before the target desensitized data is desensitized.
[0044] In a third aspect, an embodiment of the present application provides a computer device, wherein the computer device includes a processor and a memory:
[0045] The memory is used to store a computer program and transmit the computer program to the processor;
[0046] The processor is configured to execute the method according to the first aspect of claim 1 according to the computer program.
[0047] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store a computer program, and the computer program is used to execute the method described in the first aspect above.
[0048] In a fifth aspect, an embodiment of the present application provides a computer program product comprising a computer program, which, when executed on a computer device, enables the computer device to execute the method described in the first aspect above.
[0049] It can be seen from the above technical solutions that the present application has at least the following beneficial effects:
[0050] A query request for target desensitized data and a query condition for querying backup data corresponding to the target desensitized data are obtained; based on the query condition, a query value corresponding to the query condition of the target desensitized data is obtained, so that the data can be quickly located according to the query value, thereby improving the query efficiency; the target backup data corresponding to the query value is obtained from the backup data according to the query value; the backup data provides a data source for querying the target desensitized data, so that the original content of the target desensitized data before desensitization can be queried through the backup data, thereby meeting the query demand for tracing the content of the target desensitized data before desensitization; the target backup data that meets the query value is obtained from multiple backup data according to the query value, so that the query process does not need to search the backup data one by one, thereby improving the efficiency of querying the target desensitized data. BRIEF DESCRIPTION OF THE DRAWINGS
[0051] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.
[0052] Figure 1 A flowchart of a desensitized data query method provided in an embodiment of the present application;
[0053] Figure 2 A schematic diagram of the structure of a desensitized data query device provided in an embodiment of the present application;
[0054] Figure 3 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0055] The embodiments of the present application will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present application are shown in the accompanying drawings, it should be understood that the present application can be implemented in various forms and should not be construed as being limited to the embodiments described herein. Instead, these embodiments are provided to provide a more thorough and complete understanding of the present application. It should be understood that the drawings and embodiments of the present application are only for exemplary purposes and are not intended to limit the scope of protection of the present application.
[0056] Data masking, also known as data bleaching, refers to the removal of sensitive information from the original data. Such sensitive information usually includes the user's name, phone number, address, and ID number. Data masking can ensure that the sensitive information in the original data is not leaked. Common types of desensitization operations include replacement (such as replacing a female user name with F), rearrangement (such as rearranging the serial number 12345 to 54321), encryption (such as encrypting the number 12345 to 23456), truncation (for example, 13811001111 is truncated to 138), and masking (such as 123456 becomes 1xxxx6).
[0057] However, in the insurance brokerage, finance and other industries, scenarios such as case complaints and case node tracing are often involved, which create a need for desensitized data query. Desensitized data query is to query the original data corresponding to the desensitized data before the desensitization operation. However, the original data is difficult to query after the desensitization process.
[0058] Based on this, an embodiment of the present application provides a desensitized data query method and related devices, which obtain a query request for target desensitized data and a query condition for querying backup data corresponding to the target desensitized data, and based on the query condition, obtain the query value corresponding to the query condition of the target desensitized data, so that it can be quickly located according to the query value, thereby improving the query efficiency, and obtaining the target backup data corresponding to the query value from the backup data according to the query value. The backup data provides a data source for querying the target desensitized data, so that the original content of the data before desensitization of the target desensitized data can be queried through the backup data, thereby meeting the query demand for tracing the data content of the target desensitized data before desensitization, and obtaining the target backup data that meets the query value from multiple backup data according to the query value, so that the query process does not need to search the backup data one by one, thereby improving the efficiency of querying the target desensitized data.
[0059] The desensitized data query method provided in this application can be applied to computer devices with data query capabilities, such as terminal devices and servers. Among them, the terminal device can be a desktop computer, a laptop computer, a mobile phone, and a tablet computer; the server can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers. The terminal device and the server can be directly or indirectly connected via wired or wireless communication, and this application does not limit this.
[0060] All data collected in this application (such as original data and desensitized data) are collected with the consent and authorization of the object to which the data belongs (such as users, institutions or enterprises), and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.
[0061] See also Figure 1 , this figure is a schematic flowchart of the desensitized data query method provided by the embodiment of the present application. For ease of description, in the following embodiments, the execution subject of the desensitized data query method is taken as an example of a server. As Figure 1 shown, the desensitized data query method includes S101 - S103.
[0062] S101: Obtain a query request and query conditions for the target desensitized data.
[0063] The original data is the data without desensitization operation. The original data can be log data from the system, and the system can be an insurance business system, a financial business system, etc. For example, the original data can include data such as user names, user contact information, and user ID numbers recorded during the handling of insurance business, which are generated due to business handling in the actual business scenario.
[0064] The desensitized data is the data obtained by desensitizing the original data. To prevent the leakage of the original data, the original data is usually desensitized to obtain the desensitized data. For example, in an original data where the user name is "Li Dahua", based on the masking desensitization operation, the user name is desensitized to become "Li **", and the desensitized data corresponding to the original data is obtained. The target desensitized data is the desensitized data to be queried among multiple desensitized data.
[0065] The original data and the desensitized data can be a piece of data including multiple data attributes. The data attributes can include date, case number, user name, incoming amount, etc. For the desensitized data including multiple data attributes, some data attributes can be desensitized or all data attributes can be desensitized, or it can be a piece of data with only one data attribute, such as the user name. The embodiments of the present application do not limit this here.
[0066] The query condition is a condition determined based on the desensitized data. The query condition can be one or more, and is used to query the backup data corresponding to the target desensitized data. The backup data is the data obtained by backing up the original data. For example, a target desensitized data is "‘Li **’, ‘2020 / 10 / 21’, ‘Smart Health’, ‘5 years’, ‘**** yuan’", where the user name and the incoming amount are desensitized, while the signing date, insurance type, and effective duration are not desensitized. The signing date can be determined as the query condition.
[0067] S102: Based on the query conditions, obtain the query value of the target desensitized data.
[0068] The query value is the value corresponding to the query condition for the target desensitized data, and is used to determine the target backup data corresponding to the target desensitized data. Continuing with the above example, if the query condition is the signing date, the query value is ‘2020 / 10 / 21’.
[0069] S103: According to the query value, the target backup data corresponding to the query value is obtained from the backup data.
[0070] The target backup data is the backup data corresponding to the original data before the target desensitized data is desensitized. The target backup data is the data obtained by backing up the target desensitized data. Therefore, the data content of the target backup data and the target desensitized data is the same. By obtaining the target backup data, the query process of the target desensitized data is realized, and the data content of the target desensitized data before desensitization is obtained, which meets the needs in business scenarios such as complaint cases.
[0071] When the original data is difficult to recover after being desensitized, you can back up the original data and recover it from the backed-up original data. However, this method may result in a large amount of downloaded data and slow original data location during the recovery process, making the process of recovering desensitized data inefficient. The query value can narrow the query range, thereby speeding up the process of locating the target backup data and improving the query efficiency for the target desensitized data.
[0072] It can be seen from the above technical solution that a query request for the target desensitized data and a query condition for querying the backup data corresponding to the target desensitized data are obtained, and based on the query condition, the query value corresponding to the query condition of the target desensitized data is obtained, so that it can be quickly located according to the query value, thereby improving the query efficiency, and obtaining the target backup data corresponding to the query value from the backup data according to the query value. The backup data provides a data source for querying the target desensitized data, so that the original content of the target desensitized data before desensitization can be queried through the backup data, which meets the query demand for tracing the data content of the target desensitized data before desensitization, and obtains the target backup data that meets the query value from multiple backup data according to the query value, so that the query process does not need to search the backup data one by one, thereby improving the efficiency of querying the target desensitized data.
[0073] With the above technical solution, it can be known that the query conditions are conditions determined based on the desensitized data. The content of the desensitized data is complex and changeable, so the query conditions can exist in various forms. The embodiments of the present application do not limit the form of the query conditions. Here, the two cases where the query conditions are common data attributes and the query conditions are non-massified data are taken as examples for explanation.
[0074] First, let's take the query condition as a common data attribute as an example. Common data attributes are data attributes included in both backup data and desensitized data, see A1-A2:
[0075] A1: Based on the common data attributes, obtain the common data attribute values of the target desensitized data.
[0076] The common data attribute value is the attribute value corresponding to the common data attribute of the target desensitized data. As shown in Table 1, three examples of backup data are provided. Due to data loss, special case type, etc., some data attributes of some backup data (such as customer name, insurance type) are null values, but the case number is a data attribute that each backup data has. As shown in Table 2, an example of target desensitized data is provided. The case number is a data attribute included in both the target desensitized data and the backup data. The common data attribute value corresponding to the case number of the target desensitized data is '202010214525'.
[0077] Table 1 Backup data example
[0078] Case No. User Name Signing date Insurance Type Validity period Amount of deposit 202008061912 — 2020 / 08 / 06 — 4 years 2000 NTD 202010214525 Li Xiaoming 2020 / 10 / 21 Smart Health 5 years 2500 NTD 202009062891 Li Xingxiao 2020 / 09 / 06 Safe transportation 1 year 1000 NTD
[0079] Table 2 Example of target desensitized data
[0080] Case No. User Name Signing date Insurance Type Validity period Amount of deposit 202010214525 plum** 2020 / 10 / 21 Smart Health 5 years ****Yuan
[0081] A2: According to the common data attribute value, the target backup data corresponding to the common data attribute value is obtained from the backup data.
[0082] Continuing with the above example, after step A1, the common data attribute value obtained is '202010214525', and the target backup data corresponding to the common data attribute value obtained from the backup data according to the case number is '202010214525', 'Li Xiaoming', '2020 / 10 / 21', 'Smart Health', '5 years', '2500 yuan'.
[0083] In the case where the query condition is a common data attribute, the embodiment of the present application also provides a specific implementation method for obtaining desensitized data and backup data, see B1-B4:
[0084] B1: Get the original data.
[0085] Raw data is data that has not been desensitized, and can be log data from the system. For example, in an insurance business system, the standard output log data of the log architecture framework can be collected by the collector Filebeat, and the log data can be sent to the buffer Kafka, which is classified and buffered by Kafka. The data from Kafka is consumed by the filter Logstash, and the log data is formatted and outputted again, thereby obtaining the raw data.
[0086] B2: Desensitize the original data to obtain desensitized data.
[0087] B3: Classify the original data according to the common data attributes to obtain multiple data sets, and the original data in each data set has the same data attribute value.
[0088] The shared data attributes can be determined as date, time period, case number, etc. according to the content of the desensitized data, or can be determined as namespace, appname, podname, etc. according to the system location source of the original data corresponding to the desensitized data.
[0089] B4: Store multiple data sets to obtain backup data.
[0090] When storing data sets, data compression methods such as gzip can be used for storage, so that more backup data can be stored in the same memory. During the stage of storing multiple data sets or managing backup data, user authentication can be performed on storage operations and management operations to identify the user identity information of the operations, thereby ensuring data security.
[0091] As an implementation method, multiple data can be combined and stored in the Hadoop Distributed File System (HDFS). HDFS is a distributed file system used to store large-scale data sets and supports big data processing applications. HDFS can run on inexpensive hardware, provide high-throughput data access, and is suitable for the storage and processing requirements of large-scale data sets. By storing multiple data sets in HDFS, it can ensure that backup data can be saved for a long time, so that the coverage range of desensitized data queries can be larger and the effective duration can be longer.
[0092] The original data is classified and stored through shared data attributes to obtain backup data. By querying through shared data attributes, the target backup data corresponding to the target desensitized data can be quickly queried from a large amount of backup data based on the data content or source of the target desensitized data itself. This method of classified storage and category-based query can improve the query efficiency of desensitized data.
[0093] Then, the situation where the query condition is non-desensitized data is described. Non-desensitized data is the data in desensitized data that has not changed due to desensitization operations. See C1 - C2:
[0094] C1: Based on the non-desensitized data, obtain the keywords of the target desensitized data.
[0095] Keywords are the data used for querying in non-desensitized data. For example, a target desensitized data is "‘Li*Hua’, ‘2020 / 10 / 21’, ‘Smart Health’, ‘5 years’, ‘**** yuan’", where ‘Li’, ‘Hua’, ‘2020 / 10 / 21’, etc. have not changed due to desensitization operations and belong to non-desensitized data. Based on these non-desensitized data, the keyword of the target desensitized data can be obtained as ‘Li Hua’.
[0096] C2: According to the keyword, target backup data including the keyword is acquired from the backup data.
[0097] Continuing with the above example, the target backup data including "Li Hua" can be obtained according to "Li Hua". As an implementation method, the target backup data can be determined by searching by keywords through a search engine corresponding to the stored backup data, such as performing a full-text search on the keywords through Elasticsearch.
[0098] Through keyword query, real-time and fast query can be achieved when the backup data is not stored based on common data attributes, thereby increasing the diversity of desensitized data query methods.
[0099] The present application also provides a specific implementation method for data desensitization, see D1-D3:
[0100] D1: Obtain the desensitization correspondence.
[0101] The desensitization correspondence is used to describe the correspondence between original data and desensitization operations. Different types of original data correspond to different types of desensitization operations.
[0102] D2: Based on the desensitization correspondence, determine the target desensitization operation corresponding to the original data.
[0103] By determining the type of the original data, different original data types may result in different data lengths, data structures, etc., so corresponding desensitization operations need to be used for different types of data. The target desensitization operation corresponding to the original data type can be determined based on the desensitization correspondence. Specifically, the type of original data can be determined by regular expressions. Regular expressions are type matching rules determined based on the content of the original data. Compared with type matching of field names, regular expressions are more versatile as a recognition method, and there is no need to set multiple rules for the same type of original data with different field names.
[0104] For example, for data types such as ID cards, bank cards, and mobile phone numbers, the corresponding types can be determined through the corresponding data type matching rules:
[0105] (1) ID card id_card_regex =
[0106] / (?<![^\W\d])(?<!\d)([1-9]\d{5})(18|19|20)\d{2}((0[1-9])|(1[0-2] ))(([0-2][1-9])|10|20|30|31)(\d{2})(\d{1}[0-9Xx])(?!\d|[^\W\d]) / .
[0107] (2) Bank card bank_card_regex =
[0108] / (?<![^\W\d])(?<!\d)(62|95)\d{2}(\d{8,11})\d{4}(?!\d|[^\W\d]) /
[0109] (3)Mobile phone number mobile_regex=
[0110] / (?<![^\W\d])(?<!\d)1(\d{2})\d{4}(\d{4})(?!\d|[^\W\d]) /
[0111] (4) Email_regex =
[0112] / (.{4})(?=@) /
[0113] (5) file file_extension_regex =
[0114] / (.{1,8})\.(pdf|docx?|xlsx?|txt|csv|pptx?|zip|rar|tar|mp3|wav)\b / I
[0115] (6) password password_regex =
[0116] / (password)(.{5}) / I
[0117] D3: Desensitize the original data according to the target desensitization operation to obtain desensitized data.
[0118] Taking a masking operation using an asterisk as an example, the gsub function can be used to perform a masking operation on the original data. Different types of original data correspond to different types of masking operations:
[0119] filtered_message=message.gsub(id_card_regex,'\1****\9')
[0120] .gsub(bank_card_regex,'****\2****')
[0121] .gsub(mobile_regex,'1\1****\2')
[0122] .gsub(email_regex,'****\2')
[0123] .gsub(file_extension_regex,'****.\2')
[0124] .gsub(password_regex,'\1****')
[0125] Through the desensitization correspondence, the corresponding desensitization operations are performed on different types of original data, which improves the versatility of desensitization data type matching and the flexibility of desensitization operations. The above desensitization process can be written into a plug-in to achieve the integration of desensitization, simplify the desensitization process, and improve the desensitization efficiency.
[0126] One common data attribute value often cannot accurately locate and query the target backup data. Multiple common data attribute values can narrow the query scope. The embodiment of the present application provides two query methods using multiple common data attribute values. For query method 1, refer to E1-E4, and for query method 2, refer to F1-F2. The following is an explanation of query method 1:
[0127] E1: Get the first common data attribute value.
[0128] E2: According to the first common data attribute value, a backup data set is obtained from the backup data, where the backup data set includes a plurality of backup data satisfying the first common data attribute value.
[0129] First, the backup data set that meets the first common data attribute value can be determined by obtaining the first common data attribute value. For example, the first common data attribute value 2022 / 10 / 21 can be used to determine multiple backup data sets that meet the time corresponding to the date.
[0130] E3: Get the second common data attribute value.
[0131] E4: Acquire target backup data from the backup data set according to the second common data attribute value.
[0132] Then, by obtaining the obtained second common data attribute value, the target backup data that meets the second common data attribute value can be obtained from the backup data set determined by the first common data attribute value. Correspondingly, in the process of storing the obtained backup data, multi-layer classification storage can be performed according to the first common attribute and the second common data attribute, so as to realize the step-by-step query through the first common data attribute value and the second common data attribute value.
[0133] The embodiment of the present application does not limit the number of shared data attribute values, which can be more than 2, and the query principle is the same as above. The second query method is described below.
[0134] F1: Obtain a first common data attribute value and a second common data attribute value.
[0135] F2: Obtain target backup data from the backup data according to the first common data attribute value and the second common data attribute value.
[0136] When there are multiple common data attribute values, not only can they be queried level by level, but also can be queried jointly. For example, after obtaining the first common data attribute value and the second common data attribute value, target backup data that satisfies both values can be obtained from the backup data.
[0137] By querying desensitized data through multiple shared data attribute values, the query range can be narrowed by superimposing query values, thereby improving query accuracy, obtaining target backup data more quickly, and improving query efficiency.
[0138] The reason for desensitizing the desensitized data is that the original data corresponding to the desensitized data is not expected to be leaked completely, and the process of querying the desensitized data is a restoration of the original data. In view of this situation, the embodiment of the present application provides an authentication method, see G1-G3:
[0139] G1: Obtain the authentication correspondence between the account identifier and the permission information.
[0140] The account identifier can be a user name, a combination of an account number and a password, an identity identifier, or other information that can be used to identify an account. The permission information is used to indicate whether the account corresponding to the account identifier can query the target desensitized data.
[0141] G2: Determine the target permission information corresponding to the target account identifier based on the authentication correspondence.
[0142] G3: If the target permission information can query the target desensitized data, then according to the query value, the target backup data corresponding to the query value is obtained from the backup data.
[0143] If the target permission information indicates that the account corresponding to the account identifier can query the target desensitized data, the process of querying the desensitized data is performed. If the target permission information indicates that the account corresponding to the account identifier cannot query the target desensitized data, the query request is rejected.
[0144] By determining the permissions of the account corresponding to the query request, the security of the process of querying the target desensitized data can be improved, thereby ensuring that the data is difficult to be leaked and improving the reliability of the query process.
[0145] It should be emphasized that the above-mentioned desensitizing method, backup method and query method can be executed in a system different from the business system to achieve non-intrusive desensitizing, non-intrusive backup and non-intrusive query of the business system, thereby ensuring that there will be no impact on the data of the business system and ensuring data security.
[0146] See also Figure 2 , Figure 2 A desensitized data query device is provided in an embodiment of the present application, and the device 200 includes a request unit 201, an acquisition unit 202 and a query unit 203.
[0147] A request unit, used to obtain a query request and query conditions for target desensitized data, where the target desensitized data is desensitized data to be queried among multiple desensitized data, and the desensitized data is data obtained by desensitizing the original data. The query conditions are used to query backup data corresponding to the target desensitized data, and the backup data is data obtained by backing up the original data;
[0148] An acquisition unit, used to acquire a query value of the target desensitized data based on a query condition, where the query value is a value of the target desensitized data corresponding to the query condition;
[0149] The query unit is used to obtain target backup data corresponding to the query value from the backup data according to the query value, and the target backup data is the backup data corresponding to the original data before the target desensitized data is desensitized.
[0150] The request unit obtains a query request for the target desensitized data and a query condition for querying the backup data corresponding to the target desensitized data. Based on the query condition, the acquisition unit obtains the query value corresponding to the query condition of the target desensitized data, so that it can be quickly located according to the query value, thereby improving the query efficiency. The query unit obtains the target backup data corresponding to the query value from the backup data according to the query value. The backup data provides a data source for querying the target desensitized data, so that the original content of the target desensitized data before desensitization can be queried through the backup data, thereby meeting the query demand for tracing the data content of the target desensitized data before desensitization. According to the query value, the target backup data that meets the query value is obtained from multiple backup data, so that the query process does not need to search the backup data one by one, thereby improving the efficiency of querying the target desensitized data.
[0151] As a possible implementation, the device further includes a desensitization backup unit, which is used to:
[0152] Acquiring the original data;
[0153] Desensitizing the original data to obtain the desensitized data;
[0154] Classifying the original data according to the common data attribute to obtain a plurality of data sets, wherein the original data in each of the data sets has the same data attribute value;
[0155] storing the multiple data sets to obtain the backup data;
[0156] The acquisition unit is specifically used for:
[0157] Based on the common data attribute, obtaining a common data attribute value of the target desensitized data, wherein the common data attribute value is an attribute value of the target desensitized data corresponding to the common data attribute;
[0158] The query unit is specifically used for:
[0159] According to the common data attribute value, target backup data corresponding to the common data attribute value is acquired from the backup data.
[0160] As a possible implementation, the desensitizing backup unit is specifically used for:
[0161] Obtaining a desensitization correspondence relationship, where the desensitization correspondence relationship is used to describe a correspondence relationship between the original data and the desensitization operation;
[0162] Based on the desensitization correspondence relationship, determine the target desensitization operation corresponding to the original data;
[0163] According to the target desensitization operation, the original data is desensitized to obtain the desensitized data.
[0164] As a possible implementation manner, the acquisition unit is specifically used for:
[0165] Based on the un-massified data, obtain keywords of the target masked data, where the keywords are data used for query in the un-massified data;
[0166] The query unit is specifically used for:
[0167] According to the keyword, target backup data including the keyword is acquired from the backup data.
[0168] As a possible implementation manner, the query unit is specifically used for:
[0169] Obtaining the first common data attribute value;
[0170] According to the first common data attribute value, acquiring a backup data set from the backup data, the backup data set including a plurality of backup data satisfying the first common data attribute value;
[0171] Obtaining the second common data attribute value;
[0172] According to the second common data attribute value, obtaining target backup data from the backup data set; or,
[0173] Obtaining the first common data attribute value and the second common data attribute value;
[0174] According to the first common data attribute value and the second common data attribute value, target backup data is acquired from the backup data.
[0175] As a possible implementation manner, the device further includes an authentication unit, configured to:
[0176] Obtain the authentication correspondence between the account identifier and the permission information;
[0177] Determine the target permission information corresponding to the target account identifier according to the authentication correspondence relationship;
[0178] The query unit is specifically used for:
[0179] If the target permission information can query the target desensitized data, then according to the query value, the target backup data corresponding to the query value is obtained from the backup data.
[0180] The present application also provides a computer device, see Figure 3 , which shows a structural diagram of a computer device provided in an embodiment of the present application, such as Figure 3 As shown, the device includes a memory 310 and a processor 320:
[0181] The memory 310 is used to store program codes and transmit the program codes to the processor;
[0182] The processor 320 is used to execute the method provided by the above method embodiment according to the instructions in the program code.
[0183] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store a computer program, and the computer program is used to execute the method provided by the above method embodiment.
[0184] The embodiment of the present application also provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the method provided in the above method embodiment.
[0185] It should be noted that the various embodiments in this specification are described in a progressive manner, and each embodiment focuses on the differences from other embodiments, and the same or similar parts between the various embodiments can be referred to each other. For the system or device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part description.
[0186] The term "including" and its variations used herein are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". The relevant definitions of other terms will be given in the following description.
[0187] It should be understood that in the present application, "at least one (item)" means one or more, and "plurality" means two or more. "And / or" is used to describe the association relationship of associated objects, indicating that three relationships may exist. For example, "A and / or B" can mean: only A exists, only B exists, and A and B exist at the same time, where A and B can be singular or plural. The character " / " generally indicates that the objects associated before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, at least one of a, b or c can mean: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, c can be single or multiple.
[0188] It should also be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.
[0189] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.
[0190] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments shown herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.
Claims
1. A method for querying desensitized data, characterized in that: The method comprises: Obtain a query request and query conditions for target desensitized data, wherein the target desensitized data is desensitized data to be queried among multiple desensitized data, and the desensitized data is data obtained by desensitizing the original data. The query conditions are used to query backup data corresponding to the target desensitized data, and the backup data is data obtained by backing up the original data; Based on the query condition, obtaining a query value of the target desensitized data, where the query value is a value of the target desensitized data corresponding to the query condition; According to the query value, target backup data corresponding to the query value is obtained from the backup data, and the target backup data is backup data corresponding to original data before desensitizing the target desensitized data.
2. The method according to claim 1, characterized in that If the query condition is a common data attribute, and the common data attribute is a data attribute included in both the backup data and the desensitized data, then the original data includes the common data attribute, and the desensitized data and the backup data are obtained in the following manner: Acquiring the original data; Desensitizing the original data to obtain the desensitized data; Classifying the original data according to the common data attribute to obtain a plurality of data sets, wherein the original data in each of the data sets has the same data attribute value; storing the multiple data sets to obtain the backup data; The obtaining, based on the query condition, a query value of the target desensitized data includes: Based on the common data attribute, obtaining a common data attribute value of the target desensitized data, wherein the common data attribute value is an attribute value of the target desensitized data corresponding to the common data attribute; The acquiring, according to the query value, target backup data corresponding to the query value from the backup data includes: According to the common data attribute value, target backup data corresponding to the common data attribute value is acquired from the backup data.
3. The method according to claim 2, characterized in that Desensitizing the original data to obtain the desensitized data includes: Obtaining a desensitization correspondence relationship, where the desensitization correspondence relationship is used to describe a correspondence relationship between the original data and the desensitization operation; Based on the desensitization correspondence relationship, determine the target desensitization operation corresponding to the original data; According to the target desensitization operation, the original data is desensitized to obtain the desensitized data.
4. The method according to claim 1, characterized in that: If the query condition is non-masked data, then obtaining the query value of the target masked data based on the query condition includes: Based on the un-massified data, obtain a keyword of the target masked data, where the keyword is data used for query in the un-massified data; The acquiring, according to the query value, target backup data corresponding to the query value from the backup data includes: According to the keyword, target backup data including the keyword is acquired from the backup data.
5. The method according to claim 2, characterized in that: The common data attribute value includes a first common data attribute value and a second common data attribute value, and acquiring target backup data corresponding to the common data attribute value from the backup data according to the common data attribute value includes: Obtaining the first common data attribute value; According to the first common data attribute value, acquiring a backup data set from the backup data, the backup data set including a plurality of backup data satisfying the first common data attribute value; Obtaining the second common data attribute value; According to the second common data attribute value, obtaining target backup data from the backup data set; or, Obtaining the first common data attribute value and the second common data attribute value; According to the first common data attribute value and the second common data attribute value, target backup data is acquired from the backup data.
6. The method according to claim 1, characterized in that The query request includes a target account identifier, and the method further includes: Obtain the authentication correspondence between the account identifier and the permission information; Determine the target permission information corresponding to the target account identifier according to the authentication correspondence relationship; The acquiring, according to the query value, target backup data corresponding to the query value from the backup data includes: If the target permission information can query the target desensitized data, then according to the query value, the target backup data corresponding to the query value is obtained from the backup data.
7. A desensitized data query device, characterized in that: The device comprises: a request unit, an acquisition unit and a query unit; The request unit is used to obtain a query request and query conditions for target desensitized data, wherein the target desensitized data is desensitized data to be queried among multiple desensitized data, and the desensitized data is data obtained by desensitizing the original data. The query conditions are used to query backup data corresponding to the target desensitized data, and the backup data is data obtained by backing up the original data; The acquisition unit is used to acquire a query value of the target desensitized data based on the query condition, where the query value is a value of the target desensitized data corresponding to the query condition; The query unit is used to obtain target backup data corresponding to the query value from the backup data according to the query value, and the target backup data is backup data corresponding to the original data before the target desensitized data is desensitized.
8. A computer device, characterized in that: The computer device comprises a processor and a memory: The memory is used to store a computer program and transmit the computer program to the processor; The processor is configured to execute the method according to any one of claims 1 to 6 according to the computer program.
9. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store a computer program, and the computer program is used to execute the method according to any one of claims 1 to 6.
10. A computer program product comprising a computer program, characterized in that When the method is executed on a computer device, the computer device is enabled to execute the method according to any one of claims 1 to 6.