Data desensitization method and device, storage medium and electronic equipment

Abstract

The invention discloses a data desensitization method and device, a storage medium and electronic equipment, and relates to the technical field of data processing, the data desensitization method comprises the following steps: in response to sending API request information to an API service, receiving API proxy traffic data returned by the API service; identifying a content protocol corresponding to the API proxy traffic data; based on a predetermined three-layer structure table and a content protocol, determining structure data corresponding to the API proxy traffic data, the predetermined three-layer structure table being a content-structure-value three-layer structure; and labeling a sensitive identifier on a sensitive field contained in the structural data, and performing data desensitization processing on the API proxy traffic data according to the sensitive identifier. Compared with the prior art, the data desensitization method and the data desensitization device have the advantages that the sensitive data can be prevented from being mistakenly identified or omitted, and the accuracy of data desensitization is guaranteed.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data desensitization method, device, storage medium and electronic device. Background Art

[0002] In the process of obtaining data through the Application Programming Interface (API), the traffic data returned by the API contains a lot of sensitive data that needs to be desensitized. The general solution is to deploy the API protection system agent before the API service, and the API protection system identifies and desensitizes the sensitive data.

[0003] Currently, data desensitization is performed in the API protection system mainly by using dictionaries or regular rules to identify sensitive data in the traffic data returned by the API and desensitizing the identified sensitive data.

[0004] However, since the traffic data returned by the API contains a lot of data with similar content or names, the data desensitization method cannot accurately identify the data that needs to be desensitized from similar content, resulting in missed or wrong identification of the data that needs to be desensitized, which in turn leads to desensitization errors in the desensitized data, resulting in low accuracy of data desensitization. Summary of the invention

[0005] In view of this, the present application provides a data desensitization method, device, storage medium and electronic device, the main purpose of which is to improve the technical problem that the current existing technology cannot accurately identify the data that needs to be desensitized among similar contents, resulting in missed identification or wrong identification in the identified data that needs to be desensitized, and then resulting in desensitization errors in the desensitized data, resulting in low accuracy of data desensitization.

[0006] In a first aspect, the present application provides a data desensitization method, comprising:

[0007] In response to sending a program programming interface API request information to an API service, receiving API proxy traffic data returned by the API service;

[0008] Identify the content protocol corresponding to the API proxy traffic data;

[0009] Determine the structure data corresponding to the API proxy traffic data based on a predetermined three-layer structure table and the content protocol, wherein the predetermined three-layer structure table is a content-structure-value three-layer structure;

[0010] The sensitive fields contained in the structure data are marked with sensitive identifiers, and the API proxy traffic data is desensitized based on the sensitive identifiers.

[0011] In a second aspect, the present application provides a data desensitization device, comprising:

[0012] A receiving module, configured to receive API proxy traffic data returned by the API service in response to sending a program programming interface API request information to the API service;

[0013] an identification module configured to identify a content protocol corresponding to the API proxy traffic data;

[0014] A determination module is configured to determine the structure data corresponding to the API proxy traffic data based on a predetermined three-layer structure table and the content protocol, wherein the predetermined three-layer structure table is a content-structure-value three-layer structure;

[0015] The desensitizing module is configured to mark sensitive fields contained in the structure data with sensitive identifiers, and perform data desensitization processing on the API proxy traffic data based on the sensitive identifiers.

[0016] In a third aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the data desensitization method described in the first aspect is implemented.

[0017] In a fourth aspect, the present application provides an electronic device, comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor implements the data desensitization method described in the first aspect when executing the computer program.

[0018] By means of the above technical scheme, the present application provides a data desensitization method, device, storage medium and electronic device. Compared with the current existing technology, the present application identifies the content protocol corresponding to the API proxy traffic data, and determines the structural data corresponding to the API proxy traffic data based on a predetermined three-layer structure table and the content protocol, wherein the predetermined three-layer structure table is a three-layer structure of content-structure-value, which can clearly classify the data identified in the content protocol, and also mark the sensitive fields contained in the structural data with sensitive identifiers, and perform data desensitization on the API proxy traffic data based on the sensitive identifiers, so that the sensitive fields in the structural data that need to be desensitized can be clearly determined, and the sensitive fields are marked with sensitive identifiers, and the data is desensitized based on the sensitive identifiers, so as to avoid the occurrence of incorrect or missed identification of sensitive data, thereby ensuring the accuracy of data desensitization. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0020] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0021] Figure 1 A schematic diagram of a data desensitization method provided in an embodiment of the present application is shown;

[0022] Figure 2 A schematic diagram of a data desensitization method provided in an embodiment of the present application is shown;

[0023] Figure 3 A schematic diagram of a data desensitization method provided in an embodiment of the present application is shown;

[0024] Figure 4 A schematic diagram showing an example provided by an embodiment of the present application;

[0025] Figure 5 A schematic diagram showing an example provided by an embodiment of the present application;

[0026] Figure 6 A schematic diagram of an example process provided by an embodiment of the present application is shown;

[0027] Figure 7 A schematic diagram of the structure of a data desensitization device provided in an embodiment of the present application is shown;

[0028] Figure 8 A schematic structural diagram of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0029] The embodiments of the present application will be described in more detail below with reference to the accompanying drawings. It should be noted that the embodiments and features in the embodiments of the present application can be combined with each other without conflict.

[0030] In order to improve the technical problem that the prior art cannot accurately identify the data to be desensitized from similar content, resulting in missed or wrong identification of the identified data to be desensitized, and then resulting in desensitization errors in the desensitized data, resulting in low accuracy of data desensitization. This embodiment provides a data desensitization method, such as Figure 1 As shown, the method includes:

[0031] Step 101: In response to sending API request information to an API service, receiving API proxy traffic data returned by the API service.

[0032] An Application Programming Interface (API) is a set of rules, protocols, and tools that define how software components communicate with each other. APIs enable different software applications to communicate and exchange data without having to understand the underlying implementation details. APIs can be used in a variety of scenarios, including operating systems, databases, web services, etc.

[0033] In this embodiment, in various scenarios such as application systems, development and operation and maintenance, data is obtained through the API mainly by generating API request information. After the API request information is verified by the API protection system, the API request information is sent to the API service. After receiving the API request information, the API service generates API proxy traffic data according to the content of the request information and returns it to the API protection system. The API protection system processes the API proxy traffic data and returns it to the API.

[0034] It should be noted that the execution subject of this application is the API protection system, which is a key component to ensure API security. It covers technologies and measures from identity authentication, authorization to encryption, current limiting, etc. A complete API protection system can effectively prevent unauthorized access, data leakage and other security threats.

[0035] Specifically, the functions of the API protection system may include but are not limited to the following:

[0036] 1. Authentication, ensuring that only verified users can access the API.

[0037] 2. Authorization: Ensure that users can only access resources for which they are authorized.

[0038] 3. Encryption: ensure that data in transmission is not eavesdropped or tampered with.

[0039] 4. Rate Limiting, used to prevent API abuse and ensure that resources are not over-consumed.

[0040] 5. Request Validation: Ensure that the incoming data format is correct and legal.

[0041] 6. Logging and Monitoring, used to detect abnormal behavior and respond in a timely manner.

[0042] 7. Exception Handling: Exception handling ensures that the API can provide useful feedback when encountering errors.

[0043] 8. Security Auditing: Security auditing is used to regularly check the security status of the API.

[0044] In some examples, API proxy traffic data refers to the number of requests processed by the API proxy server and related statistics. API proxies are often used to implement functions such as load balancing, caching, authentication, rate limiting, and can collect and report important information about API usage. The API proxy traffic data in the embodiments of the present application is the data returned to the API by the API service based on the received API request information.

[0045] Step 102: Identify the content protocol corresponding to the API proxy traffic data.

[0046] In the embodiment of the present application, the content protocols used by the API proxy traffic data include transmission protocols, content encodings, programming interfaces, and API gateway protocols. The content protocols used by the API proxy traffic data generally refer to protocols related to API requests and responses, as well as protocols used to transmit these data.

[0047] Specifically, a transmission protocol refers to a protocol used to transmit data on a network. Common transmission protocols may include but are not limited to the following:

[0048] 1. HTTP / HTTPS:

[0049] HTTP (HyperText Transfer Protocol): A stateless protocol used to transmit web pages and API data.

[0050] HTTPS (HTTP Secure): HTTP encrypted using TLS / SSL to protect the security of data transmission.

[0051] 2. WebSocket: A two-way communication protocol that allows a persistent connection between the client and the server and full-duplex communication.

[0052] 3. gRPC: A high-performance remote procedure call (RPC) framework that supports multiple languages, uses HTTP / 2 for transmission, and uses TLS encryption by default.

[0053] 4. MQTT (Message Queuing Telemetry Transport): A lightweight message transmission protocol suitable for Internet of Things (IoT) scenarios.

[0054] In the embodiment of the present application, it is necessary to specifically identify one or more content protocols used by the API proxy traffic data.

[0055] Step 103: Determine the structure data corresponding to the API proxy traffic data based on the predetermined three-layer structure table and the content protocol.

[0056] The predetermined three-layer structure table is a three-layer structure of content-structure-value.

[0057] In some examples, the Content-Structure-Value (CSV) is an abstract conceptual model used to describe and organize different levels of data. This three-layer structure is often used to understand and analyze the composition of data, especially in the fields of database design, data exchange, and data processing.

[0058] Specifically, content refers to the specific information or value of data. It is the core part of data, including the information actually stored in the data structure. Content can be any type of data, such as numbers, strings, dates, etc. For example, in a user table, content can be specific information such as the user's name, age, gender, etc. In an order table, content can be order number, order time, product name, product quantity, etc.

[0059] Furthermore, structure refers to the way data is organized, that is, how data is organized into a specific format or pattern. Structure determines how data is stored, retrieved, and accessed. Common data structures include arrays, lists, trees, graphs, relational database tables, etc. For example, in a relational database, structure usually refers to the definition of a table, including table name, field name, field type, etc. In JSON format, structure can be in the form of key-value pairs, such as {"name":"Alice","age":30}.

[0060] Correspondingly, a value refers to a specific numerical value stored in a data structure. It is a specific instance of content, representing a specific data point. For example, in a user table, "Zhang San", "Li Si", etc. are the values ​​of the name field. In an order table, "2023-01-01" is the value of the order time field.

[0061] In an embodiment of the present application, it is necessary to determine the specific data corresponding to the content-structure-value three-layer structure corresponding to the API proxy traffic data based on the content protocol, that is, content data, received data and value data in the present application.

[0062] Step 104: mark sensitive fields contained in the structure data with sensitive identifiers, and perform data desensitization processing on the API proxy traffic data based on the sensitive identifiers.

[0063] For this embodiment, in the three-layer structure of content-structure-value, "structure" refers to the organization or format of data, which defines how data is stored, retrieved and accessed. At the structure layer, field is one of the basic units that constitute the data structure. Fields can be understood as columns or attributes in the data structure, which are used to store specific types of information.

[0064] For example, in relational databases (such as MySQL, PostgreSQL, etc.), fields are usually called "columns", and the data type of each column is defined when creating a table; in NoSQL databases (such as MongoDB), fields can be nested objects or arrays; in XML (Extensible Markup Language), fields are usually represented by elements; in JSON (JavaScript Object Notation), fields are usually represented in the form of key-value pairs.

[0065] It should be noted that, in the embodiment of the present application, a field may be a column in the structured data, that is, each segment in the structured data is a column.

[0066] Furthermore, sensitive field annotation refers to marking fields containing sensitive information during data processing and storage so that special protection measures can be taken. Sensitive information includes but is not limited to personal identity information (such as name, ID number), financial information (such as bank card number), health information (such as medical records), passwords, and other information that needs to be kept confidential. Labeling sensitive fields can ensure that sensitive information is not accessed by unauthorized personnel, meet the requirements of laws and regulations, reduce the risk of data leakage, and protect enterprises and individuals from damage.

[0067] Optionally, data masking is a technique for hiding sensitive information during data display or transmission. Common masking methods include but are not limited to the following:

[0068] 1. Replacement: Replace real data with fake data.

[0069] 2. Masking: partially hide data, such as showing the first and last few digits, and replacing the middle with asterisks or other characters.

[0070] 3. Hash: Use a hash algorithm to convert sensitive data into an irreversible hash value.

[0071] Compared with the current existing technology, this embodiment identifies the content protocol corresponding to the API proxy traffic data, determines the structural data corresponding to the API proxy traffic data based on a predetermined three-layer structure table and the content protocol, wherein the predetermined three-layer structure table is a three-layer structure of content-structure-value, and the data in the identified content protocol can be clearly classified, and sensitive fields contained in the structural data are marked with sensitive identifiers, and the API proxy traffic data is desensitized according to the sensitive identifiers. The sensitive fields that need to be desensitized in the structural data can be clearly determined, and the sensitive fields are marked with sensitive identifiers. The data is desensitized based on the sensitive identifiers, thereby avoiding the occurrence of incorrect or missing identification of sensitive data, and ensuring the accuracy of data desensitization.

[0072] As a refinement and extension of the above embodiment, when determining the structure data corresponding to the API proxy traffic data based on the predetermined three-layer structure table and the content protocol, the following method may be used but is not limited to, and the method includes:

[0073] Step 201: parse the content protocol to determine the content protocol type corresponding to the content protocol and the content structure data contained in the content protocol.

[0074] In the embodiment of the present application, all content structure data contained in the content protocol can be obtained after parsing the content protocol.

[0075] Exemplarily, if the content protocol is JSON, the protocol parsing module parses out the HTTP request header, request body, response header, response body, etc.

[0076] Step 202: Based on the predetermined three-layer structure table, content structure data is extracted to obtain content data, structure data and value data corresponding to the API proxy traffic data.

[0077] Exemplarily, the identified content data (location) location may include: username, gender, age, habit.shopping, habit.sport, habit.diet, friend.0.name, friend.0.gender, friend.0.age, friend.1.name, friend.1.gender, friend.1.age, and the like.

[0078] Accordingly, the identified structural data structure (struct) may include: username, gender, age, habit.shopping, habit.sport, habit.diet, friend.name, friend.gender, friend.age, friend.name, friend.gender, friend.age, and the like.

[0079] Correspondingly, the identified value data values ​​(value) may include: Zhang San, male, 40, electronic, basketball, noodles, Li Si, male, 40, Wang Wu, male, 30, and the like.

[0080] Furthermore, when marking sensitive fields contained in the structure data with sensitive identifiers, the following methods may be used but are not limited to: Figure 3 As shown, the method includes:

[0081] Step 301: Based on the content data, structure data and value data, a content-structure-value three-layer data table corresponding to the API proxy traffic data is formed.

[0082] Exemplarily, based on step 202, the content-structure-value three-layer data table corresponding to the API proxy traffic data may be as shown in Table 1 below:

[0083] Table 1

[0084]

[0085]

[0086] Step 302: Merge the content data and value data with the same structure data in the content-structure-value three-layer data table respectively to obtain a markable content-structure-value three-layer data table corresponding to the API proxy traffic data.

[0087] Exemplarily, based on step 301, the content data and value data with the same structure data in the content-structure-value three-layer data table are merged respectively, which can be: if the 7th row and the 10th row in the structure data of Table 1 are the same, then the content data and value data of the 7th row and the 10th row in Table 1 need to be merged respectively; if the 8th row and the 11th row in the structure data of Table 1 are the same, then the content data and value data of the 8th row and the 11th row in Table 1 need to be merged respectively; if the 9th row and the 12th row in the structure data of Table 1 are the same, then the content data and value data of the 9th row and the 12th row in Table 1 need to be merged respectively, and a markable content-structure-value three-layer data table is obtained, which can be specifically shown in Table 2 below:

[0088] Table 2

[0089]

[0090]

[0091] Step 303: Obtain a structure data template containing a sensitive identifier corresponding to the content protocol type.

[0092] The structural data template is obtained by summarizing and updating the historical structural data containing sensitive identifiers.

[0093] Exemplarily, the structural data template can be structural data maintained in the API protection system. Specifically, in the API protection process, an API can be defined, for example: HTTP is expressed through Method+UrlPath (of course other APIs can use the same abstraction, such as KAFKA is identified by TOPIC). Since APIs are naturally dynamic and extensible (unlike databases, the column information and content information of a table are relatively fixed), the content structure of the API is managed as an important attribute of an API. In this way, the content structure of an API can be seen, and sensitive information of the API structure can be annotated and then protected.

[0094] For example, the structure data template may be as shown in Table 3 below:

[0095] Table 3

[0096] Structure username gender age habit.shopping habit.sport habit.diet friend.name friend.gender friend.age friend.name friend.gender friend.age address (new merged structure)

[0097] Because the API itself is constantly developed and maintained based on business changes, the parameters and content of the data will continue to increase and decrease. In this way, the structure of the API can be maintained as an important attribute of the API and protected through continuous management, annotation, and maintenance. The appearance time of the field will be updated based on the traffic. If the content of a structure does not appear for a long time, the API may have changed and the structure content is no longer used. This will also be explained in the structure of the API, as shown in Table 4 below:

[0098] Table 4

[0099] Structure Appearance time username Within 1 hour gender Within 1 hour age Within 1 hour habit.shopping Within 1 hour habit.sport Within 1 hour habit.diet Within 1 hour friend.name Within 1 hour friend.gender Within 1 hour friend.age Within 1 hour friend.name Within 1 hour friend.gender Within 1 hour friend.age (may be deprecated) 1 month ago address Within 1 hour

[0100] It should be noted that through this API content structure management method, the API content structure is dynamically and continuously maintained as an important attribute of an API. Based on this content structure, field sensitive information can be continuously maintained, and the API can be protected based on this sensitive information.

[0101] Step 304: determine the marked structural data and the unmarked structural data in the markable content-structure-value three-layer data table based on the structural data template, and divide the markable content-structure-value three-layer data table into the marked content-structure-value three-layer data table and the unmarked content-structure-value three-layer data table based on the marked structural data and the unmarked structural data.

[0102] Step 305: in the content-structure-value three-layer data table to be marked, sensitive fields included in the structure data are marked with sensitive identifiers to obtain the target content-structure-value three-layer data table.

[0103] Exemplarily, based on step 305, if the field "friend.name" in the structure data is a sensitive field, "friend.name" can be marked with a sensitive identifier to obtain a three-layer data table of target content-structure-value after marking, which can be specifically shown in the following Table 5:

[0104] Table 5

[0105]

[0106]

[0107] It should be noted that the specific content of the sensitive identifier can be set according to needs, for example, it can be "sensitive", "m", "mg", etc. The specific content of the sensitive identifier is not limited in this application.

[0108] Further, when performing data desensitization processing on the API proxy traffic data according to the sensitive identification, the following method may be used but is not limited to implement the method, which includes:

[0109] Step 11: Determine the first sensitive value data corresponding to the sensitive identifier in the target content-structure-value three-layer data table and the second sensitive value data corresponding to the sensitive identifier in the marked content-structure-value three-layer data table.

[0110] Further, based on step 303, in the structure data of Table 5, the field "friend.name" has a sensitive mark, and it is necessary to determine all the value data corresponding to the field "friend.name", that is, "Li Si" and "Wang Wu".

[0111] It should be noted that the first sensitive value data is the sensitive value data with sensitive identification in the target content-structure-value three-layer data table, and the second sensitive value data is the sensitive value data with sensitive identification in the marked content-structure-value three-layer data table.

[0112] Step 12: Desensitize the first sensitive value data and the second sensitive value data according to a predetermined desensitization rule to obtain a desensitized content-structure-value three-layer data table.

[0113] Exemplarily, based on step 11, desensitization processing is performed on "Li Si" and "Wang Wu" in Table 5 according to a predetermined desensitization rule.

[0114] Data masking is a method of protecting sensitive information by modifying or replacing data so that it cannot be identified as real personal information or other sensitive information while maintaining the characteristics of the original data. Masking rules are specific guidelines that define how to modify or replace data, aiming to ensure that data retains its functionality and usability during processing while protecting privacy and security. Types of masking rules Masking rules can be divided into many types according to different application scenarios and needs. Common ones include but are not limited to:

[0115] 1. Substitution: Substitution means replacing the original data with a predefined value or a randomly generated value. This method can retain the format of the data but change its specific content. For example, replace the mobile phone number "13800138000" with "13812345678".

[0116] 2. Hashing: Hashing refers to using a hash function to convert raw data into a string of fixed length. This method ensures the irreversibility of the data, but changes the format of the data. For example, the password "securepassword" is converted to "25f9e794323b453885f5181f1b624d0b" using the SHA-256 hash function.

[0117] 3. Encryption: Encryption refers to the use of encryption algorithms to convert original data into ciphertext. This method can protect the privacy of data, but it needs to be decrypted when used. For example, the credit card number "4111111111111111" is encrypted into ciphertext using the AES encryption algorithm.

[0118] 4. Generalization: Generalization refers to abstracting data into higher-level categories to reduce the possibility of identification. For example, age "25" is generalized to age range "20-30".

[0119] 5. Shifting: Shifting is the addition and subtraction of numerical data to change its actual value. For example, shifting the birthday "1990-01-01" to "1990-02-02".

[0120] 6. Truncation: Truncation refers to removing part of the data. For example, the email address "zhangsan@example.com" is truncated to zhangsan@***.com.

[0121] 7. Randomization: Randomization means using a random number generator to replace the original data. For example, replace the ID number "123456789012345678" with a randomly generated number.

[0122] 8. Masking: Masking refers to using mask characters to partially or completely hide data. For example, masking the bank account number "1234567890123456" to "1234****5678".

[0123] It should be noted that the predetermined desensitization rule may be one or several of the above-mentioned desensitization rules, or may be other desensitization rules not listed. The specific content of the predetermined desensitization rule is not limited in the embodiments of the present application.

[0124] Optionally, after step 301 to step 305, the method of this embodiment further includes: extracting target structure data in the target content-structure-value three-layer data table, and updating the structure data template based on the target structure data.

[0125] Further, after executing step 12, the following method may be used but is not limited to implement the method, which includes:

[0126] Step 21: Generate desensitized API proxy traffic data based on the desensitized content-structure-value three-layer data table

[0127] Step 22: Send the desensitized API proxy traffic data to the API.

[0128] Further, when executing the response to sending the API request information to the API service and receiving the API proxy traffic data returned by the API service, the following method may be adopted but is not limited to, and the method includes:

[0129] Step 31: Identify the transmission protocol of the API proxy traffic data and determine the target transmission protocol corresponding to the API proxy traffic data.

[0130] Step 32: Based on the target transmission protocol, identify the content protocol corresponding to the API proxy traffic data.

[0131] In the embodiment of the present application, to identify the content protocol, it is necessary to first identify the transmission protocol used, and then identify the content protocol based on the transmission protocol used.

[0132] It should be noted that in the prior art, when obtaining data through API (in various scenarios such as application systems, development and operation), the data returned by API contains a lot of sensitive data that needs to be desensitized. A common solution is to have the API protection system identify and desensitize sensitive data before deploying the API protection system agent on the API service, such as Figure 4 As shown in the figure, the API service provides the service GET / customerinfo to obtain customerinfo. The API protection system proxy is deployed before the API service. The API request obtains the information of GET / customerinfo through the API protection system. The API protection system: identifies sensitive information in the data returned by the API service and identifies that the phone number "13000000000" is sensitive information. The identified sensitive information is desensitized to "xxxxxxxxxxx". The sensitive information in the data obtained by the API requester has been desensitized by the API protection system.

[0133] The existing method of identifying sensitive information is to use dictionaries or regular rules. Such identification rules may lead to many cases of misidentification or missed identification. For example, if there is an 11-digit number starting with 138 in the information (which may be an internal information number), it will definitely be identified as a mobile phone number if the mobile phone number identification rule is used, resulting in misidentification. Another example is that there are two types of data A and B, data A is sensitive data, and data B is not sensitive data. The user's name is number:A data; number:B data. If the dictionary number is defined to identify sensitive data, it is impossible to distinguish between data A and B.

[0134] Compared with the current existing technology, this embodiment identifies the content protocol corresponding to the API proxy traffic data, determines the structural data corresponding to the API proxy traffic data based on a predetermined three-layer structure table and the content protocol, wherein the predetermined three-layer structure table is a three-layer structure of content-structure-value, and the data in the identified content protocol can be clearly classified, and sensitive fields contained in the structural data are marked with sensitive identifiers, and the API proxy traffic data is desensitized according to the sensitive identifiers. The sensitive fields that need to be desensitized in the structural data can be clearly determined, and the sensitive fields are marked with sensitive identifiers. The data is desensitized based on the sensitive identifiers, thereby avoiding the occurrence of incorrect or missing identification of sensitive data, and ensuring the accuracy of data desensitization.

[0135] In order to illustrate the specific implementation process of this embodiment, the following specific application examples are given: Figure 5 As shown, but not limited to:

[0136] The sensitive data management method based on this patent is divided into three steps, such as Figure 6 As shown:

[0137] Step 41, when the API request accesses the API service through the API protection system, the API protection system will identify the content structure of the API. Specifically, there are many API content protocols, such as GPRC, HTTP, and there are many HTTP content-bearing protocols, such as JSON, FORM, HTML, XML, etc. The protocol identification module mainly identifies the API transmission protocol and content-bearing protocol. According to the results of protocol identification, different protocols are parsed.

[0138] Step 42: Annotate sensitive information based on the identification structure of the API content structure. Specifically, extract structured content. Regardless of the protocol, extract and construct a three-layer structure table of the content: (location) location-> structure (struct)-> value (value). Through such a three-layer structure, structured extraction of content and desensitization based on sensitive information annotation can be completed.

[0139] Step 43: Based on the sensitive information marked in the API content structure, the API protection system performs desensitization. Because the API has dynamic properties, for example, different parameters may result in different content, so the API content structure must be maintained and updated in real time to ensure that a complete and new API content structure is seen from the management properties.

[0140] Compared with the current existing technology, this embodiment identifies the content protocol corresponding to the API proxy traffic data, determines the structural data corresponding to the API proxy traffic data based on a predetermined three-layer structure table and the content protocol, wherein the predetermined three-layer structure table is a three-layer structure of content-structure-value, and the data in the identified content protocol can be clearly classified, and sensitive fields contained in the structural data are marked with sensitive identifiers, and the API proxy traffic data is desensitized according to the sensitive identifiers. The sensitive fields that need to be desensitized in the structural data can be clearly determined, and the sensitive fields are marked with sensitive identifiers. The data is desensitized based on the sensitive identifiers, thereby avoiding the occurrence of incorrect or missing identification of sensitive data, and ensuring the accuracy of data desensitization.

[0141] Further, as Figures 1 to 3 The specific implementation of the method shown in this embodiment provides a data desensitization device, such as Figure 7 As shown, the device includes: a receiving module 41, an identification module 42, a determination module 43, and a desensitization module 44.

[0142] The receiving module 41 is configured to receive the API proxy traffic data returned by the API service in response to sending the API request information to the API service;

[0143] An identification module 42, configured to identify a content protocol corresponding to the API proxy traffic data;

[0144] The determination module 43 is configured to determine the structure data corresponding to the API proxy traffic data based on a predetermined three-layer structure table and the content protocol, wherein the predetermined three-layer structure table is a content-structure-value three-layer structure;

[0145] The desensitizing module 44 is configured to mark sensitive fields contained in the structure data with sensitive identifiers, and perform data desensitization processing on the API proxy traffic data based on the sensitive identifiers.

[0146] In some examples of this embodiment, the determination module 43 is specifically configured to parse the content protocol to obtain the content structure data contained in the content protocol; based on the predetermined three-layer structure table, perform content structured extraction on the content structure data to obtain the content data, structure data and value data corresponding to the API proxy traffic data.

[0147] In some examples of the present embodiment, the desensitizing module 44 is specifically configured to form a content-structure-value three-layer data table corresponding to the API proxy traffic data based on the content data, the structure data and the value data; merge the content data and value data with the same structure data in the content-structure-value three-layer data table respectively to obtain a markable content-structure-value three-layer data table corresponding to the API proxy traffic data; obtain a structure data template containing a sensitive identifier corresponding to the content protocol type, wherein the structure data template is obtained after summarizing and updating the historical structure data containing the sensitive identifier; determine the marked structure data and the to-be-marked structure data in the markable content-structure-value three-layer data table based on the structure data template, and divide the markable content-structure-value three-layer data table into a marked content-structure-value three-layer data table and a to-be-marked content-structure-value three-layer data table based on the marked structure data and the to-be-marked structure data; mark the sensitive fields contained in the structure data in the to-be-marked content-structure-value three-layer data table with sensitive identifiers to obtain a target content-structure-value three-layer data table.

[0148] In some examples of the present embodiment, the desensitizing module 44 is further specifically configured to determine the first sensitive value data corresponding to the sensitive identifier in the target content-structure-value three-layer data table and the second sensitive value data corresponding to the sensitive identifier in the marked content-structure-value three-layer data table; desensitize the first sensitive value data and the second sensitive value data according to a predetermined desensitizing rule to obtain a desensitized content-structure-value three-layer data table.

[0149] In some examples of this embodiment, the desensitizing module 44 is further specifically configured to generate desensitized API proxy traffic data based on the desensitized content-structure-value three-layer data table; and send the desensitized API proxy traffic data to the API.

[0150] In some examples of this embodiment, the desensitizing module 44 is further configured to extract the target structure data in the target content-structure-value three-layer data table, and update the structure data template based on the target structure data.

[0151] In some examples of this embodiment, the receiving module 41 is specifically configured to identify the transmission protocol of the API proxy traffic data, determine the target transmission protocol corresponding to the API proxy traffic data; and identify the content protocol corresponding to the API proxy traffic data based on the target transmission protocol.

[0152] It should be noted that for other corresponding descriptions of the functional units involved in the data desensitization device provided in this embodiment, please refer to Figures 1 to 3 The corresponding description in will not be repeated here.

[0153] Based on the above Figures 1 to 3 The method shown in the embodiment also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned Figures 1 to 3 The method shown.

[0154] Based on this understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, USB flash drive, mobile hard disk, etc.), including a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods of various implementation scenarios of the present application.

[0155] like Figure 8 The figure shows a hardware structure diagram of an electronic device of the present invention, including:

[0156] at least one processor 501; and,

[0157] A memory 502 is communicatively connected to at least one of the processors 501; wherein,

[0158] The memory 502 stores instructions that can be executed by at least one of the processors, and the instructions are executed by at least one of the processors to enable at least one of the processors to perform the data desensitization method as described above.

[0159] Figure 8 A processor 501 is taken as an example.

[0160] The electronic device may further include: an input device 503 and a display device 504 .

[0161] The processor 501, the memory 502, the input device 503 and the display device 504 may be connected via a bus or other means. Figure 8 The example of connecting through bus is taken in the following.

[0162] The memory 502 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules, such as program instructions / modules corresponding to the data desensitization method in the embodiment of the present application, for example, Figure 1 , Figure 2 The processor 501 executes various functional applications and data processing by running the non-volatile software programs, instructions and modules stored in the memory 502, that is, the data desensitization method in the above embodiment is implemented.

[0163] The memory 502 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required by at least one function; the data storage area may store data created according to the use of the data desensitization method, etc. In addition, the memory 502 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 502 may optionally include a memory remotely arranged relative to the processor 501, and these remote memories may be connected to a device for executing the data desensitization method via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0164] The input device 503 can receive input user clicks and generate signal inputs related to user settings and function control of the data desensitization method. The display device 504 can include display devices such as a display screen.

[0165] The one or more modules are stored in the memory 502, and when executed by the one or more processors 501, the data desensitization method in any of the above method embodiments is executed.

[0166] Optionally, the above-mentioned physical device may also include a user interface, a network interface, a camera, a radio frequency (RF) circuit, a sensor, an audio circuit, a WI-FI module, etc. The user interface may include a display, an input unit such as a keyboard, etc., and the optional user interface may also include a USB interface, a card reader interface, etc. The network interface may optionally include a standard wired interface, a wireless interface (such as a WI-FI interface), etc.

[0167] Those skilled in the art will appreciate that the above-mentioned physical device structure provided in this embodiment does not constitute a limitation on the physical device, and may include more or fewer components, or a combination of certain components, or different arrangements of components.

[0168] The storage medium may also include an operating system and a network communication module. The operating system is a program that manages the hardware and software resources of the above-mentioned physical device, and supports the operation of the information processing program and other software and / or programs. The network communication module is used to realize the communication between the components inside the storage medium, and the communication with other hardware and software in the information processing physical device.

[0169] Through the description of the above implementation methods, the technical personnel in this field can clearly understand that the present application can be implemented by means of software plus the necessary general hardware platform, or by hardware. By applying the scheme of this embodiment, compared with the current prior art, this embodiment identifies the content protocol corresponding to the API proxy traffic data, and determines the structural data corresponding to the API proxy traffic data based on the predetermined three-layer structure table and the content protocol, wherein the predetermined three-layer structure table is a three-layer structure of content-structure-value, and the data in the identified content protocol can be clearly classified, and the sensitive fields contained in the structural data are marked with sensitive identifiers, and the API proxy traffic data is desensitized according to the sensitive identifiers, so that the sensitive fields in the structural data that need to be desensitized can be clearly determined, and the sensitive fields are marked with sensitive identifiers, and the data is desensitized based on the sensitive identifiers, so as to avoid the occurrence of errors or omissions in the identification of sensitive data, and ensure the accuracy of data desensitization.

[0170] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0171] The above is only a specific implementation of the present application, so that those skilled in the art can understand or implement the present application. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features applied for herein.

Claims

1. A data desensitization method, characterized in that: include: In response to sending a program programming interface API request information to an API service, receiving API proxy traffic data returned by the API service; Identify the content protocol corresponding to the API proxy traffic data; Determine the structure data corresponding to the API proxy traffic data based on a predetermined three-layer structure table and the content protocol, wherein the predetermined three-layer structure table is a content-structure-value three-layer structure; The sensitive fields contained in the structure data are marked with sensitive identifiers, and the API proxy traffic data is desensitized based on the sensitive identifiers.

2. The method according to claim 1, characterized in that The determining, based on the predetermined three-layer structure table and the content protocol, structure data corresponding to the API proxy traffic data includes: Parsing the content protocol to determine the content protocol type corresponding to the content protocol and the content structure data contained in the content protocol; Based on the predetermined three-layer structure table, the content structure data is subjected to content structure extraction to obtain content data, structure data and value data corresponding to the API proxy traffic data.

3. The method according to claim 2, characterized in that The step of marking sensitive fields contained in the structure data with sensitive identifiers includes: Based on the content data, the structure data and the value data, a content-structure-value three-layer data table corresponding to the API proxy traffic data is formed; Merge the content data and value data with the same structure data in the content-structure-value three-layer data table respectively to obtain a markable content-structure-value three-layer data table corresponding to the API proxy traffic data; Acquire a structure data template containing a sensitive identifier corresponding to the content protocol type, wherein the structure data template is obtained by summarizing and updating historical structure data containing the sensitive identifier; Determine the marked structure data and the unmarked structure data in the markable content-structure-value three-layer data table according to the structure data template, and divide the markable content-structure-value three-layer data table into the marked content-structure-value three-layer data table and the unmarked content-structure-value three-layer data table based on the marked structure data and the unmarked structure data; In the content-structure-value three-layer data table to be marked, sensitive fields contained in the structure data are marked with sensitive identifiers to obtain a target content-structure-value three-layer data table.

4. The method according to claim 3, characterized in that The performing data desensitization processing on the API proxy traffic data according to the sensitive identifier includes: Determine the first sensitive value data corresponding to the sensitive identifier in the target content-structure-value three-layer data table and the second sensitive value data corresponding to the sensitive identifier in the marked content-structure-value three-layer data table; The first sensitive value data and the second sensitive value data are desensitized according to a predetermined desensitization rule to obtain a desensitized content-structure-value three-layer data table.

5. The method according to claim 4, characterized in that The method further comprises: Generate desensitized API proxy traffic data based on the desensitized content-structure-value three-layer data table; The desensitized API proxy traffic data is sent to the API.

6. The method according to claim 3, characterized in that The method further comprises: The target structure data in the target content-structure-value three-layer data table is extracted, and the structure data template is updated based on the target structure data.

7. The method according to any one of claims 1 to 6, characterized in that The step of sending the API request information to the API service and receiving the API proxy traffic data returned by the API service includes: Performing transmission protocol identification on the API proxy traffic data to determine a target transmission protocol corresponding to the API proxy traffic data; Based on the target transmission protocol, a content protocol corresponding to the API proxy traffic data is identified.

8. A data desensitization device, characterized in that: include: A receiving module, configured to receive API proxy traffic data returned by the API service in response to sending a program programming interface API request information to the API service; an identification module configured to identify a content protocol corresponding to the API proxy traffic data; A determination module is configured to determine the structure data corresponding to the API proxy traffic data based on a predetermined three-layer structure table and the content protocol, wherein the predetermined three-layer structure table is a content-structure-value three-layer structure; The desensitizing module is configured to mark sensitive fields contained in the structure data with sensitive identifiers, and perform data desensitization processing on the API proxy traffic data based on the sensitive identifiers.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

10. An electronic device comprising a storage medium, a processor, and a computer program stored in the storage medium and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

Images