Data desensitization method, device, storage medium and electronic device

Abstract

The present application discloses a data desensitization method, device, storage medium, and electronic device, relating to the field of data processing technology, including: in response to sending API request information to an API service, receiving API proxy traffic data returned by the API service; identifying the content protocol corresponding to the API proxy traffic data; determining the structural data corresponding to the API proxy traffic data based on a predetermined three-layer structure table and a content protocol, wherein the predetermined three-layer structure table is a content-structure-value three-layer structure; marking sensitive fields contained in the structural data with sensitive identifiers, and performing data desensitization processing on the API proxy traffic data based on the sensitive identifiers. Compared with the current existing technology, the present application can avoid the occurrence of errors or omissions in the identification of sensitive data, thereby ensuring the accuracy of data desensitization.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data desensitization method, device, storage medium and electronic device. Background Art

[0002] When acquiring data through an Application Programming Interface (API), the traffic data returned by the API contains a lot of sensitive data that requires desensitization. A common solution is to deploy an API protection system agent to identify and desensitize sensitive data before deploying it on the API service.

[0003] Currently, data desensitization is performed in the API protection system mainly by using dictionaries or regular rules to identify sensitive data in the traffic data returned by the API and desensitizing the identified sensitive data.

[0004] However, since the traffic data returned by the API contains a lot of data with similar content or names, the data desensitization method cannot accurately identify the data that needs to be desensitized from similar content, resulting in missed or incorrect identification of the data that needs to be desensitized, and then resulting in desensitization errors in the desensitized data, resulting in low accuracy of data desensitization. Summary of the Invention

[0005] In view of this, the present application provides a data desensitization method, device, storage medium and electronic device, the main purpose of which is to improve the technical problem that the current existing technology cannot accurately identify the data that needs to be desensitized among similar content, resulting in missed identification or wrong identification in the identified data that needs to be desensitized, and then resulting in desensitization errors in the desensitized data, resulting in low accuracy of data desensitization.

[0006] In a first aspect, the present application provides a data desensitization method, comprising:

[0007] In response to sending a program programming interface (API) request message to an API service, receiving API proxy traffic data returned by the API service;

[0008] Identify the content protocol corresponding to the API proxy traffic data;

[0009] Determining structure data corresponding to the API proxy traffic data based on a predetermined three-layer structure table and the content protocol, wherein the predetermined three-layer structure table is a content-structure-value three-layer structure;

[0010] The sensitive fields contained in the structure data are marked with sensitive identifiers, and the API proxy traffic data is desensitized based on the sensitive identifiers.

[0011] In a second aspect, the present application provides a data desensitization device, comprising:

[0012] a receiving module configured to receive API proxy traffic data returned by the API service in response to sending API request information to the API service;

[0013] an identification module configured to identify a content protocol corresponding to the API proxy traffic data;

[0014] a determination module configured to determine structure data corresponding to the API proxy traffic data based on a predetermined three-layer structure table and the content protocol, wherein the predetermined three-layer structure table is a content-structure-value three-layer structure;

[0015] The desensitizing module is configured to mark sensitive fields contained in the structural data with sensitive identifiers, and perform data desensitization processing on the API proxy traffic data based on the sensitive identifiers.

[0016] In a third aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the data desensitization method described in the first aspect.

[0017] In a fourth aspect, the present application provides an electronic device comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor implements the data desensitization method described in the first aspect when executing the computer program.

[0018] By means of the above technical solution, the present application provides a data desensitization method, device, storage medium and electronic device. Compared with the current existing technology, the present application identifies the content protocol corresponding to the API proxy traffic data, and determines the structural data corresponding to the API proxy traffic data based on a predetermined three-layer structure table and the content protocol. The predetermined three-layer structure table is a three-layer structure of content-structure-value, which can clearly classify the data in the identified content protocol. By marking sensitive fields contained in the structural data with sensitive identifiers and performing data desensitization on the API proxy traffic data based on the sensitive identifiers, the sensitive fields in the structural data that need to be desensitized can be clearly determined, and the sensitive fields are marked with sensitive identifiers. The data is desensitized based on the sensitive identifiers, thereby avoiding incorrect or missed identification of sensitive data and ensuring the accuracy of data desensitization. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0020] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0021] Figure 1 A schematic diagram of a data desensitization method according to an embodiment of the present invention is shown;

[0022] Figure 2 A schematic diagram of a data desensitization method according to an embodiment of the present invention is shown;

[0023] Figure 3 A schematic diagram of a data desensitization method according to an embodiment of the present invention is shown;

[0024] Figure 4 A schematic diagram showing an example provided by an embodiment of the present application is shown;

[0025] Figure 5 A schematic diagram showing an example provided by an embodiment of the present application is shown;

[0026] Figure 6 A schematic diagram of an example process provided by an embodiment of the present application is shown;

[0027] Figure 7 A schematic structural diagram of a data desensitization device provided in an embodiment of the present application is shown;

[0028] Figure 8 A schematic structural diagram of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION

[0029] The embodiments of the present application will be described in more detail below with reference to the accompanying drawings. It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other.

[0030] In order to improve the technical problem that the existing technology cannot accurately identify the data that needs to be desensitized in similar content, resulting in missed recognition or wrong recognition in the identified data that needs to be desensitized, and then resulting in desensitization errors in the obtained desensitized data, resulting in low accuracy of data desensitization. This embodiment provides a data desensitization method, such as Figure 1 As shown, the method includes:

[0031] Step 101: In response to sending API request information to an API service, receive API proxy traffic data returned by the API service.

[0032] An Application Programming Interface (API) is a set of rules, protocols, and tools that define how software components communicate with each other. APIs enable different software applications to communicate and exchange data without requiring knowledge of the underlying implementation details. APIs can be used in a variety of scenarios, including operating systems, databases, and web services.

[0033] In this embodiment, in various scenarios such as application systems, development and operation and maintenance, data is obtained through the API mainly by generating API request information. After the API request information is verified by the API protection system, the API request information is sent to the API service. After receiving the API request information, the API service generates API proxy traffic data according to the content of the request information and returns it to the API protection system. The API protection system processes the API proxy traffic data and returns it to the API.

[0034] It should be noted that the execution entity of this application is the API protection system, which is a key component for ensuring API security. It covers technologies and measures in multiple areas, from authentication and authorization to encryption and rate limiting. A comprehensive API protection system can effectively prevent unauthorized access, data leakage, and other security threats.

[0035] Specifically, the functions of the API protection system may include but are not limited to the following:

[0036] 1. Authentication: Ensure that only verified users can access the API.

[0037] 2. Authorization: Ensure that users can only access resources they are authorized to access.

[0038] 3. Encryption: ensures that data in transmission is not eavesdropped or tampered with.

[0039] 4. Rate Limiting, used to prevent API abuse and ensure that resources are not over-consumed.

[0040] 5. Request Validation: Ensure that the incoming data format is correct and legal.

[0041] 6. Logging and Monitoring, used to detect abnormal behavior and respond promptly.

[0042] 7. Exception Handling: Exception handling ensures that the API can provide useful feedback when encountering errors.

[0043] 8. Security Auditing: Security auditing is used to regularly check the security status of the API.

[0044] In some examples, API proxy traffic data refers to the number of requests processed by an API proxy server and related statistics. API proxies are often used to implement functions such as load balancing, caching, authentication, and rate limiting, and can collect and report important information about API usage. In the embodiments of this application, API proxy traffic data refers to the data returned to the API by the API service based on the received API request information.

[0045] Step 102: Identify the content protocol corresponding to the API proxy traffic data.

[0046] In the embodiments of this application, the content protocols used by API proxy traffic data include transmission protocols, content encodings, programming interfaces, and API gateway protocols. The content protocols used by API proxy traffic data generally refer to protocols related to API requests and responses, as well as protocols used to transmit this data.

[0047] Specifically, a transmission protocol refers to a protocol used to transmit data over a network. Common transmission protocols include, but are not limited to, the following:

[0048] 1. HTTP / HTTPS:

[0049] HTTP (HyperText Transfer Protocol): A stateless protocol used to transmit web pages and API data.

[0050] HTTPS (HTTP Secure): HTTP encrypted using TLS / SSL to protect the security of data transmission.

[0051] 2. WebSocket: A two-way communication protocol that allows a persistent connection between the client and the server and full-duplex communication.

[0052] 3. gRPC: A high-performance remote procedure call (RPC) framework that supports multiple languages, uses HTTP / 2 for transmission, and uses TLS encryption by default.

[0053] 4. MQTT (Message Queuing Telemetry Transport): A lightweight message transmission protocol suitable for Internet of Things (IoT) scenarios.

[0054] In the embodiment of the present application, it is necessary to specifically identify one or more content protocols used by the API proxy traffic data.

[0055] Step 103: Based on the predetermined three-layer structure table and the content protocol, determine the structure data corresponding to the API proxy traffic data.

[0056] The predetermined three-layer structure table is a content-structure-value three-layer structure.

[0057] In some examples, the Content-Structure-Value (CSV) model is an abstract conceptual model used to describe and organize the different layers of data. This three-layer structure is often used to understand and analyze the composition of data, especially in areas such as database design, data exchange, and data processing.

[0058] Specifically, content refers to the specific information or value of data. It is the core part of data, including the information actually stored in the data structure. Content can be any type of data, such as numbers, strings, dates, etc. For example, in a user table, content might include specific information such as the user's name, age, and gender. In an order table, content might include the order number, order time, product name, and quantity.

[0059] Furthermore, structure refers to the way data is organized, that is, how data is organized into a specific format or pattern. Structure determines how data is stored, retrieved, and accessed. Common data structures include arrays, lists, trees, graphs, relational database tables, etc. For example, in a relational database, structure usually refers to the definition of a table, including the table name, field names, field types, etc. In the JSON format, structure can be in the form of key-value pairs, such as {"name":"Alice","age":30}.

[0060] In contrast, a value refers to a specific numerical value stored in a data structure. It is a specific instance of content, representing a specific data point. For example, in a user table, "Zhang San" and "Li Si" are the values ​​of the name field. In an order table, "2023-01-01" is the value of the order time field.

[0061] In an embodiment of the present application, it is necessary to determine the specific data corresponding to the content-structure-value three-layer structure corresponding to the API proxy traffic data based on the content protocol, that is, content data, received data and value data in this application.

[0062] Step 104: Mark sensitive fields contained in the structure data with sensitive identifiers, and perform data desensitization processing on the API proxy traffic data based on the sensitive identifiers.

[0063] In this embodiment, within the three-layer structure of content-structure-value, "structure" refers to the organization or format of data, which defines how data is stored, retrieved, and accessed. At the structure layer, fields are one of the basic units that make up the data structure. Fields can be understood as columns or attributes in a data structure, which are used to store specific types of information.

[0064] For example, in relational databases (such as MySQL, PostgreSQL, etc.), fields are usually called "columns", and the data type of each column is defined when creating a table; in NoSQL databases (such as MongoDB), fields can be nested objects or arrays; in XML (Extensible Markup Language), fields are usually represented by elements; in JSON (JavaScript Object Notation), fields are usually represented in the form of key-value pairs.

[0065] It should be noted that, in the embodiment of the present application, a field may be a column in the structured data, that is, each segment in the structured data is a column.

[0066] Furthermore, sensitive field annotation refers to the process of identifying fields containing sensitive information during data processing and storage, allowing for special protection measures. Sensitive information includes, but is not limited to, personal identification information (such as name and ID number), financial information (such as bank card number), health information (such as medical records), passwords, and other information that needs to be kept confidential. Sensitive field annotation ensures that sensitive information is not accessible to unauthorized personnel, meeting legal and regulatory requirements, reducing the risk of data leaks, and protecting businesses and individuals from harm.

[0067] Optionally, data masking is a technique for hiding sensitive information during data display or transmission. Common masking methods include, but are not limited to, the following:

[0068] 1. Replacement: Replace real data with fake data.

[0069] 2. Masking: partially hide data, such as showing the first and last few digits and replacing the middle with asterisks or other characters.

[0070] 3. Hash: Use a hash algorithm to convert sensitive data into an irreversible hash value.

[0071] Compared with the current existing technology, this embodiment identifies the content protocol corresponding to the API proxy traffic data, and determines the structural data corresponding to the API proxy traffic data based on a predetermined three-layer structure table and the content protocol, wherein the predetermined three-layer structure table is a three-layer structure of content-structure-value, which can clearly classify the data in the identified content protocol, and also marks the sensitive fields contained in the structural data with sensitive identifiers, and desensitizes the API proxy traffic data according to the sensitive identifiers, so as to clearly determine the sensitive fields in the structural data that need to be desensitized, and mark the sensitive fields with sensitive identifiers, and desensitize the data based on the sensitive identifiers, thereby avoiding the occurrence of incorrect or missed identification of sensitive data, and ensuring the accuracy of data desensitization.

[0072] As a refinement and extension of the above embodiment, when determining the structure data corresponding to the API proxy traffic data based on the predetermined three-layer structure table and the content protocol, the following method may be used but is not limited to:

[0073] Step 201: parse the content protocol to determine the content protocol type corresponding to the content protocol and the content structure data contained in the content protocol.

[0074] In the embodiment of the present application, all content structure data contained in the content protocol can be obtained after parsing the content protocol.

[0075] For example, if the content protocol is JSON, the protocol parsing module parses out the HTTP request header, request body, response header, response body, etc.

[0076] Step 202: Based on the predetermined three-layer structure table, content structure data is extracted to obtain content data, structure data, and value data corresponding to the API proxy traffic data.

[0077] Exemplarily, the identified content data (location) location may include: username, gender, age, habit.shopping, habit.sport, habit.diet, friend.0.name, friend.0.gender, friend.0.age, friend.1.name, friend.1.gender, friend.1.age, etc.

[0078] Accordingly, the identified structural data structure (struct) may include: username, gender, age, habit.shopping, habit.sport, habit.diet, friend.name, friend.gender, friend.age, friend.name, friend.gender, friend.age, etc.

[0079] Correspondingly, the identified value data values ​​(value) may include: Zhang San, male, 40, electronic, basketball, noodles, Li Si, male, 40, Wang Wu, male, 30, etc.

[0080] Furthermore, when marking sensitive fields contained in the structure data with sensitive identifiers, the following methods may be used but are not limited to: Figure 3 As shown, the method includes:

[0081] Step 301: Based on the content data, structure data and value data, a content-structure-value three-layer data table corresponding to the API proxy traffic data is formed.

[0082] For example, based on step 202, the content-structure-value three-layer data table corresponding to the API proxy traffic data may be as shown in Table 1 below:

[0083] Table 1

[0084]

[0085]

[0086] Step 302: Merge the content data and value data with the same structural data in the content-structure-value three-layer data table to obtain a markable content-structure-value three-layer data table corresponding to the API proxy traffic data.

[0087] Exemplarily, based on step 301, the content data and value data with the same structural data in the content-structure-value three-layer data table are merged respectively. For example, if the 7th row and the 10th row in the structural data of Table 1 are the same, the content data and value data of the 7th row and the 10th row in Table 1 need to be merged respectively; if the 8th row and the 11th row in the structural data of Table 1 are the same, the content data and value data of the 8th row and the 11th row in Table 1 need to be merged respectively; if the 9th row and the 12th row in the structural data of Table 1 are the same, the content data and value data of the 9th row and the 12th row in Table 1 need to be merged respectively, thereby obtaining a markable content-structure-value three-layer data table, which can be specifically shown in Table 2 below:

[0088] Table 2

[0089]

[0090]

[0091] Step 303: Obtain a structured data template corresponding to the content protocol type and containing a sensitive identifier.

[0092] The structural data template is obtained by summarizing and updating the historical structural data containing sensitive identifiers.

[0093] Exemplarily, the structural data template can be the structural data maintained in the API protection system. Specifically, during the API protection process, an API can be defined, for example: HTTP is expressed through Method+UrlPath (of course other APIs can use the same abstraction, such as KAFKA through TOPIC). Since APIs are naturally dynamic and extensible (unlike databases, the column information and content information of a table are relatively fixed), the content structure of the API is managed as an important attribute of an API. In this way, the content structure of an API can be seen, and sensitive information can be marked on the API structure, and then protected.

[0094] For example, the structure data template may be as shown in Table 3 below:

[0095] Table 3

[0096] structure username gender age habit.shopping habit.sport habit.diet friend.name friend.gender friend.age friend.name friend.gender friend.age address (new merged structure)

[0097] Because APIs are constantly developed and maintained based on business changes, the parameters and content structures of data will also increase and decrease. In this way, the structure of the API can be maintained as an important attribute of the API and protected through continuous management, annotation, and protection. The appearance time of the field will be updated based on traffic. If the content of a structure does not appear for a long time, it may be that the API has changed and is no longer used. This will also be explained in the structure of the API, as shown in Table 4 below:

[0098] Table 4

[0099] structure Appearance time username Within 1 hour gender Within 1 hour age Within 1 hour habit.shopping Within 1 hour habit.sport Within 1 hour habit.diet Within 1 hour friend.name Within 1 hour friend.gender Within 1 hour friend.age Within 1 hour friend.name Within 1 hour friend.gender Within 1 hour friend.age (possibly deprecated) 1 month ago address Within 1 hour

[0100] It should be noted that through this API content structure management method, the dynamic and continuous maintenance of the API content structure as an important attribute of the API can be carried out. Based on this content structure, field sensitive information can be maintained continuously, and the API can be protected based on this sensitive information.

[0101] Step 304: Determine the marked structural data and the unmarked structural data in the markable content-structure-value three-layer data table based on the structural data template, and divide the markable content-structure-value three-layer data table into the marked content-structure-value three-layer data table and the unmarked content-structure-value three-layer data table based on the marked structural data and the unmarked structural data.

[0102] Step 305: Mark sensitive fields contained in the structure data in the content-structure-value three-layer data table to be marked with sensitive identifiers to obtain the target content-structure-value three-layer data table.

[0103] For example, based on step 305, if the field "friend.name" in the structure data is a sensitive field, "friend.name" can be marked with a sensitive identifier to obtain a three-layer data table of target content-structure-value after marking, which can be specifically shown in Table 5 below:

[0104] Table 5

[0105]

[0106]

[0107] It should be noted that the specific content of the sensitive identifier can be set according to needs, for example, it can be "sensitive", "m", "mg", etc. The specific content of the sensitive identifier is not limited in this application.

[0108] Furthermore, when performing data desensitization processing on the API proxy traffic data based on the sensitive identifier, the following method may be used but is not limited to:

[0109] Step 11: Determine the first sensitive value data corresponding to the sensitive identifier in the target content-structure-value three-layer data table and the second sensitive value data corresponding to the sensitive identifier in the marked content-structure-value three-layer data table.

[0110] Furthermore, based on step 303, in the structure data of Table 5, the field "friend.name" has a sensitive flag, so it is necessary to determine all value data corresponding to the field "friend.name", namely "Li Si" and "Wang Wu".

[0111] It should be noted that the first sensitive value data is the sensitive value data with sensitive identification in the target content-structure-value three-layer data table, and the second sensitive value data is the sensitive value data with sensitive identification in the marked content-structure-value three-layer data table.

[0112] Step 12: Desensitize the first sensitive value data and the second sensitive value data according to a predetermined desensitization rule to obtain a desensitized content-structure-value three-layer data table.

[0113] Exemplarily, based on step 11, desensitization processing is performed on "Li Si" and "Wang Wu" in Table 5 according to a predetermined desensitization rule.

[0114] Data masking is a method of protecting sensitive information by modifying or replacing data so that it cannot be identified as real personal information or other sensitive information while maintaining the original data characteristics. Masking rules are specific guidelines that define how to modify or replace data, aiming to ensure that the data retains its functionality and usability during processing while protecting privacy and security. Types of masking rules Masking rules can be divided into various types based on different application scenarios and needs. Common ones include but are not limited to:

[0115] 1. Substitution: Substitution refers to replacing the original data with a predefined or randomly generated value. This method preserves the format of the data but changes its content. For example, replacing the mobile phone number "13800138000" with "13812345678"

[0116] 2. Hashing: Hashing is the process of converting raw data into a fixed-length string using a hash function. This method ensures data irreversibility but changes the format of the data. For example, using the SHA-256 hash function converts the password "securepassword" into "25f9e794323b453885f5181f1b624d0b."

[0117] 3. Encryption. Encryption uses an encryption algorithm to convert raw data into ciphertext. This method protects data privacy, but requires decryption for use. For example, the credit card number "4111111111111111" is encrypted into ciphertext using the AES encryption algorithm.

[0118] 4. Generalization: Flattening refers to abstracting data into higher-level categories to reduce the possibility of identification. For example, the age of "25" is flattened into the age range of "20-30".

[0119] 5. Shifting: Shifting is the process of adding or subtracting numerical data to change its actual value. For example, shifting the birthday "1990-01-01" to "1990-02-02".

[0120] 6. Truncation: Truncation refers to removing part of the data. For example, the email address "zhangsan@example.com" is truncated to zhangsan@***.com.

[0121] 7. Randomization: Randomization refers to using a random number generator to replace the original data. For example, the ID card number "123456789012345678" is replaced with a randomly generated number.

[0122] 8. Masking: Masking refers to using mask characters to partially or completely hide data. For example, masking the bank account number "1234567890123456" to "1234****5678".

[0123] It should be noted that the predetermined desensitization rule can be one or more of the above-mentioned desensitization rules, or can be other desensitization rules not listed. The specific content of the predetermined desensitization rule is not limited in the embodiments of the present application.

[0124] Optionally, after steps 301 to 305 , the method of this embodiment further includes: extracting target structure data from the target content-structure-value three-layer data table, and updating the structure data template based on the target structure data.

[0125] Furthermore, after executing step 12, the following method may be used but is not limited to:

[0126] Step 21: Generate desensitized API proxy traffic data based on the desensitized content-structure-value three-layer data table

[0127] Step 22: Send the desensitized API proxy traffic data to the API.

[0128] Furthermore, when executing the response to sending the API request information to the API service and receiving the API proxy traffic data returned by the API service, the following method may be used but is not limited to:

[0129] Step 31: Identify the transmission protocol of the API proxy traffic data and determine the target transmission protocol corresponding to the API proxy traffic data.

[0130] Step 32: Based on the target transmission protocol, identify the content protocol corresponding to the API proxy traffic data.

[0131] In the embodiment of the present application, to identify the content protocol, it is necessary to first identify the transmission protocol used, and then identify the content protocol based on the transmission protocol used.

[0132] It should be noted that in the existing technology, when obtaining data through API (in various scenarios such as application systems, development and operation), the data returned by API contains a lot of sensitive data that needs to be desensitized. A common solution is to have the API protection system identify and desensitize sensitive data before deploying the API protection system agent on the API service, such as Figure 4 As shown in the figure, the API service provides the GET / customerinfo service for retrieving customerinfo. The API protection system proxy is deployed before the API service. The API request obtains the information in the GET / customerinfo request through the API protection system. The API protection system identifies sensitive information in the data returned by the API service and identifies the phone number "13000000000" as sensitive information. It desensitizes the identified sensitive information to "xxxxxxxxxxx". The sensitive information in the data obtained by the API requester has been desensitized by the API protection system.

[0133] Existing methods for identifying sensitive information use dictionaries or regular expressions. These identification rules often lead to misidentification or omission. For example, if a message contains an 11-digit number beginning with 138 (possibly an internal message ID), it will definitely be identified as a mobile phone number using the mobile phone number identification rule, resulting in misidentification. Another example is two types of data, A and B: data A is sensitive, and data B is not. The user names them as number: data A; number: data B. If a dictionary number is defined to identify sensitive data, it will be impossible to distinguish between data types A and B.

[0134] Compared with the current existing technology, this embodiment identifies the content protocol corresponding to the API proxy traffic data, and determines the structural data corresponding to the API proxy traffic data based on a predetermined three-layer structure table and the content protocol, wherein the predetermined three-layer structure table is a three-layer structure of content-structure-value, which can clearly classify the data in the identified content protocol, and also marks the sensitive fields contained in the structural data with sensitive identifiers, and desensitizes the API proxy traffic data according to the sensitive identifiers, so as to clearly determine the sensitive fields in the structural data that need to be desensitized, and mark the sensitive fields with sensitive identifiers, and desensitize the data based on the sensitive identifiers, thereby avoiding the occurrence of incorrect or missed identification of sensitive data, and ensuring the accuracy of data desensitization.

[0135] In order to illustrate the specific implementation process of this embodiment, the following specific application examples are given: Figure 5 As shown, but not limited to:

[0136] The sensitive data management method based on this patent is divided into three steps, such as Figure 6 As shown:

[0137] Step 41: When an API request accesses an API service through the API protection system, the API protection system identifies the API's content structure. Specifically, API content can be delivered in a variety of protocols, such as GPRC and HTTP. HTTP can also carry content in a variety of protocols, such as JSON, FORM, HTML, and XML. The protocol identification module primarily identifies the API's transmission protocol and content-carrying protocol. Based on the protocol identification results, the system then parses the different protocols.

[0138] Step 42: Annotate sensitive information based on the identification structure of the API content structure. Specifically, for structured content extraction, regardless of the protocol, extract and construct a three-layer structure table of the content: (location) location->structure (struct)->value (value). Through such a three-layer structure, structured content extraction and desensitization based on sensitive information annotation can be completed.

[0139] Step 43: The API protection system desensitizes sensitive information based on the API content structure. Because APIs have dynamic properties, for example, different parameters may result in different content. Therefore, the API content structure must be maintained, updated, and merged in real time to ensure that the management attributes view a complete and updated API content structure.

[0140] Compared with the current existing technology, this embodiment identifies the content protocol corresponding to the API proxy traffic data, and determines the structural data corresponding to the API proxy traffic data based on a predetermined three-layer structure table and the content protocol, wherein the predetermined three-layer structure table is a three-layer structure of content-structure-value, which can clearly classify the data in the identified content protocol, and also marks the sensitive fields contained in the structural data with sensitive identifiers, and desensitizes the API proxy traffic data according to the sensitive identifiers, so as to clearly determine the sensitive fields in the structural data that need to be desensitized, and mark the sensitive fields with sensitive identifiers, and desensitize the data based on the sensitive identifiers, thereby avoiding the occurrence of incorrect or missed identification of sensitive data, and ensuring the accuracy of data desensitization.

[0141] Further, as Figures 1 to 3 The specific implementation of the method shown in this embodiment provides a data desensitization device, such as Figure 7 As shown, the device includes: a receiving module 41, an identification module 42, a determination module 43, and a desensitization module 44.

[0142] The receiving module 41 is configured to receive the API proxy traffic data returned by the API service in response to sending the API request information to the API service;

[0143] an identification module 42 configured to identify a content protocol corresponding to the API proxy traffic data;

[0144] The determining module 43 is configured to determine the structure data corresponding to the API proxy traffic data based on a predetermined three-layer structure table and the content protocol, wherein the predetermined three-layer structure table is a content-structure-value three-layer structure;

[0145] The desensitizing module 44 is configured to mark sensitive fields contained in the structure data with sensitive identifiers, and perform data desensitization processing on the API proxy traffic data based on the sensitive identifiers.

[0146] In some examples of this embodiment, the determination module 43 is specifically configured to parse the content protocol to obtain the content structure data contained in the content protocol; based on the predetermined three-layer structure table, perform content structured extraction on the content structure data to obtain the content data, structure data and value data corresponding to the API proxy traffic data.

[0147] In some examples of this embodiment, the desensitizing module 44 is specifically configured to form a content-structure-value three-layer data table corresponding to the API proxy traffic data based on the content data, the structure data and the value data; merge the content data and value data with the same structure data in the content-structure-value three-layer data table respectively to obtain a markable content-structure-value three-layer data table corresponding to the API proxy traffic data; obtain a structure data template containing a sensitive identifier corresponding to the content protocol type, and the structure data template is obtained after summarizing and updating the historical structure data containing the sensitive identifier; determine the marked structure data and the structure data to be marked in the markable content-structure-value three-layer data table based on the structure data template, and divide the markable content-structure-value three-layer data table into a marked content-structure-value three-layer data table and a content-structure-value three-layer data table to be marked based on the marked structure data and the structure data to be marked; mark the sensitive fields contained in the structure data in the content-structure-value three-layer data table to be marked with sensitive identifiers to obtain a target content-structure-value three-layer data table.

[0148] In some examples of this embodiment, the desensitizing module 44 is further configured to determine the first sensitive value data corresponding to the sensitive identifier in the target content-structure-value three-layer data table and the second sensitive value data corresponding to the sensitive identifier in the marked content-structure-value three-layer data table; desensitize the first sensitive value data and the second sensitive value data according to predetermined desensitizing rules to obtain a desensitized content-structure-value three-layer data table.

[0149] In some examples of this embodiment, the desensitizing module 44 is further configured to generate desensitized API proxy traffic data based on the desensitized content-structure-value three-layer data table; and send the desensitized API proxy traffic data to the API.

[0150] In some examples of this embodiment, the desensitizing module 44 is further configured to extract target structure data from the target content-structure-value three-layer data table, and update the structure data template based on the target structure data.

[0151] In some examples of this embodiment, the receiving module 41 is specifically configured to identify the transmission protocol of the API proxy traffic data, determine the target transmission protocol corresponding to the API proxy traffic data; and identify the content protocol corresponding to the API proxy traffic data based on the target transmission protocol.

[0152] It should be noted that for other corresponding descriptions of the functional units involved in the data desensitization device provided in this embodiment, please refer to Figures 1 to 3 The corresponding description in will not be repeated here.

[0153] Based on the above Figures 1 to 3 The method shown in FIG. 1 is a method for performing the above-mentioned steps. Accordingly, this embodiment further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the above-mentioned steps are performed. Figures 1 to 3 The method shown.

[0154] Based on this understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, USB flash drive, mobile hard disk, etc.), and includes a number of instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute the methods of various implementation scenarios of the present application.

[0155] like Figure 8 FIG. 1 is a schematic diagram of the hardware structure of an electronic device of the present invention, comprising:

[0156] at least one processor 501; and,

[0157] A memory 502 in communication with at least one of the processors 501; wherein,

[0158] The memory 502 stores instructions that can be executed by at least one of the processors. The instructions are executed by at least one of the processors to enable at least one of the processors to perform the data desensitization method as described above.

[0159] Figure 8 A processor 501 is taken as an example.

[0160] The electronic device may further include an input device 503 and a display device 504 .

[0161] The processor 501, the memory 502, the input device 503 and the display device 504 may be connected via a bus or other means. Figure 8 The bus connection is taken as an example.

[0162] The memory 502 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs, and modules, such as program instructions / modules corresponding to the data desensitization method in the embodiment of the present application, for example, Figure 1 、 Figure 2 The processor 501 executes various functional applications and data processing by running the non-volatile software programs, instructions and modules stored in the memory 502, that is, implementing the data desensitization method in the above embodiment.

[0163] The memory 502 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data created according to the use of the data desensitization method, etc. In addition, the memory 502 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 502 may optionally include a memory remotely located relative to the processor 501, and these remote memories may be connected to a device for executing the data desensitization method via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0164] The input device 503 can receive user clicks and generate signal input related to user settings and function control of the data desensitization method. The display device 504 can include a display device such as a display screen.

[0165] The one or more modules are stored in the memory 502 and, when executed by the one or more processors 501 , execute the data desensitization method in any of the above method embodiments.

[0166] Optionally, the physical device may further include a user interface, a network interface, a camera, a radio frequency (RF) circuit, a sensor, an audio circuit, a Wi-Fi module, and the like. The user interface may include a display, an input unit such as a keyboard, and the like. The optional user interface may also include a USB interface, a card reader interface, and the like. The network interface may optionally include a standard wired interface, a wireless interface (such as a Wi-Fi interface), and the like.

[0167] Those skilled in the art will understand that the above-mentioned physical device structure provided in this embodiment does not constitute a limitation on the physical device, and may include more or fewer components, or a combination of certain components, or different component arrangements.

[0168] The storage medium may also include an operating system and a network communication module. The operating system is a program that manages the hardware and software resources of the physical device, supporting the execution of information processing programs and other software and / or programs. The network communication module is used to enable communication between components within the storage medium, as well as with other hardware and software within the physical information processing device.

[0169] Through the description of the above implementation methods, those skilled in the art can clearly understand that the present application can be implemented by means of software plus the necessary general hardware platform, or by hardware. By applying the solution of this embodiment, compared with the current existing technology, this embodiment identifies the content protocol corresponding to the API proxy traffic data, and determines the structural data corresponding to the API proxy traffic data based on a predetermined three-layer structure table and the content protocol, wherein the predetermined three-layer structure table is a three-layer structure of content-structure-value, which can clearly classify the data in the identified content protocol, and also by marking sensitive fields contained in the structural data with sensitive identifiers, and performing data desensitization processing on the API proxy traffic data based on the sensitive identifiers, it is possible to clearly determine the sensitive fields in the structural data that need to be desensitized, and mark the sensitive fields with sensitive identifiers, and perform data desensitization processing on the data based on the sensitive identifiers, thereby avoiding the occurrence of errors or omissions in the identification of sensitive data, and ensuring the accuracy of data desensitization.

[0170] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or device comprising the element.

[0171] The foregoing is merely a list of specific embodiments of the present application, intended to enable those skilled in the art to understand and implement the present application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present application. Therefore, the present application is not limited to the embodiments described herein, but is intended to conform to the broadest scope consistent with the principles and novel features of the present application.

Claims

1. A data desensitization method, applied to an API protection system, characterized in that: include: In response to sending a program programming interface (API) request message to an API service, receiving API proxy traffic data returned by the API service; Identify the content protocol corresponding to the API proxy traffic data; Determining structure data corresponding to the API proxy traffic data based on a predetermined three-layer structure table and the content protocol, wherein the predetermined three-layer structure table is a content-structure-value three-layer structure; Marking sensitive fields contained in the structure data with sensitive identifiers, and performing data desensitization processing on the API proxy traffic data based on the sensitive identifiers; The step of determining the structure data corresponding to the API proxy traffic data based on the predetermined three-layer structure table and the content protocol includes: Parsing the content protocol to determine the content protocol type corresponding to the content protocol and content structure data contained in the content protocol; Based on the predetermined three-layer structure table, performing content structure extraction on the content structure data to obtain content data, structure data and value data corresponding to the API proxy traffic data; The step of marking sensitive fields contained in the structure data with sensitive identifiers includes: Based on the content data, the structure data and the value data, a content-structure-value three-layer data table corresponding to the API proxy traffic data is formed; Merging the content data and value data with the same structural data in the content-structure-value three-layer data table respectively to obtain a markable content-structure-value three-layer data table corresponding to the API proxy traffic data; Obtaining a structure data template containing a sensitive identifier corresponding to the content protocol type, wherein the structure data template is obtained by summarizing and updating historical structure data containing the sensitive identifier, and the structure data template is structure data maintained in the API protection system; Determining, based on the structure data template, the marked structure data and the unmarked structure data in the markable content-structure-value three-layer data table, and dividing the markable content-structure-value three-layer data table into a marked content-structure-value three-layer data table and a unmarked content-structure-value three-layer data table based on the marked structure data and the unmarked structure data; In the content-structure-value three-layer data table to be marked, sensitive fields contained in the structure data are marked with sensitive identifiers to obtain a target content-structure-value three-layer data table.

2. The method according to claim 1, characterized in that The performing data desensitization processing on the API proxy traffic data according to the sensitive identifier includes: Determine the first sensitive value data corresponding to the sensitive identifier in the target content-structure-value three-layer data table and the second sensitive value data corresponding to the sensitive identifier in the marked content-structure-value three-layer data table; The first sensitive value data and the second sensitive value data are desensitized according to a predetermined desensitization rule to obtain a desensitized content-structure-value three-layer data table.

3. The method according to claim 2, characterized in that The method further comprises: Generate desensitized API proxy traffic data based on the desensitized content-structure-value three-layer data table; The desensitized API proxy traffic data is sent to the API.

4. The method according to claim 1, wherein The method further comprises: Target structure data in the target content-structure-value three-layer data table is extracted, and the structure data template is updated based on the target structure data.

5. The method according to any one of claims 1 to 4, characterized in that The step of sending the API request information to the API service and receiving the API proxy traffic data returned by the API service includes: Performing transmission protocol identification on the API proxy traffic data to determine a target transmission protocol corresponding to the API proxy traffic data; Based on the target transmission protocol, a content protocol corresponding to the API proxy traffic data is identified.

6. A data desensitization device, configured in an API protection system, characterized in that: include: a receiving module configured to receive API proxy traffic data returned by the API service in response to sending API request information to the API service; an identification module configured to identify a content protocol corresponding to the API proxy traffic data; a determination module configured to determine structure data corresponding to the API proxy traffic data based on a predetermined three-layer structure table and the content protocol, wherein the predetermined three-layer structure table is a content-structure-value three-layer structure; a desensitizing module configured to mark sensitive fields contained in the structure data with sensitive identifiers, and perform data desensitization processing on the API proxy traffic data based on the sensitive identifiers; The step of determining the structure data corresponding to the API proxy traffic data based on the predetermined three-layer structure table and the content protocol includes: Parsing the content protocol to determine the content protocol type corresponding to the content protocol and content structure data contained in the content protocol; Based on the predetermined three-layer structure table, performing content structure extraction on the content structure data to obtain content data, structure data and value data corresponding to the API proxy traffic data; The step of marking sensitive fields contained in the structure data with sensitive identifiers includes: Based on the content data, the structure data and the value data, a content-structure-value three-layer data table corresponding to the API proxy traffic data is formed; Merging the content data and value data with the same structural data in the content-structure-value three-layer data table respectively to obtain a markable content-structure-value three-layer data table corresponding to the API proxy traffic data; Obtaining a structure data template containing a sensitive identifier corresponding to the content protocol type, wherein the structure data template is obtained by summarizing and updating historical structure data containing the sensitive identifier, and the structure data template is structure data maintained in the API protection system; Determining, based on the structure data template, the marked structure data and the unmarked structure data in the markable content-structure-value three-layer data table, and dividing the markable content-structure-value three-layer data table into a marked content-structure-value three-layer data table and a unmarked content-structure-value three-layer data table based on the marked structure data and the unmarked structure data; In the content-structure-value three-layer data table to be marked, sensitive fields contained in the structure data are marked with sensitive identifiers to obtain a target content-structure-value three-layer data table.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

8. An electronic device comprising a storage medium, a processor, and a computer program stored in the storage medium and executable on the processor, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 5 is implemented.

Images