Data desensitization method for content delivery network

Abstract

The invention belongs to the technical field of data desensitization, and particularly relates to a content distribution network data desensitization method which comprises the following steps: content acquisition: a WAF is deployed at the edge of a network, intercepts a user request and agents the user request to a source station, and the WAF acquires content data of the source station through communication with the source station; content auditing: a sensitive information identification engine is built in the WAF, the obtained content is scanned and analyzed, and if sensitive information is found, the WAF marks response content and enters the next step of processing; content desensitization: processing the content containing the sensitive information by the WAF according to a preset desensitization strategy; cache management: the desensitized content is stored in a WAF cache according to a cache strategy, the WAF manages the cache according to the life cycle of the content, and timely updating and expiration processing are ensured; and rule and edge calculation: the WAF is configured with a cache rule, a cache request is dynamically responded according to conditions, and an edge calculation JavaScript script is used for processing a specific request.

Description

Technical Field

[0001] The invention belongs to the technical field of data desensitization, and specifically, is a method for desensitizing data in a content distribution network. Background Art

[0002] With the widespread application of data in various business scenarios, data leakage incidents occur frequently, posing a threat to personal privacy and corporate security. Globally, data protection laws and regulations are becoming increasingly stringent, such as the EU's GDPR, requiring companies to take effective measures to protect personal data and sensitive information. The popularity of cloud services and the demand for big data analysis have promoted the innovation of data security technologies to ensure the security of data stored and processed in the cloud. With the development of cryptography and data protection technologies, such as homomorphic encryption and secure multi-party computing, a technical basis is provided for data desensitization and encryption. Under the premise of ensuring data privacy, enterprises and institutions need to share data for joint analysis and decision support, which requires that data must be properly desensitized and protected when shared. Data needs to be protected in all links such as collection, transmission, storage, and use, which has given rise to the demand for data desensitization and encryption technologies. While ensuring data security, the efficiency and performance of the technology also need to be considered to meet the requirements of data processing speed in the big data era. Different business scenarios and needs have given rise to the development of a variety of data protection technologies, such as agent-based data desensitization, distributed encryption, differential privacy, etc., to meet different application needs. The immutability and transparency of blockchain technology combined with data desensitization and encryption technology provide new solutions for data sharing and protection. In order to resist malicious attacks and unauthorized access, it is necessary to develop privacy-preserving data search solutions that can hide data content and search conditions.

[0003] The technical solutions currently used in data desensitization are as follows: (1) Proxy-based data desensitization solution: A proxy server is introduced during the data transmission process. The proxy server is responsible for desensitizing sensitive data and then transmitting the desensitized data to the destination. The specific steps are: a. The data generation end sends the sensitive data to the proxy server, b. The proxy server desensitizes the data, such as using a data desensitization algorithm to modify or replace the data, c. The desensitized data is transmitted to the destination through the network, d. After receiving the data, the destination can perform desensitization operations as needed to restore the original format of the data.

[0004] (2) Distributed encryption scheme: The encryption and decryption process is distributed to multiple nodes in the network to enhance security and flexibility. The specific steps are: a. The data generation end divides the sensitive data into multiple parts and encrypts them separately, b. The encrypted data is transmitted to multiple nodes through the network, c. Each node is responsible for storing and processing part of the encrypted data, d. When the data needs to be used, the nodes collaborate to decrypt and restore the data.

[0005] (3) Differential privacy solution: Differential privacy technology is used to protect privacy by introducing noise into the data. The specific steps are as follows: a. The data generation end processes sensitive data and introduces controlled noise; b. The processed data is transmitted to the destination through the network; c. After the destination receives the data, the noise is removed through the differential privacy algorithm to restore the original data.

[0006] (4) Scheme based on ciphertext search: Use searchable encryption technology to allow data search and access in an encrypted state. The specific steps are: a. The data generation end performs searchable encryption on the sensitive data, b. The encrypted data is transmitted to the destination through the network, and c. The destination uses the search key to perform a search operation, allowing access to the data in an encrypted state.

[0007] The above technical solutions all have certain defects, as follows: (1) Disadvantages of proxy-based data desensitization solutions: Stability risk. When using the proxy mode, if there is a problem with the proxy server, the entire product may become unavailable; Learning cost. You need to fully understand the business to configure desensitization rules for the returned fields, which increases the learning cost; Configuration workload. Desensitization configuration is required for each application, each interface, and each field, which is a large workload and prone to omissions; Bypass risk. If the application database does not have desensitization capabilities, there is a risk of bypassing the proxy and directly accessing the application database; Performance issues. Result set desensitization is usually performed after receiving the return data packet, which may result in performance degradation.

[0008] (2) Disadvantages of distributed encryption schemes: performance degradation. Distributed encryption may require communication and data processing between multiple nodes, which may lead to performance degradation; complex key management. In a distributed system, the generation, distribution and storage of keys are more complicated; system stability. Distributed systems rely on the collaboration of multiple nodes, and a single point of failure may affect the overall stability.

[0009] (3) Disadvantages of differential privacy schemes: Difficulty in parameter selection. It is difficult to determine the optimal privacy parameter ε to balance privacy protection and data analysis utility; Evolution of privacy attacks. With the evolution of attack technology, differential privacy algorithms need to continuously improve their resistance capabilities; Risk of privacy leakage. Differential privacy protects privacy by adding noise, but the introduction of noise may lead to a decrease in the accuracy of data analysis results.

[0010] (4) Disadvantages of ciphertext-based search solutions: Computational resource consumption: Some ciphertext-based search techniques, such as homomorphic encryption, may require a large amount of computing resources; Implementation complexity: It is technically challenging to build a ciphertext-based search system that is both secure and efficient. Summary of the invention

[0011] In view of the above-mentioned prior art, the present invention proposes a method for desensitizing data in a content distribution network, which can improve data security. By adopting desensitizing technology, the data is encrypted, anonymized or de-identified, so as to improve the security of data transmission and reduce the risk of data leakage; protect user privacy. Through desensitization processing, the user's personal privacy and sensitive information are effectively protected, ensuring that user data is not easily maliciously used or stolen during transmission; ensure data integrity. The implementation of a desensitization scheme can reduce the risk of data tampering or damage, thereby ensuring the integrity and reliability of data during transmission; improve data transmission rate. The desensitization scheme can effectively reduce redundant information in data transmission, improve data transmission efficiency, and speed up the response speed and performance of the content distribution network; meet compliance requirements, help enterprises comply with data protection regulations, such as GDPR, by avoiding direct processing of personally identifiable information (PII) through desensitization; support flexible data use, allowing data to be analyzed and mined to extract valuable information while protecting personal privacy.

[0012] The specific technical solution adopted by the present invention is as follows: A method for desensitizing content distribution network data, comprising the following steps: Step 1: Content acquisition: WAF is deployed at the edge of the network, intercepts user requests and proxies them to the origin site. By communicating with the origin site, WAF obtains the content data of the origin site. Step 2: Content review: WAF has a built-in sensitive information identification engine to scan and analyze the acquired content. If sensitive information is found, WAF will mark the response content and proceed to the next step of processing; Step 3: Content desensitization: According to the preset desensitization strategy (matching the domain name service to find the desensitization strategy that the user has customized on the management platform, such as replacing email information with '*' and deleting ID card information), WAF processes the content containing sensitive information. Possible desensitization methods include replacing, deleting or encrypting sensitive information. Step 4: Cache management: The desensitized content is stored in the WAF cache according to the cache policy. The WAF manages the cache according to the life cycle of the content to ensure timely updates and expiration processing; Step 5: Rules and edge computing: WAF is configured with cache rules to dynamically respond to cache requests based on conditions such as request type and user identity. Edge computing JavaScript scripts can be used to process specific requests, such as dynamic content desensitization or personalized content display.

[0013] In the above technical solution, before WAF accesses the domain name service, the customer needs to modify the domain name resolution and pass the user's access domain name traffic through the edge node of WAF, so that WAF can obtain content. After obtaining the traffic, it is first parsed to extract key information such as URL, request header, and request body. Based on the parsed URL information, WAF determines the best origin server node through DNS resolution or load balancing algorithm. WAF establishes a connection with the origin server, uses HTTP or HTTPS protocol to send requests and obtain content. In this process, WAF adopts a caching strategy to cache the content that has been obtained to reduce the number of requests to the origin site.

[0014] In the above technical solution, WAF also audits the content of export data, which is also an important part of ensuring the accuracy of data desensitization. First of all, WAF has a rich built-in security rule library (the WAF management platform has 3,000 built-in regular rules, and sets the rules at high / medium / low levels, which can be selected by users or use the default rule cluster), which is used to match malicious code, sensitive information, etc. that may exist in the content. These rules can be pattern matching based on regular expressions or behavioral analysis based on machine learning. For the matched content, WAF uses security scanning algorithms for further analysis. For example, for malicious code, WAF can use static code analysis or dynamic execution analysis to detect its potential risks. Based on the scanning results, WAF assesses the risk of the content and gives corresponding processing suggestions. For high-risk content, WAF can choose to intercept or further process it; for low-risk content, it can be directly released or desensitized.

[0015] Data desensitization is also the core link of CDN data desensitization. It is mainly divided into three steps. The first is sensitive information identification. WAF uses natural language processing (NLP) technology or regular expressions to identify sensitive information in the content. These sensitive information may include but are not limited to personal privacy information such as name, address, phone number, email address, as well as sensitive data such as corporate secrets and state secrets. The second is desensitization algorithm selection. According to the type of sensitive information identified and the desensitization requirements, WAF selects a suitable desensitization algorithm for processing. Common desensitization algorithms include partial replacement, randomization, encryption, etc. For example, for name information, a partial replacement algorithm can be used to replace it with "*" or a placeholder; for phone number information, a randomization algorithm can be used to replace it with an invalid number. The last step is desensitization processing. WAF applies the selected desensitization algorithm to the identified sensitive information to generate desensitized content.

[0016] In order to reduce the pressure on the origin site, we implemented cache management. Through the user-configured cache policy, we match user access. The desensitized content is stored in the CDN cache node to quickly respond to user requests later. The cache node uses distributed storage technology to improve storage reliability and scalability. When the original site content is updated, WAF needs to update the content in the CDN cache in a timely manner. At the same time, for cached content that has not been accessed for a long time or has expired, WAF needs to delete it from the cache to avoid occupying too many storage resources.

[0017] The beneficial effects of the present invention are as follows: the present invention encrypts the transmitted data to ensure that the data is not easily stolen or tampered with during the transmission process; anonymizes the user's personal information to hide the user's identity information and protect the user's privacy; de-identifies the identification information in the data to reduce the sensitivity of the data and reduce the risk of data leakage; and implements a data integrity verification mechanism during data transmission to ensure that the data is not tampered with or damaged during the transmission process. DETAILED DESCRIPTION

[0018] In order to deepen the understanding of the present invention, the present invention will be further described in detail below in conjunction with embodiments. The embodiments are only used to explain the present invention and do not limit the protection scope of the present invention.

[0019] Embodiment: A method for desensitizing content distribution network data, comprising the following steps: Step 1: Content acquisition: WAF is deployed at the edge of the network, intercepts user requests and proxies them to the origin site. By communicating with the origin site, WAF obtains the content data of the origin site. Step 2: Content review: WAF has a built-in sensitive information identification engine to scan and analyze the acquired content. If sensitive information is found, WAF will mark the response content and proceed to the next step of processing; Step 3: Content desensitization: WAF processes the content containing sensitive information according to the preset desensitization strategy; Step 4: Cache management: The desensitized content is stored in the WAF cache according to the cache policy. The WAF manages the cache according to the life cycle of the content to ensure timely updates and expiration processing; Step 5: Rules and edge computing: WAF is configured with cache rules to dynamically respond to cache requests based on conditions, and edge computing JavaScript scripts are used to process specific requests.

[0020] In the above embodiment, in step three, the desensitization method includes replacing, deleting or encrypting sensitive information; in step five, the edge computing JavaScript script is used to process specific requests, including dynamic content desensitization or personalized content display.

[0021] In the above embodiment, in step one, before WAF accesses the domain name service, the customer modifies the domain name resolution and passes the traffic of the user accessing the domain name through the edge node of WAF, so that WAF can obtain content. After obtaining the traffic, it is first parsed to extract key information. Based on the parsed URL information, WAF determines the best origin server node through DNS resolution or load balancing algorithm. WAF establishes a connection with the origin server, uses HTTP or HTTPS protocol to send requests and obtain content. In this process, WAF adopts a caching strategy to cache the content that has been obtained to reduce the number of requests to the origin site.

[0022] In step 2, WAF has a rich built-in security rule library to match malicious code and sensitive information that may exist in the content. For the matched content, WAF uses a security scanning algorithm for further analysis. Based on the scanning results, WAF assesses the risk of the content and gives corresponding processing suggestions. For high-risk content, WAF chooses to intercept or further process it; for low-risk content, it can be directly released or desensitized; the WAF management platform has 3,000 built-in regular rules and sets high / medium / low levels of rules, which can be customized by users or use the default rule cluster.

[0023] In the above embodiment, in step 3, content desensitization specifically includes the following process: Process 1: Sensitive information identification: WAF uses natural language processing technology or regular expressions to identify sensitive information in the content; Process 2: Desensitization algorithm selection: WAF selects an appropriate desensitization algorithm for processing based on the identified sensitive information type and desensitization requirements; Process 3: Desensitization processing: WAF applies the selected desensitization algorithm to the identified sensitive information to generate desensitized content.

[0024] This embodiment also includes cache management, which matches user access through the cache strategy configured by the user, and stores the desensitized content in the CDN cache node to quickly respond to user requests later.

[0025] This embodiment has the following technical effects: Performance optimization: The content distribution data desensitization solution can reduce the computing pressure on the central server by performing desensitization processing at the edge of the network, thereby improving the overall system performance.

[0026] Real-time: The content distribution data desensitization solution can implement dynamic data desensitization (DDM), that is, desensitization is performed in real time when the data is accessed, ensuring the real-time nature of the data.

[0027] Transparency: For the client and server, the desensitization process of the content distribution data desensitization solution is usually transparent, without the need to change the original data storage method or application code.

[0028] Flexibility: The content distribution data desensitization solution can apply different desensitization strategies according to different visitors and usage scenarios, providing flexible desensitization processing.

[0029] Scalability: The CDN architecture naturally supports scalability, and the desensitization processing capabilities can be expanded as the amount of data and user requests increase.

[0030] Security: Content distribution desensitization solutions usually combine multiple security measures, such as data encryption and access control, to enhance the security of data transmission and storage.

[0031] Compatibility: The content distribution desensitization solution is not limited to relational databases, but can also be applied to non-relational databases and big data environments, and has good compatibility.

[0032] Easy deployment: The content distribution desensitization solution can be deployed as a service, which simplifies the deployment and maintenance of the desensitization system.

[0033] Fine-grained control: The content distribution data desensitization solution allows sensitive data to be transformed based on user roles, responsibilities and other rules to achieve fine-grained access control.

[0034] Reduce the risk of data leakage: By desensitizing data before transmitting it to users, the content distribution data desensitization solution effectively reduces the risk of data being intercepted and leaked during transmission.

[0035] Regulatory compliance: Content distribution data masking solutions help enterprises comply with data protection regulations, such as GDPR, by avoiding direct processing of personally identifiable information (PII) through masking.

[0036] Maintaining data consistency: Compared with static desensitization, CDN's dynamic desensitization does not affect data consistency in the production environment.

[0037] Reduce development costs: Since the content distribution data desensitization solution does not require modifying existing databases and application codes, it can reduce development and maintenance costs.

[0038] Responding to big data challenges: The content distribution data desensitization solution can handle the massive, heterogeneous, and real-time data desensitization needs in the big data environment and is suitable for modern big data challenges.

[0039] The technical features of the above-described embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above-described embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

Claims

1. A method for desensitizing content distribution network data, characterized in that: The steps include: Step 1: Content acquisition: WAF is deployed at the edge of the network, intercepts user requests and proxies them to the origin site. By communicating with the origin site, WAF obtains the content data of the origin site. Step 2: Content review: WAF has a built-in sensitive information identification engine to scan and analyze the acquired content. If sensitive information is found, WAF will mark the response content and proceed to the next step of processing; Step 3: Content desensitization: WAF processes the content containing sensitive information according to the preset desensitization strategy; Step 4: Cache management: The desensitized content is stored in the WAF cache according to the cache policy. The WAF manages the cache according to the life cycle of the content to ensure timely updates and expiration processing; Step 5: Rules and edge computing: WAF is configured with cache rules to dynamically respond to cache requests based on conditions, and edge computing JavaScript scripts are used to process specific requests.

2. The method for desensitizing content distribution network data according to claim 1, characterized in that: In step three, the desensitizing method includes replacing, deleting or encrypting sensitive information.

3. The method for desensitizing content distribution network data according to claim 1, characterized in that: In step five, the edge computing JavaScript script is used to process specific requests, including dynamic content desensitization or personalized content display.

4. The method for desensitizing content distribution network data according to any one of claims 1 to 3, characterized in that: In the step 1, before WAF accesses the domain name service, the customer modifies the domain name resolution and passes the user's access domain name traffic through the edge node of WAF, so that WAF can obtain content. After obtaining the traffic, it is first parsed to extract key information. Based on the parsed URL information, WAF determines the best origin server node through DNS resolution or load balancing algorithm. WAF establishes a connection with the origin server, uses HTTP or HTTPS protocol to send requests and obtain content. In this process, WAF adopts a caching strategy to cache the content that has been obtained to reduce the number of requests to the origin site.

5. The method for desensitizing content distribution network data according to claim 4, characterized in that: In step 2, WAF has a rich built-in security rule library for matching malicious code and sensitive information that may exist in the content. For the matched content, WAF uses a security scanning algorithm for further analysis. Based on the scanning results, WAF assesses the risk of the content and gives corresponding processing suggestions. For high-risk content, WAF chooses to intercept or further process it; for low-risk content, it can be directly released or desensitized.

6. The method for desensitizing content distribution network data according to claim 5, characterized in that: In step 2, the WAF management platform has 3,000 built-in regular rules and sets high / medium / low levels for the rules, allowing users to customize or use the default rule cluster.

7. A method for desensitizing content distribution network data according to claim 6, characterized in that: In step 3, content desensitization specifically includes the following process: Process 1: Sensitive information identification: WAF uses natural language processing technology or regular expressions to identify sensitive information in the content; Process 2: Desensitization algorithm selection: WAF selects an appropriate desensitization algorithm for processing based on the identified sensitive information type and desensitization requirements; Process 3: Desensitization processing: WAF applies the selected desensitization algorithm to the identified sensitive information to generate desensitized content.

8. The method for desensitizing content distribution network data according to claim 7, characterized in that: It also includes cache management, which matches user access through user-configured cache policies and stores the anonymized content in the CDN cache nodes to quickly respond to user requests later.