Webpage data security protection method and device

Abstract

The invention provides a webpage data security protection method and device, and the method comprises the steps: obtaining request data according to a first page sent by a client, and obtaining first target webpage data; then classifying the first target webpage data according to a preset data classification rule to obtain a plurality of first to-be-analyzed sub-data; processing all the first to-be-analyzed sub-data by using a data security processing algorithm corresponding to each first to-be-analyzed sub-data to obtain first request response data; and finally returning the first request response data to the client which sends the first page acquisition request data. Compared with the prior art, the method has the advantages that different data security processing algorithms are adopted for processing the data of different format types, it is not needed to sequentially process the data of all format types through multiple data security algorithms, and therefore the webpage data security protection processing efficiency can be improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and in particular to a web page data security protection method and device. Background Art

[0002] With the continuous development of Internet technology, the number of websites is increasing. Websites that provide Internet services usually store some sensitive or private information of themselves and their users. Once this information is leaked, illegally provided or abused, it may not only pose a threat to the security of the website, but also endanger the personal and property safety of individuals, and easily lead to damage to personal reputation, physical and mental health, or discriminatory treatment.

[0003] In order to protect the security of web page data in the website, sensitive information included in the web page data is often shielded. However, the existing technology mainly uses manual processing or multiple rounds of recursive algorithms to detect and process sensitive information of the entire web page data. These methods not only have the problem of a high omission rate of sensitive information screening, but also have the problem of low data processing efficiency. Summary of the invention

[0004] In view of this, one of the technical problems solved by the embodiments of the present invention is to provide a web page data security protection method and device to overcome the problems of high omission rate of sensitive information screening and low processing efficiency in the prior art for web page data security processing.

[0005] The first aspect of the embodiment of the present application discloses a webpage data security protection method, the method comprising:

[0006] Obtaining first target web page data according to first page acquisition request data sent by the client;

[0007] Classify the first target webpage data according to a preset data classification rule to obtain a plurality of first sub-data to be analyzed;

[0008] Using the data security processing algorithm corresponding to each of the first sub-data to be analyzed, all of the first sub-data to be analyzed are processed to obtain first request response data;

[0009] The first request response data is returned to the client that sent the first page acquisition request data.

[0010] A second aspect of an embodiment of the present application discloses a webpage data security protection device, the device comprising:

[0011] A data acquisition module, used to obtain first target web page data according to the first page acquisition request data sent by the client;

[0012] A data type analysis module, used to classify the first target web page data according to a preset data classification rule to obtain a plurality of first sub-data to be analyzed;

[0013] a data analysis module, configured to process all of the first sub-data to be analyzed by using a data security processing algorithm corresponding to each of the first sub-data to be analyzed, to obtain first request response data;

[0014] A data sending module is used to return the first request response data to the client that sent the first page acquisition request data.

[0015] In the embodiment of the present invention, firstly, first target web page data is obtained according to the first page acquisition request data sent by the client; then, the first target web page data is classified according to the preset data classification rules to obtain a plurality of first sub-data to be analyzed; then, all the first sub-data to be analyzed are processed using the data security processing algorithm corresponding to each first sub-data to be analyzed to obtain the first request response data; thus, the first request response data is finally returned to the client that sent the first page acquisition request data. Compared with the prior art, in the present embodiment, different data security processing algorithms are used to process data of different formats respectively, and there is no need to use multiple data security algorithms to process data of all formats in sequence, thereby improving the efficiency of web page data security protection processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0017] Figure 1 It is a flowchart of a webpage data security protection method disclosed in the first embodiment of the present application;

[0018] Figure 2 It is a flowchart of a web page data security protection method disclosed in Embodiment 2 of the present application;

[0019] Figure 3 It is a structural schematic block diagram of a web page data security protection device disclosed in Example 3 of the present application. DETAILED DESCRIPTION

[0020] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0021] It should be noted that the terms "first", "second", "third" and "fourth" in the specification and claims of the present application are used to distinguish different objects rather than to describe a specific order. The terms "including" and "having" in the embodiments of the present application and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, device, product or equipment including a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0022] Embodiment 1

[0023] like Figure 1 As shown, Figure 1 This is a schematic flow chart of a web page data security protection method disclosed in Embodiment 1 of the present application. The web page data security protection method includes:

[0024] Step S101, obtaining first target web page data according to first page acquisition request data sent by a client.

[0025] In this embodiment, the type of the execution subject of this method is not limited, for example, it can be a server of the target website, or it can be a firewall that provides security services for the target website.

[0026] In this embodiment, the client is the execution subject of sending the page acquisition request, and the type and number of the client are not limited. The client can obtain the corresponding data in several target web pages in the target website by sending the first page acquisition request data request.

[0027] In this embodiment, after receiving the first page acquisition request data, the implementation subject of this method can obtain the first target web page data from the server of the target website according to the first page acquisition request data. The specific data format type and number of types of the first target web page data are not limited, for example, it can include data in HTML format, data in document formats such as Word, Excel, and PPT, and character string data used to represent server information, SQL statements, code error information, etc.

[0028] Step S102: classify the first target webpage data according to a preset data classification rule to obtain a plurality of first sub-data to be analyzed.

[0029] In this embodiment, the data classification rule is used to classify data according to format type, so that the format types of different first sub-data to be analyzed obtained in step S102 are all different. Among them, the method of presetting the data classification rule is not limited, and can be reasonably selected according to actual application requirements.

[0030] Step S103: using the data security processing algorithm corresponding to each first sub-data to be analyzed, process all the first sub-data to be analyzed to obtain first request response data.

[0031] In this embodiment, before the implementation of step S103, a data security algorithm corresponding to each format type of data will be preset. The data security processing algorithm is used to perform security analysis and protection processing on the specified type of data. The specific security analysis and protection processing logic is not limited and can be reasonably selected according to actual application requirements.

[0032] In this embodiment, after processing all the first sub-data to be analyzed, the first request response data obtained is different from the first target web page data mainly in that the information or files in the target web page that may be at risk of leakage, abuse or attack are protected.

[0033] Optionally, in order to prevent the document or image in the target webpage from being abused, step S103 may further include sub-step S103a: adding a watermark to the first sub-data to be analyzed in the document format or the image format to obtain the first request response data.

[0034] There is no limit to the specific method of adding watermarks, and a reasonable choice can be made according to actual application requirements. For example, a preset digital or character watermark can be added to documents and pictures in formats such as word, excel, and ppt.

[0035] Furthermore, in order to facilitate tracing of watermark information, sub-step S103a may also include: adding watermark processing to the first sub-data to be analyzed in document format or image format according to the domain name information and / or time information corresponding to the first target web page data to obtain the first request response data.

[0036] Step S104: Return the first request response data to the client that sent the first page acquisition request data.

[0037] Optionally, since it takes a long time to perform data security processing on web page data, performing data security processing on multiple page acquisition requests at the same time can easily cause machine resources to be exhausted and crash. Therefore, in order to reduce time and avoid the problem of excessive resource utilization, if a third page acquisition request data is received from one or more clients before step S104, this embodiment may also include: determining whether the first page acquisition request data and the third page acquisition request data are requests to obtain the same target web page data.

[0038] If yes, step S104 further includes: returning the first request response data to the client that sent the third page acquisition request data; if no, taking the third page acquisition request data as the first page acquisition request data in step S101, and re-executing steps S101 to S104.

[0039] Optionally, in order to reduce time consumption and avoid the problem of excessive resource usage, the first request response data can be stored so that when the client subsequently receives the request data for obtaining the target web page data, the stored first request response data can be directly called and returned to the client. Specifically, this embodiment can also include the following steps S105 and S106:

[0040] Step S105: Process the first request response data using a preset identification algorithm to obtain first identification information corresponding to the first request response data.

[0041] The method for identifying the first request response data is not limited and can be reasonably selected according to actual application requirements. For example, the first request response data can be identified according to a predetermined sequence number or according to the generation time of the first request response data.

[0042] Furthermore, in order to ensure the security of data storage, step S105 may also include: according to at least one of the web page content information, request parameter information, data security configuration parameter information, and URL information in the first request response data, using a preset identification algorithm to calculate the first identification information corresponding to the first request response data.

[0043] For example, in order to improve the integrity and consistency of data storage, an MD5 value can be calculated based on the web page content information, request parameter information, data security configuration parameter information and URL information in the first request response data, and the MD5 value can be used as the first identification information corresponding to the first request response data.

[0044] Step S106: store the first request response data and the first identification information.

[0045] Storing the first request response data and the first identification information refers to storing the first request response data, the first identification information and the corresponding relationship between the two.

[0046] Furthermore, in order to reduce time consumption and avoid the problem of excessive resource usage, after step S106, this embodiment may further include the following steps S107 to S109:

[0047] Step S107, obtaining second target web page data according to the second page acquisition request data sent by the client.

[0048] The client sending the second page acquisition request data may be the same as or different from the client sending the first page acquisition request data; and the target webpage corresponding to the second target webpage data may be the same as or different from the target webpage corresponding to the first target webpage data in step S101.

[0049] Step S108: Process the second target webpage data using a preset identification algorithm to obtain second identification information corresponding to the second target webpage data.

[0050] Step S109: when it is determined that the second identification information is the same as the first identification information, the first request response data is returned to the client that sent the second page acquisition request data.

[0051] Furthermore, when the data after the data security processing of the second target webpage data is not stored, in order to achieve the response to the client request, this embodiment may further include the following steps S110 to S112:

[0052] Step S110: when it is determined that no information identical to the second identification information is stored, the second target webpage data is classified according to a preset data classification rule to obtain a plurality of second sub-data to be analyzed.

[0053] Step S111 : using the data security processing algorithm corresponding to each second sub-data to be analyzed, all the second sub-data to be analyzed are processed to obtain second request response data.

[0054] Step S112: Return second request response data to the client that sent the second page acquisition request data.

[0055] Among them, the processing methods of step S110 to step S112 are the same or similar to the aforementioned step S102 to step S104, and are not repeated here.

[0056] As can be seen from the above embodiments of the present invention, the embodiments of the present invention first obtain the first target web page data according to the first page acquisition request data sent by the client; then classify the first target web page data according to the preset data classification rules to obtain a number of first sub-data to be analyzed; then use the data security processing algorithm corresponding to each first sub-data to be analyzed to process all the first sub-data to be analyzed to obtain the first request response data; and finally return the first request response data to the client that sent the first page acquisition request data. Compared with the prior art, in this embodiment, different data security processing algorithms are used to process data of different formats respectively, and there is no need to use multiple data security algorithms to process all format types of data in sequence, so the efficiency of web page data security protection processing can be improved.

[0057] Embodiment 2

[0058] like Figure 2 As shown, Figure 2 This is a schematic flow chart of a web page data security protection method disclosed in Embodiment 2 of the present application. The web page data security protection method includes:

[0059] Step S201, obtaining first target web page data according to first page acquisition request data sent by the client.

[0060] In this embodiment, step S201 is substantially the same as or similar to step S101 in the aforementioned first embodiment, and will not be described in detail herein.

[0061] Step S202: classify the first target webpage data according to a preset data classification rule to obtain a plurality of first sub-data to be analyzed.

[0062] In this embodiment, step S202 is substantially the same as or similar to step S102 in the aforementioned first embodiment, and will not be described in detail herein.

[0063] Step S203: According to the preset sensitive information shielding rule, the first sub-data to be analyzed is subjected to sensitive information shielding processing to obtain first request response data.

[0064] In this embodiment, the sensitive information shielding rule is used to detect whether the content represented by the first sub-data to be analyzed contains preset sensitive information, and when it is determined that the preset sensitive information exists, the preset sensitive information is shielded accordingly, so that the preset sensitive information is not displayed in the first request response data received by the client. The specific setting method of the sensitive information shielding rule is not limited and can be reasonably selected according to actual application requirements.

[0065] In addition, the sensitive information shielding rule may be composed of one or more rules. In practical applications, in order to comprehensively detect and shield sensitive information, it is preferred that the sensitive information shielding rule is composed of multiple rules.

[0066] Optionally, considering that in actual applications, all or part of the same sensitive information may be detected by multiple sensitive information detection rules, in order to more efficiently and comprehensively process sensitive information for data in HTML format, sensitive information detection and sensitive information shielding processing may be performed separately. Specifically, the sensitive information shielding rule includes information matching sub-rules and information shielding sub-rules; when the first sub-data to be analyzed is in HTML format, step S203 includes the following sub-steps S203a-S203c:

[0067] Sub-step S203a: detecting all label data in the first sub-data to be analyzed according to the information matching sub-rule.

[0068] The information matching sub-rule is used to detect whether the content represented by the tag data contains preset sensitive information. In order to comprehensively detect sensitive information, it is preferred that there are multiple information matching sub-rules.

[0069] Sub-step S203b, when it is determined that the target tag data in the tag data includes preset sensitive information, information identification data corresponding to the target tag data is generated.

[0070] The information identification data is used to identify the starting position and the ending position of the preset sensitive information in the target tag data.

[0071] Sub-step S203c, based on the information identification data corresponding to the target tag data, sensitive information shielding processing is performed on the target tag data according to the information shielding sub-rule to obtain the first request response data.

[0072] Among them, the information shielding sub-rule is used to determine how to shield the sensitive information represented in the target tag data. When shielding the target tag data for sensitive information according to the information shielding sub-rule, it is only necessary to traverse the detection results once, and the information shielding sub-rule can be flexibly adjusted. The specific setting method of the information shielding sub-rule is not limited, and can be reasonably selected according to the actual application requirements.

[0073] Furthermore, under the premise of avoiding leakage of sensitive information, in order to ensure that the user of the client can see more required information to improve the user experience, the information shielding sub-rule may include at least one of the following rules:

[0074] For sensitive information of the "name" type, the "surname" is retained and the "given" is shielded;

[0075] For sensitive information of the "address" type, "country", "province" and "city" are retained, and information below "city" is blocked;

[0076] For sensitive information of the "phone number" type, the four or more digits in the middle of the number or the four or more digits at the end of the number are shielded;

[0077] For sensitive information of the "bank card number" type or the "identity card number" type, the numbers after the first four digits are shielded.

[0078] Furthermore, since in actual application, it is possible to set up multiple information matching sub-rules for detecting the same type of sensitive information, in order to accurately and efficiently detect the same type of sensitive information, it is preferred to prioritize the multiple information matching sub-rules for detecting the same type of sensitive information. When an information matching sub-rule with a high priority detects sensitive information, the information matching sub-rule with a low priority will no longer be used to continue detecting the same information.

[0079] Specifically, this embodiment further includes step S200: prioritizing a plurality of first target sub-rules in the information matching sub-rule.

[0080] Among them, multiple first target sub-rules are used to detect sensitive information of the same type. The specific setting method and number of the first target sub-rules are not limited and can be reasonably selected according to actual application requirements.

[0081] For example, for the information matching sub-rule used to detect sensitive information of the "address" type, the first target sub-rule with the key "address" in front can be set to "Address: xxxxx Avenue, Wuhan City", and the first target sub-rule without the key "address" can be set to "xxx Avenue, Wuhan City", and the priority of "Address: xxxxx Avenue, Wuhan City" is higher than that of "xxx Avenue, Wuhan City".

[0082] Correspondingly, sub-step S203a includes the following steps A and B:

[0083] Step A: all label data in the first sub-data to be analyzed are detected according to the first target sub-rule in order of priority.

[0084] Step B: when it is determined that the target label data includes preset sensitive information according to the first target sub-rule with a higher priority, the first target sub-rule with a lower priority is no longer used to detect the preset sensitive information included in the target label data.

[0085] Furthermore, in order to ensure the accuracy of sensitive information detection, sub-step S203b also includes the following steps C and D:

[0086] Step C: when it is determined according to multiple second target sub-rules in the information shielding sub-rule that the target label data includes preset sensitive information, a plurality of identification pre-processing data corresponding to the target label data are generated.

[0087] Among them, one identification preprocessing data is used to identify the starting position and the ending position of the preset sensitive information determined according to a second target sub-rule in the target label data.

[0088] Step D, when the preset sensitive information identified by the multiple identification preprocessing data corresponding to the target label data overlaps in the starting position and the ending position in the target label data, the multiple identification preprocessing data corresponding to the target label data are deduplicated to obtain the information identification data corresponding to the target label data.

[0089] Among them, the starting positions and ending positions of the multiple preset sensitive information identified by the information identification data in the target label data do not overlap. It should be noted that the starting positions and ending positions of the multiple preset sensitive information in the target label data do not overlap, which does not include the situation where a starting position overlaps with an ending position, that is, the ending position corresponding to the previous preset sensitive information can be the same as the ending position corresponding to the next preset sensitive information.

[0090] In addition, it should be noted that step A-step B, and step C-step D can be selected and used one by one, or can be selected and used at the same time, and this embodiment does not limit this.

[0091] Furthermore, in order to improve the comprehensiveness and accuracy of sensitive information detection, it is preferred that after step A-step B is completed, step C-step D is further performed.

[0092] Furthermore, in order to more efficiently perform deduplication processing on a plurality of identified pre-processed data, the sequence number corresponding to each identified pre-processed data may be identified in sequence.

[0093] Furthermore, in order to efficiently and comprehensively perform sensitive information shielding processing on the target tag data, the identification preprocessing data may be stored in an array. Specifically, step C may also include: using a linked list structure to store multiple identification preprocessing data corresponding to the target tag data.

[0094] Optionally, in order to completely perform security protection processing on the first target web page data, when the first target web page data includes data other than HTML format data, document format data, and image format data, it is preferred to use a regular expression to detect whether there is a preset string. When a preset string is matched, the preset string is shielded.

[0095] The data for detecting whether a preset character string exists using a regular expression may include at least one of data for representing server information, data for representing SQL statements, and data for representing code error information.

[0096] Step S204: Return the first request response data to the client that sent the first page acquisition request data.

[0097] In this embodiment, step S204 is substantially the same as or similar to step S104 in the first embodiment, and will not be described in detail herein.

[0098] It can be seen from the above embodiments of the present invention that, compared with the aforementioned embodiments, this embodiment performs sensitive information shielding processing on the first sub-data to be analyzed according to the preset sensitive information shielding rule to obtain the first request response data, so that the preset sensitive information will not be displayed in the first page acquisition request data received by the client, thereby avoiding the leakage of sensitive information; by setting information matching sub-rules and information shielding sub-rules, and performing sensitive information detection and sensitive information shielding processing separately, sensitive information processing can be performed on data in HTML format more efficiently and comprehensively.

[0099] Embodiment 3

[0100] Embodiment 3 of the present application provides a webpage data security protection device, Figure 3 This is a schematic diagram of the structure of a webpage data security protection device disclosed in Embodiment 3 of the present application, the device comprising:

[0101] A data acquisition module, used to obtain first target web page data according to the first page acquisition request data sent by the client;

[0102] A data type analysis module, used to classify the first target web page data according to a preset data classification rule to obtain a plurality of first sub-data to be analyzed;

[0103] A data analysis module, configured to process all first sub-data to be analyzed by using a data security processing algorithm corresponding to each first sub-data to be analyzed, and obtain first request response data;

[0104] The data sending module is used to return the first request response data to the client that sends the first page acquisition request data.

[0105] Optionally, the data analysis module is further used to perform sensitive information shielding processing on the first sub-data to be analyzed according to a preset sensitive information shielding rule to obtain first request response data.

[0106] Optionally, the sensitive information shielding rule includes an information matching sub-rule and an information shielding sub-rule; when the first sub-data to be analyzed is in HTML format, the data analysis module is further used to:

[0107] According to the information matching sub-rule, all label data in the first sub-data to be analyzed are detected;

[0108] When it is determined that the target label data in the label data includes preset sensitive information, information identification data corresponding to the target label data is generated; wherein the information identification data is used to identify the starting position and the ending position of the preset sensitive information in the target label data;

[0109] According to the information identification data corresponding to the target tag data, sensitive information shielding processing is performed on the target tag data according to the information shielding sub-rule to obtain the first request response data.

[0110] Optionally, the webpage data security protection device further includes a priority setting module, which is used to prioritize the multiple first target sub-rules in the information matching sub-rule; correspondingly, the data analysis module is also used to:

[0111] Detect all label data in the first sub-data to be analyzed according to the first target sub-rule in order of priority;

[0112] When it is determined that the target label data includes preset sensitive information according to the first target sub-rule with a higher priority, the first target sub-rule with a lower priority is no longer used to detect the preset sensitive information included in the target label data.

[0113] Optionally, the data analysis module is further used to:

[0114] When the target label data includes preset sensitive information according to multiple second target sub-rules in the information shielding sub-rule, multiple identification pre-processing data corresponding to the target label data are generated; wherein one identification pre-processing data is used to identify the starting position and the ending position of the preset sensitive information determined according to one second target sub-rule in the target label data;

[0115] When the starting position and the ending position of the preset sensitive information identified by the multiple identification preprocessing data corresponding to the target label data overlap in the target label data, the multiple identification preprocessing data corresponding to the target label data are deduplicated to obtain the information identification data corresponding to the target label data; wherein the starting position and the ending position of the multiple preset sensitive information identified by the information identification data in the target label data have no overlapping interval.

[0116] Optionally, the web page data security protection device further includes a storage module for storing a plurality of identification pre-processing data corresponding to the target tag data in a linked list structure.

[0117] Optionally, the data analysis module is further used to: perform watermark processing on the first sub-data to be analyzed in a document format or a picture format to obtain first request response data.

[0118] Optionally, the data analysis module is further used to: add watermark processing to the first sub-data to be analyzed in document format or image format according to the domain name information and / or time information corresponding to the first target web page data, so as to obtain the first request response data.

[0119] Optionally, the web page data security protection device also includes an identification module, which is used to process the first request response data using a preset identification algorithm to obtain first identification information corresponding to the first request response data; and store the first request response data and the first identification information.

[0120] Optionally, the webpage data security protection device further includes a query module, which is used to:

[0121] According to the second page acquisition request data sent by the client, the second target web page data is obtained; the second target web page data is processed by using a preset identification algorithm to obtain second identification information corresponding to the second target web page data; when it is determined that the second identification information is the same as the first identification information, the first request response data is returned to the client that sent the second page acquisition request data.

[0122] Optionally, the query module is also used to:

[0123] When it is determined that no information identical to the second identification information is stored, classifying the second target webpage data according to the data classification rule to obtain a plurality of second sub-data to be analyzed;

[0124] Using the data security processing algorithm corresponding to each second sub-data to be analyzed, all the second sub-data to be analyzed are processed to obtain second request response data;

[0125] The second request response data is returned to the client that sent the second page acquisition request data.

[0126] Optionally, the data analysis module is also used to calculate the first identification information corresponding to the first request response data using a preset identification algorithm based on at least one of the web page content information, request parameter information, data security configuration parameter information, and URL information in the first request response data.

[0127] The webpage data security protection device of this embodiment can implement the corresponding webpage data security protection methods in the aforementioned multiple method embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be described in detail here.

[0128] So far, specific embodiments of the present application have been described. Other embodiments are within the scope of the appended claims. In some cases, the actions recorded in the claims can be performed in a different order and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In some embodiments, multitasking and parallel processing can be advantageous.

[0129] The present application is described with reference to the flowcharts and / or block diagrams of the methods according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0130] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0131] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods and devices. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0132] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0133] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A web page data security protection method, characterized in that: The method comprises: Obtaining first target web page data according to first page acquisition request data sent by the client; Classify the first target webpage data according to a preset data classification rule to obtain a plurality of first sub-data to be analyzed; Using the data security processing algorithm corresponding to each of the first sub-data to be analyzed, all of the first sub-data to be analyzed are processed to obtain first request response data; The first request response data is returned to the client that sent the first page acquisition request data.

2. The method according to claim 1, characterized in that The using the data security processing algorithm corresponding to each of the first sub-data to be analyzed to process all of the first sub-data to be analyzed to obtain the first request response data includes: According to preset sensitive information shielding rules, the first sub-data to be analyzed is subjected to sensitive information shielding processing to obtain the first request response data.

3. The method according to claim 2, characterized in that The sensitive information shielding rule includes an information matching sub-rule and an information shielding sub-rule; When the first sub-data to be analyzed is in HTML format, the first sub-data to be analyzed is subjected to sensitive information shielding processing according to a preset sensitive information shielding rule, and obtaining the first request response data includes: According to the information matching sub-rule, all label data in the first sub-data to be analyzed are detected; When it is determined that the target label data in the label data includes preset sensitive information, information identification data corresponding to the target label data is generated; wherein the information identification data is used to identify the starting position and the ending position of the preset sensitive information in the target label data; According to the information identification data corresponding to the target tag data, sensitive information shielding processing is performed on the target tag data according to the information shielding sub-rule to obtain the first request response data.

4. The method according to claim 3, characterized in that The method further comprises: prioritizing a plurality of first target sub-rules in the information matching sub-rule; Correspondingly, the detecting all label data in the first sub-data to be analyzed according to the information matching sub-rule includes: Detecting all label data in the first sub-data to be analyzed according to the first target sub-rules in order of priority; When it is determined that the target label data includes preset sensitive information according to the first target sub-rule with a higher priority, the first target sub-rule with a lower priority is no longer used to detect the preset sensitive information included in the target label data.

5. The method according to claim 3, characterized in that: When it is determined that the target tag data in the tag data includes preset sensitive information, generating information identification data corresponding to the target tag data includes: When it is determined that the target label data includes the preset sensitive information according to multiple second target sub-rules in the information shielding sub-rule, a plurality of identification pre-processing data corresponding to the target label data are generated; wherein one identification pre-processing data is used to identify the starting position and the ending position of the preset sensitive information determined according to one of the second target sub-rules in the target label data; When the starting position and the ending position of the preset sensitive information identified by the multiple identification preprocessing data corresponding to the target label data overlap in the target label data, the multiple identification preprocessing data corresponding to the target label data are deduplicated to obtain the information identification data corresponding to the target label data; wherein the starting position and the ending position of the multiple preset sensitive information identified by the information identification data in the target label data have no overlapping interval.

6. The method according to claim 1, characterized in that The using the data security processing algorithm corresponding to each of the first sub-data to be analyzed to process all of the first sub-data to be analyzed to obtain the first request response data includes: According to the domain name information and / or time information corresponding to the first target web page data, watermark processing is performed on the first sub-data to be analyzed in the document format or the image format to obtain the first request response data.

7. The method according to claim 1, characterized in that The method further comprises: Processing the first request response data using a preset identification algorithm to obtain first identification information corresponding to the first request response data; The first request response data and the first identification information are stored.

8. The method according to claim 7, characterized in that The method further comprises: Obtaining second target web page data according to the second page acquisition request data sent by the client; Processing the second target webpage data using the preset identification algorithm to obtain second identification information corresponding to the second target webpage data; When it is determined that the second identification information is the same as the first identification information, the first request response data is returned to the client that sent the second page acquisition request data.

9. The method according to claim 8, characterized in that The method further comprises: When it is determined that no information identical to the second identification information is stored, classifying the second target webpage data according to the data classification rule to obtain a plurality of second sub-data to be analyzed; Using the data security processing algorithm corresponding to each of the second sub-data to be analyzed, all of the second sub-data to be analyzed are processed to obtain second request response data; The second request response data is returned to the client that sent the second page acquisition request data.

10. A web page data security protection device, characterized in that: The device comprises: A data acquisition module, used to obtain first target web page data according to the first page acquisition request data sent by the client; A data type analysis module, used to classify the first target web page data according to a preset data classification rule to obtain a plurality of first sub-data to be analyzed; a data analysis module, configured to process all of the first sub-data to be analyzed by using a data security processing algorithm corresponding to each of the first sub-data to be analyzed, to obtain first request response data; A data sending module is used to return the first request response data to the client that sent the first page acquisition request data.

Images