Extensible interface data desensitization method, equipment and medium

Abstract

The invention relates to the technical field of data processing, and discloses an extensible interface data desensitization method and device and a medium, and the method comprises the steps: recognizing a desensitization type corresponding to target sensitive data, and generating a desensitization rule corresponding to the target sensitive data according to the desensitization type; configuring a desensitization annotation interface of the target sensitive data according to the desensitization rule and the annotation attribute, and adding the desensitization annotation interface to a pre-acquired section programming interface; when a data calling request is received, intercepting the data calling request by utilizing the section programming interface, and calling a request interface corresponding to the intercepted data calling request in the section programming interface; and extracting a return result corresponding to the intercepted data calling request through the request interface, and performing data desensitization on the return result by utilizing a desensitization annotation interface in the aspect programming interface. According to the invention, the data desensitization efficiency can be improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to an extensible interface data desensitization method, device and medium. Background Art

[0002] With the deepening of the informatization process, a large amount of personal and sensitive information is stored and transmitted, such as users' mobile phone numbers, ID card numbers, bank card numbers, etc. Protecting sensitive information from unauthorized access and use is an important measure to protect user privacy. Therefore, it is necessary to desensitize sensitive information data to ensure the security of data during transmission.

[0003] The existing data desensitization technology requires that when the interface returns data containing sensitive information, sensitive data needs to be desensitized one by one, and manual code needs to be written to perform desensitization one by one according to the rules. In actual applications, data desensitization based on manually written code may result in data desensitization being too slow, resulting in low efficiency when performing data desensitization. Summary of the invention

[0004] The present invention provides an extensible interface data desensitization method, device and medium, the main purpose of which is to solve the problem of low efficiency when performing data desensitization.

[0005] To achieve the above object, the present invention provides an extensible interface data desensitization method, comprising:

[0006] Identify the desensitization type corresponding to the pre-acquired target sensitive data, and generate desensitization rules corresponding to the target sensitive data according to the desensitization type;

[0007] Configure a desensitizing annotation interface for the target sensitive data according to the desensitizing rule and predefined annotation attributes, and add the desensitizing annotation interface to a pre-acquired aspect programming interface;

[0008] When receiving a data call request, intercepting the data call request using the aspect programming interface, and calling a request interface corresponding to the intercepted data call request in the aspect programming interface;

[0009] The return result corresponding to the intercepted data call request is extracted through the request interface, and the return result is desensitized using the desensitizing annotation interface in the aspect programming interface.

[0010] Optionally, the identifying the desensitization type corresponding to the pre-acquired target sensitive data includes:

[0011] Extract data labels of pre-acquired target sensitive data;

[0012] Determine the field name of the pre-acquired target sensitive data according to the data label;

[0013] Determining the data type of the pre-acquired target sensitive data according to the field name;

[0014] The desensitization type of the pre-acquired target sensitive data is determined according to the data type.

[0015] Optionally, generating a desensitization rule corresponding to the target sensitive data according to the desensitization type includes:

[0016] Determining the character length of the target sensitive data according to the desensitization type;

[0017] Configure the mask position of the target sensitive data according to the character length;

[0018] Generate desensitization rules for the target sensitive data according to the mask position.

[0019] Optionally, configuring the desensitizing annotation interface of the target sensitive data according to the desensitizing rule and predefined annotation attributes includes:

[0020] Extract the desensitized data path and desensitized data type in the pre-defined annotation attributes;

[0021] Determine a desensitized object according to the desensitized data path and the type of desensitized data;

[0022] Configuring the desensitization object and the desensitization rule into a desensitization annotation format;

[0023] The desensitizing annotation format is encapsulated as a desensitizing annotation interface for the target sensitive data.

[0024] Optionally, intercepting the data call request by using the aspect programming interface includes:

[0025] Parsing parameters of the data call request, and verifying parameters of the parsed data call request;

[0026] When the verified data call request meets the preset interception rule, the data call request is intercepted using the interception function in the aspect programming interface.

[0027] Optionally, calling the request interface corresponding to the intercepted data call request in the aspect programming interface includes:

[0028] Using the request parameters in the intercepted data call request as original call parameters;

[0029] Calling the original target execution function in the aspect programming interface;

[0030] Passing the original call parameters to the original target execution function;

[0031] The original target execution function passed to the original call parameter is determined as the request interface corresponding to the intercepted data call request.

[0032] Optionally, extracting the return result corresponding to the intercepted data call request through the request interface includes:

[0033] Passing the request parameters in the intercepted data call request to the request interface;

[0034] Execute the request interface after the request parameters are passed to obtain the request result variable;

[0035] The return result corresponding to the intercepted data call request is extracted according to the request result variable.

[0036] Optionally, the utilizing the desensitizing annotation interface in the aspect programming interface to perform data desensitization on the returned result includes:

[0037] Extracting the desensitized object in the returned result according to the annotation parameters in the desensitized annotation interface;

[0038] Desensitizing the data of the desensitized object using the desensitization rules in the desensitization annotation interface;

[0039] The desensitized data result is returned to the data requester.

[0040] In order to solve the above problem, the present invention further provides an electronic device, the electronic device comprising:

[0041] at least one processor; and,

[0042] a memory communicatively connected to the at least one processor; wherein,

[0043] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the scalable interface data desensitization method described above.

[0044] In order to solve the above problems, the present invention also provides a computer-readable storage medium, in which at least one computer program is stored. The at least one computer program is executed by a processor in an electronic device to implement the above-mentioned scalable interface data desensitization method.

[0045] The embodiments of the present invention can generate appropriate desensitization rules in a targeted manner by identifying the types of sensitive data (such as name, phone number, email address, etc.), support extension, and customize desensitization types and desensitization rules; configure desensitization rules using predefined annotation attributes, so that desensitization processing can be made flexible and configurable; when applying the desensitization annotation interface, the fields or objects marked as sensitive in the returned results can be directly desensitized, and it can be used out of the box, and desensitization is performed for commonly used sensitive data, ensuring the consistency and effectiveness of data desensitization. Therefore, the scalable interface data desensitization method, device, and medium proposed by the present invention can solve the problem of low efficiency when performing data desensitization. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 A schematic diagram of a flow chart of an extensible interface data desensitization method provided by an embodiment of the present invention;

[0047] Figure 2 A schematic diagram of a process for configuring a desensitizing annotation interface provided by an embodiment of the present invention;

[0048] Figure 3 A schematic diagram of a process of intercepting a data call request provided by an embodiment of the present invention;

[0049] Figure 4 A schematic diagram of the structure of an electronic device for implementing the scalable interface data desensitization method provided in one embodiment of the present invention.

[0050] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0051] It should be understood that the specific embodiments described herein are only used to explain the present invention, and are not used to limit the present invention.

[0052] The embodiment of the present application provides an extensible interface data desensitization method. The execution subject of the extensible interface data desensitization method includes but is not limited to at least one of the electronic devices that can be configured to execute the method provided by the embodiment of the present application, such as a server, a terminal, etc. In other words, the extensible interface data desensitization method can be executed by software or hardware installed on a terminal device or a server device, and the software can be a blockchain platform. The server includes but is not limited to: a single server, a server cluster, a cloud server or a cloud server cluster, etc. The server can be an independent server, or it can be a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content distribution networks (Content Delivery Network, CDN), and basic cloud computing services such as big data and artificial intelligence platforms.

[0053] Reference Figure 1 FIG. 1 is a flow chart of an extensible interface data desensitization method provided by an embodiment of the present invention. In this embodiment, the extensible interface data desensitization method includes:

[0054] S1. Identify the desensitization type corresponding to the pre-acquired target sensitive data, and generate desensitization rules corresponding to the target sensitive data according to the desensitization type.

[0055] In an embodiment of the present invention, the pre-acquired target sensitive data refers to data with sensitive properties that are acquired in advance, including but not limited to personal identity information (such as name, address, ID number, telephone number), financial information (such as bank account, credit card number), and health information (such as medical records, health status). Therefore, the pre-acquired target sensitive data must be classified into types so as to more accurately desensitize the sensitive data and ensure the security of the data during transmission; the desensitization type refers to the type of data that needs to be desensitized corresponding to the target sensitive data, that is, the data type corresponding to the target sensitive data.

[0056] In the embodiment of the present invention, the identifying the desensitization type corresponding to the pre-acquired target sensitive data includes:

[0057] Extract data labels of pre-acquired target sensitive data;

[0058] Determine the field name of the pre-acquired target sensitive data according to the data label;

[0059] Determining the data type of the pre-acquired target sensitive data according to the field name;

[0060] The desensitization type of the pre-acquired target sensitive data is determined according to the data type.

[0061] In detail, the pre-acquired target sensitive data is classified and labeled to identify the type and meaning of the data, such as data labels such as ID card number, mobile phone number, and personal password, and the field name of the pre-acquired target sensitive data is determined based on the data labels. For example, if the data label is ID card number, the corresponding field name is ID card number; if the data label is mobile phone number, the corresponding field name is mobile phone number; if the data label is personal password, the corresponding field name is password.

[0062] Specifically, the data characteristics of the target sensitive data can be described according to the field name, and the data type of the target sensitive data is determined according to the field description of the field name. For example, if the field name is ID number, mobile phone number, or password, the corresponding data type is text data, which contains numbers and letters. The ID number is not just a combination of numbers, but also contains letters and possible special characters. The mobile phone number may contain special formats (such as international area codes, separators, etc.), and the data type is then determined to be the desensitized type of the pre-acquired target sensitive data.

[0063] Furthermore, in order to effectively protect the privacy of the original data, it is necessary to generate corresponding desensitization rules based on the desensitization type of the target sensitive data to ensure the compliance and security of the data during processing and sharing.

[0064] In the embodiment of the present invention, the desensitization rules refer to specific methods and steps for processing sensitive data to protect data privacy and security.

[0065] In the embodiment of the present invention, the generating of the desensitization rule corresponding to the target sensitive data according to the desensitization type includes:

[0066] Determining the character length of the target sensitive data according to the desensitization type;

[0067] Configure the mask position of the target sensitive data according to the character length;

[0068] Generate desensitization rules for the target sensitive data according to the mask position.

[0069] In detail, the type of sensitive data is determined based on the desensitization type, such as the data length of credit card number, name, address, etc. If the ID number is text data, the character length of the ID number is counted, and the middle part of the ID number is replaced or masked with randomly generated characters or numbers, such as replacing the middle 8 digits of the ID number with randomly generated characters or numbers, for example "1234********3456".

[0070] Specifically, different desensitizing positions of the target sensitive data can be configured according to different character lengths. For example, if the character length is 3, the middle bit is selected as the mask position; if the character length is 8, the middle four bits are selected as the mask position. The mask position of the target sensitive data can be customized according to the character length, and then the desensitizing rules of the target sensitive data are determined according to the mask position. If the character length of the target sensitive data is n bits, the middle n*2 (rounded down) bits are selected as the mask position, and random characters or numbers are configured in the mask position.

[0071] Furthermore, data desensitization can be implemented in a customizable and scalable manner through desensitization rules. Therefore, the desensitization rules need to be encapsulated as a data desensitization interface so that different desensitization rules and attributes can be configured.

[0072] S2. Configure a desensitizing annotation interface for the target sensitive data according to the desensitizing rules and predefined annotation attributes, and add the desensitizing annotation interface to the pre-acquired aspect programming interface.

[0073] In the embodiment of the present invention, the desensitizing annotation interface refers to partially or completely hiding, replacing or generalizing sensitive data by using specific annotations and related processing logic, thereby preventing unauthorized access and leakage of sensitive information.

[0074] In the embodiment of the present invention, refer to Figure 2 As shown, the desensitizing annotation interface for configuring the target sensitive data according to the desensitizing rule and the predefined annotation attribute includes:

[0075] S21, extracting the desensitized data path and desensitized data type in the predefined annotation attributes;

[0076] S22, determining a desensitization object according to the desensitized data path and the type of desensitized data;

[0077] S23, configuring the desensitization object and the desensitization rule into a desensitization annotation format;

[0078] S24. Encapsulate the desensitizing annotation format as a desensitizing annotation interface for the target sensitive data.

[0079] In detail, the rules that need to be masked are declared through annotations, and the annotation attributes include the masked data path attribute dataPath and the masked data type attribute dataType, where the default value of the masked data path attribute dataPath is $, that is, the object that needs to be masked, and the object selection format is: BeanPath, $----root node, *----all nodes, []---iterator identifier, such as selecting the current object: $, selecting the current array object: $[*], selecting the store attribute of the first array element: $[0].store, selecting the attribute store of the current object, and store is an array: $.store[*]; the default value of the masked data type attribute dataType is MaskingDataType.object, that is, MaskingDataType.object, MaskingDataType.json.

[0080] Specifically, the object that needs to be desensitized can be determined according to the desensitized data path attribute dataPath and the desensitized data type attribute dataType, and the desensitized annotation format can be configured according to the desensitized object and the desensitization rule, that is, the object selected based on dataPath, the attributes that need to be desensitized and the desensitization rules, and support the configuration of multiple object attributes and desensitization rules. The desensitizing annotation configuration format is {BeanPath1#Desensitization rule 1, BeanPath2#Desensitization rule 2,......}, and the desensitizing annotation configuration format is encapsulated as a desensitizing annotation interface, that is, the desensitizing annotation interface is the annotation parameter maskingRule in the annotation attribute, such as @DataMasking(dataPath="$",dataType=MaskingDataType.object,maskingRule="$.phone#internationalTelephone"), which means that for the object of the current type is object, the attribute phone of the selected object is desensitized using the internationalTelephone (international mobile phone number) rule.

[0081] For example, by using the @DataMasking annotation processor to process the data returned by the method according to the annotated rules, the methods that need to be desensitized can be easily marked in the code, and desensitization can be automatically performed according to predefined rules, which can effectively protect the security of sensitive information. @Retention(RetentionPolicy.RUNTIME), @Target({ElementType.METHOD})public@interface DataMasking{String dataPath()default"$";

[0082] MaskingDataType dataType()default MaskingDataType.object;

[0083] / / "abc#rule1,abd#rule2"String[]maskingRule();}, that is, dataPath is the data path, the default is $, dataType is the data type, the default is MaskingDataType.object, and maskingRule is an array used to specify the desensitization rules.

[0084] Furthermore, when integrating the masking annotation interface into aspect programming, you need to define an aspect that intercepts methods annotated with @DataMasking and applies the corresponding masking logic. Then, according to the entry point, the masking annotation interface is added to the pre-acquired aspect programming interface. That is, you need to ensure that component scanning is enabled in the Spring configuration file (such as applicationContext.xml) or in the Java configuration class annotated with @Configuration so that Spring can scan the DataMaskingAspect class.

[0085] Furthermore, in order to desensitize sensitive data during data transmission to ensure data security and privacy protection, it is necessary to intercept data call requests.

[0086] S3. When a data call request is received, the data call request is intercepted by using the aspect programming interface, and a request interface corresponding to the intercepted data call request is called in the aspect programming interface.

[0087] In an embodiment of the present invention, the data call request refers to a request initiated by the data requester to the data storage or service, the purpose of which is to obtain, update or delete specific data, such as a user login request, a product information query request, or an order creation request.

[0088] In the embodiment of the present invention, refer to Figure 3 As shown, the intercepting the data call request by using the aspect programming interface includes:

[0089] S31, performing parameter parsing on the data call request, and performing parameter verification on the parsed data call request;

[0090] S32: When the verified data call request meets the preset interception rule, the data call request is intercepted using the interception function in the aspect programming interface.

[0091] In detail, the aspect programming interface refers to the SDK implementation of the MethodInterceptor interface in spring aop, that is, intercepting and processing before and after the execution of the target method and when an exception is thrown. MethodInterceptor can be used to create a dynamic proxy to execute additional logic before or after the execution of the target method. The data call request will be parsed first, and the parameters of the HTTP request can be obtained through the HttpServletRequest object, and the parameters in the parsed data call request will be verified to ensure that the request parameters meet the preset interception rules. Only if they meet the interception rules will the data call request be intercepted, otherwise, the data call request will not be intercepted. The interception rules are that the request parameters include personal identity information (such as name, address, ID number, telephone number), financial information (such as bank account, credit card number), and health information (such as medical records, health status). If the verified data call request includes the parameters in the interception rules, the data call request will be intercepted through the interception function MethodInterceptor in the aspect programming interface.

[0092] Furthermore, the interceptor can capture various information of the request, including request parameters, header information, etc. Calling the request interface can ensure that the intercepted data flows correctly into the business logic link and maintain the consistency and integrity of the overall business logic. It is necessary to call the original data request interface after interception.

[0093] In the embodiment of the present invention, the request interface is used to call a data call request, and return a request result based on the data call request, so as to execute the data call request.

[0094] In the embodiment of the present invention, the request interface corresponding to the intercepted data call request in the aspect programming interface includes:

[0095] Using the request parameters in the intercepted data call request as original call parameters;

[0096] Calling the original target execution function in the aspect programming interface;

[0097] Passing the original call parameters to the original target execution function;

[0098] The original target execution function passed to the original call parameter is determined as the request interface corresponding to the intercepted data call request.

[0099] In detail, we first define an aspect technology, which uses the request parameters in the intercepted data call request as the original call parameters, and passes the original call parameters as request parameters, such as obtaining the method call parameters through Object[]getArguments(), and using Objectproceed() in the MethodInterceptor interface in the aspect programming interface to execute the intercepted request interface. Calling this interface is equivalent to allowing the original target execution function corresponding to the original call parameters to continue executing, thereby determining the original target execution function as the request interface corresponding to the intercepted data call request.

[0100] Furthermore, the obtained request interface can be used to return the return result corresponding to the data call request, and then the return result can be desensitized to ensure the security of the data during storage or transmission.

[0101] S4. Extract the return result corresponding to the intercepted data call request through the request interface, and use the desensitizing annotation interface in the aspect programming interface to desensitize the return result.

[0102] In the embodiment of the present invention, the return result refers to a response or feedback obtained from the request interface, and the return result may be a data object, a data set or a data stream.

[0103] In the embodiment of the present invention, the extracting the return result corresponding to the intercepted data call request through the request interface includes:

[0104] Passing the request parameters in the intercepted data call request to the request interface;

[0105] Execute the request interface after the request parameters are passed to obtain the request result variable;

[0106] The return result corresponding to the intercepted data call request is extracted according to the request result variable.

[0107] In detail, certain operations or events in the system are captured through some aspects or interceptors, the required data is extracted from them, and the constructed request parameters are passed to the target request interface. The request interface will perform the corresponding operations, process the passed parameters, and finally return a result, and store the returned result in a variable. That is, when the proceed() method is called, the intercepted target method will be executed and its result will be returned. The returned result will be stored in a variable, such as Object result = joinPoint.proceed(), so that the extracted data in the request result variable calls the return result corresponding to the request.

[0108] Exemplarily, the original request interface is executed through the MethodInterceptor interface, that is, public Objectinvoke(MethodInvocation invocation)throws Throwable, Object returnValue=invocation.proceed(), and the request return result corresponding to the data call request is obtained by executing the original request interface.

[0109] Furthermore, the returned results may contain the user's personally identifiable information (PII), such as name, address, telephone number, etc. If this information is not anonymized and is accessed or leaked without authorization, it may cause the risk of user privacy leakage. Therefore, the returned results must be anonymized for analysis.

[0110] In an embodiment of the present invention, the returned result is desensitized, that is, sensitive data is partially hidden or replaced to protect user privacy. For example, some commonly used desensitization rules are implemented by default in the SDK, such as ID card number desensitization, international mobile phone number desensitization, password desensitization, etc.; for other desensitization rules, the system can implement the apply method of the java.util.function.Function interface, customize the data conversion, and call the interface in the SDK to register the desensitization rules.

[0111] In the embodiment of the present invention, the method of performing data desensitization on the returned result by using the desensitization annotation interface in the aspect programming interface includes:

[0112] Extracting the desensitized object in the returned result according to the annotation parameters in the desensitized annotation interface;

[0113] Desensitizing the data of the desensitized object using the desensitization rules in the desensitization annotation interface;

[0114] The desensitized data result is returned to the data requester.

[0115] In detail, according to the annotation parameters in the desensitization annotation interface, identify the objects or fields that need to be desensitized from the returned results, use the desensitization rules defined in the desensitization annotation interface to perform data desensitization on the extracted desensitized objects, and return the desensitized results to the data requester, that is, the SDK implements the MethodInterceptor interface in spring aop to desensitize the method's return data. If the method has a data desensitization annotation, find the desensitized object according to the annotation parameters, call the specific desensitization rule interface to desensitize the data, and return the final data.

[0116] Specifically, in the MethodInterceptor interface, it is necessary to check whether the method is marked with the SensitiveData annotation. If there is no annotation, the return value will not be desensitized. If there is an annotation, the return value will be desensitized, that is, SensitiveData sensitiveDatainvocation.getMethod().getAnnotation(SensitiveData.class), to obtain the SensitiveData annotation on the currently called method. If there is no such annotation on the method, sensitiveData will be null. If the return value of the method is a string, call the DataMaskingUtil.maskSensitiveData method to desensitize the string and then return the desensitized string. For example, desensitize the email field of the email address, that is, user.setEmail(DataMaskingUtil.maskEmail(user.getEmail())), that is, the method returns a User object, and desensitizes specific fields of the User object (such as the email field). Desensitization policies and rules can be configured for more flexible management.

[0117] For example, assuming that the data returned by the request interface is String idCardNumber = "310115199001011234"; String phoneNumber = "+1234567890"; then the desensitized data is String desensitizedIdCard = desensitizeIdCard (idCardNumber); String desensitizedPhone=desensitizePhoneNumber(phoneNumber); then the desensitized ID card number data is 310115********1234, and the desensitized mobile phone number data is +123****890. The desensitization rule for the ID card number is to hide the middle part, so the desensitization rule for the ID card number is idCard.substring(0,6)+"********"+idCard.substring(14); the desensitization rule for the mobile phone number is to hide the middle part, that is, phoneNumber.substring(0,phoneNumber.length()-7)+"****"+phoneNumber.substring(phoneNumber.length()-3).

[0118] The embodiments of the present invention can generate appropriate desensitization rules in a targeted manner by identifying the types of sensitive data (such as name, phone number, email address, etc.), support extension, and customize desensitization types and desensitization rules; use pre-defined annotation attributes to configure desensitization rules, so that desensitization processing can be flexible and configurable; when applying the desensitization annotation interface, the fields or objects marked as sensitive in the returned results can be directly desensitized, which can be used out of the box, and desensitize commonly used sensitive data, ensuring the consistency and effectiveness of data desensitization. Therefore, the scalable interface data desensitization method, device and medium proposed by the present invention can solve the problem of low efficiency when performing data desensitization.

[0119] like Figure 4 , which is a schematic diagram of the structure of an electronic device for implementing an extensible interface data desensitization method provided by an embodiment of the present invention.

[0120] The electronic device may include a processor 10, a memory 11, a communication bus 12, and a communication interface 13, and may also include a computer program stored in the memory 11 and executable on the processor 10, such as an extensible interface data desensitization program.

[0121] In some embodiments, the processor 10 may be composed of an integrated circuit, for example, a single packaged integrated circuit, or a plurality of packaged integrated circuits with the same or different functions, including one or more central processing units (CPUs), microprocessors, digital processing chips, graphics processors, and combinations of various control chips. The processor 10 is the control core (ControlUnit) of the electronic device, and uses various interfaces and lines to connect the various components of the entire electronic device, and executes or executes programs or modules stored in the memory 11 (for example, executing an extensible interface data desensitization program, etc.), and calls the data stored in the memory 11 to execute various functions of the electronic device and process data.

[0122] The memory 11 includes at least one type of readable storage medium, and the readable storage medium includes a flash memory, a mobile hard disk, a multimedia card, a card-type memory (for example, an SD or DX memory, etc.), a magnetic memory, a disk, an optical disk, etc. The memory 11 may be an internal storage unit of an electronic device in some embodiments, such as a mobile hard disk of the electronic device. The memory 11 may also be an external storage device of an electronic device in other embodiments, such as a plug-in mobile hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device. Further, the memory 11 may also include both an internal storage unit of the electronic device and an external storage device. The memory 11 may not only be used to store application software and various types of data installed in the electronic device, such as the code of an expandable interface data desensitization program, etc., but may also be used to temporarily store data that has been output or is to be output.

[0123] The communication bus 12 may be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The bus is configured to realize connection and communication between the memory 11 and at least one processor 10, etc.

[0124] The communication interface 13 is used for communication between the above-mentioned electronic device and other devices, including a network interface and a user interface. Optionally, the network interface may include a wired interface and / or a wireless interface (such as a WI-FI interface, a Bluetooth interface, etc.), which is generally used to establish a communication connection between the electronic device and other electronic devices. The user interface may be a display (Display), an input unit (such as a keyboard (Keyboard)), and optionally, the user interface may also be a standard wired interface, a wireless interface. Optionally, in some embodiments, the display may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, and an OLED (Organic Light-Emitting Diode, organic light-emitting diode) touch device, etc. Among them, the display may also be appropriately referred to as a display screen or a display unit, which is used to display information processed in the electronic device and to display a visual user interface.

[0125] The figure only shows an electronic device with components. Those skilled in the art will understand that the structure shown in the figure does not constitute a limitation on the electronic device, and may include fewer or more components than shown in the figure, or combine certain components, or arrange the components differently.

[0126] For example, although not shown, the electronic device may also include a power source (such as a battery) for supplying power to each component. Preferably, the power source may be logically connected to the at least one processor 10 through a power management device, so that the power management device can realize functions such as charging management, discharging management, and power consumption management. The power source may also include one or more DC or AC power sources, recharging devices, power failure detection circuits, power converters or inverters, power status indicators, and other arbitrary components. The electronic device may also include a variety of sensors, Bluetooth modules, Wi-Fi modules, etc., which will not be repeated here.

[0127] It should be understood that the embodiment is for illustration only and the scope of the patent application is not limited to this structure.

[0128] The expandable interface data desensitization program stored in the memory 11 in the electronic device is a combination of multiple instructions, and when running in the processor 10, it can achieve:

[0129] Identify the desensitization type corresponding to the pre-acquired target sensitive data, and generate desensitization rules corresponding to the target sensitive data according to the desensitization type;

[0130] Configure a desensitizing annotation interface for the target sensitive data according to the desensitizing rule and predefined annotation attributes, and add the desensitizing annotation interface to a pre-acquired aspect programming interface;

[0131] When receiving a data call request, intercepting the data call request using the aspect programming interface, and calling a request interface corresponding to the intercepted data call request in the aspect programming interface;

[0132] The return result corresponding to the intercepted data call request is extracted through the request interface, and the return result is desensitized using the desensitizing annotation interface in the aspect programming interface.

[0133] Specifically, the specific implementation method of the processor 10 for the above instructions can refer to the description of the relevant steps in the corresponding embodiment of the accompanying drawings, which will not be repeated here.

[0134] Furthermore, if the module / unit integrated in the electronic device is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. The computer-readable storage medium can be volatile or non-volatile. For example, the computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a USB flash drive, a mobile hard disk, a magnetic disk, an optical disk, a computer memory, and a read-only memory (ROM).

[0135] The present invention further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor of an electronic device, the computer program can implement:

[0136] Identify the desensitization type corresponding to the pre-acquired target sensitive data, and generate desensitization rules corresponding to the target sensitive data according to the desensitization type;

[0137] Configure a desensitizing annotation interface for the target sensitive data according to the desensitizing rule and predefined annotation attributes, and add the desensitizing annotation interface to a pre-acquired aspect programming interface;

[0138] When receiving a data call request, intercepting the data call request using the aspect programming interface, and calling a request interface corresponding to the intercepted data call request in the aspect programming interface;

[0139] The return result corresponding to the intercepted data call request is extracted through the request interface, and the return result is desensitized using the desensitizing annotation interface in the aspect programming interface.

[0140] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, media and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative, for example, the division of the modules is only a logical function division, and there may be other division methods in actual implementation.

[0141] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0142] In addition, each functional module in each embodiment of the present invention may be integrated into one processing unit, each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional modules.

[0143] It is obvious to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and that the present invention can be implemented in other specific forms without departing from the spirit or essential characteristics of the present invention.

[0144] Therefore, no matter from which point of view, the embodiments should be regarded as illustrative and non-restrictive, and the scope of the present invention is not limited only according to the above description, and it is intended that all changes within the meaning and scope of equivalent elements within the scope of protection are included in the present invention.

[0145] The embodiments of the present application can acquire and process relevant data based on artificial intelligence technology. Among them, artificial intelligence (AI) is the theory, method, technology and application system that uses digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results.

[0146] In addition, it is clear that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. Multiple units or devices stated in the system can also be implemented by one unit or device through software or hardware. The words first, second, etc. are used to indicate names, and do not indicate any particular order.

[0147] If software tools or components not owned by the patent applicant appear in the embodiments of the present application, they are merely used to illustrate that a wide range of software tools or components can be selected during the actual implementation of the technical solution disclosed in the present application, and do not mean that the patent applicant actually used these example software tools or components; Finally, it should be noted that the above embodiments are only used to illustrate the technical solution of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, ordinary technicians in this field should understand that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention.

Claims

1. A scalable interface data desensitization method, characterized in that: The method comprises: Identify the desensitization type corresponding to the pre-acquired target sensitive data, and generate desensitization rules corresponding to the target sensitive data according to the desensitization type; Configure a desensitizing annotation interface for the target sensitive data according to the desensitizing rule and predefined annotation attributes, and add the desensitizing annotation interface to a pre-acquired aspect programming interface; When receiving a data call request, intercepting the data call request using the aspect programming interface, and calling a request interface corresponding to the intercepted data call request in the aspect programming interface; The return result corresponding to the intercepted data call request is extracted through the request interface, and the return result is desensitized using the desensitizing annotation interface in the aspect programming interface.

2. The scalable interface data desensitization method according to claim 1, characterized in that: The identifying of the desensitization type corresponding to the pre-acquired target sensitive data includes: Extract data labels of pre-acquired target sensitive data; Determine the field name of the pre-acquired target sensitive data according to the data label; Determining the data type of the pre-acquired target sensitive data according to the field name; The desensitization type of the pre-acquired target sensitive data is determined according to the data type.

3. The scalable interface data desensitization method according to claim 1, characterized in that: The generating, according to the desensitization type, a desensitization rule corresponding to the target sensitive data includes: Determining the character length of the target sensitive data according to the desensitization type; Configure the mask position of the target sensitive data according to the character length; Generate desensitization rules for the target sensitive data according to the mask position.

4. The scalable interface data desensitization method according to claim 1, characterized in that: The desensitizing annotation interface for configuring the target sensitive data according to the desensitizing rule and the predefined annotation attribute includes: Extract the desensitized data path and desensitized data type in the pre-defined annotation attributes; Determine a desensitized object according to the desensitized data path and the type of desensitized data; Configuring the desensitization object and the desensitization rule into a desensitization annotation format; The desensitizing annotation format is encapsulated as a desensitizing annotation interface for the target sensitive data.

5. The scalable interface data desensitization method according to claim 1, characterized in that: The intercepting the data call request by using the aspect programming interface includes: Parsing parameters of the data call request, and verifying parameters of the parsed data call request; When the verified data call request meets the preset interception rule, the data call request is intercepted using the interception function in the aspect programming interface.

6. The scalable interface data desensitization method according to claim 1, characterized in that: The request interface corresponding to the intercepted data call request called in the aspect programming interface includes: Using the request parameters in the intercepted data call request as original call parameters; Calling the original target execution function in the aspect programming interface; Passing the original call parameters to the original target execution function; The original target execution function passed to the original call parameter is determined as the request interface corresponding to the intercepted data call request.

7. The scalable interface data desensitization method according to claim 1, characterized in that: The return result corresponding to the intercepted data call request extracted through the request interface includes: Passing the request parameters in the intercepted data call request to the request interface; Execute the request interface after the request parameters are passed to obtain the request result variable; The return result corresponding to the intercepted data call request is extracted according to the request result variable.

8. The scalable interface data desensitization method according to claim 1, characterized in that: The method of performing data desensitization on the returned result by using the desensitization annotation interface in the aspect programming interface includes: Extracting the desensitized object in the returned result according to the annotation parameters in the desensitized annotation interface; Desensitizing the data of the desensitized object using the desensitization rules in the desensitization annotation interface; The desensitized data result is returned to the data requester.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and, a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the scalable interface data desensitization method as described in any one of claims 1 to 8.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the scalable interface data desensitization method as described in any one of claims 1 to 8 is implemented.

Images