Sensitive field detection method and device for interface access parameters, equipment and storage medium

Abstract

The invention provides a sensitive field detection method and device for interface access parameters, equipment and a storage medium, and the method comprises the steps: converting a to-be-detected sensitive field into a target field set based on a field naming rule of each to-be-detected micro-service, thereby obtaining a sensitive field which accords with the field naming habit of the to-be-detected micro-service, and obtaining a sensitive field named by the to-be-detected micro-service; based on the target field set conforming to the field naming habit of the to-be-detected micro-service, different micro-services are adapted to correspond to different business scenes, and the compatibility of the sensitive information identification method of the interface input and output parameters is improved. And then obtaining access parameter fields of all interfaces in the to-be-detected micro-service from interface registration information corresponding to the to-be-detected micro-service, and performing sensitive field detection on the access parameter fields of all the interfaces based on the target field name. Therefore, automatic acquisition of the interface in-out parameters and automatic detection of the sensitive fields of the interface in-out parameters are realized, and the detection efficiency and accuracy of the sensitive fields of the interface in-out parameters are improved.

Description

Technical Field

[0001] The present invention relates to the field of data processing, and in particular to a method, device, computer equipment and computer-readable storage medium for detecting sensitive fields of interface input and output parameters. Background Art

[0002] With the rapid development of the Internet and the improvement of cybersecurity laws, it is particularly important to improve the security of user privacy data. Once the privacy data is leaked, it is easy to cause immeasurable consequences. Therefore, encrypting user privacy data is also a task that developers must complete to ensure the security of system data.

[0003] When developing a system, it is essential to train program developers on data security awareness, which can avoid some data leakage problems to a certain extent, but this cannot be a means of protecting the system from data leakage. In the process of system function development, it is particularly important to check the data returned by the back-end interface, because whether it is data interaction with the front-end or docking with third-party services, it may cause important data leakage. It is not completely reliable to rely on developers to identify all data leakage risks during interface development, because this not only requires developers to have certain data security experience accumulation, but also needs to consider different business scenarios.

[0004] Moreover, in the process of system service development, the call interactions between the front-end and back-end and the call interactions between the back-end microservices all involve data information exchange, which may cause data information leakage. Therefore, it is necessary to further effectively identify sensitive information for interface input and output parameters, so as to desensitize user privacy data according to the development specifications of the corresponding system. However, different microservices correspond to different business scenarios, so the identification methods of sensitive fields of different microservices are different, which requires customized development of different identification schemes. As a result, the current sensitive information identification method of interface input and output parameters has low compatibility and reduces the identification efficiency.

[0005] Therefore, how to improve the compatibility and efficiency of sensitive information identification methods for interface input and output parameters is a technical problem that needs to be solved urgently. Summary of the invention

[0006] The main purpose of the present invention is to provide a sensitive field detection method, device, equipment and computer-readable storage medium for interface input and output parameters, aiming to improve the compatibility and recognition efficiency of the sensitive information identification method of interface input and output parameters.

[0007] To achieve the above object, the present invention provides a method for detecting sensitive fields of interface input and output parameters, and the method for detecting sensitive fields of interface input and output parameters comprises the following steps:

[0008] Upon receiving a sensitive field detection instruction corresponding to the microservice to be detected, obtaining a sensitive data set to be detected and a configuration file corresponding to the microservice to be detected;

[0009] Determine a field naming rule corresponding to the microservice to be detected based on the configuration file, and determine a target field set corresponding to the sensitive data set to be detected based on the field naming rule;

[0010] Based on a preset framework mapping processor, obtain the interface registration information corresponding to the microservice to be detected, and based on the interface registration information, obtain the input and output parameter fields of all interfaces in the microservice to be detected;

[0011] Based on the target field set, sensitive field detection is performed on the input and output parameter fields corresponding to all the interfaces, so as to perform sensitive field detection on the input and output parameters of all the interfaces in the microservice to be detected.

[0012] In addition, to achieve the above-mentioned purpose, the present invention further provides a sensitive field detection device for interface input and output parameters, and the sensitive field detection device for interface input and output parameters comprises:

[0013] A detection information acquisition module is used to obtain a set of sensitive data to be detected and a configuration file corresponding to the microservice to be detected when receiving a sensitive field detection instruction corresponding to the microservice to be detected;

[0014] A sensitive field conversion module, used to determine the field naming rule corresponding to the microservice to be detected based on the configuration file, and determine the target field set corresponding to the sensitive data set to be detected based on the field naming rule;

[0015] An interface field acquisition module is used to acquire the interface registration information corresponding to the microservice to be detected based on a preset framework mapping processor, and acquire the input and output parameter fields of all interfaces in the microservice to be detected based on the interface registration information;

[0016] The sensitive field detection module is used to perform sensitive field detection on the input and output parameter fields corresponding to all the interfaces based on the target field set, so as to perform sensitive field detection on the input and output parameters of all the interfaces in the microservice to be detected.

[0017] In addition, to achieve the above-mentioned purpose, the present invention also provides a computer device, which includes a processor, a memory, and a sensitive field detection program for interface input and output parameters stored in the memory and executable by the processor, wherein when the sensitive field detection program for interface input and output parameters is executed by the processor, the steps of the sensitive field detection method for interface input and output parameters as described above are implemented.

[0018] In addition, to achieve the above-mentioned purpose, the present invention also provides a computer-readable storage medium, on which a sensitive field detection program for interface input and output parameters is stored. When the sensitive field detection program for interface input and output parameters is executed by a processor, the steps of the sensitive field detection method for interface input and output parameters as described above are implemented.

[0019] The present application provides a method for detecting sensitive fields of interface input and output parameters. When receiving a sensitive field detection instruction corresponding to a microservice to be detected, the method obtains a sensitive data set to be detected and a configuration file corresponding to the microservice to be detected; determines the field naming rule corresponding to the microservice to be detected based on the configuration file, and determines the target field set corresponding to the sensitive data set to be detected based on the field naming rule; obtains the interface registration information corresponding to the microservice to be detected based on a preset framework mapping processor, and obtains the input and output parameter fields of all interfaces in the microservice to be detected based on the interface registration information; performs sensitive field detection on the input and output parameter fields corresponding to all interfaces based on the target field set, so as to perform sensitive field detection on the input and output parameters of all interfaces in the microservice to be detected. Through the above-mentioned method, the present application converts the sensitive fields to be detected into a target field set based on the field naming rules of each microservice to be detected, thereby obtaining sensitive fields that conform to the field naming conventions of the microservice to be detected, so as to adapt to different business scenarios corresponding to different microservices based on the target field set that conforms to the field naming conventions of the microservice to be detected, thereby improving the compatibility of the sensitive information identification method of interface input and output parameters. Then, the input and output parameter fields of all interfaces in the microservice to be detected are obtained from the interface registration information corresponding to the microservice to be detected, and sensitive field detection is performed on the input and output parameter fields of all interfaces based on the target field name. This realizes the automatic acquisition of interface input and output parameters and the automatic detection of sensitive fields of interface input and output parameters, thereby improving the efficiency and accuracy of sensitive field detection of interface input and output parameters. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 It is a flowchart of the first embodiment of the method for detecting sensitive fields of interface input and output parameters of the present invention;

[0021] Figure 2 A schematic flow chart of a second embodiment of a method for detecting sensitive fields of interface input and output parameters of the present invention;

[0022] Figure 3 A schematic flow chart of a third embodiment of a method for detecting sensitive fields of interface input and output parameters of the present invention;

[0023] Figure 4 A schematic diagram of a sensitive field detection device for interface input and output parameters of the present invention;

[0024] Figure 5The figure is a schematic diagram of the hardware structure of a computer device involved in an embodiment of the present invention.

[0025] The realization of the purpose, functional features and advantages of the present invention will be further explained in conjunction with embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0026] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0027] The flowcharts shown in the accompanying drawings are only examples and do not necessarily include all the contents and operations / steps, nor must they be executed in the order described. For example, some operations / steps may also be decomposed, combined or partially merged, so the actual execution order may change according to actual conditions.

[0028] It should be understood that the terms used in this application specification are only for the purpose of describing specific embodiments and are not intended to limit the application. As used in this application specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0029] It should be further understood that the term “and / or” used in the specification and appended claims refers to any combination and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0030] The sensitive field detection method of the interface input and output parameters involved in the embodiment of the present invention is mainly applied to computer equipment, which can be a PC, a portable computer, a mobile terminal, or other equipment with display and processing functions.

[0031] In conjunction with the accompanying drawings, some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0032] Reference Figure 1 , Figure 1 The figure is a flow chart of the first embodiment of the method for detecting sensitive fields of interface input and output parameters of the present invention.

[0033] like Figure 1 As shown, an embodiment of the present invention provides a method for detecting sensitive fields of interface input and output parameters, and the method for detecting sensitive fields of interface input and output parameters includes steps S10 to S40.

[0034] Step S10: upon receiving a sensitive field detection instruction corresponding to the microservice to be detected, obtaining a sensitive data set to be detected and a configuration file corresponding to the microservice to be detected;

[0035] In today's era of rapid development of the Internet and increasingly improved cybersecurity laws, the security of user privacy data is particularly important. Once leaked, it will cause immeasurable consequences. Therefore, encrypting user privacy data is now a task that developers must complete in order to ensure the security of system data.

[0036] When developing a system, it is essential to train program developers on data security awareness, which can avoid some data leakage problems to a certain extent, but this cannot be a means of ensuring that the system avoids data leakage. In the process of system function development, it is particularly important to check the data returned by the back-end interface, because whether it is data interaction with the front-end or docking with third-party services, it is possible to cause the leakage of important data. It is not completely reliable to rely on developers to identify all data leakage risks during interface development, because this not only requires developers to have certain data security experience accumulation, but also needs to consider various business scenarios. Therefore, in order to solve the above problems, it is necessary to provide a highly compatible and efficient interface input and output parameter sensitive field detection solution to provide the system with more reliable data security protection.

[0037] Some technical solutions currently available on the market for scanning sensitive fields of interface output parameters are prone to exceptions when scanning sensitive fields. For example, sensitive fields are difficult to scan out due to some special field naming; or different technical teams choose different desensitization technologies for processing sensitive fields of interface output parameters, which makes it difficult to identify whether certain fields have been desensitized. In order to solve the above problems, this embodiment provides a solution that can efficiently scan sensitive information of interfaces based on personalized business needs.

[0038] After analysis, it was found that in the process of system service development, the call interaction between the front-end and back-end and the call interaction between back-end microservices all involve data information exchange, which may cause data information leakage during the microservice call process. Therefore, it is necessary to effectively identify sensitive information, desensitize user privacy data according to the current system development specifications, and specially mark sensitive information fields returned by interface information, so as to achieve processing for different business scenarios, avoid leakage of user information, and ensure the security of system data. In the actual development process, the following problems exist:

[0039] 1. The sensitive fields that need to be desensitized in historical interfaces are difficult to identify and process;

[0040] 2. Different development teams have inconsistent naming conventions and habits for interface input and output parameter attribute fields, resulting in omissions in sensitive field identification;

[0041] 3. There are many levels of interface parameter entities, which makes sensitive fields easy to be overlooked.

[0042] In this embodiment, customized modifications are made to the naming conventions and habits corresponding to different development teams (i.e., different microservices), and some specified fields (i.e., sensitive fields declared by microservices) are ignored for scanning. When a microservice is in production, it can configure the sensitive fields that may appear (including the attributes, names, or string sets of sensitive fields) and the fields that need to be ignored (such as ignoring the field names or the string sets contained) in the backend service code library that needs to be scanned, and further export the sensitive field information identified in the interface input and output parameter fields (the exported sensitive field information includes the basic information of the interface to which the sensitive field belongs, the omitted sensitive field names, and the specific hierarchical entity information referenced by the sensitive field, etc.).

[0043] Specifically, before the microservice goes online, according to the team's development specifications or business requirements, a sensitive field detection instruction can be generated based on the sensitive fields that may appear in the input and output parameter fields of the interface (such as the string set contained in the sensitive field name). Then, based on the sensitive data set to be detected in the sensitive field detection instruction, the microservice to be detected that publishes the interface on the backend is scanned.

[0044] Step S20: determining a field naming rule corresponding to the microservice to be detected based on the configuration file, and determining a target field set corresponding to the sensitive data set to be detected based on the field naming rule;

[0045] In this embodiment, if developers are relied upon to identify sensitive fields when developing new interfaces, omissions are inevitable, and once omissions occur, they are difficult to identify, which can easily lead to the leakage of user privacy data after the service is produced. Therefore, before the microservices are launched, the field naming rules corresponding to the microservices to be detected (i.e., the custom field naming rules corresponding to each microservice) can be determined according to the configuration files of each microservice.

[0046] The target field set includes a target field set and a target string set. Based on the field naming rules, the sensitive fields to be detected are converted to obtain the target field set corresponding to the sensitive data set to be detected. Therefore, based on the converted target field set (i.e., the sensitive fields to be detected), the interface input and output parameter fields corresponding to the microservice can be scanned to reduce the risk of user privacy data leakage.

[0047] Customizing the scanning of sensitive fields according to the naming conventions and habits of interface input and output parameter attribute fields of different development teams can improve the accuracy of sensitive field scanning results. It can also conduct a comprehensive and targeted investigation of omissions caused by negligence, thereby minimizing data leakage problems.

[0048] Step S30: Based on a preset framework mapping processor, obtain the interface registration information corresponding to the microservice to be detected, and based on the interface registration information, obtain the input and output parameter fields of all interfaces in the microservice to be detected;

[0049] In this embodiment, the characteristics of the SpringMVC framework mapping processor are used to obtain the interface registration information of all exposed interfaces in the microservice to be detected in the container published by the microservice to be detected, wherein the interface registration information includes the input and output parameter information of the interface. Therefore, based on the interface registration information, the input and output parameter fields of all interfaces in the microservice to be detected can be obtained.

[0050] Step S40: Based on the target field set, sensitive field detection is performed on the input and output parameter fields corresponding to all the interfaces, so as to perform sensitive field detection on the input and output parameters of all the interfaces in the microservice to be detected.

[0051] In this embodiment, the input and output parameter fields corresponding to all the interfaces are matched with each field in the target field set. If there are fields in the input and output parameter fields corresponding to all the interfaces that match the target field set, it is determined that there are sensitive fields in the input and output parameter fields corresponding to all the interfaces.

[0052] Specifically, the input and output parameter fields corresponding to all the interfaces include output parameter fields and input parameter fields. The output parameter fields are fields output by the microservice to be detected, and the input parameter fields are fields received by the microservice to be detected.

[0053] Obtain an output parameter field or an input parameter field in sequence as the current field, and determine whether the current field is a basic type or a nested object based on the field attributes of the current field. If it is an object, perform a recursive scan to scan all the attribute fields of the nested object, that is, the field corresponding to the nested object needs to further obtain the lower-level field nested by the current field or the upper-level field nested by the current field, and scan the upper-level field and the lower-level field to obtain the detection result of the current field.

[0054] Repeat the above steps until all fields in all the interfaces are identified, and sensitive field detection is completed for the input and output parameters of all interfaces in the microservice to be detected.

[0055] The present embodiment provides a method for detecting sensitive fields of interface input and output parameters. When receiving a sensitive field detection instruction corresponding to a microservice to be detected, the method obtains a sensitive data set to be detected and a configuration file corresponding to the microservice to be detected; determines the field naming rule corresponding to the microservice to be detected based on the configuration file, and determines the target field set corresponding to the sensitive data set to be detected based on the field naming rule; obtains the interface registration information corresponding to the microservice to be detected based on a preset framework mapping processor, and obtains the input and output parameter fields of all interfaces in the microservice to be detected based on the interface registration information; based on the target field set, performs sensitive field detection on the input and output parameter fields corresponding to all interfaces, so as to perform sensitive field detection on the input and output parameters of all interfaces in the microservice to be detected. Through the above manner, the present application converts the sensitive fields to be detected into a target field set based on the field naming rules of each microservice to be detected, thereby obtaining sensitive fields that conform to the field naming conventions of the microservice to be detected, so as to adapt to different business scenarios corresponding to different microservices based on the target field set that conforms to the field naming conventions of the microservice to be detected, thereby improving the compatibility of the sensitive information identification method of interface input and output parameters. Then, the input and output parameter fields of all interfaces in the microservice to be detected are obtained from the interface registration information corresponding to the microservice to be detected, and sensitive field detection is performed on the input and output parameter fields of all interfaces based on the target field name. This realizes the automatic acquisition of interface input and output parameters and the automatic detection of sensitive fields of interface input and output parameters, thereby improving the efficiency and accuracy of sensitive field detection of interface input and output parameters.

[0056] Reference Figure 2 , Figure 2 A flowchart of the second embodiment of the sensitive field detection method for interface input and output parameters provided in this application.

[0057] Based on the above Figure 1 In the embodiment shown, in this embodiment, after step S40, the following steps are further included:

[0058] Step S50: based on the sensitive field detection result, determine the sensitive input and output parameter fields in the input and output parameter fields corresponding to all the interfaces, and obtain the position of the sensitive input and output parameter fields in the code corresponding to the microservice to be detected as parameter position information;

[0059] Step S60, the sensitive input and output parameter fields and their corresponding parameter position information are associated and stored, and a sensitive input and output parameter record table corresponding to the microservice to be detected is generated, so that the user can process the sensitive input and output parameters in the microservice to be detected based on the sensitive input and output parameter record table.

[0060] In this embodiment, for interfaces that have already existed in the past, the existing solutions cannot meet the requirements for checking the input and output parameter field information of existing interface resources. Manual checking is inefficient and the workload is huge.

[0061] In order to solve the above problem, after determining the sensitive fields in the input and output parameter fields of all the interfaces, the positions of the sensitive input and output parameter fields in the corresponding codes of the microservice to be detected are further obtained, and based on the sensitive input and output parameter fields and their corresponding parameter position information, a sensitive input and output parameter record table corresponding to the microservice to be detected is generated.

[0062] The data in the sensitive input and output parameter record table is the sensitive field information omitted by the interface. The sensitive fields at which specific level in the interface input and output parameters are omitted are marked, and then the marked fields are processed according to different business scenarios.

[0063] The specific location of sensitive fields in microservices is recorded in the sensitive input and output record table. This can not only quickly and efficiently export sensitive field problems in interface input and output parameters, but also clearly reflect at which reference level the object attributes have sensitive field problems, making it easier for developers to process corresponding data information.

[0064] Further, after determining the sensitive input and output parameter fields in the input and output parameter fields corresponding to all the interfaces based on the sensitive field detection result, the method further includes:

[0065] In the code corresponding to the microservice to be detected, the relevant code corresponding to the sensitive input and output parameter field is determined, and the sensitive input and output parameter field and the relevant code are associated and stored in the sensitive input and output parameter record table.

[0066] In this embodiment, in order to further facilitate developers to process sensitive input and output parameters of microservices, the relevant code corresponding to the sensitive input and output parameter field is determined in the corresponding code of the microservice to be detected. The sensitive input and output parameter field and the relevant code are associated and stored in the sensitive input and output parameter record table, without the need for developers to search for codes. After the developer modifies the code, the modified code is replaced with the original code based on the corresponding parameter position information, thereby improving the processing efficiency of sensitive input and output parameter fields.

[0067] Furthermore, after associating and storing the sensitive input and output parameter fields and the corresponding parameter location information to generate the sensitive input and output parameter record table corresponding to the microservice to be detected, the method further includes:

[0068] Based on the configuration file, a set of ignored fields corresponding to the microservice to be detected is determined, and based on the set of ignored fields, sensitive fields in the sensitive input and output parameter record table are filtered and removed.

[0069] In this embodiment, the interface input and output parameter fields containing sensitive characters may be configured in advance so that the fields will not expose sensitive information, thereby filtering the above-mentioned configuration fields from the identified sensitive fields.

[0070] Specifically, based on the above-mentioned configuration fields, the sensitive fields in the sensitive data set to be detected are filtered in advance, and then the interface input and output parameter fields are scanned based on the filtered sensitive data set to be detected, thereby customizing the corresponding ignore according to different business needs to skip the scanning of the ignored fields.

[0071] Further, after determining the sensitive input and output parameter fields in the input and output parameter fields corresponding to all the interfaces based on the sensitive field detection result, the method further includes:

[0072] Based on the marked sensitive field set corresponding to the microservice to be detected, the marked sensitive fields are determined in the sensitive input and output parameter fields, and the marked sensitive fields in the sensitive input and output parameter fields are filtered and removed.

[0073] In this embodiment, developers can record processed sensitive detection fields by marking sensitive field sets. Subsequent personnel can further perform sensitive field detection on the microservice to be detected based on other sensitive fields.

[0074] Determine the marked sensitive fields in the sensitive input and output parameter fields, and filter and remove the marked sensitive fields in the sensitive input and output parameter fields.

[0075] It is also possible to further determine whether there are marked sensitive fields in each sensitive field in the target field set. Marked sensitive fields are marked to indicate that sensitive fields have been processed and do not need to be queried again. Therefore, marked sensitive fields are filtered out in the target field set. This reduces the number of fields in the target field set, reduces the time for sensitive field detection, and improves the efficiency of sensitive field detection.

[0076] Among them, sensitive fields are generally marked by annotations, which can be annotated according to the annotations customized by the development team, and then it is determined whether the sensitive field needs to be desensitized according to different scenarios.

[0077] Repeat the above steps until all fields in all the interfaces are identified, and sensitive field detection is completed for the input and output parameters of all interfaces in the microservice to be detected.

[0078] See also Figure 3 , Figure 3 A flowchart of the third embodiment of the sensitive field detection method for interface input and output parameters provided in this application.

[0079] Based on the above Figure 1In the embodiment shown, in this embodiment, the step S40 specifically includes:

[0080] Step S41, obtaining any field in the input and output parameter fields corresponding to all the interfaces as the current field, and determining whether the current field is a nested object;

[0081] Step S42, when the current field is the nested object, recursively scan the nested object corresponding to the current field to obtain the upper-level field and / or lower-level field corresponding to the current field;

[0082] Step S43, performing sensitive field detection on the current field, the upper field and the lower field, and updating the current field based on the next attribute field in the input and output parameter fields corresponding to all the interfaces, until the detection of all fields in the input and output parameter fields corresponding to all the interfaces is completed.

[0083] Furthermore, after step S41, the following steps are further included:

[0084] When the current field is a basic type field, determining whether the current field matches the target field set;

[0085] If the current field matches the target field set, the current field is determined to be a sensitive field;

[0086] If the current field does not match the target field set, the current field is determined to be a normal field.

[0087] In this embodiment, in order to further improve the accuracy of the sensitive field detection results of the interface input and output parameters, the field attributes of the current field are judged. If the field attribute of the current field is a nested object, the nested object of the current field is recursively scanned, and all the attribute fields of the nested object are scanned once, that is, the field corresponding to the nested object needs to further obtain the lower-level field nested by the current field or the upper-level field nested, and scan the upper-level field and the lower-level field to obtain the detection result of the current field.

[0088] When the current field is a basic type field, determine whether the current field matches the target field set; if the current field matches the target field set, determine that the current field is a sensitive field; if the current field does not match the target field set, determine that the current field is a normal field.

[0089] Through the above methods, this embodiment can prevent the leakage of user privacy data due to microservice interface calls, improve the security of system data, and quickly troubleshoot sensitive field problems of microservice interface input and output parameters; and perform customized scanning and modification of sensitive fields according to the naming rules of different systems, thereby improving the detection efficiency and accuracy of sensitive fields.

[0090] See also Figure 4 , Figure 4 It is a functional module diagram of a sensitive field detection device for interface input and output parameters provided in an embodiment of the present application.

[0091] like Figure 4 As shown, the sensitive field detection device 400 of the interface input and output parameters includes:

[0092] The detection information acquisition module 410 is used to obtain the sensitive data set to be detected and the configuration file corresponding to the microservice to be detected when receiving the sensitive field detection instruction corresponding to the microservice to be detected;

[0093] The sensitive field conversion module 420 is used to determine the field naming rule corresponding to the microservice to be detected based on the configuration file, and determine the target field set corresponding to the sensitive data set to be detected based on the field naming rule;

[0094] The interface field acquisition module 430 is used to acquire the interface registration information corresponding to the microservice to be detected based on a preset framework mapping processor, and acquire the input and output parameter fields of all interfaces in the microservice to be detected based on the interface registration information;

[0095] The sensitive field detection module 440 is used to perform sensitive field detection on the input and output parameter fields corresponding to all the interfaces based on the target field set, so as to perform sensitive field detection on the input and output parameters of all the interfaces in the microservice to be detected.

[0096] Furthermore, the sensitive field detection device 400 of the interface input and output parameters further includes:

[0097] A parameter position acquisition module, used to determine the sensitive input and output parameter fields in the input and output parameter fields corresponding to all the interfaces based on the sensitive field detection result, and obtain the position of the sensitive input and output parameter fields in the code corresponding to the microservice to be detected as parameter position information;

[0098] The record file generation module is used to associate and store the sensitive input and output parameter fields and their corresponding parameter position information, and generate a sensitive input and output parameter record table corresponding to the microservice to be detected, so that the user can process the sensitive input and output parameters in the microservice to be detected based on the sensitive input and output parameter record table.

[0099] Furthermore, the sensitive field detection device 400 of the interface input and output parameters further includes:

[0100] The sensitive field filtering module is used to determine the ignored field set corresponding to the microservice to be detected based on the configuration file, and filter and remove the sensitive fields in the sensitive input and output parameter record table based on the ignored field set.

[0101] Furthermore, the sensitive field detection device 400 of the interface input and output parameters further includes:

[0102] The sensitive information acquisition module is used to determine the relevant code corresponding to the sensitive input and output parameter field in the code corresponding to the microservice to be detected, and associate the sensitive input and output parameter field and the relevant code and store them in the sensitive input and output parameter record table.

[0103] Furthermore, the sensitive field detection device 400 of the interface input and output parameters further includes:

[0104] A field marking processing module is used to determine the marked sensitive fields in the sensitive input and output parameter fields based on the marked sensitive field set corresponding to the microservice to be detected, and filter and remove the marked sensitive fields in the sensitive input and output parameter fields.

[0105] Furthermore, the sensitive field detection module 440 includes:

[0106] A field attribute judgment unit, used to obtain any field in the input and output parameter fields corresponding to all the interfaces as the current field, and judge whether the current field is a nested object;

[0107] A nested field scanning unit, used for, when the current field is the nested object, recursively scanning the nested object corresponding to the current field to obtain the upper-level field and / or lower-level field corresponding to the current field;

[0108] The nested field detection unit is used to perform sensitive field detection on the current field, the upper field and the lower field, and update the current field based on the next attribute field in the input and output parameter fields corresponding to all the interfaces until the detection of all fields in the input and output parameter fields corresponding to all the interfaces is completed.

[0109] Furthermore, the sensitive field detection module 440 includes:

[0110] A sensitive field matching unit, used for determining whether the current field matches the target field set when the current field is a basic type field;

[0111] a sensitive field determination unit, configured to determine that the current field is a sensitive field if the current field matches the target field set;

[0112] The normal field determination unit is configured to determine that the current field is a normal field if the current field does not match the target field set.

[0113] It should be noted that those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the above-described device and each module can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0114] The above-mentioned device can be implemented in the form of a computer program. Figure 5 Runs on the computer device shown.

[0115] See also Figure 5 , Figure 5 1 is a schematic block diagram of a computer device provided in an embodiment of the present application. The computer device may be a server.

[0116] See also Figure 5 The computer device includes a processor, a memory and a network interface connected through a system bus, wherein the memory may include a non-volatile storage medium and an internal memory.

[0117] The non-volatile storage medium can store an operating system and a computer program. The computer program includes program instructions, and when the program instructions are executed, the processor can execute any sensitive field detection method of interface input and output parameters.

[0118] The processor is used to provide computing and control capabilities and support the operation of the entire computer equipment.

[0119] The internal memory provides an environment for the operation of the computer program in the non-volatile storage medium. When the computer program is executed by the processor, the processor can execute any sensitive field detection method of the interface input and output parameters.

[0120] The network interface is used for network communication, such as sending assigned tasks, etc. Those skilled in the art will appreciate that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0121] It should be understood that the processor may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among them, the general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0122] In one embodiment, the processor is used to run a computer program stored in the memory to implement the following steps:

[0123] Upon receiving a sensitive field detection instruction corresponding to the microservice to be detected, obtaining a sensitive data set to be detected and a configuration file corresponding to the microservice to be detected;

[0124] Determine a field naming rule corresponding to the microservice to be detected based on the configuration file, and determine a target field set corresponding to the sensitive data set to be detected based on the field naming rule;

[0125] Based on the preset framework mapping processor, obtain the interface registration information corresponding to the microservice to be detected, and based on the interface registration information, obtain the input and output parameter fields of all interfaces in the microservice to be detected;

[0126] Based on the target field set, sensitive field detection is performed on the input and output parameter fields corresponding to all the interfaces, so as to perform sensitive field detection on the input and output parameters of all the interfaces in the microservice to be detected.

[0127] In one embodiment, in the aspect of performing sensitive field detection on all input and output parameter identifiers based on the target field set to complete the input and output parameter sensitive field detection of each interface in the microservice to be detected, the processor is used to run a computer program stored in a memory to implement the following steps:

[0128] Based on the sensitive field detection result, determine the sensitive input and output parameter fields in the input and output parameter fields corresponding to all the interfaces, and obtain the position of the sensitive input and output parameter fields in the code corresponding to the microservice to be detected as parameter position information;

[0129] The sensitive input and output parameter fields and their corresponding parameter position information are associated and stored, and a sensitive input and output parameter record table corresponding to the microservice to be detected is generated, so that the user can process the sensitive input and output parameters in the microservice to be detected based on the sensitive input and output parameter record table.

[0130] In one embodiment, in the aspect of associating and storing the sensitive input and output parameter fields and the corresponding parameter location information to generate the sensitive input and output parameter record table corresponding to the microservice to be detected, the processor is used to run a computer program stored in the memory to implement the following steps:

[0131] Based on the configuration file, a set of ignored fields corresponding to the microservice to be detected is determined, and based on the set of ignored fields, sensitive fields in the sensitive input and output parameter record table are filtered and removed.

[0132] In one embodiment, in determining the sensitive input and output parameter fields from the input and output parameter fields corresponding to all the interfaces based on the sensitive field detection result, the processor is used to run a computer program stored in the memory to implement the following steps:

[0133] In the code corresponding to the microservice to be detected, the relevant code corresponding to the sensitive input and output parameter field is determined, and the sensitive input and output parameter field and the relevant code are associated and stored in the sensitive input and output parameter record table.

[0134] In one embodiment, in determining the sensitive input and output parameter fields from the input and output parameter fields corresponding to all the interfaces based on the sensitive field detection result, the processor is used to run a computer program stored in the memory to implement the following steps:

[0135] Based on the marked sensitive field set corresponding to the microservice to be detected, the marked sensitive fields are determined in the sensitive input and output parameter fields, and the marked sensitive fields in the sensitive input and output parameter fields are filtered and removed.

[0136] In one embodiment, in the aspect of performing sensitive field detection on the input and output parameter fields corresponding to all the interfaces based on the target field set, the processor is used to run a computer program stored in a memory to implement the following steps:

[0137] Obtain any field in the input and output parameter fields corresponding to all the interfaces as the current field, and determine whether the current field is a nested object;

[0138] When the current field is the nested object, recursively scan the nested object corresponding to the current field to obtain the upper-level field and / or lower-level field corresponding to the current field;

[0139] Sensitive field detection is performed on the current field, the upper field and the lower field, and the current field is updated based on the next attribute field in the input and output parameter fields corresponding to all the interfaces until the detection of all fields in the input and output parameter fields corresponding to all the interfaces is completed.

[0140] In one embodiment, in the aspect of obtaining any field among the input and output parameter fields corresponding to all the interfaces as the current field and determining whether the current field is a nested object, the processor is used to run a computer program stored in a memory to implement the following steps:

[0141] When the current field is a basic type field, determining whether the current field matches the target field set;

[0142] If the current field matches the target field set, the current field is determined to be a sensitive field;

[0143] If the current field does not match the target field set, the current field is determined to be a normal field.

[0144] The computer-readable storage medium may be an internal storage unit of the computer device described in the foregoing embodiment, such as a hard disk or memory of the computer device. The computer-readable storage medium may also be an external storage device of the computer device, such as a plug-in hard disk, a smart memory card (SmartMedia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc., equipped on the computer device.

[0145] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A method for detecting sensitive fields of interface input and output parameters, characterized in that: The sensitive field detection method of the interface input and output parameters comprises the following steps: Upon receiving a sensitive field detection instruction corresponding to the microservice to be detected, obtaining a sensitive data set to be detected and a configuration file corresponding to the microservice to be detected; Determine a field naming rule corresponding to the microservice to be detected based on the configuration file, and determine a target field set corresponding to the sensitive data set to be detected based on the field naming rule; Based on the preset framework mapping processor, obtain the interface registration information corresponding to the microservice to be detected, and based on the interface registration information, obtain the input and output parameter fields of all interfaces in the microservice to be detected; Based on the target field set, sensitive field detection is performed on the input and output parameter fields corresponding to all the interfaces, so as to perform sensitive field detection on the input and output parameters of all the interfaces in the microservice to be detected.

2. The method for detecting sensitive fields of interface input and output parameters according to claim 1, characterized in that: After performing sensitive field detection on all input and output parameter identifiers based on the target field set to complete the input and output parameter sensitive field detection of each interface in the microservice to be detected, the method further includes: Based on the sensitive field detection result, determine the sensitive input and output parameter fields in the input and output parameter fields corresponding to all the interfaces, and obtain the position of the sensitive input and output parameter fields in the code corresponding to the microservice to be detected as parameter position information; The sensitive input and output parameter fields and their corresponding parameter position information are associated and stored, and a sensitive input and output parameter record table corresponding to the microservice to be detected is generated, so that the user can process the sensitive input and output parameters in the microservice to be detected based on the sensitive input and output parameter record table.

3. The method for detecting sensitive fields of interface input and output parameters as claimed in claim 2, characterized in that: After associating and storing the sensitive input and output parameter fields and the corresponding parameter location information to generate the sensitive input and output parameter record table corresponding to the microservice to be detected, the method further includes: Based on the configuration file, a set of ignored fields corresponding to the microservice to be detected is determined, and based on the set of ignored fields, sensitive fields in the sensitive input and output parameter record table are filtered and removed.

4. The method for detecting sensitive fields of interface input and output parameters as claimed in claim 2, characterized in that: After determining the sensitive input and output parameter fields in the input and output parameter fields corresponding to all the interfaces based on the sensitive field detection result, the method further includes: In the code corresponding to the microservice to be detected, the relevant code corresponding to the sensitive input and output parameter field is determined, and the sensitive input and output parameter field and the relevant code are associated and stored in the sensitive input and output parameter record table.

5. The method for detecting sensitive fields of interface input and output parameters as claimed in claim 2, characterized in that: After determining the sensitive input and output parameter fields in the input and output parameter fields corresponding to all the interfaces based on the sensitive field detection result, the method further includes: Based on the marked sensitive field set corresponding to the microservice to be detected, the marked sensitive fields are determined in the sensitive input and output parameter fields, and the marked sensitive fields in the sensitive input and output parameter fields are filtered and removed.

6. The method for detecting sensitive fields of interface input and output parameters according to any one of claims 1 to 5, characterized in that: The performing sensitive field detection on the input and output parameter fields corresponding to all the interfaces based on the target field set specifically includes: Obtain any field in the input and output parameter fields corresponding to all the interfaces as the current field, and determine whether the current field is a nested object; When the current field is the nested object, recursively scan the nested object corresponding to the current field to obtain the upper-level field and / or lower-level field corresponding to the current field; Sensitive field detection is performed on the current field, the upper field and the lower field, and the current field is updated based on the next attribute field in the input and output parameter fields corresponding to all the interfaces until the detection of all fields in the input and output parameter fields corresponding to all the interfaces is completed.

7. The method for detecting sensitive fields of interface input and output parameters according to claim 6, characterized in that: After obtaining any field in the input and output parameter fields corresponding to all the interfaces as the current field and determining whether the current field is a nested object, the method further includes: When the current field is a basic type field, determining whether the current field matches the target field set; If the current field matches the target field set, the current field is determined to be a sensitive field; If the current field does not match the target field set, the current field is determined to be a normal field.

8. A sensitive field detection device for interface input and output parameters, characterized in that: The sensitive field detection device of the interface input and output parameters includes: A detection information acquisition module is used to obtain a set of sensitive data to be detected and a configuration file corresponding to the microservice to be detected when receiving a sensitive field detection instruction corresponding to the microservice to be detected; A sensitive field conversion module, used to determine the field naming rule corresponding to the microservice to be detected based on the configuration file, and determine the target field set corresponding to the sensitive data set to be detected based on the field naming rule; An interface field acquisition module is used to acquire the interface registration information corresponding to the microservice to be detected based on a preset framework mapping processor, and acquire the input and output parameter fields of all interfaces in the microservice to be detected based on the interface registration information; The sensitive field detection module is used to perform sensitive field detection on the input and output parameter fields corresponding to all the interfaces based on the target field set, so as to perform sensitive field detection on the input and output parameters of all the interfaces in the microservice to be detected.

9. A computer device, characterized in that: The computer device includes a processor, a memory, and a sensitive field detection program for interface input and output parameters stored in the memory and executable by the processor, wherein when the sensitive field detection program for interface input and output parameters is executed by the processor, the steps of the sensitive field detection method for interface input and output parameters as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a sensitive field detection program for interface input and output parameters, wherein when the sensitive field detection program for interface input and output parameters is executed by a processor, the steps of the sensitive field detection method for interface input and output parameters as described in any one of claims 1 to 7 are implemented.

Images