Desensitization method and device and server

Abstract

The invention relates to the technical field of data processing, in particular to a desensitization method and device and a server. The method is applied to a proxy server, the proxy server can establish communication with each system, and the method comprises the following steps: intercepting messages entering and exiting each system to obtain a target message; determining a target desensitization rule corresponding to the target message from a desensitization rule base based on a sending object and / or a receiving object corresponding to the target message, the desensitization rule base being used for maintaining desensitization rules corresponding to each system; and desensitizing the target message based on the target desensitization rule to obtain a desensitized message, and forwarding the desensitized message to the receiving object. By adopting the method provided by the invention, the cost of updating the desensitization rule of each system by an enterprise can be reduced, so that the desensitization rule of each system can be maintained more conveniently.

Description

Technical Field

[0001] The present application relates to the technical field of data processing, and in particular to a desensitization method, device and server. Background Art

[0002] In today's information age, the development of network and data transmission technology has greatly promoted the dissemination and sharing of information; however, the openness of information flow also makes the leakage of sensitive information and improper information dissemination a potential security risk. In reality, there are multiple systems in an enterprise, and the data transmitted by each system may contain confidential content, private information, or sensitive data that does not comply with ethical standards. Therefore, in order to improve data security, it is usually necessary to configure a desensitization algorithm based on desensitization rules within each system, and different nodes within the same system may need to be configured with corresponding desensitization algorithms separately.

[0003] In the above-mentioned data masking method, the masking-related codes need to be written into the system. However, since the relevant masking rules need to be constantly updated to maintain timeliness, enterprises need to incur high manpower and material costs when updating sensitive rules of various systems. In addition, there may even be some special systems in the enterprise, such as old systems that are difficult to expand, or closed systems without source code. For these special systems, the cost of modifying the internal code of the system is high, which further increases the cost of maintaining data security for enterprises.

[0004] Therefore, how to reduce the cost of maintaining data security for enterprises is an urgent problem that needs to be solved. Summary of the invention

[0005] Based on this, it is necessary to provide a desensitization method, device and server that can reduce the cost of enterprises updating the desensitization rules of various systems in response to the above technical problems.

[0006] In a first aspect, the present application provides a desensitization method, which is applied to a proxy server, wherein the proxy server can establish communication with each system, and the method comprises:

[0007] Intercepting messages entering and leaving the systems to obtain target messages;

[0008] Based on the sending object and / or receiving object corresponding to the target message, determine the target desensitization rule corresponding to the target message from the desensitization rule library, and the desensitization rule library is used to maintain the desensitization rules corresponding to each system;

[0009] The target message is desensitized based on the target desensitization rule to obtain a desensitized message, and the desensitized message is forwarded to the receiving object.

[0010] In one embodiment, the method further comprises:

[0011] Extracting a field of the target message at a preset position, and determining a sending object and a receiving object corresponding to the target message according to the extracted field;

[0012] The desensitizing the target message based on the target desensitization rule to obtain a desensitized message includes:

[0013] Determine a target encryption and decryption rule corresponding to the target message according to the sending object or the receiving object, and parse the target message based on the target encryption and decryption rule to obtain a target text corresponding to the target message;

[0014] The target text is desensitized based on the target desensitization rule to obtain a desensitized text, and the desensitized text is encrypted based on the target encryption and decryption rule to obtain a desensitized message.

[0015] In one embodiment, performing desensitization processing on the target text based on the target desensitization rule to obtain the desensitized text includes:

[0016] Retrieving a dictionary tree of sensitive words corresponding to the target desensitization rule, searching the dictionary tree based on the target text, and determining whether sensitive words exist in the target text according to the search results;

[0017] In the case where there are sensitive words in the target text, determining a replacement word corresponding to the sensitive word based on a replacement rule in the target desensitization rule, wherein the replacement word has the same length as the corresponding sensitive word;

[0018] The sensitive words in the target text are replaced with the corresponding replacement words to obtain a desensitized text.

[0019] In one embodiment, the process of constructing the dictionary tree includes:

[0020] According to the order of the characters in the sensitive words, each character of the sensitive word is taken as a node to construct a dictionary tree;

[0021] Constructing a failure pointer for each of the nodes, wherein the failure pointer is used to point to other nodes having the same character as the node;

[0022] The characters of each node are bit-compressed to obtain a status identifier of each node, wherein the status identifier indicates whether the node is the end of a sensitive word.

[0023] In one embodiment, forwarding the desensitized message to the receiving object includes:

[0024] According to the sending object or the receiving object, matching is performed from the proxy forwarding table to obtain a target communication port, wherein the target communication port is a communication port corresponding to the target message, and the proxy forwarding table represents the corresponding relationship between each system and the communication port;

[0025] The desensitized message is forwarded to the receiving object of the target message through the target communication port corresponding to the target message, and the target communication port is used to establish proxy communication between the sending object and the receiving object.

[0026] In one embodiment, the method further comprises:

[0027] When the desensitization rule corresponding to any system in the desensitization rule base is updated, the communication port corresponding to each system in the proxy forwarding table is updated.

[0028] In one embodiment, the method further comprises:

[0029] For any communication port, if it is determined that the number of messages forwarded by the communication port is greater than the concurrency threshold within a unit period, an auxiliary port is determined from each available port;

[0030] In the proxy forwarding table, the auxiliary port is associated with the communication port, and a validity period is set for the auxiliary port; wherein the validity period is positively correlated with the number of messages.

[0031] In one embodiment, the proxy server is configured with an interceptor, and the interception of messages entering and leaving each system to obtain the target message includes:

[0032] Acquire the protocol type of the messages entering and leaving each system, and determine the messages that meet the set protocol type as the messages to be processed;

[0033] Determine the content type corresponding to each of the to-be-processed messages, and determine the to-be-processed messages whose content type is a text type as target messages;

[0034] The target message is intercepted by the interceptor.

[0035] In a second aspect, the present application further provides a desensitization device, the device comprising an interception module, a target desensitization rule determination module and a desensitization module, wherein:

[0036] The interception module intercepts the messages entering and leaving each system and obtains the target message;

[0037] A target desensitization rule determination module is used to determine the target desensitization rule corresponding to the target message from a desensitization rule library based on the sending object and / or receiving object corresponding to the target message, and the desensitization rule library is used to maintain the desensitization rules corresponding to each system;

[0038] A desensitizing module is used to perform desensitization processing on the target message based on the target desensitization rule to obtain a desensitized message, and forward the desensitized message to the receiving object.

[0039] In a third aspect, the present application further provides a server, which is a proxy server, comprising a memory and a processor, the proxy server can establish communication with each system, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0040] Intercepting messages entering and leaving the systems to obtain target messages;

[0041] Based on the sending object and / or receiving object corresponding to the target message, determine the target desensitization rule corresponding to the target message from the desensitization rule library, and the desensitization rule library is used to maintain the desensitization rules corresponding to each system;

[0042] The target message is desensitized based on the target desensitization rule to obtain a desensitized message, and the desensitized message is forwarded to the receiving object.

[0043] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the following steps are implemented:

[0044] Intercepting messages entering and leaving the systems to obtain target messages;

[0045] Based on the sending object and / or receiving object corresponding to the target message, determine the target desensitization rule corresponding to the target message from the desensitization rule library, and the desensitization rule library is used to maintain the desensitization rules corresponding to each system;

[0046] The target message is desensitized based on the target desensitization rule to obtain a desensitized message, and the desensitized message is forwarded to the receiving object.

[0047] In a fifth aspect, the present application further provides a computer program product, including a computer program, which implements the following steps when executed by a processor:

[0048] Intercepting messages entering and leaving the systems to obtain target messages;

[0049] Based on the sending object and / or receiving object corresponding to the target message, determine the target desensitization rule corresponding to the target message from the desensitization rule library, and the desensitization rule library is used to maintain the desensitization rules corresponding to each system;

[0050] The target message is desensitized based on the target desensitization rule to obtain a desensitized message, and the desensitized message is forwarded to the receiving object.

[0051] The above desensitization method, device and server have at least the following beneficial effects:

[0052] 1. By setting up an independent proxy server that can communicate with each system, the desensitization rules corresponding to each system are configured in the desensitization rule library of the proxy server, so that the proxy server intercepts the messages entering and leaving each system to obtain the target message, and then the target desensitization rule corresponding to the target message can be determined from the desensitization rule library for the system corresponding to the target message (sending object or requesting object), and then the target message can be desensitized according to the target desensitization rule to obtain the desensitized message; the proxy server further sends the desensitized message to the receiving object corresponding to the original target message, so that the proxy server can complete the desensitization processing of the data entering and leaving the system and the forwarding of the message; compared with the related art, in the method of the present application, the administrator can easily modify the desensitization rules (related data and program codes) corresponding to each system in the data storage system of the proxy server, and supports batch modification of the desensitization rules corresponding to multiple systems, and the modification of the code configured in the proxy server is relatively simple, thereby reducing the cost of the enterprise to modify the desensitization rules in each system;

[0053] 2. The correspondence between each system and port in the proxy forwarding table can be updated. The correspondence between each system and port after the update does not overlap with the correspondence between each system and port before the update. In other words, each update changes the communication port corresponding to each system, thereby reducing the risk of the system using a single communication port for a long time, thereby improving the security of data that realizes proxy communication through the proxy server.

[0054] 3. The proxy server obtains the number of messages forwarded by each communication port within the ended unit period every unit period, and determines whether the number of messages is greater than the concurrency threshold; for any communication port, if the number of messages forwarded is greater than the concurrency threshold, the communication port is determined to be a busy port, indicating that the burden of the communication port is relatively large; that is, the system corresponding to the busy port has a large amount of tasks, and the system is a busy system; at this time, if it is determined in the forwarding proxy table that the busy system does not have a spare port, an auxiliary port is determined from the available empty port of the proxy server, wherein the IP address of the auxiliary port is in the same network segment as the IP address of the busy port, so that there is no need to occupy too many bridges of the proxy server for data routing; and the auxiliary port is added to the proxy forwarding table to correspond to the busy system, so that the auxiliary port and the busy port can simultaneously perform the message forwarding task for the busy system, thereby improving the message forwarding efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0056] Figure 1 An application environment diagram of a desensitization method in an embodiment;

[0057] Figure 2 Schematic diagram of a desensitization method in one embodiment;

[0058] Figure 3 This is an example diagram of a desensitization rule in an embodiment;

[0059] Figure 4 A schematic diagram of a flow chart of steps for determining a target message in an embodiment;

[0060] Figure 5 A schematic diagram of a process for processing a target message in one embodiment;

[0061] Figure 6 The figure is a schematic diagram of a desensitization process in one embodiment;

[0062] Figure 7 A schematic diagram of a process of proxy server load balancing in one embodiment;

[0063] Figure 8 is a schematic diagram of the implementation process of the desensitization method in another embodiment;

[0064] Fig. 9An example diagram of the logic for implementing a desensitization method in one embodiment;

[0065] Fig.10 is a structural block diagram of a desensitization device in one embodiment;

[0066] Fig.11 FIG. 4 is a diagram showing the internal structure of a server in one embodiment. DETAILED DESCRIPTION

[0067] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0068] The desensitization method provided in the embodiments of the present application can be applied to Figure 1 In the application environment shown, the proxy server can establish communication with each system (such as system 1, system 2, system 3, etc.), and the request message sent by the user's computer device to each system and the response message sent by each system to the user's computer device can be intercepted by the proxy server, and the desensitization method of the embodiment of the present application is used to desensitize the intercepted message.

[0069] The data storage system can store the data that the proxy server needs to process. The data storage system can be integrated on the proxy server or placed on the cloud or other network servers. Among them, the user's computer device can be, but is not limited to, various personal computers, laptops, smart phones, tablets, Internet of Things devices and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart car devices, etc. Portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The proxy server can be implemented as an independent server or a server cluster consisting of multiple servers.

[0070] In an exemplary embodiment, Figure 2 As shown, a desensitization method is provided, which is applied to Figure 1 The proxy server in is used as an example to illustrate, including the following steps 10 to 30, wherein:

[0071] Step 10: Intercept the messages entering and leaving each system to obtain the target message.

[0072] For the embodiments of the present application, the target message is a message that conforms to a specific type, for example, a message that conforms to a preset protocol type, and / or a message that conforms to a preset content type. Of course, the target message may also be other types, which is not specifically limited in the embodiments of the present application. The target message may be a request message sent by the user's computer device to the system, or a response message fed back by the system to the user's computer device. Intercepting the message is achieved through an interceptor, and intercepting the messages entering and leaving the system through an interceptor is a mechanism in the communication system, which allows developers to modify, check or record them before the request is sent or the response is received.

[0073] Step 20: Based on the sending object and / or receiving object corresponding to the target message, determine the target desensitization rule corresponding to the target message from the desensitization rule library, and the desensitization rule library is used to maintain the desensitization rules corresponding to each system.

[0074] For the embodiment of the present application, for the request message sent by the user's computer device to the system, the sending object is the user's computer device, and the receiving object is the corresponding target system; for the response message fed back by the system to the user's computer device, the sending object is the system, and the receiving object is the target user's computer device. The desensitization rule base is pre-stored in the data storage system of the proxy server, and the data storage system can be integrated on the proxy server, or placed on the cloud or other network servers.

[0075] The administrator can modify the desensitization rules corresponding to each system in the data storage system of the proxy server, including modifying the relevant data referenced by the desensitization rules, such as the correspondence between sensitive words and replacement words and the sensitive word library, or modifying the program code corresponding to the implementation of the desensitization rules.

[0076] Among them, the desensitization rule base may store the desensitization rules corresponding to each system; for the target message, if the target message is a request message, the target desensitization rule is determined from the desensitization rule base based on the receiving object of the target message (the target system to which the message will be sent); if the target message is a response message, the target desensitization rule is determined from the desensitization rule base based on the sending object of the target message (the system that sends the message).

[0077] An example of a desensitization rule is Figure 3 As shown, the desensitization rules may include matching rules for sensitive words, interception methods (desensitization methods) and display rules (replacement rules).

[0078] Step 30: Desensitize the target message based on the target desensitization rule to obtain a desensitized message, and forward the desensitized message to the receiving object.

[0079] For the embodiment of the present application, after determining the target desensitization rule corresponding to the target message, the target message is modified according to the target desensitization rule to obtain a desensitized message. In addition, for the target message, if the target message is a request message, the desensitized message is sent to the receiving object of the target message (target system); if the target message is a response message, the desensitized message is sent to the receiving object corresponding to the target message (the computer device of the target user).

[0080] In the above-mentioned desensitizing method, by setting up an independent proxy server that can communicate with each system, the desensitizing rules corresponding to each system are configured in the desensitizing rule library of the proxy server, so that the proxy server intercepts the messages entering and leaving each system to obtain the target message, and then the target desensitizing rule corresponding to the target message can be determined from the desensitizing rule library for the system corresponding to the target message (sending object or request object), and then the target message can be desensitized according to the target desensitizing rule to obtain the desensitized message; the proxy server further sends the desensitized message to the receiving object corresponding to the original target message, so that the proxy server can complete the desensitizing processing of the data entering and leaving the system and the forwarding of the message; compared with the related art, in the method of the present application, the administrator can easily modify the desensitizing rules (related data and program codes) corresponding to each system in the data storage system of the proxy server, and supports batch modification of the desensitizing rules corresponding to multiple systems, and the modification of the code configured in the proxy server is relatively simple, thereby reducing the cost of the enterprise to modify the desensitizing rules in each system.

[0081] Further, in one embodiment, if Figure 4 As shown, step 10 may specifically include steps 11 to 13, wherein:

[0082] Step 11: Obtain the protocol type of the messages entering and leaving each system, and determine the messages that meet the set protocol type as the messages to be processed.

[0083] In the embodiment of the present application, the protocol type is set to HTTP (Hypertext Transfer Protocol) and HTTPS (Hypertext Transfer Protocol Secure); HTTP messages have a specific format, usually including a request line (for request messages) or a status line (for response messages), as well as a header field and an optional message body. HTTP runs on the TCP layer and is a plain text transmission protocol; HTTPS runs on the SSL (Secure Socket Layer) / TLS (Transport Layer Security) layer and then to the TCP (Transmission Control Protocol) layer; SSL / TLS is responsible for encrypting and decrypting the transmitted data, so that the data is safe during transmission. And usually, the HTTP protocol type uses port 80 by default, and the HTTPS protocol type uses port 443 by default. Therefore, in the embodiment of the present application, it can be determined whether the message is a message to be processed by checking the port number or checking the message header field.

[0084] Step 12: Determine the content type corresponding to each to-be-processed message, and determine the to-be-processed message whose content type is a text type as a target message.

[0085] Furthermore, in another possible implementation, for unencrypted messages, it is also possible to determine whether a message is a pending message that complies with the set protocol type by parsing the content of the message. For example, after parsing a request message, the request method, request URI (Uniform Resource Identifier) ​​and transmission protocol version of the message can be obtained; among which, common HTTP request methods include GET, POST, PUT, DELETE, etc.; common HTTP versions are usually HTTP / 1.0, HTTP / 1.1 or HTTP / 2.0. Then, determine whether the request message is a pending message by parsing at least one of the request method, request URI and transmission protocol version of the request message.

[0086] After parsing a response message, you can get the message's status line (the first line of the response message, consisting of the HTTP version, status code, and status message), header fields (containing a series of key-value pairs that provide additional information about the response), and response body (containing the actual data); then, based on at least one of the status line, header fields, and response body obtained from the parsed response message, determine whether the message is a to-be-processed message that complies with the set protocol type.

[0087] Furthermore, the corresponding content type in the message to be processed can be determined by checking the MIME (Multipurpose Internet Mail Extensions) type in the message; the corresponding content type in the message to be processed can also be determined by analyzing the file extension in the message; and the message to be processed can also be processed by calling a preset content sniffing component to obtain the content type corresponding to the message to be processed. The specific method of determining the content type in the message to be processed is not specifically limited in the embodiments of the present application. Furthermore, when it is determined that the content type corresponding to the message to be processed is text content, the message to be processed is determined as a target message for interception.

[0088] Step 13: Intercept the target message through the interceptor.

[0089] Specifically, in the embodiment of the present application, the proxy server is a high-performance proxy server implemented based on Netty; the proxy server is configured with an interceptor, which is a mechanism that can intercept and process HTTP requests and responses, and is usually integrated in the network request library. The working principle of the interceptor is to intercept the request message before it is sent or the response message after it is received, and perform some custom operations, such as modifying request parameters, adding request headers, and recording logs.

[0090] In one embodiment, after determining a target message of Http or Https protocol type and a text content type, the proxy server selects a corresponding target communication port to establish proxy communication between a sending object and a receiving object of the target message. The process of determining the target communication port may specifically include: matching from a proxy forwarding table according to the sending object or the receiving object to obtain the target communication port.

[0091] The target communication port is the communication port corresponding to the target message, and the proxy forwarding table represents the corresponding relationship between each system and the communication port; the target communication port is used to establish proxy communication between the sending object and the receiving object.

[0092] After determining the target communication interface, the target message intercepted by the interceptor is sent to the proxy server through the target communication port, so that the proxy server desensitizes the target message to obtain a desensitized message, and the proxy server sends the desensitized message to the recipient of the target message through the target communication port. Thus, the process of desensitizing the target message and proxy forwarding is realized through the proxy server.

[0093] Furthermore, since the proxy server intercepts, desensitizes, and forwards the messages between users and various systems, the security of the proxy server is particularly important. Since the proxy forwarding table determines the communication port for forwarding messages for each system, if the correspondence between the system and the port in the proxy forwarding table remains unchanged, there is a greater risk of leakage; if the correspondence between the communication port and the system is leaked, it is possible to attack a certain system or hijack data for a long time, thus affecting the security of the data.

[0094] Therefore, in order to further improve the security of data, in an embodiment of the present application, update rules are set for the proxy forwarding table in the proxy server. When any update rule is met, the correspondence between each system and port in the proxy forwarding table can be updated and changed, thereby reducing the risk of leakage of the correspondence between the port and the system.

[0095] Specifically, the updating rules include: when the desensitization rule corresponding to any system in the desensitization rule base is updated, the communication ports corresponding to each system in the proxy forwarding table are updated.

[0096] Furthermore, the update rule also includes: updating the communication ports corresponding to each system in the proxy forwarding table at every set update period. The update period can be a set fixed value, for example, the update period can be set to 3 days; the update period can also be a set dynamic value, for example, a digital sequence is set, the order of the numbers in the digital sequence represents the order of the update period, and the size of the numbers in the digital sequence represents the duration of the corresponding update period.

[0097] In the case of satisfying the update rules, the correspondence between each system and port in the proxy forwarding table can be updated. Specifically, the correspondence between each system and port after the update does not overlap with the correspondence between each system and port before the update. In other words, each update changes the communication port corresponding to each system, thereby reducing the risk of the system using a single communication port for a long time, thereby improving the security of data that realizes proxy communication through the proxy server.

[0098] In one embodiment, referring to Figure 5 , step 30 may specifically include steps 31 to 33, wherein:

[0099] Step 31: extract the field of the target message at the preset position, and determine the sending object and receiving object corresponding to the target message according to the extracted field.

[0100] Specifically, after determining that the target message is of Http or Https protocol type and the content type is of text type, if the text content corresponding to the target message is encrypted, the target message needs to be decrypted accordingly to obtain the text content corresponding to the target message. In addition, usually, the message is encrypted because the system has a corresponding data format specification, that is, to determine the encryption and decryption algorithm corresponding to the target message, it is necessary to determine the system corresponding to the target message. Further, the field at the preset position of the target message is extracted, and then the sending object and the receiving object of the target message are determined, and then the system corresponding to the target message is determined.

[0101] The destination node name (i.e., the domain name or IP address of the receiving object) can be obtained by parsing the "Host" field of the target message; the source node name (i.e., the domain name or IP address of the sending object) can be obtained by parsing the "Referer" field or "Origin" field of the message. Of course, you can also call the preset network protocol analysis tool to analyze the target message, and then get the sending object and receiving object of the target message.

[0102] Step 32: determining a target encryption and decryption rule corresponding to the target message according to the sending object or the receiving object, and parsing the target message based on the target encryption and decryption rule to obtain a target text corresponding to the target message;

[0103] Step 33: Desensitize the target text based on the target desensitization rule to obtain a desensitized text, and encrypt the desensitized text based on the target encryption and decryption rule to obtain a desensitized message.

[0104] Specifically, the proxy server pre-stores the encryption and decryption algorithms corresponding to each system. After determining the sending object and receiving object of the target message, the encryption and decryption algorithm of the system corresponding to the target message is used as the target encryption and decryption algorithm, and then the content of the target message is parsed according to the target encryption and decryption algorithm, thereby obtaining the target text corresponding to the target message. Furthermore, the target text is desensitized according to the target desensitization rules determined by the system corresponding to the target message, thereby obtaining the desensitized text corresponding to the target text; the desensitized text is reorganized into a message to obtain the desensitized message corresponding to the target message. The proxy server then forwards the desensitized message corresponding to the target message through the determined target communication port to the receiving object corresponding to the target message, thereby completing the desensitization processing and proxy forwarding process of the target message.

[0105] Further, refer to Figure 6 Step 33 may specifically include steps 331 to 333, wherein:

[0106] Step 331: retrieve the dictionary tree of sensitive words corresponding to the target desensitization rule, search the dictionary tree based on the target text, and determine whether the target text contains sensitive words based on the search results.

[0107] Specifically, the dictionary tree of sensitive words is pre-built based on multiple sensitive words pre-stored in a preset sensitive word library, and the dictionary tree is a Trie tree structure. The process of building the dictionary tree includes: according to the order of characters in the sensitive word library, the characters of each sensitive word are taken as a node to build the dictionary tree; build a failure pointer for each node, and the failure pointer is used to point to other nodes with the same characters as the node; bit compress the characters of each node to obtain the state flag of each node, and the state flag indicates whether the node is the end of the sensitive word.

[0108] Further explanation of the construction process of the dictionary tree: All sensitive words are organized into a Trie tree. Each node of the Trie tree represents a character. The character sequence on the path from the root node to a certain node represents a prefix. Then create a root node of the Trie tree. For each sensitive word, start from the root node and insert it into the Trie tree character by character. If the child node corresponding to the current character does not exist, create a new child node; after the traversal is completed, mark the end of the sensitive word on the last node.

[0109] Further, a failure pointer is constructed for each node of the Trie tree. The failure pointer points to the next node to jump to when the current node fails to match. A queue is initialized, and the root node of the Trie tree (whose failure pointer points to itself or null) is queued. For each node in the queue, all child nodes of the node are traversed. If the node pointed to by the failure pointer of the parent node of the child node has a child node with the same character as the child node, the failure pointer of the child node is pointed to the same child node; if the node pointed to by the failure pointer of the parent node of the child node does not have a child node with the same character as the child node, continue to search upward along the failure pointer until a node with a child node with the same character is found, or the root node is reached; then the failure pointer of the child node points to the found child node with the same character (if it is still not found when reaching the root node, it points to the root node or null). The construction process of the dictionary tree corresponding to the sensitive words of each system is completed in the above manner; wherein, the process of constructing the failure pointer is performed using the BFS algorithm of breadth-first search or the Aho-Corasick algorithm.

[0110] After determining the dictionary tree in the target desensitization rule corresponding to the target text, the proxy server loads the dictionary tree into the memory, searches the dictionary tree based on the target text, obtains the search results, and then further determines whether there are sensitive words in the target text based on the search results.

[0111] In order to further reduce the state storage of the dictionary tree, the state of each node can be compressed, that is, the character information of each node in the dictionary tree and the termination mark of sensitive words are stored in advance using bit operations. In a possible implementation method, an integer state is assigned to each node using bit compression, and the state information of each node is represented by bit compression. For example, the upper 16 bits represent the index of the current character, and the lower 16 bits are used to indicate whether it is a terminal state (that is, whether the node is the end of a sensitive word). By constructing a state transition graph for each sensitive word in the dictionary tree, and then constructing a table based on the state transition graph of each sensitive word, as the bit compression access state table of the dictionary tree; using bit operations can quickly locate the transition in the bit compression access state table.

[0112] Furthermore, in an embodiment of the present application, a DFA (Deterministic Finite Automaton) algorithm is used to search the target text in a dictionary tree to obtain search results, wherein the search results include sensitive words and the positions of the sensitive words in the target text.

[0113] The time complexity of the DFA algorithm mainly depends on the length of the text content and the efficiency of sensitive word matching. Since the DFA algorithm is matched based on state transition, it only needs to scan the text to be detected once to detect all sensitive words. It is worth noting that the time complexity of the DFA algorithm is independent of the number of sensitive words, but only related to the length of the text. This means that no matter how many sensitive words there are in the sensitive word library, the DFA algorithm can complete the sensitive word recognition of the entire text in the same time; therefore, compared with the method of using regular expressions for sensitive word recognition in the related art, the scheme of this embodiment uses a DFA algorithm based on state compression (a state transition diagram of a dictionary tree based on bit operations) to identify sensitive words. It has a higher efficiency, thereby shortening the time required for desensitizing the target message.

[0114] Step 332: Based on the replacement rule in the target desensitization rule, determine the replacement word corresponding to the sensitive word, and the length of the replacement word is the same as that of the corresponding sensitive word.

[0115] Step 333: Replace the sensitive words in the target text with corresponding replacement words to obtain a desensitized text.

[0116] Specifically, for the identified sensitive words, the replacement rules in the target desensitization rules are retrieved and loaded into the memory; the replacement rules characterize the correspondence between sensitive words and replacement words. Among them, a sensitive word can be a word or a character; for sensitive words of the word or character class, the replacement word can also be a word or a character; and sensitive words can also be specific types of privacy data, such as mobile phone numbers, email addresses, etc.; for sensitive words that are privacy data, the corresponding replacement words can be words or symbols. For example, in the case where the sensitive word is a mobile phone number, the "*" symbol can be used as a character to replace part of the numbers in the mobile phone number. The specific correspondence between sensitive words and replacement words is not specifically limited in the embodiments of the present application. However, it should be noted that the length of the replacement word should be the same as the length of the corresponding sensitive word, so that the desensitized text obtained after desensitization is consistent with the length of the target text.

[0117] Furthermore, since the proxy server intercepts and desensitizes the messages entering and leaving each system, when faced with a large number of message requests, it will bring a large burden to the corresponding communication ports of each system in the source server. Therefore, in order to improve the forwarding efficiency of messages entering and leaving each system, in the embodiment of the present application, the desensitization method also includes a load balancing process, referring to Figure 7 , specifically may include step 40 and step 50, wherein:

[0118] Step 40: For any communication port, if the number of messages forwarded by the communication port is determined to be greater than the concurrency threshold within a unit period, an auxiliary port is determined from each available port;

[0119] Step 50: In the proxy forwarding table, the auxiliary port is associated with the communication port, and a validity period is set for the auxiliary port; wherein the validity period is positively correlated with the number of messages.

[0120] Specifically, in the proxy forwarding table, each system may have only one communication port or multiple communication ports. The number of communication ports corresponding to each system in the proxy forwarding table can be set by the user based on actual business needs, or can be determined based on the number of historical message processing of each system.

[0121] The proxy server obtains the number of messages forwarded by each communication port in the completed unit cycle every other unit cycle, and determines whether the number of messages is greater than the concurrent threshold; for any communication port, if the number of messages forwarded is greater than the concurrent threshold, the communication port is determined to be a busy port, indicating that the burden of the communication port is relatively large; that is, the system corresponding to the busy port has a large amount of tasks, and the system is a busy system. At this time, if it is determined that there is no spare port for the busy system in the forwarding proxy table, an auxiliary port is determined from the available empty point ports of the proxy server, wherein the IP address of the auxiliary port is in the same network segment as the IP address of the busy port, so that it is not necessary to occupy too many bridges of the proxy server for data routing. In addition, the auxiliary port is added to the proxy forwarding table to correspond to the busy system, so that the auxiliary port and the busy port can simultaneously perform the message forwarding task for the busy system, thereby improving the forwarding efficiency of the message.

[0122] Furthermore, in order to avoid excessive occupation of the port, each auxiliary port is set with a validity period, wherein the validity period is positively correlated with the number of messages forwarded by the busy port determined when the busy port is determined. The specific correspondence between the validity period and the number of messages is not specifically limited in the embodiments of the present application.

[0123] It should be noted that the concurrency threshold corresponding to each communication port can be the same or different and can be specified by the user; however, the concurrency threshold corresponding to each communication port should be less than or equal to 80% of the maximum forwarding number corresponding to the communication port, thereby retaining sufficient redundant performance for the proxy server to reduce the chance of congestion at each communication port.

[0124] In an exemplary embodiment, referring to Figure 8 The present application provides a desensitization method, and the specific implementation process may include steps S1 to S4, wherein:

[0125] S1. Build a high-performance proxy server;

[0126] S2. Implement customized forwarding functions in the proxy server and build a general request interceptor;

[0127] S3, implement the DFA algorithm of state compression and multi-pattern matching, and realize the management function of sensitive words;

[0128] S4. Intercept the request and filter the request and response content for sensitive words.

[0129] Specifically, in step S1, a high-performance Http proxy server is implemented based on the Netty framework. A general proxy forwarding configuration is designed, and the proxy forwarding effect is implemented according to the configuration file. An example of a configuration file is localPort=8080; remoteHost=10.64.12.89; remotePort=8081. Among them, localPort describes the startup port (target communication port) of the proxy server itself, remoteHost describes the IP of the target system, and remotePort describes the communication port of the target system.

[0130] Specifically, in step S2, in the proxy server, a general interceptor is pre-configured, and the request is intercepted by inheriting the ChannelInboundHandlerAdapter class adapter of Netty; by intercepting the request or the returned object, it is determined whether its type is an HttpRequest or HttpResponse object, and only the messages corresponding to the Http request and the Https request are processed. In the embodiment of the present application, all Http and Https message requests entering and leaving each system are identified and intercepted, and the intercepted messages are analyzed to obtain the messages with the content type of text as the target messages that need to be desensitized.

[0131] Specifically, in step S3, a sensitive word matching algorithm based on the DFA algorithm of state compression and multi-mode matching is implemented. A dictionary tree of sensitive words is constructed for each system in advance. The dictionary tree is a Trie tree. The specific implementation method is: each system is corresponding to the sensitive words in the sensitive word library and organized into a Trie tree, and the Aho-Corasick algorithm is used to construct the state transfer and failure pointer of each node in the Trie tree. At the same time, in order to reduce state storage, the state of each node can be compressed, and bit operations are used to store the character information of the node, the termination mark of the sensitive word and other information. The specific process of constructing a Trie tree includes: constructing a Trie tree: storing sensitive words in the Trie tree; state encoding: using bit compression to assign an integer state to each node. In an example, bit compression can be used to represent the state information of each node. For example, the upper 16 bits represent the index of the current character, and the lower 16 bits are used to indicate whether it is a terminal state (that is, whether the node is the end of a sensitive word); failure pointer construction: with the help of the Aho-Corasick algorithm, partially matched states are connected through failure pointers; bit compression access state table: use bit operations to quickly locate transitions in the state table.

[0132] For the input string (target text) and sensitive word set The recognition performance of sensitive words in text content by the DFA algorithm based on state compression and multi-pattern matching is represented by time complexity and space complexity, where: Time complexity: The construction phase is ; The matching stage is The total complexity is . Space complexity: The space complexity is .

[0133] Time complexity of the construction phase It means that the time required to build the Trie tree and related data structures is proportional to the total length of all sensitive words. The input string The number of sensitive words in the matching phase; the time complexity of the matching phase Indicates the time required to match sensitive words and the text (string )length Proportional to the total time complexity It is the sum of the construction and matching stages. Space complexity It means that the space required to store the Trie tree and other related data structures is proportional to the total length of all sensitive words.

[0134] In the related art, the time complexity of using regular expression matching is: ;in, is the length of the text, The number of sensitive words or the complexity of regular expressions. The DFA algorithm based on state compression and multi-pattern matching used in this application has significantly better performance in identifying sensitive words in text content than the recognition algorithm for sensitive words built using regular expressions in related technologies.

[0135] When the system in the proxy server starts, the proxy server obtains the target message and determines the target desensitization rule corresponding to the target message, and then loads the corresponding Trie tree in the target desensitization rule from the pre-stored database into the memory of the proxy server, providing an interface (target communication port) for sensitive word filtering and implementing forwarding processing of request messages.

[0136] Furthermore, in step S4, the interceptor configured in S2 is used to intercept Http and Https requests; by intercepting the request, it is determined whether the current request message is in text format, and if it is in text format, it is processed, otherwise it is skipped. The stream is parsed through the encoding format defined by each system to obtain the text content (target text) in the target message; the sensitive word algorithm implemented in step S3 is used to identify and replace sensitive words in the target text to obtain the desensitized text after desensitization; and, in the process of replacement, the length of the replacement word is the same as the length of the corresponding sensitive word, and the text length is not modified, so that the length of the target text before desensitization is consistent with the length of the desensitized text after desensitization.

[0137] If the original message (target message) is signed and encrypted, the desensitized text needs to be re-signed and encrypted according to the signing and encryption algorithm provided by the system corresponding to the target message, so as to reassemble the desensitized text into a new message (desensitized message), and then forward the desensitized message to the recipient corresponding to the original message (target message).

[0138] In one example, if Fig. 9 As shown, the logic of the desensitization method provided in the embodiment of the present application is implemented between the user's computer device and each system:

[0139] The request message (text content) sent by user 1 to business system A is intercepted by the interceptor, and the proxy server uses the request message as the target message that needs to be desensitized. In addition, the request message requests port 1007 of the proxy server, and port 1007 is used as the target communication port to realize the proxy communication between user 1 and business system A. After the target message is desensitized by the proxy server, a desensitized message is obtained, and the proxy server forwards the desensitized message to business system A. The proxy server intercepts the request with sensitive words, blocks or replaces the sensitive information according to the policy, and then sends it to system A. In addition, the interceptor can also intercept the response message of business system A to user 1. The proxy server desensitizes the response message fed back by business system A to user 1, obtains the desensitized message, and then forwards the desensitized message as a response message to user 1.

[0140] The request message (text content) sent by user 2 to business system B is intercepted by the interceptor, and the proxy server uses the request message as the target message that needs to be desensitized. In addition, the request message requests port 1008 of the proxy server, and port 1007 is used as the target communication port to realize the proxy communication between user 1 and business system A. After the target message is desensitized by the proxy server, a desensitized message is obtained, and the proxy server forwards the desensitized message to business system B. The proxy server intercepts the request with sensitive words, blocks or replaces the sensitive information according to the policy, and then sends it to system B. In addition, the interceptor can also intercept the response message of business system A to user 2. The proxy server desensitizes the response message fed back by business system B to user 2, obtains the desensitized message, and then forwards the desensitized message as a response message to user B.

[0141] The process of determining the target communication port of the target message may specifically include: matching from the proxy forwarding table according to the sending object or the receiving object to obtain the target communication port corresponding to the target message. The proxy forwarding table represents the correspondence between each system and the communication port, and the target communication port is used to establish proxy communication between the sending object and the receiving object.

[0142] The pre-configured proxy server supports the rules of different systems, supports the matching rules of multiple sensitive words, supports regular expression matching such as mobile phone numbers and mailboxes, supports customized display rules, supports sensitive word rules and interception rules, and supports the configuration of multiple sensitive word libraries. By executing the desensitization method of the embodiment of the present application in the proxy server, it can be realized that there is no sensitive information in the message of the input system, and at the same time, there is no sensitive information in the message fed back to the user; and the advantage of the present application is that it can realize unified sensitive word matching rule management and sensitive word replacement rule management for each system, and different sensitive matching strategies and display strategies can be configured according to different business systems; and the present application realizes a non-intrusive sensitive word desensitization scheme for each system through the proxy server, and can replace and display sensitive words without changing the original system code, without any impact on the original system; and the present application adopts a DFA algorithm based on state compression and multi-mode matching to identify and replace sensitive words in the message, and supports multiple sensitive word matching in one scan, so the recognition efficiency of sensitive words is relatively high.

[0143] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0144] Based on the same inventive concept, the embodiment of the present application also provides a desensitization device for implementing the above-mentioned desensitization method. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more desensitization device embodiments provided below can refer to the limitations of the desensitization method above, and will not be repeated here.

[0145] In an exemplary embodiment, Fig.10 As shown, a desensitization device is provided, which includes an interception module 1001, a target desensitization rule determination module 1002 and a desensitization module 1003, wherein:

[0146] The interception module 1001 intercepts the messages entering and leaving each system to obtain the target message;

[0147] A target desensitization rule determination module 1002 is used to determine a target desensitization rule corresponding to the target message from a desensitization rule library based on a sending object and / or a receiving object corresponding to the target message, and the desensitization rule library is used to maintain desensitization rules corresponding to each system;

[0148] The desensitization module 1003 is used to perform desensitization processing on the target message based on the target desensitization rule, obtain the desensitized message, and forward the desensitized message to the receiving object.

[0149] In the above-mentioned desensitizing device, by setting up an independent proxy server that can communicate with each system, the desensitizing rules corresponding to each system are configured in the desensitizing rule library of the proxy server, so that the proxy server intercepts the messages entering and leaving each system to obtain the target message, and then the target desensitizing rule corresponding to the target message can be determined from the desensitizing rule library for the system corresponding to the target message (sending object or request object), and then the target message can be desensitized according to the target desensitizing rule to obtain the desensitized message; the proxy server further sends the desensitized message to the receiving object corresponding to the original target message, so that the proxy server can complete the desensitization processing of the data entering and leaving the system and the forwarding of the message; compared with the related art, in the method of the present application, the administrator can easily modify the desensitizing rules (related data and program codes) corresponding to each system in the data storage system of the proxy server, and supports batch modification of the desensitizing rules corresponding to multiple systems, and the modification of the code configured in the proxy server is relatively simple, thereby reducing the cost of the enterprise to modify the desensitizing rules in each system.

[0150] In one embodiment, the desensitization module 1003 is specifically used to:

[0151] Extract the field of the target message at the preset position, and determine the sending object and receiving object corresponding to the target message according to the extracted field;

[0152] Determine the target encryption and decryption rules corresponding to the target message according to the sending object or the receiving object, and parse the target message based on the target encryption and decryption rules to obtain the target text corresponding to the target message;

[0153] The target text is desensitized based on the target desensitization rule to obtain the desensitized text, and the desensitized text is encrypted based on the target encryption and decryption rule to obtain the desensitized message.

[0154] In one embodiment, the desensitization module 1003 is specifically used to:

[0155] Retrieve the dictionary tree of sensitive words corresponding to the target desensitization rule, search the dictionary tree based on the target text, and determine whether the target text contains sensitive words based on the search results;

[0156] When there are sensitive words in the target text, the replacement word corresponding to the sensitive word is determined based on the replacement rule in the target desensitization rule, and the replacement word has the same length as the corresponding sensitive word;

[0157] Replace the sensitive words in the target text with the corresponding replacement words to obtain the desensitized text.

[0158] In one embodiment, the device further comprises a building module, and the building module is specifically used for:

[0159] According to the order of characters in sensitive words, take the characters of each sensitive word as a node and build a dictionary tree;

[0160] Construct a failure pointer for each node, which is used to point to other nodes with the same character as the node;

[0161] The characters of each node are bit-compressed to obtain a state flag of each node, which indicates whether the node is the end of a sensitive word.

[0162] In one embodiment, the desensitization module 1003 is specifically used to:

[0163] According to the sending object or receiving object, the target communication port corresponding to the target message is obtained by matching from the proxy forwarding table. The proxy forwarding table represents the corresponding relationship between each system and the communication port;

[0164] The desensitized message is forwarded to the receiving object of the target message through the target communication port corresponding to the target message. The target communication port is used to establish proxy communication between the sending object and the receiving object.

[0165] In one embodiment, the desensitization device further includes an update module, the update module being specifically configured to:

[0166] When the desensitization rule corresponding to any system in the desensitization rule base is updated, the target communication port corresponding to any system in the proxy forwarding table is updated.

[0167] In one embodiment, the desensitizing device further includes a load balancing module, the load balancing module being specifically used for:

[0168] For any communication port, if the number of messages forwarded by the communication port is determined to be greater than the concurrency threshold within a unit period, an auxiliary port is determined from each available port;

[0169] In the proxy forwarding table, the auxiliary port is associated with the communication port, and a validity period is set for the auxiliary port; wherein the validity period is positively correlated with the number of messages.

[0170] In one embodiment, an interceptor is configured in the proxy server, and the interception module 1001 is specifically used for:

[0171] Obtain the protocol type of the messages entering and leaving each system, and determine the messages that meet the set protocol type as the messages to be processed;

[0172] Determine the content type corresponding to each to-be-processed message, and determine the to-be-processed message whose content type is a text type as a target message;

[0173] Intercept the target message through the interceptor.

[0174] Each module in the above-mentioned desensitization device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the server in the form of hardware, or can be stored in the memory in the server in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0175] In an exemplary embodiment, a server is provided, which is a proxy server, and its internal structure diagram can be as follows: Fig.11 As shown. The server includes a processor, a memory, an input / output interface, a communication interface, a display unit and an input device. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface, the display unit and the input device are connected to the system bus through the input / output interface. Among them, the processor of the server is used to provide computing and control capabilities. The memory of the server includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the server is used to exchange information between the processor and the external device. The communication interface of the server is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a desensitization method is implemented. The display unit of the server is used to form a visually visible picture, which can be a display screen, a projection device or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen, and the input device of the server can be a touch layer covered on the display screen, or a button, trackball or touchpad set on the server shell, or an external keyboard, touchpad or mouse.

[0176] Those skilled in the art will understand that Fig.11 The structure shown in the figure is only a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the server to which the solution of the present application is applied. The specific server may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0177] In an exemplary embodiment, a server is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the steps of any desensitization method in the above method embodiments are implemented.

[0178] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of any desensitization method in the above method embodiments are implemented.

[0179] In one embodiment, a computer program product is provided, including a computer program, which, when executed by a processor, implements the steps of any desensitization method in the above method embodiments.

[0180] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0181] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0182] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0183] The above embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A desensitization method, characterized in that, Applied to a proxy server, the proxy server can establish communication with each system, the method comprising: Intercepting messages entering and leaving the systems to obtain target messages; Based on the sending object and / or receiving object corresponding to the target message, determine the target desensitization rule corresponding to the target message from the desensitization rule library, and the desensitization rule library is used to maintain the desensitization rules corresponding to each system; The target message is desensitized based on the target desensitization rule to obtain a desensitized message, and the desensitized message is forwarded to the receiving object.

2. The method according to claim 1, characterized in that: The method further comprises: Extracting a field of the target message at a preset position, and determining a sending object and a receiving object corresponding to the target message according to the extracted field; The desensitizing the target message based on the target desensitization rule to obtain a desensitized message includes: Determine a target encryption and decryption rule corresponding to the target message according to the sending object or the receiving object, and parse the target message based on the target encryption and decryption rule to obtain a target text corresponding to the target message; The target text is desensitized based on the target desensitization rule to obtain a desensitized text, and the desensitized text is encrypted based on the target encryption and decryption rule to obtain a desensitized message.

3. The method according to claim 2, characterized in that The desensitizing the target text based on the target desensitization rule to obtain the desensitized text includes: Retrieving a dictionary tree of sensitive words corresponding to the target desensitization rule, searching the dictionary tree based on the target text, and determining whether sensitive words exist in the target text according to the search results; In the case where there are sensitive words in the target text, determining a replacement word corresponding to the sensitive word based on a replacement rule in the target desensitization rule, wherein the replacement word has the same length as the corresponding sensitive word; The sensitive words in the target text are replaced with the corresponding replacement words to obtain a desensitized text.

4. The method according to claim 3, characterized in that The construction process of the dictionary tree includes: According to the order of the characters in the sensitive words, each character of the sensitive word is taken as a node to construct a dictionary tree; Constructing a failure pointer for each of the nodes, wherein the failure pointer is used to point to other nodes having the same character as the node; The characters of each node are bit-compressed to obtain a status identifier of each node, wherein the status identifier indicates whether the node is the end of a sensitive word.

5. The method according to any one of claims 1 to 4, characterized in that The forwarding the desensitized message to the receiving object includes: According to the sending object or the receiving object, matching is performed from the proxy forwarding table to obtain a target communication port, wherein the target communication port is a communication port corresponding to the target message, and the proxy forwarding table represents the corresponding relationship between each system and the communication port; The desensitized message is forwarded to the receiving object of the target message through the target communication port corresponding to the target message, and the target communication port is used to establish proxy communication between the sending object and the receiving object.

6. The method according to claim 5, characterized in that The method further comprises: When the desensitization rule corresponding to any system in the desensitization rule base is updated, the communication port corresponding to each system in the proxy forwarding table is updated.

7. The method according to claim 5, characterized in that The method further comprises: For any communication port, if it is determined that the number of messages forwarded by the communication port is greater than the concurrency threshold within a unit period, an auxiliary port is determined from each available port; In the proxy forwarding table, the auxiliary port is associated with the communication port, and a validity period is set for the auxiliary port; wherein the validity period is positively correlated with the number of messages.

8. The method according to any one of claims 1 to 4, characterized in that The proxy server is configured with an interceptor, which intercepts the messages entering and leaving each system to obtain the target message, including: Acquire the protocol type of the messages entering and leaving each system, and determine the messages that meet the set protocol type as the messages to be processed; Determine the content type corresponding to each of the to-be-processed messages, and determine the to-be-processed messages whose content type is a text type as target messages; The target message is intercepted by the interceptor.

9. A desensitization device, characterized in that: The device includes an interception module, a target desensitization rule determination module and a desensitization module, wherein: The interception module intercepts the messages entering and leaving each system and obtains the target message; A target desensitization rule determination module is used to determine the target desensitization rule corresponding to the target message from a desensitization rule library based on the sending object and / or receiving object corresponding to the target message, and the desensitization rule library is used to maintain the desensitization rules corresponding to each system; A desensitizing module is used to perform desensitization processing on the target message based on the target desensitization rule to obtain a desensitized message, and forward the desensitized message to the receiving object.

10. A server comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: The server is a proxy server, and the processor implements the steps of the method according to any one of claims 1 to 8 when executing the computer program.

Images