Desensitization method, device and server

Abstract

This application relates to the technical field of data processing, and particularly to a desensitization method, device and server. The method is applied to a proxy server which can establish communications with various systems. The method includes: intercepting messages entering and leaving each system to obtain target messages; determining, based on the sending object and / or receiving object corresponding to the target messages, a target desensitization rule corresponding to the target messages from a desensitization rule library which is used to maintain the desensitization rules corresponding to each system; performing desensitization processing on the target messages based on the target desensitization rule to obtain desensitized messages, and forwarding the desensitized messages to the receiving object. Using the method of this application can reduce the cost for an enterprise to update the desensitization rules of each system, and thus more conveniently maintain the desensitization rules of each system.

Description

Technical Field

[0001] The present application relates to the technical field of data processing, and particularly to a desensitization method, apparatus, and server. Background Art

[0002] In today's information age, the development of network and data transmission technologies has greatly promoted the dissemination and sharing of information; however, the openness of information flow has also made the leakage of sensitive information and the spread of inappropriate information potential security risks. In reality, there are multiple subsystems in an enterprise, and the data transmitted by each system may contain confidential content, privacy information, or sensitive data that does not conform to ethical norms. Therefore, in order to enhance the security of data, it is usually necessary to configure a desensitization algorithm based on desensitization rules within each system, and different nodes within the same system may need to be separately configured with corresponding desensitization algorithms.

[0003] In the above data desensitization method, it is necessary to write desensitization-related code into the system. However, since the relevant desensitization rules need to be continuously updated to maintain timeliness, when an enterprise updates the sensitive rules of each system, it requires high costs in terms of manpower and material resources; moreover, there may even be some special systems in an enterprise, such as old systems that are difficult to expand, or closed systems without source code; for these special systems, the cost of modifying the internal code of the system is relatively high. Therefore, this further increases the cost of an enterprise to maintain data security.

[0004] Therefore, how to reduce the cost of an enterprise to maintain data security is an urgent problem to be solved. Summary of the Invention

[0005] Based on this, in view of the above technical problems, it is necessary to provide a desensitization method, apparatus, and server that can reduce the cost of an enterprise to update desensitization rules for each system.

[0006] In a first aspect, the present application provides a desensitization method applied to a proxy server that can establish communications with each system. The method includes:

[0007] Intercept the packets entering and leaving each system to obtain target packets;

[0008] Based on the sending object and / or receiving object corresponding to the target packet, determine the target desensitization rule corresponding to the target packet from a desensitization rule library for maintaining the desensitization rules corresponding to each system;

[0009] Perform desensitization processing on the target packet based on the target desensitization rule to obtain a desensitized packet, and forward the desensitized packet to the receiving object.

[0010] In one embodiment, the method further includes:

[0011] Extract the fields of the target message at preset positions, and determine the sending object and receiving object corresponding to the target message according to the extracted fields;

[0012] The desensitizing the target message based on the target desensitization rule to obtain a desensitized message includes:

[0013] Determine the target encryption / decryption rule corresponding to the target message according to the sending object or receiving object, and parse the target message based on the target encryption / decryption rule to obtain the target text corresponding to the target message;

[0014] Desensitize the target text based on the target desensitization rule to obtain a desensitized text, and encrypt the desensitized text based on the target encryption / decryption rule to obtain a desensitized message.

[0015] In one embodiment, the desensitizing the target text based on the target desensitization rule to obtain a desensitized text includes:

[0016] Retrieve the trie of sensitive words corresponding to the target desensitization rule, search in the trie based on the target text, and determine whether there are sensitive words in the target text according to the search result;

[0017] In the case where there are sensitive words in the target text, determine the replacement word corresponding to the sensitive word based on the replacement rule in the target desensitization rule, and the replacement word has the same length as the corresponding sensitive word;

[0018] Replace the sensitive word in the target text with the corresponding replacement word to obtain a desensitized text.

[0019] In one embodiment, the construction process of the trie includes:

[0020] According to the order of characters in the sensitive word, use each character of the sensitive word as a node to construct a trie;

[0021] Construct a failure pointer for each node, and the failure pointer is used to point to other nodes with the same character as this node;

[0022] Perform bit compression on the characters of each node to obtain the status identifier of each node, and the status identifier indicates whether this node is the end of a sensitive word.

[0023] In one embodiment, the forwarding the desensitized message to the receiving object includes:

[0024] Match from the proxy forwarding table according to the sending object or the receiving object to obtain a target communication port, where the target communication port is the communication port corresponding to the target message, and the proxy forwarding table represents the corresponding relationship between each system and the communication port;

[0025] Forward the desensitized message to the receiving object of the target message through the target communication port corresponding to the target message, where the target communication port is used to establish proxy communication between the sending object and the receiving object.

[0026] In one embodiment, the method further includes:

[0027] When the desensitization rule corresponding to any system in the desensitization rule library is updated, update the communication ports corresponding to each system in the proxy forwarding table.

[0028] In one embodiment, the method further includes:

[0029] For any communication port, if it is determined that the number of messages forwarded by the communication port within a unit period is greater than the concurrency threshold, determine an auxiliary port from the available ports;

[0030] In the proxy forwarding table, associate the auxiliary port with the communication port and set a validity period for the auxiliary port; where the validity period is positively correlated with the number of messages.

[0031] In one embodiment, an interceptor is configured in the proxy server, and intercepting the messages entering and leaving each system to obtain a target message includes:

[0032] Obtain the protocol type of the messages entering and leaving each system, and determine the messages that meet the set protocol type as the messages to be processed;

[0033] Determine the content type corresponding to each of the messages to be processed, and determine the messages to be processed with the content type of text type as the target messages;

[0034] Intercept the target message through the interceptor.

[0035] In a second aspect, the present application further provides a desensitization device, where the device includes an interception module, a target desensitization rule determination module, and a desensitization module, where:

[0036] The interception module intercepts the messages entering and leaving each system to obtain a target message;

[0037] A target desensitization rule determination module, configured to determine a target desensitization rule corresponding to the target message from a desensitization rule library based on a sending object and / or a receiving object corresponding to the target message, where the desensitization rule library is used to maintain desensitization rules corresponding to each system;

[0038] A desensitization module, configured to desensitize the target message based on the target desensitization rule to obtain a desensitized message, and forward the desensitized message to the receiving object.

[0039] In a third aspect, the present application further provides a server, where the server is a proxy server, including a memory and a processor. The proxy server can establish communication with each system. The memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0040] Intercept messages entering and leaving each system to obtain a target message;

[0041] Based on a sending object and / or a receiving object corresponding to the target message, determine a target desensitization rule corresponding to the target message from a desensitization rule library, where the desensitization rule library is used to maintain desensitization rules corresponding to each system;

[0042] Desensitize the target message based on the target desensitization rule to obtain a desensitized message, and forward the desensitized message to the receiving object.

[0043] In a fourth aspect, the present application further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0044] Intercept messages entering and leaving each system to obtain a target message;

[0045] Based on a sending object and / or a receiving object corresponding to the target message, determine a target desensitization rule corresponding to the target message from a desensitization rule library, where the desensitization rule library is used to maintain desensitization rules corresponding to each system;

[0046] Desensitize the target message based on the target desensitization rule to obtain a desensitized message, and forward the desensitized message to the receiving object.

[0047] In a fifth aspect, the present application further provides a computer program product, including a computer program. When the computer program is executed by a processor, the following steps are implemented:

[0048] Intercept messages entering and leaving each system to obtain a target message;

[0049] Based on the sending object and / or receiving object corresponding to the target message, determine the target desensitization rule corresponding to the target message from the desensitization rule library, where the desensitization rule library is used to maintain the desensitization rules corresponding to each system;

[0050] Perform desensitization processing on the target message based on the target desensitization rule to obtain a desensitized message, and forward the desensitized message to the receiving object.

[0051] The above desensitization method, device, and server have at least the following beneficial effects;

[0052] 1. By setting up an independent proxy server that can communicate with each system, the desensitization rules corresponding to each system are configured in the desensitization rule library of the proxy server. In this way, after intercepting the messages entering and leaving each system through the proxy server to obtain the target message, the target desensitization rule corresponding to the target message can be determined from the desensitization rule library for the corresponding system (sending object or request object) in the target message. Then, the target message can be desensitized through the target desensitization rule to obtain a desensitized message; the proxy server further sends the desensitized message to the receiving object corresponding to the original target message, so that the desensitization processing and message forwarding of the data entering and leaving the system can be completed through the proxy server; compared with the related technology, in the method of this application, the administrator can conveniently modify the desensitization rules (related data and program codes) corresponding to each system in the data storage system of the proxy server, and supports batch modification of the desensitization rules corresponding to multiple systems, and the modification of the code configured in the proxy server is relatively simple, thus reducing the cost of modifying the desensitization rules within each system for the enterprise;

[0053] 2. The correspondence between each system and the port in the proxy forwarding table can be updated, and the updated correspondence between each system and the port does not overlap with the correspondence between each system and the port before the update. That is to say, each update changes the communication ports corresponding to each system, thereby reducing the risk of the system using a single communication port for a long time, and thus enhancing the security of the data for proxy communication implemented through the proxy server.

[0054] 3. The proxy server obtains the number of forwarded packets of each communication port in the ended unit period every other unit period, and determines whether the number of packets is greater than the concurrency threshold; for any communication port, if the number of its packet forwards is greater than the concurrency threshold, it is determined that the communication port is a busy port, indicating that the burden on this communication port is relatively large; that is to say, the task volume of the system corresponding to this busy port is relatively large, and this system is a busy system; at this time, if it is determined that there is no spare port for the busy system in the forwarding proxy table, an auxiliary port is determined from the available empty ports of the proxy server, where the IP address of the auxiliary port is in the same network segment as the IP address of the busy port, so that it is not necessary to occupy too many network bridges of the proxy server for data routing; and the auxiliary port is added to the proxy forwarding table corresponding to the busy system, so that the auxiliary port and the busy port can simultaneously perform the packet forwarding task for the busy system, thereby improving the packet forwarding efficiency. Description of the Drawings

[0055] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the following will briefly introduce the drawings required for use in the description of the embodiments or related technologies. Obviously, the following drawings are only some embodiments of the present application. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0056] Figure 1 It is an application environment diagram of the desensitization method in an embodiment;

[0057] Figure 2 It is a flowchart of the desensitization method in an embodiment;

[0058] Figure 3 It is an example diagram of the desensitization rule in an embodiment;

[0059] Figure 4 It is a flowchart of the steps for determining the target packet in an embodiment;

[0060] Figure 5 It is a flowchart of the process for processing the target packet in an embodiment;

[0061] Figure 6 It is a flowchart of the desensitization processing steps in an embodiment;

[0062] Figure 7 It is a flowchart of the proxy server load balancing in an embodiment;

[0063] Figure 8 It is a schematic diagram of the implementation process of the desensitization method in another embodiment;

[0064] Figure 9An example diagram of the implementation logic of the desensitization method in an embodiment;

[0065] Figure 10 A structural block diagram of the desensitization device in an embodiment;

[0066] Figure 11 The internal structure diagram of the server in an embodiment. Detailed implementation manners

[0067] To make the objectives, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, and are not used to limit the present application.

[0068] The desensitization method provided by the embodiments of the present application can be applied to an application environment as shown in Figure 1 Among them, the proxy server can establish communications with each system (such as System 1, System 2, System 3...). The request messages sent by the user's computer device to each system and the response messages sent by each system to the user's computer device can both be intercepted by the proxy server, and the intercepted messages can be desensitized by using the desensitization method of the embodiments of the present application.

[0069] The data storage system can store the data that the proxy server needs to process. The data storage system can be integrated on the proxy server, or can be placed in the cloud or other network servers. Among them, the user's computer device can be, but is not limited to, various personal computers, laptop computers, smart phones, tablet computers, Internet of Things devices, and portable wearable devices. The Internet of Things devices can be smart speakers, smart TVs, smart air conditioners, smart vehicle-mounted devices, etc. The portable wearable devices can be smart watches, smart bracelets, head-mounted devices, etc. The proxy server can be implemented by an independent server or a server cluster composed of multiple servers.

[0070] In an exemplary embodiment, as shown in Figure 2 A desensitization method is provided. Taking the method applied to the proxy server in Figure 1 as an example, the method includes the following steps 10-step 30, where:

[0071] Step 10: Intercept the messages entering and leaving each system to obtain the target messages.

[0072] For the embodiments of this application, the target message is a message that conforms to a specific type, such as a message that conforms to a preset protocol type, and / or can also be a message that conforms to a preset content type. Of course, the target message can also be of other types, which are not specifically limited in the embodiments of this application. The target message can be a request message sent by the user's computer device to the system, or a response message sent by the system to the user's computer device. Intercepting the message is achieved through an interceptor. Intercepting the messages entering and leaving the system through an interceptor is a mechanism in the communication system. This mechanism allows developers to modify, check, or record them before the request is sent or the response is received.

[0073] Step 20: Based on the sending object and / or receiving object corresponding to the target message, determine the target desensitization rule corresponding to the target message from the desensitization rule library, where the desensitization rule library is used to maintain the desensitization rules corresponding to each system.

[0074] For the embodiments of this application, for the request message sent by the user's computer device to the system, the sending object is the user's computer device, and the receiving object is the corresponding target system; for the response message sent by the system to the user's computer device, the sending object is the system, and the receiving object is the target user's computer device. The desensitization rule library is pre-stored in the data storage system of the proxy server. The data storage system can be integrated on the proxy server, or can be placed on the cloud or other network servers.

[0075] The administrator can modify the desensitization rules corresponding to each system in the data storage system of the proxy server. Among them, it can be the relevant data referenced by the desensitization rules, such as the correspondence between sensitive words and replacement words and the sensitive word library, or it can be the program code corresponding to the implementation of the desensitization rules.

[0076] Among them, what can be stored in the desensitization rule library are the desensitization rules corresponding to each system; for the target message, if the target message is a request message, the target desensitization rule is determined from the desensitization rule library based on the receiving object of the target message (the target system to which the message is to be sent); if the target message is a response message, the target desensitization rule is determined from the desensitization rule library based on the sending object of the target message (the system that sends the message).

[0077] Among them, an example of the desensitization rule is Figure 3 as shown. Among them, the desensitization rule can include the matching rule for sensitive words, the interception method (desensitization method), and the display rule (replacement rule).

[0078] Step 30: Perform desensitization processing on the target message based on the target desensitization rule to obtain a desensitized message, and forward the desensitized message to the receiving object.

[0079] For the embodiments of the present application, after determining the target desensitization rule corresponding to the target message, the target message is modified by the target desensitization rule to obtain the desensitized message. Moreover, for the target message, if the target message is a request message, the desensitized message is sent to the receiving object (target system) of the target message; if the target message is a response message, the desensitized message is sent to the receiving object corresponding to the target message (the computer device of the target user).

[0080] In the above desensitization method, by setting up an independent proxy server that can communicate with each system, the desensitization rules corresponding to each system are configured in the desensitization rule library of the proxy server. In this way, after the proxy server intercepts the messages entering and leaving each system to obtain the target message, then for the corresponding system (sending object or request object) in the target message, the target desensitization rule corresponding to the target message can be determined from the desensitization rule library, and then the target message can be desensitized through the target desensitization rule to obtain the desensitized message; the proxy server further sends the desensitized message to the receiving object corresponding to the original target message, so that the desensitization processing of the data entering and leaving the system and the forwarding of the message can be completed through the proxy server; compared with the related art, in the method of the present application, the administrator can conveniently modify the desensitization rules (related data and program codes) corresponding to each system in the data storage system of the proxy server, and supports batch modification of the desensitization rules corresponding to multiple systems, and the modification of the code configured in the proxy server is relatively simple, thus reducing the cost of modifying the desensitization rules in each system of the enterprise.

[0081] Furthermore, in one of the embodiments, as Figure 4 shown, step 10 may specifically include steps 11 - 13, where:[[]]END]]

[0082] Step 11: Obtain the protocol type of the messages entering and leaving each system, and determine the messages that meet the set protocol type as the messages to be processed.

[0083] In the embodiments of the present application, the protocol types are set to HTTP (Hypertext Transfer Protocol) and HTTPS (Hypertext Transfer Protocol Secure); HTTP messages have a specific format, usually including a request line (for request messages) or a status line (for response messages), as well as header fields and an optional message body. HTTP runs on top of the TCP layer and is a plaintext transmission protocol; HTTPS runs on top of the SSL (Secure Socket Layer) / TLS (Transport Layer Security) layer and then to the TCP (Transmission Control Protocol) layer; among them, SSL / TLS is responsible for encrypting and decrypting the transmitted data, making the data secure during transmission. And usually, the HTTP protocol type defaults to use port 80, and the HTTPS protocol type defaults to use port 443. Therefore, in the embodiments of the present application, the message can be determined whether it is a message to be processed by checking the port number or checking the header fields of the message.

[0084] Step 12: Determine the content type corresponding to each message to be processed, and determine the message to be processed with the content type of text type as the target message.

[0085] Furthermore, in another possible implementation manner, for an unencrypted message, it is also possible to determine whether a message is a message to be processed that conforms to the set protocol type by parsing the content of the message. For example, after parsing a request message, the request method, request URI (Uniform Resource Identifier), and version of the transport protocol of the message can be obtained; among them, common HTTP request methods include GET, POST, PUT, DELETE, etc.; common HTTP versions are usually HTTP / 1.0, HTTP / 1.1, or HTTP / 2.0. Then, it is determined whether the request message is a message to be processed based on at least one of the request method, request URI, and version of the transport protocol obtained by parsing the request message.

[0086] After parsing a response message, the status line of the message (the first line of the response message, composed of the HTTP version, status code, and status message), header fields (containing a series of key-value pairs that provide additional information about the response), and the response body (containing the actual data) can be obtained; then, based on at least one of the status line, header fields, and response body parsed from the response message, it is determined whether the message is a message to be processed that conforms to the set protocol type.

[0087] Furthermore, by checking the MIME (Multipurpose Internet Mail Extensions) type in the message to determine the corresponding content type in the message to be processed; it is also possible to determine the corresponding content type in the message to be processed by analyzing the file extension in the message; it is also possible to call a preset content sniffing component to process the message to be processed, and then obtain the corresponding content type of the message to be processed. The specific method for determining the content type in the message to be processed is not specifically limited in the embodiments of the present application. Further, when it is determined that the content type corresponding to the message to be processed is text content, the message to be processed is determined as the target message for interception.

[0088] Step 13: Intercept the target message through an interceptor.

[0089] Specifically, in the embodiments of the present application, the proxy server is a high-performance proxy server implemented based on Netty; an interceptor is configured in the proxy server. An interceptor is a mechanism that can intercept and process during the HTTP request and response processes, and it is usually integrated in the network request library. The working principle of the interceptor is to intercept the request message before it is sent or the response message after it is received, and perform some custom operations, such as modifying request parameters, adding request headers, logging, etc.

[0090] In one of the embodiments, after determining the target message with the Http or Https protocol type and the content type being text type, the proxy server will select the corresponding target communication port to establish proxy communication between the sending object and the receiving object of the target message. The process of determining the target communication port can specifically include: matching from the proxy forwarding table according to the sending object or the receiving object to obtain the target communication port.

[0091] Among them, the target communication port is the communication port corresponding to the target message, and the proxy forwarding table represents the corresponding relationship between each system and the communication port; the target communication port is used to establish proxy communication between the sending object and the receiving object.

[0092] After determining the target communication interface, the target message intercepted by the interceptor is sent to the proxy server through the target communication port, so that the proxy server performs desensitization processing on the target message to obtain a desensitized message, and the proxy server sends the desensitized message to the recipient of the target message through the target communication port. Thus, the desensitization and proxy forwarding processes of the target message are realized through the proxy server.

[0093] Furthermore, since the proxy server intercepts, desensitizes, and forwards the messages for communication between users and various systems, the security of the proxy server is particularly important. Since the proxy forwarding table determines the communication ports for forwarding messages to various systems, if the correspondence between the systems and ports in the proxy forwarding table remains unchanged all the time, there is a relatively high risk of leakage; if the correspondence between the communication ports and the systems is leaked, it may be possible to launch an attack on a certain system or perform long-term data hijacking, thus affecting the security of the data.

[0094] Therefore, in order to further enhance the security of the data, in the embodiments of the present application, for the proxy forwarding table in the proxy server, an update rule is set. When any update rule is satisfied, the correspondence between each system and port in the proxy forwarding table can be updated, thereby reducing the risk of leakage of the correspondence between the port and the system.

[0095] Specifically, the update rule includes: when the desensitization rule corresponding to any system in the desensitization rule library is updated, the communication ports corresponding to each system in the proxy forwarding table are updated.

[0096] Furthermore, the update rule also includes: updating the communication ports corresponding to each system in the proxy forwarding table every set update period. Among them, the update period can be a set fixed value. For example, the update period can be set to 3 days; the update period can also be a set dynamic value. For example, a digital sequence is set, and the order of the numbers in the digital sequence represents the order of the update period, and the size of the numbers in the digital sequence represents the duration of the corresponding update period.

[0097] When the update rule is satisfied, the correspondence between each system and port in the proxy forwarding table can be updated. Specifically, the correspondence between each system and port after the update does not overlap with the correspondence between each system and port before the update. That is to say, each update changes the communication ports corresponding to each system, thereby reducing the risk that the system uses a single communication port for a long time, and thus enhancing the security of the data for proxy communication realized through the proxy server.

[0098] In one of the embodiments, referring to Figure 5 , step 30 may specifically include steps 31 - 33, where:

[0099] Step 31: Extract the fields of the target message at the preset positions, and determine the sender and receiver corresponding to the target message based on the extracted fields.

[0100] Specifically, after determining the target message with the Http or Https protocol type and the content type being text type, if the text content corresponding to the target message is encrypted, the target message needs to be decrypted accordingly to obtain the text content corresponding to the target message. And usually, the message is encrypted due to the corresponding data format specifications of the system. That is to say, to determine the encryption and decryption algorithm corresponding to the target message, it is necessary to determine the system corresponding to the target message. Further, extract the fields at the preset positions of the target message, and then judge the sender and receiver of the target message, and then judge the system corresponding to the target message.

[0101] Among them, the destination node name (i.e., the domain name or IP address of the receiver) can be obtained by parsing the "Host" field of the target message; the source node name (i.e., the domain name or IP address of the sender) can be obtained by parsing the "Referer" field or "Origin" field of the message. Of course, it is also possible to call a preset network protocol analysis tool to analyze the target message, and then obtain the sender and receiver of the target message.

[0102] Step 32: Determine the target encryption and decryption rules corresponding to the target message according to the sender or receiver, and parse the target message based on the target encryption and decryption rules to obtain the target text corresponding to the target message;

[0103] Step 33: Perform desensitization processing on the target text based on the target desensitization rules to obtain the desensitized text, and encrypt the desensitized text based on the target encryption and decryption rules to obtain the desensitized message.

[0104] Specifically, the proxy server pre-stores the encryption and decryption algorithms corresponding to each system. After determining the sender and receiver of the target message, the encryption and decryption algorithm of the system corresponding to the target message is used as the target encryption and decryption algorithm, and then the content of the target message is parsed according to the target encryption and decryption algorithm to obtain the target text corresponding to the target message. Further, perform desensitization processing on the target text according to the target desensitization rules determined by the system corresponding to the target message to obtain the desensitized text corresponding to the target text; reorganize the desensitized text into a message to obtain the desensitized message corresponding to the target message. Then the proxy server forwards the desensitized message corresponding to the target message to the receiver corresponding to the target message through the determined target communication port, thus completing the desensitization processing and proxy forwarding process of the target message.

[0105] Further, referring to Figure 6 , Step 33 can specifically include Steps 331 - 333, where:

[0106] Step 331, retrieve the trie of sensitive words corresponding to the target desensitization rule, search in the trie based on the target text, and determine whether there are sensitive words in the target text according to the search result.

[0107] Specifically, the trie of sensitive words is pre-constructed based on multiple sensitive words stored in a preset sensitive word library, and the trie is a Trie tree structure. The process of constructing the trie includes: taking the characters of each sensitive word as a node in the order of the characters in the sensitive word library to construct the trie; constructing a failure pointer for each node, and the failure pointer is used to point to other nodes with the same characters as the node; performing bit compression on the characters of each node to obtain the status identifier of each node, and the status identifier indicates whether the node is the end of a sensitive word.

[0108] Further explain the process of constructing the trie: organize all sensitive words into a Trie tree, each node of the Trie tree represents a character, and the character sequence passed on the path from the root node to a certain node represents a prefix. Then create a root node of the Trie tree, and for each sensitive word, start from the root node and insert it into the Trie tree character by character. If the child node corresponding to the current character does not exist, create a new child node; after traversal, mark the end of the sensitive word on the last node.

[0109] Further construct a failure pointer for each node of the Trie tree. The failure pointer points to the next node that should be jumped to when the match fails at the current node. Initialize a queue, enqueue the root node of the Trie tree (whose failure pointer points to itself or is empty), and for each node in the queue, traverse all the child nodes of the node. If the node pointed to by the failure pointer of the parent node of the child node has a child node with the same character as the child node, then point the failure pointer of the child node to this same child node; if the node pointed to by the failure pointer of the parent node of the child node does not have a child node with the same character as the child node, continue to search upward along the failure pointer until a node with a child node of the same character is found, or reach the root node; then point the failure pointer of the child node to the found child node with the same character (if the root node is still not found, point to the root node or is empty). Through the above method, complete the construction process of the trie of sensitive words corresponding to each system; among them, the process of constructing the failure pointer uses the breadth-first search BFS algorithm or the Aho-Corasick algorithm.

[0110] After determining the trie in the target desensitization rule corresponding to the target text, the proxy server retrieves the trie into the memory for loading, searches in the trie based on the target text to obtain the search result, and then further determines whether there are sensitive words in the target text according to the search result.

[0111] And in order to further reduce the state storage of the trie, the states of each node can be compressed, that is, the character information of each node in the trie and information such as the termination mark of the sensitive word are stored in advance using bit operations. In a possible implementation, an integer state is assigned to each node using bit compression, and the state information of each node is represented using bit compression. For example, the high 16 bits represent the index of the current character, and the low 16 bits are used to indicate whether it is a termination state (that is, whether the node is the end of a sensitive word). By constructing a state transition graph for each sensitive word in the trie, and then constructing a table based on the state transition graph of each sensitive word as the bit-compressed access state table of the trie; bit operations can be used to quickly locate the transition in the bit-compressed access state table.

[0112] Furthermore, in the embodiment of the present application, the DFA (Deterministic Finite Automaton) algorithm is used to search for the target text in the trie to obtain the search result, where the search result includes the sensitive word and the position of the sensitive word in the target text.

[0113] The time complexity of the DFA algorithm mainly depends on the length of the text content and the efficiency of sensitive word matching. Since the DFA algorithm performs matching based on state transition, it only needs to scan the text to be detected once to detect all sensitive words. It should be noted that the time complexity of the DFA algorithm is independent of the number of sensitive words and only related to the text length. This means that no matter how many sensitive words there are in the sensitive word library, the DFA algorithm can complete the recognition of sensitive words in the entire text in the same amount of time; therefore, compared with the method of using regular expressions for sensitive word recognition in the related art, in the solution of this embodiment, the DFA algorithm based on state compression (constructing the state transition graph of the trie based on bit operations) for sensitive word recognition has higher efficiency, thereby being able to shorten the time required for desensitizing the target message.

[0114] Step 332: Based on the replacement rule in the target desensitization rule, determine the replacement word corresponding to the sensitive word, and the replacement word has the same length as the corresponding sensitive word.

[0115] Step 333: Replace the sensitive word in the target text with the corresponding replacement word to obtain the desensitized text.

[0116] Specifically, for the identified sensitive words, the replacement rules in the target desensitization rules are retrieved and loaded into the memory; the replacement rules represent the corresponding relationship between the sensitive words and the replacement words. Among them, the sensitive words can be a word or a character; for the sensitive words that are words or characters, the replacement words can also be words or characters; and, the sensitive words can also be specific types of privacy data, such as mobile phone numbers, email addresses, etc.; for the sensitive words that are privacy data, the corresponding replacement words can be words or symbols. For example, for the case where the sensitive word is a mobile phone number, the "*" symbol can be used as a character to replace some of the numbers in the mobile phone number. The specific corresponding relationship between the sensitive words and the replacement words is not specifically limited in the embodiments of the present application. However, it should be noted that the length of the replacement word should be the same as the length of the corresponding sensitive word, so that the length of the desensitized text obtained after desensitization is consistent with the length of the target text.

[0117] Further, since the proxy server intercepts and desensitizes the packets entering and leaving each system, therefore, in the case of a large number of packet requests, it will bring a large burden to the communication ports corresponding to each system in the origin server. Therefore, in order to improve the forwarding efficiency of the packets entering and leaving each system, in the embodiments of the present application, the desensitization method further includes a load balancing process, referring to Figure 7 , which may specifically include step 40 and step 50, where:

[0118] Step 40: For any communication port, if it is determined that the number of packets forwarded by the communication port within a unit period is greater than the concurrency threshold, then determine an auxiliary port from each available port;

[0119] Step 50: In the proxy forwarding table, associate the auxiliary port with the communication port and set a validity period for the auxiliary port; where the validity period is positively correlated with the number of packets.

[0120] Specifically, in the proxy forwarding table, there may be only one communication port corresponding to each system, or there may be multiple communication ports. Among them, the number of communication ports corresponding to each system in the proxy forwarding table can be set by the user based on actual business requirements, or determined based on the historical number of packet processes of each system.

[0121] The proxy server obtains the number of forwarded packets of each communication port during the ended unit period every other unit period, and determines whether the number of packets is greater than the concurrency threshold; for any communication port, if the number of its packet forwards is greater than the concurrency threshold, it is determined that the communication port is a busy port, indicating that the burden on this communication port is relatively large; that is to say, the task volume of the system corresponding to this busy port is relatively large, and this system is a busy system. At this time, if it is determined that there is no spare port for the busy system in the forwarding proxy table, an auxiliary port is determined from the available empty ports of the proxy server, where the IP address of the auxiliary port is in the same network segment as the IP address of the busy port, so that it is not necessary to occupy too many network bridges of the proxy server for data routing. And the auxiliary port is added to the proxy forwarding table corresponding to the busy system, so that the auxiliary port and the busy port can simultaneously perform the packet forwarding task for the busy system, thereby improving the packet forwarding efficiency.

[0122] Moreover, in order to avoid excessive occupation of ports, each auxiliary port is set with a validity period, where the validity period is positively correlated with the number of packets forwarded by the busy port determined when determining the busy port. For the specific correspondence between the validity period and the number of packets, it is not specifically limited in the embodiments of the present application.

[0123] It should be noted that the concurrency threshold corresponding to each communication port can be the same or different, and can be specified by the user; however, the concurrency threshold corresponding to each communication port should be less than or equal to 80% of the limit forwarding quantity corresponding to this communication port, so as to retain sufficient redundant performance for the proxy server to reduce the probability of congestion occurring in each communication port.

[0124] In an exemplary embodiment, referring to Figure 8 , the present application provides a desensitization method, and the specific implementation process may include steps S1-step S4, where:

[0125] S1. Construct a high-performance proxy server;

[0126] S2. Implement a customized forwarding function on the proxy server and construct a general request interceptor;

[0127] S3. Implement the DFA algorithm for state compression and multi-pattern matching, and implement the management function of sensitive words;

[0128] S4. Intercept the request and perform sensitive word filtering on the request content and response content.

[0129] Specifically, in step S1, a high-performance Http proxy server is implemented based on the Netty framework. A general proxy forwarding configuration is designed, and the proxy forwarding effect is implemented according to the configuration file. An example of the configuration file is localPort=8080; remoteHost=10.64.12.89; remotePort=8081. Among them, localPort describes the startup port (target communication port) of the proxy server itself, remoteHost describes the IP of the target system, and remotePort describes the communication port of the target system.

[0130] Specifically, in step S2, in the proxy server, a general interceptor is pre-configured. The request is intercepted by inheriting the ChannelInboundHandlerAdapter class adapter of Netty; by intercepting the request or the returned object, it is judged whether its type is an HttpRequest or HttpResponse object, and only the packets corresponding to Http requests and Https requests are processed. In the embodiment of the present application, all Http and Https packet requests entering and leaving each system are identified and intercepted, and the intercepted packets are analyzed to obtain the packets with the content type of text type as the target packets to be desensitized.

[0131] Specifically, in step S3, a sensitive word matching algorithm based on the DFA algorithm of state compression and multi-pattern matching is implemented. A dictionary tree of sensitive words is constructed for each system in advance. The dictionary tree is the Trie tree. The specific implementation method is: organize the sensitive words corresponding to each system in the sensitive word library into a Trie tree, and use the Aho-Corasick algorithm to construct the state transition and failure pointers of each node in the Trie tree. At the same time, in order to reduce state storage, the state of each node can be compressed, and bit operations are used to store information such as the character information of the node and the termination mark of the sensitive word. The specific process of constructing the Trie tree includes: constructing the Trie tree: storing the sensitive words in the Trie tree; state encoding: using bit compression to assign an integer state to each node. In an example, bit compression can be used to represent the state information of each node. For example, the high 16 bits represent the index of the current character, and the low 16 bits are used to represent whether it is a termination state (that is, whether the node is the end of a sensitive word); failure pointer construction: with the help of the Aho-Corasick algorithm, connect the states of partial matches through the failure pointer; bit compression access state table: use bit operations to quickly locate the conversion in the state table.

[0132] For the input string (target text) and the set of sensitive words , the recognition performance of sensitive words in the text content by the DFA algorithm based on state compression and multi-pattern matching is represented by time complexity and space complexity, where: Time complexity: In the construction phase, it is ; in the matching phase, it is ; the total complexity is . Space complexity: The space complexity is .

[0133] The time complexity of the construction phase indicates that the time required to construct the Trie tree and related data structures is proportional to the total length of all sensitive words, is the input string and is the number of sensitive words in ; the time complexity of the matching phase indicates that the time required for sensitive word matching is proportional to the length of the text (string ). The total time complexity is the sum of the construction and matching phases. The space complexity

[0134] indicates that the space required to store the Trie tree and other related data structures is proportional to the total length of all sensitive words. ; where is the length of the text, is the number of sensitive words or the complexity of the regular expression. The recognition performance of sensitive words in the text content by the DFA algorithm based on state compression and multi-pattern matching adopted in this application is significantly better than the performance of the recognition algorithm for sensitive words constructed by regular expressions in the related art.

[0135] When the system in the proxy server starts up, the proxy server obtains the target message, determines the target desensitization rule corresponding to the target message, then loads the corresponding Trie tree in the target desensitization rule from the pre-stored database into the memory of the proxy server, provides an interface (target communication port) for sensitive word filtering, and implements the forwarding process of the request message.

[0136] Further, in step S4, the interceptors configured in S2 are used to intercept Http and Https requests; by intercepting the requests, it is determined whether the current request message is in text format. If it is in text format, it is processed; otherwise, it is skipped. The stream is parsed according to the encoding format defined by each system to obtain the text content (target text) in the target message; the sensitive word algorithm implemented in step S3 is used to identify and replace sensitive words in the target text to obtain the desensitized text after desensitization processing; and, during the replacement process, the length of the replacement word is the same as the length of the corresponding sensitive word, without modifying the text length, so that the length of the target text before desensitization is the same as the length of the desensitized text after desensitization.

[0137] If the original message (target message) is signed and encrypted, the desensitized text needs to be re-signed and encrypted according to the signature and encryption algorithms provided by the system corresponding to the target message, so as to reassemble the desensitized text into a new message (desensitized message), and then the desensitized message is forwarded to the receiving object corresponding to the original message (target message).

[0138] In one example, as Figure 9 shown, to demonstrate the logic implemented by the desensitization method provided in the embodiments of the present application between the user's computer device and each system:

[0139] The request message (text content) sent by User 1 to Business System A is intercepted by the interceptor, and the proxy server uses this request message as the target message that needs to be desensitized. And this request message requests port 1007 of the proxy server, and port 1007 is used as the target communication port to achieve proxy communication between User 1 and Business System A. After the target message is desensitized by the proxy server, a desensitized message is obtained, and the proxy server forwards the desensitized message to Business System A. The proxy server intercepts the request with sensitive words, blocks it or replaces the sensitive information according to the policy and then sends it to System A. And the interceptor can also intercept the response message from Business System A to User 1. The proxy server desensitizes the response message fed back from Business System A to User 1 to obtain the desensitized message after desensitization, and then forwards the desensitized message as the response message to User 1.

[0140] The request message (text content) sent by User 2 to Business System B is intercepted by the interceptor, and the proxy server uses this request message as the target message to be desensitized. Moreover, this request message requests the 1008 port of the proxy server, and the 1007 port is used as the target communication port to implement proxy communication between User 1 and Business System A. After the target message is desensitized by the proxy server, a desensitized message is obtained, and the proxy server forwards the desensitized message to Business System B. The proxy server intercepts the request with sensitive words, blocks it according to the policy or replaces the sensitive information and then sends it to System B. And the interceptor can also intercept the response message of Business System A to User 2. The proxy server desensitizes the response message fed back from Business System B to User 2 to obtain the desensitized message, and then forwards the desensitized message as the response message to User B.

[0141] Among them, the process of determining the target communication port of the target message can specifically include: matching from the proxy forwarding table according to the sending object or the receiving object to obtain the target communication port corresponding to the target message. Among them, the proxy forwarding table represents the corresponding relationship between each system and the communication port, and the target communication port is used to establish proxy communication between the sending object and the receiving object.

[0142] By supporting the rules of different systems through the pre-configured proxy server, supporting multiple matching rules for sensitive words, supporting regular expression matching such as mobile phone numbers and email addresses, supporting customized display rules, simultaneously supporting sensitive word rules and interception rules, and supporting the configuration of multiple sensitive word libraries. By executing the desensitization method of the embodiment of the present application in the proxy server, it can be realized that there is no sensitive information in the message input to the system, and at the same time, there is no sensitive information in the message fed back to the user; and the advantage of the present application is that it can realize unified management of sensitive word matching rules and sensitive word replacement rules for each system, and different sensitive matching strategies and display strategies can be configured according to different business systems; and the present application realizes a non-invasive sensitive word desensitization solution for each system through the proxy server, and can replace and display sensitive words without changing the original system code, without any impact on the original system; and, the present application uses the DFA algorithm based on state compression and multi-pattern matching to identify and replace sensitive words in the message, supports multiple sensitive word matching in one scan, so the recognition efficiency of sensitive words is relatively high.

[0143] It should be understood that although the steps in the flowcharts involved in the above embodiments are sequentially shown according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless there is a clear indication in this article, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages. These steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be executed alternately or in turn with at least a part of other steps or steps or stages in other steps.

[0144] Based on the same inventive concept, an embodiment of the present application further provides a desensitization device for implementing the above-mentioned desensitization method. The implementation solution provided by this device to solve problems is similar to the implementation solution described in the above method. Therefore, the specific limitations in one or more embodiments of the desensitization device provided below can refer to the limitations on the desensitization method in the above text, and will not be repeated here.

[0145] In an exemplary embodiment, as Figure 10 shown, a desensitization device is provided. The device includes an interception module 1001, a target desensitization rule determination module 1002, and a desensitization module 1003, where:

[0146] The interception module 1001 intercepts the messages entering and leaving each system to obtain the target message;

[0147] The target desensitization rule determination module 1002 is used to determine the target desensitization rule corresponding to the target message from the desensitization rule library based on the sending object and / or receiving object corresponding to the target message. The desensitization rule library is used to maintain the desensitization rules corresponding to each system;

[0148] The desensitization module 1003 is used to desensitize the target message based on the target desensitization rule to obtain the desensitized message, and forward the desensitized message to the receiving object.

[0149] In the above desensitization device, by setting up an independent proxy server that can communicate with each system, the desensitization rules corresponding to each system are configured in the desensitization rule library of the proxy server. In this way, after intercepting the packets entering and leaving each system through the proxy server to obtain the target packet, the target desensitization rule corresponding to the target packet can be determined from the desensitization rule library for the corresponding system (sender or requester) in the target packet, and then the target packet can be desensitized through the target desensitization rule to obtain the desensitized packet; the proxy server further sends the desensitized packet to the receiving object corresponding to the original target packet, so that the desensitization processing of the data entering and leaving the system and the forwarding of the packet can be completed through the proxy server; compared with the related technology, in the method of this application, the manager can conveniently modify the desensitization rules (related data and program codes) corresponding to each system in the data storage system of the proxy server, and supports batch modification of the desensitization rules corresponding to multiple systems, and the modification of the code configured in the proxy server is relatively simple, thus reducing the cost of modifying the desensitization rules in each system for the enterprise.

[0150] In one embodiment, the desensitization module 1003 is specifically configured to:

[0151] Extract the fields of the target packet at the preset positions, and determine the sender and receiver corresponding to the target packet according to the extracted fields;

[0152] Determine the target encryption / decryption rule corresponding to the target packet according to the sender or receiver, and parse the target packet based on the target encryption / decryption rule to obtain the target text corresponding to the target packet;

[0153] Perform desensitization processing on the target text based on the target desensitization rule to obtain the desensitized text, and encrypt the desensitized text based on the target encryption / decryption rule to obtain the desensitized packet.

[0154] In one embodiment, the desensitization module 1003 is specifically configured to:

[0155] Retrieve the trie of sensitive words corresponding to the target desensitization rule, search based on the target text in the trie, and determine whether there are sensitive words in the target text according to the search result;

[0156] In the case where there are sensitive words in the target text, determine the replacement word corresponding to the sensitive word based on the replacement rule in the target desensitization rule, and the replacement word has the same length as the corresponding sensitive word;

[0157] Replace the sensitive words in the target text with the corresponding replacement words to obtain the desensitized text.

[0158] In one embodiment, the device further includes a construction module, and the construction module is specifically configured to:

[0159] According to the order of characters in the sensitive words, take the characters of each sensitive word as a node to construct a trie tree;

[0160] Construct a failure pointer for each node, and the failure pointer is used to point to other nodes with the same characters as this node;

[0161] Perform bit compression on the characters of each node to obtain the status identifier of each node, and the status identifier indicates whether this node is the end of a sensitive word.

[0162] In one embodiment, the desensitization module 1003 is specifically configured to:

[0163] Match according to the sending object or the receiving object from the proxy forwarding table to obtain the target communication port corresponding to the target message, and the proxy forwarding table represents the corresponding relationship between each system and the communication port;

[0164] Forward the desensitized message to the receiving object of the target message through the target communication port corresponding to the target message, and the target communication port is used to establish proxy communication between the sending object and the receiving object.

[0165] In one embodiment, the desensitization device further includes an update module, and the update module is specifically configured to:

[0166] When the desensitization rule corresponding to any system in the desensitization rule library is updated, update the target communication port corresponding to any system in the proxy forwarding table.

[0167] In one embodiment, the desensitization device further includes a load balancing module, and the load balancing module is specifically configured to:

[0168] For any communication port, if it is determined that the number of messages forwarded by the communication port within a unit period is greater than the concurrency threshold, determine an auxiliary port from each available port;

[0169] In the proxy forwarding table, associate the auxiliary port with the communication port and set a validity period for the auxiliary port; wherein, the validity period is positively correlated with the number of messages.

[0170] In one embodiment, an interceptor is configured in the proxy server, and the interception module 1001 is specifically configured to:

[0171] Obtain the protocol type of the messages entering and leaving each system, and determine the messages that meet the set protocol type as the messages to be processed;

[0172] Determine the content type corresponding to each message to be processed, and determine the message to be processed with the content type of text type as the target message;

[0173] Intercept the target message through the interceptor.

[0174] Each module in the above desensitization device can be implemented in whole or in part by software, hardware, or a combination thereof. Each of the above modules can be embedded in the processor in the server in hardware form or be independent of it, or can be stored in the memory in the server in software form, so that the processor can call and execute the operations corresponding to each of the above modules.

[0175] In an exemplary embodiment, a server is provided. The server is a proxy server, and its internal structure diagram can be as Figure 11 shown. The server includes a processor, a memory, an input / output interface, a communication interface, a display unit, and an input device. Among them, the processor, the memory, and the input / output interface are connected through a system bus, and the communication interface, the display unit, and the input device are connected to the system bus through the input / output interface. Among them, the processor of the server is used to provide computing and control capabilities. The memory of the server includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The input / output interface of the server is used to exchange information between the processor and external devices. The communication interface of the server is used to communicate with external terminals in a wired or wireless manner, and the wireless manner can be implemented through WIFI, a mobile cellular network, NFC (Near Field Communication), or other technologies. The computer program, when executed by the processor, implements a desensitization method. The display unit of the server is used to form a visually visible picture, which can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be a liquid crystal display screen or an electronic ink display screen. The input device of the server can be a touch layer covering the display screen, or a button, a trackball, or a touchpad provided on the server housing, or an external keyboard, a touchpad, or a mouse, etc.

[0176] Those skilled in the art can understand that Figure 11 the structure shown in

[0177] is only a block diagram of some structures related to the solution of this application, and does not constitute a limitation on the server to which the solution of this application is applied. The specific server may include more or fewer components than those shown in the figure, or combine some components, or have a different component layout.

[0178] In an embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of any one of the desensitization methods in the above method embodiments are implemented.

[0179] In one embodiment, a computer program product is provided, including a computer program which, when executed by a processor, implements the steps of the desensitization method in any one of the above method embodiments.

[0180] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use, and processing of relevant data need to comply with relevant regulations.

[0181] Those of ordinary skill in the art can understand that all or part of the processes in the above method embodiments can be completed by instructing relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the above method embodiments. Among them, any reference to a memory, database, or other medium used in the embodiments provided in this application can include at least one of non-volatile and volatile memories. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc. The databases involved in the embodiments provided in this application can include at least one of relational databases and non-relational databases. Non-relational databases can include distributed databases based on blockchain, etc., without limitation. The processors involved in the embodiments provided in this application can be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, data processing logics based on quantum computing, etc., without limitation.

[0182] The technical features of the above embodiments can be combined arbitrarily. For the sake of concise description, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, it should be considered as the scope described in this specification.

[0183] The above embodiments only express several implementation manners of the present application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the patent scope of the present application. It should be noted that for those of ordinary skill in the art, without departing from the concept of the present application, several modifications and improvements can still be made, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the appended claims.

Claims

1. A desensitization method, characterized in that, Applied to a proxy server, which can establish communication with each system, the method includes: Intercept the packets going in and out of each system to obtain target packets; Based on the sending object and / or receiving object corresponding to the target packet, determine the target desensitization rule corresponding to the target packet from the desensitization rule library, where the desensitization rule library is used to maintain the desensitization rules corresponding to each system; Perform desensitization processing on the target packet based on the target desensitization rule to obtain a desensitized packet; Match according to the sending object or the receiving object from the proxy forwarding table to obtain the target communication port, where the target communication port is the communication port corresponding to the target packet, and the proxy forwarding table represents the corresponding relationship between each system and the communication port; Forward the desensitized packet to the receiving object of the target packet through the target communication port corresponding to the target packet, where the target communication port is used to establish proxy communication between the sending object and the receiving object; Among them, when any update rule is satisfied, the corresponding relationship between each system and the port in the proxy forwarding table is updated, and the updated corresponding relationship between each system and the port does not overlap with the corresponding relationship between each system and the port before the update; The update rule includes updating the communication ports corresponding to each system in the proxy forwarding table when the desensitization rule corresponding to any system in the desensitization rule library is updated, and updating the communication ports corresponding to each system in the proxy forwarding table every set update period.

2. The method according to claim 1, characterized in that, The method further includes: Extract the fields of the target packet at the preset position, and determine the sending object and receiving object corresponding to the target packet according to the extracted fields; The performing desensitization processing on the target packet based on the target desensitization rule to obtain a desensitized packet includes: Determine the target encryption / decryption rule corresponding to the target packet according to the sending object or the receiving object, and parse the target packet based on the target encryption / decryption rule to obtain the target text corresponding to the target packet; Perform desensitization processing on the target text based on the target desensitization rule to obtain a desensitized text, and encrypt the desensitized text based on the target encryption / decryption rule to obtain a desensitized packet.

3. The method according to claim 2, wherein The performing desensitization processing on the target text based on the target desensitization rule to obtain a desensitized text includes: Retrieve the trie of sensitive words corresponding to the target desensitization rule, search in the trie based on the target text, and determine whether there are sensitive words in the target text according to the search result; In the case where there are sensitive words in the target text, determine the replacement word corresponding to the sensitive word based on the replacement rule in the target desensitization rule, and the replacement word has the same length as the corresponding sensitive word; Replace the sensitive words in the target text with the corresponding replacement words to obtain a desensitized text.

4. The method according to claim 3, characterized in that, The construction process of the trie includes: Taking the characters of each sensitive word as a node in the order of the characters in the sensitive word to construct a trie; Construct a failure pointer for each of the nodes, where the failure pointer is used to point to other nodes with the same character as that of the node; Perform bit compression on the characters of each of the nodes to obtain a status identifier for each of the nodes, where the status identifier indicates whether the node is the end of a sensitive word.

5. The method according to any one of claims 1-4, characterized in that, The method further includes: Determine the update period of the proxy forwarding table based on a digital sequence, where the order of the digits in the digital series represents the order of the update period, and the magnitude of the digits represents the duration of the corresponding update period.

6. The method according to claim 1, characterized in that, The determining the target desensitization rule corresponding to the target message from the desensitization rule library based on the sending object and / or receiving object corresponding to the target message includes: For the target message, if the target message is a request message, determine the target desensitization rule from the desensitization rule library based on the receiving object of the target message; If the target message is a response message, determine the target desensitization rule from the desensitization rule library based on the sending object of the target message.

7. The method according to claim 1, characterized in that, The method further includes: For any communication port, if it is determined that the number of messages forwarded by the communication port within a unit period is greater than the concurrency threshold, determine an auxiliary port from the available ports; In the proxy forwarding table, associate the auxiliary port with the communication port and set a validity period for the auxiliary port; where the validity period is positively correlated with the number of messages.

8. The method according to any one of claims 1-4, characterized in that, An interceptor is configured in the proxy server, and the intercepting the messages entering and leaving each system to obtain a target message includes: Obtain the protocol type of the messages entering and leaving each system, and determine the messages that conform to the set protocol type as the messages to be processed; Determine the content type corresponding to each of the messages to be processed, and determine the messages to be processed with the content type of text type as the target messages; Intercept the target messages through the interceptor.

9. A desensitization device, characterized in that, The device includes an interception module, a target desensitization rule determination module, a desensitization module, and an update module, where: The interception module intercepts the messages entering and leaving each system to obtain a target message; The target desensitization rule determination module is used to determine the target desensitization rule corresponding to the target message from the desensitization rule library based on the sending object and / or receiving object corresponding to the target message, and the desensitization rule library is used to maintain the desensitization rules corresponding to each system; The desensitization module is used to desensitize the target message based on the target desensitization rule to obtain a desensitized message; perform matching from the proxy forwarding table according to the sending object or the receiving object to obtain a target communication port, where the target communication port is the communication port corresponding to the target message, and the proxy forwarding table represents the corresponding relationship between each system and the communication port; forward the desensitized message to the receiving object of the target message through the target communication port corresponding to the target message, and the target communication port is used to establish proxy communication between the sending object and the receiving object; The update module is specifically used to update the correspondence between each system and port in the proxy forwarding table when any update rule is satisfied, and the updated correspondence between each system and port does not overlap with the correspondence between each system and port before the update; The update rules include updating the communication ports corresponding to each system in the proxy forwarding table when the desensitization rule corresponding to any system in the desensitization rule library is updated, and updating the communication ports corresponding to each system in the proxy forwarding table every set update period.

10. A server, comprising a memory and a processor, the memory storing a computer program, characterized in that, The server is a proxy server, and when the processor executes the computer program, it implements the steps of the method described in any one of claims 1 to 8.

Images