Data mask method and device, computer equipment, storage medium and program product

Abstract

The invention relates to a data masking method and device, computer equipment, a storage medium and a program product. The method comprises the steps of obtaining a target character string to be masked and a mask rule corresponding to the target character string, wherein the mask rule comprises mask mode indication information, mask position indication information and specific characters which cannot be masked in the target character string; determining a target mask algorithm according to the mask mode indication information, and determining candidate characters in the target character string according to the target mask algorithm, the mask position indication information and the specific character; and performing mask processing on the candidate character to obtain a mask character string. By adopting the method, the mask flexibility can be improved.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data masking method, apparatus, computer equipment, storage medium and program product. Background Art

[0002] PII (Personally Identifiable Information) plain text information refers to information that can be used to identify, contact or locate a specific individual, such as name, address, telephone number, etc.

[0003] In some business scenarios, PII needs to be displayed. If PII is displayed directly, there will be a risk of personal information leakage. Therefore, PII is usually masked before display.

[0004] However, the current mask processing method has the problem of low flexibility. Summary of the invention

[0005] Based on this, it is necessary to provide a data masking method, apparatus, computer equipment, storage medium and program product that can improve the flexibility of masking in response to the above technical problems.

[0006] In a first aspect, the present application provides a data masking method, comprising: obtaining a target character string to be masked and a masking rule corresponding to the target character string, the masking rule comprising masking mode indication information, masking position indication information and specific characters in the target character string that cannot be masked; determining a target masking algorithm according to the masking mode indication information, and determining candidate characters in the target character string according to the target masking algorithm, the masking position indication information and the specific characters; and masking the candidate characters to obtain a masked character string.

[0007] In one of the embodiments, the mask mode indication information indicates that the current mask mode is a mode for a first type of string, the first type of string is a string that does not contain separator characters, and the specific characters include exclusion characters. Candidate characters are determined in the target string based on the target mask algorithm, the mask position indication information and the specific characters, including: removing the exclusion characters in the target string to obtain the effective string length of the target string; and determining the candidate characters based on the effective string length and the mask position indication information.

[0008] In one of the embodiments, the masking mode is a common masking mode, the mask position indication information includes a front reserved value and a rear reserved value, and the candidate characters are determined according to the effective string length and the mask position indication information, including: determining the left boundary according to the effective string length and the front reserved value; determining the right boundary according to the rear reserved value; and determining the characters between the left boundary and the right boundary as candidate characters.

[0009] In one of the embodiments, the masking method is a percentage masking method, the mask position indication information includes a front reserved value and a rear reserved value, and the candidate characters are determined according to the effective string length and the mask position indication information, including: determining the left boundary according to the percentage of the product of the effective string length and the front reserved value; determining the right boundary according to the percentage of the product of the effective string length and the rear reserved value; and determining the characters between the left boundary and the right boundary as candidate characters.

[0010] In one of the embodiments, the mask mode indication information indicates that the current mask mode is a mode for a second type of string, the second type of string is a string containing a separator character, the specific characters include an exclusion character and a separator character, and candidate characters are determined in the target string according to the target mask algorithm, the mask position indication information and the specific characters, including: dividing the target string according to the separator character to obtain multiple string segments; for at least one of the string segments, removing the exclusion character in the string to obtain the effective string length of the string, and determining the candidate characters according to the effective string length and the mask position indication information.

[0011] In one embodiment, the masking method is an email masking method, the separator character is an email address character, and for at least one string therein, the exclusion characters in the string are removed to obtain the effective string length of the string, and the candidate characters are determined based on the effective string length and the mask position indication information, including: for the string located before the email address character, the exclusion characters in the string are removed to obtain the effective string length of the string, and the candidate characters are determined based on the effective string length and the mask position indication information.

[0012] In one embodiment, the masking method is a segmentation masking method, the separator character is at least one of an email address character or a non-email address character, and for at least one string segment therein, the exclusion characters in the string are removed to obtain the effective string length of the string, and the candidate characters are determined based on the effective string length and the mask position indication information, including: for each string segment therein, the exclusion characters in the string are removed to obtain the effective string length of the string, and the candidate characters are determined based on the effective string length and the mask position indication information.

[0013] In one of the embodiments, the mask position indication information includes a front reserved value and a rear reserved value, and the candidate characters are determined according to the effective string length and the mask position indication information, including: determining the left boundary according to the effective string length and the front reserved value; determining the right boundary according to the rear reserved value; and determining the characters between the left boundary and the right boundary as candidate characters.

[0014] In one embodiment, masking the candidate characters to obtain a masked string includes: masking the candidate characters in at least one string to obtain a plurality of initial masked strings; and concatenating the plurality of initial masked strings to obtain a masked string.

[0015] In one embodiment, if the front reserved value is negative, determining the left boundary according to the effective string length and the front reserved value includes: determining the sum of the front reserved value and the effective string length as the left boundary.

[0016] In the second aspect, the present application also provides a data masking device, including: an acquisition module, used to obtain a target character string to be masked and a masking rule corresponding to the target character string, the masking rule including masking mode indication information, masking position indication information and specific characters in the target character string that cannot be masked; a determination module, used to determine a target masking algorithm according to the masking mode indication information, and determine candidate characters in the target character string according to the target masking algorithm, the masking position indication information and the specific characters; a processing module, used to mask the candidate characters to obtain a masked character string.

[0017] In one of the embodiments, the mask mode indication information indicates that the current mask mode is a mode for a first type of string, the first type of string is a string that does not contain separator characters, the specific characters include exclusion characters, and the determination module is specifically used to remove the exclusion characters in the target string to obtain the effective string length of the target string; determine the candidate characters according to the effective string length and the mask position indication information.

[0018] In one of the embodiments, the masking mode is a common masking mode, the mask position indication information includes a front reserved value and a rear reserved value, and the determination module is specifically used to determine the left boundary according to the effective character string length and the front reserved value; determine the right boundary according to the rear reserved value; and determine the characters between the left boundary and the right boundary as candidate characters.

[0019] In one of the embodiments, the masking method is a percentage masking method, the mask position indication information includes a front reserved value and a rear reserved value, and the determination module is specifically used to determine the left boundary according to the percentage of the product of the effective string length and the front reserved value; determine the right boundary according to the percentage of the product of the effective string length and the rear reserved value; and determine the characters between the left boundary and the right boundary as candidate characters.

[0020] In one of the embodiments, the mask mode indication information indicates that the current mask mode is a mode for a second type of string, the second type of string is a string containing a separator character, the specific characters include an exclusion character and a separator character, and a determination module is specifically used to divide the target string according to the separator character to obtain multiple string segments; for at least one of the string segments, the exclusion character in the string is removed to obtain the effective string length of the string, and the candidate characters are determined according to the effective string length and the mask position indication information.

[0021] In one embodiment, the masking method is an email masking method, the separator character is an email address character, and the determination module is specifically used to remove the exclusion characters in the string before the email address character to obtain the effective string length of the string, and determine the candidate characters based on the effective string length and the mask position indication information.

[0022] In one of the embodiments, the masking method is a segmentation masking method, the separator character is at least one of an email address character or a non-email address character, and the determination module is specifically used to remove the exclusion characters in the string for each string segment, obtain the effective string length of the string, and determine the candidate characters based on the effective string length and the mask position indication information.

[0023] In one of the embodiments, the mask position indication information includes a front reserved value and a rear reserved value, and the determination module is specifically used to determine the left boundary according to the effective character string length and the front reserved value; determine the right boundary according to the rear reserved value; and determine the characters between the left boundary and the right boundary as candidate characters.

[0024] In one embodiment, the processing module is specifically used to perform mask processing on candidate characters in at least one string to obtain multiple initial masked strings; and concatenate the multiple initial masked strings to obtain the masked string.

[0025] In one embodiment, if the front reserved value is negative, a determination module is specifically configured to use the sum of the front reserved value and the length of the valid character string as the left boundary.

[0026] In a third aspect, the present application further provides a computer device, wherein the computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of any one of the methods described in the first aspect are implemented.

[0027] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the steps of any one of the methods described in the first aspect are implemented.

[0028] In a fifth aspect, the present application further provides a computer program product, wherein the computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of any one of the methods described in the first aspect are implemented.

[0029] The above-mentioned data masking method, device, computer equipment, storage medium and program product obtain the target character string to be masked and the masking rules corresponding to the target character string, the masking rules include masking mode indication information, masking position indication information and specific characters in the target character string that cannot be masked, and then determine the target masking algorithm according to the masking mode indication information, and determine candidate characters in the target character string according to the target masking algorithm, masking position indication information and specific characters, and then mask the candidate characters to obtain the masked character string. In this way, the method of determining the candidate characters for masking according to the target masking algorithm, masking position indication information and specific characters is more flexible. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the related technologies, the drawings required for use in the embodiments or the related technical descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0031] Figure 1 A diagram of an application environment of a data masking method in an embodiment;

[0032] Figure 2 is a flow chart of a data masking method in one embodiment;

[0033] Figure 3 is a flow chart of another data masking method in one embodiment;

[0034] Figure 4 is a flow chart of yet another data masking method in an embodiment;

[0035] Figure 5 is a structural block diagram of a data mask device in one embodiment;

[0036] Figure 6 The figure is a diagram of the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0037] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0038] PII (Personally Identifiable Information) plain text information refers to information that can be used to identify, contact or locate a specific individual, such as name, address, phone number, etc. In some business scenarios, PII needs to be displayed, such as the mobile phone number and name in the client user center, the bank card number and driver tax number on the driver card binding page, as well as the internal system customer service platform, Magellan, Clipper and other systems all have a large amount of user PII plain text information. If PII plain text information is displayed directly, there will be a risk of personal information leakage.

[0039] In order to reduce the risk of user personal information leakage and meet the compliance requirements of various countries, it is necessary to anonymize the user PII plaintext information at the presentation layer.

[0040] Existing technologies can meet the needs of user PII information masking, but the masking rules do not support customization, and it is difficult to adjust the rules specific to different PII types. For example, a specific mobile phone number masking method is provided to retain the last four digits of the mobile phone number, but it cannot support the masking requirements of the ID number. For specific characters in the mobile phone number, it will also be masked indiscriminately, and the original data format cannot be guaranteed. For example, for the mobile phone number 122345678901, if the last four digits are retained, *******8901, but it cannot adapt to the scene with the "-" separator character, for 123-4567-8901, the masked effect is *******8901, and the original "-" separator character is not retained.

[0041] Therefore, the current mask processing method has the problem of low flexibility, and it is necessary to propose an effective technical means to solve this problem. The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems are described in detail below with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0042] The data masking method provided in the embodiment of the present application can be applied to Figure 1In the application environment shown. Among them, the terminal 102 communicates with the server 104 through the network. The data storage system can store the data that the server 104 needs to process. The data storage system can be integrated on the server 104, or it can be placed on the cloud or other network servers. The server 104 obtains the target string to be masked and the masking rules corresponding to the target string from the terminal 102, and the masking rules include masking mode indication information, masking position indication information and specific characters that cannot be masked in the target string; the server 104 determines the target masking algorithm according to the masking mode indication information, and determines the candidate characters in the target string according to the target masking algorithm, the masking position indication information and the specific characters; the server 104 masks the candidate characters to obtain a masked string. Among them, the terminal 102 can be but is not limited to various personal computers, laptops, smart phones and tablet computers. The server 104 can be implemented with an independent server or a server cluster consisting of multiple servers.

[0043] In an exemplary embodiment, Figure 2 As shown, a data masking method is provided, which is applied to Figure 1 The server in the example is used to illustrate, including the following steps 201 to 203. Among them:

[0044] Step 201 : obtaining a target character string to be masked and a mask rule corresponding to the target character string, wherein the mask rule includes mask mode indication information, mask position indication information and specific characters in the target character string that cannot be masked.

[0045] The mask mode indication information may indicate whether the current mask mode is for a first type of string or a second type of string; the first type of string is a string that does not contain a separator character, and the second type of string is a string that contains a separator character.

[0046] The mask position indication information can be used to determine the characters to be masked in the target character string. The non-maskable specific characters can be used to determine the non-maskable characters in the target character string.

[0047] Optionally, after the server obtains the data text from the terminal, it traverses the data text to obtain the target string, mask mode indication information, mask position indication information and specific characters that cannot be masked, wherein the specific characters can be placed in the map array in the form of keys, and the map array includes keys and values.

[0048] Step 202, determining a target masking algorithm according to the masking mode indication information, and determining candidate characters in the target character string according to the target masking algorithm, the masking position indication information and the specific character.

[0049] Among them, according to the mask mode indication information, the mask mode includes one of the common mask mode, percentage mask mode, mailbox mask mode, split mask mode and non-mask mode, and different mask modes correspond to different mask algorithms.

[0050] Optionally, a target masking algorithm is determined according to a masking mode indicated by masking mode indication information, initial candidate characters are determined according to the target masking algorithm and masking position indication information, and specific characters in the initial candidate characters are removed to obtain candidate characters.

[0051] Step 203, masking the candidate characters to obtain a masked character string.

[0052] Optionally, the candidate characters in the target character string are replaced with mask characters to obtain a mask character string, wherein the mask character may be at least one of “*”, “?”, “!”, etc.

[0053] In the above data masking method, by obtaining the target character string to be masked and the masking rules corresponding to the target character string, the masking rules include masking mode indication information, masking position indication information and specific characters in the target character string that cannot be masked, and then determining the target masking algorithm according to the masking mode indication information, and determining the candidate characters in the target character string according to the target masking algorithm, the masking position indication information and the specific characters, and then performing masking processing on the candidate characters to obtain the masked character string. In this way, the method of determining the candidate characters for masking processing according to the target masking algorithm, the masking position indication information and the specific characters is more flexible.

[0054] In one of the embodiments, the mask mode indication information indicates that the current mask mode is a mode for a first type of string, the first type of string is a string that does not contain separator characters, and the specific characters include exclusion characters. Candidate characters are determined in the target string based on the target mask algorithm, the mask position indication information and the specific characters, including: removing the exclusion characters in the target string to obtain the effective string length of the target string; and determining the candidate characters based on the effective string length and the mask position indication information.

[0055] Among them, there is at least one of the separation characters such as "|", ",", " / ", etc., and at least one of the exclusion characters such as "-", ".", " / ", etc. The specific forms of the separation characters and exclusion characters are not limited here.

[0056] In an optional embodiment, the masking mode is a common masking mode, the mask position indication information includes a front reserved value and a rear reserved value, and the candidate characters are determined according to the valid string length and the mask position indication information, including: determining the left boundary according to the valid string length and the front reserved value; determining the right boundary according to the rear reserved value; and determining the characters between the left boundary and the right boundary as candidate characters.

[0057] In another optional embodiment, the masking method is a percentage masking method, the mask position indication information includes a front reserved value and a rear reserved value, and the candidate characters are determined according to the valid string length and the mask position indication information, including: determining the left boundary according to the percentage of the product of the valid string length and the front reserved value; determining the right boundary according to the percentage of the product of the valid string length and the rear reserved value; and determining the characters between the left boundary and the right boundary as candidate characters.

[0058] In addition, if the front reserved value is negative, the left boundary is determined according to the effective string length and the front reserved value, including: determining the sum of the front reserved value and the effective string length as the left boundary. If the rear reserved value is negative, the right boundary is determined according to the rear reserved value, including: positively valuating the rear reserved value, and determining the rear reserved value after the positive valuating as the right boundary.

[0059] For example, the target string is 436.219.098-85. If the mask mode is the normal mask mode, the front reserved value is -5, the rear reserved value is 2, and the exclusion character is ".-", after removing the exclusion characters, the effective string length of the target string is 11, the left boundary is 11 plus -5, that is, the left boundary is 6, and the right boundary is 2. Then 098 in the target string is a candidate character.

[0060] The target string is 27-910-113-69. If the mask mode is percentage mask mode, the front retention value is 50, the back retention value is 20, and the exclusion character is "-". After removing the exclusion characters, the effective string length of the target string is 10, the left boundary is 10×50 / 100, that is, the left boundary is 5%, and the right boundary is 10×20 / 100, that is, the right boundary is 2%. Then 113 in the target string is a candidate character.

[0061] The above-mentioned common masking method can be applied to scenarios such as mobile phone numbers and bank card numbers. The percentage masking method can be applied to the default scenario.

[0062] In one embodiment, if Figure 3 As shown, another data masking method is provided, the masking mode indication information indicates that the current masking mode is a mode for a second type of character string, the second type of character string is a character string containing a separator character, and the specific characters include an exclusion character and a separator character. The method includes the following steps:

[0063] Step 301, segment the target string according to the separator characters to obtain multiple string segments.

[0064] Step 302: for at least one string, remove the exclusion characters in the string to obtain the effective string length of the string, and determine the candidate characters according to the effective string length and the mask position indication information.

[0065] In an optional embodiment, the masking method is an email masking method, the separator character is an email address character, and for at least one string therein, the exclusion characters in the string are removed to obtain the effective string length of the string, and the candidate characters are determined based on the effective string length and the mask position indication information, including: for the string located before the email address character, the exclusion characters in the string are removed to obtain the effective string length of the string, and the candidate characters are determined based on the effective string length and the mask position indication information.

[0066] The email address symbol can be "@" etc. The exclusion character can be empty.

[0067] The mask position indication information includes a front reserved value and a rear reserved value. Determining candidate characters according to the effective string length and the mask position indication information includes: determining a left boundary according to the effective string length and the front reserved value; determining a right boundary according to the rear reserved value; and determining characters between the left boundary and the right boundary as candidate characters.

[0068] For example, the target string is 12345@123.com, the separator character is "@", the exclusion character is empty, the leading value is 2, and the trailing value is 0. The target string is split according to "@" to get "12345" and "123.com". For "12345", the effective string length is 5, the left boundary is 2, and the right boundary is 0, so the candidate character is "345".

[0069] In another optional embodiment, the masking method is a segmentation masking method, the separator character is at least one of an email address character or a non-email address character, and for at least one string segment therein, the exclusion characters in the string are removed to obtain the effective string length of the string, and the candidate characters are determined based on the effective string length and the mask position indication information, including: for each string segment therein, the exclusion characters in the string are removed to obtain the effective string length of the string, and the candidate characters are determined based on the effective string length and the mask position indication information.

[0070] Among them, the separator is at least one of “|”, “,”, “ / ”, “@”, etc.

[0071] The mask position indication information includes a front reserved value and a rear reserved value. Determining candidate characters according to the effective string length and the mask position indication information includes: determining a left boundary according to the effective string length and the front reserved value; determining a right boundary according to the rear reserved value; and determining characters between the left boundary and the right boundary as candidate characters.

[0072] For example, the target string is 12345@123.com / 78910@127.com, the separator is "@ / ", the exclusion character is ".", the leading retaining value is 1, and the trailing retaining value is 2. The target string is split according to "@ / " to get "12345", "123.com", "78910", and "127.com". For "12345", remove the exclusion character, and the valid string length is 5, the left boundary is 1, and the right boundary is 2, so the candidate character is "23". Similarly, the candidate characters for "123.com" are "23c", the candidate characters for "78910" are "89", and the candidate characters for "127.com" are "27c".

[0073] Step 303: Mask the candidate characters in at least one string to obtain a plurality of initial masked strings; and concatenate the plurality of initial masked strings to obtain a masked string.

[0074] In an optional embodiment, the masking method is an email masking method, and the candidate characters in the character string before the email address symbol are replaced with mask characters to obtain an initial mask string, and the initial mask string, the email address symbol and the character string after the email address symbol are concatenated to obtain the mask string.

[0075] For example, in the target string 12345@123.com, the candidate character of "12345" is "345". After replacing "345" with "*", the initial mask string is "12***". After concatenating "12***", "@" and "123.com", the mask string is "12***@123.com".

[0076] In another optional embodiment, the masking method is a segmentation masking method, in which the candidate characters in each string are replaced with mask characters to obtain multiple initial mask strings, and the multiple initial mask strings and separation characters are spliced ​​using a splicing function to obtain a mask string.

[0077] For example, the above target string 12345@123.com / 78910@127.com obtains the initial mask strings "1**45", "1**.*om", "7**10", and "1**.*om". The concatenation function strings.Join(initial mask string, separator character) is used to concatenate multiple initial mask strings and the separator character "@ / " to obtain the mask string "1**45@1**.*om / 7**10@1**.*om".

[0078] The above mailbox masking method can be applied to mailbox scenarios, and the segmentation masking method can be applied to address and name scenarios.

[0079] In one embodiment, the masking mode is a non-masking mode, and the target character string to be masked is directly output without being masked.

[0080] In one embodiment, the masking rule also includes the country, and determining the target masking algorithm according to the masking mode indication information includes:

[0081] The target masking algorithm is determined based on the country and masking mode indication information.

[0082] In this embodiment, a target masking algorithm specific to different countries and different masking mode indication information can be implemented to mask the target character string, thereby further improving the flexibility of masking.

[0083] In one of the embodiments, the mask rule also includes an identification bit. If the identification bit is 0, the meanings of the front reserved value and the rear reserved value in the above mask position indication information still follow the above logic, that is, the front reserved value X indicates that the first X bits of the target string are reserved, and the rear reserved value Y indicates that the rear Y bits of the target string are reserved; the front reserved value -X indicates the rear X bits of the encrypted target string, and the rear reserved value -Y indicates the first Y bits of the encrypted target string.

[0084] If the flag bit is 1, the front reserved value and the rear reserved value in the above mask position indication information do not follow the above logic. The front reserved value X represents the first X bits of the masked target string, and the rear reserved value Y represents the last Y bits of the masked target string; the front reserved value -X represents the last X bits of the reserved target string, and the rear reserved value -Y represents the first Y bits of the reserved target string.

[0085] Based on the above data masking method, such as Figure 4 As shown, another data masking method is provided, the method comprising the following steps:

[0086] Get the target string mask rule;

[0087] Traverse the mask rules and store the excluded characters in the map array as keys;

[0088] Determine the mask mode according to the mask mode indication information in the mask rule;

[0089] If the mask mode is a common mask mode, the exclusion characters in the target string are removed to obtain the effective string length of the target string; the left boundary and the right boundary are determined according to the effective string length and the front reserved value and the rear reserved value in the mask position indication information; the characters between the left boundary and the right boundary are determined as candidate characters; and the candidate characters are masked to obtain a masked string.

[0090] If the masking mode is a percentage masking mode, then the exclusion characters in the target string are removed to obtain the effective string length of the target string; the left boundary is determined according to the percentage of the product of the effective string length and the front reserved value; the right boundary is determined according to the percentage of the product of the effective string length and the rear reserved value; the same steps as those in the ordinary masking mode after determining the left boundary and the right boundary are performed, that is, the characters between the left boundary and the right boundary are determined as candidate characters; the candidate characters are masked to obtain a masked string.

[0091] If the masking method is the email masking method, the target string is split according to the email address character "@" to obtain a prefix and a suffix, where the prefix is ​​the string before the email address character, and the suffix is ​​the string after the email address character; the steps in the ordinary masking method are performed on the prefix to obtain the masked prefix; the masked prefix, "@" and suffix are concatenated to obtain a masked string.

[0092] If the masking mode is a segmentation masking mode, the target string is segmented according to the separation character to obtain multiple string segments. For each string segment, the exclusion characters in the string are removed to obtain the effective string length of the string. The left boundary and the right boundary are determined according to the effective string length and the front retention value and the rear retention value in the mask position indication information, and the characters between the left boundary and the right boundary are determined as candidate characters; masking is performed on the candidate characters in each string segment to obtain multiple initial masked strings; and the multiple initial masked strings and the separation character are concatenated to obtain a masked string.

[0093] If the mask mode is non-mask mode, the target string to be masked is directly output without masking.

[0094] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0095] Based on the same inventive concept, the embodiment of the present application also provides a data mask device for implementing the data mask method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations of one or more data mask device embodiments provided below can refer to the limitations of the data mask method above, and will not be repeated here.

[0096] In an exemplary embodiment, Figure 5 As shown, a data mask device is provided, the data mask 500 comprises: an acquisition module 501, a determination module 502 and a processing module 503, wherein:

[0097] An acquisition module 501 is used to acquire a target character string to be masked and a mask rule corresponding to the target character string, wherein the mask rule includes mask mode indication information, mask position indication information and specific characters in the target character string that cannot be masked;

[0098] A determination module 502, configured to determine a target masking algorithm according to the masking mode indication information, and determine candidate characters in a target character string according to the target masking algorithm, the masking position indication information and the specific character;

[0099] The processing module 503 is used to perform mask processing on the candidate characters to obtain a masked character string.

[0100] In one of the embodiments, the mask mode indication information indicates that the current mask mode is a mode for a first type of string, the first type of string is a string that does not contain separator characters, and the specific characters include exclusion characters. The determination module 502 is specifically used to remove the exclusion characters in the target string to obtain the effective string length of the target string; and determine the candidate characters based on the effective string length and the mask position indication information.

[0101] In one of the embodiments, the masking mode is a common masking mode, the mask position indication information includes a front reserved value and a rear reserved value, and the determination module 502 is specifically used to determine the left boundary according to the effective string length and the front reserved value; determine the right boundary according to the rear reserved value; and determine the characters between the left boundary and the right boundary as candidate characters.

[0102] In one embodiment, the masking method is a percentage masking method, the mask position indication information includes a front reserved value and a rear reserved value, and the determination module 502 is specifically used to determine the left boundary according to the percentage of the product of the effective string length and the front reserved value; determine the right boundary according to the percentage of the product of the effective string length and the rear reserved value; and determine the characters between the left boundary and the right boundary as candidate characters.

[0103] In one of the embodiments, the mask mode indication information indicates that the current mask mode is a mode for a second type of string, the second type of string is a string containing a separator character, the specific characters include an exclusion character and a separator character, and the determination module 502 is specifically used to divide the target string according to the separator character to obtain multiple string segments; for at least one of the string segments, remove the exclusion character in the string to obtain the effective string length of the string, and determine the candidate characters according to the effective string length and the mask position indication information.

[0104] In one embodiment, the masking method is an email masking method, the separator character is an email address character, and the determination module 502 is specifically used to remove the exclusion characters in the string before the email address character to obtain the effective string length of the string, and determine the candidate characters based on the effective string length and the mask position indication information.

[0105] In one embodiment, the masking method is a segmentation masking method, and the separator character is at least one of an email address character or a non-email address character. The determination module 502 is specifically used to remove the exclusion characters in the string for each string segment, obtain the effective string length of the string, and determine the candidate characters based on the effective string length and the mask position indication information.

[0106] In one embodiment, the mask position indication information includes a front reserved value and a rear reserved value, and the determination module 502 is specifically used to determine the left boundary according to the effective character string length and the front reserved value; determine the right boundary according to the rear reserved value; and determine the characters between the left boundary and the right boundary as candidate characters.

[0107] In one embodiment, the processing module 503 is specifically configured to perform mask processing on candidate characters in at least one string to obtain a plurality of initial masked strings; and concatenate the plurality of initial masked strings to obtain a masked string.

[0108] In one embodiment, if the front reserved value is negative, the determination module 502 is specifically configured to determine that the sum of the front reserved value and the length of the valid character string is the left boundary.

[0109] Each module in the above data mask device can be implemented in whole or in part by software, hardware or a combination thereof. Each module can be embedded in or independent of a processor in a computer device in the form of hardware, or can be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to each module.

[0110] In an exemplary embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as shown in FIG. Figure 6As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data such as mask mode indication information, mask position indication information, specific characters and mask character strings. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a data masking method is implemented.

[0111] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0112] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps of any of the above data mask method embodiments when executing the computer program.

[0113] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the above data mask method embodiments are implemented.

[0114] In one embodiment, a computer program product is provided, including a computer program, which implements the steps of any of the above data mask method embodiments when executed by a processor.

[0115] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0116] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0117] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0118] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A data masking method, characterized in that: The method comprises: Acquire a target character string to be masked and a mask rule corresponding to the target character string, wherein the mask rule includes mask mode indication information, mask position indication information, and specific characters in the target character string that cannot be masked; Determining a target masking algorithm according to the masking mode indication information, and determining a candidate character in the target character string according to the target masking algorithm, the masking position indication information and the specific character; Masking is performed on the candidate characters to obtain a masked character string.

2. The method according to claim 1, characterized in that The mask mode indication information indicates that the current mask mode is a mode for a first type of character string, the first type of character string is a character string that does not contain a separator character, the specific character includes an excluded character, and the determining of candidate characters in the target character string according to the target mask algorithm, the mask position indication information and the specific character includes: Removing the excluded characters from the target string to obtain the effective string length of the target string; The candidate characters are determined according to the effective character string length and the mask position indication information.

3. The method according to claim 2, characterized in that The masking mode is a common masking mode, the mask position indication information includes a front reserved value and a rear reserved value, and the determining the candidate characters according to the effective character string length and the mask position indication information includes: Determine the left boundary according to the effective character string length and the front reserved value; Determine the right boundary according to the rear reserved value; Characters between the left boundary and the right boundary are determined as the candidate characters.

4. The method according to claim 2, characterized in that: The masking mode is a percentage masking mode, the mask position indication information includes a front reserved value and a rear reserved value, and the determining the candidate characters according to the effective character string length and the mask position indication information includes: Determine the left boundary according to the percentage of the product of the effective character string length and the front reserved value; Determine the right boundary according to the percentage of the product of the effective character string length and the rear reserved value; Characters between the left boundary and the right boundary are determined as the candidate characters.

5. The method according to claim 1, characterized in that The mask mode indication information indicates that the current mask mode is a mode for a second type of character string, the second type of character string is a character string containing a separator character, the specific characters include an exclusion character and a separator character, and determining a candidate character in the target character string according to the target mask algorithm, the mask position indication information and the specific characters includes: Splitting the target string according to the separator character to obtain multiple string segments; For at least one of the character strings, the excluded characters in the character string are removed to obtain the effective character string length of the character string, and the candidate characters are determined according to the effective character string length and the mask position indication information.

6. The method according to claim 5, characterized in that The masking mode is an email masking mode, the separator character is an email address character, and for at least one segment of the string, removing the exclusion character in the string to obtain a valid string length of the string, and determining the candidate characters according to the valid string length and the mask position indication information, including: For the character string before the email address symbol, the exclusion characters in the character string are removed to obtain the valid character string length of the character string, and the candidate characters are determined according to the valid character string length and the mask position indication information.

7. The method according to claim 5, characterized in that The masking method is a segmentation masking method, the separator character is at least one of an email address character and a non-email address character, and for at least one segment of the string, removing the exclusion character in the string to obtain a valid string length of the string, and determining the candidate character according to the valid string length and the mask position indication information, including: For each segment of the string, the excluded characters in the string are removed to obtain the valid string length of the string, and the candidate characters are determined according to the valid string length and the mask position indication information.

8. The method according to claim 5, characterized in that The mask position indication information includes a front reserved value and a rear reserved value, and determining the candidate character according to the valid character string length and the mask position indication information includes: Determine the left boundary according to the effective character string length and the front reserved value; Determine the right boundary according to the rear reserved value; Characters between the left boundary and the right boundary are determined as the candidate characters.

9. The method according to claims 5 to 7, characterized in that The step of performing mask processing on the candidate characters to obtain a masked character string includes: Masking the candidate characters in at least one segment of the character string to obtain a plurality of initial masked character strings; The multiple initial mask character strings are concatenated to obtain the mask character string.

10. The method according to claim 3, 4 or 8, characterized in that If the front reserved value is negative, determining the left boundary according to the effective string length and the front reserved value includes: The sum of the front reserved value and the effective character string length is determined as the left boundary.

11. A data masking device, characterized in that: The device comprises: An acquisition module, used for acquiring a target character string to be masked and a mask rule corresponding to the target character string, wherein the mask rule includes mask mode indication information, mask position indication information and specific characters in the target character string that cannot be masked; A determination module, configured to determine a target masking algorithm according to the masking mode indication information, and determine candidate characters in the target character string according to the target masking algorithm, the masking position indication information and the specific character; The processing module is used to perform mask processing on the candidate characters to obtain a masked character string.

12. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 10 are implemented.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

14. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

Images