Data desensitization method and device, equipment and storage medium

Abstract

The invention discloses a data desensitization method and device, equipment and a storage medium, and aims to solve the problem of how to perform desensitization processing on original data so as to know the information type to which the original data belongs through a desensitization result. The desensitization method comprises the following steps: acquiring partial data capable of representing an information type to which original data belongs from the original data; replacing at least one character in other data except the partial data in the original data with a preset character to obtain partial hidden data corresponding to the original data; performing data encryption processing on the original data to obtain a character string corresponding to the original data; and connecting the character string and the partial hidden data through a preset separator to form a desensitization result of the original data. According to the desensitization result obtained by the method, based on the partial hidden data, the information type to which the original data belongs can be known; and on the basis of the obtained character string, the uniqueness of the desensitization result corresponding to the original data can be determined.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data desensitization method, device, equipment and storage medium. Background Art

[0002] In order to protect information security, sensitive data is usually desensitized and the desensitization results are displayed to users. The current desensitization method is usually to use a one-way irreversible algorithm to map the original data (such as sensitive data) into a string and display the string to the user. This desensitization method is not suitable for scenarios where the specific original data cannot be obtained from the desensitization results, but the desensitization results need to be used to understand the information type (such as name, ID number, address, etc.) to which the original data belongs. For example, the original data are "Zhang San" and "15112345678", and the desensitization results obtained by the above desensitization method are "B93BC1214F7B1" and "A6DB7E1BA31C777ECE0". It is difficult to know from the desensitization results that the corresponding original data represent the name and phone number respectively.

[0003] In view of the above problems, how to desensitize the original data so that the information type of the original data can be known through the desensitization results is an urgent problem to be solved. Summary of the invention

[0004] The embodiments of the present application provide a data desensitization method, apparatus, device and storage medium to solve the problem of how to desensitize original data so as to obtain the information type to which the original data belongs through the desensitization result.

[0005] The present application embodiment adopts the following technical solutions: A data desensitization method, comprising: Acquire partial data capable of characterizing the information type to which the original data belongs from the original data; At least one character in the remaining data of the original data except the partial data is replaced with a preset character to obtain partially hidden data corresponding to the original data; Performing data encryption processing on the original data to obtain a character string corresponding to the original data; The character string and part of the hidden data are connected through a preset separator to form a desensitized result of the original data.

[0006] A data desensitization device, comprising: A partial data acquisition unit, used to acquire partial data capable of representing the information type to which the original data belongs from the original data; A character replacement unit, used to replace at least one character in the remaining data of the original data except the partial data with a preset character, so as to obtain partially hidden data corresponding to the original data; A data encryption unit performs data encryption processing on the original data to obtain a character string corresponding to the original data; The result generating unit is used to connect the character string and the partially hidden data through a preset separator to form a desensitization result of the original data.

[0007] A computing device, comprising: a memory and a processor, wherein: The memory is used to store computer programs; The processor is coupled to the memory and is used to execute the computer program stored in the memory to perform the above method.

[0008] A computer-readable storage medium storing a computer program, wherein the computer program can implement the above method when executed by a computer.

[0009] A computer program product comprises a computer program, and the computer program implements the above method when executed by a processor.

[0010] At least one of the above technical solutions adopted in the embodiments of the present application can achieve the following beneficial effects: By replacing the remaining data in the original data except for the part of the data that can represent the information type of the original data with a preset character, partially hidden data is obtained, and the original data is encrypted to obtain a string representing the original data, and the partially hidden data and the encrypted string are connected to form a desensitization result. Since the part of the original data that has not been replaced contains data representing the information type of the original data, the user can understand the information type of the original data based on the desensitization result. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings: Figure 1 A specific implementation flow chart of a data desensitization method provided in an embodiment of the present application; Figure 2 A specific example diagram of a data desensitization method provided in an embodiment of the present application; Figure 3 A schematic diagram of the specific structure of a data desensitization device provided in an embodiment of the present application; Figure 4A schematic diagram of the specific structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0012] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0013] Those skilled in the art may appreciate that, with the development of technology and the emergence of new scenarios, the technical solutions provided in the embodiments of the present application are also applicable to similar technical problems.

[0014] The terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and need not be used to describe a specific order or sequential order. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances, which is only to describe the distinction mode adopted by the objects of the same attributes when describing in the embodiments of the present application. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, so that the process, method, system, product or equipment comprising a series of units need not be limited to those units, but may include other units that are not clearly listed or inherent to these processes, methods, products or equipment.

[0015] In order to solve the problem of how to desensitize original data so that users can understand the information type to which the original data belongs through the desensitization result, an embodiment of the present application provides a data desensitization method.

[0016] The executor of the method may be any computing device that can implement the method, such as a server, a mobile phone, a personal computer, a smart wearable device, a smart robot, and the like.

[0017] In addition, the execution order of different steps is not limited in the embodiment of the present application. When using the method provided in the embodiment of the present application, the execution order of different steps can be adjusted according to actual needs.

[0018] For ease of description, the method provided in the embodiment of the present application is described in detail below by taking a data desensitizing device as the executor of the method as an example.

[0019] like Figure 1 As shown, it is a specific implementation flow chart of a method provided in an embodiment of the present application, including the following steps 11 to 14: Step 11: Acquire partial data that can characterize the information type to which the original data belongs from the original data.

[0020] Original data usually refers to data in a database, or various data stored, used or directly obtained by a terminal, which is unprocessed or simplified data. Original data in this embodiment refers to personal information data that has not been desensitized.

[0021] The type of original data in this embodiment may be text data, such as data representing name, address, or license plate number.

[0022] The information type refers to the type of information expressed by the original data; for example, the original data are "Zhang San", "810000180001010021", and "Xingfu Village, No. 666, Xingfu Road, Xingfu District, Jinan City, Shandong Province", and the information types expressed correspond to name, ID number, and address.

[0023] In a feasible implementation, since the storage or description form of the personal information data that needs to be desensitized is often fixed, the location of the partial data that can represent the information type of the original data belonging to different information types is often fixed. For example, for the original data of the information type of name, the partial data that can represent the name is often reflected in the surname, so the characters representing the surname are selected as partial data.

[0024] Step 12: Replace at least one character in the remaining data of the original data except the partial data with a preset character to obtain partially hidden data corresponding to the original data.

[0025] In a feasible implementation, at least one character in the remaining data is replaced with a preset character. If multiple characters in the remaining data are replaced with preset characters, the multiple characters can be replaced with preset characters respectively, rather than replacing multiple characters with one preset character. The advantage of this operation is that even if the remaining data is replaced, the number of characters in the remaining data can still be known from the partially hidden data. For data in which the partially hidden data is pure digits, it is convenient to quickly determine the information type to which the original data belongs through the partially hidden data.

[0026] In another feasible implementation, at least one character in the remaining data is replaced with a preset character. If multiple characters in the remaining data are replaced with preset characters, the multiple characters can be replaced with one preset character. This operation is applied to scenarios where it is difficult to determine the number of characters in the remaining data based on the partially hidden data. For example, for the original data representing the address, the specific information such as the community name and house number that needs to be replaced can be replaced with one character, which can further enhance the confidentiality of the partially hidden data.

[0027] The preset character can be a special symbol, such as "*", or a selected number, such as "0".

[0028] Regarding the implementation method mentioned in the above step 11 - since the storage or description form of the personal information data that needs to be desensitized is often fixed, the location of the part of the original data that can characterize the information type to which the original data belongs is often fixed. Furthermore, the location of the remaining data is also fixed. Therefore, in order to improve the efficiency of desensitization, the implementation of step 12 can be: At least one character at a preset position in the original data is replaced with a preset character to obtain partially hidden data corresponding to the original data.

[0029] The preset position refers to the position set for the characters in the original data, such as the positions of the second and third characters in the original data.

[0030] The preset position is determined based on the information type to which the original data belongs; for original data of different information types, the data to be replaced may be different.

[0031] The preset position for character replacement in the original data is determined based on the information type to which the original data belongs. This is to enable the information type of the original data to be understood based on the unreplaced data in the partially hidden data after replacing the remaining data - that is, the partial data characterizing the information type to which the original data belongs as described in step 11 above.

[0032] As shown in Table 1 below, examples of partially hidden data corresponding to original data belonging to different information types are provided:

[0033] Table 1 Step 13: encrypt the original data to obtain a character string corresponding to the original data.

[0034] Among them, the encryption process can be performed using a one-way irreversible algorithm.

[0035] A one-way irreversible algorithm, also known as a hash algorithm, is an algorithm that does not require a key during the encryption process, and the encrypted data cannot be decrypted back to the original text. This algorithm makes it impossible to decrypt the secret text into plain text through the structure of the algorithm, which can enhance the security of the resulting string.

[0036] The hash algorithm used in the embodiments of the present application can be an MD5 (Message-Digest Algorithm 5, based on Hash transformation, transforms a "byte string" of any length into a 128-bit large integer, and is an irreversible string transformation algorithm) algorithm, or a SHA (including SHA-1, SHA-256, etc., which generates a fixed-length message digest output for binary messages whose length does not exceed a certain limit) series of algorithms.

[0037] In order to further ensure the security of the encrypted string, in one implementation of the present application, the original data is encrypted to obtain a string corresponding to the original data, including: A random string is added to the original data (or called a salting operation), and data encryption processing is performed on the original data with the random string added to obtain a string corresponding to the original data.

[0038] In this implementation, even if the plaintext data is obtained through illegal means, the original raw data cannot be determined based on the plaintext data because a random string is added to the plaintext data, thereby further improving the security of the encryption result.

[0039] In order to ensure the relevance of the desensitized data, when applied to the query scenario of the associated data table, the associated query of the original data is usually performed based on the encrypted string. Then, the original data is encrypted to obtain the string corresponding to the original data, including: For at least two data tables that need to be associated with each other, the same data encryption processing method is used for the original data in the at least two data tables, so that the same original data in the at least two data tables corresponds to the same character string.

[0040] For at least two data tables that need to be associated for query, the unification of partially hidden data can be further achieved, including: For the same original data in the at least two data tables, characters at the same position are selected from the remaining data and replaced with preset characters to obtain the same hidden partial data corresponding to the same original data.

[0041] For example, for the two tables in the database, Table 2-1 and Table 3-1, they represent the source tables that have not been processed in the above steps 11 to 13:

[0042] Table 2-1

[0043] Table 3-1 If the associated query of the data in Table 2-1 and Table 3-1 can be realized, in this embodiment, for the original data that needs to be sensitively processed in the two tables, such as "Zhang San", the same encryption processing method is used; similarly, for the original data "Li Si" in the two tables, the same encryption processing method is also used; then the corresponding Table 2-1 and Table 3-2 after desensitization are as follows respectively, where Table 2-2 is the result after desensitizing Table 2-1, and Table 3-2 is the result after desensitizing Table 3-1.

[0044]

[0045] Table 2-2

[0046] Table 3-2 It can be seen from Table 2-2 and Table 3-2 that in the two tables, the strings representing "Zhang San" are the same, and similarly, the strings representing "Li Si" and "Zhang Wu" are also the same respectively.

[0047] Step 14, connect the string and the partially hidden data with a preset delimiter to form the desensitization result of the original data.

[0048] As shown in Table 2-2 and Table 3-2 above, the preset delimiter can be "丨".

[0049] As Figure 2 shown, a detailed data desensitization example diagram of the above embodiment of the present application is provided. Among them, the original data is "Jia Baoyu", the partial data that can represent the information type to which the original data belongs is "Jia", and the "Bao" in the original data is replaced with the preset character "*"; a random string "Abc123" is added to the original data, and the encryption algorithm used is SM3.

[0050] For the original data "Jia Baoyu", the obtained partially hidden data is "Jia*yu", the string is "76229269248af0e37f85a49e3225bd079c1da994707d57e18fc64e63c0bc8a56", and the desensitization result is: "76229269248af0e37f85a49e3225bd079c1da994707d57e18fc64e63c0bc8a56丨Jia*yu".

[0051] The data desensitization method of the embodiment of the present application replaces the remaining data in the original data with preset characters except for the partial data that can characterize the information type to which the original data belongs, obtains partially hidden data, encrypts the original data, obtains a string that characterizes the original data, and connects the partially hidden data and the encrypted string to form a desensitization result. Since the part of the original data that is not replaced contains data that characterizes the information type of the original data, the user can understand the information type to which the original data belongs based on the obtained desensitization result.

[0052] In order to solve the problem of how to desensitize the original data so as to obtain the information type of the original data through the desensitization result, based on the same inventive concept as the above-mentioned embodiment 1 of the present application, embodiment 2 of the present application also provides a data desensitization device.

[0053] The specific structural diagram of the device is shown in Figure 3 As shown, it includes the following functional units 31-34: The partial data acquisition unit 31 is used to acquire partial data that can characterize the information type to which the original data belongs from the original data.

[0054] The original data may be text data.

[0055] The character replacement unit 32 is used to replace at least one character in the remaining data of the original data except the partial data with a preset character to obtain partially hidden data corresponding to the original data.

[0056] In a feasible implementation, since the storage or description form of the personal information data that needs to be desensitized is often fixed, the location of the partial data of original data belonging to different information types that can characterize the information type to which the original data belongs is often fixed.

[0057] The data encryption unit 33 performs data encryption processing on the original data to obtain a character string corresponding to the original data.

[0058] The data encryption processing unit is specifically used for: The original data is encrypted using a one-way irreversible algorithm, and the original data is mapped into a character string.

[0059] Furthermore, in order to improve the security of the encrypted string, the data encryption processing unit is also used to: A random character string is added to the original data, and data encryption processing is performed on the original data to which the random character string is added, so as to obtain a character string corresponding to the original data.

[0060] When the data desensitization device is used in a query scenario of an associated data table, the data encryption processing unit is also used to: For at least two data tables that need to be associated with each other, the same data encryption processing method is used for the original data in the at least two data tables, so that the same original data in the at least two data tables corresponds to the same character string.

[0061] In this scenario, the character replacement unit is also used to: For the same original data in the at least two data tables, the same characters are selected from the remaining data and replaced with preset characters to obtain the same hidden partial data corresponding to the same original data.

[0062] Since the storage or description form of the personal information data that needs to be desensitized is often fixed, the location of the part of the original data that can characterize the information type to which the original data belongs is often fixed. Furthermore, the location of the remaining data is also fixed. Therefore, in order to improve the efficiency of desensitization, the data encryption processing unit is also used to: At least one character at a preset position in the original data is replaced with a preset character to obtain partially hidden data corresponding to the original data.

[0063] The result generating unit 34 is used to connect the character string and the partially hidden data through a preset separator to form a desensitization result of the original data.

[0064] The data desensitization device of the embodiment of the present application replaces the remaining data in the original data with preset characters except for the partial data that can characterize the information type to which the original data belongs, obtains partially hidden data, encrypts the original data, obtains a string that characterizes the original data, and connects the partially hidden data and the encrypted string to form a desensitization result. Since the part of the original data that is not replaced contains data that characterizes the information type of the original data, the user can understand the information type to which the original data belongs based on the obtained desensitization result.

[0065] Based on the same inventive concept as the aforementioned embodiments of the present application, the embodiments of the present application also provide a computing device.

[0066] like Figure 4As shown, the computing device includes: a memory 41 and a processor 42. The memory 41 can be configured to store various other data to support operations on the electronic device. Examples of these data include instructions for any application or method for operating on the electronic device. The memory 41 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as a static random access memory (SRAM), an electrically erasable programmable read-only memory (EEPROM), an erasable programmable read-only memory (EPROM), a programmable read-only memory (PROM), a read-only memory (ROM), a magnetic memory, a flash memory, a magnetic disk or an optical disk.

[0067] The processor 42 is coupled to the memory 41 and is used to execute a computer program stored in the memory 41 to execute a data desensitization method described in the aforementioned embodiment.

[0068] When the processor 42 executes the computer program to perform the data desensitization method, the remaining data in the original data except for the partial data that can characterize the information type of the original data is replaced with a preset character to obtain partially hidden data, and the original data is encrypted to obtain a string characterizing the original data, and the partially hidden data and the encrypted string are connected to form a desensitization result. Since the part of the original data that is not replaced contains data characterizing the information type of the original data, the user can understand the information type of the original data based on the obtained desensitization result.

[0069] When the processor 42 executes the computer program in the memory 41, in addition to the above functions, it can also realize other functions, and the details can be referred to the description of the previous embodiments.

[0070] Further, such as Figure 4 As shown, the computing device also includes: a display 44, a communication component 43, a power component 45, an audio component 46 and other components. Figure 4 Only some components are shown schematically, and it does not mean that the computing device only includes Figure 4 Components shown.

[0071] Accordingly, an embodiment of the present application further provides a computer-readable storage medium storing a computer program, and when the computer program is executed by a computer, the methods provided in the above embodiments can be implemented.

[0072] An embodiment of the present application also provides a computer program product, including a computer program, which implements the methods provided in the above embodiments when executed by a processor.

[0073] The computer program product includes a computer program stored on a non-transitory computer-readable storage medium. The computer program includes program instructions. When the program instructions are executed by a processor, the methods provided in the above embodiments are implemented.

[0074] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0075] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0076] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A data desensitization method, characterized in that: include: Acquire partial data capable of characterizing the information type to which the original data belongs from the original data; At least one character in the remaining data of the original data except the partial data is replaced with a preset character to obtain partially hidden data corresponding to the original data; Performing data encryption processing on the original data to obtain a character string corresponding to the original data; The character string and part of the hidden data are connected through a preset separator to form a desensitized result of the original data.

2. The method according to claim 1, characterized in that Performing data encryption processing on the original data to obtain a character string corresponding to the original data includes: The original data is encrypted using a one-way irreversible algorithm, and the original data is mapped into a character string.

3. The method according to claim 1, characterized in that Performing data encryption processing on the original data to obtain a character string corresponding to the original data includes: A random character string is added to the original data, and data encryption processing is performed on the original data to which the random character string is added, so as to obtain a character string corresponding to the original data.

4. The method according to claim 1, characterized in that The original data is text data.

5. The method according to claim 1, characterized in that The method is applied to the query scenario of the associated data table, then, The encrypting the original data to obtain a character string corresponding to the original data includes: For at least two data tables that need to be associated with each other, the same data encryption processing method is used for the original data in the at least two data tables, so that the same original data in the at least two data tables corresponds to the same character string.

6. The method according to claim 5, characterized in that Replacing at least one character in the remaining data except the partial data in the original data with a preset character to obtain partially hidden data corresponding to the original data, including: For the same original data in the at least two data tables, characters at the same position are selected from the remaining data and replaced with preset characters to obtain the same hidden partial data corresponding to the same original data.

7. A data desensitization device, characterized in that: include: A partial data acquisition unit, used to acquire partial data capable of representing the information type to which the original data belongs from the original data; A character replacement unit, used to replace at least one character in the remaining data of the original data except the partial data with a preset character, so as to obtain partially hidden data corresponding to the original data; A data encryption unit performs data encryption processing on the original data to obtain a character string corresponding to the original data; The result generating unit is used to connect the character string and the partially hidden data through a preset separator to form a desensitization result of the original data.

8. A computing device, characterized in that include: Memory and processor, wherein: The memory is used to store computer programs; The processor is coupled to the memory and is used to execute the computer program stored in the memory to execute the method described in any one of claims 1 to 6.

9. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a computer, it can implement the method described in any one of claims 1 to 6.

10. A computer program product, characterized in that It includes a computer program, which, when executed by a processor, implements the method described in any one of claims 1 to 6.

Images