Data desensitization method and device, equipment and storage medium

Abstract

The embodiment of the invention provides a data desensitization method and device, equipment and a storage medium. The method comprises the steps that multiple to-be-desensitized data tables are obtained; determining an associated data table in the plurality of data tables, and determining a subject identifier corresponding to the associated data table from the associated data table according to a preset subject identifier field; obtaining a desensitization data table; the desensitization data table comprises desensitization data and original data corresponding to the desensitization data before desensitization; querying the main body identifier in the desensitization data table, and adding a record corresponding to the main body identifier in the desensitization data table under the condition that the main body identifier does not exist in the desensitization data table; wherein the record corresponding to the main body identifier comprises the main body identifier and desensitization data corresponding to the main body identifier; and desensitizing the associated data table according to the record corresponding to the main body identifier in the desensitization data table.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing technology, and in particular to a data desensitization method, device, equipment and storage medium. Background Art

[0002] Data desensitization is a technology for protecting sensitive information. It can be done by desensitizing the data to be desensitized that contains sensitive information to obtain desensitized data, and then using the desensitized data to update the original data to be desensitized, so that the data does not expose the original sensitive information while maintaining its use value.

[0003] In order to increase the difficulty of reverse restoration of desensitized data, the current data desensitization process usually adopts a random desensitization algorithm. When the same sensitive data exists in multiple related data tables, due to the use of a random desensitization algorithm, the desensitized data obtained after desensitization of the same sensitive data may be different, resulting in the related data tables being unable to perform related queries based on different desensitized data after desensitization, and thus unable to query relatively complete information. Summary of the invention

[0004] The embodiments of the present disclosure provide a data desensitization method, apparatus, device and storage medium to solve the problem in the related art that a random desensitization algorithm is used to perform desensitization processing on the same sensitive data in an associated data table to obtain different desensitized data, resulting in the associated data table being unable to perform associated queries based on the different desensitized data after the desensitization processing, thereby failing to query relatively complete information.

[0005] In a first aspect, an embodiment of the present disclosure provides a data desensitization method, the method comprising: Obtain multiple data tables to be desensitized; Determine an associated data table among the multiple data tables, and determine the subject identifier corresponding to the associated data table from the associated data table according to a preset subject identifier field; Obtain a desensitized data table; the desensitized data table includes desensitized data and original data before desensitization corresponding to the desensitized data; Querying the subject identifier in the desensitized data table, and if the subject identifier is not in the desensitized data table, adding a record corresponding to the subject identifier in the desensitized data table; wherein the record corresponding to the subject identifier includes the subject identifier and the desensitized data corresponding to the subject identifier; The multiple associated data tables are desensitized according to the records corresponding to the subject identifiers in the desensitized data table.

[0006] In a second aspect, an embodiment of the present disclosure provides a data desensitization device, the device comprising: A first acquisition module is used to acquire multiple data tables to be desensitized; A determination module, configured to determine an associated data table among the plurality of data tables, and determine, from the associated data table according to a preset subject identification field, a subject identification corresponding to the associated data table; A second acquisition module is used to acquire a desensitized data table; the desensitized data table includes desensitized data and original data before desensitization corresponding to the desensitized data; An adding module, used for querying the subject identifier in the desensitized data table, and adding a record corresponding to the subject identifier in the desensitized data table if the subject identifier is not in the desensitized data table; wherein the record corresponding to the subject identifier includes the subject identifier and the desensitized data corresponding to the subject identifier; The desensitizing module is used to desensitize the associated data table according to the record corresponding to the subject identifier in the desensitized data table.

[0007] In a third aspect, an embodiment of the present disclosure provides a data desensitizing device, comprising: a processor; and a memory configured to store computer-executable instructions, wherein the computer-executable instructions, when executed, enable the processor to implement the steps of the method described in the first aspect above.

[0008] In a fourth aspect, an embodiment of the present disclosure provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store computer-executable instructions, and the computer-executable instructions implement the steps of the method described in the first aspect when executed by a processor.

[0009] In a fifth aspect, an embodiment of the present disclosure provides a computer program product, wherein the computer program product includes a computer program, and when the computer program is executed by a processor, the steps of the method described in the first aspect are implemented.

[0010] At least one of the above technical solutions provided by the embodiments of the present invention can achieve the following technical effects: In an embodiment of the present invention, when desensitizing an associated data table, the subject identifier corresponding to the associated data table can be first determined, and the desensitized data table can be queried to see whether the subject identifier is present. If the subject identifier is not present, a new record corresponding to the subject identifier can be added to the desensitized data table, and the newly added record can include the subject identifier and the desensitized data corresponding to the subject identifier. When desensitizing an associated data table, the associated data table can be desensitized based on the newly added subject identifier in the desensitized data table and its corresponding desensitized data. Since the desensitized data corresponding to the subject identifier of the associated data table has been determined in advance, when desensitizing the associated data table, the associated data table can be directly desensitized according to the desensitized data corresponding to the subject identifier of the associated data table in the desensitized data table, thereby effectively maintaining the consistency of the desensitized data corresponding to the subject identifier of the associated data table, so that the desensitized data obtained after desensitizing the same subject identifier in the associated data table is also the same, and the associated data tables after the desensitization processing can also be associated queried, thereby effectively solving the problem in the related technology that the same sensitive data in the associated data table is desensitized by a random desensitization algorithm to obtain different desensitized data, resulting in the associated data tables being unable to be associated queried according to the different desensitized data after the desensitization processing, thereby failing to query relatively complete information. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate one or more embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present disclosure. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative labor. Figure 1 One of the flowcharts of the data desensitization method provided by one embodiment of the present invention; Figure 2 A second flowchart of a data desensitization method provided by an embodiment of the present invention; Figure 3 A second flowchart of a data desensitization method provided by an embodiment of the present invention; Figure 4 A schematic diagram of the module composition of a data desensitization device 400 provided in one embodiment of the present invention; Figure 5 A schematic diagram of the hardware structure of a data desensitization device provided for one embodiment of the present invention. DETAILED DESCRIPTION

[0012] In order to make the technical parties in this technical field better understand the technical aspects of one or more embodiments of the present disclosure, and to make the purpose, technical solutions and advantages of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below in combination with the specific embodiments of the present invention and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0013] The technical solutions provided by various embodiments of the present invention are described in detail below in conjunction with the accompanying drawings.

[0014] See also Figure 1 , Figure 1 One of the flow charts of the data desensitization method provided by one embodiment of the present invention is as follows: Figure 1 As shown, the method comprises the following steps: Step 102: Obtain multiple data tables to be desensitized.

[0015] Step 104: determining an associated data table among the plurality of data tables, and determining a subject identifier corresponding to the associated data table from the associated data table according to a preset subject identifier field.

[0016] Step 106: Obtain a desensitized data table; the desensitized data table includes the desensitized data and the original data before desensitization corresponding to the desensitized data.

[0017] Step 108: Query the subject identifier in the desensitized data table, and if there is no subject identifier in the desensitized data table, add a record corresponding to the subject identifier in the desensitized data table; wherein the record corresponding to the subject identifier includes the subject identifier and the desensitized data corresponding to the subject identifier.

[0018] Step 110: Desensitize the associated data table according to the record corresponding to the subject identifier in the desensitized data table.

[0019] In the embodiment of the present invention, a plurality of data tables to be desensitized may be obtained first. In practical applications, the data tables may be obtained according to requirements.

[0020] For example, the multiple data tables to be desensitized may be data tables in an intermediate database. When a business system is reconstructed or the database is replaced, the newly developed business system can be tested using historical business data. During testing, the database administrator may first export the historical business data from the online database to the intermediate database, then identify sensitive data for the business data in the intermediate database, desensitize the identified sensitive data, export the desensitized data from the intermediate database and transfer it to the test environment, and the tester may use the desensitized data to test the business system. In this application scenario, after exporting the historical business data from the online database to the intermediate database, the multiple data tables in the intermediate database may be identified as multiple data tables to be desensitized.

[0021] In one embodiment of the invention, after obtaining multiple data tables to be desensitized, the multiple data tables to be desensitized can be scanned, and sensitive data that needs to be desensitized can be identified.

[0022] When identifying sensitive data, you can use methods such as keyword matching and data feature matching to identify it. The sensitive data identification schemes corresponding to data of different field types can be different. For example, ID card numbers, passport numbers, mobile phone numbers, insurance policy numbers, etc. can be identified through regular expressions; names, genders, addresses, etc. can be identified through keywords.

[0023] After the sensitive data is identified, relevant information of the sensitive data may be output, for example, the database table name, field name, data type, sensitive data type, identification rule, etc. of the sensitive data may be output.

[0024] In addition, when identifying sensitive data, you can also classify the sensitive data according to the field type of the sensitive data. For example, sensitive data can be divided into two levels: high sensitivity and low sensitivity. Among them, business-related field types such as policy number and order number can be low sensitivity; while identity-related field types such as ID number and passport number can be high sensitivity.

[0025] In one example, the process of identifying sensitive data can be as follows: Figure 2 As shown, you can first define the identification rules for sensitive data, and the identification rules corresponding to sensitive data of different field types can be different. Then, you can perform sensitive data detection on multiple data tables in the database, and after detecting sensitive data, you can classify and mark the sensitive data according to the field type. After marking, in order to prevent identification errors, you can verify the sensitive data. Through this identification process, you can more accurately and comprehensively identify all sensitive data in the data table to be desensitized, thereby laying a high data foundation for the subsequent data desensitization process.

[0026] After the sensitive data is identified, the identified sensitive data can be confirmed to exclude the non-sensitive data that was identified incorrectly.

[0027] Then, the associated data tables among the acquired multiple data tables can be determined. In one embodiment of the invention, when determining the associated data tables, the data tables among the multiple data tables that meet at least one of the specified conditions can be determined as the associated data tables among the multiple data tables, wherein the specified conditions can be: data tables containing the same preset fields, the same preset fields are preset fields with the same field type and field content; there is a foreign key association.

[0028] Considering that there may be related data tables in multiple data tables, for example, the same customer information is scattered and stored in multiple data tables, more information about the customer can be obtained after associating these data tables, so as to provide better services to the customer. Therefore, after obtaining multiple data tables, the embodiment of the present invention determines the related data tables in the multiple data tables.

[0029] When determining associated data tables, it can be determined directly manually. Relevant personnel can determine the tables with associated relationships in multiple data tables from the perspective of business and data tables. It can also be determined not manually but by whether there is a foreign key association. For example, if a table contains the primary key of another table containing customer main information, and this table also has customer sensitive information, then the two tables are associated, and the two tables can be determined as associated data tables. In addition, it can also be determined whether it is an associated data table by whether it contains data tables with the same preset fields. Considering that mobile phone numbers are usually authenticated by real name, the mobile phone number can be set as a preset field. When both data tables contain the mobile phone number field and the content of the mobile phone number is the same, the two data tables can be determined as associated data tables.

[0030] After determining the associated data tables, for these associated data tables, you can select some data that can uniquely represent the main information of the data table. For example, taking a data table that records customer information as an example, the customer information can be distributed in the associated data table. At this time, you can select some data that can uniquely represent the customer subject from the associated data table, such as the customer's ID card information, the customer's mobile phone number, etc.

[0031] In one embodiment of the invention, a subject identification field may be preset to determine the subject identification corresponding to the associated data table from the associated data table according to the preset subject identification field. The preset subject identification field may include at least one of the following: certificate information, mobile phone number, and the certificate information may include: certificate type, certificate number, and certificate name.

[0032] After determining the subject identifier corresponding to the associated data table, a desensitized data table may be obtained, wherein the desensitized data table may include desensitized data and original data before desensitization corresponding to the desensitized data. Then, the subject identifier may be queried in the obtained desensitized data table.

[0033] If there is no subject identifier corresponding to the above-mentioned associated data table in the desensitized data table, a record corresponding to the subject identifier may be added to the desensitized data table. The record corresponding to the subject identifier may include the subject identifier and the desensitized data corresponding to the subject identifier.

[0034] If the subject identifier is ID information or mobile phone number, you can check in the desensitized data table whether the ID information or mobile phone number exists. If neither exists, you can add a new record to the desensitized data table. This new record can include the ID information or mobile phone number, as well as the desensitized data corresponding to the ID information or mobile phone number.

[0035] In one embodiment of the invention, the record corresponding to the subject identifier may also include the data to be desensitized other than the subject identifier in the associated data table, and the desensitized data corresponding to the data to be desensitized other than the subject identifier. That is, it may include other sensitive data other than the subject identifier in all the sensitive data determined above, such as customer email address, customer home address, frame number, insurance policy number, etc. Then, in the case that there is no subject identifier corresponding to the associated data table in the desensitized data table, when adding the record corresponding to the subject identifier in the desensitized data table, the data to be desensitized in the associated data table can be determined first, and the desensitized data corresponding to the data to be desensitized can be determined according to the preset random desensitization algorithm and the field type of the data to be desensitized, wherein different field types correspond to different preset random desensitization algorithms, and then, according to the data to be desensitized and the desensitized data corresponding to the data to be desensitized, the record corresponding to the subject identifier can be added to the desensitized data table.

[0036] In addition, in order to ensure the consistency of sensitive data after desensitization, the preset random desensitization algorithms corresponding to the same data to be desensitized in the data to be desensitized can be the same, and the desensitized data corresponding to the same data to be desensitized in the data to be desensitized can be the same, where the same data to be desensitized refers to data with the same field type and field content in the data to be desensitized.

[0037] When determining the desensitized data corresponding to sensitive data, a random desensitization algorithm can be used to determine it, which can effectively ensure that the desensitized data cannot be restored to the original data, effectively protect the security of sensitive information, and keep the data valuable while not exposing the original sensitive information. In order to ensure that the desensitized data corresponding to the same sensitive data in different data tables is also the same, the desensitization algorithm corresponding to the same sensitive data is the same.

[0038] In an embodiment of the present invention, the desensitized data obtained after desensitization can completely simulate the original sensitive data before desensitization in terms of format and content, thereby minimizing the impact on subsequent processes, such as not affecting normal use in subsequent test business systems. It can also ensure that the desensitized data has high validity and consistency, and has the same statistical characteristics as the original sensitive data.

[0039] As shown in the following table, the desensitization algorithm for some sensitive data can better balance statistical characteristics, efficiency and consistency: Table 1

[0040] In an embodiment of the present invention, if there is a foreign key association between the above-determined associated data tables, when a record corresponding to the subject identifier is added to the desensitized data table, the newly added record may also include the primary key of the associated data table with the foreign key association.

[0041] If there are foreign key associations between related data tables, primary keys can be designed in these related data tables, and the primary keys in the tables are used as foreign keys to associate with other data tables. If these primary keys are not in the newly added records, these primary key information cannot be saved. Some fields can be set in the newly added records, such as extended primary key fields, to store the primary keys of the related data tables with foreign key associations.

[0042] In an embodiment of the present invention, if the subject identifier corresponding to the associated data table is queried in the obtained desensitized data table, the desensitized data corresponding to the subject identifier in the desensitized data table can be directly obtained without adding a new record.

[0043] Desensitize the associated data table based on the records corresponding to the subject identifier in the desensitized data table.

[0044] In an embodiment of the present invention, the desensitized data in the record corresponding to the subject identifier in the desensitized data table can be used to replace the corresponding data to be desensitized in the associated data table, and then, other sensitive data in the associated data table that has not been desensitized can be desensitized according to the primary key of the associated data table in the record. When desensitizing other sensitive data in the associated data table that has not been desensitized, if the data to be desensitized corresponding to other sensitive data is stored in the record, it can be directly replaced; if the data to be desensitized corresponding to other sensitive data is not stored, desensitization processing can be performed based on a random desensitization algorithm.

[0045] In another embodiment of the invention, for the above other sensitive data, if the subsequent processing does not need to use its data characteristics, simple desensitization methods such as shielding, deformation, and replacement can be directly adopted, which is faster and has better performance. Among them, the shielding strategy can be shown in Table 2: Table 2

[0046] For example, the data to be desensitized may be the information of the express recipient, and the other sensitive data mentioned above may be the mobile phone number and address, etc. Since the mobile phone number and address have no other uses in the express delivery scenario, the shielding strategy can be directly used for desensitization.

[0047] In an embodiment of the present invention, for non-associated data tables among the multiple data to be desensitized, that is, other data tables except the above-mentioned associated data tables, since there is no need to consider the requirement of associated query data, when desensitizing, a random desensitization algorithm can be directly used or a shielding strategy can be used as shown in Table 2 to perform desensitization.

[0048] In one example, the multiple data tables to be desensitized may be the data tables in the intermediate database mentioned in the above example. Figure 3 As shown, during testing, the database administrator can first export the historical business data from the online database to the intermediate database, and then identify the sensitive data of the business data in the intermediate database. During identification, the sensitive data can be scanned and the data desensitization type can be marked. Then, it is determined whether there is an association relationship between the data tables. For the data tables with an association relationship, the unique subject identifier is determined, and the corresponding desensitization algorithm is selected according to the desensitization type to generate random desensitized data. The original sensitive data and desensitized data are written into the desensitized data table by adding new records, and the sensitive data is replaced with the corresponding desensitized data according to the desensitized data table; for the data tables without an association relationship, the sensitive data can be directly desensitized. After the desensitization is successful, the desensitized data can be exported from the intermediate database and transferred to the test environment, and the tester uses the desensitized data to test the business system.

[0049] Through the embodiment of the present invention, the desensitized data is displayed in the system as ordinary data, and can keep the information consistent in multiple applications / modules. For example, the insurance policy and customer information are stored in application module 1, and the value-added services and customer information are stored in application module 2. Application module 1 can correctly match and obtain all value-added services of the customer from application module 2 through the new desensitized customer certificate information. If the customer data is desensitized using *, the correct value-added service information cannot be obtained, and it cannot match or matches too much data. Unified customer information can connect the upstream and downstream system function modules in series, which is very important in the full process test of the system. And the unified and complete customer information retains the behavioral characteristics of the original customer in the system, and customer behavior analysis can still be performed. In the system function, it is necessary to verify the customer information, and the new desensitized customer information meets all data characteristics, so it can pass the data verification.

[0050] The new anonymized customer data is random, has low data repetition, and maintains distribution characteristics consistent with the real data in the production environment, thereby reducing the impact on performance testing and effectively improving the accuracy of subsequent performance testing.

[0051] In an embodiment of the present invention, when desensitizing an associated data table, the subject identifier corresponding to the associated data table can be first determined, and the desensitized data table can be queried to see whether the subject identifier is present. If the subject identifier is not present, a new record corresponding to the subject identifier can be added to the desensitized data table, and the newly added record can include the subject identifier and the desensitized data corresponding to the subject identifier. When desensitizing an associated data table, the associated data table can be desensitized based on the newly added subject identifier in the desensitized data table and its corresponding desensitized data. Since the desensitized data corresponding to the subject identifier of the associated data table has been determined in advance, when desensitizing the associated data table, the associated data table can be directly desensitized according to the desensitized data corresponding to the subject identifier of the associated data table in the desensitized data table, thereby effectively maintaining the consistency of the desensitized data corresponding to the subject identifier of the associated data table, so that the desensitized data obtained after desensitizing the same subject identifier in the associated data table is also the same, and the associated data tables after the desensitization processing can also be associated queried, thereby effectively solving the problem in the related technology that the same sensitive data in the associated data table is desensitized by a random desensitization algorithm to obtain different desensitized data, resulting in the associated data tables being unable to be associated queried according to the different desensitized data after the desensitization processing, thereby failing to query relatively complete information.

[0052] Corresponding to the above data desensitization method, an embodiment of the present invention further provides a data desensitization device, Figure 4 A schematic diagram of the module composition of the data desensitization device 400 provided in an embodiment of the present invention is shown in FIG. Figure 3 As shown, the data desensitization device 400 includes: A first acquisition module 401 is used to acquire multiple data tables to be desensitized; The determination module 402 is used to determine an associated data table among the multiple data tables, and determine the subject identification corresponding to the associated data table from the associated data table according to a preset subject identification field; The second acquisition module 403 is used to acquire a desensitized data table; the desensitized data table includes desensitized data and original data before desensitization corresponding to the desensitized data; An adding module 404 is used to query the subject identifier in the desensitized data table, and if the subject identifier is not in the desensitized data table, add a record corresponding to the subject identifier in the desensitized data table; wherein the record corresponding to the subject identifier includes the subject identifier and the desensitized data corresponding to the subject identifier; The desensitizing module 405 is used to desensitize the associated data table according to the record corresponding to the subject identifier in the desensitized data table.

[0053] Optionally, the determining module 402 is used to: A data table among the multiple data tables that satisfies at least one of the specified conditions is determined as an associated data table among the multiple data tables; the specified conditions are: data tables containing the same preset fields; and there is a foreign key association.

[0054] Optionally, the preset subject identification field includes at least one of the following: certificate information, mobile phone number; wherein the certificate information includes: certificate type, certificate number and certificate name.

[0055] Optionally, the record corresponding to the subject identifier also includes the data to be desensitized except the subject identifier in the associated data table, and the desensitized data corresponding to the data to be desensitized except the subject identifier; The adding module 403 is used for: Determine the data to be desensitized in the associated data table; Determine the desensitized data corresponding to the data to be desensitized according to the preset random desensitization algorithm and the field type of the data to be desensitized; wherein different field types correspond to different preset random desensitization algorithms; According to the data to be desensitized and the desensitized data corresponding to the data to be desensitized, a record corresponding to the subject identifier is added to the desensitized data table.

[0056] Optionally, the preset random desensitization algorithms corresponding to the same data to be desensitized in the data to be desensitized are the same; the desensitized data corresponding to the same data to be desensitized in the data to be desensitized are the same; and the data with the same field type and field content in the data to be desensitized are the same data to be desensitized.

[0057] Optionally, when a foreign key association exists in the associated data table, the record corresponding to the subject identifier also includes the primary key of the associated data table.

[0058] In an embodiment of the present invention, when desensitizing an associated data table, the subject identifier corresponding to the associated data table can be first determined, and the desensitized data table can be queried to see whether the subject identifier is present. If the subject identifier is not present, a new record corresponding to the subject identifier can be added to the desensitized data table, and the newly added record can include the subject identifier and the desensitized data corresponding to the subject identifier. When desensitizing an associated data table, the associated data table can be desensitized based on the newly added subject identifier in the desensitized data table and its corresponding desensitized data. Since the desensitized data corresponding to the subject identifier of the associated data table has been determined in advance, when desensitizing the associated data table, the associated data table can be directly desensitized according to the desensitized data corresponding to the subject identifier of the associated data table in the desensitized data table, thereby effectively maintaining the consistency of the desensitized data corresponding to the subject identifier of the associated data table, so that the desensitized data obtained after desensitizing the same subject identifier in the associated data table is also the same, and the associated data tables after the desensitization processing can also be associated queried, thereby effectively solving the problem in the related technology that the same sensitive data in the associated data table is desensitized by a random desensitization algorithm to obtain different desensitized data, resulting in the associated data tables being unable to be associated queried according to the different desensitized data after the desensitization processing, thereby failing to query relatively complete information.

[0059] Corresponding to the above data desensitization method, an embodiment of the present invention further provides a data desensitization device, Figure 5 A schematic diagram of the hardware structure of a data desensitization device provided for one embodiment of the present invention.

[0060] The data desensitizing device may be a terminal device or server for desensitizing data provided in the above-mentioned embodiment.

[0061] The data desensitization device may have relatively large differences due to different configurations or performances, and may include one or more processors 501 and memory 502, and one or more storage applications or data may be stored in the memory 502. Among them, the memory 502 can be short-term storage or persistent storage. The application stored in the memory 502 may include one or more modules (not shown in the figure), and each module may include a series of computer executable instructions in the data desensitization device. Furthermore, the processor 501 can be configured to communicate with the memory 502 and execute a series of computer executable instructions in the memory 502 on the data desensitization device. The data desensitization device may also include one or more power supplies 503, one or more wired or wireless network interfaces 504, one or more input and output interfaces 505, and one or more keyboards 506.

[0062] Specifically in this embodiment, the data desensitizing device includes a memory and one or more programs, wherein the one or more programs are stored in the memory, and the one or more programs may include one or more modules, and each module may include a series of computer executable instructions in the data desensitizing device, and is configured to be executed by one or more processors.

[0063] In an embodiment of the present invention, when desensitizing an associated data table, the subject identifier corresponding to the associated data table can be first determined, and the desensitized data table can be queried to see whether the subject identifier is present. If the subject identifier is not present, a new record corresponding to the subject identifier can be added to the desensitized data table, and the newly added record can include the subject identifier and the desensitized data corresponding to the subject identifier. When desensitizing an associated data table, the associated data table can be desensitized based on the newly added subject identifier in the desensitized data table and its corresponding desensitized data. Since the desensitized data corresponding to the subject identifier of the associated data table has been determined in advance, when desensitizing the associated data table, the associated data table can be directly desensitized according to the desensitized data corresponding to the subject identifier of the associated data table in the desensitized data table, thereby effectively maintaining the consistency of the desensitized data corresponding to the subject identifier of the associated data table, so that the desensitized data obtained after desensitizing the same subject identifier in the associated data table is also the same, and the associated data tables after the desensitization processing can also be associated queried, thereby effectively solving the problem in the related technology that the same sensitive data in the associated data table is desensitized by a random desensitization algorithm to obtain different desensitized data, resulting in the associated data tables being unable to be associated queried according to the different desensitized data after the desensitization processing, thereby failing to query relatively complete information.

[0064] Another embodiment of the present disclosure further provides a computer-readable storage medium, wherein the computer-readable storage medium is used to store computer-executable instructions, and the computer-executable instructions implement the above process when executed by a processor.

[0065] The storage medium in the embodiment of the present disclosure can implement each process of the above-mentioned data desensitization method embodiment and achieve the same effect and function, which will not be repeated here.

[0066] Another embodiment of the present disclosure further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the above process is implemented.

[0067] The computer program product in the embodiments of the present disclosure can implement the various processes of the above-mentioned data desensitization method embodiment and achieve the same effects and functions, which will not be repeated here.

[0068] In various embodiments of the present disclosure, the computer-readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0069] In the 1990s, it was very clear whether the improvement of a technology was hardware improvement (for example, improvement of the circuit structure of diodes, transistors, switches, etc.) or software improvement (improvement of the method flow). However, with the development of technology, many improvements of the method flow today can be regarded as direct improvements of the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented with a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming themselves, without having to ask chip manufacturers to design and make dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one kind of HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0070] The controller may be implemented in any suitable manner, for example, the controller may take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (e.g., software or firmware) executable by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320, and the memory controller may also be implemented as part of the control logic of the memory. It is also known to those skilled in the art that, in addition to implementing the controller in a purely computer-readable program code manner, the controller may be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, such a controller may be considered as a hardware component, and the devices for implementing various functions included therein may also be considered as structures within the hardware component. Or even, the devices for implementing various functions may be considered as both software modules for implementing the method and structures within the hardware component.

[0071] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0072] For the convenience of description, the above devices are described in terms of functions and are divided into various units. Of course, when implementing the embodiments of the present disclosure, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0073] It should be understood by those skilled in the art that one or more embodiments of the present disclosure may be provided as a method, system or computer program product. Therefore, one or more embodiments of the present disclosure may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, one or more embodiments of the present disclosure may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0074] The present disclosure is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present disclosure. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0075] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0076] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0077] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0078] One or more embodiments of the present disclosure may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present disclosure may also be practiced in distributed computing environments in which tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0079] Each embodiment in the present disclosure is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0080] The above description is only an embodiment of the present disclosure and is not intended to limit the present disclosure. For those skilled in the art, the present disclosure may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present disclosure shall be included in the scope of the claims of the present disclosure.

Claims

1. A data desensitization method, characterized in that: The method comprises: Obtain multiple data tables to be desensitized; Determine an associated data table among the multiple data tables, and determine the subject identifier corresponding to the associated data table from the associated data table according to a preset subject identifier field; Obtain a desensitized data table; the desensitized data table includes desensitized data and original data before desensitization corresponding to the desensitized data; Querying the subject identifier in the desensitized data table, and if the subject identifier is not in the desensitized data table, adding a record corresponding to the subject identifier in the desensitized data table; wherein the record corresponding to the subject identifier includes the subject identifier and the desensitized data corresponding to the subject identifier; The associated data table is desensitized according to the record corresponding to the subject identifier in the desensitized data table.

2. The method according to claim 1, characterized in that The determining of the associated data table among the multiple data tables includes: A data table among the multiple data tables that satisfies at least one of the specified conditions is determined as an associated data table among the multiple data tables; the specified conditions are: data tables containing the same preset fields; and there is a foreign key association.

3. The method according to claim 1, characterized in that The preset subject identification field includes at least one of the following: certificate information, mobile phone number; wherein the certificate information includes: certificate type, certificate number and certificate name.

4. The method according to claim 3, characterized in that The record corresponding to the subject identifier also includes the data to be desensitized except the subject identifier in the associated data table, and the desensitized data corresponding to the data to be desensitized except the subject identifier; Adding a record corresponding to the subject identifier in the desensitized data table includes: Determine the data to be desensitized in the associated data table; Determine the desensitized data corresponding to the data to be desensitized according to the preset random desensitization algorithm and the field type of the data to be desensitized; wherein different field types correspond to different preset random desensitization algorithms; According to the data to be desensitized and the desensitized data corresponding to the data to be desensitized, a record corresponding to the subject identifier is added to the desensitized data table.

5. The method according to claim 4, characterized in that The preset random desensitization algorithms corresponding to the same data to be desensitized in the data to be desensitized are the same; the desensitized data corresponding to the same data to be desensitized in the data to be desensitized are the same; The data to be desensitized that have the same field type and field content are the same data to be desensitized.

6. The method according to claim 2, characterized in that In the case where a foreign key association exists in the associated data table, the record corresponding to the subject identifier also includes the primary key of the associated data table.

7. A data desensitization device, characterized in that: The device comprises: A first acquisition module is used to acquire multiple data tables to be desensitized; A determination module, configured to determine an associated data table among the plurality of data tables, and determine, from the associated data table according to a preset subject identification field, a subject identification corresponding to the associated data table; A second acquisition module is used to acquire a desensitized data table; the desensitized data table includes desensitized data and original data before desensitization corresponding to the desensitized data; An adding module, used for querying the subject identifier in the desensitized data table, and adding a record corresponding to the subject identifier in the desensitized data table if the subject identifier is not in the desensitized data table; wherein the record corresponding to the subject identifier includes the subject identifier and the desensitized data corresponding to the subject identifier; The desensitizing module is used to desensitize the associated data table according to the record corresponding to the subject identifier in the desensitized data table.

8. A data desensitization device, characterized in that: include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program implements the steps of the method according to any one of claims 1 to 6 when executed by the processor.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium is used to store computer-executable instructions, and when the computer-executable instructions are executed by a processor, the steps of the method described in any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images