Sensitive information positioning and shielding method, system equipment and storage medium

Abstract

The invention discloses a sensitive information positioning and shielding method. The sensitive information positioning and shielding method comprises the following steps: acquiring a character string needing to be processed by calling a sensitive information shielding module; splitting the character string according to consensus knowledge to obtain a sub-character string set; carrying out sensitive information feature judgment on all sub-character strings in the sub-character string set; if the character string is judged to be a non-sensitive character string, skipping and not processing; if the character string is judged to be a sensitive character string, performing shielding processing according to the judged category and the corresponding category; and processing all the sub-character strings, restoring the sub-character strings into an output format, and returning a result. Automatic sensitive information masking of various interactive contents in the financial industry is realized, supervision requirements are met, and intrusive transformation of business logic codes is not needed. A requester only needs to add a section and call a shielding system on an output layer, a database interaction layer or a log printing layer, so that the workload can be effectively reduced, the service function and the system performance are not influenced, and the normal operation of the service is ensured.

Description

Technical Field

[0001] The present invention relates to the field of Internet information security technology, in particular to Internet information security applied in the financial industry, and more particularly to a method, system equipment and storage medium for locating and shielding sensitive information. Background Art

[0002] In the current practice of sensitive information masking, a variety of methods are widely used, such as the masking method using string replacement functions, log formatting components supported by log4j, and processing methods using regular expressions. However, each method has its inherent limitations. Directly using string replacement functions for masking, although simple to operate, requires modification in all business logics involving sensitive information, and this method will change the value of the original string, which will have an intrusive impact on the business logic. Especially in scenarios such as log printing, it is usually necessary to perform masking without changing the original value, which makes it difficult for the direct replacement method to meet the needs. Although log formatting components such as log4j provide masking functions, they usually only support replacing content with fixed values, which cannot meet the financial industry's needs for partial masking of sensitive information or different masking formats for different sensitive information. In addition, although using regular expressions to match and replace sensitive information is flexible, it is easy to cause performance problems when processing large amounts of data. At present, these sensitive information masking processing methods are scattered in various links such as input and output logic, database operations, and business processing, lacking the ability of centralized management and unified configuration. This results in the need for technical modifications to be made in different application systems to shield sensitive information, increasing the complexity and cost of maintenance.

[0003] Therefore, overcoming the limitations of existing methods, developing a unified sensitive information masking tool or platform for centralized management of masking rules, and providing unified masking services for different application systems and business logics, thereby improving masking efficiency, accuracy and security and reducing the complexity of management and maintenance are technical issues that need to be addressed urgently. Summary of the invention

[0004] This application provides one or more technical solutions to solve the above-mentioned defects of the prior art, realize the input of all common interactive content, and effectively mask sensitive information such as ID card, name, mobile phone number, card number, etc., so that the business system can meet regulatory requirements without intrusive modification of the business logic code of the system. To this end, this solution provides a method, system equipment and storage medium for locating and masking sensitive information to solve at least one of the above-mentioned technical problems.

[0005] To achieve the above objectives, in a first aspect, the present invention provides a method for locating and shielding sensitive information, comprising:

[0006] Call the sensitive information masking module to obtain the string that needs to be processed;

[0007] According to the consensus knowledge, the string is split to obtain a substring set;

[0008] Determine sensitive information features of all substrings in the substring set; if determined to be non-sensitive strings, skip and do not process; if determined to be sensitive strings, mask them according to their corresponding categories based on the determined categories;

[0009] After completing all the substring processing, the result is returned after being restored to the output format.

[0010] Furthermore, the consensus knowledge includes: common message interaction specifications in the financial industry, common communication formats in information systems, log output, database statements, shell script formats and other knowledge.

[0011] Furthermore, the sensitive information characteristics include: personal identity information, bank account information, transaction records, corporate financial data, strategic decisions, marketing plans, etc.

[0012] Furthermore, the determined category is masked according to its corresponding category. When the category is identified as a mobile phone number, it is masked in the manner of first 3 and last 4. When the category is identified as other information, a reserved interface is used to allow the consumer to define the information format to be processed and its masking format, and inject the configuration to realize the configuration and inspection of custom rules.

[0013] In a second aspect, the present invention also provides a system for locating and masking sensitive information, the system comprising: an information calling unit, an information splitting unit, a feature determination unit, and an output unit;

[0014] The information calling unit is used to call the sensitive information shielding module to obtain the character string to be processed;

[0015] The information splitting unit is used to split the string according to the consensus knowledge to obtain a substring set;

[0016] The feature determination unit is used to determine the sensitive information features of all substrings in the substring set; if it is determined to be a non-sensitive string, it is skipped and not processed; if it is determined to be a sensitive string, it is masked according to its corresponding category according to the determined category;

[0017] The output unit is used to complete all the substring processing, restore the results to the output format and return them.

[0018] Furthermore, the consensus knowledge includes: common message interaction specifications in the financial industry, common communication formats in information systems, log output, database statements, shell script formats and other knowledge.

[0019] Furthermore, the sensitive information characteristics include: personal identity information, bank account information, transaction records, corporate financial data, strategic decisions, marketing plans, etc.

[0020] Furthermore, the determined category is masked according to its corresponding category. When the category is identified as a mobile phone number, it is masked in the manner of first 3 and last 4. When the category is identified as other information, a reserved interface is used to allow the consumer to define the information format to be processed and its masking format, and inject the configuration to realize the configuration and inspection of custom rules.

[0021] In a third aspect, the present invention provides a computing device, comprising:

[0022] A memory for storing program instructions;

[0023] The processor is used to call the program instructions stored in the memory and execute the above-mentioned method of locating and masking sensitive information according to the obtained program instructions.

[0024] In a fourth aspect, the present invention provides a computer-readable storage medium, including computer-readable instructions. When a computer reads and executes the computer-readable instructions, the above-mentioned method of locating and masking sensitive information is implemented. The readable medium may be multiple, and the multiple readable media can operate independently of each other.

[0025] Compared with the prior art, this solution obtains the string to be processed by calling the sensitive information masking module; splits the string according to the consensus knowledge to obtain a substring set; determines the sensitive information characteristics of all substrings in the substring set; if it is determined to be a non-sensitive string, it is skipped and not processed; if it is determined to be a sensitive string, it is masked according to its corresponding category according to the determined category; after completing all the substring processing, the result is returned after restoring it to the output format. Automatic sensitive information masking of various interactive contents in the financial industry is realized to meet regulatory requirements without intrusive modification of business logic code. The requester only needs to add a section in the output layer, database interaction layer or log printing layer and call the masking system to effectively reduce the workload, ensure that business functions and system performance are not affected, and ensure the normal operation of the business. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present disclosure. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0027] Figure 1 A schematic flow chart of an embodiment of a method for locating and shielding sensitive information provided by the present invention;

[0028] Figure 2 A framework diagram of an embodiment of the method for locating and shielding sensitive information provided by the present invention;

[0029] Figure 3 A structural block diagram of an embodiment of the system for locating and shielding sensitive information provided by the present invention. DETAILED DESCRIPTION

[0030] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be interpreted as limiting the present application.

[0031] It will be understood by those skilled in the art that, unless otherwise stated, the singular forms "a", "an" and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present application refers to the presence of features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0032] In order to make the objectives, technical solutions and advantages of the present application more clear, the specific implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0033] The core of the present invention is to provide a method for locating and shielding sensitive information. Figure 1 FIG. 1 is a flow chart of a method for locating and shielding sensitive information provided in this embodiment. Figure 2 The figure shows a framework diagram of the method for locating and shielding sensitive information provided by this embodiment. In order to better understand the method, Figure 1 and Figure 2 The technical solution of this embodiment is described in detail:

[0034] Step S1: calling the sensitive information shielding module to obtain the character string to be processed.

[0035] In a preferred embodiment, the sensitive information shielding module or the function or component of the sensitive information shielding system is called to obtain the character string to be processed. The character string comes from various data sources, such as user input, database records or network transmission data.

[0036] Step S2: split the string according to the consensus knowledge to obtain a set of substrings.

[0037] In a preferred embodiment, splitting the character string includes dividing based on specific characters, vocabulary or grammatical structure.

[0038] Step S3: Determine sensitive information features of all substrings in the substring set; if determined to be non-sensitive strings, skip and do not process; if determined to be sensitive strings, mask them according to the determined category and their corresponding categories.

[0039] In a preferred embodiment, sensitive information features are determined for each substring in the substring set. The determination process involves analysis of multiple dimensions such as the content, format, and context of the substring. If the substring is determined to be a non-sensitive string, no processing is performed on it. If the substring is determined to be a sensitive string, it is masked according to the determined category (e.g., personal information, password, bank account, etc.). The specific methods of masking may include replacement, encryption, deletion, or obfuscation.

[0040] Step S4: After all the substring processing is completed and the result is restored to the output format, it is returned.

[0041] In a preferred embodiment, after all substrings have been processed, they are restored to their original output format and the results are returned.

[0042] In this way, the sensitive information in the original string is effectively located and masked, thereby protecting privacy and information security. The sensitive information location and masking method provided in this embodiment has broad application prospects in practical applications, especially when processing information containing personal privacy or commercial secrets. By automatically identifying and masking sensitive information, the risk caused by information leakage can be effectively reduced.

[0043] In a preferred embodiment, the consensus knowledge includes: common message interaction specifications in the financial industry, common communication formats in information systems, log output, database statements, shell script formats and other knowledge.

[0044] In a preferred embodiment, the sensitive information characteristics include: personal identity information, bank account information, transaction records, corporate financial data, strategic decisions, marketing plans, etc.

[0045] In a preferred embodiment, the determined category is masked according to its corresponding category. When its category is identified as a mobile phone number, it is masked in the manner of first 3 and last 4. When its category is identified as other information, a reserved interface is used to allow the consumer to define the information format to be processed and its masking format, and inject the configuration to implement the configuration and inspection of custom rules.

[0046] This solution obtains the string to be processed by calling the sensitive information masking module; splits the string according to the consensus knowledge to obtain a substring set; determines the sensitive information characteristics of all substrings in the substring set; if it is determined to be a sensitive string, it is masked according to its corresponding category according to the determined category; after completing all the substring processing, the result is returned after restoring it to the output format. Automatic sensitive information masking of various interactive contents in the financial industry is realized to meet regulatory requirements without intrusive modification of business logic code. The requester only needs to add a section in the output layer, database interaction layer or log printing layer and call the masking system to effectively reduce the workload, ensure that business functions and system performance are not affected, and ensure the normal operation of the business.

[0047] In one embodiment, a system for locating and masking sensitive information is provided. Figure 3 The figure shows a block diagram of a system structure for locating and shielding sensitive information provided by this embodiment, wherein the system comprises: an information calling unit 10, an information splitting unit 20, a feature determination unit 30, and an output unit 40;

[0048] Information calling unit 10: used to call the sensitive information shielding module to obtain the character string that needs to be processed.

[0049] In a preferred embodiment, the sensitive information shielding module or the function or component of the sensitive information shielding system is called to obtain the character string to be processed. The character string comes from various data sources, such as user input, database records or network transmission data.

[0050] The information splitting unit 20 is used to split the string according to the consensus knowledge to obtain a substring set.

[0051] In a preferred embodiment, splitting the character string includes dividing based on specific characters, vocabulary or grammatical structure.

[0052] Feature determination unit 30: used to perform sensitive information feature determination on all substrings in the substring set; if determined to be a non-sensitive string, skip and do not process; if determined to be a sensitive string, mask the string according to the determined category and its corresponding category.

[0053] In a preferred embodiment, sensitive information features are determined for each substring in the substring set. The determination process involves analysis of multiple dimensions such as the content, format, and context of the substring. If the substring is determined to be a non-sensitive string, no processing is performed on it. If the substring is determined to be a sensitive string, it is masked according to the determined category (e.g., personal information, password, bank account, etc.). The specific methods of masking may include replacement, encryption, deletion, or obfuscation.

[0054] Output unit 40: used to complete all the substring processing, restore to output format and return the result.

[0055] In a preferred embodiment, after all substrings have been processed, they are restored to their original output format and the results are returned.

[0056] In a preferred embodiment, the consensus knowledge includes: common message interaction specifications in the financial industry, common communication formats in information systems, log output, database statements, shell script formats and other knowledge.

[0057] In a preferred embodiment, the sensitive information characteristics include: personal identity information, bank account information, transaction records, corporate financial data, strategic decisions, marketing plans, etc.

[0058] In a preferred embodiment, the determined category is masked according to its corresponding category. When its category is identified as a mobile phone number, it is masked in the manner of first 3 and last 4. When its category is identified as other information, a reserved interface is used to allow the consumer to define the information format to be processed and its masking format, and inject the configuration to implement the configuration and inspection of custom rules.

[0059] This solution obtains the string to be processed by calling the sensitive information masking module; splits the string according to the consensus knowledge to obtain a substring set; determines the sensitive information characteristics of all substrings in the substring set; if it is determined to be a sensitive string, it is masked according to its corresponding category according to the determined category; after completing all the substring processing, the result is returned after restoring it to the output format. Automatic sensitive information masking of various interactive contents in the financial industry is realized to meet regulatory requirements without intrusive modification of business logic code. The requester only needs to add a section in the output layer, database interaction layer or log printing layer and call the masking system to effectively reduce the workload, ensure that business functions and system performance are not affected, and ensure the normal operation of the business.

[0060] The system for locating and masking sensitive information of the present embodiment is used to implement the aforementioned method for locating and masking sensitive information. Therefore, the specific implementation method of the system for locating and masking sensitive information can be found in the specific implementation method of the method for locating and masking sensitive information in the previous text. For example, the information calling unit 10 is used to implement step S1 in the aforementioned method for locating and masking sensitive information, the information splitting unit 20 is used to implement step S2 in the aforementioned method for locating and masking sensitive information, the feature determination unit 30 is used to implement step S3 in the aforementioned method for locating and masking sensitive information, and the output unit 40 is used to implement step S4 in the aforementioned method for locating and masking sensitive information. Therefore, its specific implementation method can refer to the description of the corresponding embodiments of each part. The system provided by the present invention is attached to the method provided by the present invention. Its specific effects can refer to the above method and will not be repeated here.

[0061] In one embodiment, a computing device is provided, comprising:

[0062] A memory for storing program instructions;

[0063] A processor is used to implement the steps of any of the above-mentioned methods for locating and masking sensitive information when executing the computer program. A method for locating and masking sensitive information of the present invention has obvious advantages and beneficial effects compared with the prior art. According to consensus knowledge, a character string is split to obtain a substring set; sensitive information features of all substrings in the substring set are determined; if it is determined to be a sensitive character string, it is masked according to its corresponding category according to the determined category; after completing all the substring processing, the result is returned after restoring it to the output format. Automatic sensitive information masking of various interactive contents in the financial industry is realized, which meets regulatory requirements without the need for intrusive modification of business logic code. The requester only needs to add a section in the output layer, database interaction layer or log printing layer, and call the masking system to effectively reduce the workload, ensure that business functions and system performance are not affected, and ensure the normal operation of the business.

[0064] In one embodiment, a computer-readable storage medium is provided, including computer-readable instructions. When a computer reads and executes the computer-readable instructions, the steps of the method for locating and masking sensitive information described above are implemented. Compared with the prior art, the method for locating and masking sensitive information of the present invention has obvious advantages and beneficial effects. According to the consensus knowledge, the string is split to obtain a substring set; all substrings in the substring set are subjected to sensitive information feature determination; if it is determined to be a sensitive string, it is masked according to its corresponding category according to the determined category; after completing all the substring processing, the result is returned after restoring to the output format. Automatic sensitive information masking of various interactive contents in the financial industry is realized, which meets regulatory requirements without intrusive modification of business logic code. The requester only needs to add a section in the output layer, database interaction layer or log printing layer and call the masking system to effectively reduce the workload, ensure that the business function and system performance are not affected, and ensure the normal operation of the business.

[0065] Through the description of the above implementation methods, technical personnel in the relevant field can understand that for the convenience and simplicity of description, only the division of the above-mentioned functional modules is used as an example. In actual applications, the above-mentioned functions can be assigned to different functional modules as needed, that is, the internal structure of the specific system can be divided into different functional modules to complete all or part of the functions described above.

[0066] Those of ordinary skill in the art will appreciate that the modules and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0067] In several embodiments covered by the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the division of modules is only a logical function division, and there may be other division methods in actual implementation, such as multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or modules, or it can be an electrical, mechanical or other form of connection.

[0068] The modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0069] In addition, each functional module in each embodiment of the present application can be implemented in the form of hardware or in the form of software functional modules. If these functional modules are implemented in the form of software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on such an understanding, the technical solution of the present application is essentially or part of the prior art that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a computer program product, which includes one or more computer instructions. When loading and executing computer program instructions on a computer, the process or function according to the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer program product is stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, a computer instruction can be transmitted from a website site, a computer, a server or a data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integrations. The available media may be magnetic media (eg, floppy disks, hard disks, magnetic tapes), optical media (eg, DVDs), or semiconductor media (eg, solid state disks (SSDs)).

[0070] The above contents are merely examples and explanations of the structure of the present invention. The technicians in this technical field may make various modifications or additions to the specific embodiments described or replace them in a similar manner. As long as they do not deviate from the structure of the invention or exceed the scope defined by the claims, they should all fall within the protection scope of the present invention.

Claims

1. A method for locating and shielding sensitive information, characterized in that: include: Call the sensitive information masking module to obtain the string that needs to be processed; According to the consensus knowledge, the string is split to obtain a substring set; Performing sensitive information feature determination on all substrings in the substring set; If it is determined to be a non-sensitive string, it will be skipped and not processed; if it is determined to be a sensitive string, it will be masked according to its corresponding category based on the determined category; After completing all the substring processing, the result is returned after being restored to the output format.

2. The method for locating and shielding sensitive information according to claim 1, characterized in that: The consensus knowledge includes: common message interaction specifications in the financial industry, common communication formats in information systems, log output, database statements, shell script formats and other knowledge.

3. The method for locating and shielding sensitive information according to claim 1, characterized in that: The sensitive information characteristics include: personal identity information, bank account information, transaction records, corporate financial data, strategic decisions, marketing plans, etc.

4. The method for locating and shielding sensitive information according to claim 1, characterized in that: The determined category is masked according to its corresponding category. When the category is identified as a mobile phone number, the first 3 and the last 4 are masked. When the category is identified as other information, the reserved interface allows the consumer to define the information format to be processed and its masking format, and inject the configuration to realize the configuration and inspection of custom rules.

5. A system for locating and shielding sensitive information, characterized in that: include: Information calling unit, information splitting unit, feature determination unit, output unit; The information calling unit is used to call the sensitive information shielding module to obtain the character string to be processed; The information splitting unit is used to split the string according to the consensus knowledge to obtain a substring set; The feature determination unit is used to determine sensitive information features of all substrings in the substring set; If it is determined to be a non-sensitive string, it will be skipped and not processed; if it is determined to be a sensitive string, it will be masked according to its corresponding category based on the determined category; The output unit is used to complete all the substring processing, restore the results to the output format and return them.

6. The system for locating and shielding sensitive information according to claim 5, characterized in that: The consensus knowledge includes: common message interaction specifications in the financial industry, common communication formats in information systems, log output, database statements, shell script formats and other knowledge.

7. The system for locating and shielding sensitive information according to claim 5, characterized in that: The sensitive information characteristics include: personal identity information, bank account information, transaction records, corporate financial data, strategic decisions, marketing plans, etc.

8. The system for locating and shielding sensitive information according to claim 5, characterized in that: The determined category is masked according to its corresponding category. When the category is identified as a mobile phone number, the first 3 and the last 4 are masked. When the category is identified as other information, the reserved interface allows the consumer to define the information format to be processed and its masking format, and inject the configuration to realize the configuration and inspection of custom rules.

9. A computing device, characterized in that include: A memory for storing program instructions; A processor is used to call the program instructions stored in the memory, and execute the method according to any one of claims 1 to 4 according to the obtained program instructions.

10. A computer-readable storage medium, characterized in that: It includes computer-readable instructions. When a computer reads and executes the computer-readable instructions, it implements the method as claimed in any one of claims 1 to 4. There can be multiple readable media, and the multiple readable media can operate independently of each other.

Images