Configuration log desensitization method and device, electronic equipment and readable storage medium

Abstract

The invention discloses a configured log desensitization method, which comprises the following steps of: traversing configuration items of all desensitization fields, generating a regular expression according to current configuration, and matching the regular expression with an original log message; if yes, performing matched item desensitization on the original log message, and performing next item field matching desensitization processing until all configuration items are processed; and if the configuration items are not matched, directly carrying out matching and desensitization processing on the next item field until all the configuration items are processed. The regular expression is accurately matched with the original log message, it is ensured that only the content meeting the desensitization rule is desensitized, and the risk of mistaken desensitization is reduced; by automatically traversing the configuration items of the desensitization fields and generating the corresponding regular expressions, manual intervention is reduced, and the desensitization processing efficiency is improved; and through automatic and accurate desensitization processing, sensitive information is effectively protected, data leakage is prevented, and the security of data is enhanced while the stability of the system is improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a configurable log desensitization method, device, electronic device and readable storage medium. Background Art

[0002] With the development of banking technology, the importance of user sensitive information continues to increase. In the storage, transmission, display, log printing and other scenarios, user sensitive information is required to be encrypted or desensitized. For log desensitization, user sensitive information is generally desensitized before printing the log. For existing systems, this method requires more desensitization to be modified, and it is easy to miss. Each modification means going online, which increases the risk of system operation.

[0003] To this end, it is a technical problem that needs to be urgently solved by technical personnel in this field to propose a technical solution that can separate the log desensitization logic from the business scenario, uniformly desensitize the user sensitive information logs, and reduce the system operation risks. Summary of the invention

[0004] The purpose of this application is to solve at least one of the above technical defects. The technical solution adopted by this application is as follows:

[0005] In a first aspect, an embodiment of the present application provides a configurable log desensitization method, the method comprising:

[0006] Traverse the configuration items of all desensitized fields, generate regular expressions based on the current configuration, and match the regular expressions with the original log messages;

[0007] If there is a match, the original log message is desensitized for the matching item, and the next item field matching desensitization is performed until all configuration items are processed;

[0008] If there is no match, the next item field matching and desensitization processing will be carried out directly until all configuration items are processed.

[0009] Optionally, the log pattern of log4j is extended for layout, and the log4j log printing mode is a custom log pattern layout.

[0010] Optionally, the log pattern of log4j is extended for layout, and the log4j log printing pattern is a custom log pattern layout including: when the custom layout is initialized, the configuration of all desensitized fields is obtained from the configuration center.

[0011] Optionally, the method further comprises:

[0012] When the original log message has no clear format and cannot be matched by regular expressions, some special identifiers are configured in the desensitise.field.specMsg field. When traversing to this field, it is determined whether the message contains the configured field. If so, the entire message is matched for sensitive fields and desensitized.

[0013] In a second aspect, an embodiment of the present application provides a configurable log desensitization device, the device comprising: a generation module, a matching module, and a judgment module, wherein:

[0014] Generation module: used to traverse the configuration items of all desensitized fields and generate regular expressions based on the current configuration;

[0015] Matching module: used to match the regular expression with the original log message;

[0016] Judgment module: used to judge the matching results and make instructions for the next step;

[0017] If there is a match, the original log message is desensitized for the matching item, and the next item field matching desensitization is performed until all configuration items are processed;

[0018] If there is no match, the next item field matching and desensitization processing will be carried out directly until all configuration items are processed.

[0019] Optionally, the device further comprises a layout module: used for performing layout by extending the log mode of log4j, and the log4j log printing mode is a custom log mode layout.

[0020] Optionally, the layout module further includes: when the custom layout is initialized, obtaining the configuration of all desensitized fields from the configuration center.

[0021] Optionally, the device also includes: when the original log message does not have a clear format and cannot be matched by a regular expression, some special identifiers are configured in the desensitise.field.specMsg field; when traversing to this field, it is determined whether the message contains the configured field. If it does, the sensitive field is matched on the entire message and desensitization is performed.

[0022] In a third aspect, an embodiment of the present invention provides an electronic device, including a processor and a memory;

[0023] The memory is used to store operation instructions;

[0024] The processor is used to execute the above-mentioned configurable log desensitization method by calling the operation instruction.

[0025] In a fourth aspect, a computer-readable storage medium is provided, wherein a computer program is stored on the storage medium, and when the computer program is executed by a processor, the above-mentioned configurable log desensitization method is implemented.

[0026] The configuration log desensitization scheme disclosed in the embodiment of the present application traverses the configuration items of all desensitized fields, generates a regular expression according to the current configuration, and matches the regular expression with the original log message; if it matches, the original log message is desensitized for the matching item, and the next item field matching desensitization processing is performed until all configuration items are processed; if it does not match, the next item field matching desensitization processing is directly performed until all configuration items are processed. The technical solution provided by the present application brings the following beneficial effects:

[0027] (1) Regular expressions are used to accurately match the original log messages, ensuring that only content that meets the desensitization rules is desensitized, reducing the risk of mis-desensitization.

[0028] (2) By automatically traversing the configuration items of the desensitized fields and generating corresponding regular expressions, manual intervention is reduced and the efficiency of the desensitization processing is improved.

[0029] (3) Through automated and precise desensitization processing, sensitive information is effectively protected, data leakage is prevented, system stability is improved, and data security is enhanced. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in describing the embodiments of the present application are briefly introduced below.

[0031] Figure 1 A flow chart of a configurable log desensitization method provided in an embodiment of the present application;

[0032] Figure 2 A schematic diagram of the structure of a configurable log desensitization device provided in an embodiment of the present application;

[0033] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0034] The embodiments of the present application are described in detail below, and examples of the embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present application, and cannot be interpreted as limiting the present invention.

[0035] Those skilled in the art will appreciate that, unless otherwise stated, the singular forms "a", "an", "said" and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present application refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0036] At present, the conventional desensitization method is generally to desensitize the user's sensitive information before printing the log. This method is highly invasive to the existing system code. Each modification requires special testing, which is a large testing workload. Multiple modifications require the code to be released online, which has a high system operation risk and a large workload for business regression verification. In addition, for existing systems, this method requires more desensitization to be modified, and it is easy to miss. Each modification means an online release, which increases the risk of system operation. Based on this, the present application discloses a configurable log desensitization method to at least solve one of the above problems.

[0037] To more clearly describe the embodiments of the present application, some definitions, concepts or devices that may be used in the embodiments are introduced below:

[0038] The technical solution of the present application and how the technical solution of the present application solves the above-mentioned technical problems will be described in detail below with reference to the accompanying drawings. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described in detail in some embodiments. The embodiments of the present application will be described below with reference to the accompanying drawings.

[0039] In order to make the purpose, technical solutions and advantages of this application clearer, Figure 1 A flow chart of a configurable log desensitization method provided by an embodiment of the present application is disclosed, such as Figure 1 As shown, the configurable log desensitization method includes:

[0040] S101, traverse the configuration items of all desensitized fields, generate a regular expression according to the current configuration, and match the regular expression with the original log message;

[0041] S102: If there is a match, desensitize the original log message for the matching item, and perform a matching desensitization process on the next item field until all configuration items are processed;

[0042] S103. If there is no match, directly proceed to the next item field matching desensitization process until all configuration items are processed.

[0043] In this embodiment, since the records may not be messages with a clear format like json (key: value) that can be well matched by regular expressions, some may be messages with no obvious format. In this case, some special identifiers can be configured in the desensitise.field.specMsg field. When traversing to this field, it will be determined whether the message contains the configured field. If it does, the sensitive field matching and desensitization processing will be performed on the entire message.

[0044] In an optional embodiment, the log pattern of log4j is extended for layout, and the log4j log printing pattern is a custom log pattern layout.

[0045] In an optional embodiment, the layout is performed by extending the log mode of log4j, and the log4j log printing mode is a custom log mode layout including: when the custom layout is initialized, the configuration of all desensitized fields is obtained from the configuration center.

[0046] In an optional embodiment, when the original log message does not have a clear format and cannot be matched by a regular expression, some special identifiers are configured in the desensitise.field.specMsg field; when traversing to this field, it is determined whether the message contains the configured field. If so, the entire message is matched for sensitive fields and desensitized.

[0047] In this embodiment, when the custom layout is initialized, the configuration of all desensitized fields is obtained from the configuration center.

[0048] The configuration center format is as follows:

[0049] desensitise.field.idNumber = Field identified by the ID number

[0050] desensitise.field.name = Field for name identification

[0051] desensitise.field.mobile = Field for mobile phone number identification

[0052] desensitise.field.cardNo = Field identified by card number

[0053] desensitise.field.address = Field for address identification

[0054] desensitise.field.email = Field identified by email

[0055] desensitise.field.specMsg=Special format information identifier containing sensitive fields. The following will take a certain log printing as an example to introduce the specific implementation process of the configurable log desensitization method described in the embodiment of the present application.

[0056] For example, a log prints a JSON object that contains the ID number, name, and mobile phone number. When the ID number configuration is traversed, the ID number field will be desensitized. When the name and mobile phone number are traversed, the name and mobile phone number will be desensitized respectively.

[0057] Since the records may not be messages with a clear format like json (key: value) that can be well matched by regular expressions, some may be messages without obvious format, such as "Current interface call address: htttp: / / 127.0.0.1 / userinfo / 362XXXXXXXX (this address is a dynamic address)". In this case, some special identifiers, such as the class or key characters (current interface call address) of the log, can be configured in the desensitise.field.specMsg field. When traversing to this field, it will determine whether the message contains the configured field. If it does, the sensitive field matching and desensitization processing will be performed on the entire message.

[0058] The technical solution of this embodiment traverses the configuration items of all desensitized fields, generates a regular expression according to the current configuration, and matches the regular expression with the original log message; if matched, the original log message is desensitized for the matching item, and the next item field matching desensitization processing is performed until all configuration items are processed; if not matched, the next item field matching desensitization processing is directly performed until all configuration items are processed. It realizes the precise matching of the original log message with the regular expression, ensuring that only the content that meets the desensitization rules is desensitized, reducing the risk of false desensitization; by automatically traversing the configuration items of the desensitized field and generating the corresponding regular expression, it reduces manual intervention and improves the efficiency of the desensitization processing; and through automated and precise desensitization processing, it effectively protects sensitive information, prevents data leakage, improves the stability of the system and enhances the security of the data.

[0059] based on Figure 1 The embodiment shown provides a configurable log desensitization method. Figure 2 A configurable log desensitization device provided by an embodiment of the present application is shown. Figure 2 As shown, the device can mainly include: 201 generation module, 202 matching module, 203 judgment module, wherein,

[0060] Generating module 201: used to traverse the configuration items of all desensitized fields and generate regular expressions according to the current configuration;

[0061] Matching module 202: used to match the regular expression with the original log message;

[0062] Determination module 203: used to determine the matching result and make next step instructions;

[0063] If there is a match, the original log message is desensitized for the matching item, and the next item field matching desensitization is performed until all configuration items are processed;

[0064] If there is no match, the next item field matching and desensitization processing will be carried out directly until all configuration items are processed.

[0065] In an embodiment of the present application, by traversing the configuration items of all desensitized fields, a regular expression is generated according to the current configuration, and the regular expression is matched with the original log message; if matched, the original log message is desensitized for the matching item, and the next item field matching desensitization processing is performed until all configuration items are processed; if not matched, the next item field matching desensitization processing is directly performed until all configuration items are processed. It is achieved that the regular expression is used to accurately match the original log message, ensuring that only content that meets the desensitization rules is desensitized, reducing the risk of false desensitization; by automatically traversing the configuration items of the desensitized field and generating the corresponding regular expression, manual intervention is reduced and the efficiency of the desensitization processing is improved; and through automated and accurate desensitization processing, sensitive information is effectively protected, data leakage is prevented, and the stability of the system is improved while enhancing the security of the data.

[0066] In an optional embodiment, the apparatus further comprises a calculation module layout module 204, wherein:

[0067] The layout module is used to perform layout by extending the log mode of log4j, and the log4j log printing mode is a custom log mode layout.

[0068] The layout module also includes: when the custom layout is initialized, obtaining the configuration of all desensitized fields from the configuration center.

[0069] The device also includes: when the original log message has no clear format and cannot be matched by a regular expression, some special identifiers are configured in the desensitise.field.specMsg field; when traversing to the field, it is determined whether the message contains the configured field. If it does, the sensitive field is matched on the entire message and desensitization is performed.

[0070] It can be understood that the above modules of the configurable log desensitization device in this embodiment have the function of realizing Figure 1The functions of the corresponding steps of the method in the embodiment shown in . The function can be implemented by hardware, or by hardware executing the corresponding software. The hardware or software includes one or more modules corresponding to the above functions. The above modules can be software and / or hardware, and the above modules can be implemented separately or integrated with multiple modules. For the functional description of the above modules, please refer to Figure 1 The corresponding description of the method in the embodiment shown in will not be repeated here.

[0071] An embodiment of the present application provides an electronic device, including a processor and a memory;

[0072] A memory, used for storing operation instructions;

[0073] The processor is used to execute the configurable log desensitization method provided in any embodiment of the present application by calling an operation instruction.

[0074] As an example, Figure 3 A schematic diagram of the structure of an electronic device applicable to the embodiment of the present application is shown. Figure 3 As shown, the electronic device 2000 includes: a processor 2001 and a memory 2003. The processor 2001 and the memory 2003 are connected, such as through a bus 2002. Optionally, the electronic device 2000 may also include a transceiver 2004. It should be noted that in actual applications, the transceiver 2004 is not limited to one, and the structure of the electronic device 2000 does not constitute a limitation on the embodiments of the present application.

[0075] The processor 2001 is applied in the embodiment of the present application to implement the method shown in the above method embodiment. The transceiver 2004 may include a receiver and a transmitter. The transceiver 2004 is applied in the embodiment of the present application to implement the function of the electronic device of the embodiment of the present application communicating with other devices when executed.

[0076] Processor 2001 may be a CPU (Central Processing Unit), a general purpose processor, a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Gate Array) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of this application. Processor 2001 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0077] The bus 2002 may include a path to transmit information between the above components. The bus 2002 may be a PCI (Peripheral Component Interconnect) bus or an EISA (Extended Industry Standard Architecture) bus. The bus 2002 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, Figure 3 Only one thick line is used in the diagram, but this does not mean that there is only one bus or only one type of bus.

[0078] The memory 2003 can be a ROM (Read Only Memory) or other types of static storage devices that can store static information and instructions, a RAM (Random Access Memory) or other types of dynamic storage devices that can store information and instructions, or an EEPROM (Electrically Erasable Programmable Read Only Memory), a CD-ROM (Compact Disc Read Only Memory) or other optical disk storage, optical disk storage (including compressed optical disk, laser disk, optical disk, digital versatile disk, Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0079] Optionally, the memory 2003 is used to store application code for executing the solution of the present application, and the execution is controlled by the processor 2001. The processor 2001 is used to execute the application code stored in the memory 2003 to implement the configurable log desensitization method provided in any embodiment of the present application.

[0080] The electronic device provided in the embodiment of the present application is applicable to any embodiment of the above method and will not be described in detail here.

[0081] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the configurable log desensitization method shown in the above method embodiment is implemented.

[0082] The computer-readable storage medium provided in the embodiments of the present application is applicable to any embodiment of the above method and will not be described in detail here.

[0083] The configurable log desensitization solution provided in the embodiment of the present application traverses the configuration items of all desensitized fields, generates a regular expression according to the current configuration, and matches the regular expression with the original log message; if matched, the original log message is desensitized for the matching item, and the next item field matching desensitization processing is performed until all configuration items are processed; if not matched, the next item field matching desensitization processing is directly performed until all configuration items are processed. It realizes the precise matching of the original log message with the regular expression, ensures that only the content that meets the desensitization rules is desensitized, and reduces the risk of false desensitization; by automatically traversing the configuration items of the desensitized fields and generating the corresponding regular expressions, it reduces manual intervention and improves the efficiency of the desensitization processing; and through automated and precise desensitization processing, it effectively protects sensitive information, prevents data leakage, improves the stability of the system, and enhances the security of the data.

[0084] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0085] The above are only some embodiments of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A configurable log desensitization method, characterized in that: The method comprises: Traverse the configuration items of all desensitized fields, generate regular expressions based on the current configuration, and match the regular expressions with the original log messages; If there is a match, the original log message is desensitized for the matching item, and the next item field matching desensitization is performed until all configuration items are processed; If there is no match, the next item field matching and desensitization processing will be carried out directly until all configuration items are processed.

2. The configurable log desensitization method according to claim 1, characterized in that: By extending the log4j log mode for layout, the log4j log printing mode is a custom log mode layout.

3. The configurable log desensitization method according to claim 2, characterized in that: The layout is performed by extending the log mode of log4j, and the log4j log printing mode is a custom log mode layout including: when the custom layout is initialized, the configuration of all desensitized fields is obtained from the configuration center.

4. The configurable log desensitization method according to claim 1, characterized in that: When the original log message has no clear format and cannot be matched by regular expressions, some special identifiers are configured in the desensitise.field.specMsg field. When traversing to this field, it is determined whether the message contains the configured field. If so, the entire message is matched for sensitive fields and desensitized.

5. A configurable log desensitization device, characterized in that: The device comprises: a generating module, a matching module, and a judging module, wherein: Generation module: used to traverse the configuration items of all desensitized fields and generate regular expressions based on the current configuration; Matching module: used to match the regular expression with the original log message; Judgment module: used to judge the matching results and make instructions for the next step; If there is a match, the original log message is desensitized for the matching item, and the next item field matching desensitization is performed until all configuration items are processed; If there is no match, the next item field matching and desensitization processing will be carried out directly until all configuration items are processed.

6. The configurable log desensitization device according to claim 5, characterized in that: The device also includes a layout module: used for performing layout by extending the log mode of log4j, and the log4j log printing mode is a custom log mode layout.

7. The configurable log desensitization device according to claim 6, characterized in that: The layout module also includes: when the custom layout is initialized, obtaining the configuration of all desensitized fields from the configuration center.

8. The configurable log desensitization device according to claim 5, characterized in that: When the original log message has no clear format and cannot be matched by regular expressions, some special identifiers are configured in the desensitise.field.specMsg field. When traversing to this field, it is determined whether the message contains the configured field. If so, the entire message is matched for sensitive fields and desensitized.

9. An electronic device, characterized in that: including a processor and a memory; The memory is used to store operation instructions; The processor is used to execute the method according to any one of claims 1 to 6 by calling the operation instruction.

10. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images