Data desensitization effect monitoring method, data desensitization effect monitoring device, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a data desensitization effect monitoring method, a data desensitization effect monitoring device, electronic equipment and a storage medium. The data desensitization effect monitoring method comprises the following steps: acquiring first data; obtaining second data obtained after the gateway desensitizes the first data; and monitoring the desensitization effect of the gateway according to the first data and the second data. According to the data desensitization effect monitoring method provided by the embodiment of the invention, the gateway data desensitization effect can be monitored in real time, and the data security risk is reduced.

Description

Technical Field

[0001] Embodiments of the present application relate to the field of data security, and in particular, to a data desensitization effect monitoring method, a data desensitization effect monitoring device, an electronic device, and a storage medium. Background Art

[0002] Data desensitization is a key data processing technology in the field of data security. It can not only prevent the leakage of sensitive information and protect personal privacy rights, but also enable enterprises to safely use data resources for business innovation and decision-making analysis under the premise of compliance.

[0003] Currently, dynamic data desensitization is performed on data during data transmission through an Application Programming Interface Gateway (API Gateway).

[0004] However, the monitoring mechanism for the API gateway data desensitization effect in the existing technology is still imperfect, and it is unable to accurately reflect the execution status of the API gateway data desensitization operation in real time, and the data security is low. Summary of the invention

[0005] In view of this, an embodiment of the present application provides a data desensitization effect monitoring method, a data desensitization effect monitoring device, an electronic device and a computer storage medium to at least partially solve the above-mentioned problems.

[0006] According to a first aspect of an embodiment of the present application, a method for monitoring the effect of data desensitization is provided, which is applied to a gateway, and includes: obtaining first data; obtaining second data obtained after the gateway desensitizes the first data; and monitoring the desensitization effect of the gateway based on the first data and the second data.

[0007] In a possible implementation, the desensitization effect of the gateway is monitored based on the first data and the second data, including: generating a desensitization effect evaluation result based on the first data and the second data; and monitoring the desensitization effect of the gateway based on the desensitization effect evaluation result and pre-set desensitization rules.

[0008] In a possible implementation, the method further includes: acquiring performance indicator data of the gateway; and monitoring a desensitized performance indicator of the gateway according to the performance indicator data.

[0009] In a possible implementation, the method further includes: if the desensitization performance index of the gateway is lower than a preset index threshold, and / or the desensitization effect of the gateway is lower than a preset effect threshold, outputting an alarm message, wherein the alarm message includes at least one of an email message, a text message and a first system log.

[0010] In a possible implementation, the method further includes: generating a second system log according to at least one of the desensitization effect evaluation result, the performance indicator data and the alarm information.

[0011] In a possible implementation, obtaining the second data obtained after the gateway desensitizes the first data includes: obtaining a data capture point embedded in the request and response processing flow of the gateway, and obtaining the second data obtained after the gateway desensitizes the first data.

[0012] According to the second aspect of an embodiment of the present application, a data desensitization effect monitoring device is provided, including: a first acquisition unit, used to acquire first data; a second acquisition unit, used to acquire second data obtained after the gateway desensitizes the first data; and a monitoring unit, used to monitor the desensitization effect of the gateway based on the first data and the second data.

[0013] According to a third aspect of an embodiment of the present application, there is provided an electronic device, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; the memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform an operation corresponding to the method described in the first aspect.

[0014] According to a fourth aspect of an embodiment of the present application, a computer storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the method described in the first aspect is implemented.

[0015] According to a fifth aspect of an embodiment of the present application, a computer program product is provided, comprising computer instructions, wherein the computer instructions instruct a computing device to execute the method as described in the first aspect.

[0016] According to the data desensitization effect monitoring method provided in the embodiment of the present application, the first data is obtained, and the second data obtained after the gateway desensitizes the first data is obtained. Based on the first data and the second data, the desensitization effect of the gateway is monitored. Real-time monitoring of the execution of the gateway desensitization operation can be achieved, so that potential security issues can be discovered and handled in time to ensure data security. Compared with the prior art, the data desensitization effect monitoring scheme in the embodiment of the present application can improve the monitoring of the API gateway data desensitization effect, and can reflect the execution of the API gateway data desensitization operation in real time and accurately, thereby reducing data security risks. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0018] Figure 1 It is a flow chart of a data desensitization effect monitoring method provided in an embodiment of the present application;

[0019] Figure 2 It is a schematic diagram of a data desensitization effect monitoring device provided in an embodiment of the present application;

[0020] Figure 3 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to enable those skilled in the art to better understand the technical solutions in the embodiments of the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments in the embodiments of the present application should fall within the scope of protection of the embodiments of the present application.

[0022] The terms used in this application are for the purpose of describing particular embodiments only and are not intended to limit the present application. As used in this application and the appended claims, the singular forms "a", "an", "said", and "the" are also intended to include

[0023] [HZTC-HXJMJJ241015][HS2411181CCN] includes plural forms, unless the context clearly indicates otherwise. It should also be understood that the term "and / or" used herein refers to and includes any or all possible combinations of one or more associated listed items.

[0024] It should be understood that although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0025] As mentioned above, data desensitization is a key data processing technology in the field of data security. It can not only prevent the leakage of sensitive information and protect personal privacy rights, but also enable enterprises to safely use data resources for business innovation and decision analysis under the premise of compliance. At present, data is dynamically desensitized during data transmission through the API gateway. However, the monitoring mechanism for the data desensitization effect of the API gateway in the existing technology is still imperfect, and it is impossible to accurately reflect the execution of the API gateway data desensitization operation in real time, which poses a potential threat to data security.

[0026] The embodiment of the present application provides a method for monitoring the effect of data desensitization, which obtains first data and second data obtained after the gateway desensitizes the first data. The desensitization effect of the gateway is monitored based on the first data and the second data. Real-time monitoring of the execution of the gateway desensitization operation can be achieved, so that potential security issues can be discovered and handled in time to ensure data security. Compared with the prior art, the data desensitization effect monitoring scheme in the embodiment of the present application can improve the monitoring of the API gateway data desensitization effect, and can reflect the execution of the API gateway data desensitization operation in real time and accurately, thereby reducing data security risks.

[0027] The following example illustrates the data desensitization effect monitoring method provided by the present application.

[0028] Figure 1 is a flow chart of a data desensitization effect monitoring method provided in an embodiment of the present application, and the data desensitization effect monitoring method is applied to a gateway, such as Figure 1 As shown, the data desensitization effect monitoring method includes the following steps 101 to 103:

[0029] Step 101: Obtain first data.

[0030] First data is obtained, where the first data is original data that has not been desensitized, such as personal identity information, personal health information, and commercially sensitive information.

[0031] Step 102: Obtain second data obtained after the gateway desensitizes the first data.

[0032] Obtain second data, where the second data is data obtained after the gateway desensitizes the first data, for example: data obtained by masking part of the first data, encrypting the first data using an encryption algorithm, etc. In one example, the gateway is an API gateway.

[0033] Step 103: monitor the desensitization effect of the gateway according to the first data and the second data.

[0034] According to the acquired first data and second data, the changes in the data contents of the first data and the second data are compared, and the desensitization effect of the gateway is monitored.

[0035] In the embodiment of the present application, the first data is obtained, and the second data obtained after the gateway desensitizes the first data is obtained. According to the first data and the second data, the desensitization effect of the gateway is monitored, and the execution of the gateway desensitization operation can be monitored in real time, so that potential security issues can be discovered and handled in time to ensure data security. Compared with the prior art, the data desensitization effect monitoring scheme in the embodiment of the present application can improve the monitoring of the API gateway data desensitization effect, and can be implemented.

[0036] [HZTC-HXJMJJ241015][HS2411181CCN] can accurately reflect the execution status of API gateway data desensitization operations and reduce data security risks.

[0037] In one possible implementation, when the desensitization effect of the gateway is monitored based on the first data and the second data, a desensitization effect evaluation result can be generated based on the first data and the second data, and the desensitization effect of the gateway can be monitored based on the desensitization effect evaluation result and pre-set desensitization rules.

[0038] Based on the first data and the second data, the data changes before and after data desensitization are compared to generate a desensitization effect evaluation result, which includes at least one of whether the sensitive information is effectively hidden or replaced, whether the desensitized data maintains the availability of the original data, and whether the desensitization rules are consistently applied to all relevant data. Based on the desensitization effect evaluation result and the pre-set desensitization rules, it is detected whether the data desensitization operation performed by the gateway complies with the pre-set desensitization rules, and the desensitization effect of the gateway is monitored.

[0039] In an embodiment of the present application, a desensitization effect evaluation result is generated based on the first data and the second data, and the desensitization effect of the gateway is monitored based on the desensitization effect evaluation result and the pre-set desensitization rules. It can be monitored whether the data desensitization operation performed by the gateway effectively desensitizes the data according to the pre-set desensitization rules, thereby ensuring the correctness and compliance of the gateway desensitization effect and protecting data security.

[0040] In a possible implementation, the data desensitization effect monitoring method can also obtain performance indicator data of the gateway, and monitor the desensitization performance indicator of the gateway based on the performance indicator data.

[0041] The performance indicator data of the gateway before, during and after data desensitization is obtained in real time, such as response time, memory usage and CPU utilization, etc. The desensitization performance indicators of the gateway are monitored according to the performance indicator data. The desensitization performance indicators are used to evaluate the performance of the gateway in data desensitization. It should be understood that if the performance response time of the gateway is long, the memory usage is high, and the CPU utilization is high, it means that the desensitization performance indicator of the gateway is low. If the performance response time of the gateway is short, the memory usage is low, and the CPU utilization is low, it means that the desensitization performance indicator of the gateway is high. In one example, the performance indicator data before the gateway performs data desensitization can be used to monitor the performance of the gateway during normal operation, the performance indicator data during data desensitization can be used to monitor the performance of the gateway during data desensitization operations, and the performance indicator data after the gateway performs data desensitization can be used to monitor whether the performance of the gateway after data desensitization gradually returns to the performance level during normal operation of the gateway.

[0042] In an embodiment of the present application, performance indicator data of the gateway is obtained, and the desensitization performance indicator of the gateway is monitored based on the performance indicator data. The performance status of the gateway performing data desensitization operations can be monitored, thereby ensuring the stability and reliability of the gateway performing data desensitization and ensuring the security of data during transmission.

[0043] In one possible implementation, the data desensitization effect monitoring method can also output an alarm message if the desensitization performance index of the gateway is lower than a preset index threshold, and / or the desensitization effect of the gateway is lower than a preset effect threshold, wherein the alarm message includes at least one of an email message, a text message and a first system log.

[0044] The user can pre-set the gateway desensitization performance index threshold, gateway desensitization effect threshold and alarm strategy when it is lower than the set threshold according to actual needs. If the gateway desensitization performance index is lower than the preset index threshold, and / or the gateway desensitization effect is lower than the preset effect threshold, an alarm message is output according to the alarm strategy pre-set by the user. The alarm message includes at least one of an email message, a text message and a first system log, wherein the first system log may include information lower than the preset threshold and processing suggestions for information lower than the preset threshold. In one example, the gateway desensitization performance index threshold set by the user is medium, the gateway desensitization effect threshold is medium, and the alarm strategy when it is lower than the set threshold is email notification. If it is detected that the gateway desensitization performance index is lower than medium, and / or the gateway desensitization effect is lower than medium, an email is output to

[0045] [HZTC-HXJMJJ241015][HS2411181CCN] users to notify users that the gateway data desensitization operation status is abnormal.

[0046] In an embodiment of the present application, if the desensitization performance index of the gateway is lower than a preset index threshold, and / or the desensitization effect of the gateway is lower than a preset effect threshold, an alarm message is output, wherein the alarm message includes at least one of an email message, a text message, and a first system log, so as to monitor whether the gateway performs data desensitization as expected, and when the desensitization effect or performance index of the gateway data desensitization process is monitored to be lower than the preset threshold, relevant personnel are promptly notified for processing, so as to promptly discover and resolve abnormal situations occurring during gateway data desensitization, thereby ensuring the stability and reliability of the gateway data desensitization effect.

[0047] In a possible implementation, the data desensitization effect monitoring method may also generate a second system log based on at least one of the desensitization effect evaluation results, performance indicator data, and alarm information.

[0048] Record the desensitization effect evaluation results and performance indicator data. If the gateway outputs alarm information during the data desensitization process, record the output alarm information and generate a second system log based on at least one of the desensitization effect evaluation results, performance indicator data and alarm information.

[0049] In an embodiment of the present application, a second system log is generated based on at least one of the desensitization effect evaluation results, performance indicator data and alarm information. The second system log can be used to record the desensitization effect of the monitored gateway, so that health checks, centralized management and analysis of the gateway's data desensitization can be performed regularly, and strong support can be provided for subsequent audits and traceability.

[0050] In a possible implementation, when obtaining the second data obtained after the gateway desensitizes the first data, the data capture point embedded in the gateway's request and response processing flow can be obtained to obtain the second data obtained after the gateway desensitizes the first data.

[0051] A data capture point is embedded in the request and response processing flow of the gateway, that is, a configuration file or code is written at a specific location of the gateway, wherein the specific location is at least one of after the request arrives at the gateway, before the request is forwarded, and before the response is returned to the client. The data capture point embedded in the request and response processing flow of the gateway is obtained, and the second data obtained by the gateway after desensitizing the first data is obtained by obtaining the data capture point embedded in the request and response processing flow of the gateway.

[0052] In an embodiment of the present application, a data capture point embedded in the request and response processing flow of the gateway is obtained, and the second data obtained by the gateway after desensitizing the first data is obtained. The desensitized data of the gateway can be obtained, so as to monitor the desensitization effect of the gateway and ensure the correctness and compliance of the desensitization effect of the gateway.

[0053] Figure 2 is a schematic diagram of a data desensitization effect monitoring device provided in an embodiment of the present application, such as Figure 2 As shown, the data desensitization effect monitoring device 200 includes:

[0054] The first acquiring unit 201 is configured to acquire first data.

[0055] The second acquisition unit 202 is used to acquire second data obtained after the gateway desensitizes the first data.

[0056] The monitoring unit 203 is used to monitor the desensitization effect of the gateway according to the first data and the second data.

[0057] In the embodiment of the present application, the first acquisition unit 201 can be used to execute step 101 in the above method embodiment, the second acquisition unit 202 can be used to execute step 102 in the above method embodiment, and the monitoring unit 203 can be used to execute step 103 in the above method embodiment.

[0058] In a possible implementation, the monitoring unit 203 may also generate a desensitization effect evaluation result based on the first data and the second data; and monitor the desensitization effect of the gateway based on the desensitization effect evaluation result and a pre-set desensitization rule.

[0059] [HZTC-HXJMJJ241015][HS2411181CCN]

[0060] In a possible implementation, the monitoring unit 203 may also obtain performance indicator data of the gateway; and monitor the desensitized performance indicator of the gateway according to the performance indicator data.

[0061] In one possible implementation, the monitoring unit 203 can also output an alarm message if the desensitization performance index of the gateway is lower than a preset index threshold, and / or the desensitization effect of the gateway is lower than a preset effect threshold, wherein the alarm message includes at least one of an email message, a text message and a first system log.

[0062] In a possible implementation, the monitoring unit 203 may also generate a second system log according to at least one of the desensitization effect evaluation result, the performance indicator data and the alarm information.

[0063] In a possible implementation, the second acquisition unit 202 may also acquire a data capture point embedded in the request and response processing flow of the gateway, and acquire second data obtained after the gateway desensitizes the first data.

[0064] Reference Figure 3 , shows a schematic diagram of the structure of an electronic device according to an embodiment of the present application. The specific embodiment of the present application does not limit the specific implementation of the electronic device.

[0065] like Figure 3 As shown, the electronic device may include: a processor (processor) 302 , a communication interface (Communications Interface) 304 , a memory (memory) 306 , and a communication bus 308 .

[0066] in:

[0067] The processor 302 , the communication interface 304 , and the memory 306 communicate with each other via the communication bus 308 .

[0068] The communication interface 304 is used to communicate with other electronic devices or servers.

[0069] The processor 302 is used to execute the program 310, and specifically can execute the relevant steps in the above-mentioned data desensitization effect monitoring method embodiment.

[0070] Specifically, the program 310 may include program codes, which include computer operation instructions.

[0071] The processor 302 may be a central processing unit (CPU), a graphics processing unit (GPU), an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of the present application. The one or more processors included in the smart device may be processors of the same type, such as one or more CPUs; one or more GPUs; or different types of processors, such as one or more CPUs, one or more GPUs, and one or more ASICs.

[0072] The memory 306 is used to store the program 310. The memory 306 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0073] The program 310 can be specifically used to enable the processor 302 to execute the data desensitization effect monitoring method in any of the aforementioned embodiments.

[0074] The specific implementation of each step in program 310 can refer to the corresponding description in the corresponding steps and units in any of the aforementioned data desensitization effect monitoring method embodiments, which will not be repeated here. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the above-described devices and modules can refer to the corresponding process description in the aforementioned method embodiments, which will not be repeated here.

[0075] In the embodiment of the present application, the first data is obtained, and the second data obtained after the gateway desensitizes the first data is obtained. According to the first data and the second data, the desensitization effect of the gateway is monitored, and the execution of the gateway desensitization operation can be monitored in real time, so that potential security issues can be discovered and handled in time to ensure data security. Compared with the prior art, the data desensitization effect monitoring scheme in the embodiment of the present application can improve the monitoring of the API gateway data desensitization effect, and can accurately monitor the performance of the gateway desensitization operation in real time.

[0076] [HZTC-HXJMJJ241015][HS2411181CCN]Accurately reflect the execution status of API gateway data desensitization operations and reduce data security risks.

[0077] An embodiment of the present application also provides a computer program product, including computer instructions, which instruct a computing device to execute operations corresponding to any one of the above-mentioned multiple method embodiments.

[0078] It should be pointed out that, according to the needs of implementation, the various components / steps described in the embodiments of the present application can be split into more components / steps, or two or more components / steps or partial operations of components / steps can be combined into new components / steps to achieve the purpose of the embodiments of the present application.

[0079] The above-mentioned method according to the embodiment of the present application can be implemented in hardware, firmware, or implemented as software or computer code that can be stored in a recording medium (such as a CD ROM, RAM, floppy disk, hard disk or magneto-optical disk), or implemented as a computer code originally stored in a remote recording medium or a non-temporary machine-readable medium downloaded through a network and to be stored in a local recording medium, so that the method described herein can be stored in such software processing on a recording medium using a general-purpose computer, a special-purpose processor or programmable or special-purpose hardware (such as an ASIC or FPGA). It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component (e.g., RAM, ROM, flash memory, etc.) that can store or receive software or computer code, and when the software or computer code is accessed and executed by a computer, a processor or hardware, the data desensitization effect monitoring method described herein is implemented. In addition, when a general-purpose computer accesses the code for implementing the data desensitization effect monitoring method shown here, the execution of the code converts the general-purpose computer into a special-purpose computer for executing the data desensitization effect monitoring method shown here.

[0080] Those of ordinary skill in the art will appreciate that the units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the embodiments of the present application.

[0081] The above implementation methods are only used to illustrate the embodiments of the present application, and are not limitations on the embodiments of the present application. Ordinary technicians in the relevant technical field can make various changes and modifications without departing from the spirit and scope of the embodiments of the present application. Therefore, all equivalent technical solutions also belong to the scope of the embodiments of the present application. The scope of patent protection of the embodiments of the present application should be limited by the claims.

Claims

1. A data desensitization effect monitoring method, applied to a gateway, characterized in that: include: Acquire first data; Acquire second data obtained by the gateway after desensitizing the first data; The desensitization effect of the gateway is monitored according to the first data and the second data.

2. The method according to claim 1, characterized in that The monitoring of the desensitization effect of the gateway according to the first data and the second data includes: Generate a desensitization effect evaluation result according to the first data and the second data; The desensitization effect of the gateway is monitored according to the desensitization effect evaluation result and the pre-set desensitization rules.

3. The method according to claim 2, characterized in that The method further comprises: Obtaining performance indicator data of the gateway; Based on the performance indicator data, the desensitization performance indicator of the gateway is monitored.

4. The method according to claim 3, characterized in that The method further comprises: If the desensitization performance index of the gateway is lower than a preset index threshold, and / or the desensitization effect of the gateway is lower than a preset effect threshold, an alarm message is output, wherein the alarm message includes at least one of an email message, a text message and a first system log.

5. The method according to claim 4, characterized in that The method further comprises: A second system log is generated according to at least one of the desensitization effect evaluation result, the performance indicator data and the alarm information.

6. The method according to claim 1, characterized in that The obtaining of the second data obtained after the gateway desensitizes the first data includes: The data capture point embedded in the request and response processing flow of the gateway is obtained, and the second data obtained after the gateway desensitizes the first data is obtained.

7. A data desensitization effect monitoring device, applied to a gateway, characterized in that: include: A first acquisition unit, used to acquire first data; A second acquisition unit, used to acquire second data obtained by the gateway after desensitizing the first data; A monitoring unit is used to monitor the desensitization effect of the gateway according to the first data and the second data.

8. An electronic device, characterized in that: include: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute the data desensitization effect monitoring method as described in any one of claims 1-6.

9. A computer storage medium, characterized in that A computer program is stored thereon, which, when executed by a processor, implements the data desensitization effect monitoring method as described in any one of claims 1-6.

10. A computer program product, characterized in that It includes computer instructions, which instruct a computing device to execute the data desensitization effect monitoring method as described in any one of claims 1-6.

Images