Method and system for unified desensitization processing of webpage information

Abstract

The invention relates to the field of data security, in particular to a method and a system for uniformly desensitizing webpage information, and the method comprises the following steps: uniformly intercepting request data sent by a user through a browser by using an interceptor; matching sensitive information with the intercepted data by using at least one of two encryption methods according to a configuration item to judge whether encryption is needed or not; sensitive information needing to be encrypted is automatically encrypted according to the configuration content of the configuration item, an encryption label is added to encrypted data, and then the encrypted data are stored in a database; when a user requests background data through a browser, the background server obtains the request data from the database in a unified mode, decrypts the data with the encryption label and processes the data into a desensitization mode. A unified desensitization method is adopted, original programs do not need to be modified, database encryption storage and desensitization display are automatically achieved, and efficiency and safety can be improved.

Description

Technical Field

[0001] The present invention relates to the field of data security, and in particular to a method and system for unified desensitization processing of web page information. Background Art

[0002] With the rapid development of information technology, the protection of personal privacy data has become a focus of social attention. Especially in the era of the Internet and big data, the leakage and abuse of personal privacy data are becoming increasingly serious. In order to protect the privacy of users, relevant laws and regulations require the protection of sensitive data in personal information (such as mobile phone numbers, names, ID numbers, etc.). These sensitive information needs to be encrypted and stored in the database, and needs to be displayed in a desensitized style when displayed on the front desk, such as displaying the mobile phone number as 181****6500.

[0003] Traditional privacy data protection methods usually require code transformation in every place involving sensitive information. This method has the following problems:

[0004] 1. Large workload: All places in the system involving sensitive information need to be modified one by one, and the workload of development and testing is very large.

[0005] 2. Difficult maintenance: Every time the system is upgraded or modified, the relevant code needs to be rechecked and modified, which results in high maintenance costs.

[0006] 3. Low security: Since the transformation involves multiple places, omissions or errors are prone to occur, resulting in safety risks in the system.

[0007] 4. Poor consistency: Different developers may use different encryption methods and processing methods, resulting in poor consistency and maintainability of the system.

[0008] Therefore, how to achieve unified encryption and decryption of personal privacy data without changing the original program has become an urgent problem to be solved. Summary of the invention

[0009] The purpose of the present invention is to provide a method and system for unified desensitization processing of web page information, aiming to solve the problem that the traditional method requires all places involving sensitive information in the system to be modified one by one, which increases the workload of development and testing and may also cause system instability and security risks.

[0010] To achieve the above object, on the one hand, the present invention provides a method for uniformly desensitizing web page information, the method comprising the following steps:

[0011] Use interceptors to uniformly intercept request data sent by users through browsers;

[0012] For the intercepted data, use at least one of the two encryption methods to determine whether encryption is required;

[0013] The two encryption methods include encrypting sensitive information by specifying a specific database field as sensitive information through a configuration item and encrypting sensitive information by matching a desensitized regular expression;

[0014] Automatically encrypt the data that needs to be encrypted according to the configuration content of the configuration item, add an encryption tag to the encrypted data, and then store it in the database;

[0015] When a user requests background data through a browser, the background server uniformly obtains the requested data from the database, decrypts the data with the encryption tag, and processes it into a desensitized style.

[0016] Furthermore, the method also includes that when the user requests to view sensitive information, after secondary verification, the background directly returns the decrypted sensitive information field.

[0017] Furthermore, the configuration items include specified sensitive database field configuration items and sensitive information configuration items; the specified sensitive database field configuration items are used to configure sensitive information fields that need to be encrypted, and the sensitive information configuration items are used to configure sensitive information that needs to be encrypted in the process of using desensitizing regular expressions.

[0018] Furthermore, the encrypting of sensitive information by specifying a specific database field as sensitive information through a configuration item includes determining whether encryption is required based on the table name and field name of the specified sensitive database field configuration item when writing data into the database, and automatically encrypting if required.

[0019] Furthermore, the encryption by matching sensitive information with a desensitized regular expression includes defining a regular expression pattern, scanning and identifying sensitive information, and then encrypting the identified sensitive information.

[0020] Furthermore, the sensitive information field includes at least one of a mobile phone number, an email address, a name, and an ID card.

[0021] Furthermore, the encryption and decryption process is implemented through the MyBatis interceptor.

[0022] Furthermore, for the sensitive information field that needs to be encrypted, the AES encryption algorithm is used for encryption.

[0023] Furthermore, the desensitization styles include desensitizing a mobile phone number to the first three digits and the last four digits, replacing the middle with ****; desensitizing an email address to the first letter and the last letter of the user name, replacing the middle with ****, and the address after @ remains unchanged; and desensitizing an ID card to the first three digits and the last four digits, replacing the middle with ****.

[0024] In addition, in another aspect of the present invention, a system for implementing the above-mentioned method for unified desensitization processing of web page information is provided, comprising:

[0025] The interceptor module is used to intercept the data saving request sent by the user through the browser;

[0026] Configuration module, used to configure the specified database tables and fields as sensitive information, and configure encryption judgment rules;

[0027] An encryption module is used to encrypt the field content that matches the configuration module and the desensitizing regular expression, and add an encryption tag;

[0028] The decryption module is used to decrypt the requested data and process it into a desensitized format;

[0029] The verification module is used to return the decrypted data after the user has undergone secondary verification.

[0030] Compared with the prior art, the present invention has at least the following technical effects:

[0031] The present invention provides a method and system for unified desensitization of web page information, using an interceptor to uniformly intercept data requests sent by users through browsers, using at least one of two encryption methods to determine whether the intercepted data needs to be encrypted, the two encryption methods include: encrypting sensitive information by specifying a specific database field through a configuration item and encrypting sensitive information by matching a desensitized regular expression, automatically encrypting sensitive information that needs to be encrypted according to the configuration content, adding an encryption tag to the encrypted data, and then storing it in a database. When a user requests background data, the background server uniformly obtains the request data from the database, decrypts the data with the encryption tag, and processes it into a desensitized style. The method can not only achieve unified protection of personal privacy data and reduce the workload of development and testing through automated interception, identification, encryption, decryption and desensitization, but also maintain the invariance of the original program and improve the efficiency and security of data processing. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 The present invention is a flowchart of a method for unified desensitization of web page information in one embodiment of the present invention. DETAILED DESCRIPTION

[0033] The following is a more detailed description of a method and system for uniform desensitization of web page information of the present invention in conjunction with a schematic diagram, wherein a preferred embodiment of the present invention is shown, and it should be understood that those skilled in the art can modify the present invention described herein while still achieving the beneficial effects of the present invention. Therefore, the following description should be understood as being widely known to those skilled in the art, and not as a limitation of the present invention.

[0034] For the sake of clarity, not all features of the actual embodiments are described. In the following description, well-known functions and structures are not described in detail because they would clutter the invention with unnecessary detail. It should be recognized that in the development of any actual embodiment, a large number of implementation details must be made to achieve the developer's specific goals, such as changing from one embodiment to another according to the limitations of the relevant system or the relevant business. In addition, it should be recognized that such development work may be complex and time-consuming, but it is just a routine task for those skilled in the art.

[0035] The present invention is described in more detail in the following paragraphs by way of example with reference to the accompanying drawings. The advantages and features of the present invention will become more apparent from the following description. It should be noted that the accompanying drawings are in very simplified form and are not in exact proportions, and are only used to facilitate and clearly assist in illustrating the purpose of the embodiments of the present invention.

[0036] As mentioned in the background technology, the traditional method requires all places in the system involving sensitive information to be modified one by one, which will increase the workload of development and testing, and may also cause system instability and security risks. Figure 1 As shown, the present invention provides a method for uniformly desensitizing web page information to solve the above problem. Specifically, the method comprises the following steps:

[0037] Use interceptors to uniformly intercept request data sent by users through browsers;

[0038] For the intercepted data, use at least one of the two encryption methods to determine whether encryption is required;

[0039] The two encryption methods include encrypting sensitive information by specifying a specific database field as sensitive information through a configuration item and encrypting sensitive information by matching a desensitized regular expression;

[0040] Automatically encrypt the data that needs to be encrypted according to the configuration content of the configuration item, add an encryption tag to the encrypted data, and then store it in the database;

[0041] When a user requests background data through a browser, the background server uniformly obtains the requested data from the database, decrypts the data with the encryption tag, and processes it into a desensitized style.

[0042] Furthermore, the method also includes that when the user requests to view sensitive information, after secondary verification, the background directly returns the decrypted sensitive information field.

[0043] In this embodiment, the configuration items include a specified sensitive database field configuration item and a sensitive information configuration item; the specified sensitive database field configuration item is used to configure the sensitive information field that needs to be encrypted, and the sensitive information configuration item is used to configure the sensitive information that needs to be encrypted in the process of using a desensitizing regular expression.

[0044] Specifically, in the database, some fields need to be encrypted when stored because they contain sensitive information, such as identity card number, mailbox, mobile phone number, name, etc. Therefore, when a user sends a data preservation request through a browser, the backend server intercepts the request data through the MyBatis interceptor. And in the present embodiment, a configuration item is set up to specify a specific database field that needs to be encrypted, and the specific database field is designated as a sensitive information field. These sensitive information fields include at least one of identity card number, mailbox, mobile phone number, and name. Flexible specification of which database fields need to be encrypted with sensitive words through configuration items makes the encryption process more unified and automated.

[0045] In this embodiment, the encrypting of sensitive information by specifying a specific database field as sensitive information through a configuration item includes determining whether encryption is required based on the table name and field name of the specified sensitive database field configuration item when writing data into the database, and automatically encrypting if required.

[0046] In this embodiment, the encryption by matching sensitive information with a desensitized regular expression includes defining a regular expression pattern, scanning and identifying sensitive information, and then encrypting the identified sensitive information.

[0047] In addition, the configuration item includes the configuration item name, configuration item content, and sensitive information fields that match the desensitization regular expression. The configuration item name is an identifier that specifies which fields in the database need to be encrypted. For example, "CommonConfigApp.EASY3W_DATA_ENCRYPT" is a configuration item name. The configuration content contains specific configuration information, which details which fields in which tables in the database need to be encrypted. For example, the configuration content is given in JSON format {"sys_user":"DISPLAY_NAME","t_psac_0001":"LEADER_NAME,LAWER,BID_LINK_MAN_CNAME,REFEREE_DISPLAY_NAME","t_psac_0040":"ACCOUNT_LINKMAN,REFEREE,LEADER_NAME,BID_LINK_MAN_CNAME","t_psac_0050":"PROJECT_MANAGER,LEADER_NAME,BUSINESS_OWNER,BUSINESS_MANAGER"}. "sys_user":"DISPLAY_NAME" means that in the sys_user table, the DISPLAY_NAME field needs to be encrypted.

[0048] "t_psac_0001":"LEADER_NAME,LAWER,BID_LINK_MAN_CNAME,REFEREE_DISPLAY_NAME" means that in the t_psac_0001 table, the four fields LEADER_NAME, LAWER, BID_LINK_MAN_CNAME and REFEREE_DISPLAY_NAME need to be encrypted.

[0049] "t_psac_0040":"ACCOUNT_LINKMAN,REFEREE,LEADER_NAME,BID_LI NK_MAN_CNAME" means that in the t_psac_0040 table, the four fields ACCOUNT_LINKMAN, `REFEREE`, `LEADER_NAME` and `BID_LINK_MAN_CNAME` need to be encrypted.

[0050] "t_psac_0050":"PROJECT_MANAGER,LEADER_NAME,BUSINESS_OWN ER,BUSINESS_MANAGER" means that in the t_psac_0050 table, the four fields PROJECT_MANAGER, LEADER_NAME, BUSINESS_OWNER and BUSINESS_MANAGER need to be encrypted.

[0051] In this embodiment, when data is written to the database, the system will determine which fields need to be encrypted based on the table name and field name of the specified sensitive database field configuration item. If a field is marked as requiring encryption, the system will automatically encrypt the data in the field and then store it in the database. For example, according to the above configuration, it is known that the DISPLAY_NAME field is sensitive information and needs to be encrypted. Therefore, when new user data is added to the sys_user table, the system will automatically find the DISPLAY_NAME field and use some encryption algorithm (such as the AES encryption algorithm) to encrypt the data in this field, and then store the encrypted data in the database. In this way, since the data is stored in encrypted form, even if the database is accessed without authorization, the attacker cannot directly read the user's name information.

[0052] In this embodiment, the encryption and decryption process is implemented by MyBatis interceptor. By adding mybatis interceptor, query, save, and update methods are intercepted, and the data after encryption or decryption is desensitized according to the desensitized field information in the cache.

[0053] Furthermore, the desensitization styles include desensitizing a mobile phone number to the first three digits and the last four digits, replacing the middle with ****; desensitizing an email address to the first letter and the last letter of the user name, replacing the middle with ****, and the address after @ remains unchanged; and desensitizing an ID card to the first three digits and the last four digits, replacing the middle with ****.

[0054] In addition, in another aspect of the present invention, a system for implementing the above-mentioned unified desensitization processing method for web page information is provided, comprising:

[0055] The interceptor module is used to intercept the data saving request sent by the user through the browser;

[0056] Configuration module, used to configure the specified database tables and fields as sensitive information, and configure encryption judgment rules;

[0057] An encryption module is used to encrypt the content that matches the configuration module and the desensitized regular expression and add an encryption tag;

[0058] The decryption module is used to decrypt the requested data and process it into an anonymous format when displayed on the front end;

[0059] The verification module is used to return the decrypted data after the user has undergone secondary verification.

[0060] In summary, in a method and system for unified desensitization of web page information provided by an embodiment of the present invention, an interceptor is used to uniformly intercept data requests sent by users through browsers, and at least one of two encryption methods is used to determine whether the intercepted data needs to be encrypted. The two encryption methods include: encrypting sensitive information by specifying a specific database field as sensitive information through a configuration item and encrypting sensitive information by matching a desensitizing regular expression. For sensitive information that needs to be encrypted, encryption processing is automatically performed according to the configuration content, and an encryption tag is added to the encrypted data, and then stored in the database. When a user requests background data, the background server uniformly obtains the request data from the database, decrypts the data with the encryption tag, and processes it into a desensitized style. This method can not only achieve unified protection of personal privacy data and reduce the workload of development and testing through automated interception, identification, encryption, decryption and desensitization processing, but also maintain the invariance of the original program and improve the efficiency and security of data processing.

[0061] The above is only a preferred embodiment of the present invention and does not limit the present invention in any way. Any technician in the relevant technical field, without departing from the scope of the technical solution of the present invention, makes any form of equivalent replacement or modification to the technical solution and technical content disclosed in the present invention, which does not depart from the content of the technical solution of the present invention and still falls within the protection scope of the present invention.

Claims

1. A method for uniformly desensitizing web page information, characterized in that: The method comprises the following steps: using an interceptor to uniformly intercept request data sent by a user through a browser; For the intercepted data, use at least one of the two encryption methods to determine whether encryption is required; The two encryption methods include encrypting sensitive information by specifying a specific database field as sensitive information through a configuration item and encrypting sensitive information by matching a desensitized regular expression; Automatically encrypt the data that needs to be encrypted according to the configuration content of the configuration item, add an encryption tag to the encrypted data, and then store it in the database; When a user requests background data through a browser, the background server uniformly obtains the requested data from the database, decrypts the data with the encryption tag, and processes it into a desensitized style.

2. The method according to claim 1, characterized in that The method also includes that when the user requests to view sensitive information, after secondary verification, the background directly returns the decrypted sensitive information field.

3. The method according to claim 1, characterized in that The configuration items include a specified sensitive database field configuration item and a sensitive information configuration item; the specified sensitive database field configuration item is used to configure the sensitive information field that needs to be encrypted, and the sensitive information configuration item is used to configure the sensitive information that needs to be encrypted in the process of using a desensitizing regular expression.

4. The method according to claim 3, characterized in that: The encrypting of sensitive information by specifying a specific database field as sensitive information through a configuration item includes determining whether encryption is required based on the table name and field name of the specified sensitive database field configuration item when writing data into the database, and automatically encrypting if required.

5. The method according to claim 1, characterized in that The encryption by matching sensitive information with a desensitized regular expression includes defining a regular expression pattern, scanning and identifying sensitive information, and then encrypting the identified sensitive information.

6. The method according to claim 1, characterized in that The sensitive information field includes at least one of a mobile phone number, an email address, a name, and an ID card.

7. The method according to claim 1, characterized in that The encryption and decryption process is implemented through the MyBatis interceptor.

8. The method according to claim 1, characterized in that: For the sensitive information fields that need to be encrypted, the AES encryption algorithm is used for encryption.

9. The method according to claim 1, characterized in that: The desensitization style includes desensitizing the mobile phone number to the first three and last four digits, replacing the middle with ****; desensitizing the email address to the first and last letters of the user name, replacing the middle with ****, and the address after @ remains unchanged; The ID card is desensitized to the first three and last four digits, and the middle digits are replaced with ****.

10. A system for implementing the method for uniformly desensitizing web page information as claimed in any one of claims 1 to 9, characterized in that: include: The interceptor module is used to intercept the data saving request sent by the user through the browser; Configuration module, used to configure the specified database tables and fields as sensitive information, and configure encryption judgment rules; An encryption module is used to encrypt the field content that matches the configuration module and the desensitizing regular expression, and add an encryption tag; The decryption module is used to decrypt the requested data and process it into a desensitized format; The verification module is used to return the decrypted data after the user has undergone secondary verification.

Images