Page desensitization method and device, nonvolatile storage medium and electronic equipment

Abstract

The invention discloses a page desensitization method and device, a nonvolatile storage medium and electronic equipment. The method comprises the steps of obtaining a page processing request of a target; processing the page processing request by adopting a predetermined processing logic of the client to obtain a service processing result; the service processing result is forwarded to a desensitization server for processing through a reverse proxy server deployed at the client, and the desensitization server is used for analyzing based on the service processing result and determining a session identifier and response data of the target; determining a target desensitization strategy corresponding to the target according to the session identifier; adopting a target desensitization strategy to perform desensitization processing on the response data to obtain desensitization data; responding to the received desensitization data, and responding after the client performs desensitization on the page processing request. According to the method and the device, the technical problem that the dynamic desensitization effect for different user requirements is not ideal in the prior art is solved.

Description

Technical Field

[0001] The present application relates to the field of data protection, and more specifically, to a page desensitization method, device, non-volatile storage medium and electronic device. Background Art

[0002] In recent years, data security issues have become increasingly prominent, and data leakage, data abuse and other incidents have occurred from time to time. Data desensitization is an important step in ensuring data security. It protects sensitive data while protecting data availability, providing security for data display, testing, analysis, leakage and use. In related technologies, data desensitization is mainly carried out by intercepting all requests and traffic through gateways, and returning them after desensitization processing. Most of them are connected in series to the business, which will affect the performance of the original business. Once the component is damaged, it will block the main business process. In addition, dynamic desensitization mainly adopts a rule-based sensitive data identification mechanism. However, this mechanism relies on static configuration, such as desensitization rules, sensitive fields, etc., which is difficult to update in real time and cannot adapt to complex and changing business scenarios. As a result, different desensitization effects cannot be achieved based on user roles. There are technical problems in related technologies that the dynamic desensitization effect for different user needs is not ideal.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a page desensitization method, device, non-volatile storage medium and electronic device to at least solve the technical problem in the related art that the dynamic desensitization effect for different user needs is not ideal.

[0005] According to one aspect of an embodiment of the present application, a page desensitization method is provided, including: obtaining a page processing request of a target; using a predetermined processing logic of a client to process the page processing request to obtain a business processing result; forwarding the business processing result to a desensitization server for processing via a reverse proxy server deployed on the client, wherein the desensitization server is used to perform analysis based on the business processing result to determine the session identifier and response data of the target; determining a target desensitization policy corresponding to the target according to the session identifier; using the target desensitization policy to desensitize the response data to obtain desensitized data; in response to receiving the desensitized data, executing a desensitized response to the page processing request on the client.

[0006] Optionally, before obtaining the target's page processing request, the method also includes: responding to the target's login request on the client, using a reverse proxy server to forward the login request to a desensitizing server, wherein the desensitizing server is used to store the target's session identifier; after the target logs in on the client, allowing the target to request a page in the client.

[0007] Optionally, the method also includes: determining predetermined desensitization policies corresponding to different types of targets logged in to the client based on the business type, domain name, and predetermined desensitization field corresponding to the client; and configuring the predetermined desensitization policies corresponding to multiple types of targets to the desensitization server via the configuration server.

[0008] According to another aspect of an embodiment of the present application, a page desensitization method is provided, including: receiving a business processing result, wherein the business processing result is forwarded to a desensitization server via a reverse proxy server deployed on a client, the business processing result is obtained by the client using a predetermined processing logic to process a page processing request, and the page processing request is a request for obtaining a target via the client; parsing based on the business processing result to determine a session identifier and response data of the target; determining a target desensitization strategy corresponding to the target according to the session identifier; using the target desensitization strategy to desensitize the response data, and obtaining and sending desensitized data, wherein the desensitized data is used to execute a desensitized response to the page processing request on the client.

[0009] Optionally, the method further includes: in response to the desensitizing server starting processing, pulling predetermined desensitizing policies corresponding to multiple types of targets from the configuration server; receiving and caching predetermined desensitizing policies corresponding to multiple types of targets.

[0010] Optionally, after pulling predetermined desensitization policies corresponding to multiple types of targets from the configuration server, the method also includes: determining the connection status between the desensitization server and the configuration server at predetermined time intervals; when the connection status is normal, obtaining desensitization policy update information in the configuration server; and updating the cached predetermined desensitization policy based on the desensitization policy update information.

[0011] According to another aspect of an embodiment of the present application, a page desensitization method is provided, including: a client obtains a page processing request of a target; a predetermined processing logic of the client is used to process the page processing request to obtain a business processing result; a reverse proxy server deployed on the client forwards the business processing result to a desensitizing server for processing; the desensitizing server performs analysis based on the business processing result to determine the session identifier and response data of the target; according to the session identifier, a target desensitization policy corresponding to the target is determined; the target desensitization policy is used to desensitize the response data to obtain and send desensitized data; the client executes a desensitized response to the page processing request based on the received desensitized data.

[0012] According to another aspect of an embodiment of the present application, a page desensitization device is provided, including: a page processing request acquisition module, used to obtain a page processing request of a target; a business processing module, used to process the page processing request using a predetermined processing logic of the client, and obtain a business processing result; a forwarding module, used to forward the business processing result to a desensitization server for processing via a reverse proxy server deployed on the client, wherein the desensitization server is used to perform analysis based on the business processing result to determine the session identifier and response data of the target; determine a target desensitization policy corresponding to the target according to the session identifier; use the target desensitization policy to desensitize the response data to obtain desensitized data; a response module, used to execute a desensitized response to the page processing request on the client in response to receiving the desensitized data.

[0013] According to another aspect of an embodiment of the present application, a non-volatile storage medium is provided, wherein the non-volatile storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing any one of the page desensitization methods.

[0014] According to another aspect of an embodiment of the present application, an electronic device is provided, comprising: one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by one or more processors, the one or more processors implement any one of the page desensitization methods.

[0015] In an embodiment of the present application, by obtaining the page processing request of the target; using the predetermined processing logic of the client to process the page processing request and obtain the business processing result; forwarding the business processing result to the desensitizing server for processing via the reverse proxy server deployed on the client, wherein the desensitizing server is used to parse based on the business processing result to determine the session identifier and response data of the target; according to the session identifier, determine the target desensitization strategy corresponding to the target; adopt the target desensitization strategy to desensitize the response data to obtain desensitized data; in response to receiving the desensitized data, execute the desensitized response to the page processing request on the client. The purpose of executing the desensitization strategy based on the user role is achieved, and different desensitization strategies are executed according to user needs, which improves the technical effect of the dynamic desensitization effect, thereby solving the technical problem of unsatisfactory dynamic desensitization effect for different user needs existing in the related technology. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0017] Figure 1is a first flow chart of an optional page desensitization method provided according to an embodiment of the present application;

[0018] Figure 2 is a second flow chart of an optional page desensitization method provided according to an embodiment of the present application;

[0019] Figure 3 is a third flow chart of an optional page desensitization method provided according to an embodiment of the present application;

[0020] Figure 4 is a schematic diagram of an optional page desensitization method provided according to an embodiment of the present application;

[0021] Figure 5 It is a schematic diagram of an optional page desensitization device provided according to an embodiment of the present application. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0023] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0024] For the convenience of description, some nouns or terms involved in the embodiments of the present application are explained below:

[0025] Data Masking is a data protection technology used to hide or modify sensitive information without affecting the data structure and availability. The goal of data masking is to reduce the risk of data leakage while ensuring that the data can still be used for its intended purpose. Data masking technology is crucial in the storage, transmission and use of data, especially when the data needs to be accessed by unauthorized personnel or used in development, testing, analysis and other scenarios.

[0026] nginx is a high-performance HTTP (Hyper Text Transfer Protocol) and reverse proxy server, as well as a mail proxy server, with high concurrent processing capabilities, low memory consumption and high stability.

[0027] A reverse proxy server is a server configuration that receives client requests on behalf of one or more backend servers, then forwards these requests to the backend servers and returns the responses of the backend servers to the clients. The reverse proxy hides the information of the backend servers, and the clients interact directly with the reverse proxy servers without directly accessing the backend servers.

[0028] A gateway plays the role of a bridge in a computer network and is used to connect two or more networks of different types. Its main functions are protocol conversion, address translation, data filtering and security, and flow control.

[0029] Heartbeat Monitoring usually refers to a mechanism used to monitor service status and ensure the normal operation of services in distributed systems, network services or software applications. A heartbeat is a signal or message sent periodically to indicate that the system or service is still active and can respond to external requests. Through heartbeat monitoring, real-time monitoring of services and rapid response to failures can be achieved, ensuring the stability and reliability of the data dynamic desensitization system.

[0030] AJAX (Asynchronous JavaScript and XML) is a technology that can update part of a web page without reloading the entire web page. XML (eXtensible Markup Language) is a markup language used to describe the structure and meaning of data. AJAX technology can use any data format, including JSON (JavaScript Object Notation, a lightweight data exchange format) and HTML (Hyper Text Markup Language). Its core idea is to enable web pages to dynamically update their content by exchanging small amounts of data with the server in the background, thereby providing a smoother and more interactive user experience.

[0031] According to an embodiment of the present application, a method embodiment of a page desensitization method is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0032] Figure 1 This is a first flow chart of an optional page desensitization method provided according to an embodiment of the present application, and the execution subject may be a client, such as Figure 1 As shown, the method comprises the following steps:

[0033] Step S102, obtaining a target page processing request;

[0034] It can be understood that the target initiates a page processing request, the client obtains the target's page processing request, and sends the page processing request to the reverse proxy server. After receiving the page processing request, the reverse proxy server parses and processes the request information. Among them, the above-mentioned client may include a browser and a business platform, and the above-mentioned reverse proxy server may adopt a plug-in-based nginx reverse proxy server, that is, an nginx plug-in. By utilizing the function of the nginx plug-in, the target's page request can be efficiently and accurately identified and processed, providing a solid foundation for subsequent data desensitization, while ensuring the high availability of the system and the continuity of business processing.

[0035] In an optional embodiment, before obtaining the target's page processing request, the method also includes: responding to the target's login request on the client, using a reverse proxy server to forward the login request to a desensitizing server, wherein the desensitizing server is used to store the target's session identifier; after the target logs in on the client, allowing the target to request a page in the client.

[0036] It can be understood that before obtaining the target's page processing request, the user initiates a login request to log in to the business platform on the client, and uses the reverse proxy server to forward the user's login request to the desensitizing server. The desensitizing service caches the relationship between the user and the session (that is, the target's session ID). After the target successfully logs in to the business platform on the client, the target is allowed to request pages on the client's business platform that contain sensitive data. The use of session IDs allows the system to provide personalized desensitizing services based on user roles and permissions, ensuring that sensitive data is only displayed to authorized users in an appropriate manner. At the same time, by storing the target's session ID on the desensitizing server, the login status and permission information of each user can be effectively managed to ensure that all subsequent requests can be correctly identified and processed.

[0037] In an optional embodiment, the method also includes: determining predetermined desensitization policies corresponding to different types of targets logged in to the client based on the business type, domain name, and predetermined desensitization field corresponding to the client; and configuring the predetermined desensitization policies corresponding to multiple types of targets to the desensitization server via the configuration server.

[0038] It can be understood that based on the business type, domain name and predetermined desensitizing field corresponding to the client, predetermined desensitizing policies corresponding to different types of targets are defined on the configuration server. According to the business type, domain name and predetermined desensitizing field corresponding to the client, the predetermined desensitizing policies corresponding to different targets are determined, and these predetermined desensitizing policies are configured to the desensitizing server through the configuration server. The configuration method can be a cache method. Through the policy definition based on business type, domain name and field, refined control of sensitive data can be achieved, ensuring that each request is desensitized according to the policy that best suits its characteristics, thereby improving data security and the accuracy of user privacy protection.

[0039] Step S104, using the client's predetermined processing logic to process the page processing request and obtain a business processing result;

[0040] It can be understood that based on the predetermined processing logic of the client's business platform, the target page processing request is processed to obtain the business processing result. By using the client's business platform to implement the predetermined business processing logic, the integrity and efficiency of the business process can be ensured, and the business processing logic is separated from the data dynamic desensitization strategy, so that even if the desensitization server fails, the business processing system can still operate normally, ensuring the continuity of the business and the stability of data processing.

[0041] Step S106, forwarding the business processing result to the desensitizing server for processing via the reverse proxy server deployed on the client, wherein the desensitizing server is used to parse based on the business processing result, determine the session identifier and response data of the target; determine the target desensitizing strategy corresponding to the target according to the session identifier; adopt the target desensitizing strategy to desensitize the response data to obtain desensitized data;

[0042] It can be understood that after the target page request is processed by the business platform, the business platform will generate a response containing the original data, that is, the business processing result. The above business processing result is forwarded to the desensitizing server via the reverse proxy server deployed on the client. When the business processing result arrives at the desensitizing server, the server first parses the business processing result to identify the session identifier (i.e., session) and response data therein, and determines the desensitization policy corresponding to the target based on the identified session identifier. Based on the determined desensitization policy, the desensitizing server processes the sensitive information in the response data to obtain desensitized data. The desensitization policy based on user and session identifiers can provide personalized data display for different users, meet compliance requirements, and provide appropriate information access, and desensitize the data before the data is transmitted to the user, ensuring the security of sensitive information and preventing the risk of data leakage.

[0043] In an optional embodiment, the method further includes: in response to the desensitizing server starting processing, pulling predetermined desensitizing policies corresponding to multiple types of targets from the configuration server; receiving and caching predetermined desensitizing policies corresponding to multiple types of targets.

[0044] It can be understood that when the desensitizing server is started, the predetermined desensitizing policies corresponding to multiple types of targets are pulled from the configuration server. The desensitizing server receives and caches the predetermined desensitizing policies corresponding to the above multiple types of targets. By pre-pulling and caching the predetermined desensitizing policies of the configuration server, the communication delay between the desensitizing server and the configuration server can be reduced, so that the desensitizing server can quickly apply the policy, improve the data processing speed, and reduce the user waiting time.

[0045] In an optional embodiment, after pulling predetermined desensitization policies corresponding to multiple types of targets from the configuration server, the method also includes: determining the connection status between the desensitization server and the configuration server at a predetermined time interval; when the connection status is normal, obtaining the desensitization policy update information in the configuration server; and updating the cached predetermined desensitization policy based on the desensitization policy update information.

[0046] It can be understood that in order to ensure the real-time and accuracy of the desensitization policy, the desensitization server needs to regularly check and update the desensitization policy obtained from the configuration server. The desensitization server can be checked and updated regularly by setting a heartbeat task on the desensitization server. A heartbeat task is set on the desensitization server, which runs at a predetermined time interval to check the connection status between the desensitization server and the configuration server. When the connection status is normal, the heartbeat task of the desensitization server will further obtain the latest desensitization policy update information from the configuration server. After receiving the update information, the desensitization server will update the cached desensitization policy based on this information. If the connection status is normal, the configuration server will try to reconnect to the desensitization server. If the reconnection fails, the configuration server will issue a warning and perform the predetermined fault handling activities. The heartbeat mechanism can not only detect the connection status, but also take quick action when anomalies are detected, which improves the system's fault recovery capability and stability, and ensures that the desensitization server can provide basic services even when the network is unstable. Through regular heartbeat checks and policy updates, the desensitization server can ensure that its local policy is consistent with the latest policy of the management platform, thereby realizing real-time updates and applications of desensitization policies and improving data security.

[0047] Optionally, the heartbeat mechanism is a communication strategy commonly used in computer networks and software systems, which can be used to detect and maintain the activity of the connection, ensuring continuous communication and synchronization between the client and the server or between system components. In the process of dynamic data desensitization, the heartbeat mechanism generally includes a heartbeat sender, a heartbeat receiver, a heartbeat signal, a heartbeat frequency, and a timeout threshold. Among them, the heartbeat sender is used to send heartbeat signals regularly, such as a configuration server; the heartbeat receiver is used to receive and process heartbeat signals, such as a desensitization server; the heartbeat signal can be a simple message or contain more complex status information, such as the service status of the desensitization server, desensitization policy update information, and these signals are usually sent through a network protocol; the heartbeat frequency refers to the frequency at which the heartbeat signal is sent, which usually depends on the stability requirements of the connection and the network conditions. If the network delay is high, the heartbeat frequency may need to be set longer to avoid unnecessary reconnection; the timeout threshold refers to the time that the receiver, i.e., the desensitization server, waits when it does not receive a heartbeat signal. If this threshold is exceeded, the system will consider that the sender, i.e., the configuration server, is no longer active and take action. Through the heartbeat mechanism, connection status checks and real-time desensitization policy updates for dynamic data desensitization can be achieved, ensuring the continuous availability of data and services, improving the overall stability and efficiency of the system, and ensuring the real-time and accuracy of the desensitization policy.

[0048] Step S108, in response to receiving the desensitized data, executing a desensitized response to the page processing request on the client.

[0049] It can be understood that after the desensitization server completes the data desensitization of the target request page, it obtains the desensitized data, and responds to the desensitized response of the client to the page processing request, and sends the desensitized data to the client via the reverse proxy server. The desensitization result is sent to the client through the reverse proxy server, which ensures that the data received by the client is desensitized data that has been securely processed, while maintaining a good user experience, reducing the processing burden of the client, simplifying the system architecture, enhancing the compliance of data protection, and comprehensively improving the efficiency and security of data protection and business processing.

[0050] Through the above step S102, the page processing request of the target is obtained; step S104, the predetermined processing logic of the client is used to process the page processing request to obtain the business processing result; step S106, the business processing result is forwarded to the desensitizing server for processing via the reverse proxy server deployed on the client, wherein the desensitizing server is used to parse based on the business processing result to determine the session identifier and response data of the target; according to the session identifier, the target desensitization strategy corresponding to the target is determined; the target desensitization strategy is used to desensitize the response data to obtain desensitized data; step S108, in response to receiving the desensitized data, the client executes the desensitized response to the page processing request. The purpose of executing the desensitization strategy based on the user role can be achieved, and different desensitization strategies are executed according to user needs, which improves the technical effect of the dynamic desensitization effect, thereby solving the technical problem of unsatisfactory dynamic desensitization effect for different user needs existing in the related technology.

[0051] Figure 2 is a second flow chart of an optional page desensitization method provided according to an embodiment of the present application, and the execution subject may be a desensitization server, such as Figure 2 As shown, the method comprises the following steps:

[0052] Step S202, receiving a business processing result, wherein the business processing result is forwarded to the desensitizing server via a reverse proxy server deployed on the client, and the business processing result is obtained by the client using a predetermined processing logic to process a page processing request, and the page processing request is a request to obtain a target via the client;

[0053] Step S204, performing analysis based on the business processing result to determine the target session identifier and response data;

[0054] Step S206, determining a target desensitization strategy corresponding to the target according to the session identifier;

[0055] Step S208, adopting the target desensitization strategy, desensitizing the response data, obtaining and sending the desensitized data, wherein the desensitized data is used to execute a desensitized response to the page processing request on the client.

[0056] It can be understood that the target sends a page processing request, the client obtains the target's page processing request, and sends the page processing request to the reverse proxy server. After receiving the page processing request, the reverse proxy server sends the page processing request to the client's business platform. The business platform uses a predetermined processing logic to process the target's page processing request, obtains a business processing result, and sends the business processing result to the desensitizing server via the reverse proxy server. The desensitizing server receives the above-mentioned business processing result, parses the business processing result, and obtains the session identifier and response data of the target. Based on the session identifier, the target desensitization policy corresponding to the target is determined. Using the target desensitization policy, the response data is desensitized to obtain desensitized data. In order to respond to the client's desensitized response to the page processing request, the reverse proxy server is used to send the desensitized data to the client. By performing desensitization on the path where the data is returned from the business platform to the client, the security of sensitive information during transmission is ensured, and the desensitization logic is separated from the business platform, which not only prevents the risk of data being stolen or abused during transmission, but also reduces the processing burden of the business platform, so that the business platform can focus on its core functions without worrying about the details of data security.

[0057] Through the above step S202, the business processing result is received, wherein the business processing result is forwarded to the desensitizing server via the reverse proxy server deployed on the client, and the business processing result is obtained by the client using a predetermined processing logic to process the page processing request, and the page processing request is a request to obtain the target via the client; step S204, based on the business processing result, the session identifier and response data of the target are analyzed; step S206, according to the session identifier, the target desensitization strategy corresponding to the target is determined; step S208, the target desensitization strategy is adopted to desensitize the response data, and the desensitized data is obtained and sent, wherein the desensitized data is used to execute the desensitized response to the page processing request on the client. The purpose of executing the desensitization strategy based on the user role can be achieved, and different desensitization strategies are executed according to user needs, and the technical effect of improving the dynamic desensitization effect is achieved, thereby solving the technical problem that the dynamic desensitization effect for different user needs in the related technology is not ideal.

[0058] Figure 3 It is a third flow chart of an optional page desensitization method provided according to an embodiment of the present application, and the execution subject may be a client, a reverse proxy server and a desensitization server, such as Figure 3 As shown, the method comprises the following steps:

[0059] Step S302, the client obtains the target page processing request; uses the client's predetermined processing logic to process the page processing request and obtains a business processing result;

[0060] Step S304, the reverse proxy server deployed on the client forwards the business processing result to the desensitization server for processing;

[0061] Step S306: The desensitizing server performs analysis based on the business processing result to determine the session identifier and response data of the target; determines the target desensitizing strategy corresponding to the target according to the session identifier; adopts the target desensitizing strategy to desensitize the response data, obtains and sends the desensitized data;

[0062] Step S308: The client executes a desensitized response to the page processing request based on the received desensitized data.

[0063] It can be understood that the target sends a page processing request, and the client obtains the target's page processing request. The page processing request is processed using the predetermined processing logic of the client's business platform to obtain the business processing result. The above business processing result is sent to the desensitizing server for desensitization using the reverse proxy server deployed on the client. After receiving the business processing result, the desensitizing server parses the business processing result to obtain the session identifier and response data of the target. Based on the session identifier, the target desensitization policy corresponding to the target is determined. Using the target desensitization policy, the response data is desensitized to obtain desensitized data. In order to respond to the client's desensitized response to the page processing request, the desensitized data is sent to the client using the reverse proxy server. The above data dynamic desensitization process and method can realize accurate and secure desensitization processing of data under different users and different business scenarios, while maintaining the efficiency of business processing and the optimization of user experience. It is a comprehensive solution that integrates data security, business continuity, user experience, policy flexibility, efficient resource utilization and compliance assurance.

[0064] Through the above step S302, the client obtains the page processing request of the target; the page processing request is processed using the predetermined processing logic of the client to obtain the business processing result; step S304, the reverse proxy server deployed on the client forwards the business processing result to the desensitizing server for processing; step S306, the desensitizing server parses based on the business processing result to determine the session identifier and response data of the target; according to the session identifier, the target desensitization strategy corresponding to the target is determined; the target desensitization strategy is adopted to desensitize the response data, and the desensitized data is obtained and sent; step S308, the client executes the desensitized response to the page processing request based on the received desensitized data. The purpose of executing the desensitization strategy based on the user role can be achieved, and different desensitization strategies are executed according to user needs, which improves the technical effect of the dynamic desensitization effect, thereby solving the technical problem of unsatisfactory dynamic desensitization effect for different user needs existing in the related technology.

[0065] Based on the above-mentioned embodiments and optional embodiments, the present application proposes an optional implementation method for dynamic desensitization of page data. For data desensitization, the relevant technology is generally to intercept all requests and traffic by means of a gateway, and return after desensitization processing, and most of them are connected in series to the business, which will first affect the performance of the original business, and the component will block the main business process once it is damaged. In the embodiment of the present application, a lightweight nginx (i.e., reverse proxy server) plug-in is introduced to solve the problem of dynamic desensitization of data, and different desensitization effects can be achieved based on user roles, so that the sensitive data of the same business system can show different desensitization effects to different users, and the control of desensitized traffic can be accurate to a specific domain name, and the realization of desensitization capability can be accurate to the field level, and the business side is zero-transformed. Figure 4 is a schematic diagram of an optional page desensitization method provided according to an embodiment of the present application, such as Figure 4 As shown in the figure, the specific process of the data dynamic desensitization method based on the nginx plug-in is shown. The process is introduced below.

[0066] S1. The administrator configures the business platform information on the management platform (i.e., the configuration server), including: domain name, method to be desensitized, desensitization level of the field, and desensitization policies for different users.

[0067] Based on the client's corresponding business type, domain name, and predetermined desensitization field, the predetermined desensitization policies corresponding to different types of targets are defined on the configuration server. Through the policy definition based on business type, domain name, and field, refined control of sensitive data can be achieved, ensuring that each request is desensitized according to the policy that best suits its characteristics, improving data security and the accuracy of user privacy protection.

[0068] S2. When the desensitizing service (i.e., desensitizing server) is started, relevant configuration information is pulled and cached, and updated in real time through heartbeat detection.

[0069] When the desensitization service is started, the configuration server is requested to obtain the latest scheduled desensitization policies corresponding to multiple types of targets. The desensitization server receives and caches the latest scheduled desensitization policies. In order to ensure the real-time and accuracy of the desensitization policies, the desensitization server needs to regularly check and update the desensitization policies obtained from the configuration server. The regular check and update of the desensitization server can be achieved by setting a heartbeat task on the desensitization server. A heartbeat task is set on the desensitization server. After starting the heartbeat task, the configuration server sends a heartbeat to the desensitization server and detects the update of the desensitization policy. The heartbeat task runs at a predetermined time interval to check the connection status between the desensitization server and the configuration server. When the connection status is normal, the heartbeat task of the desensitization server will further obtain the latest desensitization policy update information from the configuration server. After receiving the update information, the desensitization server will update the cached desensitization policy based on this information. The heartbeat mechanism can not only detect the connection status, but also take quick action when anomalies are detected, which improves the system's fault recovery capability and stability, and ensures that the desensitization server can provide basic services even when the network is unstable. Through regular heartbeat checks and policy updates, the desensitizing server can ensure that its local policies are consistent with the latest policies of the management platform, thereby achieving real-time updating and application of desensitizing policies and improving data security.

[0070] S3. The user logs in to the business platform.

[0071] S4. The user's login request is forwarded to the desensitizing service through the nginx plug-in, and the desensitizing service caches the relationship between the user and the session.

[0072] The user initiates a login request to log into the business platform on the client, and the login request can be sent using the AJAX method. Using the nginx plug-in, the user's login request is forwarded to the desensitizing server, and the desensitizing service caches the relationship between the user and the session (that is, the target's session identifier). After the target successfully logs in to the business platform on the client, the target is allowed to request pages on the client's business platform that contain sensitive data. The use of session identifiers allows the system to provide personalized desensitizing services based on user roles and permissions, ensuring that sensitive data is only displayed to authorized users in an appropriate manner. At the same time, by storing the target's session identifier on the desensitizing server, each user's login status and permission information can be effectively managed to ensure that all subsequent requests can be correctly identified and processed.

[0073] S5. The user requests a page on the business platform that contains sensitive data.

[0074] After the user's request is sent to the business platform via the nginx plug-in, the business platform uses the predetermined processing logic to process the request, obtains the business processing result, and sends the business processing result to the nginx plug-in. By using the client's business platform to implement the predetermined business processing logic, the integrity and efficiency of the business process can be ensured, and the business processing logic is separated from the data dynamic desensitization strategy, so that even if the desensitization server fails, the business processing system can still operate normally, ensuring the continuity of the business and the stability of data processing.

[0075] S6. The page where the user requests sensitive data is forwarded to the desensitizing service through the nginx plug-in. The desensitizing service parses the session, finds the user based on the session, finds the corresponding desensitizing policy based on the user, and then desensitizes the sensitive data in the response data.

[0076] After the target page request is processed by the business platform, the business platform will generate a response containing the original data, that is, the business processing result. The above business processing results are forwarded to the desensitizing server via the nginx plug-in deployed on the client, wherein a connection can be established between the nginx plug-in and the desensitizing server using websocket (a communication protocol that allows real-time, two-way data exchange between the client and the server). When the business processing result arrives at the desensitizing server, the server first parses the business processing result, including parsing the domain name, method, parameter, session identifier (i.e., session), etc., and determines whether there is a corresponding desensitization strategy based on the session identifier. If there is a corresponding desensitization strategy, the response data is desensitized based on the identified session identifier and response data, and the corresponding desensitization strategy is used to obtain desensitized data. The desensitization strategy based on user and session identifiers can provide personalized data display for different users, meet compliance requirements, and provide appropriate information access. Data desensitization is performed before the data is transmitted to the user, ensuring the security of sensitive information and preventing the risk of data leakage.

[0077] S7. The user sees a page containing sensitive data that has been desensitized.

[0078] After desensitizing the data of the target's request page, the desensitizing server obtains the desensitized data, and responds to the desensitized response of the client to the page processing request, and sends the desensitized data to the client via the nginx plug-in. The user can see the page containing sensitive data that has been desensitized. The desensitization result is sent to the client through the nginx plug-in, which ensures that the data received by the client is securely processed desensitized data, while maintaining a good user experience, reducing the processing burden of the client, simplifying the system architecture, enhancing the compliance of data protection, and comprehensively improving the efficiency and security of data protection and business processing.

[0079] The above page desensitization method is accessed through the nginx plug-in, without the need to introduce new components and code modifications. It can accurately configure the forwarding of specific traffic of a certain port; secondly, it can provide a management platform that can not only configure desensitization policies based on the field level, but also configure different desensitization policies based on different user roles.

[0080] The above optional implementation method achieves at least the following effects: introducing a lightweight nginx plug-in to solve the problem of dynamic data desensitization, avoiding the performance of the original business and the main business process blocking problem caused by component damage; performing data desensitization through the nginx plug-in, avoiding the introduction of new components and code transformation, achieving zero transformation of the business side, and improving the convenience of the data desensitization process; by configuring different desensitization strategies, the control of desensitized traffic can be accurate to a specific domain name, and the implementation of desensitization capabilities can be accurate to the field level, achieving different desensitization effects based on user roles and improving the purpose of desensitization accuracy.

[0081] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0082] In this embodiment, a page desensitization device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and will not be repeated hereafter. As used below, the terms "module" and "device" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0083] According to an embodiment of the present application, a device embodiment for implementing a page desensitization method is also provided. Figure 5 is a schematic diagram of a page desensitization device according to an embodiment of the present application, such as Figure 5 As shown, the above-mentioned page desensitization device includes a page processing request acquisition module 502, a business processing module 504, a forwarding module 506, and a response module 508. The device is described below.

[0084] The page processing request acquisition module 502 is used to acquire the target page processing request;

[0085] The business processing module 504 is connected to the page processing request acquisition module 502 and is used to process the page processing request using the predetermined processing logic of the client to obtain the business processing result;

[0086] The forwarding module 506 is connected to the business processing module 504 and is used to forward the business processing result to the desensitizing server for processing via the reverse proxy server deployed on the client, wherein the desensitizing server is used to parse based on the business processing result to determine the session identifier and response data of the target; determine the target desensitization strategy corresponding to the target according to the session identifier; adopt the target desensitization strategy to desensitize the response data to obtain desensitized data;

[0087] The response module 508 is connected to the forwarding module 506 and is used to execute a post-desensitization response to the page processing request at the client in response to receiving the desensitized data.

[0088] In a page desensitization device provided by an embodiment of the present application, a page processing request acquisition module 502 is set to obtain the page processing request of the target; a business processing module 504 is connected to the page processing request acquisition module 502, and is used to process the page processing request using the predetermined processing logic of the client to obtain the business processing result; a forwarding module 506 is connected to the business processing module 504, and is used to forward the business processing result to the desensitization server for processing via a reverse proxy server deployed on the client, wherein the desensitization server is used to parse based on the business processing result, determine the session identifier and response data of the target; according to the session identifier, determine the target desensitization strategy corresponding to the target; adopt the target desensitization strategy to desensitize the response data to obtain desensitized data; a response module 508 is connected to the forwarding module 506, and is used to respond to the desensitization of the page processing request on the client in response to receiving the desensitized data. The purpose of executing the desensitization strategy based on the user role is achieved, and different desensitization strategies are implemented according to user needs, and the technical effect of improving the dynamic desensitization effect is improved, thereby solving the technical problem that the dynamic desensitization effect for different user needs in the related technology is not ideal.

[0089] It should be noted that the above modules can be implemented by software or hardware. For example, for the latter, it can be implemented in the following ways: the above modules can be located in the same processor; or the above modules can be located in different processors in any combination.

[0090] It should be noted that the page processing request acquisition module 502, the business processing module 504, the forwarding module 506, and the response module 508 correspond to steps S102 to S108 in the embodiment, and the examples and application scenarios implemented by the modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above embodiment. It should be noted that the modules as part of the device can be run in a computer terminal.

[0091] It should be noted that the optional or preferred implementation of this embodiment can refer to the relevant description in the embodiment, which will not be repeated here.

[0092] The above-mentioned page desensitization device may also include a processor and a memory. The page processing request acquisition module 502, the business processing module 504, the forwarding module 506, the response module 508, etc. are all stored in the memory as program units, and the processor executes the above-mentioned program units stored in the memory to realize the corresponding functions.

[0093] The processor includes a kernel, which retrieves the corresponding program unit from the memory. There can be one or more kernels. The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one storage chip.

[0094] An embodiment of the present application provides a non-volatile storage medium on which a program is stored, and when the program is executed by a processor, a page desensitization method is implemented.

[0095] The embodiment of the present application provides an electronic device, which includes a processor, a memory, and a program stored in the memory and can be run on the processor. When the processor executes the program, the following steps are implemented: obtaining a page processing request of a target; using a predetermined processing logic of a client to process the page processing request and obtain a business processing result; forwarding the business processing result to a desensitizing server for processing via a reverse proxy server deployed on the client, wherein the desensitizing server is used to parse based on the business processing result to determine the session identifier and response data of the target; according to the session identifier, determine the target desensitization strategy corresponding to the target; adopt the target desensitization strategy to desensitize the response data to obtain desensitized data; in response to receiving the desensitized data, execute a desensitized response to the page processing request on the client. The device in this article can be a server, a PC, etc.

[0096] The present application also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program that initializes the following method steps: obtaining a page processing request of a target; using a predetermined processing logic of a client to process the page processing request to obtain a business processing result; forwarding the business processing result to a desensitizing server for processing via a reverse proxy server deployed on the client, wherein the desensitizing server is used to perform analysis based on the business processing result to determine the session identifier and response data of the target; determining a target desensitizing strategy corresponding to the target according to the session identifier; using the target desensitizing strategy to desensitize the response data to obtain desensitized data; in response to receiving the desensitized data, executing a desensitized response to the page processing request on the client.

[0097] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0098] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0099] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0100] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0101] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0102] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0103] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0104] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0105] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0106] The above are only embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included within the scope of the claims of the present application.

Claims

1. A page desensitization method, characterized in that: include: Get the target page processing request; Using the predetermined processing logic of the client, the page processing request is processed to obtain a business processing result; The business processing result is forwarded to the desensitizing server for processing via the reverse proxy server deployed on the client, wherein the desensitizing server is used to parse the business processing result to determine the session identifier and response data of the target; determine the target desensitizing policy corresponding to the target according to the session identifier; adopt the target desensitizing policy to desensitize the response data to obtain desensitized data; In response to receiving the desensitized data, a desensitized response to the page processing request is performed on the client.

2. The method according to claim 1, characterized in that: Before obtaining the target page processing request, the method further includes: In response to a login request of the target at the client, the reverse proxy server is used to forward the login request to the desensitizing server, wherein the desensitizing server is used to store the session identifier of the target; After the target logs in to the client, the target is allowed to request pages in the client.

3. The method according to any one of claims 1 or 2, characterized in that The method further comprises: Determine predetermined desensitization strategies corresponding to different types of targets logged in in the client based on the business type, domain name, and predetermined desensitization field corresponding to the client; Via the configuration server, predetermined desensitization strategies corresponding to multiple types of targets are configured to the desensitization server.

4. A page desensitization method, characterized in that: include: Receiving a business processing result, wherein the business processing result is forwarded to the desensitizing server via a reverse proxy server deployed on the client, the business processing result is obtained by the client using a predetermined processing logic to process a page processing request, and the page processing request is a request to obtain a target via the client; Parsing based on the business processing result to determine the session identifier and response data of the target; Determining a target desensitization strategy corresponding to the target according to the session identifier; The target desensitization strategy is adopted to desensitize the response data, and desensitized data is obtained and sent, wherein the desensitized data is used to execute a desensitized response to the page processing request on the client.

5. The method according to claim 4, characterized in that The method further comprises: In response to the desensitization server starting processing, pulling predetermined desensitization policies corresponding to multiple types of targets from the configuration server; Receive and cache predetermined desensitization strategies corresponding to the multiple types of targets respectively.

6. The method according to claim 5, characterized in that After pulling predetermined desensitization policies respectively corresponding to multiple types of targets from the configuration server, the method further includes: Determining the connection status between the desensitizing server and the configuration server at predetermined time intervals; When the connection status is normal, obtain the desensitization policy update information in the configuration server; and update the cached predetermined desensitization policy based on the desensitization policy update information.

7. A page desensitization method, characterized in that: include: The client obtains the target page processing request; Using the predetermined processing logic of the client, the page processing request is processed to obtain a business processing result; The reverse proxy server deployed on the client forwards the business processing result to the desensitizing server for processing; The desensitizing server performs analysis based on the business processing result to determine the session identifier and response data of the target; Determining a target desensitization strategy corresponding to the target according to the session identifier; Adopting the target desensitization strategy, desensitizing the response data, and obtaining and sending desensitized data; The client performs a desensitized response to the page processing request based on the received desensitized data.

8. A page desensitization device, characterized in that: include: A page processing request acquisition module is used to obtain the target page processing request; A business processing module, used to process the page processing request using a predetermined processing logic of the client to obtain a business processing result; A forwarding module, used for forwarding the business processing result to a desensitizing server for processing via a reverse proxy server deployed on the client, wherein the desensitizing server is used for parsing based on the business processing result to determine the session identifier and response data of the target; according to the session identifier, determining a target desensitizing strategy corresponding to the target; adopting the target desensitizing strategy to desensitize the response data to obtain desensitized data; A response module is used to execute a post-desensitization response to the page processing request on the client in response to receiving the desensitized data.

9. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the page desensitization method described in any one of claims 1 to 7.

10. An electronic device, characterized in that: include: One or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the page desensitization method described in any one of claims 1 to 7.

Images