Data asset processing method and device, equipment and medium

Abstract

The invention relates to a data asset processing method and device, equipment and a medium. The data asset processing method comprises the steps of receiving an instruction that a user selects target data as original data assets; performing rule matching on the target data, determining an application category and a sensitivity level of the target data according to a rule matched with the target data, and obtaining classified and graded target data; and selectively performing desensitization processing on the classified and graded target data according to the sensitivity level to generate circulation data assets. According to the method and the device, the original data assets are uniformly classified and graded, and desensitization processing is selectively performed on the original data assets according to the sensitivity levels of the original data assets, so that application classification and safety processing of the data are realized, and effective asset carding and risk prevention are obtained before the data is applied; the original data assets can be safely and efficiently converted into the data assets for circulation.

Description

Technical Field

[0001] The present disclosure relates to the field of data processing technology, and in particular to a data asset processing method, device, equipment and medium. Background Art

[0002] With the rapid development of information technology, enterprises are facing the challenge of generating and managing massive amounts of data. Enterprise data is not only diverse, including structured data, unstructured data, and semi-structured data, but also involves sensitive information such as personal privacy and business secrets. Therefore, ensuring data security and compliance is the top priority in the process of generating data assets.

[0003] At present, data assets have become an important strategic resource for enterprises. When generating data assets, enterprises mainly rely on traditional data acquisition and processing methods. However, these methods often face problems such as inefficiency and security risks when facing large amounts of data and diversity. Especially in the cross-border flow of data and cloud computing environments, data security issues have become more prominent, often leading to data leakage and compliance risks. Existing data generation technologies fail to effectively integrate multi-source heterogeneous data and lack intelligent data governance and management methods, resulting in a complex and unstable data asset generation process, and the inability to generate data assets safely and effectively. Summary of the invention

[0004] In order to solve the above technical problems or at least partially solve the above technical problems, the present disclosure provides a data asset processing method, device, equipment and medium.

[0005] In a first aspect, the present disclosure provides a data asset processing method, comprising:

[0006] Receiving an instruction from a user to select target data as an original data asset;

[0007] Perform rule matching on the target data, determine the application category and sensitivity level of the target data according to the rules that match the target data, and obtain the classified and graded target data;

[0008] Selectively desensitize the classified and graded target data according to the sensitivity level to generate circulating data assets.

[0009] Optionally, rule matching is performed on the target data, and the application category and sensitivity level of the target data are determined according to the rules matching the target data, including:

[0010] Traversing and matching the target data with the first rule, determining the application category of the target data according to the first rule matching the target data, the first rule being a rule bound to a pre-configured data application category;

[0011] Traversing and matching the target data with the second rule, determining the basic sensitivity level of the target data according to the second rule matching the target data, where the second rule is a rule with a corresponding sensitivity level preset;

[0012] The sensitivity level correction parameter corresponding to the application category of the target data is queried, and the sensitivity level of the target data is determined according to the sensitivity level correction parameter and the basic sensitivity level of the target data.

[0013] Optionally, the classified and graded target data is selectively desensitized according to the sensitivity level, including:

[0014] If the sensitivity level is above the preset sensitivity level threshold, then find the first desensitization rule bound to the matching second rule, and perform desensitization processing on the classified and graded target data according to the first desensitization rule;

[0015] If there is no first desensitization rule bound to the matching second rule, then the second desensitization rule bound to the application category of the target data is searched, and the classified and graded target data is desensitized according to the first desensitization rule.

[0016] Optionally, before matching the target data with rules, the following steps are also included:

[0017] When receiving a configuration instruction from a user regarding an application category of data, a data classification tree template is displayed to the user, where the custom data classification tree includes a plurality of leaf node input items;

[0018] In response to the user's configuration operation on the data classification tree template, the application category information filled in by the user in each leaf node input item is saved to obtain a custom data classification tree, where each leaf node in the custom data classification tree corresponds to a data application category;

[0019] In response to the user's configuration operation on the custom data classification tree, the leaf nodes selected by the user are bound to the rules pre-configured by the user, and the sensitivity level modification parameters set by the user for each leaf node are saved.

[0020] Optionally, before matching the target data with rules, the following steps are also included:

[0021] In response to the user's configuration instruction on the matching rule, a rule information input interface is displayed to receive the rule information input by the user;

[0022] After saving the rule information entered by the user, the setting options of the rule matching object are displayed to the user. The rule matching object includes the field name, field comment and data content;

[0023] The rule matching object selected by the user is set as the matching object of the rule information, and a rule for matching with the target data is generated.

[0024] Optionally, before matching the target data with rules, the following steps are also included:

[0025] Upon receiving a configuration instruction from a user regarding the sensitivity level of data, displaying pre-configured rules and sensitivity level input items to the user;

[0026] The sensitivity level entered by the user in the sensitivity level input item is used as the sensitivity level corresponding to the pre-configured rule.

[0027] Optionally, the method further comprises:

[0028] When receiving a request for circulating data assets, count the proportion of desensitized data in the circulating data assets;

[0029] If the ratio is above the preset ratio threshold, the circulating data assets are encrypted and the corresponding keys are generated;

[0030] The encrypted circulating data asset is transmitted to the requester who sent the request instruction, and after the requester passes the key request verification, the key is sent to the requester so that the requester can decrypt the encrypted circulating data asset with the key.

[0031] In a second aspect, the present disclosure provides a data asset processing device, comprising:

[0032] A receiving module, used for receiving an instruction from a user to select target data as original data assets;

[0033] The classification and grading module is used to match the target data with rules, determine the application category and sensitivity level of the target data according to the rules that match the target data, and obtain the classified and graded target data;

[0034] The desensitizing module is used to selectively desensitize the classified and graded target data according to the sensitivity level to generate circulating data assets.

[0035] Optionally, when the classification and grading module performs rule matching on the target data and determines the application category and sensitivity level of the target data according to the rules matching the target data, it is specifically used to:

[0036] Traversing and matching the target data with the first rule, determining the application category of the target data according to the first rule matching the target data, the first rule being a rule bound to a pre-configured data application category;

[0037] Traversing and matching the target data with the second rule, determining the basic sensitivity level of the target data according to the second rule matching the target data, where the second rule is a rule with a corresponding sensitivity level preset;

[0038] The sensitivity level correction parameter corresponding to the application category of the target data is queried, and the sensitivity level of the target data is determined according to the sensitivity level correction parameter and the basic sensitivity level of the target data.

[0039] Optionally, when the desensitizing module selectively performs desensitization processing on the classified and graded target data according to the sensitivity level, it is specifically used to:

[0040] If the sensitivity level is above the preset sensitivity level threshold, then find the first desensitization rule bound to the matching second rule, and perform desensitization processing on the classified and graded target data according to the first desensitization rule;

[0041] If there is no first desensitization rule bound to the matching second rule, then the second desensitization rule bound to the application category of the target data is searched, and the classified and graded target data is desensitized according to the first desensitization rule.

[0042] Optionally, the data asset processing device further includes a configuration module, which is used, before matching the target data with rules, to:

[0043] When receiving a configuration instruction from a user regarding an application category of data, a data classification tree template is displayed to the user, where the custom data classification tree includes a plurality of leaf node input items;

[0044] In response to the user's configuration operation on the data classification tree template, the application category information filled in by the user in each leaf node input item is saved to obtain a custom data classification tree, where each leaf node in the custom data classification tree corresponds to a data application category;

[0045] In response to the user's configuration operation on the custom data classification tree, the leaf nodes selected by the user are bound to the rules pre-configured by the user, and the sensitivity level modification parameters set by the user for each leaf node are saved.

[0046] Optionally, the configuration module is also used to:

[0047] In response to the user's configuration instruction on the matching rule, a rule information input interface is displayed to receive the rule information input by the user;

[0048] After saving the rule information entered by the user, the setting options of the rule matching object are displayed to the user. The rule matching object includes the field name, field comment and data content;

[0049] The rule matching object selected by the user is set as the matching object of the rule information, and a rule for matching with the target data is generated.

[0050] Optionally, the configuration module is also used to:

[0051] Upon receiving a configuration instruction from a user regarding the sensitivity level of data, displaying pre-configured rules and sensitivity level input items to the user;

[0052] The sensitivity level entered by the user in the sensitivity level input item is used as the sensitivity level corresponding to the pre-configured rule.

[0053] Optionally, the data asset processing device further includes an encryption module, which is used to:

[0054] When receiving a request for circulating data assets, count the proportion of desensitized data in the circulating data assets;

[0055] If the ratio is above the preset ratio threshold, the circulating data assets are encrypted and the corresponding keys are generated;

[0056] The encrypted circulating data asset is transmitted to the requester who sent the request instruction, and after the requester passes the key request verification, the key is sent to the requester so that the requester can decrypt the encrypted circulating data asset with the key.

[0057] In a third aspect, the present disclosure provides an electronic device, comprising a memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the method as described in any one of the first aspects is implemented.

[0058] In a fourth aspect, the present disclosure provides a computer-readable storage medium having program instructions stored thereon, which implement any method of the first aspect when the program instructions are executed.

[0059] In a fifth aspect, the present disclosure provides a computer program product, which is stored in a storage medium. When the program product is executed, the method of the first aspect can be implemented.

[0060] Compared with the prior art, the technical solution provided by the present invention has the following advantages:

[0061] The data asset processing method, device, equipment and medium provided by the present disclosure, after receiving the instruction of the user selecting the target data as the original data asset, matches the target data with rules, determines the application category and sensitivity level of the target data according to the rules matching the target data, obtains the classified and graded target data, and then selectively desensitizes the classified and graded target data according to the sensitivity level to generate the circulating data asset. The present disclosure realizes the application classification and security processing of data by uniformly classifying and grading the original data assets, and selectively desensitizing the original data assets according to the sensitivity level of the original data assets, so that the data can be effectively sorted and risk-prevented before application, and the original data assets can be safely and efficiently converted into data assets for circulation. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0063] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0064] Figure 1 A flow chart of a data asset processing method provided in an embodiment of the present disclosure;

[0065] Figure 2 An example diagram of a custom data classification tree provided in an embodiment of the present disclosure;

[0066] Figure 3 A schematic diagram of the structure of a data asset processing device provided in an embodiment of the present disclosure;

[0067] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0068] In order to more clearly understand the above-mentioned objectives, features and advantages of the present disclosure, the scheme of the present disclosure will be further described below. It should be noted that the embodiments of the present disclosure and the features in the embodiments can be combined with each other without conflict.

[0069] In the following description, many specific details are set forth to facilitate a full understanding of the present disclosure, but the present disclosure may also be implemented in other ways different from those described herein; it is obvious that the embodiments in the specification are only part of the embodiments of the present disclosure, rather than all of the embodiments.

[0070] Figure 1 This is a flow chart of a data asset processing method provided in an embodiment of the present disclosure. The method can be executed by a data asset processing device. The data asset processing device can be implemented in software and / or hardware. The data asset processing device can be configured in an electronic device, such as a server or a terminal. The method includes the following steps:

[0071] S101. Receive an instruction from a user to select target data as original data assets.

[0072] The data asset processing method provided in the embodiment of the present disclosure can also be executed by the data middle platform or the client of the data middle platform. The data middle platform is a new data management architecture and concept proposed in the process of digital transformation and enterprise informatization in recent years. It aims to break the data silos, realize the centralized management and efficient use of data, and thus provide enterprises with more flexible and agile data services.

[0073] The client of the data middle platform can be installed on the data server of the user's enterprise. When the user selects data tables from the database to combine into original data assets to be circulated and used, subsequent data processing steps are executed.

[0074] In some embodiments, before executing the rule matching operation on the target data in the subsequent steps, the user can also customize the rules used to match the data, specifically including: in response to the user's configuration instructions on the matching rules, displaying the rule information input interface and receiving the rule information input by the user; after saving the rule information input by the user, displaying the setting options of the rule matching object to the user, the rule matching object including the field name, field annotation and data content; setting the rule matching object selected by the user as the matching object of the rule information, and generating rules for matching the target data.

[0075] The disclosed embodiments may be executed by a configuration module of a data center, which supports user-defined setting rules (including rule types, matching objects), classification levels of sensitivity levels, application categories of data classifications, and other information.

[0076] The rule consists of two parts: the matching object and the rule type. The matching object refers to the target of the current rule matching. For example, it can support three matching objects: field name, field comment, and data content. The "field name" matching target means that when matching data with rules, only the field name in the data table is compared with the currently set rules. If it meets the rules, it is a match, otherwise it is not a match. For example, by matching the rule by the field name "employee name" of the data, it can be determined that the application category of the data is "employee information", and by matching the data content "25 yuan" of the data, it can be determined that the application category of the data is "amount". The application categories determined by two matching rules can be combined to determine that the application category of the data is ultimately "employee information-amount", and the application category of the data can also be determined to be ultimately "employee information-amount" based on the inclusion relationship between the application categories determined by the two matching rules.

[0077] The matching method supports two modes: single rule matching and multi-rule composite matching. The types of matching rules include equal, contain, regular matching and other processing methods. For example, Rule A is a matching type rule with "field name" 123 as the matching object and the matching method is "equal". When "target field name = 123", the target field meets Rule A.

[0078] In some embodiments, the user can also customize the application category of the data, specifically including: upon receiving the user's configuration instructions regarding the application category of the data, displaying a data classification tree template to the user, the custom data classification tree including multiple leaf node input items; in response to the user's configuration operation on the data classification tree template, saving the application category information filled in by the user in each leaf node input item to obtain a custom data classification tree, wherein each leaf node in the custom data classification tree corresponds to a data application category; in response to the user's configuration operation on the custom data classification tree, binding the leaf node selected by the user to the rules pre-configured by the user, and saving the sensitivity level correction parameters set by the user for each leaf node.

[0079] The disclosed embodiments support user-defined data classification trees. When a user configures an application category for data classification, a data classification tree template for assisting in configuring the application category can be displayed to the user. The data classification tree template is a blank data classification tree that has not yet been filled with application category information for the data. The data classification tree includes multiple leaf nodes that define specific application categories of the data, and non-leaf nodes that are used to refine the hierarchical relationships between specific categories. These non-leaf nodes can define application scenarios for the data. Accordingly, each leaf node of the data classification tree template can be used as a leaf node input item for the user to fill in the application category information of the data. In addition, the non-leaf nodes of the data classification tree template can also support users to modify corresponding application scenarios.

[0080] Figure 2 An example diagram of a custom data classification tree provided in an embodiment of the present disclosure, such as Figure 2 As shown, users can set the hierarchical relationship according to the corresponding standards or actual needs, where non-leaf nodes are used to refine the hierarchical relationship between specific categories, and leaf nodes are the finest-grained atomic categories in practical applications. For example, the "mobile phone number" in the Internet industry is a basic component element of "customer data-user data-privacy information-personal contact information".

[0081] The leaf nodes of the data classification tree are bound to the rules used to match data to achieve the matching mapping of "data-application category". The system supports a one-to-many relationship of "leaf node-rule" and can describe the same application category from multiple perspectives (rules). The data classification tree template builds a bridge between "data-application category" and gives practical meaning to the disordered data.

[0082] The sensitivity level correction parameters are used to reflect the sensitivity level of data in different application scenarios. For example, "amount" data can be set as sensitive data in the employee information application category, but it is less sensitive in the resident consumption application category. Therefore, in addition to setting corresponding sensitivity level correction parameters for leaf nodes, corresponding sensitivity level correction parameters can also be set for non-leaf nodes that refine the hierarchical relationship between specific categories, thereby reflecting the sensitivity level of data in different application scenarios.

[0083] In some embodiments, the user can customize the sensitivity level of the data, specifically including: upon receiving the user's configuration instructions regarding the sensitivity level of the data, displaying pre-configured rules and sensitivity level input items to the user; and using the sensitivity level entered by the user in the sensitivity level input item as the sensitivity level corresponding to the pre-configured rules.

[0084] The definition of sensitive data also supports user-defined configuration. Users can create rules for matching sensitive data in different scenarios and set corresponding sensitivity levels for these rules. By matching these rules with data, sensitive data and its sensitivity level can be identified to meet the different sensitivity levels of the same data in different application scenarios. Users can modify the sensitivity level corresponding to the rule according to the application scenario.

[0085] The disclosed embodiments can support user-defined configuration of classification and grading rules, data application categories, and data sensitivity levels, thereby improving the versatility of the solution and meeting the needs of different application scenarios.

[0086] S102: Perform rule matching on the target data, determine the application category and sensitivity level of the target data according to the rules matching the target data, and obtain the classified and graded target data.

[0087] The target data is matched with the rules bound to the application category and sensitivity level. When a rule matches the target data, the application category bound to the rule is queried and the application category is determined as the application category of the target data. If the rule also sets or binds a sensitivity level, the sensitivity level set by the rule is also used as the sensitivity level of the target data to obtain the classified and graded target data.

[0088] In some embodiments, when rule matching is performed on target data and the application category and sensitivity level of the target data are determined according to the rules that match the target data, it specifically includes: traversing and matching the target data with a first rule, and determining the application category of the target data according to the first rule that matches the target data, wherein the first rule is a rule bound to a pre-configured data application category; traversing and matching the target data with a second rule, and determining the basic sensitivity level of the target data according to the second rule that matches the target data, wherein the second rule is a rule with a corresponding sensitivity level pre-set; and querying the sensitivity level correction parameter corresponding to the application category of the target data, and determining the sensitivity level of the target data according to the sensitivity level correction parameter and the basic sensitivity level of the target data.

[0089] Exemplarily, if the system sets 100 rules for matching, including rules 00 to 99, the target data will be traversed and matched with these 100 rules. If rule 04 matches the target data, application category E bound to rule 04 will be determined as the application category of the target data. If rule 04 also sets the sensitivity level to level 3, the basic sensitivity level of the target data will be determined to be level 3. Then, the sensitivity level correction parameter corresponding to application category E is queried. If the sensitivity level correction parameter is +1, the final sensitivity level of the target data can be determined to be level 4.

[0090] The disclosed embodiment determines the application category and basic sensitivity level of the target data through rule matching, then queries the sensitivity level correction parameters corresponding to the application category of the target data, and determines the final sensitivity level of the target data according to the basic sensitivity level and sensitivity level correction parameters of the target data, so that the data has different sensitivity levels under different application categories, and the classification and grading of the target data is more in line with the application scenario of the data.

[0091] In addition to being achieved through machine automation tasks, "data-rule" matching can also be accomplished by distributing manual matching tasks. The system can also support users to modify task matching results, and supports the synchronization of manual matching and automated task matching results for the same data "data-classification rules". The system provides identification management functions, supports marking / ignoring "data-rule" pairs in the manual / task discovery process, and directly assigns marked / ignored "data-rule" results during the task discovery execution process.

[0092] S103. Desensitize the classified and graded target data selectively according to the sensitivity level to generate circulating data assets.

[0093] Whether desensitization is required can be determined based on the sensitivity level of the target data. For example, the sensitivity level of "amount" data in the employee information application category is 4, while its sensitivity in the resident consumption category is lower, at a sensitivity level of 3. Data with a sensitivity level of 4 needs to be desensitized, but data with a sensitivity level of 3 does not need to be desensitized.

[0094] In some embodiments, the classified and graded target data is selectively desensitized according to the sensitivity level, including: if the sensitivity level is above a preset sensitivity level threshold, searching for a first desensitization rule bound to a matching second rule, and desensitizing the classified and graded target data according to the first desensitization rule; if there is no first desensitization rule bound to a matching second rule, searching for a second desensitization rule bound to an application category of the target data, and desensitizing the classified and graded target data according to the first desensitization rule.

[0095] Desensitization rules refer to the selection of desensitization algorithms for sensitive data to perform desensitization processing in order to hide and protect sensitive information from the source. Users can directly bind the corresponding desensitization rules to the rules used for data matching, and can also bind the corresponding desensitization rules to the application category of the data. For example, under the "ID number" application category label, you can set multiple desensitization rules such as data clipping and fixed value replacement with * to meet the desensitization requirements in different scenarios. When the second rule that matches the target data is bound to the corresponding first desensitization rule, the first desensitization rule can be used to desensitize the target data. When the second rule that matches the target data is not bound to a desensitization rule, the desensitization rule bound to the application category of the target data can be used to desensitize the target data.

[0096] The disclosed embodiment binds the data matching rules with the desensitization rules, and binds the data application categories with the desensitization rules, thereby determining the desensitization rules used to desensitize the data, thereby ensuring the security of data asset processing.

[0097] The embodiment of the present disclosure performs rule matching on the target data after receiving an instruction from a user to select the target data as the original data asset, determines the application category and sensitivity level of the target data according to the rules that match the target data, obtains the classified and graded target data, and then selectively desensitizes the classified and graded target data according to the sensitivity level to generate a circulating data asset. The present disclosure achieves application classification and security processing of data by uniformly classifying and grading original data assets and selectively desensitizing them according to the sensitivity level of the original data assets, so that data can be effectively sorted out and risk prevented before application, and can safely and efficiently convert original data assets into data assets for circulation.

[0098] In some embodiments, the method further includes: upon receiving a request instruction for a circulating data asset, counting the proportion of desensitized data in the circulating data asset; if the proportion is above a preset proportion threshold, encrypting the circulating data asset and generating a corresponding key; transmitting the encrypted circulating data asset to the requester who sent the request instruction, and after the requester passes the key request verification, sending the key to the requester, so that the requester can decrypt the encrypted circulating data asset with the key.

[0099] Encryption algorithm refers to the encryption process of data before transmission. The receiver must hold the correct key to obtain the real data content, thereby ensuring the security of data transmission. The system supports mainstream encryption algorithms, including symmetric encryption (DES, 3DES, etc.) and asymmetric encryption (RSA, DSA, etc.). Under normal circumstances, users will desensitize and encrypt sensitive data at the same time to ensure data security.

[0100] After accessing the data source as the original data asset, the target data source content is quickly scanned through rule matching to complete the identification of sensitive data sources. Then, the proportion of sensitive data in the data source that needs to be desensitized can be preliminarily calculated. When the proportion of sensitive data exceeds the preset proportion threshold, the data source can be marked as a sensitive data source.

[0101] In addition to using desensitizing rules to desensitize sensitive data, encryption algorithms can also be used to securely process sensitive data sources when the requester requests to use circulating data assets, thereby ensuring data security and confidentiality from the source. After the sensitive data source is desensitized and encrypted, it can be used for subsequent data circulation and use, such as data asset processing, API service publishing, etc. After the encrypted circulating data assets are transmitted to the requester, the requester can request the decryption key again. When the requester passes the security verification of the key request, the key will be sent to the requester, so that the requester can use the key to decrypt the encrypted circulating data assets.

[0102] In the disclosed embodiment, when the proportion of sensitive data in the circulating data assets exceeds a preset proportion threshold, the circulating data assets are encrypted and then transmitted to the requester who sends the request instruction. After the requester passes the key request verification, the key is sent to the requester, allowing the requester to use the key to decrypt the encrypted circulating data assets, thereby ensuring the security and confidentiality of the data from the source.

[0103] Figure 3 The data asset processing device provided in the embodiment of the present disclosure is a schematic diagram of the structure of the data asset processing device. The data asset processing device may be a component or assembly in the terminal of the above embodiment. The data asset processing device provided in the embodiment of the present disclosure may execute the processing flow provided in the data asset processing method embodiment, such as Figure 3 As shown, the data asset processing device 300 includes:

[0104] The receiving module 301 is used to receive an instruction from a user to select target data as the original data asset;

[0105] The classification and grading module 302 is used to perform rule matching on the target data, determine the application category and sensitivity level of the target data according to the rules matching the target data, and obtain the classified and graded target data;

[0106] The desensitizing module 303 is used to selectively desensitize the classified and graded target data according to the sensitivity level to generate circulating data assets.

[0107] In some embodiments, when the classification and grading module 302 performs rule matching on the target data and determines the application category and sensitivity level of the target data according to the rules that match the target data, it is specifically used to traverse and match the target data with the first rule, and determine the application category of the target data according to the first rule that matches the target data, where the first rule is a rule bound to a pre-configured data application category; traverse and match the target data with the second rule, and determine the basic sensitivity level of the target data according to the second rule that matches the target data, where the second rule is a rule with a corresponding sensitivity level pre-set; query the sensitivity level correction parameter corresponding to the application category of the target data, and determine the sensitivity level of the target data according to the sensitivity level correction parameter and the basic sensitivity level of the target data.

[0108] In some embodiments, when the desensitizing module 303 selectively desensitizes the classified and graded target data according to the sensitivity level, it is specifically used to search for the first desensitizing rule bound to the matching second rule if the sensitivity level is above the preset sensitivity level threshold, and desensitize the classified and graded target data according to the first desensitizing rule; if there is no first desensitizing rule bound to the matching second rule, search for the second desensitizing rule bound to the application category of the target data, and desensitize the classified and graded target data according to the first desensitizing rule.

[0109] In some embodiments, the data asset processing device also includes a configuration module 304, which is used to display a data classification tree template to the user upon receiving the user's configuration instructions regarding the application category of the data before matching the target data with rules, and the custom data classification tree includes multiple leaf node input items; in response to the user's configuration operation on the data classification tree template, the application category information filled in by the user in each leaf node input item is saved to obtain a custom data classification tree, and each leaf node in the custom data classification tree corresponds to a data application category; in response to the user's configuration operation on the custom data classification tree, the leaf node selected by the user is bound to the rules pre-configured by the user, and the sensitivity level correction parameters set by the user for each leaf node are saved.

[0110] In some embodiments, the configuration module 304 is also used to display a rule information input interface and receive rule information input by the user in response to the user's configuration instructions regarding matching rules; after saving the rule information input by the user, display setting options for the rule matching object to the user, the rule matching object including field name, field annotation and data content; set the rule matching object selected by the user as the matching object of the rule information, and generate rules for matching the target data.

[0111] In some embodiments, the configuration module 304 is also used to display pre-configured rules and sensitivity level input items to the user when receiving the user's configuration instructions on the sensitivity level of data; and use the sensitivity level entered by the user in the sensitivity level input item as the sensitivity level corresponding to the pre-configured rules.

[0112] In some embodiments, the data asset processing device also includes an encryption module 305, which is used to count the proportion of desensitized data in the circulating data assets when receiving a request instruction for the circulating data assets; if the proportion is above a preset proportion threshold, the circulating data assets are encrypted and a corresponding key is generated; the encrypted circulating data assets are transmitted to the requester who sent the request instruction, and after the requester passes the key request verification, the key is sent to the requester, so that the requester can decrypt the encrypted circulating data assets through the key.

[0113] Figure 3 The data asset processing device of the illustrated embodiment can be used to execute the technical solution of the above-mentioned method embodiment. Its implementation principle and technical effects are similar and will not be repeated here.

[0114] Figure 4 Schematic diagram of the structure of an electronic device in the embodiment of the present disclosure. Figure 4 , which shows a structural schematic diagram of an electronic device 400 suitable for implementing the embodiments of the present disclosure. Figure 4The electronic device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0115] like Figure 4 As shown, the electronic device 400 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 401, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 402 or a program loaded from a storage device 408 to a random access memory (RAM) 403 to implement the data asset processing method of the embodiment described in the present disclosure. In the RAM 403, various programs and data required for the operation of the electronic device 400 are also stored. The processing device 401, the ROM 402, and the RAM 403 are connected to each other via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0116] Typically, the following devices may be connected to the I / O interface 405: an input device 406 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, a microphone, an accelerometer, a gyroscope, etc.; an output device 407 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; a storage device 408 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 409. The communication device 409 may allow the electronic device 400 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 4 The electronic device 400 is shown with various devices, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead.

[0117] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart, thereby implementing the data asset processing method as described above. In such an embodiment, the computer program can be downloaded and installed from the network through the communication device 409, or installed from the storage device 408, or installed from the ROM 402. When the computer program is executed by the processing device 401, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0118] It should be noted that the computer-readable medium disclosed above may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in combination with an instruction execution system, device or device. In the present disclosure, a computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, in which a computer-readable program code is carried. This propagated data signal may take a variety of forms, including but not limited to an electromagnetic signal, an optical signal, or any suitable combination of the above. The computer readable signal medium may also be any computer readable medium other than a computer readable storage medium, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0119] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0120] The computer-readable medium may be included in the electronic device, or may exist independently without being incorporated into the electronic device.

[0121] The computer-readable medium carries one or more programs. When the one or more programs are executed by the electronic device, the electronic device:

[0122] Receiving an instruction from a user to select target data as an original data asset;

[0123] Perform rule matching on the target data, determine the application category and sensitivity level of the target data according to the rules that match the target data, and obtain the classified and graded target data;

[0124] Selectively desensitize the classified and graded target data according to the sensitivity level to generate circulating data assets.

[0125] Optionally, when the above one or more programs are executed by the electronic device, the electronic device may also execute other steps described in the above embodiments.

[0126] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including, but not limited to, object-oriented programming languages, such as Java, Smalltalk, C++, and conventional procedural programming languages, such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0127] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0128] The units involved in the embodiments described in the present disclosure may be implemented by software or hardware, wherein the name of a unit does not, in some cases, limit the unit itself.

[0129] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0130] In the context of the present disclosure, a machine-readable medium may be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, device, or equipment. A machine-readable medium may be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0131] The embodiments of the present disclosure also provide a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the method of any of the above embodiments can be implemented. The execution method and beneficial effects are similar and will not be repeated here.

[0132] The embodiments of the present disclosure also provide a computer program product, which is stored in a storage medium. When the program product is run, the method of any of the above embodiments can be implemented. The execution method and beneficial effects are similar and will not be repeated here.

[0133] The above description is only a preferred embodiment of the present disclosure and an explanation of the technical principles used. Those skilled in the art should understand that the scope of disclosure involved in the present disclosure is not limited to the technical solutions formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above disclosed concept. For example, the above features are replaced with the technical features with similar functions disclosed in the present disclosure (but not limited to) by each other to form a technical solution.

[0134] In addition, although each operation is described in a specific order, this should not be understood as requiring these operations to be performed in the specific order shown or in a sequential order. Under certain circumstances, multitasking and parallel processing may be advantageous. Similarly, although some specific implementation details are included in the above discussion, these should not be interpreted as limiting the scope of the present disclosure. Some features described in the context of a separate embodiment can also be implemented in a single embodiment in combination. On the contrary, the various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable sub-combination mode.

[0135] Although the subject matter has been described in language specific to structural features and / or methodological logical actions, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. On the contrary, the specific features and actions described above are merely example forms of implementing the claims.

[0136] It should be noted that, in this article, relational terms such as "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0137] The above description is only a specific embodiment of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A data asset processing method, characterized in that: include: Receiving an instruction from a user to select target data as an original data asset; Performing rule matching on the target data, determining the application category and sensitivity level of the target data according to the rules matching the target data, and obtaining the classified and graded target data; The classified and graded target data is selectively desensitized according to the sensitivity level to generate circulating data assets.

2. The data asset processing method according to claim 1, characterized in that: The performing rule matching on the target data and determining the application category and sensitivity level of the target data according to the rule matching the target data includes: Traversing and matching the target data with a first rule, and determining an application category of the target data according to the first rule matching the target data, wherein the first rule is a rule bound to a pre-configured data application category; Traversing and matching the target data with a second rule, and determining a basic sensitivity level of the target data according to the second rule matching the target data, wherein the second rule is a rule with a corresponding sensitivity level preset; The sensitivity level correction parameter corresponding to the application category of the target data is queried, and the sensitivity level of the target data is determined according to the sensitivity level correction parameter and the basic sensitivity level of the target data.

3. The data asset processing method according to claim 2, characterized in that: The selectively performing desensitization processing on the classified and graded target data according to the sensitivity level includes: If the sensitivity level is above the preset sensitivity level threshold, searching for a first desensitization rule bound to the matching second rule, and performing desensitization processing on the classified and graded target data according to the first desensitization rule; If there is no first desensitization rule bound to the matching second rule, then the second desensitization rule bound to the application category of the target data is searched, and the classified and graded target data is desensitized according to the first desensitization rule.

4. The data asset processing method according to claim 1, characterized in that: Before the target data is matched with rules, the method further includes: Upon receiving a configuration instruction from a user regarding an application category of data, displaying a data classification tree template to the user, wherein the custom data classification tree includes a plurality of leaf node input items; In response to the user's configuration operation on the data classification tree template, the application category information filled in by the user in each leaf node input item is saved to obtain a custom data classification tree, wherein each leaf node in the custom data classification tree corresponds to a data application category; In response to the user's configuration operation on the custom data classification tree, the leaf nodes selected by the user are bound to the rules pre-configured by the user, and the sensitivity level modification parameters set by the user for each leaf node are saved.

5. The data asset processing method according to claim 1, characterized in that: Before the target data is matched with rules, the method further includes: In response to the user's configuration instruction on the matching rule, a rule information input interface is displayed to receive the rule information input by the user; After saving the rule information input by the user, the setting options of the rule matching object are displayed to the user, and the rule matching object includes the field name, field comment and data content; The rule matching object selected by the user is set as the matching object of the rule information, and a rule for matching with the target data is generated.

6. The data asset processing method according to claim 1, characterized in that: Before the target data is matched with rules, the method further includes: Upon receiving a configuration instruction from a user regarding the sensitivity level of data, displaying pre-configured rules and sensitivity level input items to the user; The sensitivity level input by the user in the sensitivity level input item is used as the sensitivity level corresponding to the pre-configured rule.

7. The data asset processing method according to claim 1, characterized in that: The method further comprises: When receiving the request instruction for the circulating data asset, counting the proportion of the desensitized data in the circulating data asset; If the ratio is above a preset ratio threshold, encrypt the circulating data assets and generate a corresponding key; The encrypted circulating data asset is transmitted to the requester who sends the request instruction, and after the requester passes the key request verification, the key is sent to the requester, so that the requester can decrypt the encrypted circulating data asset with the key.

8. A data asset processing device, characterized in that: include: A receiving module, used for receiving an instruction from a user to select target data as the original data asset; A classification and grading module is used to perform rule matching on the target data, determine the application category and sensitivity level of the target data according to the rules matching the target data, and obtain the classified and graded target data; The desensitizing module is used to selectively desensitize the classified and graded target data according to the sensitivity level to generate circulating data assets.

9. An electronic device, characterized in that: The method comprises a memory and a processor, wherein a computer program is stored in the memory, and when the computer program is executed by the processor, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: Program instructions are stored thereon, and when the program instructions are executed, the method according to any one of claims 1 to 7 is implemented.

Images