Dynamic data desensitization method and system

Abstract

The invention provides a dynamic data desensitization method and system. The method comprises the following steps: acquiring a data access request and identity information of a user; according to the data access request and a preset data grading table, the data security level of target data is determined, and the data grading table is updated in real time according to the content and the accessed frequency of each piece of data; confirming the access authority of the user according to the identity information; judging whether a user is allowed to access the target data or not according to the data security level and the access permission; when the user is allowed to access the target data, determining a response mode of the target data according to the data security level, the response mode including a complete encryption response, a data desensitization response or a direct response; and responding to the data access request of the user according to the response mode of the target data, thereby improving the security and privacy of the data in the use process.

Description

Technical Field

[0001] The present application relates to the field of data processing and data security technology, and in particular to a method and system for dynamic data desensitization. Background Art

[0002] As the core platform for enterprise data management and analysis, the data center needs to process and store a large amount of sensitive data. This data may contain personal privacy information, business secrets, etc., so strict security measures are needed to protect it. The existing data desensitization and data management solutions have the following problems:

[0003] 1) Lack of dynamism and real-time performance: Although it has a certain ability to set desensitization rules based on user roles and data classification, the overall process is relatively static. In the case of continuous changes in data in the data center, dynamic adjustments in business scenarios, and continuous evolution of the external environment (such as laws, regulations, industry standards, etc.), it is impossible to perceive these changes in real time and quickly adjust the desensitization strategy. For example, new laws and regulations have increased the protection requirements for certain data, and existing technologies cannot automatically update desensitization rules in a timely manner to meet new requirements, resulting in potential risks to data security. 2) The association between roles and data is not flexible enough: Although the combination of user roles and data classification levels is considered to configure desensitization rules, in actual complex enterprise business, the relationship between roles and data is more complex and diverse. Existing technologies are difficult to quickly adapt to the flexible and changeable mapping relationship between role permissions and data classification under the unique organizational structure and business processes of different enterprises, and cannot accurately meet diverse business needs. For example, when collaborating on cross-departmental projects within an enterprise, members of a temporarily formed project team may need to access specific sensitive data, but existing technologies make it difficult to quickly configure corresponding desensitization rules. 3) The accuracy and adaptability of data classification and grading are limited: Data classification and grading mainly rely on system preset rules and user customization. For some complex data or emerging data types, it may not be possible to accurately judge their sensitivity and importance. For example, for data in new big data application scenarios that integrate multiple data formats and semantics, the classification and grading rules of existing technologies may not be able to effectively identify their potential risks, thereby affecting the pertinence and effectiveness of desensitization strategies. 4) Imperfect log auditing function: Log auditing mainly focuses on recording basic desensitization operation information, and the judgment of abnormal situations is relatively basic. When faced with complex security threats and abnormal behavior patterns, there is a lack of in-depth analysis and correlation detection capabilities. For example, it is impossible to effectively identify attack behaviors that bypass desensitization rules by combining multiple seemingly normal operations, and it is difficult to explore potential security risks from the correlation of multiple log records. Summary of the invention

[0004] In response to the above technical problems, the present application provides a method and system for dynamic data desensitization. By constructing a dynamic data security level system, real-time and accurate identification and desensitization processing of sensitive data in the data center can be achieved, thereby improving the security and privacy of data during use.

[0005] In a first aspect, the present application provides a method for dynamic data desensitization, comprising:

[0006] Obtain the user's data access request and identity information;

[0007] Determine the data security level of the target data according to the data access request and a preset data classification table, wherein the data classification table is updated in real time according to the content and access frequency of each data;

[0008] confirming the user's access rights according to the identity information;

[0009] Determining whether to allow the user to access the target data according to the data security level and the access permission;

[0010] When the user is allowed to access the target data, a response mode for the target data is determined according to the data security level, and the response mode includes a fully encrypted response, a data desensitized response, or a direct response;

[0011] The data access request of the user is responded to according to the response mode of the target data.

[0012] The embodiment of the present application provides a method for dynamic data desensitization. When a user accesses data, through double verification of the user's identity and the target data being accessed, the user's access rights and data security level are determined, and the response mode of the target data is determined, ensuring that the user can only see the desensitized data that meets his authority, and protecting the privacy and security of the data. Considering that in practical applications, the importance and privacy of data are dynamically changing, the embodiment of the present application introduces a data classification table, and updates the data classification table in real time according to the content of each data and the access frequency, improving the security and privacy of the data during use. On the other hand, in the response process of the target data, different response modes are adopted according to the data security level, and encrypted responses or data desensitization responses are used, that is, all data do not need to be encrypted, saving the computing resources of the system, improving the response speed of the data, and ensuring the security of sensitive data while not affecting the normal use of the data.

[0013] In a possible implementation, updating the data classification table in real time according to the content and access frequency of each data includes:

[0014] Scanning the database according to a first preset time interval to obtain scanning results, wherein the scanning results include access frequency of each data, user behavior pattern and data content;

[0015] Analyze the scanning results to determine the data security level of each data;

[0016] The data classification table is dynamically updated according to the data security level of each data.

[0017] Furthermore, analyzing the scan results to determine the data security level of each data includes:

[0018] Inputting the access frequency and user behavior pattern in the scanning result into a preset machine learning model, so that the machine learning model analyzes data characteristics and user behavior characteristics in real time according to the scanning result, and outputs a first security level of each data;

[0019] Inputting the data content in the scanning result into a preset natural language processing model, so that the natural language processing model extracts keywords and phrases of each data, further identifies sensitive information in each data, and outputs the second security level of each data;

[0020] The data security level of each data is determined according to the preset weight, the first security level and the second security level.

[0021] The embodiment of the present application provides a method for updating a data classification table, by scanning the data regularly, determining the data security level of each data according to the scanning results, and then realizing the dynamic update of the data classification table, and improving the flexibility of data management. Furthermore, in the process of determining the data security level of each data, a machine learning algorithm and a natural language processing technology are introduced, and the data characteristics and user behavior characteristics are analyzed by a machine learning algorithm based on the access frequency and user behavior pattern, and the first security level of each data is calculated. At the same time, a natural language processing model is used to analyze the content of each data, identify the sensitive information contained in each data, and then determine the second security level of each data. Finally, the data security level of each data is obtained by combining the first security level and the second security level. The embodiment of the present application realizes the automatic classification of each data by combining machine learning algorithms and natural language processing technology, and ensures the rationality and accuracy of data security level classification.

[0022] Furthermore, the method further comprises:

[0023] Acquire a manual data classification table according to a second preset time interval;

[0024] Performing a hierarchical comparison between the current data grading table and the manual data grading table to determine a number of grading difference data, wherein the grading difference data is data whose data security levels are inconsistent between the current data grading table and the manual data grading table;

[0025] Performing difference evaluation and decision making on each of the classified difference data according to a preset priority rule, and determining a final data security level of each of the classified difference data;

[0026] The current data classification table is dynamically updated according to the final data security level of each of the classification difference data.

[0027] In an embodiment of the present application, a manual data grading table is combined to correct the results of the automated grading to ensure that the classification and grading of the data is always up-to-date and accurate. Among them, by comparing the data grading table with the manual data grading table, a number of grading difference data with differences in grading are determined, and then further difference evaluation and decision-making are performed on each of the grading difference data to determine the final data security level of each of the grading difference data. For example, when the scanning results of the automatic scan show that the sensitivity of a certain data has increased significantly, and the manual data grading table shows that the security level of the data is low, the system may issue an alarm to remind the data administrator to re-evaluate the classification and grading of the data item. By regularly comparing the manual data grading table with the data grading table automatically generated by the system, the data grading results can be further optimized, and a data basis can be provided for the improvement of the rules of automated grading, thereby improving the accuracy of data grading and the security of data use.

[0028] In a possible implementation, when the response mode of the target data is a fully encrypted response, responding to the user's data access request according to the response mode of the target data includes:

[0029] The target data is encrypted using AES symmetric encryption or RSA asymmetric encryption algorithm to generate corresponding encrypted data;

[0030] The encrypted data is used to respond to the user's data access request.

[0031] In an embodiment of the present application, when it is determined that the response mode of the target data is a fully encrypted response, it means that the target data is important confidential data and requires high-intensity encryption processing. Therefore, AES symmetric encryption or RSA asymmetric encryption algorithm is used to fully encrypt the target data. After obtaining the encrypted target data, the user needs to apply for decryption permission separately to decrypt the data, thereby ensuring the security of important data.

[0032] In a possible implementation, when the response mode of the target data is a data desensitization response, responding to the user's data access request according to the response mode of the target data includes:

[0033] determining sensitive information in the target data;

[0034] Processing the sensitive information in the target data by means of data masking or data replacement to generate corresponding desensitized data;

[0035] The desensitized data is used to respond to the user's data access request.

[0036] In an embodiment of the present application, when it is determined that the response method of the target data is a data desensitization response, the target data is masked or replaced. Such a processing method does not affect the normal use of the data, and at the same time can effectively protect the sensitive information in the data, thereby improving the user experience and the security of data use.

[0037] In the second aspect, accordingly, the embodiment of the present application provides a system for dynamic data desensitization, including an acquisition module, a data security level determination module, an access permission confirmation module, a judgment module, a response mode determination module and a data response module;

[0038] Wherein, the acquisition module is used to obtain the user's data access request and identity information;

[0039] The data security level determination module is used to determine the data security level of the target data according to the data access request and a preset data classification table, wherein the data classification table is updated in real time according to the content and access frequency of each data;

[0040] The access permission confirmation module is used to confirm the access permission of the user according to the identity information;

[0041] The judging module is used to judge whether to allow the user to access the target data according to the data security level and the access permission;

[0042] The response mode determination module is used to determine the response mode of the target data according to the data security level when allowing the user to access the target data, and the response mode includes a fully encrypted response, a data desensitized response or a direct response;

[0043] The data response module is used to respond to the user's data access request according to the response mode of the target data.

[0044] In a possible implementation, updating the data classification table in real time according to the content and access frequency of each data includes:

[0045] Scanning the database according to a first preset time interval to obtain scanning results, wherein the scanning results include access frequency of each data, user behavior pattern and data content;

[0046] Analyze the scanning results to determine the data security level of each data;

[0047] The data classification table is dynamically updated according to the data security level of each data.

[0048] In a possible implementation, when the response mode of the target data is a fully encrypted response, the data response module responds to the user's data access request according to the response mode of the target data, including:

[0049] The target data is encrypted using an AES symmetric encryption algorithm or an RSA asymmetric encryption algorithm to generate corresponding encrypted data;

[0050] The encrypted data is used to respond to the user's data access request.

[0051] In a possible implementation, when the response mode of the target data is a data desensitization response, the data response module responds to the user's data access request according to the response mode of the target data, including:

[0052] determining sensitive information in the target data;

[0053] Processing the sensitive information in the target data by means of data masking or data replacement to generate corresponding desensitized data;

[0054] The desensitized data is used to respond to the user's data access request. BRIEF DESCRIPTION OF THE DRAWINGS

[0055] Figure 1 A flowchart of a method for dynamic data desensitization provided in an embodiment of the present application.

[0056] Figure 2 A schematic diagram of the structure of a system for dynamic data desensitization provided in an embodiment of the present application. DETAILED DESCRIPTION

[0057] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0058] It should be noted that the step numbers in the text are only for the convenience of explanation of the specific embodiments and do not serve to limit the order in which the steps are executed. In the description of this application, the terms "first" and "second" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features.

[0059] Embodiment 1:

[0060] like Figure 1 As shown, embodiment 1 provides a method for dynamic data desensitization, including steps S1-S6:

[0061] Step S1, obtaining the user's data access request and identity information;

[0062] Step S2: determining the data security level of the target data according to the data access request and a preset data classification table, wherein the data classification table is updated in real time according to the content and access frequency of each data;

[0063] Step S3, confirming the access rights of the user according to the identity information;

[0064] Step S4: judging whether to allow the user to access the target data according to the data security level and the access permission;

[0065] Step S5: When the user is allowed to access the target data, a response mode of the target data is determined according to the data security level, and the response mode includes a fully encrypted response, a data desensitized response or a direct response;

[0066] Step S6: respond to the user's data access request according to the response mode of the target data.

[0067] The embodiment of the present application provides a method for dynamic data desensitization. When a user accesses data, through double verification of the user's identity and the target data being accessed, the user's access rights and data security level are determined, and the response mode of the target data is determined, ensuring that the user can only see the desensitized data that meets his authority, and protecting the privacy and security of the data. Considering that in practical applications, the importance and privacy of data are dynamically changing, the embodiment of the present application introduces a data classification table, and updates the data classification table in real time according to the content of each data and the access frequency, improving the security and privacy of the data during use. On the other hand, in the response process of the target data, different response modes are adopted according to the data security level, and encrypted responses or data desensitization responses are used, that is, all data do not need to be encrypted, saving the computing resources of the system, improving the response speed of the data, and ensuring the security of sensitive data while not affecting the normal use of the data.

[0068] In a preferred embodiment, the data management system presets four identities, including:

[0069] (1) Super administrators have the highest authority and can manage and configure the entire data desensitization system, including adding new users, defining user roles, setting data classification standards, configuring dynamic desensitization rules, and viewing log audits.

[0070] (2) Data administrators are responsible for the specific operations of classifying and grading data, as well as maintaining and updating data. Data can be divided into different data security levels, such as public, internal, confidential, etc., based on the sensitivity of the data and business needs.

[0071] (3) Security administrators focus on the formulation and implementation of system security policies to ensure data security and compliance. They are responsible for supervising the implementation of dynamic desensitization rules, handling security incidents, and reviewing log audits.

[0072] (4) Ordinary users can only access data that meets their permissions according to the dynamic desensitization rules. Different data access permissions are granted according to their business needs.

[0073] Therefore, in step S1 and step S3, the user's access rights are confirmed by obtaining the user's identity information. Further, when the user's access rights are not sufficient to access the target data, the user's access request is directly rejected.

[0074] In a possible implementation, in step S2, updating the data classification table in real time according to the content and access frequency of each data includes:

[0075] Scanning the database according to a first preset time interval to obtain scanning results, wherein the scanning results include access frequency of each data, user behavior pattern and data content;

[0076] Analyze the scanning results to determine the data security level of each data;

[0077] The data classification table is dynamically updated according to the data security level of each data.

[0078] The database may be a MySQL database, a Doris database, or other commonly used databases.

[0079] In a preferred embodiment, the specific process of real-time updating of the data classification table is as follows:

[0080] a. Real-time data scanning: The system performs a comprehensive scan of the data in the data center at a preset time interval (such as every hour or every day), traversing all data tables and fields in the data center. During the scanning process, the system collects data access frequency, user behavior patterns, and changes in data content.

[0081] b. Data feature extraction: Use data feature extraction technology to analyze the scan results. The system will extract data format, keywords, data patterns and other features to determine the type and potential sensitivity of the data. Specifically, perform format and content analysis on each data item to extract keywords, data patterns and other features. Count the access frequency and access time distribution of each data item, and then use statistical methods to identify data items with abnormal access frequencies.

[0082] c. Dynamic adjustment: Based on the extracted data features and real-time access frequency, the system will dynamically adjust the data security level of the data. For example, if the access frequency of a data item suddenly increases, the system will automatically classify it as data of a higher sensitivity level.

[0083] Furthermore, analyzing the scan results to determine the data security level of each data includes:

[0084] Inputting the access frequency and user behavior pattern in the scanning result into a preset machine learning model, so that the machine learning model analyzes data characteristics and user behavior characteristics in real time according to the scanning result, and outputs a first security level of each data;

[0085] Inputting the data content in the scanning result into a preset natural language processing model, so that the natural language processing model extracts keywords and phrases of each data, further identifies sensitive information in each data, and outputs the second security level of each data;

[0086] The data security level of each data is determined according to the preset weight, the first security level and the second security level.

[0087] In a preferred embodiment, the training and deployment process of the machine learning model and the natural language processing model is as follows:

[0088] (1) Machine learning model: Collect historical data and user feedback, annotate the data, and mark the sensitivity and classification level of the data. Use the annotated data to train the machine learning model to automatically identify new features and potential sensitivity of the data. The model can be trained based on historical data and user feedback to continuously optimize the accuracy of classification and grading.

[0089] (2) Natural language processing model: Natural language processing technology is used to automatically identify sensitive information in text data. The system can analyze the text content, extract keywords and phrases, and determine the sensitivity of the data.

[0090] (3) Continuous optimization: Regularly collect new data and user feedback, update the training data set, retrain the model, and optimize the accuracy of data security level classification.

[0091] Furthermore, this embodiment also provides a user feedback mechanism, allowing users to provide feedback on the data security level classification results. Users can submit feedback through the management interface and point out the unreasonableness of the data security level classification. The system automatically collects user feedback, analyzes and processes it. According to the feedback results, the data security level of the data is adjusted to improve the accuracy of the data security level classification and user satisfaction. Specifically:

[0092] In the management interface, a user feedback portal is provided, where users can submit their opinions and suggestions on the classification of data security levels. Users can choose specific feedback types, such as inaccurate classification, too high or too low classification, etc. The system automatically collects feedback submitted by users and stores it in the feedback database. The feedback is classified and summarized to generate a feedback report. Natural language processing technology is used to analyze the feedback content and extract key information. Based on the feedback, the rationality of the data security level classification is evaluated. Based on the feedback results, the data security level of the data is adjusted. The classification and grading information in the metadata management system is updated to ensure the accuracy and timeliness of data classification. Notifications of feedback processing results are provided to users to inform them of adjustments to classification and grading. Detailed records of feedback processing are provided for users to review and track.

[0093] The embodiment of the present application provides a method for updating a data classification table, by scanning the data regularly, determining the data security level of each data according to the scanning results, and then realizing the dynamic update of the data classification table, and improving the flexibility of data management. Furthermore, in the process of determining the data security level of each data, a machine learning algorithm and a natural language processing technology are introduced, and the data characteristics and user behavior characteristics are analyzed by a machine learning algorithm based on the access frequency and user behavior pattern, and the first security level of each data is calculated. At the same time, a natural language processing model is used to analyze the content of each data, identify the sensitive information contained in each data, and then determine the second security level of each data. Finally, the data security level of each data is obtained by combining the first security level and the second security level. The embodiment of the present application realizes the automatic classification of each data by combining machine learning algorithms and natural language processing technology, and ensures the rationality and accuracy of data security level classification.

[0094] Furthermore, the method further comprises:

[0095] Acquire a manual data classification table according to a second preset time interval;

[0096] Performing a hierarchical comparison between the current data grading table and the manual data grading table to determine a number of grading difference data, wherein the grading difference data is data whose data security levels are inconsistent between the current data grading table and the manual data grading table;

[0097] Performing difference evaluation and decision making on each of the classified difference data according to a preset priority rule, and determining a final data security level of each of the classified difference data;

[0098] The current data classification table is dynamically updated according to the final data security level of each of the classification difference data.

[0099] In an embodiment of the present application, a manual data grading table is combined to correct the results of the automated grading to ensure that the classification and grading of the data is always up-to-date and accurate. Among them, by comparing the data grading table with the manual data grading table, a number of grading difference data with differences in grading are determined, and then further difference evaluation and decision-making are performed on each of the grading difference data to determine the final data security level of each of the grading difference data. For example, when the scanning results of the automatic scan show that the sensitivity of a certain data has increased significantly, and the manual data grading table shows that the security level of the data is low, the system may issue an alarm to remind the data administrator to re-evaluate the classification and grading of the data item. By regularly comparing the manual data grading table with the data grading table automatically generated by the system, the data grading results can be further optimized, and a data basis can be provided for the improvement of the rules of automated grading, thereby improving the accuracy of data grading and the security of data use.

[0100] In a preferred embodiment, the manual data classification table is constructed based on the manual configuration of the data administrator. The data administrator manually classifies the data into data security levels according to the sensitivity, importance and business needs of the data. For example, data involving customer privacy is classified as confidential, and public statistical data is classified as public. During the manual configuration process, the data administrator can specify detailed description information for each data item to better understand the nature and purpose of the data. The manually configured data security level classification results will be stored in the metadata management system of the data center for subsequent dynamic desensitization rule configuration and data access control. The data classification table is updated in real time by an automatic scanning engine. The system scans the data regularly and adjusts the data classification according to the preset data security level classification rules. For example, if a new data item is found to have a higher sensitivity, the system will automatically classify it as a corresponding high level. The results of the scheduled scan will be combined with the results of the manual configuration to ensure that the classification and grading of the data are always kept up to date and accurate. Specifically:

[0101] The automatic scanning engine will perform a comprehensive scan of the data in the data center at preset time intervals. During the scanning process, it will evaluate the sensitivity and importance of each data item based on a series of preset data security level classification rules. These rules may include but are not limited to the following aspects:

[0102] 1) Data content feature analysis: Determine the type and potential sensitivity of the data by analyzing the data format, keywords, data patterns, etc. For example, data in specific formats such as ID card numbers and bank card numbers may be identified as highly sensitive data. 2) Data source analysis: Determine the importance and sensitivity level of the data based on its source channel. For example, data from core business systems may be assigned a higher level. 3) Data usage frequency analysis: If certain data is frequently accessed and used, it may be necessary to re-evaluate its data security level to ensure that its security matches the actual usage needs.

[0103] When the automatic scanning engine completes a scan, the system will compare each data item in the scan result with the manually configured data security level classification result. Matching is performed through the unique identifier of the data (such as data ID, data name, etc.) to ensure that the corresponding data item can be accurately found. For data items that have a clear data security level in the manual configuration, the system will check whether the automatic scanning result is consistent with the manual configuration. If consistent, the classification and grading of the data item will continue to remain unchanged; if inconsistent, the system will start the difference assessment mechanism. First, analyze the cause of the difference. The difference may be caused by changes in data content, adjustments in business needs, or errors in manual configuration. For differences, the system will decide which classification result to use based on the preset priority rules. Generally speaking, if the manual configuration is carefully evaluated and confirmed by the data administrator, the manual configuration result may have a higher priority. However, if the automatic scanning result shows that the sensitivity of the data has increased significantly, the system may issue an alarm to remind the data administrator to re-evaluate the classification of the data item. During the evaluation process, the system will also consider other factors, such as the use scenario of the data, the requirements of relevant laws and regulations, etc. For example, if a data item involves personal privacy information and recent laws and regulations have increased the protection requirements for such data, then even if the manual configuration result is a lower level, the system may adjust it to a higher level of data security based on the automatic scanning results.

[0104] After differential evaluation and decision-making, the system will update the data classification based on the final results. If the automatic scanning results are used, the system will adjust the classification of the corresponding data items in the manual configuration and record the reasons and time of the adjustment. At the same time, the system will synchronize the updated classification results to the metadata management system of the data center to ensure that all related systems and applications can obtain the latest classification information in a timely manner. In this way, in the subsequent dynamic desensitization rule configuration and data access control, processing can be based on the latest classification results.

[0105] In addition, the system will continuously monitor the data to ensure that the data security level is always up to date and accurate. The automatic scanning engine will continue to scan at preset time intervals, and the manual configuration can be adjusted at any time according to business needs and data changes. The system will also establish a feedback mechanism to allow data administrators and other relevant personnel to make comments and suggestions on the combination of automatic scanning results and manual configuration. If a problem is found in the classification of a data item in actual application, or the automatic scanning rules and manual configuration rules need to be further optimized, the relevant personnel can raise it to the system administrator through the feedback channel so that timely adjustments and improvements can be made.

[0106] In a preferred embodiment, in steps S4-S5, according to the user role and the data classification and grading results, corresponding dynamic desensitization rules are configured to determine whether the user is allowed to access the target data and the response mode of the target data, specifically:

[0107] Rule 1: For confidential data, only administrators and specific authorized users can access it, and the target data needs to be highly encrypted;

[0108] Rule 2: For internal-level data, some authorized users can access it, and the target data can be desensitized by data masking or data replacement;

[0109] Rule 3: Public-level data can be directly displayed to ordinary users without the need for desensitization.

[0110] Dynamic desensitization rules can be configured through the management interface, and super administrators and data administrators can make flexible adjustments based on actual needs.

[0111] In a possible implementation, in step S6, when the response mode of the target data is a fully encrypted response, responding to the user's data access request according to the response mode of the target data includes:

[0112] The target data is encrypted using an AES symmetric encryption algorithm or an RSA asymmetric encryption algorithm to generate corresponding encrypted data;

[0113] The encrypted data is used to respond to the user's data access request.

[0114] In an embodiment of the present application, when it is determined that the response mode of the target data is a fully encrypted response, it means that the target data is important confidential data and requires high-intensity encryption processing. Therefore, AES symmetric encryption or RSA asymmetric encryption algorithm is used to fully encrypt the target data. After obtaining the encrypted target data, the user needs to apply for decryption permission separately to decrypt the data, thereby ensuring the security of important data.

[0115] In a possible implementation, in step S6, when the response mode of the target data is a data desensitization response, responding to the user's data access request according to the response mode of the target data includes:

[0116] determining sensitive information in the target data;

[0117] Processing the sensitive information in the target data by means of data masking or data replacement to generate corresponding desensitized data;

[0118] The desensitized data is used to respond to the user's data access request.

[0119] The data masking process is to replace some sensitive data with specific symbols or characters, and only display some key information to protect the privacy of the data. For example, the middle four digits of a mobile phone number are replaced with "****". The data replacement process is to replace sensitive data with other insensitive data to achieve the purpose of desensitization. For example, replace the customer name with the number.

[0120] In an embodiment of the present application, when it is determined that the response method of the target data is a data desensitization response, the target data is masked or replaced. Such a processing method does not affect the normal use of the data, and at the same time can effectively protect the sensitive information in the data, thereby improving the user experience and the security of data use.

[0121] In general, the real-time dynamic desensitization processing process of the embodiment of the present application is as follows: when the user accesses the data, the system performs real-time desensitization processing on the data according to the preset dynamic desensitization rules. Ensure that users can only access desensitized data that meets their roles and data security levels. When a user initiates a data access request, the system first verifies the user's identity and authority. According to the user's role and authorization status, determine the scope and level of data that the user can access. At the same time, confirm the data security level of the target data, and for the data requested by the user, the system performs real-time desensitization processing according to the dynamic desensitization rules. If the data needs to be masked or replaced, the system will perform corresponding processing before returning the data to the user; if the data needs to be encrypted, the system will determine whether to decrypt it based on the user's authority. Real-time dynamic desensitization processing can ensure that users can only see desensitized data that meets their authority, protecting the privacy and security of the data.

[0122] In a preferred embodiment, the method also includes logging all data access and data response operations, and monitoring whether there are any abnormal situations through log auditing. The system logs all data access and desensitization processing operations, including user identity, access time, accessed data content, desensitization rules and other information. This log information can be used for security auditing and troubleshooting to ensure the security and compliance of the system. Super administrators and security administrators can audit logs regularly to check the security status of the system and the implementation of desensitization rules. If abnormal situations are found, such as unauthorized access, desensitization rules being bypassed, etc. The security administrator can take timely measures to deal with it and prevent the occurrence of security incidents. The specific process is as follows:

[0123] (1) Log information collection and storage

[0124] The system uses the log management system of the data center to comprehensively log all data access and desensitization operations. These log information includes user identity, access time, accessed data content, applied desensitization rules and other details, and stores them in a secure and reliable storage medium for subsequent analysis and query.

[0125] (2) Regular audit process

[0126] The super administrator and security administrator will audit the logs regularly. The audit frequency can be set according to the enterprise's data security needs and system usage, such as once a week or once a month. During the audit process, the integrity of the logs will be checked first to ensure that no logs are lost or damaged. Then, the administrator will analyze the log records one by one in chronological order.

[0127] (3) Determination of abnormal situations

[0128] Unauthorized access judgment: Compare user identity information with the authorized user list. If the user identity that appears in the log is not within the authorized user range, it can be determined as unauthorized access. Check whether the access time is within the normal working hours. If there are a large number of access records during non-normal working hours, there may be an abnormality. For example, the company's prescribed working hours are 9:00-18:00 Monday to Friday, and there is an access record at 3 am in the log, and the user is not on duty, it may be an unauthorized access. Analyze the content of the accessed data. If an ordinary user accesses confidential data, and according to the dynamic desensitization rules, the user should not have the authority to access such data, then this is also an unauthorized access.

[0129] Determine whether the desensitization rules are bypassed: Check whether the desensitization rules recorded in the log are consistent with the data content actually returned to the user. If it is found that the data content is not processed according to the preset desensitization rules, for example, confidential data that should be encrypted appears in the log record in plain text, then it is very likely that the desensitization rules are bypassed. Compare the access records of different users to the same data. If users of different roles access the same data and encounter desensitization rules that do not comply with their roles, it may also mean that the desensitization rules are bypassed. For example, when an internal user and a confidential user access the same internal data, the data seen by the internal user is masked, while the data seen by the confidential user is plain text. This may be a problem of abnormal modification or bypass of the desensitization rules.

[0130] (4) Handling abnormal situations

[0131] Once an abnormal situation is discovered, the security administrator will immediately take measures to deal with it. This may include the following aspects:

[0132] Suspend the relevant user's access rights to prevent further illegal access or data leakage.

[0133] Perform a comprehensive security check on the system to look for possible security vulnerabilities or signs of attacks.

[0134] Notify relevant departments and personnel, such as the technical team, to carry out emergency repairs, and report the situation to superiors so that further decisions and measures can be taken.

[0135] Track and analyze abnormally accessed data to determine whether the data has been stolen or tampered with, and take appropriate remedial measures, such as restoring data backups.

[0136] Log auditing can be achieved through the log management system of the data center, which can collect, store, analyze and report logs, providing strong support for security management.

[0137] In summary, the embodiment of the present application provides a method for dynamic data desensitization, supports common MySQL and Doris databases, and realizes real-time and accurate identification and desensitization of sensitive data in the data center by building a more dynamic, flexible and intelligent role authentication and data classification and grading system, ensuring the security and privacy of data under different user role access and various complex business scenarios. At the same time, the log audit function is optimized, the detection and analysis capabilities of abnormal situations are enhanced, and potential security threats are discovered and handled in a timely manner, providing strong support for the stable operation of the data center and the security of data assets, meeting the growing data security needs of enterprises in the digital age.

[0138] Embodiment 2:

[0139] like Figure 2 As shown, embodiment 2 provides a system for dynamic data desensitization, including an acquisition module 10, a data security level determination module 20, an access permission confirmation module 30, a judgment module 40, a response mode determination module 50 and a data response module 60;

[0140] Wherein, the acquisition module 10 is used to obtain the user's data access request and identity information;

[0141] The data security level determination module 20 is used to determine the data security level of the target data according to the data access request and a preset data classification table, wherein the data classification table is updated in real time according to the content and access frequency of each data;

[0142] The access permission confirmation module 30 is used to confirm the user's access permission according to the identity information;

[0143] The judging module 40 is used to judge whether to allow the user to access the target data according to the data security level and the access permission;

[0144] The response mode determination module 50 is used to determine the response mode of the target data according to the data security level when allowing the user to access the target data, and the response mode includes a fully encrypted response, a data desensitized response or a direct response;

[0145] The data response module 60 is used to respond to the user's data access request according to the response mode of the target data.

[0146] In a possible implementation, updating the data classification table in real time according to the content and access frequency of each data includes:

[0147] Scanning the database according to a first preset time interval to obtain scanning results, wherein the scanning results include access frequency of each data, user behavior pattern and data content;

[0148] Analyze the scanning results to determine the data security level of each data;

[0149] The data classification table is dynamically updated according to the data security level of each data.

[0150] Furthermore, analyzing the scan results to determine the data security level of each data includes:

[0151] Inputting the access frequency and user behavior pattern in the scanning result into a preset machine learning model, so that the machine learning model analyzes data characteristics and user behavior characteristics in real time according to the scanning result, and outputs a first security level of each data;

[0152] Inputting the data content in the scanning result into a preset natural language processing model, so that the natural language processing model extracts keywords and phrases of each data, further identifies sensitive information in each data, and outputs the second security level of each data;

[0153] The data security level of each data is determined according to the preset weight, the first security level and the second security level.

[0154] Furthermore, the system further comprises a difference data analysis module, which comprises an acquisition unit, a comparison unit, an evaluation and decision unit, and a dynamic update unit;

[0155] Wherein, the acquisition unit is used to acquire the artificial data classification table according to the second preset time interval;

[0156] The comparison unit is used to compare the current data classification table with the manual data classification table to determine a number of classification difference data, wherein the classification difference data is data whose data security levels in the current data classification table and the manual data classification table are inconsistent;

[0157] The evaluation and decision unit is used to perform difference evaluation and decision on each of the hierarchical difference data according to a preset priority rule, and determine the final data security level of each of the hierarchical difference data;

[0158] The dynamic updating unit is used to dynamically update the current data classification table according to the final data security level of each of the classification difference data.

[0159] In a possible implementation, when the response mode of the target data is a fully encrypted response, the data response module 60 responds to the user's data access request according to the response mode of the target data, including:

[0160] The target data is encrypted using AES symmetric encryption or RSA asymmetric encryption algorithm to generate corresponding encrypted data;

[0161] The encrypted data is used to respond to the user's data access request.

[0162] In a possible implementation, when the response mode of the target data is a data desensitization response, the data response module 60 responds to the user's data access request according to the response mode of the target data, including:

[0163] determining sensitive information in the target data;

[0164] Processing the sensitive information in the target data by means of data masking or data replacement to generate corresponding desensitized data;

[0165] The desensitized data is used to respond to the user's data access request.

[0166] The embodiment of the present application provides a system for dynamic data desensitization. When a user accesses data, through double verification of the user's identity and the target data being accessed, the user's access rights and data security level are determined, and the response mode of the target data is determined, ensuring that the user can only see the desensitized data that meets his authority, and protecting the privacy and security of the data. Considering that in practical applications, the importance and privacy of data are dynamically changing, the embodiment of the present application introduces a data classification table, and updates the data classification table in real time according to the content of each data and the access frequency, so as to improve the security and privacy of the data during use. On the other hand, in the response process of the target data, different response modes are adopted according to the data security level, and encrypted response or data desensitization response is used, that is, all data does not need to be encrypted, saving the computing resources of the system, improving the response speed of the data, and ensuring the security of sensitive data while not affecting the normal use of the data.

[0167] The more detailed working principle and step flow of this embodiment can refer to, but are not limited to, the relevant records of Embodiment 1.

[0168] The specific embodiments described above further describe the purpose, technical solutions and beneficial effects of the present application in detail. It should be understood that the above description is only a specific embodiment of the present application and is not intended to limit the scope of protection of the present application. It is particularly pointed out that for those skilled in the art, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of protection of the present application.

Claims

1. A method for dynamic data desensitization, characterized in that: include: Obtain the user's data access request and identity information; Determine the data security level of the target data according to the data access request and a preset data classification table, wherein the data classification table is updated in real time according to the content and access frequency of each data; confirming the user's access rights according to the identity information; Determining whether to allow the user to access the target data according to the data security level and the access permission; When the user is allowed to access the target data, a response mode for the target data is determined according to the data security level, and the response mode includes a fully encrypted response, a data desensitized response, or a direct response; The data access request of the user is responded to according to the response mode of the target data.

2. A method for dynamic data desensitization as claimed in claim 1, characterized in that: The real-time updating of the data classification table according to the content and access frequency of each data includes: Scanning the database according to a first preset time interval to obtain scanning results, wherein the scanning results include access frequency of each data, user behavior pattern and data content; Analyze the scanning results to determine the data security level of each data; The data classification table is dynamically updated according to the data security level of each data.

3. A method for dynamic data desensitization as claimed in claim 2, characterized in that: The analyzing the scanning results to determine the data security level of each data includes: Inputting the access frequency and user behavior pattern in the scanning result into a preset machine learning model, so that the machine learning model analyzes data characteristics and user behavior characteristics in real time according to the scanning result, and outputs a first security level of each data; Inputting the data content in the scanning result into a preset natural language processing model, so that the natural language processing model extracts keywords and phrases of each data, further identifies sensitive information in each data, and outputs the second security level of each data; The data security level of each data is determined according to the preset weight, the first security level and the second security level.

4. A method for dynamic data desensitization as claimed in claim 2, characterized in that: The method further comprises: Acquire a manual data classification table according to a second preset time interval; Performing a hierarchical comparison between the current data grading table and the manual data grading table to determine a number of grading difference data, wherein the grading difference data is data whose data security levels are inconsistent between the current data grading table and the manual data grading table; Performing difference evaluation and decision making on each of the classified difference data according to a preset priority rule, and determining a final data security level of each of the classified difference data; The current data classification table is dynamically updated according to the final data security level of each of the classification difference data.

5. A method for dynamic data desensitization as claimed in claim 1, characterized in that: When the response mode of the target data is a fully encrypted response, responding to the user's data access request according to the response mode of the target data includes: The target data is encrypted using AES symmetric encryption or RSA asymmetric encryption algorithm to generate corresponding encrypted data; The encrypted data is used to respond to the user's data access request.

6. A method for dynamic data desensitization as claimed in claim 1, characterized in that: When the response mode of the target data is a data desensitization response, responding to the user's data access request according to the response mode of the target data includes: determining sensitive information in the target data; Processing the sensitive information in the target data by means of data masking or data replacement to generate corresponding desensitized data; The desensitized data is used to respond to the user's data access request.

7. A system for dynamic data desensitization, characterized in that: It includes an acquisition module, a data security level determination module, an access permission confirmation module, a judgment module, a response method determination module and a data response module; Wherein, the acquisition module is used to obtain the user's data access request and identity information; The data security level determination module is used to determine the data security level of the target data according to the data access request and a preset data classification table, wherein the data classification table is updated in real time according to the content and access frequency of each data; The access permission confirmation module is used to confirm the access permission of the user according to the identity information; The judging module is used to judge whether to allow the user to access the target data according to the data security level and the access permission; The response mode determination module is used to determine the response mode of the target data according to the data security level when allowing the user to access the target data, and the response mode includes a fully encrypted response, a data desensitized response or a direct response; The data response module is used to respond to the user's data access request according to the response mode of the target data.

8. A system for dynamic data desensitization as claimed in claim 7, characterized in that: The real-time updating of the data classification table according to the content and access frequency of each data includes: Scanning the database according to a first preset time interval to obtain scanning results, wherein the scanning results include access frequency of each data, user behavior pattern and data content; Analyze the scanning results to determine the data security level of each data; The data classification table is dynamically updated according to the data security level of each data.

9. A system for dynamic data desensitization as claimed in claim 7, characterized in that: When the response mode of the target data is a fully encrypted response, the data response module responds to the user's data access request according to the response mode of the target data, including: The target data is encrypted using AES symmetric encryption or RSA asymmetric encryption algorithm to generate corresponding encrypted data; The encrypted data is used to respond to the user's data access request.

10. A system for dynamic data desensitization as claimed in claim 7, characterized in that: When the response mode of the target data is a data desensitization response, the data response module responds to the user's data access request according to the response mode of the target data, including: determining sensitive information in the target data; Processing the sensitive information in the target data by means of data masking or data replacement to generate corresponding desensitized data; The desensitized data is used to respond to the user's data access request.

Images