Data processing method and device, electronic equipment and related equipment

Abstract

The invention provides a data processing method and device, electronic equipment and related equipment, and relates to the technical field of data security. The method comprises the steps of obtaining to-be-processed target data; the to-be-processed target data is matched with a pre-established sensitive data label library, sensitive data in the target data is determined, and the sensitive data label library comprises sensitive labels, sensitive levels and desensitization rules defined according to the sensitive levels; and performing desensitization processing on the sensitive data based on a desensitization rule defined by the sensitivity level corresponding to the sensitive data. According to the method and the device, the security risk caused by sensitive information plaintext transmission can be effectively avoided, and the security of client sensitive information is ensured while service data transmission is not influenced.

Description

Background Art

[0002] With the development of Internet technology, more and more data are processed through Internet technology. In the process of data interaction or storage, some sensitive information will inevitably be involved, that is, some important information that is not convenient for public disclosure, such as personal ID number, bank account, etc.; Therefore, how to accurately locate the sensitive information in the data, mark the sensitive information that needs to be protected, and protect the sensitive information is a problem that needs to be solved in the data processing link.

[0003] However, general sensitive data scanning solutions have the following problems:

[0004] 1) Lack of corresponding desensitization processing function; 2) Supporting only a single type of data; 3) Few sensitive data identification rules and insufficient flexibility, etc. Therefore, when sending data in a local customer network to a third-party device, it is necessary to avoid leakage of sensitive data. Summary of the invention

[0005] The present disclosure provides a data processing method, device, electronic device and related equipment, which at least to some extent overcome the problem of low security when transmitting sensitive data due to related technologies.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to one aspect of the present disclosure, a data processing method is provided, including: acquiring target data to be processed; matching the target data to be processed with a pre-established sensitive data label library to determine sensitive data in the target data, wherein the sensitive data label library includes: sensitive labels, sensitivity levels, and desensitization rules defined according to the sensitivity levels; and desensitizing the sensitive data based on the desensitization rules defined according to the sensitivity levels corresponding to the sensitive data.

[0008] In some exemplary embodiments of the present disclosure, based on the aforementioned scheme, before matching the target data to be processed with a pre-established sensitive data label library to determine the sensitive data in the target data, the method also includes: obtaining a pre-constructed sensitive data set; inputting the sensitive data set into a pre-trained sensitive data label model, and outputting sensitive labels and sensitivity levels corresponding to the sensitive data in the sensitive data set; setting desensitization rules corresponding to the sensitive data in the sensitive data set according to the sensitive labels and sensitivity levels corresponding to the sensitive data in the sensitive data set; and constructing a sensitive data label library according to the sensitive labels, sensitivity levels and desensitization rules corresponding to the sensitive data in the sensitive data set.

[0009] In some exemplary embodiments of the present disclosure, based on the aforementioned scheme, the target data to be processed is matched with a pre-established sensitive data label library to determine the sensitive data in the target data, including: matching the target data to be processed with a pre-established sensitive data label library to determine whether the target data to be processed includes sensitive labels in the sensitive data label library; if the target data to be processed includes sensitive labels in the sensitive data label library, determining the sensitive data in the target data to be processed and the sensitivity level corresponding to the sensitive data and the desensitization rules.

[0010] In some exemplary embodiments of the present disclosure, based on the aforementioned scheme, the sensitive data is desensitized based on the desensitization rules defined based on the sensitivity level corresponding to the sensitive data, including: according to the sensitive data in the target data to be processed and the sensitivity level corresponding to the sensitive data and the desensitization rules, the sensitive data in the target data to be processed is desensitized using the corresponding desensitization rules.

[0011] In some exemplary embodiments of the present disclosure, based on the aforementioned scheme, before obtaining the target data to be processed, the method also includes: obtaining the target text to be desensitized; performing word segmentation processing on the target text to determine multiple words in the target text and the part of speech corresponding to each word; performing character processing on the multiple words in the target text and the part of speech corresponding to each word to obtain the target data to be processed.

[0012] In some exemplary embodiments of the present disclosure, based on the aforementioned scheme, after determining the sensitive data in the target data to be processed and the sensitivity levels and desensitization rules corresponding to the sensitive data, the method further includes: updating the sensitive data label library based on the sensitivity levels and desensitization rules corresponding to the sensitive data in the target data to be processed.

[0013] According to another aspect of the present disclosure, a data processing device is also provided, including: a target data acquisition module, used to acquire target data to be processed; a sensitive data determination module, used to match the target data to be processed with a pre-established sensitive data label library, and determine the sensitive data in the target data, wherein the sensitive data label library includes: sensitive labels, sensitivity levels, and desensitization rules defined according to the sensitivity levels; a desensitization processing module, used to perform desensitization processing on the sensitive data based on the desensitization rules defined according to the sensitivity levels corresponding to the sensitive data.

[0014] According to another aspect of the present disclosure, an electronic device is also provided, which includes: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above-mentioned data processing methods by executing the executable instructions.

[0015] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the data processing method described in any one of the above is implemented.

[0016] According to another aspect of the present disclosure, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, any one of the above-mentioned data processing methods is implemented.

[0017] The data processing method, apparatus, electronic device and related equipment provided in the embodiments of the present disclosure determine the sensitive data in the target data by matching the target data to be processed with a pre-established sensitive data label library, and desensitize the sensitive data in the target data according to the desensitization rules defined by the sensitivity level corresponding to the sensitive data in the target data. Compared with the problem that the sensitive data scanning scheme in the related art lacks the corresponding desensitization processing function and has low security when transmitting sensitive data, the embodiments of the present disclosure can accurately locate the sensitive data by matching the target data to be processed with a pre-established sensitive data label library, and desensitize the sensitive data in the target data using the desensitization rules defined by the sensitivity level corresponding to the sensitive data, which can effectively ensure data security and privacy security.

[0018] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0020] Figure 1 A schematic diagram showing a system structure of an application data processing method in an embodiment of the present disclosure;

[0021] Figure 2 A flow chart of a data processing method in an embodiment of the present disclosure is shown;

[0022] Figure 3 A schematic flow chart of a method for identifying sensitive data in target data to be processed according to an embodiment of the present disclosure is shown;

[0023] Figure 4 A schematic diagram of a process for extracting key-value pairs from target data to be processed in an embodiment of the present disclosure is shown;

[0024] Figure 5 A schematic diagram of a method for detecting sensitive data in an incoming key-value pair list in an embodiment of the present disclosure is shown;

[0025] Figure 6 A schematic diagram of a data processing device in an embodiment of the present disclosure is shown;

[0026] Figure 7 A structural block diagram of an electronic device to which a data processing method is applied in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0027] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0028] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0029] For ease of understanding, before introducing the embodiments of the present disclosure, several terms involved in the embodiments of the present disclosure are first explained as follows:

[0030] Data Loss Prevention (DLP): DLP technology is a collection of tools and processes designed to ensure that sensitive information is not accessed, used, leaked or destroyed without authorization. It can help companies identify, monitor and protect sensitive data, whether the data is stored at rest (such as hard disks), in transit (such as networks) or during use (such as terminal devices). The DLP system can set rules to detect data that meets specific patterns, such as credit card numbers, ID numbers, bank account numbers, etc., and take corresponding measures based on the set security policies, such as blocking outbound transmission, encrypting data or triggering alarms.

[0031] The specific implementation of the embodiment of the present disclosure is described in detail below with reference to the accompanying drawings.

[0032] Figure 1FIG. 1 shows an exemplary application system architecture diagram to which the data processing method in the embodiment of the present disclosure can be applied. Figure 1 As shown, the system architecture may include a terminal device 101 , a network 102 and a server 103 .

[0033] The network 102 is a medium for providing a communication link between the terminal device 101 and the server 103, and can be a wired network or a wireless network.

[0034] Optionally, the wireless network or wired network described above uses standard communication technology and / or protocol. The network is usually the Internet, but it can also be any network, including but not limited to a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a mobile, wired or wireless network, a dedicated network or any combination of a virtual private network). In some embodiments, the data exchanged through the network is represented by technologies and / or formats including Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML), etc. In addition, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPSec) can also be used to encrypt all or some links. In other embodiments, customized and / or dedicated data communication technologies can also be used to replace or supplement the above data communication technologies.

[0035] The terminal device 101 can be various electronic devices, including but not limited to smart phones, tablet computers, laptop computers, desktop computers, smart speakers, smart watches, wearable devices, augmented reality devices, virtual reality devices, etc.

[0036] Optionally, the client of the application installed in different terminal devices 101 is the same, or the client of the same type of application based on different operating systems. Based on the different terminal platforms, the specific form of the client of the application can also be different, for example, the application client can be a mobile client, a PC client, etc.

[0037] The server 103 may be a server that provides various services, such as a background management server that provides support for the device operated by the user using the terminal device 101. The background management server may analyze and process the received request and other data, and feed back the processing results to the terminal device.

[0038] Optionally, the server can be an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, CDN (Content Delivery Network), as well as big data and artificial intelligence platforms.

[0039] Those skilled in the art will know that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration, and any number of terminal devices, networks and servers may be provided according to actual needs, and the embodiments of the present disclosure do not limit this.

[0040] Under the above system architecture, a data processing method is provided in an embodiment of the present disclosure, and the method can be executed by any electronic device with computing and processing capabilities.

[0041] In some embodiments, the data processing method provided in the embodiments of the present disclosure may be executed by a terminal device of the above-mentioned system architecture; in other embodiments, the data processing method provided in the embodiments of the present disclosure may be executed by a server in the above-mentioned system architecture; in other embodiments, the data processing method provided in the embodiments of the present disclosure may be implemented by a terminal device and a server in the above-mentioned system architecture through interaction.

[0042] First of all, in response to the above technical problems, the embodiments of the present disclosure provide a data processing method, which can be applied to any electronic device that needs to desensitize privacy data, by matching the target data to be processed with a pre-established sensitive data label library, determining the sensitive data in the target data, and desensitizing the sensitive data in the target data according to the desensitization rules defined by the sensitivity level corresponding to the sensitive data in the target data. Compared with the problem that the sensitive data scanning scheme in the related technology lacks the corresponding desensitization processing function and has low security when transmitting sensitive data, the embodiments of the present disclosure can accurately locate the sensitive data by matching the target data to be processed with a pre-established sensitive data label library, and desensitize the sensitive data in the target data using the desensitization rules defined by the sensitivity level corresponding to the sensitive data, which can effectively ensure data security and privacy security.

[0043] Figure 2A flow chart of a data processing method in an embodiment of the present disclosure is shown as follows: Figure 2 As shown, the data processing method provided in the embodiment of the present disclosure includes the following steps:

[0044] S202, obtaining target data to be processed.

[0045] It should be noted that the target data to be processed in the embodiments of the present disclosure may be any data that needs to be desensitized, including images, texts, audios, etc., and the target data in the embodiments of the present disclosure may be data obtained by the terminal device through various means such as collection, transmission, storage, exchange and sharing. For example, the terminal device obtains the target data to be processed using a crawling tool.

[0046] S204, matching the target data to be processed with a pre-established sensitive data label library to determine the sensitive data in the target data, where the sensitive data label library includes: sensitive labels, sensitivity levels, and desensitization rules defined according to the sensitivity levels.

[0047] It should be noted that the embodiment of the present disclosure obtains the sensitive labels and sensitivity levels corresponding to the sensitive data in the sensitive data set by training the pre-constructed sensitive data set, and formulates corresponding desensitization rules according to the sensitive labels and sensitivity levels corresponding to the sensitive data in the sensitive data set, and finally constructs a sensitive data label library according to the sensitive labels, sensitivity levels and desensitization rules corresponding to the sensitive data in the sensitive data set, wherein the terminal device in the embodiment of the present disclosure can pre-train a sensitive data label model through a neural network model, and determine the sensitive label and sensitivity level of the input sensitive data through the sensitive data label model. For example, the employee information of a company is input into the sensitive data label model, wherein the employee information is equivalent to the pre-constructed sensitive data set, and the name, gender, and mobile phone number in the employee information are equivalent to the sensitive labels. The mobile phone number needs to be kept confidential more than the gender. Therefore, the sensitivity level corresponding to the sensitive label of the mobile phone number in the employee information is higher than the sensitive label of the gender. The sensitivity level corresponding to the sensitive label of the mobile phone number can be set to the highest level (for example, level 5), and the sensitivity level corresponding to the sensitive label of the gender can be set to the lowest level (for example, level 1).

[0048] S206: Desensitize the sensitive data based on the desensitization rules defined according to the sensitivity level corresponding to the sensitive data.

[0049] It should be noted that the desensitizing rules of the disclosed embodiment may be able to encode sensitive data in a confidential manner. For example, if the sensitive data includes the name and mobile phone number of an employee of a company, the desensitizing rule may be to encode the last digit of the name or the last 4 digits of the employee's mobile phone number.

[0050] In some embodiments, the data processing method in the disclosed embodiments, first, obtains the target data to be processed; second, matches the target data to be processed with a pre-established sensitive data label library to determine the sensitive data in the target data, wherein the sensitive data label library includes: sensitive labels, sensitivity levels, and desensitization rules defined according to the sensitivity levels; finally, desensitizes the sensitive data based on the desensitization rules defined according to the sensitivity levels corresponding to the sensitive data. Compared with the problem of low security when sensitive data is transmitted in related technologies, the disclosed embodiments can accurately locate sensitive data by matching the target data to be processed with a pre-established sensitive data label library, and desensitize the sensitive data in the target data using the desensitization rules defined according to the sensitivity levels corresponding to the sensitive data, which can effectively ensure data security and privacy security.

[0051] In some embodiments, before matching the target data to be processed with a pre-established sensitive data label library and determining the sensitive data in the target data, the data processing method in the disclosed embodiment also includes: obtaining a pre-constructed sensitive data set; inputting the sensitive data set into a pre-trained sensitive data label model, and outputting sensitive labels and sensitivity levels corresponding to the sensitive data in the sensitive data set; setting desensitization rules corresponding to the sensitive data in the sensitive data set according to the sensitive labels and sensitivity levels corresponding to the sensitive data in the sensitive data set; constructing a sensitive data label library according to the sensitive labels, sensitivity levels and desensitization rules corresponding to the sensitive data in the sensitive data set. Specifically, by constructing a sensitive data label library, the disclosed embodiment can locate the sensitive data in the target data more quickly, and determine the sensitivity level and corresponding desensitization rules in the sensitive data, desensitize the sensitive data in the target data, and ensure that the privacy in the target data is not disclosed.

[0052] In some embodiments, the disclosed embodiments match the target data to be processed with a pre-established sensitive data label library to determine the sensitive data in the target data, including: matching the target data to be processed with a pre-established sensitive data label library to determine whether the target data to be processed includes sensitive labels in the sensitive data label library; if the target data to be processed includes sensitive labels in the sensitive data label library, then determining the sensitive data in the target data to be processed and the sensitivity level and desensitization rules corresponding to the sensitive data. Specifically, the disclosed embodiments match the target data to be processed with a pre-established sensitive data label library, and can desensitize the sensitive data in the target data to be processed according to the sensitivity level and desensitization rules corresponding to the sensitive data in the target data to be processed in the matching results, thereby realizing automatic identification of sensitive data and reliable protection of sensitive privacy data.

[0053] In some embodiments, Figure 3 As shown, the embodiment of the present disclosure can automatically identify sensitive data in the target data to be processed by programming, specifically, by DetectBytes in the programming language, wherein the purpose of DetectBytes in the embodiment of the present disclosure is to extract and identify all possible sensitive data from the input target data to be processed, it traverses all detector objects in 'I.detectorMap', and calls the 'DetectBytes' method of each detector to detect sensitive information, and the detection results will be collected into a 'DetectResult' list and returned, the specific process is as follows:

[0054] S302, initialize an empty 'DetectResult' list.

[0055] S304, traverse all detector objects in 'I.detectorMap'.

[0056] S306 , for each detector object, if it is of 'VALUE' type, call its 'DetectBytes' method to detect sensitive data.

[0057] S38, adding the detection result to the DetectResult' list.

[0058] S310, returning a list of detection results and the last error (if any).

[0059] Among them, 'I.detectorMap' represents the target data to be processed; 'DetectResult' represents the detection result storage list; 'VALUE' represents the attribute value of the target data to be processed.

[0060] In some embodiments, Figure 4 As shown, the embodiment of the present disclosure uses ExtractKVList in a programming language to extract key-value (KV) items from the input target data to be processed, and returns a list containing these items. The specific steps are as follows:

[0061] S402, initializing an empty 'KvList' list for storing the extracted key-value pairs.

[0062] S404, traverse the input byte array 'Line' and search for key-value pair separators (such as ':', '=', ':=', etc.).

[0063] S406: For each delimiter found, extract the key on the left side of the delimiter and the value on the right side.

[0064] S408, convert the key to lowercase and add the key-value pair to the 'KvList' list.

[0065] S410, return the 'KvList' list.

[0066] In some embodiments, the disclosed embodiments extract all key-value pairs from the input target data to be processed through ExtractKVList in the programming language to facilitate subsequent sensitive data detection.

[0067] In some embodiments, Figure 5 As shown, the disclosed embodiment detects sensitive data in the incoming key-value pair list ('KvList') through DetectKVList in the programming language. It traverses each detector object in 'DetectorMap' and calls the 'DetectList' method to detect sensitive information in the key-value pair list. The detection results will be stored in the 'Results' list and returned to the caller. The specific steps are as follows:

[0068] S502, initialize an empty 'Results' list.

[0069] S504, traverse each detector object in 'DetectorMap'.

[0070] S506, checking whether the detector object is of 'KV' type.

[0071] S508, calling the 'DetectList' method of the detector object to detect sensitive data in the key-value pair list.

[0072] S510, setting 'ResultType' of the detection result to 'VALUE'.

[0073] S512, adding the detection result to the 'Results' list.

[0074] S514, return the 'Results' list and possible errors.

[0075] In some embodiments, the disclosed embodiments detect sensitive data from a key-value pair list through ExtractKVList in a programming language and return the detection result.

[0076] In some embodiments, the disclosed embodiments perform desensitization processing on sensitive data based on desensitization rules defined based on the sensitivity level corresponding to the sensitive data, including: based on the sensitive data in the target data to be processed, the sensitivity level corresponding to the sensitive data, and the desensitization rules, the sensitive data in the target data to be processed is desensitized using the corresponding desensitization rules. Specifically, the disclosed embodiments can effectively protect the sensitive data in the target data by setting the desensitization rules.

[0077] In some embodiments, the desensitization rules in the embodiments of the present disclosure can be pre-defined, and then the corresponding desensitization rules can be called out according to different sensitivity levels. For example, in the embodiments of the present disclosure, desensitization rules for desensitizing the mobile phone numbers of employees of a certain company can be pre-defined. First, the rule name for masking the mobile phone number is set, and then the masking operation is specified to be applied to the single character level. An asterisk (*) is used as a masking symbol to replace the original character, and masking is performed starting from the 4th character (because the offset is counted from 0). For example, in an 11-digit mobile phone number, masking will start from the 4th digit, and the masked character length is 6 characters. Combined with the above offset, this means that starting from the 4th character, the next 6 characters will be replaced with asterisks. Finally, it is set to ignore the characters in the specified character set, and these characters are not considered when calculating the offset and length. The hyphen - is ignored here, which means that if the phone number contains a hyphen, they will not affect the masking logic. Ignore the characters in the specified character set, and these characters are not considered when calculating the offset and length. The hyphen - is ignored here, which means that if the phone number contains a hyphen, they will not affect the masking logic.

[0078] In more detail, the embodiment of the present disclosure can set the desensitization rules by means of code, and the specific coding is as follows:

[0079]

[0080]

[0081] In some embodiments, the disclosed embodiments effectively protect the privacy of the middle part of the phone number by setting desensitization rules, while maintaining sufficient information for identification or verification purposes. By setting the offset and length, the specific position and range of the masking can be flexibly controlled; and the function of ignoring specific character sets ensures that the desensitization rules can be correctly applied even in non-standard formats.

[0082] In some embodiments, the disclosed embodiments can effectively ensure the security and privacy of private data through identification rules and desensitization rules for sensitive data, business-customized configuration options and massive data processing capabilities. The disclosed embodiments can apply multiple privacy compliance standards, grade and label the original data, determine the sensitivity level and implement corresponding desensitization processing.

[0083] In some embodiments, before obtaining the target data to be processed, the data processing method in the disclosed embodiment also includes: obtaining the target text to be desensitized; performing word segmentation processing on the target text to determine multiple words in the target text and the part of speech corresponding to each word; performing character processing on the multiple words in the target text and the part of speech corresponding to each word to obtain the target data to be processed. Specifically, the disclosed embodiment obtains the target data to be processed by performing word segmentation processing and character processing on the target text to be desensitized, for example, replacing the escaped characters in the desensitized target text with the original characters, and replacing the wide characters with single-byte characters, which can ensure that the subsequent processing steps can run more efficiently and accurately, and can improve the robustness and user experience of the overall system.

[0084] In some embodiments, after determining the sensitive data in the target data to be processed and the sensitivity level corresponding to the sensitive data and the desensitization rules, the data processing method in the embodiment of the present disclosure further includes: updating the sensitive data label library based on the sensitivity level corresponding to the sensitive data in the target data to be processed and the desensitization rules. Specifically, if there is no sensitive label matching the target data to be processed in the sensitive data label library, the terminal device determines the sensitive label matching the target data to be processed through a pre-trained sensitive data label model, sets desensitization rules according to the sensitivity level corresponding to the sensitive label matching the target data to be processed, and updates the sensitive label, sensitivity level, and desensitization rules matching the target data to be processed to the sensitive data label library, thereby realizing the dynamic update of sensitive data and the sensitive data label library in big data activities, and improving the intelligence of the desensitization processing method of the sensitive data.

[0085] In some embodiments, the embodiments of the present disclosure can automatically identify sensitive data in the target data to be processed by means of code, and the specific code is as follows:

[0086]

[0087] Among them, InfoType: PHONE: indicates that this rule is used to identify the type of telephone number; Description: mobile phone number, indicates a brief description of the rule, here is the Chinese description "mobile phone number"; EnName: telephone_number, indicates the English name, which is used for reference in programming or internationalization environment; CnName: telephone number, indicates the Chinese name, which is easy to understand and use in Chinese environment; Level: L4, indicates the sensitivity level, L4 may mean that this is a highly sensitive data type that needs to be strictly protected.

[0088] The detection field Detect is an array in which the relationship between each element is "OR", which means that as long as any one condition is met, the match is considered successful. For phone numbers, it mainly relies on regular expressions (VReg) for matching, while the keyword dictionary (KDict) and value dictionary (VDict) are not used in this rule.

[0089] Masking rule: Mask: CHINAPHONE. When a phone number that matches the regular expression above is detected, the masking rule named CHINAPHONE will be applied. This is usually a predefined masking strategy, for example, replacing part of the number with asterisks to protect privacy.

[0090] Extended information ExtInfo: provides additional metadata, which specifies the group to which it belongs. Among them, EnGroup: user_data, which represents the English group name, indicates that this type of information belongs to the user data category; CnGroup: user data, which represents the Chinese group name, also indicates that this information is related to the user.

[0091] In more detail, the disclosed embodiments can make full use of the high concurrency characteristics of Golang, create multiple coroutines, implement multiple engine instances, and add message middleware such as Kafka. It can also cooperate with big data components such as Flink and Spark to realize sensitive information identification of massive data.

[0092] In some embodiments, the scanning engine implemented by the embodiment of the present disclosure through Golang ensures the efficiency of sensitive data identification and has the ability to process massive data. The interface design makes the functions decoupled and customizable. For example, custom sensitive data identification rules and desensitization rules can be registered, and structured (JSON data, KV data) and unstructured data (multi-language strings) can be widely supported. The general sensitive data identification scheme has fewer sensitive data identification rules and is not flexible enough. The embodiment of the present disclosure can freely configure the identification rules of sensitive data and can identify the sensitive type of the original data to ensure that the sensitive data can be properly handled. The general sensitive data identification scheme lacks the corresponding desensitization processing function. The embodiment of the present disclosure supports multiple desensitization algorithms, and the business can customize the desensitization rules for sensitive data according to the needs and perform different desensitization processing.

[0093] Based on the same inventive concept, the present disclosure also provides a data processing device in the following embodiments. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0094] Figure 6A schematic diagram of a data processing device in an embodiment of the present disclosure is shown. Figure 6 As shown, the device comprises:

[0095] The target data acquisition module 601 is used to acquire the target data to be processed;

[0096] The sensitive data determination module 602 is used to match the target data to be processed with a pre-established sensitive data label library to determine the sensitive data in the target data, where the sensitive data label library includes: sensitive labels, sensitivity levels, and desensitization rules defined according to the sensitivity levels;

[0097] The desensitization processing module 603 is used to perform desensitization processing on the sensitive data based on the desensitization rules defined according to the sensitivity level corresponding to the sensitive data.

[0098] In some embodiments, the data processing device in the disclosed embodiments obtains the target data to be processed through the target data acquisition module; matches the target data to be processed with a pre-established sensitive data label library through the sensitive data determination module to determine the sensitive data in the target data, wherein the sensitive data label library includes: sensitive labels, sensitivity levels, and desensitization rules defined according to the sensitivity levels; and desensitizes the sensitive data based on the desensitization rules defined according to the sensitivity levels corresponding to the sensitive data through the desensitization processing module. Compared with the problem of low security when sensitive data is transmitted in the related art, the disclosed embodiments can accurately locate sensitive data by matching the target data to be processed with a pre-established sensitive data label library, and desensitize the sensitive data in the target data using the desensitization rules defined according to the sensitivity levels corresponding to the sensitive data, which can effectively ensure data security and privacy security.

[0099] In some embodiments, the data processing device in the disclosed embodiments further includes: a sensitive data set acquisition module, which is used to acquire a pre-constructed sensitive data set before matching the target data to be processed with a pre-established sensitive data label library to determine the sensitive data in the target data; a sensitive information determination module, which is used to input the sensitive data set into a pre-trained sensitive data label model, and output the sensitive labels and sensitivity levels corresponding to the sensitive data in the sensitive data set; a desensitization rule setting module, which is used to set desensitization rules corresponding to the sensitive data in the sensitive data set according to the sensitive labels and sensitivity levels corresponding to the sensitive data in the sensitive data set; and a sensitive data label library construction module, which is used to construct a sensitive data label library according to the sensitive labels, sensitivity levels and desensitization rules corresponding to the sensitive data in the sensitive data set.

[0100] In some embodiments, the sensitive data determination module in the embodiments of the present disclosure is also used to match the target data to be processed with a pre-established sensitive data label library to determine whether the target data to be processed includes sensitive labels in the sensitive data label library; if the target data to be processed includes sensitive labels in the sensitive data label library, then determine the sensitive data in the target data to be processed and the sensitivity level corresponding to the sensitive data and the desensitization rules.

[0101] In some embodiments, the sensitive data determination module in the embodiments of the present disclosure is also used to desensitize the sensitive data in the target data to be processed using corresponding desensitization rules based on the sensitive data in the target data to be processed and the sensitivity levels and desensitization rules corresponding to the sensitive data.

[0102] In some embodiments, the data processing device in the embodiments of the present disclosure also includes: a target text acquisition module, which is used to obtain the target text to be desensitized before obtaining the target data to be processed; a word segmentation processing module, which is used to perform word segmentation processing on the target text, and determine multiple words in the target text and the part of speech corresponding to each word; a character processing module, which is used to perform character processing on multiple words in the target text and the part of speech corresponding to each word to obtain the target data to be processed.

[0103] In some embodiments, the data processing device in the disclosed embodiments further includes: a sensitive data label library update module, which is used to update the sensitive data label library based on the sensitivity levels corresponding to the sensitive data in the target data to be processed and the desensitization rules after determining the sensitive data in the target data to be processed and the sensitivity levels corresponding to the sensitive data and the desensitization rules.

[0104] It should be noted that the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the contents disclosed in the above method embodiments. It should be noted that the above modules as part of the device can be executed in a computer system such as a set of computer executable instructions.

[0105] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0106] Refer to the following Figure 7 An electronic device 700 according to this embodiment of the present disclosure is described. Figure 7 The electronic device 700 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0107] like Figure 7 As shown, the electronic device 700 is in the form of a general computing device. The components of the electronic device 700 may include but are not limited to: at least one processing unit 710, at least one storage unit 720, and a bus 730 connecting different system components (including the storage unit 720 and the processing unit 710).

[0108] The storage unit stores program codes, which can be executed by the processing unit 710, so that the processing unit 710 performs the steps of various exemplary embodiments of the present disclosure described in the above “Exemplary Method” section of this specification. For example, the processing unit 710 can perform the following steps of the above method embodiment:

[0109] Obtain the target data to be processed; match the target data to be processed with a pre-established sensitive data label library to determine the sensitive data in the target data, where the sensitive data label library includes: sensitive labels, sensitivity levels, and desensitization rules defined according to the sensitivity levels; desensitize the sensitive data based on the desensitization rules defined according to the sensitivity levels corresponding to the sensitive data.

[0110] The storage unit 720 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 7201 and / or a cache storage unit 7202 , and may further include a read-only storage unit (ROM) 7203 .

[0111] The storage unit 720 may also include a program / utility 7204 having a set (at least one) of program modules 7205, such program modules 7205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0112] Bus 730 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0113] The electronic device 700 may also communicate with one or more external devices 740 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 700, and / or communicate with any device that enables the electronic device 700 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 750. Furthermore, the electronic device 700 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 760. As shown, the network adapter 760 communicates with other modules of the electronic device 700 via a bus 730. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 700, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0114] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0115] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart may be implemented as a computer program product, which includes: a computer program, which implements the method in the above embodiment when executed by a processor.

[0116] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, which may be a readable signal medium or a readable storage medium. A program product capable of implementing the above method of the present disclosure is stored thereon. In some possible implementations, various aspects of the present disclosure may also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary implementations of the present disclosure described in the above “Exemplary Method” section of this specification.

[0117] More specific examples of computer-readable storage media in the present disclosure may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0118] In the present disclosure, a computer readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0119] Alternatively, the program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0120] In a specific implementation, the program code for performing the operations of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0121] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0122] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0123] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0124] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary techniques in the art that are not disclosed in the present disclosure. The description and examples are intended to be exemplary only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A data processing method, characterized in that: include: Obtain target data to be processed; Matching the target data to be processed with a pre-established sensitive data label library to determine the sensitive data in the target data, wherein the sensitive data label library includes: sensitive labels, sensitivity levels, and desensitization rules defined according to the sensitivity levels; The sensitive data is desensitized based on desensitization rules defined based on the sensitivity level corresponding to the sensitive data.

2. The data processing method according to claim 1, characterized in that: Before matching the target data to be processed with a pre-established sensitive data label library to determine the sensitive data in the target data, the method further includes: Obtain pre-constructed sensitive data sets; Input the sensitive data set into a pre-trained sensitive data label model, and output the sensitive labels and sensitivity levels corresponding to the sensitive data in the sensitive data set; According to the sensitivity labels and sensitivity levels corresponding to the sensitive data in the sensitive data set, setting desensitization rules corresponding to the sensitive data in the sensitive data set; A sensitive data label library is constructed according to the sensitive labels, sensitivity levels and desensitization rules corresponding to the sensitive data in the sensitive data set.

3. The data processing method according to claim 2, characterized in that: Matching the target data to be processed with a pre-established sensitive data label library to determine the sensitive data in the target data, including: Matching the target data to be processed with a pre-established sensitive data label library to determine whether the target data to be processed includes a sensitive label in the sensitive data label library; If the target data to be processed includes sensitive labels in the sensitive data label library, the sensitive data in the target data to be processed and the sensitivity level and desensitization rules corresponding to the sensitive data are determined.

4. The data processing method according to claim 3, characterized in that: Desensitizing the sensitive data based on a desensitization rule defined at a sensitivity level corresponding to the sensitive data, including: According to the sensitive data in the target data to be processed and the sensitivity level and desensitization rules corresponding to the sensitive data, the sensitive data in the target data to be processed is desensitized using the corresponding desensitization rules.

5. The data processing method according to claim 1, characterized in that: Before obtaining the target data to be processed, the method further includes: Obtain the target text to be desensitized; Performing word segmentation processing on the target text to determine a plurality of words in the target text and a part of speech corresponding to each word; Character processing is performed on multiple words in the target text and the part of speech corresponding to each word to obtain target data to be processed.

6. The data processing method according to claim 3, characterized in that: After determining the sensitive data in the target data to be processed and the sensitivity level and desensitization rules corresponding to the sensitive data, the method further includes: The sensitive data label library is updated based on the sensitivity levels corresponding to the sensitive data in the target data to be processed and the desensitization rules.

7. A data processing device, characterized in that: include: A target data acquisition module, used to acquire target data to be processed; A sensitive data determination module, used to match the target data to be processed with a pre-established sensitive data label library to determine the sensitive data in the target data, wherein the sensitive data label library includes: sensitive labels, sensitivity levels, and desensitization rules defined according to the sensitivity levels; The desensitization processing module is used to perform desensitization processing on the sensitive data based on the desensitization rules defined by the sensitivity level corresponding to the sensitive data.

8. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the data processing method according to any one of claims 1 to 6 by executing the executable instructions.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the data processing method according to any one of claims 1 to 6 is implemented.

10. A computer program product comprising: A computer program or instruction, characterized in that when the computer program or instruction is executed by a processor, it implements the data processing method described in any one of claims 1 to 6.

Images