Data desensitization method and device, medium and equipment

Abstract

The invention discloses a data desensitization method and device, a medium and equipment, an application program interface gateway is connected with a desensitization gateway, the desensitization gateway accesses a data interface service according to a data access request forwarded by the application program interface gateway, determines a data source to be accessed, and sends the data source to the application program interface gateway; and converting the data access request into a format corresponding to the data source and then sending the data access request to the data source. And receiving access data returned by the data source, and determining a desensitization strategy matched with the information of the data access party from the storage desensitization strategies. And performing desensitization processing on the access data according to a desensitization rule contained in the desensitization strategy, and returning the access data after the desensitization processing. Through the desensitization gateway, data desensitization is carried out on the accessed data, and the problem that the flexibility of desensitization strategy change is poor due to the fact that a desensitization rule is solidified into API gateway code logic is solved. According to the invention, the flexibility of dynamic adjustment of the desensitization strategy is improved and the cost of adjustment of the desensitization rule is reduced in a scene of performing data query on a plurality of data sources.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a data desensitization method, device, medium and equipment. Background Art

[0002] Data desensitization is the processing of sensitive data. It deforms sensitive data by applying desensitization rules, thereby achieving reliable protection of sensitive data.

[0003] In the prior art, in the scenario of data querying multiple data sources, since the access query methods of different data sources are different, in order to solve the universal problem of accessing multiple data sources and enable data query services to be developed under the same standard, an application programming interface (API) gateway is usually used to implement data querying of multiple data sources. Among them, the API gateway is used to convert data query requests into data query methods corresponding to different data sources to obtain query results from different data sources.

[0004] Therefore, the data desensitization process usually involves solidifying the desensitization rules into the internal code logic of the API gateway. When the API gateway receives the query results, it desensitizes the query results.

[0005] However, the flexibility of changing the desensitization rules for data desensitization in this way is poor, and the cost of adjusting the desensitization rules is high. To this end, this specification provides a data desensitization method, device, medium and equipment. Summary of the invention

[0006] This specification provides a data desensitization method, device, medium and equipment to partially solve the above-mentioned problems existing in the prior art.

[0007] This manual adopts the following technical solutions:

[0008] This specification provides a data desensitization method, which is applied to a desensitization gateway, the desensitization gateway is connected to an application program interface gateway, and the method includes:

[0009] Receiving a data access request forwarded by the application program interface gateway, wherein the data access request includes information of a data access party;

[0010] Access the data interface service according to the data access request, determine the data source to be accessed, and convert the data access request into a format corresponding to the data source;

[0011] Sending the converted data access request to the data source, so that the data source determines access data corresponding to the data access request according to the data access request;

[0012] Receive the access data returned by the data source, and determine a desensitization strategy that matches the information of the data access party from pre-stored desensitization strategies;

[0013] According to the desensitization rules contained in the matched desensitization strategy, the access data is desensitized to obtain the target data, and the target data is returned to the application interface gateway.

[0014] Optionally, determining a desensitization strategy that matches the information of the data access party from pre-stored desensitization strategies specifically includes:

[0015] Determining the identity of the data access party according to the information of the data access party;

[0016] According to the preset access identities of each pre-stored desensitization strategy, determining whether there is a preset access identity that matches the identity of the data access party;

[0017] If yes, the desensitization policy corresponding to the preset access identity is used as the desensitization policy for the access data;

[0018] If not, the common desensitization strategy among the desensitization strategies is used as the desensitization strategy for the access data.

[0019] Optionally, there are multiple data sources that need to be accessed;

[0020] Receiving access data returned by the data source, specifically including:

[0021] Receiving access data returned by each data source that needs to be accessed;

[0022] According to the desensitization rules included in the matched desensitization policy, the access data is desensitized, specifically including:

[0023] Determine the desensitization rules corresponding to each data source in the matched desensitization strategy;

[0024] For each data source, determining access data obtained from the data source;

[0025] The access data obtained from the data source is desensitized according to the desensitization rule corresponding to the data source.

[0026] Optionally, before performing desensitization processing on the access data according to the desensitization rules included in the matched desensitization policy, the method further includes:

[0027] Obtaining preset data features for data desensitization contained in the matched desensitization strategy;

[0028] determining access data characteristics of the access data according to the access data;

[0029] According to the access data feature and the preset data feature, determining whether the access data feature of the access data is consistent with the preset data feature;

[0030] If yes, desensitizing the access data according to the desensitization rules in the matched desensitization policy;

[0031] If not, the access data is returned to the application program interface gateway.

[0032] Optionally, desensitizing the access data according to the desensitizing rules included in the matched desensitizing policy, specifically including:

[0033] Determine whether the desensitization rule included in the matched desensitization strategy is empty;

[0034] If yes, returning the access data to the API gateway;

[0035] If not, the access data is desensitized according to the desensitization rules included in the matched desensitization policy.

[0036] Optionally, before determining a desensitization strategy that matches the information of the data access party from pre-stored desensitization strategies, the method further includes:

[0037] A desensitization policy file is loaded, wherein the desensitization policy file contains multiple desensitization policies, and each desensitization policy contains at least one desensitization rule.

[0038] This specification provides a data desensitization system, which is composed of an application interface gateway, a desensitization gateway, and a data source. The application interface gateway is connected to the desensitization gateway, wherein:

[0039] The application program interface gateway is used to receive a data access request sent by a client, the data access request containing information of the data access party; forward the data access request to the desensitizing gateway; receive the target data returned by the desensitizing gateway, and return the target data to the client;

[0040] The desensitizing gateway is used to receive the data access request forwarded by the application interface gateway; according to the data access request, access the data interface service, determine the data source to be accessed, and convert the data access request into a format corresponding to the data source; send the converted data access request to the data source; receive the access data returned by the data source, and determine the desensitizing strategy that matches the information of the data access party from the pre-stored desensitizing strategies; perform desensitization processing on the access data according to the desensitization rules contained in the matched desensitizing strategy to obtain the target data, and return the target data to the application interface gateway;

[0041] The data source is used to return access data corresponding to the data access request to the desensitizing gateway based on the received data access request.

[0042] This specification provides a data desensitization device, which is applied to a desensitization gateway, and the desensitization gateway is connected to an application program interface gateway, including:

[0043] A receiving module, used for receiving a data access request forwarded by the application program interface gateway, wherein the data access request includes information of a data access party;

[0044] A first determination module is used to access the data interface service according to the data access request, determine the data source to be accessed, and convert the data access request into a format corresponding to the data source;

[0045] An access module, used to send the converted data access request to the data source, so that the data source determines the access data corresponding to the data access request according to the data access request;

[0046] A second determination module is used to receive the access data returned by the data source, and determine a desensitization strategy that matches the information of the data access party from various pre-stored desensitization strategies;

[0047] The desensitizing module is used to perform desensitizing processing on the access data according to the desensitizing rules contained in the matched desensitizing strategy, obtain target data, and return the target data to the application interface gateway.

[0048] This specification provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the above-mentioned data desensitization method is implemented.

[0049] This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the above-mentioned data desensitization method is implemented when the processor executes the program.

[0050] At least one of the above technical solutions adopted in this specification can achieve the following beneficial effects:

[0051] A data desensitization method provided in this specification is applied to a desensitizing gateway. According to the data access request forwarded by the received application program interface gateway, the data interface service is accessed, the data source to be accessed is determined, and the data access request is converted into a format corresponding to the data source. The converted data access request is sent to the data source, so that the data source determines the access data corresponding to the data access request according to the data access request. The access data returned by the data source is received, and a desensitization strategy that matches the information of the data access party is determined from the pre-stored desensitization strategies. According to the desensitization rules contained in the matched desensitization strategy, the access data is desensitized to obtain the target data, and the target data is returned to the application program interface gateway.

[0052] It can be seen that in the scenario where data is queried from multiple data sources, an additional desensitizing gateway is set after the API gateway, so that the API gateway does not directly access the data source, but desensitizes the accessed data through the desensitizing gateway according to the desensitizing policy stored in the desensitizing gateway. There is no need to solidify the desensitizing policy into the desensitizing gateway code logic, and it also avoids the problem of poor flexibility in changing the desensitizing policy and poor adaptability to dynamic changes in the desensitizing policy due to changes in data access party permissions. In the scenario where data is queried from multiple data sources, the flexibility of dynamic adjustment of the desensitizing policy is improved, and the cost of adjusting the desensitizing rules is reduced. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] The drawings described herein are used to provide a further understanding of this specification and constitute a part of this specification. The illustrative embodiments and descriptions of this specification are used to explain this specification and do not constitute an improper limitation on this specification. In the drawings:

[0054] Figure 1 A flowchart of a data desensitization method provided in an embodiment of this specification;

[0055] Figure 2 A structural diagram of a data desensitization system provided in this manual;

[0056] Figure 3 Provide a flowchart for desensitization strategy configuration personnel in this manual to configure desensitization strategy;

[0057] Figure 4 A structural diagram of a data desensitization system provided in this manual;

[0058] Figure 5 A schematic diagram of a flow chart of a data desensitization device provided in this specification;

[0059] Figure 6 A method corresponding to the Figure 1 Schematic diagram of the structure of an electronic device. DETAILED DESCRIPTION

[0060] In order to make the purpose, technical solutions and advantages of this specification more clear, the technical solutions of this specification will be clearly and completely described below in combination with the specific embodiments of this specification and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0061] The technical solutions provided by the embodiments of this specification are described in detail below in conjunction with the accompanying drawings.

[0062] At present, in the scenario of data querying from multiple data sources, sensitive data may exist in the queried data. In order to prevent the leakage of sensitive data, the sensitive data needs to be desensitized. In addition, in order to solve the universal problem of accessing multiple data sources, a unified API gateway is usually used to query data from multiple data sources. However, the API gateway itself cannot achieve data desensitization. For this reason, this manual provides a data desensitization method.

[0063] Figure 1 A data desensitization method provided in this specification is applied to a desensitization gateway, which specifically includes the following steps:

[0064] S100: Receive a data access request forwarded by the application programming interface gateway, where the data access request includes information about a data access party.

[0065] In one or more embodiments of the present specification, the desensitizing gateway receives a data access request forwarded by the API gateway. The data access request includes information about the data access party.

[0066] This specification provides a data desensitization method that can be applied to a data query platform. When a user uses the data query platform to query data, he or she can send a data access request through the data query client. After receiving the data access request, the traffic gateway sends the data access request to the API gateway, and the API gateway forwards the data access request to the desensitization gateway, which performs the specific process of data desensitization.

[0067] Figure 2A structural diagram of a data desensitization system provided for this specification. The client sends a data access request to a traffic gateway (such as Nginx), and the traffic gateway sends the data access request to an API gateway. The API gateway forwards the data access request to a desensitizing gateway, and the desensitizing gateway accesses the data interface service, determines the data source to be accessed, and converts the data access request into a format corresponding to the data source. The data source returns access data according to the data access request, and the desensitizing gateway desensitizes the data according to the stored desensitization strategy, and returns the desensitized access data to the client through the API gateway.

[0068] In one or more embodiments of the present specification, the information of the data access party includes at least the identity of the logged-in client, account permissions, and the purpose of data use after obtaining the data. Of course, it can also include the type of data query platform, and the client interface returned after the current client initiates a data access request, displaying the function menu or function module of the triggerable data interface and other information. For example, the type of data query platform can be a literature retrieval platform. The function menu or function module can record the function menu or function module of the called data interface so that auditing and monitoring can be performed when necessary to ensure data security and compliance of data operations.

[0069] S102: Access a data interface service according to the data access request, determine a data source to be accessed, and convert the data access request into a format corresponding to the data source.

[0070] In one or more embodiments of the present specification, the desensitizing gateway accesses the data interface service based on the received data access request, obtains a data interface list, determines the data source that needs to be accessed, and converts the data access request into a format corresponding to the data source.

[0071] In one or more embodiments of this specification, the newly added data interface will be pre-registered with the data interface service, and the data interface service can provide the desensitizing gateway with a service for querying the data interface. When a data interface call occurs, the desensitizing gateway can obtain a data interface list from the data interface service in real time, call the data interface of the data source that needs to be accessed, and convert the data access request into the format corresponding to the data source to access the data source to obtain access data.

[0072] Of course, in one or more embodiments of the present specification, the API gateway may also access the data interface service according to the received data access request, obtain the data interface list, determine the data source to be accessed, and convert the data access request into a format corresponding to the data source. The converted data access request is then sent to the desensitizing gateway, which sends the converted data access request to the data source.

[0073] S104: Send the converted data access request to the data source, so that the data source determines access data corresponding to the data access request according to the data access request.

[0074] In one or more embodiments of the present specification, after the desensitizing gateway determines the data source to be accessed and converts the data access request into a format corresponding to the data source, the converted data access request can be sent to the data source, so that the data source determines the access data corresponding to the data access request according to the data access request, and returns the access data corresponding to the data access request to the desensitizing gateway.

[0075] S106: Receive the access data returned by the data source, and determine a desensitization strategy that matches the information of the data access party from pre-stored desensitization strategies.

[0076] In one or more embodiments of the present specification, the desensitization gateway receives access data returned by the data source and determines a desensitization strategy that matches the information of the data access party from various pre-stored desensitization strategies.

[0077] Specifically, the desensitizing gateway can determine the identity of the data access party based on the information of the data access party. According to the preset access identities of each pre-stored desensitizing policy, it is determined whether there is a preset access identity that matches the identity of the data access party. If so, the desensitizing policy corresponding to the preset access identity is used as the desensitizing policy for accessing the data. If not, the general desensitizing policy among the desensitizing policies is used as the desensitizing policy for accessing the data.

[0078] In one or more embodiments of the present specification, before determining the desensitization strategy that matches the information of the data access party among the desensitization strategies pre-stored in the desensitization gateway, the desensitization gateway may first query whether the desensitization strategy has been stored internally. If so, the desensitization strategy that matches the information of the data access party is determined from the pre-stored desensitization strategies. If not, the access data is returned to the application interface gateway.

[0079] For example, when the data access party initiates a data access request carrying information of two different data access parties during a data interface call, two sets of desensitization policies can be pre-set for the data access parties according to their different identities. The two data interface calls and data usage scenarios correspond to desensitization policy 1 (policy-1) and desensitization policy 2 (policy-2), respectively.

[0080] In Strategy 1: For certain text content (such as ID card information), 4-7 characters are not allowed to be displayed, and the rest can be displayed in plain text. For numerical values, data desensitization is not required. For complex text information such as JSON and reports, specific algorithm scripts or rule algorithms can be specified for processing.

[0081] In Strategy 2: For certain text content (such as ID card information), 4-12 characters are not allowed to be displayed, and the rest can be displayed in plain text. All numerical values ​​are desensitized. Similarly, for complex text information such as JSON and reports, specific algorithm scripts or rule algorithms can be specified for processing.

[0082] Similarly, for different data accessor identities, the degree of anonymization of the access data obtained when accessing the data is different. For example, in the above example, different data accessor identities can see different access data contents.

[0083] S108: Desensitizing the access data according to the desensitizing rules included in the matched desensitizing policy to obtain target data, and returning the target data to the application program interface gateway.

[0084] In one or more embodiments of the present specification, the desensitizing gateway desensitizes the access data according to the desensitizing rules contained in the desensitizing policy that matches the information of the data access party, obtains the target data after data desensitization, and returns the target data to the API gateway.

[0085] Specifically, the desensitizing gateway can determine whether the desensitizing rules contained in the desensitizing policy that matches the information of the data access party are empty. If so, the access data is returned to the API gateway. If not, the access data is desensitized according to the desensitizing rules contained in the desensitizing policy that matches the information of the data access party. The access data after desensitization is used as the target data. The target data is returned to the API gateway.

[0086] In one or more embodiments of the present specification, the desensitizing gateway may need to access multiple data sources. The desensitizing gateway receives access data returned by each data source. And determines the desensitization rules corresponding to each data source in the matching desensitization strategy. For each data source, determine the access data obtained from the data source. According to the desensitization rules corresponding to the data source, the access data obtained from the data source is desensitized.

[0087] In the scenario of data query in multiple data sources, different desensitization requirements of different data sources for accessing data are taken into consideration.

[0088] based on Figure 1A data desensitization method is shown, which is applied to a desensitizing gateway. According to the data access request forwarded by the received API gateway, the data interface service is accessed, the data source to be accessed is determined, and the data access request is converted into a format corresponding to the data source. The converted data access request is sent to the data source, so that the data source determines the access data corresponding to the data access request according to the data access request. The access data returned by the data source is received, and a desensitization strategy that matches the information of the data access party is determined from the pre-stored desensitization strategies. According to the desensitization rules contained in the matching desensitization strategy, the access data is desensitized to obtain the target data, and the target data is returned to the API gateway.

[0089] It can be seen that in the scenario where data is queried from multiple data sources, an additional desensitizing gateway is set after the API gateway, so that the API gateway does not directly access the data source, but desensitizes the accessed data through the desensitizing gateway according to the desensitizing policy stored in the desensitizing gateway. There is no need to solidify the desensitizing policy into the desensitizing gateway code logic, and it also avoids the problem of poor flexibility in changing the desensitizing policy and poor adaptability to dynamic changes in the desensitizing policy due to changes in data access party permissions. In the scenario where data is queried from multiple data sources, the flexibility of dynamic adjustment of the desensitizing policy is improved, and the cost of adjusting the desensitizing rules is reduced.

[0090] In addition, before the desensitizing gateway desensitizes the access data according to the desensitizing rules contained in the desensitizing policy that matches the information of the data access party, it is also necessary to determine whether the desensitizing rules can be used to desensitize the access data.

[0091] In one or more embodiments of the present specification, preset data features for data desensitization included in a matching desensitization strategy are obtained, and access data features of the access data are determined based on the access data.

[0092] When configuring a desensitization policy, the desensitization policy configuration personnel will preset data features based on the attributes and types of the access data that can be desensitized by the configured desensitization policy.

[0093] Then, the desensitizing gateway can determine whether the access data characteristics of the access data are consistent with the preset data characteristics based on the access data characteristics of the access data and the preset data characteristics. If so, the access data is desensitized according to the desensitization rules in the matching desensitization strategy. If not, the access data is returned to the API gateway.

[0094] In addition, the desensitizing gateway can load more desensitizing strategies before determining the desensitizing strategy that matches the information of the data access party from the pre-stored desensitizing strategies.

[0095] In one or more embodiments of the present specification, the desensitization gateway obtains a new desensitization policy by loading a desensitization policy file. The desensitization policy file includes multiple desensitization policies, and each desensitization policy includes at least one desensitization rule.

[0096] Figure 3 A flowchart for the desensitization policy configuration personnel provided in this specification to configure the desensitization policy. In one or more embodiments of this specification, the desensitization policy configuration personnel can configure the desensitization policy according to the actual situation, and formulate corresponding desensitization policies for each data interface when the information of the data access party is different. For example, desensitization policies for different data access parties are formulated based on the information of different data access parties, including the identity of the data access party (associated permissions) and the purpose of accessing the data.

[0097] Package the configured desensitization policies. Each desensitization policy contains at least one desensitization rule. According to the desensitization rule identifier in the desensitization policy, package the desensitization rules corresponding to the desensitization rule identifier into the desensitization policy. Convert the configured desensitization policy into an encrypted file and synchronize it to the desensitization gateway. This allows the desensitization gateway to load the encrypted file and parse it into a desensitization policy.

[0098] Figure 4 This is a structural diagram of a data desensitizing system provided in this specification. The system consists of an API gateway, a desensitizing gateway, and a data source. The API gateway is connected to the desensitizing gateway, and the desensitizing gateway is connected to access the data source.

[0099] In the embodiment of this specification, the API gateway is used to receive a data access request sent by a client, the data access request includes information about the data access party, and forward the data access request to the desensitizing gateway.

[0100] The desensitizing gateway is used to receive data access requests forwarded by the API gateway. According to the data access request, it accesses the data interface service, determines the data source to be accessed, and converts the data access request into the format corresponding to the data source. The converted data access request is sent to the data source.

[0101] The data source is used to return the access data corresponding to the data access request to the desensitizing gateway based on the received data access request.

[0102] The desensitizing gateway receives the access data returned by the data source, and determines the desensitizing strategy that matches the information of the data access party from the pre-stored desensitizing strategies. According to the desensitizing rules contained in the matching desensitizing strategy, the access data is desensitized to obtain the target data, and the target data is returned to the API gateway.

[0103] The API gateway receives the target data returned by the desensitizing gateway and returns the target data to the client.

[0104] For specific details of the steps in the above system, please refer to the description of the previous method and will not be described in detail here.

[0105] based on Figure 4 This specification provides a data desensitization system, in which a desensitizing gateway accesses a data interface service according to a data access request forwarded by an API gateway, determines the data source to be accessed, and converts the data access request into a format corresponding to the data source. The converted data access request is sent to the data source, so that the data source determines the access data corresponding to the data access request according to the data access request. The access data returned by the data source is received, and a desensitization strategy that matches the information of the data access party is determined from the pre-stored desensitization strategies. The access data is desensitized according to the desensitization rules contained in the matching desensitization strategy to obtain the target data, and the target data is returned to the API gateway.

[0106] It can be seen that through the desensitizing gateway, the accessed data is desensitized according to the desensitizing policy stored in the desensitizing gateway, and there is no need to solidify the desensitizing policy into the desensitizing gateway code logic. This avoids the problem of poor flexibility in changing desensitization policies and poor adaptability to changes in desensitization policies caused by the previous solidification of desensitization rules into the API gateway code logic. In the scenario of data querying from multiple data sources, the flexibility of dynamic adjustment of desensitization policies is improved, and the cost of adjusting desensitization rules is reduced.

[0107] Figure 5 A flow chart of a data desensitization device provided in this specification, wherein the device is applied to a desensitization gateway, and the desensitization gateway is connected to an application program interface gateway, including:

[0108] A receiving module 500 is used to receive a data access request forwarded by the application program interface gateway, wherein the data access request includes information of a data access party;

[0109] A first determination module 502 is used to access the data interface service according to the data access request, determine the data source to be accessed, and convert the data access request into a format corresponding to the data source;

[0110] An access module 504 is used to send the converted data access request to the data source, so that the data source determines access data corresponding to the data access request according to the data access request;

[0111] The second determination module 506 is used to receive the access data returned by the data source, and determine the desensitization strategy that matches the information of the data access party from the pre-stored desensitization strategies;

[0112] The desensitization module 508 is used to perform desensitization processing on the access data according to the desensitization rules included in the matched desensitization policy, obtain target data, and return the target data to the application interface gateway.

[0113] Optionally, the second determination module 506 is specifically used to determine the identity of the data access party based on the information of the data access party, and judge whether there is a preset access identity that matches the identity of the data access party based on the preset access identities of each desensitization policy pre-stored. If so, the desensitization policy corresponding to the preset access identity is used as the desensitization policy for the access data; if not, the general desensitization policy among the desensitization policies is used as the desensitization policy for the access data.

[0114] Optionally, the first determining module 502 is further configured to determine that there are multiple data sources that need to be accessed.

[0115] Optionally, the second determining module 506 is further specifically configured to receive access data respectively returned by each data source that needs to be accessed.

[0116] Optionally, the desensitizing module 508 is specifically used to determine the desensitizing rules corresponding to each data source in the matching desensitizing strategy, determine the access data obtained from each data source, and desensitize the access data obtained from the data source according to the desensitizing rules corresponding to the data source.

[0117] Optionally, the desensitizing module 508 is also used to adopt the following method to obtain the preset data features for data desensitization contained in the matching desensitization policy, determine the access data features of the access data based on the access data, and judge whether the access data features of the access data are consistent with the preset data features based on the access data features and the preset data features; if so, desensitize the access data according to the desensitization rules in the matching desensitization policy; if not, return the access data to the application interface gateway.

[0118] Optionally, the desensitizing module 508 is also specifically used to determine whether the desensitizing rules contained in the matching desensitizing policy are empty. If so, the access data is returned to the application interface gateway; if not, the access data is desensitized according to the desensitizing rules contained in the matching desensitizing policy.

[0119] Optionally, the second determination module 506 is further used to adopt the following method to load a desensitization policy file, where the desensitization policy file contains multiple desensitization policies, and each desensitization policy contains at least one desensitization rule.

[0120] This specification also provides a computer-readable storage medium, which stores a computer program, which can be used to execute the above Figure 1 A data desensitization method is provided.

[0121] This manual also provides Figure 6 The schematic structure diagram of the electronic device shown in FIG. Figure 6 As shown, at the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may also include other hardware required for the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to achieve the above Figure 1 The data desensitization method described.

[0122] Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the executor of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0123] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0124] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0125] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0126] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0127] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0128] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0129] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0130] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0131] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0132] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0133] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0134] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0135] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0136] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0137] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0138] The above description is only an embodiment of the present specification and is not intended to limit the present specification. For those skilled in the art, the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims of the present specification.

Claims

1. A data desensitization method, characterized in that: The method is applied to a desensitizing gateway, the desensitizing gateway is connected to an application program interface gateway, and the method comprises: Receiving a data access request forwarded by the application program interface gateway, wherein the data access request includes information of a data access party; Access the data interface service according to the data access request, determine the data source to be accessed, and convert the data access request into a format corresponding to the data source; Sending the converted data access request to the data source, so that the data source determines access data corresponding to the data access request according to the data access request; Receive the access data returned by the data source, and determine a desensitization strategy that matches the information of the data access party from pre-stored desensitization strategies; According to the desensitization rules contained in the matched desensitization strategy, the access data is desensitized to obtain the target data, and the target data is returned to the application interface gateway.

2. The method according to claim 1, characterized in that Determining a desensitization strategy that matches the information of the data access party from among the pre-stored desensitization strategies, specifically including: Determining the identity of the data access party according to the information of the data access party; According to the preset access identities of each pre-stored desensitization strategy, determining whether there is a preset access identity that matches the identity of the data access party; If yes, the desensitization policy corresponding to the preset access identity is used as the desensitization policy for the access data; If not, the common desensitization strategy among the desensitization strategies is used as the desensitization strategy for the access data.

3. The method according to claim 1, characterized in that There are multiple data sources that need to be accessed; Receiving access data returned by the data source, specifically including: Receiving access data returned by each data source that needs to be accessed; According to the desensitization rules included in the matched desensitization policy, the access data is desensitized, specifically including: Determine the desensitization rules corresponding to each data source in the matched desensitization strategy; For each data source, determining access data obtained from the data source; The access data obtained from the data source is desensitized according to the desensitization rule corresponding to the data source.

4. The method according to claim 1, characterized in that Before performing desensitization processing on the access data according to the desensitization rules included in the matched desensitization policy, the method further includes: Obtaining preset data features for data desensitization contained in the matched desensitization strategy; determining, based on the access data, access data characteristics of the access data; According to the access data feature and the preset data feature, determining whether the access data feature of the access data is consistent with the preset data feature; If yes, desensitizing the access data according to the desensitization rules in the matched desensitization policy; If not, the access data is returned to the application program interface gateway.

5. The method according to claim 1, characterized in that According to the desensitization rules included in the matched desensitization policy, the access data is desensitized, specifically including: Determine whether the desensitization rule included in the matched desensitization strategy is empty; If yes, returning the access data to the API gateway; If not, the access data is desensitized according to the desensitization rules included in the matched desensitization policy.

6. The method according to claim 1, characterized in that Before determining a desensitization strategy that matches the information of the data access party from pre-stored desensitization strategies, the method further includes: A desensitization policy file is loaded, wherein the desensitization policy file contains multiple desensitization policies, and each desensitization policy contains at least one desensitization rule.

7. A data desensitization system, characterized in that: The system is composed of an application interface gateway, a desensitizing gateway, and a data source. The application interface gateway is connected to the desensitizing gateway, wherein: The application program interface gateway is used to receive a data access request sent by a client, wherein the data access request includes information about the data access party; forward the data access request to the desensitizing gateway; receive target data returned by the desensitizing gateway, and return the target data to the client; The desensitizing gateway is used to receive the data access request forwarded by the application interface gateway; according to the data access request, access the data interface service, determine the data source to be accessed, and convert the data access request into a format corresponding to the data source; send the converted data access request to the data source; receive the access data returned by the data source, and determine the desensitizing strategy that matches the information of the data access party from the pre-stored desensitizing strategies; perform desensitization processing on the access data according to the desensitization rules contained in the matched desensitizing strategy to obtain the target data, and return the target data to the application interface gateway; The data source is used to return access data corresponding to the data access request to the desensitizing gateway based on the received data access request.

8. A data desensitization device, characterized in that: The device is applied to a desensitizing gateway, which is connected to an application program interface gateway and includes: A receiving module, used for receiving a data access request forwarded by the application program interface gateway, wherein the data access request includes information of a data access party; A first determination module is used to access the data interface service according to the data access request, determine the data source to be accessed, and convert the data access request into a format corresponding to the data source; An access module, used to send the converted data access request to the data source, so that the data source determines the access data corresponding to the data access request according to the data access request; A second determination module is used to receive the access data returned by the data source, and determine a desensitization strategy that matches the information of the data access party from various pre-stored desensitization strategies; The desensitizing module is used to perform desensitizing processing on the access data according to the desensitizing rules contained in the matched desensitizing strategy, obtain target data, and return the target data to the application interface gateway.

9. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 6 is implemented.

Images