Application data processing method and device

Abstract

The embodiment of the invention discloses an application data processing method and device which are used for improving the fine granularity of application data desensitization processing. The method comprises the steps that the cloud equipment receives a data loading request sent by the terminal equipment, wherein the data loading request is used for requesting to acquire application data from the cloud equipment; to-be-loaded data is monitored based on a window loading monitoring module, loading data comprises application data, the application data comprises sensitive information, and the window loading monitoring module is used for identifying the sensitive information in the loading stage of the application data. And modifying the sensitive information according to the permission information to obtain replacement data, the replacement data comprising the desensitization content after the sensitive information is replaced. And sending the replacement data to the terminal equipment, so that a display interface of the terminal equipment displays the desensitized content.

Description

Technical Field

[0001] The present invention relates to the field of computers, and more particularly to a method and apparatus for processing application data. Background Art

[0002] With the development of cloud computing technology, cloud phones, as a form of virtualized mobile phone based on network services, are widely used in enterprise-level and specific business scenarios. During the use of cloud phones, cloud phone systems need to monitor and replace sensitive information in their internal application data in real time to meet enterprise security management and compliance requirements. For example, in the scenario of protecting classified corporate information, it is necessary to prevent the leakage of sensitive corporate information through cloud phones.

[0003] In current application data processing solutions, cloud phone systems can also block users from accessing sensitive application data based on Uniform Resource Locator (URL) blacklists or network-side interception. For example, by maintaining a URL blacklist, when a cloud phone accesses a matching domain name, the entire page is directly decrypted. Although this interception method can achieve real-time interception of potentially sensitive information on the entire page, it cannot distinguish the specific content of sensitive application data on the page and can only intercept the entire page, resulting in poor granularity in application data desensitization. Summary of the Invention

[0004] The present application provides an application data processing method for improving the fine-grainedness of application data desensitization processing. The present application also provides an application data processing device, a computing device, a computing device cluster, a computer-readable storage medium, and a computer program product corresponding to the application data processing method.

[0005] In a first aspect, an embodiment of the present application provides a processing method of application data, which can be executed by a cloud phone system, or by a component of the cloud phone system, such as a processor, a chip or a chip system of the cloud phone system, or by a logic module or software capable of realizing all or part of the functions of the cloud phone system. The method provided in the first aspect comprises: receiving, by a cloud device, a data loading request sent by a terminal device, the data loading request being used to request to obtain application data from the cloud device, the application data comprising one or more of the following: text data, image data, and audio and video data. Monitoring, by the cloud device based on a window loading monitoring module, to-be-loaded data in a view object of the cloud phone, the to-be-loaded data being to-be-loaded data in the view object of the cloud phone, the to-be-loaded data comprising the application data, the application data containing sensitive information, the window loading monitoring module being used to identify the sensitive information in a loading stage of the application data, and the view object being used to display the application data on the terminal. Modifying, by the cloud device according to permission information, the sensitive information to obtain replacement data, the replacement data comprising desensitized content obtained by replacing the sensitive information. Sending, by the cloud device to the terminal device, the replacement data, so that the terminal device displays the desensitized content on a display interface.

[0006] In the cloud phone system in the embodiment of the present application, the to-be-loaded data in the view object of the terminal device can be monitored and identified based on the window loading monitoring module, and the sensitive information in the to-be-loaded data can be modified according to the permission information of the terminal device in the loading stage of the application data. Compared with the existing scheme of preventing a user from accessing an entire page based on a uniform resource locator blacklist, the processing method of application data provided in the embodiment of the present application improves the granularity of desensitization processing of the application data.

[0007] In a possible implementation, in the process of monitoring the to-be-loaded data by the cloud device based on the window loading monitoring module, the cloud device intercepts the to-be-loaded data in the view object based on a view interceptor in the window loading monitoring module, the view interceptor being used to intercept the to-be-loaded data at an application layer. Determining, by the cloud device according to a policy engine, a target policy for filtering the to-be-loaded data, the target policy being used to filter the sensitive information in the to-be-loaded data, wherein the target policy comprises one or more of the following: a regular expression strategy, a feature vector matching strategy, and a blacklist strategy. Identifying, by the cloud device based on the target policy, the sensitive information in the to-be-loaded data, to determine the sensitive information in the to-be-loaded data.

[0008] In the cloud device in the embodiment of the present application, the to-be-loaded data in the view object can be intercepted based on the view interceptor in the window loading monitoring module, and the sensitive information in the to-be-loaded data can be filtered based on the target policy, thereby improving the realizability of the desensitization processing of the application data in the embodiment of the present application.

[0009] In one possible implementation, when the target strategy is a feature vector matching strategy, before the cloud device determines the target strategy for filtering the data to be loaded based on the policy engine, the cloud device performs basic filtering on the data to be loaded based on the local filtering engine. The basic filtering includes regular expression-based filtering or blacklist-based filtering.

[0010] In the embodiment of the present application, the cloud device can perform basic filtering on the loaded data based on the local filtering engine. Since the basic filtering is based on regular expressions or blacklists, compared with the target strategy based on feature vector matching, the basic filtering in the embodiment of the present application can quickly identify sensitive information in the application data, thereby reducing the consumption of cloud computing resources.

[0011] In one possible implementation, permission information includes terminal device permissions and user account permissions, and a hierarchical policy for configuring permission information on a cloud device. The hierarchical policy indicates one or more of the following: a mapping relationship between terminal device permissions and target policies, and a mapping relationship between user account permissions and target policies. Different terminal device permissions can correspond to different target policies, and different user accounts can correspond to different target policies.

[0012] In the embodiment of the present application, the cloud device can configure a hierarchical strategy for permission information, so that different permission information corresponds to different target strategies, thereby realizing hierarchical processing of application data desensitization processing and improving the feasibility of hierarchical processing of application data desensitization processing.

[0013] In one possible implementation, after the cloud device monitors the data to be loaded in the view object based on the window loading monitoring module, the cloud device analyzes the data to be loaded based on the semantic understanding model to determine that the data to be loaded contains one or more semantic features. The semantic understanding model is used to convert the data to be loaded into a vector index, and the vector index indicates the semantic feature. The cloud device performs semantic matching with one or more semantic features based on a sensitive semantic feature library to determine that the data to be loaded contains sensitive information. The sensitive semantic feature library is used to indicate content that needs to be desensitized.

[0014] In the embodiment of the present application, the cloud device can analyze the semantic features in the data to be loaded based on the semantic understanding model, and perform semantic matching with one or more semantic features based on the sensitive semantic feature library, thereby improving the accuracy of identifying sensitive information in the application data and further improving the accuracy of desensitizing processing of the application data.

[0015] In one possible implementation, when the permission information meets the permission level threshold, the cloud device releases the sensitive information according to the permission information, so that the display interface of the terminal device displays the sensitive information.

[0016] In the embodiment of the present application, when the permission information meets the permission level threshold, the cloud device can release sensitive information based on the permission information, thereby improving the flexibility of application data processing.

[0017] In one possible implementation, the application data is text data. During a process in which the cloud device modifies sensitive information based on permission information, when the permission information does not meet the permission level threshold, the cloud device encodes the text data in the sensitive information based on the permission information to obtain replacement data. The replacement data includes a placeholder, and the placeholder is used to hide the text data in the sensitive information. The text data in the sensitive information includes one or more of the following: financial data, customer name, and password.

[0018] In the embodiment of the present application, the cloud device can encode the text data in the sensitive information according to the permission information of the terminal device, thereby improving the feasibility of desensitizing the text data.

[0019] In one possible implementation, the application data is a combination of text data and image data. During the process of the cloud device modifying the sensitive information according to the permission information, when the permission information does not meet the permission level threshold, the cloud device encodes the text data in the sensitive information according to the permission information, and replaces the image data in the sensitive information to obtain replacement data. The replacement data includes a placeholder and a default icon, wherein the placeholder is used to hide the text data in the sensitive information, and the default icon is used to hide the image data in the sensitive information.

[0020] In the embodiment of the present application, the cloud device can replace the combined content of text data and image data in sensitive information according to the permission information of the terminal device, thereby improving the feasibility of desensitizing processing of the combined application data.

[0021] In the second aspect, an embodiment of the present application provides an application data processing device, which includes a transceiver unit and a processing unit. The transceiver unit is used to receive a data loading request sent by a terminal device, and the data loading request is used to request to obtain application data from a cloud device, and the application data includes one or more of the following: text data, image data, audio and video data. The processing unit is used to monitor the data to be loaded based on the window loading monitoring module, and the data to be loaded is the data to be loaded in the cloud phone view object. The data to be loaded includes application data, and the application data contains sensitive information. The window loading monitoring module is used to identify sensitive information during the loading stage of the application data, and the view object is used to display the application data on the terminal. The processing unit is also used to modify the sensitive information according to the permission information to obtain replacement data, and the replacement data includes desensitized content after the sensitive information is replaced. The transceiver unit is also used to send replacement data to the terminal device so that the display interface of the terminal device displays the desensitized content.

[0022] In one possible implementation, the processing unit is configured to intercept data to be loaded in a view object based on a view interceptor in the window loading monitoring module. The view interceptor is configured to intercept the data to be loaded at the application layer. A target policy for filtering the data to be loaded is determined based on the policy engine. The target policy is configured to filter sensitive information and includes one or more of the following: a regular expression policy, a feature vector matching policy, and a blacklist policy.

[0023] In a possible implementation, the processing unit is further configured to configure a hierarchical policy for permission information, where the hierarchical policy indicates one or more of the following: a mapping relationship between permission information and target policy, and a mapping relationship between user account permissions and target policy.

[0024] In one possible implementation, the processing unit is further configured to analyze the data to be loaded based on a semantic understanding model to determine that the data to be loaded contains one or more semantic features. The semantic understanding model is configured to convert the data to be loaded into a vector index, where the vector index indicates the semantic feature. Semantic matching is performed based on a sensitive semantic feature library with one or more semantic features to determine that the data to be loaded contains sensitive information. The sensitive semantic feature library is configured to indicate content that needs to be desensitized.

[0025] In a possible implementation, the processing unit is specifically configured to release sensitive information according to the permission information when the permission information meets the permission level threshold, so that the display interface of the terminal device displays the sensitive information.

[0026] In one possible implementation, the application data is text data, and the processing unit is specifically used to encode the text data in the sensitive information according to the permission information when the permission information does not meet the permission level threshold, to obtain replacement data, the replacement data including a placeholder, and the text data in the sensitive information including one or more of the following: financial data, customer name, and password.

[0027] In one possible implementation, the application data is a combination of text data and image data, and the processing unit is specifically used to, when the permission information does not meet the permission level threshold, encode the text data in the sensitive information according to the permission information, and replace the image data in the sensitive information to obtain replacement data, where the replacement data includes a placeholder and a default icon.

[0028] In a third aspect, an embodiment of the present application provides a computing device, comprising a processor coupled to a memory, the processor being used to store instructions. When the instructions are executed by the processor, the computing device executes the method described in the first aspect or any possible implementation of the first aspect.

[0029] In a fourth aspect, an embodiment of the present application provides a computing device cluster, which includes one or more computing devices, each of which includes a processor coupled to a memory, and the processor is used to store instructions. When the instructions are executed by the processor, the computing device cluster executes the method described in the first aspect or any possible implementation method of the first aspect.

[0030] In a fifth aspect, an embodiment of the present application provides a computer-readable storage medium having instructions stored thereon. When the instructions are executed, the computer executes the method described in the first aspect or any possible implementation method of the first aspect.

[0031] In a sixth aspect, an embodiment of the present application provides a computer program product, which includes instructions. When the instructions are executed, the computer implements the method described in the first aspect or any possible implementation method of the first aspect.

[0032] It can be understood that the beneficial effects that can be achieved by any of the application data processing devices, computing devices, computing device clusters, computer-readable media or computer program products provided above can refer to the beneficial effects in the corresponding methods and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 A schematic diagram of the system architecture of a cloud phone system provided in an embodiment of the present application;

[0034] Figure 2 A flowchart of a method for processing application data provided in an embodiment of the present application;

[0035] Figure 3 A schematic diagram of application data processing provided in an embodiment of the present application;

[0036] Figure 4 A schematic diagram of another process flow for processing application data provided in an embodiment of the present application;

[0037] Figure 5 A schematic diagram of application data processing in an enterprise classified information management scenario provided by an embodiment of the present application;

[0038] Figure 6 A schematic diagram of application data processing for a minor protection scenario provided in an embodiment of the present application;

[0039] Figure 7 A schematic diagram of an application data processing device provided in an embodiment of the present application;

[0040] Figure 8 A schematic diagram of the structure of a computing device provided in an embodiment of the present application;

[0041] Figure 9 A schematic diagram of the structure of a computing device cluster provided in an embodiment of the present application;

[0042] Figure 10 A schematic diagram of the structure of another computing device cluster provided in an embodiment of the present application. DETAILED DESCRIPTION

[0043] The embodiments of the present application provide a method and device for processing application data, which are used to improve the fine-grainedness of desensitization processing of application data.

[0044] The terms "first," "second," "third," "fourth," and the like (if any) in the specification and claims of this application and in the accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a particular order or sequential sequence. It should be understood that the terms used in this manner are interchangeable where appropriate so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having," and any variations thereof, are intended to cover non-exclusive inclusions, e.g., a process, method, system, product, or apparatus comprising a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0045] In the embodiments of this application, words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of this application should not be interpreted as being preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "for example" is intended to present the relevant concepts in a concrete manner.

[0046] First, some terms involved in the embodiments of the present application are introduced to facilitate those skilled in the art to understand the technical solutions.

[0047] Cloud phone (CP) refers to a virtual mobile phone that provides services through the Internet. Users can remotely access and use applications and functions on the cloud phone through terminal devices.

[0048] Application data acquisition and replacement refers to the technology of real-time monitoring, acquisition and replacement of content data in applications according to preset rules in a cloud phone environment.

[0049] A sensitive word library contains a database of pre-defined words or content that need to be filtered or replaced, and is used for content risk control and content management. Content risk control refers to the review and control of content generated or accessed by users to ensure that the content complies with specific standards or policy requirements.

[0050] Image recognition is the process of identifying and analyzing content in images through computer vision techniques, including optical character recognition (OCR) and image feature recognition.

[0051] Semantic understanding refers to the in-depth analysis of the meaning and intent of text content through natural language processing techniques, rather than just simple keyword matching.

[0052] Vector matching refers to the technology of converting content into vector representation and performing content matching and retrieval by calculating vector similarity.

[0053] On-screen rendering refers to the process of displaying processed content on the user interface, including the final presentation of visual elements such as text, images, etc.

[0054] Classification of classified content protection refers to the differentiated management of content according to different security levels, ensuring that only authorized users can access information of specific levels.

[0055] Minor protection refers to filtering and managing content that minors may access to prevent them from accessing information or content that is not suitable for their age.

[0056] In order to make the technical solutions of the present application more clear and easy to understand, the system architecture of the present application will be introduced below in conjunction with the drawings.

[0057] Please refer to Figure 1 , Figure 1 A system architecture diagram of a cloud phone system is provided for the embodiments of the present application. In the example shown in Figure 1 , the cloud phone system 10 includes a terminal device 101 and a cloud device 102, wherein the cloud device 102 includes a window loading monitoring module 1021, a vocabulary matching and replacement module 1022, and a loading and rendering module 1023. The specific functions of each part of the cloud phone system 10 will be introduced below.

[0058] The terminal device 101 is a physical device directly operated by the user. The terminal device 101 is used to receive user input operation instructions and interact with the cloud device 102 through the network, so as to display the processing results of the cloud device 102. For example, the terminal device 101 can provide touch screen, microphone and camera input methods, and the user can operate the cloud phone running in the cloud device 102 through various input methods provided by the terminal device 101. The terminal device 101 can also display the rendering picture of the cloud device 102 and output audio.

[0059] In the embodiment of the present application, the terminal device 101 can run a cloud phone client, and the user can transmit commands and decode images through the client in the terminal device 101. The terminal device 101 in the embodiment of the present application can be a mobile phone, tablet, TV or personal computer, and can also be a virtual reality VR device, augmented reality AR device or vehicle-mounted device, without specific limitation.

[0060] Cloud device 102 is used to provide a cloud phone instance and is responsible for all cloud phone computing, storage, and operation tasks. Specifically, cloud device 102 can provide each user with an exclusive cloud phone operating system and applications, and can use cloud computing resources and cloud storage resources to execute user operation instructions and render the cloud phone screen. Cloud device 102 can also transmit the rendered cloud phone screen to terminal device 101 for display.

[0061] In this embodiment of the present application, cloud device 102 may be a computing device or computing device cluster deployed in a data center. Cloud device 102 may also be referred to as a cloud server. In this embodiment of the present application, cloud device 102 includes a window load monitoring module 1021, a vocabulary matching and replacement module 1022, and a loading and rendering module 1023. The specific functions of each module are described in detail below.

[0062] Among them, the window loading monitoring module 1021 is used to monitor the display screen of the cloud phone application window of the terminal device 101, so as to obtain the data to be loaded in the cloud phone application window. For example, the window loading monitoring module 1021 can monitor the behavior of the cloud phone application window loading text content and obtain the text content to be loaded in real time. Specifically, the window loading monitoring module 1021 can intercept all the data to be loaded in the cloud phone application window and parse the data to be loaded. These data to be loaded are the data before the cloud phone application is rendered, that is, the window loading monitoring module 1021 can implement content interception at the application layer before the user sees the rendered data.

[0063] The window loading monitoring module 1021 includes a view interceptor that can capture all view object creation events, thereby implementing a window-level interception mechanism. For example, the window loading monitoring module 1021 can monitor the creation process of cloud phone view objects through the view interceptor and the system-level activity management service (AMS), enabling real-time capture of the data to be loaded before rendering.

[0064] The vocabulary matching and replacement module 1022 is used to audit the display content of the cloud phone and replace sensitive information. The vocabulary matching and replacement module 1022 can match and replace sensitive information in the content to be rendered by the cloud phone through a preset or dynamically updated replacement vocabulary, ensuring that the cloud phone displays the replaced content.

[0065] In the embodiment of the present application, the vocabulary matching and replacement module 1022 can analyze the semantics of the data to be loaded based on the semantic understanding model during the process of replacing the specified information, and match the sensitive information by replacing the semantic feature library. The vocabulary matching and replacement module 1022 replaces the content of the matched sensitive information. Since the vocabulary matching and replacement module 1022 can match and replace sensitive information based on semantics, it can reduce the misjudgment of sensitive information.

[0066] The vocabulary matching and replacement module 1022 includes a local filtering engine, a vectorized service submodule and a policy engine. Among them, the local filtering engine is used to implement basic filtering of the data to be loaded and preliminarily identify sensitive information in the data to be loaded. The vectorized service submodule is used to generate multidimensional vectors for the content to be loaded and use the multidimensional vectors to implement the above-mentioned sensitive information matching and replacement operations. The policy engine is used to dynamically select matching and replacement strategies for sensitive information.

[0067] The loading and rendering module 1023 is used to load and render the replaced data in the application window of the cloud phone, so that the user can see the content after the sensitive information is replaced through the terminal device 101. The loading and rendering module 1023 can obtain the application data required by the user from the storage of the cloud device 102, and use the computing resources of the cloud device 102 to render the application data, and then send the rendered results to the terminal device 101.

[0068] It should be noted that the cloud phone system 10 in the embodiment of the present application can be applied to a variety of application scenarios. For example, the cloud phone system 10 can be applied to enterprise confidential information management scenarios, educational content graded display scenarios and minor protection scenarios, and barrier-free reading scenarios, without specific limitations.

[0069] Among them, in the enterprise classified information management scenario, for example, the cloud phone system 10 can replace and modify the classified information in the displayed content according to the user's permissions to avoid the leakage of classified information. In the educational content graded display scenario, for example, the cloud phone system 10 can modify the difficulty of the displayed content according to the user's education level, so as to facilitate users with different education levels to view different content. In the minor protection scenario, for example, the cloud phone system 10 can replace sensitive content according to the user's age to protect the use of minors. In the barrier-free reading scenario, for example, the cloud phone system 10 can convert complex charts into text descriptions to facilitate reading.

[0070] It can be understood that each unit or module of the cloud device 102 in the cloud phone system 10 in the embodiment of the present application can be deployed on a computing device or a computing device cluster. Therefore, in the embodiment of the present application, a computing device or a computing device cluster can also be used to refer to the cloud device 102 or each module in the cloud device 102.

[0071] based on Figure 1 The cloud phone system 10 shown in the present application also provides a method for processing application data. The following describes the method for processing application data provided by the present application embodiment in conjunction with an embodiment.

[0072] See also Figure 2 , Figure 2 A flow chart of a method for processing application data provided in an embodiment of the present application. Figure 2 In the example shown, the method includes the following steps:

[0073] 201. The cloud device receives a data loading request sent by the terminal device, where the data loading request is used to request to obtain application data from the cloud device.

[0074] In the embodiment of the present application, the user can operate the cloud phone through the cloud phone client in the terminal device 101 and use various applications in the cloud phone. The terminal device 101 sends a data loading request to the cloud device 102 based on the user's operation instructions. The data loading request is used to request to obtain application data from the cloud device 102 and display the obtained application data on the terminal device 101, wherein the application data includes one or more of the following: text data, image data, audio data, and video data.

[0075] It should be noted that the data loading request received by the cloud device 102 in the embodiment of the present application can be any request from the user to display the cloud phone content on the terminal device 101 during the use of the cloud phone. For example, the data loading request can be a request triggered by the user opening an application on the cloud phone, or a request triggered by the user opening a web page on the cloud phone, or a request triggered by the user opening a document using the cloud phone, without specific limitation.

[0076] In the embodiments of the present application, the application data includes sensitive information. Before the cloud device 102 displays the application data on the cloud phone, it needs to process the application data. This process is also called the desensitization process, which replaces the sensitive information in the application data. For example, if the application data contains some classified content, the cloud device 102 needs to process the classified content of the application data before rendering the application data on the screen.

[0077] The application data processing method provided in the embodiment of the present application can intercept sensitive information in the application data at the application layer and complete the replacement of the sensitive information. The application data processing method of the embodiment of the present application is described in detail below in conjunction with subsequent steps.

[0078] It can be understood that the sensitive information in the application data in the embodiments of the present application can be any information that meets specific rules, and the application data processing method in the embodiments of the present application can also be applied to replace any specific information in the application data, without specific limitation.

[0079] 202. The cloud device monitors the data to be loaded based on the window loading monitoring module. The data to be loaded includes application data, and the application data contains sensitive information. The window loading monitoring module is used to identify sensitive information during the loading stage of the application data.

[0080] After receiving the data loading request from terminal device 101, cloud device 102 determines the data to be loaded and displayed in the cloud phone application window based on the data loading request. The data to be loaded includes application data. Before rendering and displaying the data to be loaded, cloud device 102 monitors the data to be loaded in the view object using window loading monitoring module 1021 to identify sensitive information contained in the data to be loaded. Window loading monitoring module 1021 is used to identify sensitive information during the application data loading phase. View objects are used to display application data on the terminal.

[0081] See also Figure 3 , Figure 3 A schematic diagram of application data processing provided in an embodiment of the present application. Figure 3 In steps a to c of the example shown, after the cloud device 102 receives the data loading request sent by the terminal device 101, the cloud device 102 creates an application window in the cloud phone based on the data loading request and loads text in the application window. Since the text to be loaded by the cloud device 102 may contain sensitive information, the cloud device 102 monitors the behavior of loading text in the cloud phone application window, and at the same time obtains the text to be loaded and identifies the sensitive information in the text to be loaded.

[0082] In one possible implementation, while cloud device 102 monitors data to be loaded in a view object based on window loading monitoring module 1021, cloud device 102 intercepts the data to be loaded in the view object based on a view interceptor in window loading monitoring module 1021. The view interceptor is used to intercept the data to be loaded at the application layer. Cloud device 102 determines a target policy for filtering the data to be loaded based on a policy engine. The target policy is used to filter sensitive information in the data to be loaded. The target policy includes one or more of the following: a regular expression policy, a feature vector matching policy, and a blacklist policy.

[0083] Regular expression strategies use predefined regular expressions to match sensitive information in application data. Different regular expressions can be customized for different types of sensitive information, enabling the identification of structured or semi-structured sensitive information. Blacklist strategies maintain a predefined sensitive vocabulary, also known as a blacklist. They use exact string matching or prefix tree searches to determine whether application data contains words from the sensitive vocabulary, thereby determining whether the application data contains sensitive information.

[0084] The feature vector matching strategy uses a semantic understanding model to convert application data into a multidimensional feature vector. By calculating its similarity with sensitive semantic features, the strategy then determines whether the information is sensitive based on this similarity. This strategy relies on semantic understanding rather than literal matching, and can identify sensitive information expressed in subtle ways, such as variants and homophones.

[0085] In one possible implementation, when the target strategy is a feature vector matching strategy, before the cloud device 102 determines the target strategy for filtering the data to be loaded according to the policy engine, the cloud device 102 performs basic filtering on the data to be loaded based on the local filtering engine. Since the basic filtering can be the above-mentioned regular expression-based or blacklist-based sensitive information identification, the basic filtering can quickly identify sensitive information in the application data and occupy less computing resources.

[0086] See also Figure 4 , Figure 4 A flow chart of another process of processing application data provided in an embodiment of the present application. Figure 4 In the example shown, cloud device 102 initiates an application process in the cloud phone operating system based on user instructions from terminal device 101 and creates a view object, which can display the application data to be loaded. Cloud device 102 can monitor the view object creation process based on the window loading monitoring module 1021. For example, cloud device 102 triggers a view interceptor based on the Android system's activity management service (AMS) to capture the view object creation event, thereby obtaining the application data to be loaded, which is the original data content containing sensitive information.

[0087] exist Figure 4 In the example shown, after the cloud device 102 obtains the application data to be loaded, it first performs basic filtering on the application data to be loaded based on the local filtering engine to identify obvious sensitive information in the application data to be loaded. Then, the cloud device 102 performs deep identification of sensitive information on the data to be loaded after basic filtering. This deep identification of sensitive information process is semantic-based sensitive information identification of the data to be loaded, which can also be called a cloud risk control service in the embodiment of the present application.

[0088] In one possible implementation, after the cloud device 102 monitors the data to be loaded in the view object based on the window loading monitoring module 1021, the cloud device 102 analyzes the data to be loaded based on the semantic understanding model to determine that the data to be loaded contains one or more semantic features, and the semantic understanding model is used to convert the data to be loaded into a vector index, and the vector index indicates the semantic feature. The cloud device 102 performs semantic matching with one or more semantic features based on the sensitive semantic feature library to determine that the data to be loaded contains sensitive information, wherein the sensitive semantic feature library is used to indicate content that needs to be desensitized, and the sensitive semantic feature library can also be called a feature vector database.

[0089] Please continue reading Figure 4 ,exist Figure 4 In the example shown, cloud device 102 deeply identifies sensitive information in the data to be loaded based on the cloud risk control service. First, cloud device 102 vectorizes the data to be loaded based on a semantic understanding model. This includes processing various types of application data in the data to be loaded, generating multidimensional vector indexes that represent the semantics of the data to be loaded. Cloud device 102 then matches the multidimensional vector indexes based on a sensitive semantic feature library, calculates similarity, and determines the sensitive information in the data to be loaded based on the similarity.

[0090] In the embodiment of the present application, the cloud device 102 can analyze the semantic features in the data to be loaded based on the semantic understanding model, and perform semantic matching with the semantic features based on the sensitive semantic feature library, thereby improving the accuracy of identifying sensitive information in the application data and further improving the accuracy of desensitizing processing of the application data.

[0091] It should be noted that the sensitive word library and sensitive semantic feature library in the embodiments of the present application can be user-defined word libraries, and the cloud device 102 can optimize the customized word library through federated learning. In other words, in the embodiments of the present application, users can customize the word library and thus customize the filtering rules for sensitive information. For example, users can use the customized word library to block specific advertising keywords.

[0092] 203. The cloud device modifies the sensitive information according to the permission information to obtain replacement data, and the replacement data includes the desensitized content after the sensitive information is replaced.

[0093] After the cloud device 102 identifies the sensitive information in the data to be loaded, the cloud device 102 modifies the sensitive information according to the permission information to obtain replacement data, which includes the desensitized content after replacing the sensitive information. The replacement data in the embodiment of the present application can be other application data with similar semantics, a placeholder, a default icon, a default voiceprint or video, etc., without specific limitation.

[0094] Please continue reading Figure 3 ,exist Figure 3 In steps d through f of the illustrated example, when cloud device 102 identifies sensitive information in the text to be loaded, it matches sensitive terms with the text to be loaded based on a sensitive word library. When a sensitive term in the text to be loaded matches a sensitive term in the sensitive word library, cloud device 102 replaces the sensitive term in the text to be loaded, generating replacement text. Cloud device 102 can reload the replacement text in the cloud phone's application window and display the rendered replacement text in the application window.

[0095] Please continue reading Figure 4 ,exist Figure 4 In the example shown, during the process of deep identification of sensitive information in the data to be loaded, the cloud device 102 calculates similarity based on the feature vectors in the sensitive semantic feature library and the feature vectors corresponding to the data to be loaded. The cloud device 102 determines the feature vector corresponding to the sensitive information based on the feature vector whose similarity calculated in the data to be loaded is higher than a threshold. The cloud device 102 replaces the sensitive information in the data to be loaded, and the cloud device 102 performs screen rendering based on the replaced data to be loaded.

[0096] In the embodiment of the present application, the cloud device can match the sensitive information in the application data according to the sensitive word library or the sensitive semantic library and complete the replacement. Compared with the existing technology of using optical character recognition (OCR) technology to identify the text content in the image and then match and replace the sensitive information from the text content, the application data processing method provided in the embodiment of the present application improves the real-time performance of the application data desensitization processing.

[0097] In one possible implementation, the cloud device 102 can determine the sensitive information to be replaced based on the permission information. When the permission information meets the permission level threshold, the cloud device 102 releases the sensitive information according to the permission information, so that the display interface of the terminal device 101 displays the sensitive information. When the permission information does not meet the permission level threshold, the cloud device 102 replaces the sensitive information according to the permission information, so that the display interface of the terminal device 101 displays the desensitized content. In the embodiment of the present application, the cloud device 102 can release sensitive information according to the permission information, thereby improving the flexibility of application data processing.

[0098] For example, in an enterprise confidentiality management scenario, the cloud device 102 can determine the sensitive information to be replaced based on the permissions of the employee account. When an ordinary employee with low permissions views the cloud phone, the cloud device 102 can replace key information such as the amount and customer name in the data to be loaded according to the corresponding permissions. When a high-authority manager views the cloud phone, the cloud device 102 can release key information such as the amount and customer name in the data to be loaded according to the corresponding permissions.

[0099] In one possible implementation, the permission information includes terminal device permissions and user accounts, the terminal device permissions are the permission information of the terminal device 101, and the cloud device 102 configures a hierarchical strategy for the permission information, wherein the hierarchical strategy is used to indicate one or more of the following: a mapping relationship between terminal device permissions and target policies, and a mapping relationship between user account permissions and target policies. That is, in the embodiment of the present application, different permission information can correspond to different target policies, and different user accounts can correspond to different target policies. The cloud device 102 can configure a hierarchical strategy for permission information so that different permission information corresponds to different target policies, thereby realizing hierarchical processing of application data desensitization.

[0100] For example, in the hierarchical management scenario of educational content, the cloud device 102 can configure a grading strategy based on the student's age or ID. Lower grade students and higher grade students can correspond to different target strategies. Under different target strategies, different filter lexicons are used to filter the loaded data, thereby realizing hierarchical management of educational content.

[0101] In one possible implementation, the application data is text data. During the process of the cloud device 102 modifying the sensitive information according to the permission information, when the permission information does not meet the permission level threshold, the cloud device 102 encodes the text data in the sensitive information according to the permission information to obtain replacement data. The replacement data includes a placeholder, and the placeholder is used to hide the text data in the sensitive information. The text data in the sensitive information includes one or more of the following: financial data, customer name, password, where the financial data is, for example, the contract amount.

[0102] In one possible implementation, the application data is a combination of text data and image data. During the process of the cloud device 102 modifying the sensitive information according to the permission information, when the permission information does not meet the permission level threshold, the cloud device 102 encodes the text data in the sensitive information according to the permission information, and replaces the image data in the sensitive information to obtain replacement data. The replacement data includes a placeholder and a default icon, wherein the placeholder is used to hide the text data in the sensitive information, and the default icon is used to hide the image data in the sensitive information.

[0103] 204. The cloud device sends replacement data to the terminal device so that the display interface of the terminal device displays the desensitized content.

[0104] The cloud device 102 sends the replacement data to the terminal device 101. Specifically, after replacing the sensitive information in the loaded data, the cloud device 102 renders the replacement data and sends the rendered replacement data to the terminal device 101 so that the display interface of the terminal device 101 displays the desensitized content.

[0105] The application data processing method provided in the embodiment of the present application can be applied to various application scenarios such as enterprise confidentiality information management, hierarchical display of educational content, protection of minors and barrier-free reading. The following is a specific example of the application data processing method of the embodiment of the present application introduced in combination with the enterprise confidentiality information management scenario and the minor protection scenario.

[0106] See also Figure 5 , Figure 5 This is a schematic diagram of application data processing in an enterprise confidentiality information management scenario provided by an embodiment of the present application. Figure 5 In the enterprise confidentiality management scenario shown, both regular employees and senior managers use the same cloud phone app to access internal company information, including sensitive information such as customer names and financial data. The cloud phone system needs to dynamically filter or display sensitive information based on employee permission levels. When regular employees view contracts, sensitive information should be automatically censored, while senior managers can see the full information.

[0107] exist Figure 5 In steps a through c of the example shown, a user logs into an enterprise application on a cloud phone and requests to view a contract. The cloud device's application creates a view object in the cloud phone's operating system and loads the contract text. During this process, cloud device 102 intercepts the on create function of the activity management service (AMS) in the cloud phone's operating system to capture the content of the view object to be loaded. Cloud device 102 identifies sensitive information in the content to be loaded based on the user's permission level. If the user's permission level is standard, the lexicon service module of cloud device 102 matches the contract content with a classified lexicon and replaces the matched content with a placeholder, such as "****." If the user's permission level is advanced, the original content of the contract is directly released.

[0108] exist Figure 5In steps d to f of the example shown, when the cloud device 102 identifies sensitive information in the content to be loaded based on the user's permission level, if sensitive information is identified in the content to be loaded, the vocabulary service module of the cloud device 102 returns a matching result, and the matching result includes the sensitive information content that needs to be replaced. The cloud device 102 replaces the sensitive information with a placeholder, that is, encodes the sensitive information. If no sensitive information is identified in the content to be loaded, the cloud device 102 does not need to replace the content in the data to be loaded. The cloud device 102 then renders the processed data to be loaded and obtains the content displayed on the terminal device 101, which is the content after the sensitive information in the contract is desensitized.

[0109] See also Figure 6 , Figure 6 This is a schematic diagram of application data processing for a minor protection scenario provided by an embodiment of the present application. Figure 6 In the minor protection scenario shown, parents can configure cloud phones for minors. When children use social software and other applications in the cloud phone, the cloud phone system automatically filters sensitive information.

[0110] exist Figure 6 In steps a to c of the example shown, parents can configure a grading strategy on the cloud device 102, which can also be called a grading rule. The grading strategy can set a sensitive word library or a sensitive semantic library corresponding to the permission information of minors, including setting the specific content in the sensitive word library or the sensitive semantic library. When a minor is using an application in a cloud phone, the cloud device 102 can capture the application content to be loaded through AMS during the process of loading the application content, use the semantic understanding model to analyze the semantics of the application content, and match the sensitive semantic library. The cloud device 102 replaces the matched sensitive words with safe words, and replaces the matched sensitive image content with the default icon.

[0111] exist Figure 6 In steps d to f of the example shown, the cloud device 102 replaces the sensitive information in the application content to be loaded, and then renders the processed application content to be loaded to obtain content displayed on the terminal device 101. This content is the secure content after the sensitive information in the application content is desensitized.

[0112] exist Figure 6 In the example shown, the cloud device 102 can also display content differently based on permission information. For example, the same account is logged in to a real phone and a cloud phone at the same time, where the real phone can display the original content and the cloud phone can display the filtered content.

[0113] It can be seen from the above embodiments that the cloud phone system in the embodiments of the present application can monitor and identify the data to be loaded in the view object of the terminal device based on the window loading monitoring module, and modify the sensitive information in the data to be loaded during the loading stage of the application data according to the permission information, thereby improving the real-time and granularity of the application data desensitization processing.

[0114] Based on the above method embodiment, the embodiment of the present application also provides an application data processing device. The application data processing device provided by the embodiment of the present application is described in detail below.

[0115] See also Figure 7 , Figure 7 A schematic diagram of the structure of an application data processing device provided in an embodiment of the present application. Figure 7 In the example shown, the application data processing device 700 is used to implement the various steps performed by the cloud phone system in the above embodiments. The application data processing device 700 includes a transceiver unit 701 and a processing unit 702.

[0116] Among them, the transceiver unit 701 is used to receive a data loading request sent by a terminal device, and the data loading request is used to request to obtain application data from a cloud device, and the application data includes one or more of the following: text data, image data, audio and video data. The processing unit 702 is used to monitor the data to be loaded based on the window loading monitoring module, and the loaded data includes application data, and the application data contains sensitive information. The window loading monitoring module is used to identify sensitive information during the loading stage of the application data. The processing unit 702 is also used to modify the sensitive information according to the permission information to obtain replacement data, and the replacement data includes desensitized content after the sensitive information is replaced. The transceiver unit 701 is also used to send replacement data to the terminal device so that the display interface of the terminal device displays the desensitized content.

[0117] In one possible implementation, processing unit 702 is configured to intercept data to be loaded in a view object based on a view interceptor in a window loading monitoring module. The view interceptor is configured to intercept data to be loaded at the application layer. A target policy for filtering the data to be loaded is determined based on a policy engine. The target policy is configured to filter sensitive information and includes one or more of the following: a regular expression policy, a feature vector matching policy, and a blacklist policy.

[0118] In a possible implementation, the processing unit 702 is further configured to configure a hierarchical policy for permission information, where the hierarchical policy indicates one or more of the following: a mapping relationship between permission information and target policy, and a mapping relationship between user account permissions and target policy.

[0119] In one possible implementation, processing unit 702 is further configured to analyze the data to be loaded based on a semantic understanding model to determine that the data to be loaded contains one or more semantic features. The semantic understanding model is configured to convert the data to be loaded into a vector index, where the vector index indicates the semantic feature. Semantic matching is performed based on a sensitive semantic feature library with the one or more semantic features to determine that the data to be loaded contains sensitive information. The sensitive semantic feature library is configured to indicate content that needs to be desensitized.

[0120] In a possible implementation, the processing unit 702 is specifically configured to release sensitive information according to the permission information when the permission information meets the permission level threshold, so that the display interface of the terminal device displays the sensitive information.

[0121] In one possible implementation, the application data is text data, and the processing unit 702 is specifically used to encode the text data in the sensitive information according to the permission information when the permission information does not meet the permission level threshold, to obtain replacement data, the replacement data including a placeholder, and the text data in the sensitive information including one or more of the following: financial data, customer name, and password.

[0122] In one possible implementation, the application data is a combination of text data and image data. The processing unit 702 is specifically used to, when the permission information does not meet the permission level threshold, encode the text data in the sensitive information according to the permission information and replace the image data in the sensitive information to obtain replacement data. The replacement data includes a placeholder and a default icon.

[0123] It is understandable that the transceiver unit 701 and the processing unit 702 in the application data processing device 700 can be used as functional modules and Figure 1 There is a mapping between each module in the cloud phone system 10, thereby realizing the functions of each module in the cloud phone system 10.

[0124] It should be understood that the division of units in the above device is merely a division of logical functions. In actual implementation, they can be fully or partially integrated into one physical entity, or they can be physically separated. Moreover, the units in the device can all be implemented in the form of software called through processing elements; or they can all be implemented in the form of hardware; or some units can be implemented in the form of software called through processing elements, and some units can be implemented in the form of hardware. For example, each unit can be a separately established processing element, or it can be integrated into a certain chip of the device. In addition, it can also be stored in the memory in the form of a program, called by a certain processing element of the device and perform the function of the unit. In addition, all or part of these units can be integrated together, or they can be implemented independently. The processing element described here can also be a processor, which can be an integrated circuit with signal processing capabilities. In the implementation process, each step of the above method or each unit above can be implemented by the integrated logic circuit of the hardware in the processor element or in the form of software called through the processing element.

[0125] It is worth noting that, for the sake of simplicity of description, the above method embodiments are all expressed as a series of action combinations. However, those skilled in the art should know that this application is not limited to the order of the actions described. Secondly, those skilled in the art should also know that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required for this application.

[0126] Other reasonable step combinations that can be thought of by those skilled in the art based on the above description also fall within the scope of protection of this application. Secondly, those skilled in the art should also be familiar with that the embodiments described in the specification are all preferred embodiments, and the actions involved are not necessarily required by this application.

[0127] See also Figure 8 , Figure 8 This is a schematic diagram of the structure of a computing device provided in an embodiment of the present application. Figure 8 As shown, the computing device 800 includes: a processor 801, a memory 802, a communication interface 803, and a bus 804. The processor 801, the memory 802, and the communication interface 803 are coupled via a bus (not labeled in the figure). The memory 802 stores instructions. When the execution instructions in the memory 802 are executed, the computing device 800 executes the method executed by the cloud phone system in the above method embodiment.

[0128] The computing device 800 can be one or more integrated circuits (ICs) configured to implement one or more of the above methods, e.g., one or more application specific integrated circuits (ASICs), or, one or more digital signal processors (DSPs), or, one or more field programmable gate arrays (FPGAs), or a combination of at least two of these forms of integrated circuits. As another example, when units of the apparatus can be implemented by way of a processing element scheduler, the processing element can be a general purpose processor, e.g., a central processing unit (CPU) or other processor that can invoke a program. As another example, these units can be integrated together in a system-on-a-chip (SOC) form.

[0129] The processor 801 can be a central processing unit (CPU), and can also be other general purpose processors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs) or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The general purpose processor can be a microprocessor or any conventional processor.

[0130] Memory 802 may be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. Non-volatile memory may be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. Volatile memory may be random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0131] The memory 802 stores executable program codes, and the processor 801 executes the executable program codes to implement the functions of the aforementioned units or modules, thereby implementing the aforementioned application data processing method. That is, the memory 802 stores instructions for executing the aforementioned application data processing method.

[0132] The communication interface 803 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 800 and other devices or a communication network.

[0133] The bus 804 can include, in addition to a data bus, a power bus, a control bus, and a state signal bus, etc. The bus can be a peripheral component interconnect express (PCIe) bus, or an extended industry standard architecture (EISA) bus, a unified bus (Ubus or UB), a compute express link (CXL), a cache coherent interconnect for accelerators (CCIX), etc. The bus can be divided into an address bus, a data bus, a control bus, etc.

[0134] Referring to Figure 9 , Figure 9 A schematic diagram of a computing device cluster is provided for embodiments of the present application. As shown in Figure 9 , the computing device cluster 900 includes at least one computing device 800.

[0135] As shown in Figure 9 , the computing device cluster 900 includes at least one computing device 800. The memory 802 in one or more computing devices 800 in the computing device cluster 900 can have the same instructions for performing the processing method of application data described above.

[0136] In some possible implementations, the memory 802 in one or more computing devices 800 in the computing device cluster 900 can also respectively have partial instructions for performing the processing method of application data described above. In other words, the combination of one or more computing devices 800 can collectively execute the instructions for performing the processing method of application data described above.

[0137] It should be noted that the memory 802 in different computing devices 800 in the computing device cluster 900 can store different instructions, respectively for performing part of the functions of the processing device of application data described above. That is, the instructions stored in the memory 802 in different computing devices 800 can implement the functions of one or more modules in the processing unit and the transceiver unit.

[0138] In some possible implementations, one or more computing devices 800 in the computing device cluster 900 can be connected through a network. Wherein, the network can be a wide area network or a local area network, etc.

[0139] Referring to Figure 10 , Figure 10This is a schematic diagram of a computer cluster provided by an embodiment of the present application, wherein computer devices are connected via a network. Figure 10 As shown, computing device cluster 1000 includes computing device 800A and computing device 800B, and computing device 800A and computing device 800B are connected via a network. Specifically, the connection to the network is achieved through a communication interface in each computing device.

[0140] In one possible implementation, the memory of the computing device 800A stores instructions for executing the functions of the transceiver unit, while the memory of the computing device 800B stores instructions for executing the functions of the processing unit.

[0141] It should be understood that Figure 10 The functions of the computing device 800A shown in FIG. 8 may also be completed by multiple computing devices. Similarly, the functions of the computing device 800B may also be completed by multiple computing devices.

[0142] In another embodiment of the present application, a computer-readable storage medium is provided, in which computer-executable instructions are stored. When the processor of the device executes the computer-executable instructions, the device executes the method executed by the cloud phone system in the above method embodiment.

[0143] In another embodiment of the present application, a computer program product is provided, comprising computer-executable instructions stored in a computer-readable storage medium. When a processor of a device executes the computer-executable instructions, the device executes the method executed by the cloud phone system in the above method embodiment.

[0144] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0145] In the several embodiments provided in this application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0146] The units described as separate components may or may not be physically separate, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment scheme.

[0147] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can be physically present alone, or two or more units can be integrated in one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0148] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such understanding, the technical scheme of the present application essentially or the part that contributes to the prior art or the whole or part of the technical scheme can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, read-only memory), a random access memory (RAM, random access memory), a magnetic disk or an optical disk, and various program code storage media.

Claims

1. A method for processing application data, characterized in that: include: Receive a data loading request sent by a terminal device, wherein the data loading request is used to request to obtain application data from a cloud device; Monitoring data to be loaded based on a window loading monitoring module, wherein the data to be loaded includes the application data, and the application data contains sensitive information, and the window loading monitoring module is used to identify the sensitive information during the loading phase of the application data; Modify the sensitive information according to the permission information to obtain replacement data, where the replacement data includes desensitized content after replacing the sensitive information; The replacement data is sent to the terminal device so that the display interface of the terminal device displays the desensitized content.

2. The method according to claim 1, characterized in that The monitoring of the data to be loaded in the view object based on the window loading monitoring module includes: Intercepting the data to be loaded based on a view interceptor in the window loading monitoring module, wherein the view interceptor is used to intercept the data to be loaded at the application layer; Determine, according to the policy engine, a target policy for filtering the data to be loaded, wherein the target policy is used to filter the sensitive information, and the target policy includes one or more of the following: a regular expression policy, a feature vector matching policy, and a blacklist policy; Sensitive information in the data to be loaded is identified based on the target policy, and the sensitive information in the data to be loaded is determined.

3. The method according to claim 2, characterized in that The permission information includes terminal device permissions and user account permissions, and the method further includes: A hierarchical strategy for configuring the permission information is used to indicate one or more of the following: a mapping relationship between the terminal device permissions and the target policy, and a mapping relationship between the user account permissions and the target policy.

4. The method according to any one of claims 1 to 3, characterized in that After the window-based loading monitoring module monitors the data to be loaded in the view object, the method further includes: Analyzing the data to be loaded based on a semantic understanding model to determine that the data to be loaded contains one or more semantic features, wherein the semantic understanding model is used to convert the data to be loaded into a vector index, where the vector index indicates the semantic feature; Based on semantic matching between the sensitive semantic feature library and the one or more semantic features, it is determined that the data to be loaded contains the sensitive information, and the sensitive semantic feature library is used to indicate the content that needs to be desensitized.

5. The method according to any one of claims 1 to 4, characterized in that The method further comprises: When the permission information meets the permission level threshold, the sensitive information is released according to the permission information, so that the display interface of the terminal device displays the sensitive information.

6. The method according to any one of claims 1 to 5, characterized in that The application data is text data, and the modifying of the sensitive information according to the permission information includes: When the permission information does not meet the permission level threshold, the text data in the sensitive information is coded according to the permission information to obtain replacement data, where the replacement data includes a placeholder, and the text data in the sensitive information includes one or more of the following: financial data, customer name, and password.

7. The method according to any one of claims 1 to 6, characterized in that The application data is a combination of text data and image data, and the modifying of the sensitive information according to the permission information includes: When the permission information does not meet the permission level threshold, the text data in the sensitive information is coded according to the permission information, and the image data in the sensitive information is replaced to obtain replacement data, which includes a placeholder and a default icon.

8. A device for processing application data, characterized in that: include: A transceiver unit, configured to receive a data loading request sent by a terminal device, wherein the data loading request is used to request to obtain application data from a cloud device; a processing unit, configured to monitor data to be loaded based on a window loading monitoring module, wherein the data to be loaded includes the application data, and the application data contains sensitive information; the window loading monitoring module is configured to identify the sensitive information during the loading phase of the application data; and the view object is configured to display the application data on the terminal device; The processing unit is further configured to modify the sensitive information according to the permission information to obtain replacement data, wherein the replacement data includes desensitized content after replacing the sensitive information; The transceiver unit is further configured to send the replacement data to the terminal device so that the display interface of the terminal device displays the desensitized content.

9. The device according to claim 8, characterized in that The processing unit is used for: Intercepting the data to be loaded based on a view interceptor in the window loading monitoring module, wherein the view interceptor is used to intercept the data to be loaded at the application layer; Determine, according to the policy engine, a target policy for filtering the data to be loaded, wherein the target policy is used to filter the sensitive information, and the target policy includes one or more of the following: a regular expression policy, a feature vector matching policy, and a blacklist policy; Sensitive information in the data to be loaded is identified based on the target policy, and the sensitive information in the data to be loaded is determined.

10. The device according to claim 9, characterized in that The permission information includes terminal device permissions and user account permissions, and the processing unit is further configured to: A hierarchical strategy for configuring the permission information is used to indicate one or more of the following: a mapping relationship between the terminal device permissions and the target policy, and a mapping relationship between the user account permissions and the target policy.

11. The device according to any one of claims 8 to 10, characterized in that The processing unit is further configured to: Analyzing the data to be loaded based on a semantic understanding model to determine that the data to be loaded contains one or more semantic features, wherein the semantic understanding model is used to convert the data to be loaded into a vector index, where the vector index indicates the semantic feature; Based on semantic matching between the sensitive semantic feature library and the one or more semantic features, it is determined that the data to be loaded contains the sensitive information, and the sensitive semantic feature library is used to indicate the content that needs to be desensitized.

12. The device according to any one of claims 8 to 11, characterized in that The processing unit is specifically configured to: When the permission information meets the permission level threshold, the sensitive information is released according to the permission information, so that the display interface of the terminal device displays the sensitive information.

13. The device according to any one of claims 8 to 12, characterized in that The application data is text data, and the processing unit is specifically configured to: When the permission information does not meet the permission level threshold, the text data in the sensitive information is coded according to the permission information to obtain replacement data, where the replacement data includes a placeholder, and the text data in the sensitive information includes one or more of the following: financial data, customer name, and password.

14. The device according to any one of claims 8 to 13, characterized in that The application data is a combination of text data and image data, and the processing unit is specifically configured to: When the permission information does not meet the permission level threshold, the text data in the sensitive information is coded according to the permission information, and the image data in the sensitive information is replaced to obtain replacement data, which includes a placeholder and a default icon.

15. A computing device, characterized in that The computer comprises a processor coupled to a memory, wherein the processor is configured to store instructions. When the instructions are executed by the processor, the computing device performs the method according to any one of claims 1 to 7.

16. A computing device cluster, characterized in that: The system comprises at least one computing device, wherein the computing device comprises a processor coupled to a memory, and the processor is configured to store instructions. When the instructions are executed by the processor, the computing device cluster performs the method according to any one of claims 1 to 7.

17. A computer-readable storage medium having instructions stored thereon, characterized in that: When the instructions are executed, the computer is caused to perform the method according to any one of claims 1 to 7.

18. A computer program product comprising instructions, characterized in that: When the instructions are executed, the computer is caused to implement the method according to any one of claims 1 to 7.

Images