Dynamic information desensitization method and device, electronic equipment and storage medium

Abstract

The invention provides an information dynamic desensitization method and device, electronic equipment and a storage medium, and relates to the technical field of computers. The method comprises the following steps: judging an authority type of a terminal according to a preset desensitization rule base by responding to instruction information of the terminal; if the authority type of the terminal is a desensitization authority, a desensitization rule of query information is determined according to the preset desensitization rule base, and the query information is an object of instruction information query of the terminal; performing desensitization processing on the query information according to the desensitization rule, and determining desensitization data; and sending the desensitized data to the terminal. According to the method, desensitization processing is carried out in real time while the sensitive data are accessed, original data and files do not need to be modified or rewritten, and the problem that the original data are damaged due to static desensitization of the database is solved.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the technical field of computer, and particularly relates to an information dynamic desensitization method and device, electronic equipment and storage medium. BACKGROUND

[0002] With the rapid development of information technology, the security of database as the core component of information storage and processing is increasingly valued. In order to protect sensitive data in the database and prevent data leakage, database desensitization technology emerges as the times require. The technology generates desensitized data without actual meaning by converting or processing sensitive information in the database, thereby protecting privacy while meeting the needs of data analysis and sharing.

[0003] In the related art, a static desensitization method is adopted. Under a specified desensitization strategy, a data copy after desensitization is generated by initiating an instruction to perform one-time desensitization processing on the data in the database. One or more desensitized columns are then added to store the desensitized data or the desensitized data is directly replaced with the original column data. However, both methods involve direct modification of the original data file, which requires rewriting the file data on the disk. This operation method has a high risk. Once an error occurs, the data file will be damaged or unavailable, thereby threatening the security and integrity of the database.

[0004] It should be noted that the information disclosed in the above background section is only used to strengthen the understanding of the background of the present disclosure, and therefore can include information that does not constitute prior art known to those of ordinary skill in the art. SUMMARY

[0005] The present disclosure provides an information dynamic desensitization method, device, electronic equipment and storage medium, which at least partially overcomes the problem of original data damage caused by static desensitization of the database in the related art.

[0006] Other characteristics and advantages of the present disclosure will become apparent from the following detailed description, or will be learned by practice of the present disclosure.

[0007] According to one aspect of the present disclosure, an information dynamic desensitization method is provided, comprising: in response to instruction information of a terminal, determining a permission type of the terminal according to a preset desensitization rule library; if the permission type of the terminal is desensitization permission, determining a desensitization rule of query information according to the preset desensitization rule library, wherein the query information is an object of the instruction information of the terminal; performing desensitization processing on the query information according to the desensitization rule to determine desensitized data; and sending the desensitized data to the terminal.

[0008] In some embodiments, the permission type of the terminal is classified into a configuration permission, a desensitization permission, and a non-desensitization permission, wherein the configuration permission is used for configuring a desensitization rule, and the desensitization permission is associated with a desensitization rule.

[0009] In some embodiments, before the response to the instruction information of the terminal, the method further comprises: establishing a preset desensitization rule library according to a mapping relationship between a terminal identifier and a permission type; and associating a label with a preset desensitization rule in the preset desensitization rule library, wherein the label is of a permission type of desensitization permission.

[0010] In some embodiments, the method further comprises: if the permission type of the terminal is the configuration permission, caching a desensitization rule in the instruction information of the terminal; comparing the cached desensitization rule with a desensitization rule stored in the preset desensitization rule library to determine whether there is an identical desensitization rule; and if there is no identical desensitization rule, storing the cached desensitization rule into the preset desensitization rule library.

[0011] In some embodiments, the method further comprises: if the permission type of the terminal is the non-desensitization permission, sending the query information to the terminal.

[0012] In some embodiments, the desensitization processing of the query information according to the desensitization rule comprises: desensitization processing of request data corresponding to the instruction information according to at least one of a replacement rule, a shielding rule, and an encryption rule in the desensitization rule to determine desensitized data.

[0013] According to another aspect of the present disclosure, an information dynamic desensitization device is also provided, comprising: a permission type judgment module configured to determine a permission type of a terminal according to a preset desensitization rule library in response to instruction information of the terminal; a desensitization permission module configured to determine a desensitization rule of query information according to the preset desensitization rule library if the permission type of the terminal is a desensitization permission, wherein the query information is an object queried by the instruction information of the terminal; a desensitization processing module configured to desensitize the query information according to the desensitization rule to determine desensitized data; and a data sending module configured to send the desensitized data to the terminal.

[0014] According to another aspect of the present disclosure, an electronic device is also provided, comprising: a processor; and a memory configured to store executable instructions of the processor; wherein the processor is configured to execute the information dynamic desensitization method according to any one of the above by executing the executable instructions.

[0015] According to another aspect of the present disclosure, a computer readable storage medium is also provided, which stores a computer program. The computer program is executed by a processor to implement the information dynamic desensitization method according to any one of the above aspects.

[0016] According to another aspect of the present disclosure, a computer program product is also provided, which comprises a computer program. The computer program is executed by a processor to implement the information dynamic desensitization method according to any one of the above aspects.

[0017] The information dynamic desensitization method provided in the embodiments of the present disclosure comprises the following steps: judging a permission type of a terminal according to a preset desensitization rule library in response to instruction information of the terminal; if the permission type of the terminal is desensitization permission, determining a desensitization rule of query information according to the preset desensitization rule library, wherein the query information is an object of the instruction information of the terminal; performing desensitization processing on the query information according to the desensitization rule to determine desensitized data; and sending the desensitized data to the terminal. The present disclosure solves the problem of original data damage caused by static desensitization of a database by performing real-time desensitization processing while accessing sensitive data, without modifying or rewriting original data and files.

[0018] It should be understood that the foregoing general description and the following detailed description are only exemplary and explanatory, and are not limiting to the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0019] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and serve to explain the principles of the present disclosure. It is readily apparent to one of ordinary skill in the art that the accompanying drawings are merely examples of some embodiments of the present disclosure and other drawings can be obtained from the accompanying drawings without any creative effort.

[0020] Figure 1 FIG. 1 shows a schematic diagram of an information dynamic desensitization system structure according to an embodiment of the present disclosure;

[0021] Figure 2 FIG. 2 shows a flowchart of an information dynamic desensitization method according to an embodiment of the present disclosure;

[0022] Figure 3 FIG. 3 shows a flowchart of an information dynamic desensitization method according to a specific example of an embodiment of the present disclosure;

[0023] Figure 4 FIG. 4 shows a flowchart of an information dynamic desensitization method according to another specific example of an embodiment of the present disclosure;

[0024] Figure 5 FIG. 5 shows a schematic diagram of an information dynamic desensitization device according to an embodiment of the present disclosure;

[0025] Figure 6 A structural block diagram of a computer device in an embodiment of the present disclosure is shown.

[0026] Figure 7 A schematic diagram of a computer-readable storage medium in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0027] Example implementations are now described with reference to the drawings. Example implementations can, however, be implemented in many different forms and should not be construed as limited to the examples set forth herein; rather, these implementations are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the example implementations to those skilled in the art. Features described in the description, examples, or claims can be combined in any suitable manner in one or more implementations.

[0028] In addition, the drawings are only schematic and are non-limiting. Identical components have been given the same reference numerals in the various drawings and the same reference designators have been used throughout the drawings and the description for like components, and thus repetitive description is omitted for clarity. Some of the blocks in the drawings can be functional blocks that do not necessarily have a corresponding physical structure directly related to them. These blocks can be implemented in software or hardware, or a combination thereof.

[0029] To facilitate understanding, before introducing the embodiments of the present disclosure, several terms involved in the embodiments of the present disclosure are first explained as follows:

[0030] SQL: Structured Query Language, structured query language;

[0031] MDX: Multidimensional Expressions, a language for processing multidimensional databases;

[0032] AES: Advanced Encryption Standard, Advanced Encryption Standard;

[0033] RSA: Rivest-Shamir-Adleman, RSA encryption algorithm.

[0034] The specific embodiments of the embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0035] Figure 1 An exemplary application system architecture schematic diagram to which the information dynamic desensitization method in the embodiments of the present disclosure can be applied is shown. As shown in FIG. 1, the application system architecture includes a data source 101, a data processing platform 102, and a data consumer 103. Figure 1As shown, the system architecture can include a terminal device 101, a network 102 and a server 103.

[0036] The network 102 is a medium for providing a communication link between the terminal device 101 and the server 103, which can be a wired network or a wireless network.

[0037] Optionally, the wireless network or wired network described above uses standard communication technology and / or protocols. The network is usually the Internet, but can also be any network, including but not limited to a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a mobile, wired or wireless network, a private network or any combination of virtual private networks). In some embodiments, technologies and / or formats including Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML), etc. are used to represent data exchanged through the network. In addition, all or some links can be encrypted using conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPSec), etc. In other embodiments, custom and / or dedicated data communication technologies can be used instead of or in addition to the above data communication technologies.

[0038] The terminal device 101 can be various electronic devices, including but not limited to smartphones, tablets, laptop computers, desktop computers, smart speakers, smart watches, wearable devices, augmented reality devices, virtual reality devices, etc.

[0039] Optionally, the clients of the application programs installed in different terminal devices 101 are the same, or the clients of the same type of application programs based on different operating systems. Based on the difference of terminal platforms, the specific form of the client of the application program can also be different, for example, the application program client can be a mobile phone client, a PC client, etc.

[0040] The server 103 can be a server that provides various services, such as a background management server that provides support for operations performed by a user using the terminal device 101. The background management server can analyze and process received request data and the like, and feed back the processing result to the terminal device.

[0041] Optionally, the server can be a stand-alone physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and basic cloud computing services such as big data and artificial intelligence platforms.

[0042] In one example of the present disclosure, the server determines the permission type of the terminal according to a preset desensitization rule library in response to instruction information of the terminal.

[0043] If the permission type of the terminal is desensitization permission, the server determines a desensitization rule of query information according to the preset desensitization rule library, wherein the query information is an object of the instruction information of the terminal; the server desensitizes the query information according to the desensitization rule to determine desensitization data; and the server sends the desensitization data to the terminal.

[0044] Those skilled in the art can know that, Figure 1 The number of terminal devices, networks and servers in the present disclosure is only illustrative, and any number of terminal devices, networks and servers can be provided according to actual needs. The present disclosure does not limit this.

[0045] Figure 2 A flowchart of an information dynamic desensitization method in the present disclosure is shown in FIG. 1. Figure 2 As shown in FIG. 1, the information dynamic desensitization method provided in the present disclosure includes the following steps:

[0046] S202, in response to instruction information of the terminal, determining the permission type of the terminal according to a preset desensitization rule library.

[0047] It should be noted that the instruction information can be computer instructions, such as SQL and MDX, which are instruction sets for managing and operating a relational database. The permission type of the terminal can be an operation or a resource that the terminal can execute or access.

[0048] For example, in one specific example, the permission type of the terminal is divided into configuration permission, desensitization permission and non-desensitization permission, wherein the configuration permission is used to configure the desensitization rule, and the desensitization permission is associated with the desensitization rule.

[0049] It should be noted that the above configuration permission can be a configuration of data that different terminals can access and how to access.

[0050] It should be noted that the above desensitization permission can be a limited access permission that allows the terminal to access desensitized data but does not allow access to original sensitive data. For example, in the medical, financial or personal information processing field, sensitive personal identity information (such as name, identity card number, credit card number, etc.) needs to be desensitized, and then the terminal is authorized to access the desensitized data, rather than the original sensitive data.

[0051] It should be noted that the above non-desensitization permission can be a non-restricted access permission that allows the terminal to directly access the original sensitive data without any form of desensitization processing. For example, non-desensitization permission is authorized to terminals that need to directly process or analyze original data, such as data analysts, developers, or employees of specific business departments.

[0052] S204, if the permission type of the terminal is desensitization permission, determine the desensitization rule of the query information according to the preset desensitization rule library, wherein the query information is the object of the instruction information query of the terminal.

[0053] It should be noted that the above preset desensitization rule library can be a pre-defined and configured desensitization rule set, which includes desensitization rules for different permission types of terminals.

[0054] For example, when the database uses the first terminal to log in and query the "phone" field of the "person" table, since the desensitization level of the first terminal (level 1) is less than the desensitization level of the field "person. phone" (level 2), under the constraint of this security policy, the first terminal cannot directly view the original value of the field "person. phone", and the desensitization rule library follows the desensitization conditions and rules this time to determine that the "phone" queried by the first terminal uses the built-in defined masking number function (equivalent to the above desensitization rule).

[0055] S206, desensitizing the query information according to the desensitization rule to determine the desensitized data.

[0056] It should be noted that the above desensitization processing can be a conversion or modification of data to prevent sensitive data leakage. For example, desensitization processing can include partial desensitization, obfuscation desensitization, masking desensitization, and replacement desensitization.

[0057] For example, using the built-in defined masking number function, all returned "phone" values are partially shielded, realizing dynamic desensitization for different security levels of users and different data.

[0058] S208, send the desensitized data to the terminal.

[0059] For example, the first terminal queries the "telephone number" of "user A", and since the first terminal has the desensitization permission, the desensitized telephone number "111****1111" of user A is sent to the first terminal.

[0060] The present disclosure solves the problem of original data damage caused by static desensitization of the database by performing desensitization in real time while accessing sensitive data without modifying or rewriting the original data and files.

[0061] In an embodiment of the present disclosure, as shown in Figure 3 The information dynamic desensitization method provided in the embodiment of the present disclosure can determine the preset desensitization rule base before responding to the instruction information of the terminal by the following steps, which can improve the data processing efficiency:

[0062] S302, a preset desensitization rule base is established according to the mapping relationship between the terminal identifier and the permission type;

[0063] S304, the labels with the permission type of desensitization permission in the preset desensitization rule base are associated with the preset desensitization rules.

[0064] In an embodiment of the present disclosure, as shown in Figure 4 The information dynamic desensitization method provided in the embodiment of the present disclosure can update the desensitization rule base by the following steps, which can improve the scalability of the desensitization rule base:

[0065] S402, if the permission type of the terminal is the configuration permission, the desensitization rule in the instruction information of the terminal is cached;

[0066] S404, the cached desensitization rule is compared with the desensitization rule stored in the preset desensitization rule base to determine whether there is the same desensitization rule;

[0067] S406, if there is no same desensitization rule, the cached desensitization rule is stored in the preset desensitization rule base.

[0068] In an example of the present disclosure, if the permission type of the terminal is the non-desensitization permission, the query information is sent to the terminal. The present disclosure provides different data desensitization services for terminals with different permissions. For the terminal with non-desensitization permission, no additional desensitization processing is required for the data, which can reduce the time delay of data processing, so that the terminal with non-desensitization permission can receive and process the original query information in time, thereby accelerating the business decision and response speed.

[0069] In an example of the present disclosure, the query information is desensitized according to a desensitization rule, and the desensitized data is determined by desensitizing the request data corresponding to the instruction information according to at least one of the replacement rule, the masking rule, and the encryption rule in the desensitization rule. The present disclosure can set corresponding desensitization rules for different sensitive data, thereby guaranteeing data security while optimizing data storage and processing efficiency.

[0070] It should be noted that the above-mentioned replacement rule can replace the original sensitive data with a specified character or value. The above-mentioned masking rule can hide part of the sensitive data, such as replacing the middle several digits of a mobile phone number or an ID card number with “*”. The user can create a SQL function to achieve the desired masking effect. The encryption rule can use encryption algorithms such as AES and RSA to encrypt and convert the original sensitive data.

[0071] For example, each desensitization rule has a corresponding desensitization algorithm.

[0072] The replacement algorithm corresponding to the replacement rule is Function_Replace_String, which replaces the specified string in the field value with a custom string.

[0073] The masking algorithm corresponding to the masking rule is MaskPhone, which masks the middle 4 digits of the field data as a mobile phone number as “*”.

[0074] The encryption algorithm corresponding to the encryption rule is Function_AES, which uses the AES encryption algorithm to encrypt the value of the field and returns the ciphertext.

[0075] Specifically, in actual use, different desensitization rules can be created for multiple different fields of a database table. For example, for the name field, the replacement rule can be used to replace the real name with a random string; for the certificate number field, the masking rule can be used to dynamically mask part of the number information in the certificate number; and for the user's account password information, the encryption rule can be used directly to display the ciphertext.

[0076] Based on the same inventive concept, the present disclosure also provides an information dynamic desensitization device, as described in the following embodiments. Since the principles of the device embodiments solve the problem similar to the above-mentioned method embodiments, the implementation of the device embodiments can refer to the implementation of the above-mentioned method embodiments, and the repeated parts will not be repeated.

[0077] Figure 5 An information dynamic desensitization device is shown in the present disclosure, as shown in Figure 5 The device includes a permission type judgment module 51, a desensitization permission module 52, a desensitization processing module 53, and a data sending module 54.

[0078] The permission type judging module is configured to judge the permission type of the terminal according to a preset desensitization rule library in response to the instruction information of the terminal.

[0079] The desensitization permission module is configured to determine a desensitization rule of the query information according to the preset desensitization rule library if the permission type of the terminal is the desensitization permission, wherein the query information is an object of the instruction information of the terminal.

[0080] The desensitization processing module is configured to perform desensitization processing on the query information according to the desensitization rule to determine desensitization data.

[0081] The data sending module is configured to send the desensitization data to the terminal.

[0082] In an example of the present disclosure, the permission type of the terminal in the information dynamic desensitization device is divided into a configuration permission, a desensitization permission and a non-desensitization permission, wherein the configuration permission is used to configure a desensitization manner, and the desensitization permission is associated with a desensitization rule.

[0083] In an example of the present disclosure, the information dynamic desensitization device further comprises a desensitization rule library establishing module configured to establish a preset desensitization rule library according to a mapping relationship between a terminal identifier and a permission type, and associate a label with a preset desensitization rule in the preset desensitization rule library if the permission type is the desensitization permission.

[0084] In an example of the present disclosure, the desensitization permission module is further configured to cache a desensitization rule in the instruction information of the terminal if the permission type of the terminal is the configuration permission, compare the cached desensitization rule with a desensitization rule stored in the preset desensitization rule library to determine whether there is an identical desensitization rule, and store the cached desensitization rule to the preset desensitization rule library if there is no identical desensitization rule.

[0085] In an example of the present disclosure, the desensitization permission module is further configured to send the query information to the terminal if the permission type of the terminal is the non-desensitization permission.

[0086] In an example of the present disclosure, the desensitization processing module is further configured to perform desensitization processing on request data corresponding to the instruction information according to at least one rule of a replacement rule, a shielding rule and an encryption rule in the desensitization manner to determine desensitization data.

[0087] It should be noted that the above permission type determination module 51, desensitization permission module 52, desensitization processing module 53, and data sending module 54 correspond to S202-S208 in the method embodiment, and the above modules have the same examples and application scenarios as the corresponding steps, but are not limited to the content disclosed in the above method embodiment. It should be noted that the above modules as part of the device can be executed in a computer system such as a group of computer executable instructions.

[0088] Those skilled in the art can understand that various aspects of the present disclosure can be implemented as a system, a method or a program product. Therefore, various aspects of the present disclosure can be embodied as a complete hardware implementation, a complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, which can be collectively referred to as "circuitry", "module" or "system" here.

[0089] The electronic device 600 according to this embodiment of the present disclosure will be described below with reference to Figure 6 Figure 6 The electronic device 600 shown is merely an example and should not impose any limitation on the functions and use range of the embodiments of the present disclosure.

[0090] As shown in Figure 6 The components of the electronic device 600 can include, but are not limited to, the above-mentioned at least one processing unit 610, the above-mentioned at least one storage unit 620, and a bus 630 connecting different system components, including the storage unit 620 and the processing unit 610.

[0091] The storage unit stores program code that can be executed by the processing unit 610, so that the processing unit 610 performs the steps according to various exemplary embodiments of the present disclosure described in the above "Exemplary Method" section of the present specification.

[0092] For example, the processing unit 610 can execute the following steps of the above method embodiment: in response to the instruction information of the terminal, determining the permission type of the terminal according to the preset desensitization rule library; if the permission type of the terminal is desensitization permission, determining the desensitization rule of the query information according to the preset desensitization rule library, wherein the query information is the object of the instruction information of the terminal; performing desensitization processing on the query information according to the desensitization rule to determine desensitization data; and sending the desensitization data to the terminal.

[0093] For example, the processing unit 610 executes the steps of the above method embodiment, and the permission type of the terminal is divided into configuration permission, desensitization permission and non-desensitization permission, wherein the configuration permission is used to configure the desensitization mode, and the desensitization permission is associated with the desensitization rule.

[0094] ​For example, the processing unit 610 can perform the following steps of the above-mentioned method embodiments: establishing a preset desensitization rule library according to the mapping relationship between the terminal identifier and the permission type; and associating a label with a preset desensitization rule in the preset desensitization rule library, the label being of the desensitization permission type.

[0095] For example, the processing unit 610 can perform the following steps of the above-mentioned method embodiments: if the permission type of the terminal is the configuration permission, caching the desensitization rule in the instruction information of the terminal; comparing the cached desensitization rule with the desensitization rule stored in the preset desensitization rule library, and determining whether there is an identical desensitization rule; and if there is no identical desensitization rule, storing the cached desensitization rule into the preset desensitization rule library.

[0096] For example, the processing unit 610 can perform the following steps of the above-mentioned method embodiments: if the permission type of the terminal is the non-desensitization permission, sending the query information to the terminal.

[0097] For example, the processing unit 610 can perform the following steps of the above-mentioned method embodiments: performing desensitization processing on the request data corresponding to the instruction information according to at least one rule of the replacement rule, the shielding rule, and the encryption rule in the desensitization mode, to determine the desensitized data.

[0098] The storage unit 620 can include a readable medium in the form of a volatile storage unit, such as a random access memory (RAM) 6201 and / or a cache memory unit 6202, and can further include a read-only memory (ROM) 6203.

[0099] The storage unit 620 can further include a program / utility 6204 having a set of program modules 6205, including but not limited to an operating system, one or more application programs, other program modules, and program data, each of which can include an implementation of a network environment, or a combination of some of these examples.

[0100] The bus 630 can represent one or more of several types of bus structures, including a storage unit bus or storage unit controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of a variety of bus structures.

[0101] Electronic device 600 can also communicate with one or more external devices 640 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 600, and / or with any device that enables electronic device 600 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 650. Furthermore, electronic device 600 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 660. As shown, network adapter 660 communicates with other modules of electronic device 600 via bus 630. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 600, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0102] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0103] In particular, according to embodiments of this disclosure, the process described above with reference to the flowchart can be implemented as a computer program product, which includes a computer program that, when executed by a processor, implements the above-described dynamic information desensitization method.

[0104] In exemplary embodiments of this disclosure, a computer-readable storage medium, such as... Figure 7 As shown, the computer-readable storage medium 700 can be a readable signal medium or a readable storage medium. It stores a program product capable of implementing the methods described above. In some possible embodiments, various aspects of this disclosure can also be implemented as a program product including program code that, when run on a terminal device, causes the terminal device to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure.

[0105] For example, the program product in the embodiment of the present disclosure is executed by the processor to implement the method of the following steps: in response to the instruction information of the terminal, judging the permission type of the terminal according to the preset desensitization rule library; if the permission type of the terminal is desensitization permission, determining the desensitization rule of the query information according to the preset desensitization rule library, wherein the query information is the object of the instruction information of the terminal; performing desensitization processing on the query information according to the desensitization rule to determine the desensitization data; and sending the desensitization data to the terminal.

[0106] For example, the program product in the embodiment of the present disclosure is executed by the processor to implement the method of the following steps: the permission type of the terminal is divided into configuration permission, desensitization permission and non-desensitization permission, wherein the configuration permission is used to configure the desensitization mode, and the desensitization permission is associated with the desensitization rule.

[0107] For example, the program product in the embodiment of the present disclosure is executed by the processor to implement the method of the following steps: according to the mapping relationship between the terminal identifier and the permission type, establishing the preset desensitization rule library; and associating the label of the permission type being the desensitization permission in the preset desensitization rule library with the preset desensitization rule.

[0108] For example, the program product in the embodiment of the present disclosure is executed by the processor to implement the method of the following steps: if the permission type of the terminal is the configuration permission, caching the desensitization rule in the instruction information of the terminal; comparing the cached desensitization rule with the desensitization rule stored in the preset desensitization rule library to determine whether there is the same desensitization rule; and if there is no same desensitization rule, storing the cached desensitization rule to the preset desensitization rule library.

[0109] For example, the program product in the embodiment of the present disclosure is executed by the processor to implement the method of the following steps: if the permission type of the terminal is the non-desensitization permission, sending the query information to the terminal.

[0110] For example, the program product in the embodiment of the present disclosure is executed by the processor to implement the method of the following steps: according to at least one rule of the replacement rule, the shielding rule and the encryption rule in the desensitization mode, performing desensitization processing on the request data corresponding to the instruction information to determine the desensitization data.

[0111] More specific examples of the computer readable storage medium in the present disclosure can include, but are not limited to: an electrical connection with one or more conductive wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any appropriate combination of the above.

[0112] In the present disclosure, a computer readable storage medium can include a data signal transporting computer readable program code embodied in or carried by the signal. Such a data signal can be in any form, including but not limited to, electromagnetic, optical, microwave, laser, radio frequency signals, or any suitable combination thereof. A data signal can be transported using any suitable medium, including but not limited to, wireline, wireless, optical fiber cable, RF, and others.

[0113] Optionally, program code embodied on a computer readable storage medium can be transmitted by any data transmission techniques, including but not limited to, radio frequency, microwave, infrared, laser, cable, and others.

[0114] In an implementation, the program code for carrying out operations of the present disclosure can be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C++, and the like, and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code can execute entirely on the user's computing device, partly on the user's computing device, as a stand-alone software package, partly on the user's computing device and partly on a remote computing device or entirely on the remote computing device or server. In the latter scenario, the remote computing device can be connected to the user's computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computing device, such as through the Internet using an Internet Service Provider (ISP).

[0115] It should be noted that although several modules or units of the device for action execution are mentioned in the above detailed description, such a division is not mandatory. Indeed, features and functionalities of two or more modules or units described above can be embodied in one module or unit according to embodiments of the present disclosure. Conversely, features and functionalities of one module or unit described above can be further divided into multiple modules or units embodied.

[0116] Moreover, although the various steps of the methods in the present disclosure are described in a particular order in the figures, this is not required or implied in any way as to the order of the steps or that all illustrated steps be performed to achieve desirable results. Additionally or alternatively, certain steps can be omitted, combined into fewer steps, performed in an order other than that described, and / or split into multiple steps performed at different times, etc.

[0117] Through the description of the above embodiments, those skilled in the art can easily understand that the example embodiments described herein can be implemented by software, or by software in combination with necessary hardware. Therefore, the technical solutions according to the embodiments of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash disk, a mobile hard disk, or the like) or a network, and includes a number of instructions to make a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) execute the methods according to the embodiments of the present disclosure.

[0118] Other embodiments of the present disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the features disclosed herein. The present disclosure is intended to cover any variations, uses, or adaptations of the present disclosure following the general principles thereof and including such departures from the present disclosure that come within known use or custom of the art to which the present disclosure pertains. The specification and examples are to be regarded as illustrative only, and the true scope and spirit of the present disclosure are indicated by the appended claims.

Claims

1. A method for dynamic information desensitization, characterized in that, The method comprises: in response to the instruction information of the terminal, determining the permission type of the terminal according to a preset desensitization rule library; if the permission type of the terminal is desensitization permission, determining the desensitization rule of the query information according to the preset desensitization rule library, wherein the query information is the object of the instruction information query of the terminal; performing desensitization processing on the query information according to the desensitization rule to determine desensitization data; sending the desensitization data to the terminal.

2. The information dynamic desensitization method of claim 1, wherein, The permission type of the terminal is divided into configuration permission, desensitization permission and non-desensitization permission, wherein the configuration permission is used to configure the desensitization rule, and the desensitization permission is associated with the desensitization rule.

3. The information dynamic desensitization method of claim 2, wherein, Before the response to the instruction information of the terminal, the method further comprises: establishing a preset desensitization rule library according to the mapping relationship between the terminal identifier and the permission type; associating the label of the permission type as desensitization permission in the preset desensitization rule library with the preset desensitization rule.

4. The information dynamic de-sensitizing method of claim 2, wherein, The method further comprises: if the permission type of the terminal is configuration permission, caching the desensitization rule in the instruction information of the terminal; comparing the cached desensitization rule with the desensitization rule stored in the preset desensitization rule library to determine whether there is the same desensitization rule; if there is no same desensitization rule, storing the cached desensitization rule into the preset desensitization rule library.

5. The information dynamic de-sensitizing method of claim 2, wherein, The method further comprises: if the permission type of the terminal is non-desensitization permission, sending the query information to the terminal.

6. The information dynamic desensitization method according to any one of claims 1 to 5, characterized in that, The desensitization processing on the query information according to the desensitization rule to determine the desensitization data comprises: performing desensitization processing on the request data corresponding to the instruction information according to at least one rule of the replacement rule, the shielding rule and the encryption rule in the desensitization rule to determine the desensitization data.

7. An information dynamic desensitization device, characterized in that, The method comprises: a permission type judgment module, configured to determine the permission type of the terminal according to a preset desensitization rule library in response to the instruction information of the terminal; a desensitization permission module, configured to determine the desensitization rule of the query information according to the preset desensitization rule library if the permission type of the terminal is desensitization permission, wherein the query information is the object of the instruction information query of the terminal; a desensitization processing module, configured to perform desensitization processing on the query information according to the desensitization rule to determine desensitization data; a data sending module, configured to send the desensitization data to the terminal.

8. An electronic device, comprising: The method comprises: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute the executable instructions to perform the information dynamic desensitization method in any one of claims 1 to 6.

9. A computer readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the information dynamic desensitization method in any one of claims 1 to 6.

10. A computer program product, comprising: Computer program or instructions, characterized in that the computer program or instructions are executed by the processor to implement the information dynamic desensitization method in any one of claims 1 to 6.

Images