Sensitive data query method, electronic equipment, storage medium and computer program product

Abstract

The embodiment of the invention provides a data query method for sensitive data, electronic equipment, a storage medium and a computer program product, in the embodiment of the invention, when an access terminal queries the sensitive data in a database system, the database system sequentially desensitizes and encrypts the sensitive data. Therefore, an encryption and desensitization superposed data protection scheme is provided, the encrypted desensitization data flows out of the database system, and the desensitization data instead of sensitive data is obtained by decryption of the access terminal. On one hand, the sensitive data is protected through encryption in the data transmission process, and on the other hand, the access terminal obtains the desensitized data instead of the sensitive data, so that the risk of sensitive data leakage is effectively reduced.

Description

Technical Field

[0001] This application relates to the field of data security technology, and in particular to a data query method for sensitive data, an electronic device, a storage medium, and a computer program product. Background Technology

[0002] Currently, database systems often store sensitive data. To effectively protect this sensitive data, upon receiving an access request from a terminal, the database system encrypts the requested data to obtain ciphertext data, which is then transmitted to the terminal. This reduces the probability of sensitive data being leaked during data transmission. However, the ciphertext data is then decrypted at the terminal and presented in plaintext. Thus, even though the data is protected through encryption during transmission, the risk of sensitive data leakage still exists during the data processing stage after decryption at the terminal. Summary of the Invention

[0003] This application provides a data query method, electronic device, storage medium, and computer program product for sensitive data, which effectively reduces the risk of sensitive data leakage.

[0004] This application provides a data query method for sensitive data, applied to a database system. The method includes: responding to a query request from an access terminal, querying field data of a target sensitive field in the database system; performing desensitization processing on the field data of the target sensitive field to obtain a desensitization result; encrypting the desensitization result to obtain a ciphertext desensitization result; and sending the ciphertext desensitization result to the access terminal for the access terminal to decrypt the ciphertext desensitization result to obtain the desensitization result.

[0005] This application provides an electronic device, including: a memory and a processor; the memory for storing a computer program; and the processor coupled to the memory for executing the computer program to perform steps in a data query method for sensitive data.

[0006] This application provides a computer-readable storage medium storing a computer program, which, when executed by a processor, enables the processor to implement the steps in a data query method for sensitive data.

[0007] This application provides a computer program product, including a computer program / instruction, which, when executed by a processor, enables the processor to implement the steps in a data query method for sensitive data.

[0008] This application provides a method for querying sensitive data, an electronic device, a storage medium, and a computer program product. In this application, when an access terminal queries sensitive data in a database system, the database system sequentially performs de-identification and encryption processing on the sensitive data. Therefore, a data protection scheme combining encryption and de-identification is provided. The data flowing from the database system is encrypted and de-identified, and the access terminal decrypts the de-identified data, not the sensitive data. On the one hand, sensitive data is protected through encryption during data transmission; on the other hand, the access terminal obtains de-identified data, not sensitive data, effectively reducing the risk of sensitive data leakage. Attached Figure Description

[0009] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0010] Figure 1 A schematic diagram illustrating an application scenario provided in an embodiment of this application;

[0011] Figure 2 Signaling interaction diagram of a data query method for sensitive data provided in an embodiment of this application;

[0012] Figure 3 A flowchart illustrating a data query method for sensitive data provided in this application embodiment;

[0013] Figure 4 A system architecture diagram applicable to the exemplary data query method for sensitive data provided in the embodiments of this application;

[0014] Figure 5 Signaling interaction diagram of another sensitive data query method provided in the embodiments of this application;

[0015] Figure 6 This is a schematic diagram of the structure of a data processing device provided in an embodiment of this application;

[0016] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0018] In the embodiments of this application, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the access relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, or B alone, where A and B can be singular or plural. In the textual description of this application, the character " / " generally indicates that the preceding and following related objects have an "or" relationship. Furthermore, in the embodiments of this application, "first," "second," "third," etc., are only used to distinguish the content of different objects and have no other special meaning. Currently, database systems often store sensitive data. To effectively protect sensitive data, after receiving an access request from an access terminal, the database system encrypts the data requested by the access terminal to obtain ciphertext data, and transmits the ciphertext data to the access terminal, thereby reducing the probability of sensitive data being leaked during data transmission. However, the ciphertext data is presented in plaintext form after being decrypted by the access terminal. Thus, even if the data is protected through encryption during data transmission, there is still a risk of sensitive data leakage during the data processing stage after decryption at the access terminal.

[0019] In view of this, embodiments of this application provide a data query method, electronic device, storage medium, and computer program product for sensitive data. In these embodiments, when an access terminal queries sensitive data in a database system, the database system sequentially performs desensitization and encryption processing on the sensitive data. This provides a data protection scheme that combines encryption and desensitization. The data flowing from the database system is encrypted and desensitized, and the access terminal decrypts the desensitized data, not the sensitive data. On the one hand, sensitive data is protected through encryption during data transmission; on the other hand, the access terminal obtains desensitized data, not sensitive data, effectively reducing the risk of sensitive data leakage.

[0020] Figure 1This diagram illustrates an application scenario provided by an embodiment of this application. In practical applications, a database table includes multiple fields, each of which is a data unit storing a specific type of data. Among the fields provided by a database table, there are often some sensitive fields. For example, in an employee information table, "name," "age," "gender," "date of employment," and "salary" are all sensitive fields. To reduce the risk of sensitive data leakage, relevant rule configuration personnel, such as database administrators, can configure sensitive rules for these fields. Sensitive rules can be flexibly configurable rules to protect sensitive data as needed. Sensitive rules include, but are not limited to, optional custom de-identification algorithms, system default de-identification algorithms, custom encryption algorithms, system default encryption algorithms, and authorized user lists for sensitive fields. Custom de-identification algorithms refer to de-identification algorithms whose algorithm parameters can be customized by the accessing user, while system default de-identification algorithms have fixed algorithm parameters. Custom encryption algorithms refer to encryption algorithms whose algorithm parameters can be customized by the accessing user, while system default encryption algorithms have fixed algorithm parameters. The visibility of sensitive fields can vary for different accessing users. Specifically, some users only have permission to view a portion of the data in sensitive fields, meaning the sensitive fields are partially visible to them. Some users have no permission to view any sensitive field data, meaning the sensitive fields are completely invisible to them. Other users have permission to view all the data in sensitive fields, meaning the sensitive fields are fully visible to them. Rule configurers can configure corresponding authorized user lists for sensitive fields as needed. Authorized users in these lists have permission to view all or part of the data in sensitive fields. It's understandable that if a user is not in the authorized user list, they do not have permission to view the data in sensitive fields. Optionally, default permissions can be set for users not in the authorized user list. These default permissions can be flexibly set as needed, for example, including but not limited to: no permission to view sensitive field data, permission to view part of the sensitive field data, or permission to view all of the sensitive field data, etc.

[0021] In practical applications, such as Figure 1 As shown in ① and ②, the rule configuration personnel perform the configuration operation of configuring sensitive rules for sensitive fields on the configuration terminal, and trigger the configuration terminal to send the sensitive rules to the database system so that the database system can save the sensitive rules locally. Thus, the configuration process of sensitive rules is completed.

[0022] During the data access phase, see Figure 1In steps ③ and ④, the database system responds to query requests sent by accessing users' terminals, retrieving sensitive data (i.e., the field data of the requested sensitive fields). Based on sensitivity rules, the database system determines whether the sensitive data needs to be de-identified. If de-identification is required, the sensitive data is de-identified and then encrypted sequentially to obtain the ciphertext sensitive data. See also... Figure 1 As shown in ⑤ and ⑥, the database system sends encrypted sensitive data to the access terminal, which then decrypts the encrypted data to obtain the de-identified data. In this way, the access terminal displays de-identified data, not sensitive data, significantly reducing the probability of sensitive data leakage. Of course, if the accessing user is authorized to view all sensitive data, meaning the sensitive data is fully visible to the user, then the database system, based on sensitivity rules, determines that de-identification of the sensitive data is unnecessary. Instead, it can simply encrypt the sensitive data, obtaining the encrypted result, which the access terminal then decrypts to obtain the sensitive data.

[0023] The technical solutions of this application and how they solve the aforementioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The technical solutions provided by each embodiment of this application are described in detail below with reference to the accompanying drawings.

[0024] Figure 2 This is a signaling interaction diagram of a data query method for sensitive data provided in an embodiment of this application. See also... Figure 2 The method may include the following steps:

[0025] 201. The access terminal sends a query request to the database system.

[0026] 202. In response to a query request from an access terminal, the database system queries the field data of the target sensitive field within the database system.

[0027] 203. The database system performs data anonymization on the target sensitive fields to obtain the anonymization results.

[0028] 204. The database system encrypts the de-identified results to obtain ciphertext de-identified results.

[0029] 205. The database system sends the encrypted and de-identified results to the access terminal.

[0030] 206. Access the terminal to decrypt the encrypted de-identified result and obtain the de-identified result.

[0031] In practical applications, an access terminal can be understood as a client of a database system. A client can be any device or application capable of initiating requests and interacting with the database system to access and manipulate data. Access terminals include, but are not limited to, terminal devices such as desktop computers, personal computers, smartphones, tablets, in-vehicle devices, or IoT devices. Of course, an access terminal can also be an application installed on a terminal device; there are no restrictions on this.

[0032] In practical applications, database systems include, but are not limited to, relational databases, non-relational databases, cloud-native databases, or data warehouses. Which fields in the database tables provided by the database system are sensitive and which are not can be flexibly specified as needed; there are no restrictions on this.

[0033] In practical applications, when a data accessor (also known as an access user) has a query requirement for data in a database system, the access user's terminal sends a query request to the database system. Typically, a query request can include the field name of the field to be queried, such as "Name," "Age," "Gender," "Date of Employment," or "Salary." For example, an SQL (Structured Query Language) query request would be `SELECT Name FROM Employee Information Table`, meaning it would search for the "Name" field in the employee information table. In response to the received query request from the access terminal, the database system can determine whether the requested field is a sensitive field. If the requested field is not a sensitive field, the database system can provide the access terminal with the field data of the queried field. If the requested field is a sensitive field, the database system performs data protection processing on the queried sensitive field data and provides the data of the sensitive field with the protected field to the access terminal.

[0034] Alternatively, the query requests sent by the access terminal are encrypted. When the database system executes the query request, it needs to decrypt the encrypted query request first to improve the security of data access.

[0035] For ease of understanding and distinction, the sensitive fields requested by the access terminal are referred to as target sensitive fields. In practical applications, there are no restrictions on the methods of data protection processing for the target sensitive field data. For example, data protection processing for the target sensitive field data could involve simply performing de-identification processing. Another example is that data protection processing for the target sensitive field data could involve simply performing encryption processing. Unlike traditional TLS (Transport Layer Security) encryption, where plaintext data is visible at intermediate nodes in the link, this application embodiment only makes the plaintext data visible to the access terminal. TLS encryption keys are randomly and automatically generated by the communication session and are not controllable by the user, while this application embodiment uses a user-manageable key, and only the key holder can decrypt the data. For another example, data protection processing for the target sensitive field data could involve sequentially performing de-identification and encryption processing on the target sensitive field data. Understandably, compared to simply performing desensitization or encryption on sensitive data, applying both desensitization and encryption as dual data protection measures can more effectively reduce the risk of sensitive data leakage.

[0036] In practical applications, database systems can employ any data masking algorithm to mask data in target sensitive fields without restriction. Further, to enhance the flexibility and reliability of the data masking process and more effectively reduce the risk of sensitive data leakage, it is also possible to flexibly configure custom data masking algorithms and the system default algorithm for different sensitive fields as needed. Custom data masking algorithms are those whose algorithm parameters can be customized by the user, thus meeting the diverse data masking needs of different users, ranging from minimal to deep privacy protection. The system default data masking algorithm has fixed parameters, thus providing a safety net to ensure the reliability of the data masking process.

[0037] In the embodiments of this application, the de-identification algorithms include, but are not limited to: replacement de-identification algorithms, mask de-identification algorithms, hash algorithms, encryption algorithms, etc.

[0038] The replacement desensitization algorithm can replace part or all of the content in sensitive data with non-sensitive content. For example, it can replace a real name with "anonymous user" or replace the last four digits of a phone number with "****". The replacement desensitization algorithm can be user-defined by parameters such as, but not limited to, replacement pattern, replacement length, and retention position. The replacement pattern defines which non-sensitive content to use for replacement, including but not limited to: asterisks (*), random characters, and fixed characters. The replacement length determines how many digits to replace; for example, a phone number might only display the first three and last four digits, with asterisks used to replace the rest. The retention position determines which characters are not retained and which are replaced.

[0039] Masking algorithms can replace part or all of the content in sensitive data with specific characters (such as asterisks *, X) or other placeholders to hide some sensitive information in the data. Masking algorithms are suitable for data with fixed formats, such as phone numbers, credit card numbers, or ID card numbers. The algorithm parameters can be user-defined, including but not limited to: mask pattern, mask length, and reserved bit position. The mask pattern defines which non-sensitive content is used for masking, such as asterisks (*), random characters, and fixed characters. The mask length determines how many digits are used for the mask; for example, a phone number might only display the first three and last four digits, with the middle part masked. The reserved bit position determines which characters are not retained and which are masked.

[0040] Hash algorithms use hash functions to convert sensitive data into fixed-length, irreversible hash values, thereby protecting data privacy. Hash algorithms can be user-defined, with parameters including but not limited to: hash algorithm type, salt, number of iterations, etc. Hash algorithm types include, but are not limited to: SHA-1 (Secure Hash Algorithm 1) and SHA-256 (Secure Hash Algorithm 256). Salt can be added to increase hash uniqueness; increasing the number of iterations enhances security.

[0041] When used as a de-identification algorithm, encryption algorithms protect sensitive data by encrypting it. The encryption algorithm can be defined by user-defined parameters, including but not limited to: key, key derivation function, encryption algorithm type, etc. Encryption algorithm types include, but are not limited to: symmetric encryption algorithms, asymmetric encryption algorithms, etc.

[0042] In practical applications, when configuring custom and / or system default de-identification algorithms for sensitive fields, different algorithms can be configured based on the data type and / or sensitivity level of the sensitive field. For example, a replacement de-identification algorithm can be used for numeric sensitive fields; a masking de-identification algorithm can be used for text sensitive fields. The higher the sensitivity level of the sensitive field, the higher the security strength of the corresponding de-identification algorithm. For example, arranged in order of sensitivity level from low to high, the fields are: name, salary, and account password. The name field can be partially masked, the salary field can be fully masked, and the account password field can be de-identified using a hash algorithm, etc.

[0043] Based on the above, optionally, the field data of the target sensitive field can be de-identified to obtain the de-identification result as follows: if the accessing user has configured a corresponding custom de-identification algorithm for the target sensitive field, then the custom de-identification algorithm is used to de-identify the field data of the target sensitive field to obtain the de-identification result; if the accessing user has not configured a corresponding custom de-identification algorithm for the target sensitive field, then the system default de-identification algorithm pre-configured for the target sensitive field is used to de-identify the field data of the target sensitive field to obtain the de-identification result.

[0044] In practical applications, there are no restrictions on how the database system determines whether a user has configured a custom masking algorithm for the target sensitive field. For example, the database system may pre-store the correspondence between users, sensitive fields, and custom masking algorithms. If the database system finds that the user initiating the query request has configured a custom masking algorithm for the target sensitive field, then the database system confirms that the user has configured the corresponding custom masking algorithm. Otherwise, the database system confirms that the user has not configured a corresponding custom masking algorithm for the target sensitive field. As another example, if a user's query request includes a custom masking algorithm, the database system confirms that the user has configured the corresponding custom masking algorithm for the target sensitive field. Conversely, if a user's query request does not include a custom masking algorithm, the database system confirms that the user has configured the corresponding custom masking algorithm for the target sensitive field.

[0045] Optionally, to improve the flexibility of data masking and meet diverse masking needs, the database system can determine whether a user has configured a custom data masking algorithm for the target sensitive field by checking whether the query request retrieves the data masking algorithm configuration information. Specifically, if the database system retrieves the data masking algorithm configuration information from the query request (including the identifier and parameters of the custom data masking algorithm), it writes the corresponding algorithm parameters into the custom data masking algorithm template based on the identifier, thus obtaining the custom data masking algorithm. If the database system does not retrieve the data masking algorithm configuration information from the query request, it determines that the user has not configured a custom data masking algorithm for the target sensitive field.

[0046] In practical applications, database systems can store default desensitization algorithms pre-configured by relevant personnel for each sensitive field, as well as multiple optional custom desensitization algorithm templates. A custom desensitization algorithm template can be understood as a custom desensitization algorithm without configured algorithm parameters. A custom desensitization algorithm template includes one or more fields; filling in one or more algorithm parameters into the corresponding fields yields the custom desensitization algorithm.

[0047] In practical applications, the database system can send identifiers of optional custom de-identification algorithms configured for target sensitive fields to the access terminal. The access terminal can then select an identifier for a custom de-identification algorithm from the available identifiers and configure the de-identification algorithm information for the target field based on the selected identifier. When configuring the de-identification algorithm information for the target field based on the selected identifier, the access terminal can respond to the user's configuration operation, configuring the corresponding algorithm parameters for the selected custom de-identification algorithm, and generating the de-identification algorithm configuration information based on the selected identifier and its corresponding algorithm parameters.

[0048] When an access terminal initiates a query request, it can include the de-identification algorithm configuration information. This information instructs the database system to specify the identifier and parameters of the custom de-identification algorithm selected by the user for the target sensitive fields. The database system then selects the corresponding custom de-identification algorithm template based on the identifier in the configuration information and fills in the algorithm parameters from the configuration information into the template, thus obtaining the custom de-identification algorithm.

[0049] In this embodiment, if the query request sent by the access terminal does not carry the de-identification algorithm configuration information, it is determined that the access user has not configured the corresponding custom de-identification algorithm for the target sensitive field. In this case, the database system can obtain the system default de-identification algorithm pre-configured for the target sensitive field to perform de-identification processing on the field data of the target sensitive field and obtain the de-identification result.

[0050] In practical applications, database systems can configure the same or different encryption algorithms for different fields without restriction. Database systems can encrypt data in any field, including sensitive fields, without limitation.

[0051] In this embodiment, the de-identification result obtained by de-identifying the data of the target sensitive fields is encrypted using an encryption algorithm to obtain a ciphertext de-identified result. The database system can use any encryption algorithm to encrypt the de-identified result without restriction. Further optionally, to improve the flexibility and reliability of encryption processing and more effectively reduce the risk of sensitive data leakage, it also supports flexible configuration of custom encryption algorithms and system default encryption algorithms for different sensitive fields as needed. Custom encryption algorithms refer to encryption algorithms whose algorithm parameters can be customized by the accessing user. Therefore, custom encryption algorithms can meet the diverse encryption needs of different accessing users, ranging from mild privacy protection to deep privacy protection. The system default encryption algorithm is an encryption algorithm with fixed algorithm parameters. Therefore, the system default encryption algorithm serves as a fallback for encryption processing, ensuring the reliability of the encryption process.

[0052] Based on the above, alternatively, the de-identification result can be encrypted to obtain the ciphertext de-identification result as follows: if the accessing user configures a corresponding custom encryption algorithm for the target sensitive field, the de-identification result is encrypted using the custom encryption algorithm to obtain the ciphertext de-identification result; if the accessing user does not configure a corresponding custom encryption algorithm for the target sensitive field, the de-identification result is encrypted using the system default encryption algorithm pre-configured for the target sensitive field to obtain the ciphertext de-identification result.

[0053] In practical applications, there are no restrictions on how the database system determines whether an accessing user has configured a corresponding custom encryption algorithm for the target sensitive field. For example, the database system may pre-store the correspondence between accessing users, sensitive fields, and custom encryption algorithms. If the database system finds that the accessing user initiating the query request has configured a custom encryption algorithm for the target sensitive field, then the database system confirms that the accessing user has configured the corresponding custom encryption algorithm for the target sensitive field; otherwise, the database system confirms that the accessing user has not configured a corresponding custom encryption algorithm for the target sensitive field. As another example, if the query request initiated by the accessing user carries a custom encryption algorithm, the database system confirms that the accessing user has configured the corresponding custom encryption algorithm for the target sensitive field. Conversely, if the query request initiated by the accessing user does not carry a custom encryption algorithm, the database system confirms that the accessing user has configured the corresponding custom encryption algorithm for the target sensitive field.

[0054] Optionally, to improve the flexibility of encryption processing and meet diverse encryption needs, the database system can determine whether the accessing user has configured a corresponding custom encryption algorithm for the target sensitive field by checking whether the encryption algorithm configuration information is parsed from the query request. Specifically, in response to parsing the encryption algorithm configuration information from the query request, which includes the identifier and algorithm parameters of the custom encryption algorithm, the database system writes the corresponding algorithm parameters into the custom encryption algorithm template based on the identifier of the custom encryption algorithm to obtain the custom encryption algorithm; in response to not parsing the encryption algorithm configuration information from the query request, the database system determines that the accessing user has not configured a corresponding custom encryption algorithm for the target sensitive field.

[0055] In practical applications, database systems can store default encryption algorithms pre-configured for various sensitive fields by relevant personnel, as well as multiple optional custom encryption algorithm templates. A custom encryption algorithm template can be understood as a custom encryption algorithm without configured algorithm parameters. A custom encryption algorithm template includes one or more fields; filling in one or more algorithm parameters into the corresponding fields in the custom encryption algorithm template yields the custom encryption algorithm.

[0056] In practical applications, the database system can send identifiers of optional custom encryption algorithms configured for target sensitive fields to the access terminal. The access terminal can then select an identifier for a custom encryption algorithm from the available identifiers and configure the encryption algorithm configuration information for the target encrypted field based on the selected identifier. When configuring the encryption algorithm configuration information for the target encrypted field based on the selected identifier, the access terminal can respond to the user's configuration operation, configure the corresponding algorithm parameters for the selected custom encryption algorithm, and generate the encryption algorithm configuration information based on the selected identifier and its corresponding algorithm parameters.

[0057] When an access terminal initiates a query request, it can include encryption algorithm configuration information. This information informs the database system of the identifier and parameters of the custom encryption algorithm selected by the user for the target sensitive field. The database system selects the corresponding custom encryption algorithm template based on the identifier in the configuration information and fills in the algorithm parameters from the configuration information into the template, thus obtaining the custom encryption algorithm.

[0058] In this embodiment, if the query request sent by the access terminal does not carry encryption algorithm configuration information, it is determined that the access user has not configured the corresponding custom encryption algorithm for the target sensitive field. In this case, the database system can obtain the system default encryption algorithm pre-configured for the target sensitive field to encrypt the de-identification result and obtain the ciphertext de-identification result.

[0059] The data query method for sensitive data provided in this application involves the database system sequentially de-identifying and encrypting the sensitive data when an access terminal queries it. This provides a data protection scheme that combines encryption and de-identification. The data flowing from the database system is encrypted and de-identified, and the access terminal decrypts the de-identified data, not the sensitive data. On one hand, sensitive data is protected through encryption during data transmission; on the other hand, the access terminal obtains de-identified data, not sensitive data, effectively reducing the risk of sensitive data leakage.

[0060] In some optional embodiments, sensitive fields can also be protected by combining their visibility to the accessing user corresponding to the access terminal. This improves the flexibility of sensitive data protection while ensuring the security of sensitive data. The following section will further elaborate on this. Figure 3 This section introduces another method for querying sensitive data.

[0061] Figure 3 A flowchart illustrating a data query method for sensitive data provided in an embodiment of this application. This method is applied to a database system; see [link to relevant documentation]. Figure 3 The method may include the following steps:

[0062] 301. In response to a query request from the access terminal, query the field data of the target sensitive field in the database system.

[0063] 302. Identify the visibility of the target sensitive field to the accessing user corresponding to the access terminal, and proceed to step 303 or step 306.

[0064] In practical applications, the visibility of the same sensitive field can vary among different users, meaning different users have different viewing permissions for the same sensitive field. Specifically, the visibility of a sensitive field to a user can be categorized as follows: Full visibility, partial visibility, and complete invisibility. Full visibility means the user is authorized to access or view all data of the sensitive field; all data is completely transparent and visible to the user. Partial visibility means the user is authorized to access or view some data of the sensitive field; a portion of the data is transparent and visible, while the remaining portion is opaque and invisible. Complete invisibility means the user is not authorized to access or view any data of the sensitive field; all data is opaque and invisible to the user.

[0065] In practical applications, there are no restrictions on how a database system identifies the visibility of target sensitive fields to the corresponding users on the access terminals. For example, the database system analyzes a user's historical access data to identify the user's security risks. If the user's security risk is high, the target sensitive fields are completely invisible to the user; if the user's security risk is medium, the target sensitive fields are partially visible to the user; if the user's security risk is low, the target sensitive fields are visible to the user. As another example, the database system can set different visibility levels for different access time periods. After big data mining analysis, if the database system has a high security risk in the first access time period, the target sensitive fields are completely invisible to users who initiate query requests in the first access time period; if the database system has a moderate security risk in the second access time period, the target sensitive fields are partially visible to users who initiate query requests in the second access time period; if the database system has a low security risk in the second access time period, the target sensitive fields are completely invisible to users who initiate query requests in the third access time period.

[0066] Optionally, to better distinguish the visibility of target sensitive fields to accessing users and to efficiently and accurately control access to sensitive data, the method for identifying the visibility of target sensitive fields to accessing users corresponding to accessing terminals is as follows: Obtain the authorized user list configured for the target sensitive field, where the authorized user list includes the user identifiers of the first authorized user and the second authorized user. The target sensitive field is fully visible to the first authorized user and partially visible to the second authorized user. Match the accessing user's user identifier with the user identifiers in the authorized user list. Based on the matching result, identify the visibility of the target sensitive field to the accessing user.

[0067] In practical applications, when identifying the visibility of a target sensitive field to the accessing user corresponding to the accessing terminal based on the matching results, if the user identifier of the accessing user successfully matches the user identifier of the first authorized user, it is determined that the target sensitive field is fully visible to the accessing user; if the user identifier of the accessing user successfully matches the user identifier of the second authorized user, it is determined that the target sensitive field is partially visible to the accessing user; if the user identifier of the accessing user fails to match the user identifier in the list of authorized users, it is determined that the target sensitive field is completely invisible to the accessing user.

[0068] 303. If the target sensitive field is not visible to all or only partially visible to the accessing user, then the field data of the target sensitive field shall be de-identified to obtain the de-identification result.

[0069] In practical applications, if the target sensitive field is completely invisible to the accessing user, then all the field data of the target sensitive field is de-identified to obtain the de-identified result; if the target sensitive field is partially visible to the accessing user, then only the field data of the target sensitive field is de-identified to obtain the de-identified result.

[0070] 304. Encrypt the desensitized results to obtain ciphertext desensitized results.

[0071] 305. Send the encrypted de-identification result to the access terminal so that the access terminal can decrypt the encrypted de-identification result and obtain the de-identified result.

[0072] For more information on the desensitization, encryption, and decryption of data in the target sensitive fields, please refer to the relevant content in the foregoing embodiments, which will not be repeated here.

[0073] 306. If the target sensitive field is visible to all accessing users, then the field data of the target sensitive field is encrypted to obtain the encrypted result.

[0074] The methods for encrypting data in sensitive target fields and encrypting the desensitized data obtained from desensitizing sensitive target fields are similar or the same, and will not be elaborated further here.

[0075] 307. Send the encryption result to the access terminal so that the access terminal can decrypt the encryption result and obtain the field data of the target sensitive field.

[0076] In this embodiment, if the target sensitive fields are fully visible to the accessing user, the database system does not need to perform de-identification processing on the field data of the target sensitive fields; it only needs to perform encryption processing. In this way, after the accessing terminal decrypts the encryption result, it can obtain the field data of the target sensitive fields in plaintext form. It is understood that even if the accessing terminal can obtain the field data of the target sensitive fields in plaintext form, the security of this data protection scheme is still very high because the accessing user is an authorized user.

[0077] Of course, if the data protection processing for the target sensitive field is to only perform desensitization processing on the target sensitive field data, then if the target sensitive field is completely invisible or partially visible to the accessing user, the target sensitive field data will be desensitized, the desensitization result will be obtained, and the desensitization result will be sent to the accessing terminal; if the target sensitive field is completely visible to the accessing user, the target sensitive field data will be sent to the accessing terminal.

[0078] If the data protection processing for the target sensitive field is to only perform encryption processing on the target sensitive field data, then if the target sensitive field is not visible to the accessing user at all or only partially visible, the target sensitive field data is encrypted to obtain the encryption result, and the encryption result is sent to the accessing terminal; if the target sensitive field is fully visible to the accessing user, the target sensitive field data is sent directly to the accessing terminal.

[0079] The data query method for sensitive data provided in this application embodiment allows the database system to identify the visibility of sensitive data to the accessing user when the accessing terminal queries sensitive data in the database system. Based on the visibility identification result, the sensitive data is processed with differentiated data protection, which improves the flexibility of data protection for sensitive data while ensuring the security of sensitive data.

[0080] In the above embodiments, there are no restrictions on the methods used to configure the authorized user list, the system default de-identification algorithm, the system default encryption algorithm, the optional custom de-identification algorithm template, or the optional custom encryption algorithm template for sensitive fields in the database system. In practical applications, relevant configuration personnel, such as database administrators, can configure sensitive rules, which may include, but are not limited to: the authorized user list, the system default de-identification algorithm, the system default encryption algorithm, the optional custom de-identification algorithm template, or the optional custom encryption algorithm template for sensitive fields.

[0081] In practical applications, configuration personnel can configure corresponding sensitive rules for data objects at different granularities, such as databases, database tables, and columns, as needed. For example, they can configure uniform sensitive rules for each database, or uniform sensitive rules for each database table, or specific sensitive rules for specific column fields. Sensitive rules can instruct that sensitive field data should not be protected, or that sensitive field data should only be anonymized, or that sensitive field data should only be encrypted, or that sensitive field data should be both encrypted and anonymized.

[0082] In practical applications, the configuration terminal of the user sends sensitive rules to the database system for local storage. Optionally, to prevent unauthorized users from maliciously sending sensitive rules, the sensitive rules sent by the configuration terminal can be validated for legitimacy. Only after successful validation will the database system store the sensitive rules locally. Based on this, the database system responds to the sensitive rules and their signature information sent by the configuration terminal; it verifies the signature information, and if the signature verification is successful, it stores the sensitive rules locally. In practical applications, sensitive rules can be digitally signed to obtain their signature information.

[0083] In this embodiment, the configuration terminal can be any device or application capable of initiating requests and interacting with the database system to access and manipulate data. Configuration terminals include, but are not limited to, desktop computers, personal computers, smartphones, tablets, in-vehicle devices, or IoT devices. Of course, the configuration terminal can also be an application installed on a terminal device; there are no limitations on this.

[0084] To better understand the technical solutions provided in the embodiments of this application, the following is combined with... Figure 4 and Figure 5 Here is an example scenario.

[0085] Figure 4 In the system architecture shown, the client-side decryption component provides decryption functionality, the database system's security gateway (SecureGW) provides data protection, and the SQL query engine executes SQL queries. The security gateway is not limited to database systems; it can also be used in other application systems. See also... Figure 5 Users can specify sensitive rules for sensitive fields. These rules can be limited to encryption, de-identification, or a combination of both; there are no restrictions on which rules apply. The user's client sends the sensitive rules to the security gateway in the database system, which stores them locally. During data access, the user's client sends an SQL query to the SQL query engine in the database system. The SQL query engine executes the query, producing plaintext results. The security gateway then performs data protection processing on the plaintext query results based on the sensitive rules. For example, if the sensitive rule includes a de-identification algorithm, the plaintext query results are de-identified, resulting in plaintext de-identified results. If the sensitive rule includes an encryption algorithm, the plaintext de-identified results are encrypted, resulting in ciphertext de-identified results. The ciphertext de-identified results are then decrypted by the client's decryption component, yielding plaintext de-identified results, which are then provided to the user. Of course, sensitive rules may also not include de-identification or encryption algorithms, meaning no de-identification or encryption processing is required.

[0086] Figure 6 This is a schematic diagram of a data processing apparatus provided in an embodiment of this application. The apparatus can be composed of hardware and / or software, and can be applied to a database system. See also... Figure 6 The device may include:

[0087] The query module 61 is used to query the field data of the target sensitive field in the database system in response to the query request of the access terminal.

[0088] The desensitization module 62 is used to desensitize the field data of the target sensitive field to obtain the desensitization result;

[0089] Encryption module 63 is used to encrypt the de-identification result to obtain the ciphertext de-identification result;

[0090] The sending module 64 is used to send the encrypted de-identification result to the access terminal, so that the access terminal can decrypt the encrypted de-identification result and obtain the de-identification result.

[0091] Optionally, the above device further includes an identification module for identifying the visibility of the target sensitive field to the accessing user corresponding to the access terminal; then triggering the desensitization module 62 to perform desensitization processing on the field data of the target sensitive field to obtain the desensitization result.

[0092] Optionally, if the target sensitive field is not visible to the accessing user at all, the desensitization module 62 performs desensitization processing on all field data of the target sensitive field to obtain the desensitization result; if the target sensitive field is partially visible to the accessing user, the desensitization module 62 performs desensitization processing on part of the field data of the target sensitive field to obtain the desensitization result.

[0093] Optionally, if the target sensitive field is visible to all accessing users, the encryption module 63 is triggered to encrypt the field data of the target sensitive field to obtain the encryption result;

[0094] The sending module 64 is also used to send the encryption result to the access terminal so that the access terminal can decrypt the encryption result and obtain the field data of the target sensitive field.

[0095] Optionally, the identification module is specifically used to: obtain a list of authorized users configured for the target sensitive field, wherein the list of authorized users includes the user identifier of the first authorized user and the user identifier of the second authorized user, the target sensitive field is fully visible to the first authorized user, and the target sensitive field is partially visible to the second authorized user; match the user identifier of the accessing user with the user identifier in the list of authorized users; and, based on the matching result, identify the visibility of the target sensitive field to the accessing user.

[0096] Optionally, when the identification module identifies the visibility of the target sensitive field to the accessing user corresponding to the access terminal based on the matching result, it is specifically used as follows: if the user identifier of the accessing user matches successfully with the user identifier of the first authorized user, then it is determined that the target sensitive field is fully visible to the accessing user; if the user identifier of the accessing user matches successfully with the user identifier of the second authorized user, then it is determined that the target sensitive field is partially visible to the accessing user; if the user identifier of the accessing user fails to match with the user identifier in the list of authorized users, then it is determined that the target sensitive field is not visible to the accessing user at all.

[0097] Optionally, the desensitization module 62 is specifically used to: if the accessing user configures a corresponding custom desensitization algorithm for the target sensitive field, then use the custom desensitization algorithm to desensitize the field data of the target sensitive field to obtain the desensitization result; if the accessing user does not configure a corresponding custom desensitization algorithm for the target sensitive field, then use the system default desensitization algorithm pre-configured for the target sensitive field to desensitize the field data of the target sensitive field to obtain the desensitization result.

[0098] Optionally, the desensitization module 62 is further configured to: in response to parsing desensitization algorithm configuration information from a query request, the desensitization algorithm configuration information including the identifier and algorithm parameters of a custom desensitization algorithm, write the corresponding algorithm parameters into a custom desensitization algorithm template according to the identifier of the custom desensitization algorithm to obtain a custom desensitization algorithm; and in response to not parsing desensitization algorithm configuration information from a query request, determine that the accessing user has not configured a corresponding custom desensitization algorithm for the target sensitive field.

[0099] Optionally, the encryption module 63 is specifically used to: if the accessing user configures a corresponding custom encryption algorithm for the target sensitive field, then use the custom encryption algorithm to encrypt the de-identification result to obtain the ciphertext de-identification result; if the accessing user does not configure a corresponding custom encryption algorithm for the target sensitive field, then use the system default encryption algorithm pre-configured for the target sensitive field to encrypt the de-identification result to obtain the ciphertext de-identification result.

[0100] Optionally, the encryption module 63 is further configured to: in response to parsing encryption algorithm configuration information from a query request, the encryption algorithm configuration information including the identifier and algorithm parameters of a custom encryption algorithm, write the corresponding algorithm parameters into a custom encryption algorithm template according to the identifier of the custom encryption algorithm to obtain a custom encryption algorithm; in response to not parsing encryption algorithm configuration information from a query request, determine that the accessing user has not configured the corresponding custom encryption algorithm for the target sensitive field.

[0101] Optionally, the above device further includes: a configuration module, used to respond to sensitive rules and their signature information sent by the configuration terminal, wherein the sensitive rules include one or more of the following: an authorized user list configured for the target sensitive field, a system default desensitization algorithm, a system default encryption algorithm, an optional custom desensitization algorithm template, and an optional custom encryption algorithm template; verifying the signature information, and if the signature information is verified, saving the sensitive rules locally.

[0102] Figure 6 The apparatus shown can perform the aforementioned method embodiments, and its implementation principle and technical effects will not be repeated here. Regarding the embodiments described above... Figure 6 The specific methods by which each module and unit of the apparatus performs its operations have been described in detail in the relevant method embodiments, and will not be elaborated here.

[0103] It should be noted that the execution subject of each step of the method provided in the above embodiments can be the same device, or the method can be executed by different devices. For example, the execution subject of steps 301 to 307 can be device A; or the execution subject of steps 301 and 302 can be device A, and the execution subject of steps 303 to 307 can be device B; and so on.

[0104] Furthermore, in some of the processes described in the above embodiments and accompanying drawings, multiple operations appear in a specific order. However, it should be clearly understood that these operations may not be executed in the order they appear herein, or they may be executed in parallel. The operation numbers, such as 301, 302, etc., are merely used to distinguish different operations and do not represent any execution order. Additionally, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel. It should be noted that the descriptions such as "first" and "second" in this document are used to distinguish different messages, devices, modules, etc., and do not represent a sequential order, nor do they limit "first" and "second" to different types.

[0105] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, use and processing of the relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and corresponding operation portals are provided for users to choose to authorize or refuse.

[0106] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 7 As shown, the electronic device includes: a memory 71 and a processor 72;

[0107] Memory 71 is used to store computer programs and can be configured to store various other data to support operation on the computing platform. Examples of this data include instructions for any application or method operating on the computing platform, contact data, phone book data, messages, pictures, videos, etc.

[0108] The memory 71 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random-access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0109] Processor 72, coupled to memory 71, is used to execute computer programs in memory 71 for steps in a data query method for sensitive data.

[0110] Optional, such as Figure 7 As shown, the electronic device also includes other components such as a communication component 73, a display 74, a power supply component 75, and an audio component 76. Figure 7 The diagram only shows some components and does not mean that the electronic device includes only these components. Figure 7 The components shown. Additionally... Figure 7 The components within the dashed box are optional, not mandatory, and their specific requirements depend on the product form of the electronic device. The electronic device in this embodiment can be a desktop computer, laptop computer, smartphone, or IoT (Internet of Things) device, or a server-side device such as a conventional server, cloud server, or server array. If the electronic device in this embodiment is a desktop computer, laptop computer, or smartphone, it may include... Figure 7 The components within the dashed box; if the electronic device in this embodiment is implemented as a conventional server, cloud server, or server array, etc., it may be omitted. Figure 7 The component within the dashed box.

[0111] For a detailed description of the implementation process of each action by the processor, please refer to the relevant descriptions in the foregoing method embodiments or device embodiments, which will not be repeated here.

[0112] Accordingly, embodiments of this application also provide a computer-readable storage medium storing a computer program, which, when executed, can implement the steps that can be performed by an electronic device in the above method embodiments.

[0113] Accordingly, this application also provides a computer program product, including a computer program / instructions, which, when executed by a processor, enables the processor to perform the steps that can be executed by an electronic device in the above method embodiments.

[0114] The aforementioned communication components are configured to facilitate wired or wireless communication between the device containing the communication components and other devices. The device containing the communication components can access wireless networks based on communication standards, such as WiFi (Wireless Fidelity), 2G (2nd Generation), 3G (3rd Generation), 4G (4th Generation) / LTE (long Term Evolution), 5G (5th Generation), or combinations thereof. In one exemplary embodiment, the communication components receive broadcast signals or broadcast-related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, the communication components also include a Near Field Communication (NFC) module to facilitate short-range communication. For example, the NFC module may be based on Radio Frequency Identification (RFID), Infrared Data Association (IrDA), Ultra Wide Band (UWB), Bluetooth, and other technologies.

[0115] The aforementioned display includes a screen, which may include a Liquid Crystal Display (LCD) and a Touch Panel (TP). If the screen includes a Touch Panel, the screen can be implemented as a touchscreen to receive input signals from the user. The Touch Panel includes one or more touch sensors to sense touches, swipes, and gestures on the Touch Panel. The touch sensors can sense not only the boundaries of touch or swipe actions but also the duration and pressure associated with the touch or swipe operation.

[0116] The aforementioned power supply components provide power to various components within the device in which they reside. These power supply components may include a power management system, one or more power sources, and other components associated with generating, managing, and distributing power to the device in which they reside.

[0117] The aforementioned audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC) configured to receive external audio signals when the device containing the audio component is in an operating mode, such as call mode, recording mode, or voice recognition mode. The received audio signals can be further stored in memory or transmitted via a communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals.

[0118] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0119] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0120] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0121] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0122] In a typical configuration, a computing device includes one or more processors (Central Processing Unit, CPU), input / output interfaces, network interfaces, and memory.

[0123] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0124] Computer-readable media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change RAM (PRAM), static random-access memory (SRAM), dynamic random-access memory (DRAM), other types of random-access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile disc (DVD) or other optical storage, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transfer medium that can be used to store information accessible by a computing device. As defined in this article, computer-readable media do not include transient media, such as modulated data signals and carrier waves.

[0125] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0126] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. A method for querying sensitive data, characterized in that, Applied to a database system, the method includes: In response to a query request from an access terminal, the database system is queried for the field data of the target sensitive field. The data of the target sensitive fields are de-identified to obtain the de-identification result; The de-identified result is encrypted to obtain a ciphertext de-identified result; The encrypted de-identification result is sent to the access terminal so that the access terminal can decrypt the encrypted de-identification result to obtain the de-identified result.

2. The method according to claim 1, characterized in that, Before performing data anonymization on the target sensitive field and obtaining the anonymization result, the process also includes: Identify the visibility of the target sensitive field to the accessing user corresponding to the access terminal; If the target sensitive field is completely invisible or partially visible to the accessing user, then the step of performing desensitization processing on the field data of the target sensitive field is performed to obtain the desensitization result.

3. The method according to claim 2, characterized in that, If the target sensitive field is completely invisible or partially visible to the accessing user, then the step of performing desensitization processing on the field data of the target sensitive field to obtain the desensitization result includes: If the target sensitive field is not visible to the accessing user at all, then all field data of the target sensitive field are de-identified to obtain the de-identification result; If the target sensitive field is visible to the accessing user, then the field data of the target sensitive field is de-identified to obtain the de-identification result.

4. The method according to claim 2, characterized in that, Also includes: If the target sensitive field is visible to all the accessing users, then the field data of the target sensitive field is encrypted to obtain an encrypted result; The encryption result is sent to the access terminal so that the access terminal can decrypt the encryption result to obtain the field data of the target sensitive field.

5. The method according to claim 2, characterized in that, Identifying the visibility of the target sensitive field to the accessing user corresponding to the access terminal includes: Obtain a list of authorized users configured for the target sensitive field, wherein the list of authorized users includes the user identifier of a first authorized user and the user identifier of a second authorized user, the target sensitive field is fully visible to the first authorized user, and the target sensitive field is partially visible to the second authorized user; Match the user identifier of the accessing user with the user identifier in the list of authorized users; Based on the matching results, the visibility of the target sensitive field to the accessing user is identified.

6. The method according to claim 5, characterized in that, Based on the matching results, the visibility of the target sensitive field to the accessing user corresponding to the access terminal is identified, including: If the user identifier of the accessing user matches the user identifier of the first authorized user, then it is determined that the target sensitive field is fully visible to the accessing user. If the user identifier of the accessing user matches the user identifier of the second authorized user, then it is determined that the target sensitive field is partially visible to the accessing user. If the user identifier of the accessing user fails to match the user identifier in the list of authorized users, then it is determined that the target sensitive field is not visible to the accessing user at all.

7. The method according to claim 1, characterized in that, The data of the target sensitive field is de-identified to obtain the de-identification result, including: If the accessing user configures a corresponding custom desensitization algorithm for the target sensitive field, then the field data of the target sensitive field is desensitized using the custom desensitization algorithm to obtain the desensitization result; If the accessing user has not configured a corresponding custom desensitization algorithm for the target sensitive field, the system default desensitization algorithm pre-configured for the target sensitive field will be used to desensitize the field data of the target sensitive field to obtain the desensitization result.

8. The method according to claim 7, characterized in that, Also includes: In response to parsing the de-identification algorithm configuration information from the query request, the de-identification algorithm configuration information includes the identifier and algorithm parameters of the custom de-identification algorithm. Based on the identifier of the custom de-identification algorithm, the corresponding algorithm parameters are written into the custom de-identification algorithm template to obtain the custom de-identification algorithm. In response to the failure to parse the de-identification algorithm configuration information from the query request, it is determined that the accessing user has not configured a corresponding custom de-identification algorithm for the target sensitive field.

9. The method according to claim 1, characterized in that, The de-identified result is encrypted to obtain a ciphertext de-identified result, including: If the accessing user configures a corresponding custom encryption algorithm for the target sensitive field, then the de-identification result is encrypted using the custom encryption algorithm to obtain the ciphertext de-identification result; If the accessing user has not configured a corresponding custom encryption algorithm for the target sensitive field, the de-identification result is encrypted using the system default encryption algorithm pre-configured for the target sensitive field to obtain the ciphertext de-identification result.

10. The method according to claim 9, characterized in that, In response to parsing encryption algorithm configuration information from the query request, the encryption algorithm configuration information includes the identifier and algorithm parameters of the custom encryption algorithm. The corresponding algorithm parameters are written into the custom encryption algorithm template according to the identifier of the custom encryption algorithm to obtain the custom encryption algorithm. In response to the failure to parse encryption algorithm configuration information from the query request, it is determined that the accessing user has not configured a corresponding custom encryption algorithm for the target sensitive field.

11. The method according to any one of claims 1 to 10, characterized in that, In response to a query request from an access terminal, before querying the field data of the target sensitive field in the database system, the method further includes: In response to the sensitive rules and their signature information sent by the configuration terminal, the sensitive rules include one or more of the following: an authorized user list configured for the target sensitive field, a system default de-identification algorithm, a system default encryption algorithm, an optional custom de-identification algorithm template, and an optional custom encryption algorithm template; The signature information is verified. If the signature information passes the verification, the sensitive rule is saved locally.

12. An electronic device, characterized in that, include: Memory and processor; The memory is used to store computer programs; The processor is coupled to the memory for executing the computer program to perform the steps of the method according to any one of claims 1-11.

13. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it causes the processor to perform the steps of the method according to any one of claims 1-11.

14. A computer program product, characterized in that, Includes a computer program / instruction that, when executed by a processor, causes the processor to perform the steps of the method according to any one of claims 1-11.

Images