Data encryption desensitization method and device in hybrid cloud environment, equipment and medium

Abstract

The embodiment of the invention provides a data encryption and desensitization method and device in a hybrid cloud environment, equipment and a medium, and the method comprises the steps: receiving original data sent by a data owner client, and carrying out the field recognition and classification; acquiring a data desensitization strategy and an encryption key corresponding to the data owner client; performing differential encryption processing and storage on the classified fields based on a data desensitization strategy and an encryption key; in response to a data query request sent by a data request client, encrypting and rewriting the query request according to the data desensitization strategy and the encryption key, and generating a ciphertext query request; acquiring a data query result according to the ciphertext query request; and according to the data request client and the data desensitization strategy, the query result is subjected to dynamic desensitization processing and then is returned, so that the format and availability of the feature sensitive data are reserved, the plaintext exposure risk is avoided, and differentiated data sharing requirements for users with different permissions are supported.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a data encryption and desensitization method, apparatus, electronic device, and readable storage medium in a hybrid cloud environment. Background Technology

[0002] In today's big data era, data has become a core asset driving business decisions and innovation, and the need for its sharing and circulation among different entities is increasingly urgent. However, while data is generating value, it also faces serious risks of privacy breaches and information security.

[0003] Traditionally, the industry has widely adopted data anonymization or encryption techniques to address this challenge. Data anonymization protects privacy in non-production environments by transforming or replacing sensitive data; however, this process is usually irreversible, leading to the loss of original data, hindering accurate queries and analysis, and limiting the data's reusability. On the other hand, while data encryption technologies (such as AES) provide strong confidentiality protection for data at rest, the generated ciphertext undermines the data's computability, making it extremely difficult to perform efficient queries directly on encrypted data. Existing searchable encryption technologies generally rely on plaintext query requests directly acting on the database; even if the underlying data is encrypted, the query itself is still transmitted and parsed in plaintext. This not only risks revealing the user's query intent but also exposes the entire query process to the risk of man-in-the-middle attacks or log leaks. Furthermore, encryption and anonymization processes are often independent, resulting in a complex and unintelligent data processing chain that struggles to automate responses to external query requests. Summary of the Invention

[0004] In view of the above problems, embodiments of the present invention are proposed to provide a data encryption and desensitization method, apparatus, electronic device and readable storage medium in a hybrid cloud environment that overcomes or at least partially solves the above problems.

[0005] In a first aspect, embodiments of the present invention provide a data encryption and desensitization method in a hybrid cloud environment, the method comprising: Receive raw data sent by the data owner client, identify and classify the fields in the raw data, and obtain the field classification results; Obtain the data anonymization policy and encryption key corresponding to the data owner client; The field classification results are differentially encrypted and stored according to the data desensitization strategy and the encryption key; In response to a data query request sent by a data request client, the data query request is encrypted and rewritten according to the data desensitization strategy and the encryption key to generate a ciphertext query request. Obtain the data query results based on the encrypted query request; The data query results are anonymized according to the data request client and the data anonymization strategy.

[0006] Optionally, the field classification results include feature-sensitive data fields, ordinary sensitive data fields, and non-sensitive data fields; The step of performing differentiated encryption on the field classification result according to the data desensitization strategy and the encryption key includes: For the aforementioned feature-sensitive data fields, an encryption algorithm based on structure segmentation is used to encrypt them according to the encryption key. For the aforementioned ordinary sensitive data fields, encryption is performed using a standard encryption algorithm based on the encryption key; For the non-sensitive data fields, keep the non-sensitive data fields in plaintext state.

[0007] Optionally, the step of encrypting the feature-sensitive data field using a structure-segmented format-preserving encryption algorithm based on the encryption key includes: Based on predefined structural partitioning rules, the feature-sensitive data field is divided into multiple data segments to obtain a segmented structure; For the character data segment in the segmented structure, the character data segment is converted into numerical intermediate data through reversible mapping. The numerical intermediate data is then encrypted according to the encryption key to obtain an encrypted numerical result. Finally, the encrypted numerical result is restored to a character ciphertext segment through inverse mapping. For the numerical data segments in the segmented structure, the format is preserved and encrypted according to the encryption key to obtain the numerical ciphertext segments; For the predefined data segments in the segmented structure, a random permutation operation is performed according to the encryption key to obtain the predefined ciphertext segments; The character-type ciphertext segment, the numerical-type ciphertext segment, the predefined ciphertext segment, and the unprocessed data segment are assembled according to the segmentation structure to obtain format-preserving ciphertext, which matches the feature-sensitive data field in length, character type, and overall structure.

[0008] Optionally, the step of encrypting and rewriting the data query request according to the data desensitization strategy and the encryption key to generate a ciphertext query request includes: The data query request is parsed, and the query conditions in the data query request are identified. The query conditions include the target field to be queried and the constant value corresponding to the target field. Based on the data desensitization strategy, determine the encryption method used for the target field during the data storage stage; The constant value is encrypted into a ciphertext constant according to the determined encryption method and the encryption key; Replace the constant value in the query condition with the ciphertext constant to generate the ciphertext query request.

[0009] Optionally, the step of de-identifying the data query results according to the data request client and the data de-identification strategy includes: Based on the data anonymization strategy, obtain the data request client's access permissions to the target field; With plaintext access permission, the encrypted text corresponding to the target field in the data query result is decrypted according to the encryption key. Without plaintext access, the ciphertext corresponding to the target field in the data query result is retained, and the ciphertext is returned as the de-identified result.

[0010] Optionally, the step of retaining the ciphertext corresponding to the target field in the data query result and returning the ciphertext as the de-identified result when there is no plaintext access permission includes: When the target field corresponds to the feature-sensitive data field, the ciphertext is kept to have the same length, character type, and structure format as the original data, and is returned to the data request client as the de-identified result.

[0011] Optionally, the process of identifying and classifying fields in the original data includes: Based on the structural and semantic features of the data fields, the fields in the original data are identified and classified using a classification model.

[0012] Secondly, embodiments of the present invention provide a data encryption and desensitization device in a hybrid cloud environment, the device comprising: The field classification module is configured to receive raw data sent by the data owner client, identify and classify the fields in the raw data, and obtain the field classification results. The policy acquisition module is configured to acquire the data desensitization policy and encryption key corresponding to the data owner client; The encryption module is configured to perform differential encryption on the field classification results according to the data desensitization strategy and the encryption key, and then store them. The request encryption module is configured to respond to a data query request sent by a data request client by encrypting and rewriting the data query request according to the data desensitization strategy and the encryption key to generate a ciphertext query request. The query module is configured to obtain data query results based on the encrypted query request; The data anonymization module is configured to anonymize the data query results according to the data request client and the data anonymization strategy.

[0013] Thirdly, embodiments of the present invention provide an electronic device, which includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor. When the program or instructions are executed by the processor, they implement the steps of the data encryption and desensitization method in a hybrid cloud environment as described in the first aspect.

[0014] Fourthly, embodiments of the present invention provide a readable storage medium on which a program or instruction is stored, and when the program or instruction is executed by a processor, it implements the steps of the data encryption and desensitization method in a hybrid cloud environment as described in the first aspect.

[0015] The embodiments of the present invention have the following advantages: The embodiments of the present invention receive raw data sent by the data owner client, perform field identification and classification on the raw data; obtain the data anonymization strategy and encryption key corresponding to the data owner client; perform differentiated encryption processing on the classified fields based on the data anonymization strategy and encryption key, and store the encrypted data; respond to the data query request sent by the data request client, encrypt and rewrite the query request according to the data anonymization strategy and encryption key to generate an encrypted query request; obtain the data query result according to the encrypted query request; and perform dynamic anonymization processing on the query result according to the identity and permissions of the data request client and the data anonymization strategy before returning it. This achieves full lifecycle security protection of data, preserving the format and usability of sensitive data while avoiding the risk of plaintext exposure, and also supports differentiated data sharing needs for users with different permissions. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a flowchart illustrating the steps of a data encryption and desensitization method in a hybrid cloud environment provided by an embodiment of the present invention. Figure 2 This is a flowchart of another data encryption and desensitization method in a hybrid cloud environment provided by an embodiment of the present invention; Figure 3 This is an application flowchart of the data upload and encrypted storage steps of a data encryption and desensitization method in a hybrid cloud environment provided by an embodiment of the present invention; Figure 4This is an application flowchart of the data query and access steps of a data encryption and desensitization method in a hybrid cloud environment provided by an embodiment of the present invention; Figure 5 This is an application architecture diagram of a data encryption and desensitization method in a hybrid cloud environment provided by an embodiment of the present invention; Figure 6 This is a structural block diagram of a data encryption and desensitization device in a hybrid cloud environment provided by an embodiment of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] The terms "first," "second," etc., used in the specification and claims of this invention are used to distinguish similar objects and are not used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention can be implemented in orders other than those illustrated or described herein. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0020] In current data security practices, encryption and de-identification are cornerstone technologies for protecting sensitive information and preventing privacy breaches. However, existing technical solutions suffer from significant rigidity in their processing flow, making it difficult to meet the complex needs of real-world applications.

[0021] Existing data processing methods typically employ a "one-size-fits-all" strategy, applying uniform, strong encryption to all sensitive data. While this approach is secure, it causes the encrypted data to lose its original structure, rendering it unusable for subsequent queries and analysis, severely compromising data usability. For example, using the same irreversible masking or unstructured strong encryption for ID numbers requiring precise queries, monetary amounts requiring range statistics, and name fields used only for display renders the data unusable for any valuable business operations after protection, making the encrypted data useless for analysis and testing.

[0022] Furthermore, the existing architecture faces fundamental challenges in responding to external data query requests. If the server stores encrypted data, it cannot directly process plaintext query requests; however, decrypting the data before querying poses a risk of internal data leakage. This dilemma creates an irreconcilable conflict between secure data sharing and efficient query services.

[0023] Furthermore, existing technologies lack dynamism and flexibility in the data output stage, making it impossible to achieve fine-grained data security management.

[0024] Figure 1 This is a flowchart of the steps of a data encryption and desensitization method in a hybrid cloud environment provided by an embodiment of the present invention.

[0025] The data encryption and desensitization method proposed in this invention is applicable to hybrid cloud environments, where data can be collaboratively processed and stored between private and public clouds. The core of this method lies in dividing the data processing flow according to security requirements: the identification, classification, policy formulation, and encryption of the original data can be completed in the private cloud to ensure that sensitive data does not leave the security boundary; while the storage and query execution of the encrypted data utilize the resources of the public cloud, and secure data sharing and services can be achieved through query rewriting and dynamic desensitization mechanisms.

[0026] like Figure 1 As shown, the method may specifically include the following steps: Step 101: Receive raw data sent by the data owner client, identify and classify the fields in the raw data, and obtain the field classification results; In the method of this invention embodiment, the data owner is the owner or manager of the data, and the data owner client can be a client program used by an entity that owns the data and formulates its security policy (e.g., an internal system of a company or organization). The raw data can be an initial dataset containing one or more fields without any encryption or de-identification processing, such as a data table containing user names, ID numbers, phone numbers, and consumption records.

[0027] The system automatically analyzes each field of the raw data to identify whether it contains sensitive information. This identification process can combine various techniques, including but not limited to: keyword matching based on field names (such as "ID number," "phone number," "email," etc.), regular expression validation of data format (such as conformity to ID card encoding rules, mobile phone number rules, etc.), data content feature analysis (such as high uniqueness and high identifiability), and comparison with a predefined sensitive field type library. The data is then categorized into corresponding sensitivity levels or categories, providing a basis for subsequent differentiated processing.

[0028] In this embodiment of the invention, the field classification result can be a structured metadata set, which is used to explicitly identify the data type and / or sensitivity level of each field in the original data.

[0029] Step 102: Obtain the data desensitization policy and encryption key corresponding to the data owner client; In the method of this invention embodiment, the data anonymization strategy is a set of rules predefined by the data owner and stored in the system policy library. The data anonymization strategy can be bound to a specific owner identity, ensuring that different owners can have their own independent data security specifications.

[0030] The encryption key is the core security parameter used to encrypt the original data. It can be a symmetric key, and its specific type depends on the encryption mechanism used. The encryption key can be generated by the data owner or entrusted to a cloud provider's key management system and is strictly bound to the data owner's identity to ensure that only authorized parties can participate in the encryption and decryption process.

[0031] Step 103: Perform differential encryption on the field classification results according to the data desensitization strategy and the encryption key, and then store them; In this embodiment of the invention, each field type or sensitivity level in the field classification results can be mapped to a specific encryption rule according to a data anonymization strategy. Then, based on the obtained owner encryption key, each field is encrypted according to the aforementioned differentiated strategy, and the generated ciphertext data is persistently stored in a database or cloud storage. In some embodiments, the ciphertext data can also be a hybrid structure containing ciphertext and plaintext fields.

[0032] Step 104: In response to the data query request sent by the data request client, the data query request is encrypted and rewritten according to the data desensitization strategy and the encryption key to generate a ciphertext query request; In this embodiment of the invention, the query request submitted by the data request client is first parsed to identify core elements such as query conditions and target fields. Then, based on the data desensitization strategy and encryption key corresponding to the data owner obtained in step 102, the condition values ​​in the query request are encrypted and converted. The data anonymization strategy specifies the encryption algorithm used for different fields during storage. The rewriting process applies this mapping relationship in reverse. It can use the same encryption key to convert plaintext values ​​in query conditions into ciphertext values ​​according to the specific encryption method used by the fields during storage.

[0033] The converted ciphertext value is replaced back in the corresponding position in the original query statement, thereby generating a brand new ciphertext query request that can be directly executed on the ciphertext data. This allows the data request client to submit queries in plaintext without being aware of the underlying data encryption status. At the same time, the system losslessly converts the plaintext query into an equivalent ciphertext query in the background, ensuring that the server always operates in an ciphertext environment. This fundamentally eliminates the risk of internal leakage caused by data decryption during the query process, providing a key guarantee for secure and efficient data retrieval.

[0034] Step 105: Obtain the data query result according to the encrypted query request; In the method of this invention embodiment, the generated ciphertext query request can be directly submitted to the backend database or data service module storing the ciphertext data for execution. Since the query condition values ​​in the ciphertext query request have been converted according to the same encryption method as the stored data (such as deterministic encryption, format-preserving encryption, etc.), the database can directly perform operations such as equality comparison and index lookup on the ciphertext fields without decrypting the original data, thereby accurately matching records that meet the conditions.

[0035] Step 106: De-identify the data query results according to the data request client and the data de-identification strategy.

[0036] After obtaining the encrypted query results, instead of directly returning the original ciphertext or the decrypted plaintext to the data requesting client, the system first identifies the identity of the data requesting client (e.g., user role, application identifier, or security level). Subsequently, based on this identity information, fine-grained data display rules suitable for the requesting party are matched according to the obtained data anonymization strategy.

[0037] Specifically, de-identification strategies typically define the de-identified form that different fields should present when facing different requesters. For example, for an ID card number field, ordinary auditors may only be allowed to view the first 6 and last 4 digits (e.g., "110101********1234"), while risk control systems can view the complete information under specific authorization; for mobile phone numbers, external partners may only see the masked form (e.g., "138****5678"), while internal customer service systems can display the complete number. In the method of this invention embodiment, the corresponding de-identification rules can be matched from the strategy according to the actual identity of the current requesting client, and operations such as masking, generalization, truncation, replacement, or complete hiding can be performed on each field in the query results as needed. This ensures that "data does not exceed permissions," meaning that requesters with different permissions will get different levels of de-identification views of the same data, or even the same query, thereby maximizing the protection of personal privacy and sensitive information at the final output, forming an end-to-end security closed loop from storage, query to output.

[0038] This invention, through receiving raw data sent by a data owner client, performs field identification and classification on the raw data; obtains the data anonymization strategy and encryption key corresponding to the data owner client; performs differentiated encryption processing on the classified fields based on the data anonymization strategy and encryption key, and stores the encrypted data; responds to a data query request sent by a data request client, encrypts and rewrites the query request according to the data anonymization strategy and encryption key to generate an encrypted query request; obtains the data query result based on the encrypted query request; and performs dynamic anonymization processing on the query result according to the identity and permissions of the data request client and the data anonymization strategy before returning it. This achieves full lifecycle security protection for data, preserving the format and usability of sensitive data while avoiding the risk of plaintext exposure, and also supports differentiated data sharing needs for users with different permissions.

[0039] Reference Figure 2 The flowchart illustrates another data encryption and desensitization method for a hybrid cloud environment according to the present invention, which may specifically include the following steps: Step 201: Receive the raw data sent by the data owner client; based on the structural and semantic features of the data fields, identify and classify the fields in the raw data using a classification model to obtain the field classification results; First, the system receives raw data sent by the data owner's client. Then, based on the structural and semantic features of the data fields, a pre-trained classification model intelligently identifies and classifies the fields in the raw data to obtain more refined field classification results. The classification model comprehensively analyzes the structural features of each field (such as data length, character type distribution, and whether it conforms to specific formats such as mobile phone numbers, ID card numbers, email addresses, etc.) and semantic features (such as field names, contextual descriptions, value distribution, uniqueness, and similarity to known sensitive word lists) to determine its sensitive attributes.

[0040] In this embodiment of the invention, the field classification result includes feature-sensitive data fields, ordinary sensitive data fields, and non-sensitive data fields; Sensitive data fields refer to fields that are highly identifiable, have high privacy value, and usually have fixed formats and rules, such as ID card numbers, bank card numbers, mobile phone numbers, passport numbers, etc. Once such fields are leaked, they can easily lead to identity theft or targeted fraud. Commonly sensitive data fields refer to fields that have certain privacy attributes but weak identification characteristics, such as gender, age, occupation, address (not accurate to the house number), email username, etc. Their risk is relatively low, but they still need to be protected in specific scenarios. Non-sensitive data fields refer to public or general information that does not contain personal privacy or trade secrets, such as order numbers (without user association), product categories, timestamps (excluding user behavior), etc., which can usually be stored and used in plaintext.

[0041] Step 202: Obtain the data desensitization policy and encryption key corresponding to the data owner client; Data anonymization strategies are predefined and registered to the system by the data owner, specifying which anonymization method should be used for fields of different categories or sensitivity levels. In this embodiment of the invention, the strategy content may include, but is not limited to: Storage encryption rules: Explicitly specify the encryption algorithm and strength to be used when storing fields with different sensitivity levels.

[0042] Results anonymization rules: Define the range of information that data requesters with different identities can see for different categories of fields when querying.

[0043] In practical applications, data anonymization strategies can be set according to the actual needs of the data owner and the data category and sensitivity level, and this invention does not impose any restrictions on this.

[0044] An encryption key is a core parameter used to encrypt raw data, and its value depends on the chosen encryption algorithm and technology. The encryption key is bound to the identity of the data owner, ensuring that only authorized entities can participate in the encryption and decryption process. In this invention, the encryption key is not only used for data encryption during the storage phase, but also for the encrypted rewriting of query requests and the dynamic de-identification of results in subsequent steps, making it a crucial tool for ensuring data security throughout its entire lifecycle.

[0045] Step 203: For the feature-sensitive data field, encrypt and store it using a structure-segmentation-based format retention encryption algorithm according to the encryption key; In the method of this invention embodiment, for feature-sensitive data fields, instead of uniformly encrypting the entire field, it can divide the field into several data segments based on its inherent structural characteristics (for example, dividing the ID number into address code, date of birth, sequence code and check digit), and then, in combination with the encryption key, process each data segment using a format preservation encryption algorithm adapted to the data segment type.

[0046] The core advantage of format-preserving encryption algorithms lies in their ability to maintain the same data format (such as length, character set, and checksum) as the original plaintext while ensuring encryption strength. This is crucial for sensitive data with fixed business formats, such as ID card numbers and bank card numbers, ensuring that the encrypted data can still be seamlessly integrated into existing database indexes, business logic, and verification rules.

[0047] In some embodiments, step 203 specifically includes the following sub-steps: Sub-step S11: According to predefined structural partitioning rules, the feature-sensitive data field is divided into multiple data segments to obtain a segmented structure; In some embodiments, the field to be encrypted can be logically split into multiple data segments with different semantics and types, based on the known format of the field.

[0048] For example, an 18-digit ID card number can be divided according to national standards into: the first 6 digits (address code), the middle 8 digits (date of birth), and the last 3 digits (sequence code + check digit); a mobile phone number "13812345678" can be divided into "138" (operator segment), "1234" (area code segment), and "5678" (user number segment). The structural division rules are pre-configured by the system or can be customized by the data owner. The purpose is to break down fields into semantically or format-independent components for differentiated processing.

[0049] Sub-step S12: For the character data segment in the segmented structure, convert the character data segment into numerical intermediate data through reversible mapping, encrypt the numerical intermediate data according to the encryption key to obtain the encrypted numerical result, and restore the encrypted numerical result to the character ciphertext segment through inverse mapping. In some embodiments, character data segments (such as email usernames or Chinese names containing letters) in the segmented structure can be converted into numeric intermediate data through a reversible mapping. Subsequently, the intermediate numerical data is encrypted using the encryption key while preserving its format, yielding the encrypted numerical result. Finally, the numerical result is restored to a character-type ciphertext segment consistent with the original character type through inverse mapping. This process ensures that character-type information retains its original character set (e.g., containing only numbers and uppercase letters) after encryption, avoiding the introduction of illegal symbols.

[0050] Sub-step S13: Encrypt the numerical data segments in the segmented structure using the encryption key while preserving the format, to obtain numerical ciphertext segments. In some embodiments, purely numerical data segments in the segmented structure (such as birth date "19900101", the last eight digits of a phone number, etc.) can be directly encrypted using a format-preserving encryption algorithm based on the encryption key to generate a numerical ciphertext segment with the same length and numerical range as the original data. For example, an 8-digit date remains an 8-digit number after encryption, and is still within a reasonable date range to maintain business logic compatibility.

[0051] Sub-step S14: Perform a random permutation operation on the predefined data segments in the segmented structure according to the encryption key to obtain predefined ciphertext segments; In some embodiments, predefined data segments in the segmented structure (such as segments with a fixed set of values, like the first 6 digits of an ID card address or the first 3 digits of a mobile phone number operator code) can be bypassed with traditional encryption. Instead, a pseudo-random permutation table is generated based on the encryption key, allowing for one-to-one mapping and permutation of all possible values ​​for the segment. For example, "110101" can be mapped to another legal but meaningless administrative division code, "320502". This method hides the true meaning while ensuring the output remains within the legal value range, making it suitable for statistical or regional analysis scenarios.

[0052] Sub-step S15: Assemble the character-type ciphertext segment, the numerical-type ciphertext segment, the predefined ciphertext segment, and the unprocessed data segment according to the segmentation structure to obtain format-preserving ciphertext. The format-preserving ciphertext matches the feature-sensitive data field in length, character type, and overall structure.

[0053] In some embodiments, the character-type ciphertext segments, numeric-type ciphertext segments, predefined ciphertext segments obtained from the above processing, as well as other data segments not marked as sensitive and requiring no processing (e.g., if the data anonymization strategy allows for the retention of certain check bits), can be reassembled according to the original segment structure order to form the final format-preserving ciphertext. The format-preserving ciphertext is completely consistent with the original feature-sensitive data fields in terms of overall length, character type distribution, and format validity, and can seamlessly replace plaintext in business processes. At the same time, the content of the format-preserving ciphertext has been effectively protected through encryption or substitution.

[0054] After completing the above processing, the format-preserved ciphertext can be written to a secure storage medium (such as an encrypted database), and metadata such as the encryption algorithm used, key version, and segmentation rules can be associated and recorded for subsequent query rewriting and result processing. Through step 203 and its sub-steps, the highest level of data security storage requirements are met while perfectly maintaining the business availability of the data, providing a solid technical foundation for subsequent accurate queries and data verification on the ciphertext.

[0055] Step 204: For the ordinary sensitive data field, encrypt it using a standard encryption algorithm based on the encryption key and then store it; Unlike feature-sensitive data fields, ordinary sensitive data fields (such as addresses, general descriptive text, etc.) typically do not have a strict, fixed format that needs to be directly read and processed by business systems. Therefore, the focus of protecting ordinary sensitive data fields is to ensure the strong confidentiality of their content, without preserving their original format. Employing industry-wide proven standard encryption algorithms is the most effective way to achieve this goal.

[0056] In some embodiments, the acquired encryption key can be invoked, and a standard encryption algorithm can be selected to fully encrypt the entire field value. Standard encryption algorithms have high security, maturity, and broad compatibility, and can effectively prevent data from being illegally read during storage or transmission. Since ordinary sensitive fields do not require the original format or length to be maintained after encryption, standard ciphertext (usually a binary or Base64 encoded string) can be directly generated without additional format adaptation or segmentation processing.

[0057] The encrypted data is written to the storage system in ciphertext form. Because the encryption process destroys the structure and semantics of the original data, this ciphertext data is unreadable to any unauthorized party (including the database administrator), thus effectively protecting the privacy of ordinary sensitive information. In some embodiments, metadata such as the encryption algorithm identifier, key version, and field type used by the ordinary sensitive data fields can also be recorded to ensure correct decryption or result anonymization during subsequent query stages.

[0058] Step 205: For the non-sensitive data field, keep the non-sensitive data field in plaintext and store it.

[0059] The non-sensitive data fields refer to data that, according to the classification model, does not contain personal privacy, trade secrets, or any other sensitive information. This type of data is typically public information, aggregated statistical information, or business identifiers, such as a user's points balance, article view counts, publicly available product category codes, or anonymous identifiers within the system. The disclosure of this data will not pose a substantial security risk or privacy violation to individuals or organizations. Therefore, retaining its plaintext state not only significantly reduces system encryption / decryption overhead and storage complexity but also ensures that downstream applications (such as report generation, log analysis, and business monitoring) can efficiently and seamlessly access and use this data, improving overall processing performance and compatibility.

[0060] Meanwhile, since non-sensitive fields are not encrypted, they can still participate in index building, aggregation calculation, fuzzy query and other operations in the database, further ensuring data availability and the integrity of system functions.

[0061] Step 206: In response to the data query request sent by the data request client, the data query request is encrypted and rewritten according to the data desensitization strategy and the encryption key to generate a ciphertext query request; In the method of this embodiment of the invention, this step aims to ensure that the query process is executed securely within the encrypted domain throughout, and to prevent sensitive query content from being exposed in plaintext form during network transmission, log recording or database parsing.

[0062] In some embodiments, step 206 specifically includes the following sub-steps: Sub-step S21: Parse the data query request and identify the query conditions in the data query request. The query conditions include the target field to be queried and the constant value corresponding to the target field. In some embodiments, the received raw query request (e.g., SQL statement, API parameters, or structured query object) can first be parsed syntactically and semantically to extract the field names involved and their corresponding query values. For example, in the query statement "SELECT name, phone FROM users WHERE id card = '110101199001011234'", the target field is identified as "id card", and the constant value is "110101199001011234". This process can support various query formats and accurately distinguish between sensitive and non-sensitive fields.

[0063] Sub-step S22: Based on the data desensitization strategy, determine the encryption method used by the target field in the data storage stage; In some embodiments, after extracting the target field, the data anonymization strategy obtained in step 202 can be queried. The data anonymization strategy, as a metadata mapping table, records the encryption method used for each field during storage.

[0064] For example, if the field is an ID card number and is classified as feature-sensitive data, then it uses structure-segmented format preservation encryption in step 203; if it is a general sensitive field, then standard encryption algorithms such as AES may be used in step 204; if it is a non-sensitive field, then it is not encrypted. Determining the encryption method is crucial for correctly performing query rewriting.

[0065] Sub-step S23: Encrypt the constant value into a ciphertext constant according to the determined encryption method and the encryption key; In some embodiments, the same encryption algorithm, parameter configuration, and encryption key as those used in the storage phase can be invoked to perform the same encryption operation on the plaintext constant value to be queried. For format-preserving encrypted fields, encryption can be performed strictly according to their segmentation rules and mapping methods to ensure that the output ciphertext is format-compatible with the stored ciphertext; for standard encrypted fields, standard ciphertext is generated according to the corresponding algorithm. This process ensures the comparability of the query value with the ciphertext record in the database.

[0066] Sub-step S24: Replace the constant value in the query condition with the ciphertext constant to generate the ciphertext query request.

[0067] In some embodiments, the plaintext constants in the original query statement can be replaced with the ciphertext constants generated in step S23 to form a complete ciphertext query request. For example, the original query becomes "SELECT name, phone FROM users WHERE id card = '<FPE ciphertext>'". The ciphertext query request can be directly submitted to the backend storage system for matching operations without decrypting any data, thus avoiding the appearance of sensitive information in plaintext throughout the query link.

[0068] Through the above sub-steps, this solution constructs a secure query adaptation layer. It enables the data requester to not change its query habit (always using plaintext), while ensuring that the server-side always performs operations in the ciphertext environment, fundamentally eliminating the risk of data leakage in the query link and achieving the unity of security and convenience.

[0069] Step 207, obtain the data query result according to the ciphertext query request; In the method of the embodiment of the present invention, the generated ciphertext query request can be directly submitted to the backend data storage system (such as an encrypted database, a distributed storage, or a secure data service module) for execution. Since the query condition values in the ciphertext query request have been converted according to the same encryption method and key as when the original data was stored, the storage system can directly complete operations such as matching, filtering, and sorting in the ciphertext domain without decrypting any data.

[0070] The finally returned data query result is a dataset in a mixed form: among which the feature-sensitive fields and ordinary sensitive fields exist in ciphertext form, and the non-sensitive fields are in plaintext. This result completely retains the original data structure and logical relationship, and at the same time strictly follows the security processing strategy of each field in the storage stage, providing a secure and consistent input basis for dynamic desensitization based on the identity of the requester and the desensitization strategy in subsequent steps.

[0071] Step 208, perform desensitization processing on the data query result according to the data request client and the data desensitization strategy.

[0072] In the method of the embodiment of the present invention, the data query result can be desensitized according to the data request client and the data desensitization strategy. This step aims to ensure that the data content returned to the data request client strictly matches its permissions, preventing the over-disclosure of sensitive information while ensuring the availability of data. Instead of simply returning the query result as it is, the system combines the identity of the data requester and the desensitization strategy preset by the data owner to make dynamic and on-demand desensitization decisions for each field in the result.

[0073] In some embodiments, step 208 specifically includes the following sub-steps: Sub-step S31: According to the data desensitization strategy, obtain the data request client's access permissions to the target field; In some embodiments, the identity of the data request client that sent the request can first be identified (e.g., user role, application identifier, etc.).

[0074] Subsequently, based on the identity information, the data anonymization policy is queried. The data anonymization policy defines fine-grained data display rules, explicitly specifying the access permissions that different client roles have for each target field (such as name, ID number, and mobile phone number). For example, the data anonymization policy might stipulate that internal administrators have plaintext access to the "ID number" field, while third-party partners do not. The permission assessment result will determine whether decryption is allowed or whether ciphertext is returned directly.

[0075] Sub-step S32: With plaintext access permission, perform decryption operation on the ciphertext corresponding to the target field in the data query result according to the encryption key; In some embodiments, if the data anonymization strategy determines that the client has permission to view the plaintext of a certain field, a decryption operation can be performed: the ciphertext corresponding to the target field in the query result is decrypted using the data owner's encryption key, restoring it to the original plaintext. The decryption process is completed in a controlled and secure memory environment, and the plaintext result is not persisted or recorded, but only used for this response assembly.

[0076] Sub-step S33: Without plaintext access permission, retain the ciphertext corresponding to the target field in the data query result and return the ciphertext as the de-identified result.

[0077] In some embodiments, if the client does not have permission to view the plaintext of a field, the field is not decrypted, but its ciphertext form is directly output as the de-identified result.

[0078] Through the above steps, the present invention achieves dynamic anonymization based on permissions: the same data can automatically present information of different granularities according to different requesters, which not only meets the business needs of high-privilege users, but also ensures that low-privilege users cannot snoop on sensitive content, thereby achieving an efficient and secure balance between data sharing, analysis and compliance.

[0079] In some embodiments, sub-step S33 includes: When the target field corresponds to the feature-sensitive data field, the ciphertext is kept to have the same length, character type, and structure format as the original data, and is returned to the data request client as the de-identified result.

[0080] In some embodiments, since feature-sensitive data fields (such as ID card numbers, mobile phone numbers, bank card numbers, etc.) have already been processed by a format-preserving encryption algorithm based on structure segmentation during the storage stage, the generated ciphertext strictly follows the format specifications of the original data in appearance—for example, an 18-digit ID card number remains 18 digits after encryption, containing only numbers and a possible uppercase letter "X"; an 11-digit mobile phone number remains 11 pure numbers after encryption, and the first three digits conform to the operator's number segment distribution. Therefore, when it is determined that the data requesting client does not have the right to access the plaintext of the field, the system does not need to perform traditional desensitization operations such as masking, truncation, or replacement, but directly returns the format-preserving ciphertext as the desensitization result.

[0081] For example, a real ID number in plaintext is 110101199001011234. After format preservation encryption, the stored ciphertext is 440301199008019832. When a tester requests data, they do not have plaintext access permission. According to this embodiment, the system will not decrypt the ciphertext, but will directly return the properly formatted and valid fake ID number, 440301199008019832, to the tester. For the test program, what it receives is still a legitimate 18-digit ID number, which can be displayed and processed normally, but the real information is completely protected.

[0082] This invention, through receiving raw data sent by a data owner client, performs field identification and classification on the raw data; obtains the data anonymization strategy and encryption key corresponding to the data owner client; performs differentiated encryption processing on the classified fields based on the data anonymization strategy and encryption key, and stores the encrypted data; responds to a data query request sent by a data request client, encrypts and rewrites the query request according to the data anonymization strategy and encryption key to generate an encrypted query request; obtains the data query result based on the encrypted query request; and performs dynamic anonymization processing on the query result according to the identity and permissions of the data request client and the data anonymization strategy before returning it. This achieves full lifecycle security protection for data, preserving the format and usability of sensitive data while avoiding the risk of plaintext exposure, and also supports differentiated data sharing needs for users with different permissions.

[0083] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0084] In order to enable those skilled in the art to better understand the embodiments of the present invention, Figure 3 This is an application flowchart of the data upload and encrypted storage steps of a data encryption and desensitization method in a hybrid cloud environment provided by an embodiment of the present invention.

[0085] Reference Figure 3 This demonstrates the complete process from the data owner client initiating a data upload to the final secure transmission of the processed data to the hybrid cloud server: S41: Upload data; The data owner client (such as an internal enterprise system, business application, or user terminal) uploads the raw data to be processed to the de-identification system.

[0086] S42: Automatically identify sensitive data, other sensitive data, and ordinary data; After receiving the data, the data anonymization system intelligently analyzes each field based on a preset classification model or rule engine. By combining field names, data formats, character patterns, and semantic features, the system automatically classifies fields into three categories: feature-sensitive data, other sensitive data, and ordinary data.

[0087] S43: Set the desensitization strategy and randomly generate a key; In the data masking system, the data owner configures corresponding masking strategies for different categories of fields based on business needs and compliance requirements. Simultaneously, a unique encryption key is randomly generated for this data processing task and is managed by the data owner's authorization, ensuring the key's lifecycle is controllable, secure, and trustworthy.

[0088] S44: Based on the desensitization strategy, perform different desensitization processes on sensitive data; Based on the strategy and generated key set in S13, the system performs differentiated processing on various types of sensitive data: for feature-sensitive data, a structure-segmented format-preserving encryption algorithm is used to ensure that the original length and structure are maintained after encryption; for other sensitive data, standard encryption algorithms are used for full-field encryption; and for ordinary data, the plaintext state is maintained. All processing is completed within the de-identification system.

[0089] S45: Send the anonymized data to the cloud server.

[0090] After anonymization and encryption, the system packages the processed data (including ciphertext and plaintext fields) and securely transmits it to a hybrid cloud server for storage. Thus, the data has undergone security hardening before leaving the environment controlled by the data owner, and sensitive information stored on the cloud server is in ciphertext format, effectively protecting data privacy and security when stored in the cloud.

[0091] In order to enable those skilled in the art to better understand the embodiments of the present invention, Figure 4 This is an application flowchart of the data query and access steps of a data encryption and desensitization method in a hybrid cloud environment provided by an embodiment of the present invention.

[0092] Reference Figure 4 This demonstrates the complete process by which a data request client securely retrieves data from a hybrid cloud server through a data anonymization system: S51: Send a request to access data; The data request client sends a data access request to the data masking system. This request contains SQL statements for querying data.

[0093] S52: Parse the requested SQL statement; After receiving the request, the de-identification system performs syntax parsing and semantic analysis on the SQL statement to identify the fields and parameters involved in the query conditions.

[0094] S53: Obtain the corresponding de-identification strategy and key; The data anonymization system obtains the corresponding data anonymization strategy and decryption key based on the request context and data attributes.

[0095] S54: Desensitize sensitive data contained in SQL statements according to the desensitization rules; The desensitization system, based on the desensitization strategy, encrypts and rewrites the query conditions involving sensitive data in the SQL statement, generating an SQL statement that can be executed on the encrypted data.

[0096] S55: Send the processed SQL statement to the cloud server; The de-identification system sends the rewritten SQL statement to the hybrid cloud server for query execution.

[0097] S56: Returns the queried data; After executing a encrypted SQL query, the hybrid cloud server returns the query results to the de-identification system.

[0098] S57: If the requesting client has permission to access plaintext, then decrypt; otherwise, return directly. The data masking system determines the data based on the client's permission level: if the client has plaintext access permission, the encrypted data in the query results is decrypted using a key; if the client does not have plaintext access permission, the data remains encrypted.

[0099] S58: Return data.

[0100] The data masking system returns the final processed data to the data requesting client. This process fully demonstrates the entire process from receiving a query request to returning the processing result. Through the data masking system, query statements are rewritten and query results are dynamically masked, ensuring data security while meeting the data access needs of users with different permissions.

[0101] Figure 5 This is an application architecture diagram of a data encryption and desensitization method in a hybrid cloud environment provided by an embodiment of the present invention.

[0102] The data owner client is responsible for initiating data upload requests, submitting the raw data to be processed to the data masking system. The data request client sends data access requests to the data masking system, receives and displays the processed data results. The data masking system, as the core processing unit, includes the following functional modules: The data identification module identifies and classifies the fields of the received raw data, distinguishing between sensitive and ordinary data; the data anonymization strategy module stores and manages data anonymization strategy rules, providing a strategic basis for data processing; the data encryption and decryption module executes specific encryption and decryption operations to achieve data anonymization; and the key management module is responsible for the generation, storage, and management of encryption keys to ensure key security.

[0103] The hybrid cloud server receives and stores data processed by the de-identification system, and provides query services for data requests.

[0104] This architecture achieves end-to-end data security protection through the collaborative work of its various modules, from data uploading, identification and classification, policy execution to encrypted storage. At the same time, it can perform dynamic de-identification processing based on permissions during data querying, ensuring the security and compliance of data during sharing and use.

[0105] It should be noted that the data encryption and desensitization method in a hybrid cloud environment provided in this embodiment of the invention can be executed by a data encryption and desensitization device in a hybrid cloud environment, or by a control module in that device for executing the data encryption and desensitization method in a hybrid cloud environment. This embodiment of the invention uses the execution of the data encryption and desensitization method in a hybrid cloud environment by a data encryption and desensitization device in a hybrid cloud environment as an example to illustrate the data encryption and desensitization method in a hybrid cloud environment provided in this embodiment of the invention.

[0106] Figure 6 This is a structural block diagram of a data encryption and desensitization device provided in an embodiment of the present invention.

[0107] like Figure 6 As shown in the figure, the data encryption and desensitization device provided in this embodiment of the invention may specifically include the following modules: The field classification module 301 is configured to receive raw data sent by the data owner client, identify and classify the fields in the raw data, and obtain the field classification result. The policy acquisition module 302 is configured to acquire the data desensitization policy and encryption key corresponding to the data owner client; Encryption module 303 is configured to perform differential encryption on the field classification result according to the data desensitization strategy and the encryption key and then store it. The encryption module 304 is configured to respond to a data query request sent by a data request client by encrypting and rewriting the data query request according to the data desensitization strategy and the encryption key to generate a ciphertext query request. The query module 305 is configured to obtain data query results based on the encrypted query request; The data masking module 306 is configured to mask the data query results according to the data request client and the data masking strategy.

[0108] This invention, through receiving raw data sent by a data owner client, performs field identification and classification on the raw data; obtains the data anonymization strategy and encryption key corresponding to the data owner client; performs differentiated encryption processing on the classified fields based on the data anonymization strategy and encryption key, and stores the encrypted data; responds to a data query request sent by a data request client, encrypts and rewrites the query request according to the data anonymization strategy and encryption key to generate an encrypted query request; obtains the data query result based on the encrypted query request; and performs dynamic anonymization processing on the query result according to the identity and permissions of the data request client and the data anonymization strategy before returning it. This achieves full lifecycle security protection for data, preserving the format and usability of sensitive data while avoiding the risk of plaintext exposure, and also supports differentiated data sharing needs for users with different permissions.

[0109] As the apparatus embodiment is basically similar to the method embodiment, it is described in a relatively simple manner. For relevant details, please refer to the description of the method embodiment.

[0110] This invention also provides an electronic device, including a processor, a memory, and a program or instructions stored in the memory and executable on the processor. When the program or instructions are executed by the processor, they implement the various processes of the above-described data encryption and desensitization method embodiments in a hybrid cloud environment and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0111] It should be noted that the electronic devices in the embodiments of the present invention include the mobile electronic devices and non-mobile electronic devices described above.

[0112] This invention also provides a readable storage medium storing a program or instructions. When the program or instructions are executed by a processor, they implement the various processes of the above-described data encryption and desensitization method embodiments in a hybrid cloud environment and achieve the same technical effect. To avoid repetition, they will not be described again here.

[0113] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0114] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0115] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, apparatus, or computer program products. Therefore, embodiments of the present invention can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, embodiments of the present invention can take the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0116] Embodiments of the present invention are described with reference to flowchart illustrations and / or block diagrams of methods, terminal devices (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, as well as combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing terminal device to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing terminal device, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0117] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing terminal device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1The function specified in one or more boxes.

[0118] These computer program instructions can also be loaded onto a computer or other programmable data processing terminal equipment, causing a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable terminal equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0119] Although preferred embodiments of the present invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the embodiments of the present invention.

[0120] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal device that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal device. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal device that includes said element.

[0121] The above provides a detailed description of the data encryption and desensitization method, apparatus, device, and medium in a hybrid cloud environment provided by the present invention. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A data encryption and desensitization method in a hybrid cloud environment, characterized in that, The method includes: Receive raw data sent by the data owner client, identify and classify the fields in the raw data, and obtain the field classification results; Obtain the data anonymization policy and encryption key corresponding to the data owner client; The field classification results are differentially encrypted and stored according to the data desensitization strategy and the encryption key; In response to a data query request sent by a data request client, the data query request is encrypted and rewritten according to the data desensitization strategy and the encryption key to generate a ciphertext query request. Obtain the data query results based on the encrypted query request; The data query results are anonymized according to the data request client and the data anonymization strategy.

2. The data encryption and desensitization method in a hybrid cloud environment according to claim 1, characterized in that, The field classification results include feature-sensitive data fields, ordinary sensitive data fields, and non-sensitive data fields; The step of performing differentiated encryption on the field classification result according to the data desensitization strategy and the encryption key includes: For the aforementioned feature-sensitive data fields, an encryption algorithm based on structure segmentation is used to encrypt them according to the encryption key. For the aforementioned ordinary sensitive data fields, encryption is performed using a standard encryption algorithm based on the encryption key; For the non-sensitive data fields, keep the non-sensitive data fields in plaintext state.

3. The data encryption and desensitization method in a hybrid cloud environment according to claim 2, characterized in that, The encryption of the feature-sensitive data field using a structure-segmented format-preserving encryption algorithm based on the encryption key includes: Based on predefined structural partitioning rules, the feature-sensitive data field is divided into multiple data segments to obtain a segmented structure; For the character data segment in the segmented structure, the character data segment is converted into numerical intermediate data through reversible mapping. The numerical intermediate data is then encrypted according to the encryption key to obtain an encrypted numerical result. Finally, the encrypted numerical result is restored to a character ciphertext segment through inverse mapping. For the numerical data segments in the segmented structure, the format is preserved and encrypted according to the encryption key to obtain the numerical ciphertext segments; For the predefined data segments in the segmented structure, a random permutation operation is performed according to the encryption key to obtain the predefined ciphertext segments; The character-type ciphertext segment, the numerical-type ciphertext segment, the predefined ciphertext segment, and the unprocessed data segment are assembled according to the segmentation structure to obtain format-preserving ciphertext, which matches the feature-sensitive data field in length, character type, and overall structure.

4. The data encryption and desensitization method in a hybrid cloud environment according to claim 1, characterized in that, The step of encrypting and rewriting the data query request according to the data desensitization strategy and the encryption key to generate a ciphertext query request includes: The data query request is parsed, and the query conditions in the data query request are identified. The query conditions include the target field to be queried and the constant value corresponding to the target field. Based on the data desensitization strategy, determine the encryption method used for the target field during the data storage stage; The constant value is encrypted into a ciphertext constant according to the determined encryption method and the encryption key; Replace the constant value in the query condition with the ciphertext constant to generate the ciphertext query request.

5. The data encryption and desensitization method in a hybrid cloud environment according to claim 1, characterized in that, The process of de-identifying the data query results according to the data request client and the data de-identification strategy includes: Based on the data anonymization strategy, obtain the data request client's access permissions to the target field; With plaintext access permission, the encrypted text corresponding to the target field in the data query result is decrypted according to the encryption key. Without plaintext access, the ciphertext corresponding to the target field in the data query result is retained, and the ciphertext is returned as the de-identified result.

6. The data encryption and desensitization method in a hybrid cloud environment according to claim 5, characterized in that, The step of retaining the ciphertext corresponding to the target field in the data query result and returning the ciphertext as the de-identified result when there is no plaintext access permission includes: When the target field corresponds to the feature-sensitive data field, the ciphertext is kept to have the same length, character type, and structure format as the original data, and is returned to the data request client as the de-identified result.

7. The data encryption and desensitization method in a hybrid cloud environment according to claim 1, characterized in that, The process of identifying and classifying fields in the original data includes: Based on the structural and semantic features of the data fields, the fields in the original data are identified and classified using a classification model.

8. A data encryption and desensitization device for a hybrid cloud environment, characterized in that, The device includes: The field classification module is configured to receive raw data sent by the data owner client, identify and classify the fields in the raw data, and obtain the field classification results. The policy acquisition module is configured to acquire the data desensitization policy and encryption key corresponding to the data owner client; The encryption module is configured to perform differential encryption on the field classification results according to the data desensitization strategy and the encryption key, and then store them. The request encryption module is configured to respond to a data query request sent by a data request client by encrypting and rewriting the data query request according to the data desensitization strategy and the encryption key to generate a ciphertext query request. The query module is configured to obtain data query results based on the encrypted query request; The data anonymization module is configured to anonymize the data query results according to the data request client and the data anonymization strategy.

9. An electronic device, characterized in that, It includes a processor, a memory, and a program or instructions stored in the memory and executable on the processor, wherein when the program or instructions are executed by the processor, they implement the steps of the data encryption and desensitization method in a hybrid cloud environment as described in claims 1-7.

10. A readable storage medium, characterized in that, The program or instructions are stored on the readable storage medium, and when the program or instructions are executed by the processor, they implement the steps of the data encryption and desensitization method in the hybrid cloud environment as described in claims 1-7.

Images