Desensitization script generation method and device adaptive to various databases, medium and product

Abstract

The invention discloses a desensitization script generation method and device adaptive to various databases, a medium and a product, and the method comprises the steps: obtaining a target desensitization rule constructed by a developer through a natural language, and converting a semantic abstract template irrelevant to the database in the target desensitization rule into a parameterized script template irrelevant to the database; and in response to a request for applying the target desensitization rule to the target database, obtaining a target database type of the target database, and obtaining a target grammar mapping set matched with the target database type in a pre-constructed multi-database dialect knowledge base. And performing grammar conversion on the parameterized script template corresponding to the target desensitization rule by using the target grammar mapping set to obtain a target desensitization script matched with the target database. According to the technical scheme, the consistency of behaviors of the same desensitization rule in different database type environments is ensured, and the standardization level of data security management is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and in particular to a desensitization script generation method, device, medium and product suitable for multiple databases. BACKGROUND

[0002] Data desensitization is in the intersection of data management, data security and privacy protection. In the digital era, data has become the core asset of enterprises, but it faces security risks in the transmission, storage and processing links, especially the problem of sensitive data leakage, so it is crucial to protect the integrity, confidentiality and availability of data. The data desensitization module is an important part of the data architecture design to protect data security, and can dynamically adjust the desensitization strategy according to user needs, playing a crucial role in improving system security and supporting stable business development.

[0003] The existing desensitization tool belongs to business metadata, and the table design data is exported as a file according to the data format specified by the tool, then the file is imported into the desensitization tool to complete the desensitization design, and finally the desensitization script is generated by the tool. The traditional data desensitization method has obvious limitations: not only complex scripts need to be manually written, but also it is difficult to adapt to rapidly changing data needs; at the same time, its ability to accept and interface with existing design results is weak, which limits the guidance of the output results of the data architecture desensitization rule module design, and cannot provide convenient data table field desensitization design support for project developers. SUMMARY

[0004] The embodiments of the present application provide a desensitization script generation method, device, medium and product suitable for multiple databases, to solve the problem of consistent behavior of the same desensitization logic in different database environments.

[0005] According to an aspect of the embodiments of the present application, a desensitization script generation method suitable for multiple databases is provided, comprising:

[0006] Obtaining a target desensitization rule constructed by a developer through natural language, and converting a semantic abstraction template in the target desensitization rule that is independent of a database into a parameterized script template independent of the database;

[0007] In response to a request to apply the target desensitization rule to a target database, obtaining a target database type of the target database, and obtaining a target syntax mapping set matched with the target database type in a pre-constructed multi-database dialect knowledge base;

[0008] Using the target syntax mapping set to perform syntax conversion on the parameterized script template corresponding to the target desensitization rule, to obtain a target desensitization script adapted to the target database.

[0009] According to another aspect of the embodiments of the present application, there is provided a de-sensitization script generation device for adapting to multiple databases, comprising:

[0010] a de-sensitization rule template conversion module configured to obtain a target de-sensitization rule constructed by a developer through a natural language, and convert a semantic abstraction template irrelevant to a database in the target de-sensitization rule into a parameterized script template irrelevant to the database;

[0011] a database syntax set obtaining module configured to, in response to a request of applying the target de-sensitization rule to a target database, obtain a target database type of the target database, and obtain a target syntax mapping set matched with the target database type from a pre-constructed multi-database dialect knowledge base;

[0012] a target de-sensitization script generation module configured to perform syntax conversion on the parameterized script template corresponding to the target de-sensitization rule using the target syntax mapping set, to obtain a target de-sensitization script adapted to the target database.

[0013] According to another aspect of the embodiments of the present application, there is provided an electronic device, comprising:

[0014] at least one processor; and

[0015] a memory in communication with the at least one processor; wherein

[0016] the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to perform the de-sensitization script generation method for adapting to multiple databases according to any of the embodiments of the present application.

[0017] According to another aspect of the embodiments of the present application, there is provided a computer readable storage medium storing computer instructions for enabling a processor to perform the de-sensitization script generation method for adapting to multiple databases according to any of the embodiments of the present application.

[0018] According to another aspect of the embodiments of the present application, there is also provided a computer program product comprising a computer program, which, when executed by a processor, implements the steps of the method according to any of the embodiments of the present application.

[0019] The technical scheme of the embodiment of the present application can obtain a target desensitization rule constructed by a developer through a natural language, and convert a semantic abstraction template irrelevant to a database in the target desensitization rule into a parameterized script template irrelevant to the database. In response to a request of applying the target desensitization rule to a target database, a target database type of the target database is obtained, and a target syntax mapping set matched with the target database type is obtained from a pre-constructed multi-database dialect knowledge base. The parameterized script template corresponding to the target desensitization rule is subjected to syntax conversion using the target syntax mapping set, to obtain a target desensitization script adapted to the target database. The technical scheme separates the desensitization rule template from the database syntax in the data desensitization process, is applicable to generating the desensitization script for multiple databases, ensures the consistency of behaviors of the same desensitization rule in different database type environments, and improves the standardization level of data security governance.

[0020] It should be understood that the content described in this part is not intended to identify key or important features of the embodiments of the present application, nor is it used to limit the scope of the present application. Other features of the present application will become apparent from the following description. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0022] Figure 1 is a flow chart of a desensitization script generation method suitable for multiple databases according to an embodiment of the present application;

[0023] Figure 2 is a flow chart of a desensitization script generation method suitable for multiple databases according to an embodiment of the present application;

[0024] Figure 3 is a structural schematic diagram of a desensitization script generation device suitable for multiple databases according to an embodiment of the present application;

[0025] Figure 4 is a structural schematic diagram of an electronic device for implementing the desensitization script generation method suitable for multiple databases according to an embodiment of the present application. DETAILED DESCRIPTION

[0026] In the following, the technical solutions in the embodiments of the present application will be described clearly and completely with reference to the drawings in the embodiments of the present application in order to make the technical personnel in the technical field better understand the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by the ordinary skilled in the art without creative work should belong to the scope of protection of the present application.

[0027] It should be noted that the terms "first", "second", and the like in the specification and claims of the present application and the above-described drawings are used to distinguish similar objects, and do not necessarily have to be used to describe a specific order or sequence. It should be understood that the data thus used can be interchanged under appropriate circumstances, so that the embodiments of the present application described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "include" and "have" and any variations thereof are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] Embodiment one

[0029] Figure 1 A flowchart of a method for generating a desensitization script adapted to multiple databases is provided for the first embodiment of the present application. This embodiment can be applied to separate business logic (desensitization rule template) from technical implementation (database syntax) during data desensitization processing, and is suitable for automatically generating desensitization scripts for multiple databases. The method can be executed by a desensitization script generation device adapted to multiple databases, which can be realized in the form of hardware and / or software and generally can be configured in a computer electronic device. As shown in the figure, the method comprises: Figure 1

[0030] S110, obtaining a target desensitization rule constructed by a developer through a natural language, and converting a semantic abstraction template in the target desensitization rule that is independent of a database into a parameterized script template that is independent of the database.

[0031] ​The target desensitization rule can refer to a standardized operation guideline currently being used to protect sensitive data security, and clearly specifies how data needs to be transformed, shielded, or replaced. Natural language can refer to colloquial or written expression (rather than code or script, etc. machine directly recognizable language) used in human daily communication, which can be used to intuitively describe the rules to be followed for data desensitization. The semantic abstraction template can refer to a standardized template that abstracts the specific data details in the desensitization rule and extracts a general semantic expression logic framework. The parameterized script template can refer to a reusable script framework that converts the desensitization rule, in which the key desensitization logic (such as data truncation bit number, replacement character, applicable data type, etc.) is reserved in the form of parameters, and only needs to fill in specific parameters to generate a standardized template of desensitization execution script adapted to different scenarios.

[0032] Specifically, before generating a desensitization script adapted to multiple databases, the target desensitization rule expression used needs to be processed. The target desensitization rule constructed by the developer through natural language can be obtained first. In the target desensitization rule expressed in natural language, the desensitization rule content can be expressed through a database-independent semantic abstraction template, which can be converted into a database-independent parameterized script template to extract a reusable script framework corresponding to the target desensitization rule, i.e. the target desensitization rule can be represented by {column_code} or {data_type} placeholders to represent target field encoding (i.e. string field to be processed) and data type variables. For example, the target desensitization rule is named “name_tail character masking rule”, and its associated database-independent semantic abstraction template is “for the string value of this field, truncate all prefix parts except the last character, and concatenate a mask symbol ‘ ’”, which can be converted into a database-independent parameterized script template as “CONCAT(LEFT( {column_code}, LEN( {column_code}) -1), ' ')”, where {column_code} is the target field code, “LEFT( {column_code}, LEN( {column_code}) - 1)” represents truncating all prefix parts except the last character of the field value, and CONCAT is used to concatenate the truncated prefix with the mask symbol .

[0033] S120, in response to the request of applying the target de-sensitization rule to the target database, obtaining a target database type of the target database, and obtaining a target syntax mapping set matched with the target database type in a pre-constructed multi-database dialect knowledge base.

[0034] The target database can refer to a database that needs to use a target de-sensitization rule to match a de-sensitization script generated by a database-independent parameterized script template. The target database type can refer to a data organization type of the target database, which has a specific syntax rule for generating a de-sensitization script. The target syntax mapping set can refer to a set of syntax mapping rules matched with the target database type, which converts the parameterized script template corresponding to the target de-sensitization rule into the corresponding de-sensitization script. The multi-database dialect knowledge base can refer to a set containing a plurality of database type syntax mapping sets matched with each defined de-sensitization rule.

[0035] It can be understood that in order to convert different de-sensitization rules and database-independent parameterized script templates into de-sensitization scripts, it is necessary to construct corresponding syntax mapping sets, and adapt each defined de-sensitization rule to all syntax mapping sets of different data types to construct a multi-database dialect knowledge base. When responding to the request of applying the target de-sensitization rule to the target database, the target syntax mapping set matched with the target database type can be selected from the multi-database dialect knowledge base to generate a de-sensitization script. For example, when constructing the syntax mapping set for the logical function LENGTH(string) representing the length of the string in the parameterized script template of the de-sensitization rule, different database types are adapted. In the database MySQL, the function is CHAR_LENGTH(string), in the database Oracle, the function is LENGTH(string), and in the database SQL Server, the function is LEN(string).

[0036] S130, using the target syntax mapping set to perform syntax conversion on the parameterized script template corresponding to the target de-sensitization rule, to obtain a target de-sensitization script adapted to the target database.

[0037] The target de-sensitization script can refer to a de-sensitization script generated by applying the target de-sensitization rule to the target database through the target syntax mapping set matched with the target database type.

[0038] It can be understood that after obtaining the target syntax mapping set matched with the target database type of the target database to which the target de-sensitization rule is applied, the target de-sensitization rule and the database-independent parameterized script template are converted into function and operator statements matched with the target database type, and all the converted statements are generated as a target de-sensitization script adapted to the target database. The target de-sensitization script can be used to perform de-sensitization processing on the data in the target database in accordance with the target de-sensitization rule.

[0039] The technical solution of the embodiment of the application can obtain a target desensitization rule constructed by a developer through a natural language, and convert a semantic abstraction template irrelevant to a database in the target desensitization rule into a parameterized script template irrelevant to the database. In response to a request of applying the target desensitization rule to a target database, a target database type of the target database is obtained, and a target syntax mapping set matched with the target database type is obtained from a pre-constructed multi-database dialect knowledge base. The parameterized script template corresponding to the target desensitization rule is subjected to syntax conversion using the target syntax mapping set, to obtain a target desensitization script adapted to the target database. The technical solution separates the desensitization rule template from the database syntax in the data desensitization process, is applicable to generating desensitization scripts for multiple databases, ensures the consistency of behaviors of the same desensitization rule in different database type environments, and improves the standardization level of data security governance.

[0040] Embodiment Two

[0041] Figure 2 A flowchart of a desensitization script generation method adapted to multiple databases is provided for the embodiment two of the application. The embodiment is specific on the basis of the above-mentioned embodiment, and includes a specific method of converting the parameterized script template corresponding to the target desensitization rule into the target desensitization script using the target syntax mapping set. As shown in the figure, the method includes: Figure 2

[0042] S210, obtaining a target desensitization rule constructed by a developer through a natural language, and converting a semantic abstraction template irrelevant to a database in the target desensitization rule into a parameterized script template irrelevant to the database.

[0043] S220, in response to a request of applying the target desensitization rule to a target database, obtaining a target database type of the target database, and obtaining a target syntax mapping set matched with the target database type from a pre-constructed multi-database dialect knowledge base.

[0044] S230, according to a rule name in the target desensitization rule and a data storage form of the target database, performing variable filling on a placeholder in the parameterized script template of the target desensitization rule.

[0045] The placeholder can be a reserved symbol / identifier in the parameterized script template, used for temporarily replacing a specific variable value to be filled subsequently, and is a core element for realizing parameterization of the script template and dynamic replacement of the variable.

[0046] ​It can be understood that the target desensitization rule defined using the natural language includes a rule name and a semantic abstraction template corresponding to the rule name, the rule name includes a data object name requiring desensitization processing and a desensitization operation type requiring execution, and the parameterized script template converted from the semantic abstraction template includes at least one placeholder for filling a variable. Before generating the target desensitization script for syntax conversion, the placeholders in the parameterized script template of the target desensitization rule can be filled with variables according to the rule name in the target desensitization rule and the data storage form of the target database, that is, the parameterized script template is instantiated, so that the parameterized script template can express the desensitization processing on the specified data in the target database.

[0047] Optionally, the parameterized script template specifically includes a first placeholder for filling a variable name, and a second placeholder for filling a variable type;

[0048] Correspondingly, the variable filling in the placeholders in the parameterized script template of the target desensitization rule according to the rule name in the target desensitization rule and the data storage form of the target database includes:

[0049] In the rule name of the target desensitization rule, the data object name requiring desensitization processing is extracted;

[0050] The data object name is semantically matched with each data field included in the target database to obtain a target data field matched with the data object name, and a target data type of the target data field is obtained;

[0051] The target data field is filled into a position of the first placeholder in the parameterized script template, and the target data type is filled into a position of the second placeholder in the parameterized script template.

[0052] The first placeholder can be a placeholder for filling a variable name in the parameterized script template. The second placeholder can be a placeholder for filling a variable type in the parameterized script template. The data object name can be a name of data requiring desensitization processing defined in the rule name of the desensitization rule defined using the natural language. The target data field can be a data field in the target database matched with the data object name defined in the target desensitization rule. The target data type can be a data type corresponding to the target data field, for example, can be a number, a character, or a word, etc.

[0053] Specifically, the process of matching the parameterized script template of the target desensitization rule with the target database to which the target desensitization rule is applied needs to instantiate the parameterized script template, that is, according to the data object name defined in the target desensitization rule, the semantic matching and filtering of all data fields in the target database are performed, the target data field matched with the data object name is filtered, and the corresponding target data type is obtained. According to the data storage form of the data field of the target data type in the target database, the target data field is filled into the placeholder in the parameterized script template, the target data field representing the variable name is filled into the first placeholder in the parameterized script template according to the definition syntax of the parameterized script template, and the target data type representing the variable type is filled into the second placeholder in the parameterized script template. Therefore, the application instance of the parameterized script template matched with the target database can be obtained.

[0054] S240, using the target syntax mapping set to convert the syntax of each general function and / or general operator contained in the parameterized script template, to obtain a target desensitization script adapted to the target database.

[0055] The general function can refer to a function in the parameterized script template that is independent of the database type and is used to operate variable data as an input parameter. The general operator can refer to an operator in the parameterized script template that is independent of the database type and is used to directly perform logical or mathematical operations on variable data.

[0056] It can be understood that the business logic in the target desensitization rule is described in the semantic abstraction template in a natural language manner. After the semantic abstraction template describing the target desensitization rule is converted into the parameterized script template, each item of business logic in the target desensitization rule can be described in the parameterized script template by using general functions and general operators in a general programming language. The general functions and general operators used are independent of the database type. After the target database is determined, the target syntax mapping set is used to convert the syntax of each general function and general operator contained in the parameterized script template, to convert the functions and operators into functions and operators adapted to the target database type, thereby obtaining a target desensitization script adapted to the target database.

[0057] Optionally, using the target syntax mapping set to convert the syntax of each general function and / or general operator contained in the parameterized script template, to obtain a target desensitization script adapted to the target database, includes:

[0058] sequentially obtaining a general function or a general operator in the parameterized script template as a current operation object;

[0059] In the target syntax mapping set, the target syntax mapping relationship matching the current operation object is queried, and the current operation object in the parameterized script template is syntax converted according to the target syntax mapping relationship.

[0060] The operation of sequentially obtaining a general function or a general operator in the parameterized script template as the current operation object is returned until the processing of all general functions and all general operators in the parameterized script template is completed.

[0061] The current operation object can be a programming language expression that is currently being mapped and converted during the process of generating the target de-sensitization script from the parameterized script template according to the target syntax mapping set, and can be a general function or a general operator.

[0062] Specifically, in the process of generating the target de-sensitization script that is adapted to the target database using the parameterized script template through the target syntax mapping set, a general function or a general operator can be sequentially obtained in the parameterized script template as the current operation object for syntax conversion operation. In the target syntax mapping set, the target syntax mapping relationship that is suitable for the target database type and matches the current operation object can be queried and obtained, and the current operation object in the parameterized script template is syntax converted according to the target syntax mapping relationship, and the current operation object is expressed using the syntax suitable for the target database type. After the syntax conversion processing of the current operation object is completed, the operation of sequentially obtaining the next general function or general operator in the parameterized script template as the current operation object is returned until all general functions and general operators in the parameterized script template are expressed using the syntax matched by the target database type, and finally the target de-sensitization script that is adapted to the target database is obtained.

[0063] S250, obtaining sample data matching the target database, and executing the target de-sensitization script on the sample data in a pre-constructed sandbox verification environment to obtain a de-sensitization test result matching the sample data.

[0064] The sample data can be test data with target data field characteristics constructed by simulating real data de-sensitization processing business scenarios, and can be used to verify the correctness, integrity and effectiveness of the de-sensitization script execution logic. The sandbox verification environment can be an independent test environment isolated from the system, which can input sample data simulating real business characteristics, execute the de-sensitization script and verify the output result, so as to verify whether the de-sensitization logic (such as field interception or mask splicing) of the script meets the expectation and whether the data processing is accurate and free of abnormality, while avoiding the impact of the verification process on real business data and production environment.

[0065] Specifically, when verifying the target de-identification script function generated through the target grammar mapping relationship, sample data matched with the target database can be acquired first. The sample data has the target data field feature and can be used as the input data for the logical test of the target de-identification script function. The de-identification test result obtained by performing the de-identification script on the sample data in the pre-constructed sandbox verification environment is compared with the sample data and the target de-identification rule, so that the correctness, integrity and effectiveness of the execution logic of the target de-identification script can be verified.

[0066] S260, if it is determined that the de-identification test result meets the preset de-identification rule deployment condition, the target de-identification script is deployed in the target database.

[0067] The de-identification rule deployment condition can be a condition under which the target de-identification script achieves the expected result in the de-identification test in the sandbox verification environment, and can be used to determine whether the target de-identification script can be deployed in the target database.

[0068] It can be understood that the execution logic of the target de-identification script is tested in the sandbox verification environment using the sample data matched with the target database. When the target de-identification script test result meets the preset de-identification rule deployment condition, the sample data can be processed according to the defined target de-identification rule and the corresponding de-identified data is obtained, and then the target de-identification script can be deployed in the target database to perform de-identification processing on the data in the target database according to the target de-identification rule.

[0069] Optionally, based on each of the above embodiments, in response to indication information of adding a new grammar mapping set in the multi-database dialect knowledge base, a new database type supported by the new grammar mapping set is acquired.

[0070] The new database type is prompted to the user to prompt the user that the multi-database dialect knowledge base can generate a de-identification script adapted to the new database type.

[0071] The user prompt can be a prompt instruction information generated for the user when a new database type needs to be adapted, and can be used to prompt the user to generate a target de-identification script matched with the new database type.

[0072] It can be understood that when the new database indication information is adapted in response, the syntax mapping set matched with the new database type needs to be added in the multi-database dialect knowledge base to meet the condition of converting the target de-identification rule from the parameterized script template to the de-identification script matched with the new database type, and a user prompt can be initiated according to the newly added database type, prompting the user that the multi-database dialect knowledge base can generate the adapted de-identification script for the new database type. Through the above method, the de-identification script generation can be automatically performed on the defined de-identification rule, with high expansion flexibility and very low cost.

[0073] The technical scheme of the embodiment of the application can obtain the target de-identification rule constructed by the developer through the natural language, and convert the semantic abstract template irrelevant to the database in the target de-identification rule into the parameterized script template irrelevant to the database. In response to the request of applying the target de-identification rule to the target database, the target database type of the target database is obtained, and the target syntax mapping set matched with the target database type is obtained in the pre-constructed multi-database dialect knowledge base. The placeholders in the parameterized script template of the target de-identification rule are filled with variables according to the rule name in the target de-identification rule and the data storage form of the target database. The general functions and / or general operators in the parameterized script template are converted in line with the target syntax mapping set, and the target de-identification script adapted to the target database is obtained. The sample data matched with the target database is obtained, and the target de-identification script is executed on the sample data in the pre-constructed sandbox verification environment, and the de-identification test result matched with the sample data is obtained. If it is determined that the de-identification test result meets the preset de-identification rule deployment condition, the target de-identification script is deployed in the target database. The above technical scheme realizes that the de-identification rule is defined once, and the de-identification script applicable to multiple database types is automatically generated, and when a new database type needs to be supported, the multi-database dialect knowledge base only needs to be expanded, without the need to modify all existing database scripts, thereby improving the flexibility and scalability of the de-identification rule script generation.

[0074] Embodiment three

[0075] Figure 3 A structural schematic diagram of a de-identification script generation device adapted to multiple databases provided by the embodiment three of the application is shown in FIG. 3. Figure 3 As shown in the figure, the device comprises a de-identification rule template conversion module 310, a database syntax set acquisition module 320 and a target de-identification script generation module 330.

[0076] The de-identification rule template conversion module 310 is configured to obtain the target de-identification rule constructed by the developer through the natural language, and convert the semantic abstract template irrelevant to the database in the target de-identification rule into the parameterized script template irrelevant to the database.

[0077] The database syntax set acquisition module 320 is configured to, in response to a request of applying the target desensitization rule to the target database, acquire a target database type of the target database, and acquire a target syntax mapping set matched with the target database type from the pre-constructed multi-database dialect knowledge base.

[0078] The target desensitization script generation module 330 is configured to perform syntax conversion on the parameterized script template corresponding to the target desensitization rule by using the target syntax mapping set, to obtain the target desensitization script adapted to the target database.

[0079] The technical scheme of the embodiment of the present application can acquire the target desensitization rule constructed by the developer through the natural language, and convert the semantic abstraction template irrelevant to the database in the target desensitization rule into the parameterized script template irrelevant to the database. In response to a request of applying the target desensitization rule to the target database, the target database type of the target database is acquired, and the target syntax mapping set matched with the target database type is acquired from the pre-constructed multi-database dialect knowledge base. The parameterized script template corresponding to the target desensitization rule is converted by using the target syntax mapping set, to obtain the target desensitization script adapted to the target database. The technical scheme separates the desensitization rule template from the database syntax in the data desensitization process, is applicable to generating the desensitization script for multiple databases, ensures the consistency of behaviors of the same desensitization rule in different database type environments, and improves the standardization level of data security governance.

[0080] Optionally, the target desensitization script generation module 330 can be specifically configured to perform variable filling on the placeholder in the parameterized script template of the target desensitization rule according to the rule name in the target desensitization rule and the data storage form of the target database.

[0081] Optionally, the target desensitization script generation module 330 can be specifically configured to extract the data object name needing to be desensitized in the rule name of the target desensitization rule. The data object name is matched with each data field contained in the target database to obtain the target data field matched with the data object name, and the target data type of the target data field is acquired. The target data field is filled into the position of the first placeholder in the parameterized script template, and the target data type is filled into the position of the second placeholder in the parameterized script template.

[0082] Optionally, the target desensitization script generation module 330 can be specifically configured to perform syntax conversion on each general function and / or general operator contained in the parameterized script template by using the target syntax mapping set, to obtain the target desensitization script adapted to the target database.

[0083] Optionally, the target desensitization script generation module 330 can also be specifically configured to sequentially obtain a general function or a general operator as a current operation object in the parameterized script template. In the target syntax mapping set, a target syntax mapping relationship matching the current operation object is queried, and the current operation object in the parameterized script template is subjected to syntax conversion according to the target syntax mapping relationship. The operation of sequentially obtaining a general function or a general operator as a current operation object in the parameterized script template is returned, and the processing of all general functions and all general operators in the parameterized script template is completed.

[0084] Optionally, the desensitization script verification module can also be configured to obtain sample data matching the target database, and execute the target desensitization script on the sample data in a pre-constructed sandbox verification environment to obtain a desensitization test result matching the sample data. If it is determined that the desensitization test result satisfies a preset desensitization rule deployment condition, the target desensitization script is deployed in the target database.

[0085] Optionally, the desensitization script extension module can also be configured to, in response to indication information of adding a new syntax mapping set in the multi-database dialect knowledge base, obtain a new database type supported by the new syntax mapping set. The new database type is prompted to the user to prompt the user that the multi-database dialect knowledge base can generate a desensitization script adapted to the new database type.

[0086] The desensitization script generation device for adapting to multiple databases provided by the embodiments of the present application can execute the desensitization script generation method for adapting to multiple databases provided by any of the embodiments of the present application, and has the corresponding function modules and beneficial effects of the execution method.

[0087] Embodiment four

[0088] Figure 4 A structural schematic diagram of an electronic device 10 that can be used to implement embodiments of the present application is shown. The electronic device is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smart phones, wearable devices (e.g., headsets, glasses, watches, etc.), and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not intended to limit the implementations of the present application described and / or claimed in this document.

[0089] As Figure 4As shown, the electronic device 10 includes at least one processor 11, and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., which is communicatively connected to the at least one processor 11, wherein the memory stores a computer program executable by the at least one processor. The processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or loaded from the storage unit 18 into the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0090] A plurality of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a magnetic disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network, such as the Internet, and / or various telecommunication networks.

[0091] The processor 11 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 performs various methods and processes described above, such as the method of generating a de-identification script adapted to multiple databases.

[0092] That is, the target de-identification rule constructed by the developer through natural language is obtained, and the semantic abstraction template in the target de-identification rule that is irrelevant to the database is converted into a parameterized script template irrelevant to the database;

[0093] In response to a request to apply the target de-identification rule to the target database, the target database type of the target database is obtained, and a target syntax mapping set matching the target database type is obtained in the pre-constructed multi-database dialect knowledge base;

[0094] The parameterized script template corresponding to the target de-identification rule is syntax-converted using the target syntax mapping set, to obtain a target de-identification script adapted to the target database.

[0095] In some embodiments, the de-identification script generation method adapted for multiple databases can be implemented as a computer program tangibly embodied in a computer readable storage medium, e.g., storage unit 18. In some embodiments, portions or all of the computer program can be loaded and / or installed onto electronic device 10 via, e.g., ROM 12 and / or communication unit 19. When the computer program is loaded onto RAM 13 and executed by processor 11, one or more steps of the de-identification script generation method adapted for multiple databases described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform the de-identification script generation method adapted for multiple databases by other means, e.g., with the aid of firmware.

[0096] Various implementations of the systems and techniques described above can be realized in digital electronic circuitry, integrated circuitry, a field programmable gate array (FPGA), an application specific integrated circuit (ASIC), a system on a chip (SOC), a programmable logic device (PLD), a computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and / or interpretable on a programmable system including at least one programmable processor, which can be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

[0097] Computer programs used to implement the present application can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the computer program running on the processor implements the functions / operations specified in the flowcharts and / or the block diagrams. The computer program can be executed entirely on a machine, partially on a machine, partially on a machine as a stand-alone software package, partially on a machine and partially on a remote machine or entirely on a remote machine or server.

[0098] In the context of the present application, a computer-readable storage medium can be a tangible medium that can contain or store a computer program for use by or in connection with an instruction execution system, apparatus, or device. A computer-readable storage medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of a machine-readable storage medium will include one or more lines of a program of instructions in a transitory signal, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0099] To provide for interaction with a user, the systems and techniques described here can be implemented on an electronic device having a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user and a keyboard and a pointing device (e.g., a mouse or a trackball) by which the user can provide input to the electronic device. Other kinds of devices can be used to provide for interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form, including acoustic, speech, or tactile input.

[0100] The systems and techniques described here can be implemented in a computing system that includes a back end component (e.g., as a data server), or that includes a middleware component (e.g., an application server), or that includes a front end component (e.g., a user computer having a graphical user interface or a Web browser through which a user can interact with an implementation of the systems and techniques described here), or any combination of such back end, middleware, or front end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0101] The computing system can include clients and servers. A client and server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system, to solve the defects of large management difficulty and weak business scalability in traditional physical host and VPS service.

[0102] It should be understood that the various forms of flow shown above can be used to reorder, add or delete steps. For example, each step described in the present application can be executed in parallel, sequentially or in a different order, as long as the desired results of the technical solutions of the present application can be achieved, which is not limited herein.

[0103] The above detailed description does not constitute a limitation on the scope of protection of the present application. Those skilled in the art should understand that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent replacements and improvements made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for generating de-identification scripts adaptable to multiple databases, characterized in that, include: Obtain the target de-identification rules constructed by developers using natural language, and convert the database-independent semantic abstract templates in the target de-identification rules into database-independent parameterized script templates; In response to a request to apply target de-identification rules to the target database, the target database type is obtained, and a target syntax mapping set matching the target database type is obtained from a pre-built multi-database dialect knowledge base; The target syntax mapping set is used to perform syntax transformation on the parameterized script template corresponding to the target de-identification rule to obtain the target de-identification script adapted to the target database.

2. The method according to claim 1, characterized in that, After obtaining the target de-identification script adapted to the target database, the following is also included: Obtain sample data that matches the target database, and execute the target de-identification script on the sample data in a pre-built sandbox verification environment to obtain de-identification test results that match the sample data; If the desensitization test results are determined to meet the preset desensitization rule deployment conditions, then the target desensitization script will be deployed in the target database.

3. The method according to claim 1, characterized in that, The semantic abstraction template describes the business logic of the target de-identification rules in natural language, while the parameterized script template describes the business logic of the target de-identification rules in general programming languages ​​using general functions and / or general operators. Accordingly, the parameterized script template corresponding to the target de-identification rule is syntactically transformed using the target syntax mapping set to obtain the target de-identification script adapted to the target database, including: The target syntax mapping set is used to perform syntax transformation on the various common functions and / or common operators contained in the parameterized script template to obtain a target de-identified script adapted to the target database.

4. The method according to claim 3, characterized in that, The target syntax mapping set is used to perform syntax transformation on the various common functions and / or common operators contained in the parameterized script template to obtain a target de-identified script adapted to the target database, including: In the parameterized script template, a general function or general operator is sequentially obtained as the current operation object; In the target syntax mapping set, query the target syntax mapping relationship that matches the current operation object, and perform syntax transformation on the current operation object in the parameterized script template according to the target syntax mapping relationship; Return to the execution of operations that sequentially retrieve a generic function or generic operator from the parameterized script template as the current operation object, until all generic functions and generic operators in the parameterized script template have been processed.

5. The method according to claim 1, characterized in that, The target de-identification rule specifically includes: a rule name and a semantic abstract template corresponding to the rule name. The rule name includes the name of the data object to be de-identified and the type of de-identification operation to be performed. The parameterized script template also includes at least one placeholder for filling variables. Accordingly, before performing syntax transformation on the parameterized script template using the target syntax mapping set, the following steps are also included: Based on the rule name in the target de-identification rule and the data storage format of the target database, the placeholders in the parameterized script template of the target de-identification rule are populated with variables.

6. The method according to claim 5, characterized in that, The parameterized script template specifically includes a first placeholder for filling variable names and a second placeholder for filling variable types. Accordingly, based on the rule name in the target de-identification rule and the data storage format of the target database, the placeholders in the parameterized script template of the target de-identification rule are populated with variables, including: Extract the names of the data objects that need to be de-identified from the rule names of the target de-identification rules; Semantically match the data object name with each data field contained in the target database to obtain the target data field that matches the data object name, and obtain the target data type of the target data field; Fill the target data field into the position of the first placeholder in the parameterized script template, and fill the target data type into the position of the second placeholder in the parameterized script template.

7. The method according to any one of claims 1-6, characterized in that, The method further includes: In response to the indication that a new grammar map set is added to a multi-database dialect knowledge base, the new database types supported by the new grammar map set are obtained. Provide user prompts for new database types, indicating that the multi-database dialect knowledge base can generate appropriate de-identification scripts for new database types.

8. An electronic device, characterized in that, The electronic device includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the de-identification script generation method adapted to multiple databases as described in any one of claims 1-7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that, when executed by a processor, implement the de-identification script generation method adapted to multiple databases as described in any one of claims 1-7.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the method for generating de-identified scripts compatible with multiple databases according to any one of claims 1-7.

Images