Data desensitization method and device, equipment, storage medium and program product

Abstract

The invention provides a data desensitization method and device, equipment, a storage medium and a program product. Relates to the field of data processing. The method comprises the following steps: receiving a data query request sent by calling equipment through a preset interface, wherein the query request is used for calling data in a database; according to the query request, determining a first parameter indicating the identity information of the calling device, and determining to-be-desensitized first data in a database; obtaining a strategy template, wherein the strategy template is used for indicating a corresponding relation between the parameter and the desensitization strategy; determining a target desensitization strategy corresponding to the first data according to the strategy template and the first parameter; and desensitizing the first data according to the target desensitization strategy to obtain desensitized data, and sending the desensitized data to the calling device. Therefore, the data desensitization efficiency is improved.

Description

Technical Field

[0001] This application relates to the field of data processing, and in particular to a data desensitization method, apparatus, device, storage medium, and program product. Background Technology

[0002] Log data, as a core record of business system operation, is widely used in scenarios such as troubleshooting, user behavior analysis, and security auditing.

[0003] In related technologies, due to the potential for sensitive information contained in log data, data anonymization is necessary during data querying and display. For the data query interfaces of business systems, data anonymization can be achieved by modifying the interface code.

[0004] However, the above methods require a significant amount of work to modify the interface code, resulting in low efficiency in data anonymization. Summary of the Invention

[0005] This application provides a data anonymization method, apparatus, device, storage medium, and program product to solve the problem of low efficiency in data anonymization.

[0006] Firstly, this application provides a data anonymization method, comprising:

[0007] The system receives data query requests sent by the calling device through a preset interface. These query requests are used to retrieve data from the database.

[0008] Based on the query request, determine the first parameter indicating the identity information of the device to be invoked, and determine the first data to be de-identified in the database;

[0009] Obtain the strategy template, which indicates the correspondence between parameters and de-identification strategies;

[0010] Based on the strategy template and the first parameter, determine the target de-identification strategy corresponding to the first data;

[0011] The first data is de-identified according to the target de-identification strategy to obtain de-identified data, and then the de-identified data is sent to the calling device.

[0012] In one possible design, the target de-identification strategy corresponding to the first data is determined based on the strategy template and the first parameter, including:

[0013] Based on the first parameter, the business scenario of the first data and the user type of the calling device are determined. The business scenario is used to indicate the usage scenario of the first data.

[0014] Based on the business scenario, determine the first field to be de-identified within the first data;

[0015] Based on the user type and the first field, determine the target de-identification strategy corresponding to the first data in the strategy template.

[0016] In one possible design, based on the user type and the first field, the target de-identification strategy corresponding to the first data is determined in the strategy template, including:

[0017] Based on the first field, determine at least one first strategy corresponding to the first field in the strategy template;

[0018] Based on the user type, determine the corresponding de-identification level for the user. The de-identification level is used to indicate the degree to which the data is de-identified.

[0019] Based on the desensitization level, determine the target desensitization strategy corresponding to the first data in at least one first strategy.

[0020] In one possible design, the first data is de-identified according to the target de-identification strategy, including:

[0021] Determine the value of the first field corresponding to the first field;

[0022] Based on the target desensitization strategy, determine the desensitization range corresponding to the first field;

[0023] Based on the desensitization range, determine the target character within the desensitization range within the first field value;

[0024] The target character within the first field value is replaced using a preset character.

[0025] In one possible design, before obtaining the strategy template, the following steps are also included:

[0026] Retrieve multiple second fields and multiple second parameters. The values ​​of the second fields need to be de-identified, and the second parameters are the input parameters of the preset interface.

[0027] Generate an interface strategy library based on multiple second fields and multiple second parameters;

[0028] Obtain at least one second strategy corresponding to multiple second fields and the desensitization level corresponding to at least one second strategy;

[0029] The interface strategy library, at least one second strategy, and the corresponding desensitization level of at least one second strategy are parsed and processed to generate a strategy template that can be recognized by machines. The strategy template can be carried in any of the following forms: independent system form, static library form, and fixed plug-in form.

[0030] In one possible design, after desensitizing the first data according to the target desensitization strategy to obtain the desensitized data, the following steps are also included:

[0031] Get the length of the first field of the first data and the length of the second field of the de-identified data;

[0032] When the lengths of the first field and the second field are different, a de-identification error message is generated;

[0033] When the lengths of the first and second fields are the same, the length and position of the field to be replaced are determined according to the target desensitization strategy.

[0034] Determine the length and position of the replaced field in the de-identified data. Generate de-identification error messages when the length of the field to be replaced and the length of the replaced field are different, or when the position of the field to be replaced and the position of the replaced field are different.

[0035] Secondly, this application provides a data de-identification device, comprising: a receiving module, a first determining module, an acquiring module, a second determining module, and a de-identification processing module, wherein,

[0036] The receiving module is used to receive data query requests sent by the calling device through a preset interface. The query requests are used to retrieve data from the database.

[0037] The first determining module is used to determine, based on the query request, the first parameter indicating the identity information of the device to be invoked, and the first data to be de-identified in the database;

[0038] The acquisition module is used to acquire the strategy template, which indicates the correspondence between parameters and de-identification strategies.

[0039] The second determining module is used to determine the target de-identification strategy corresponding to the first data based on the strategy template and the first parameter.

[0040] The desensitization processing module is used to desensitize the first data according to the target desensitization strategy, obtain desensitized data, and send the desensitized data to the calling device.

[0041] In one possible design, the second determining module is specifically used for,

[0042] Based on the first parameter, the business scenario of the first data and the user type of the calling device are determined. The business scenario is used to indicate the usage scenario of the first data.

[0043] Based on the business scenario, determine the first field to be de-identified within the first data;

[0044] Based on the user type and the first field, determine the target de-identification strategy corresponding to the first data in the strategy template.

[0045] In one possible design, the second determining module is specifically used for,

[0046] Based on the first field, determine at least one first strategy corresponding to the first field in the strategy template;

[0047] Based on the user type, determine the corresponding de-identification level for the user. The de-identification level is used to indicate the degree to which the data is de-identified.

[0048] Based on the desensitization level, determine the target desensitization strategy corresponding to the first data in at least one first strategy.

[0049] In one possible design, the second determining module is specifically used for,

[0050] Determine the value of the first field corresponding to the first field;

[0051] Based on the target desensitization strategy, determine the desensitization range corresponding to the first field;

[0052] Based on the desensitization range, determine the target character within the desensitization range within the first field value;

[0053] The target character within the first field value is replaced using a preset character.

[0054] In one possible design, the device also includes a generation module, wherein,

[0055] The generation module is used to obtain multiple second fields and multiple second parameters. The values ​​of the second fields corresponding to the second fields need to be de-identified, and the second parameters are the input parameters of the preset interface.

[0056] Generate an interface strategy library based on multiple second fields and multiple second parameters;

[0057] Obtain at least one second strategy corresponding to multiple second fields and the desensitization level corresponding to at least one second strategy;

[0058] The interface strategy library, at least one second strategy, and the desensitization level corresponding to at least one second strategy are parsed to obtain a strategy template that can be recognized by a machine. The strategy template can be carried in any of the following forms: independent system form, static library form, and fixed plug-in form.

[0059] In one possible design, the device also includes a verification module, wherein,

[0060] The verification module is used to obtain the length of the first field of the first data and the length of the second field of the de-identified data;

[0061] When the lengths of the first field and the second field are different, a de-identification error message is generated;

[0062] When the lengths of the first and second fields are the same, the length and position of the field to be replaced are determined according to the target desensitization strategy.

[0063] Determine the length and position of the replaced field in the de-identified data. Generate de-identification error messages when the length of the field to be replaced and the length of the replaced field are different, or when the position of the field to be replaced and the position of the replaced field are different.

[0064] Thirdly, this application provides an electronic device, comprising: at least one processor and a memory; the memory storing computer-executable instructions; and at least one processor executing the computer-executable instructions stored in the memory, such that the at least one processor performs the data desensitization method as described in the first aspect and various possible designs of the first aspect.

[0065] Fourthly, this application provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the data desensitization method described in the first aspect and various possible designs of the first aspect.

[0066] Fifthly, this application provides a computer program product, including a computer program, which, when executed by a processor, implements the data desensitization method described in the first aspect and various possible designs of the first aspect.

[0067] The data anonymization method, apparatus, device, storage medium, and program product provided in this application, when data is called through an interface, requires anonymization of the called data. It can receive data query requests sent by the calling device through a preset interface. The query request is used to retrieve data from a database. Based on the query request, a first parameter indicating the identity information of the calling device and the first data to be anonymized in the database are determined. A strategy template is obtained, which indicates the correspondence between the parameter and the anonymization strategy. Based on the strategy template and the first parameter, the target anonymization strategy corresponding to the first data is determined. The first data is anonymized according to the target anonymization strategy to obtain anonymized data, which is then sent to the calling device. In this way, the anonymization strategy can be determined within a preset strategy template based on the first parameter indicating the identity information of the calling device (i.e., the input parameter) and the first data to be anonymized (i.e., the output parameter), thereby anonymizing the data without requiring modification to the interface, thus improving the efficiency of data anonymization. Attached Figure Description

[0068] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0069] Figure 1This is a schematic diagram of the system architecture provided for an embodiment of this application;

[0070] Figure 2 A flowchart illustrating a data anonymization method provided in an embodiment of this application;

[0071] Figure 3 A schematic diagram illustrating the process of determining the target desensitization strategy provided in the embodiments of this application;

[0072] Figure 4 This is a schematic diagram illustrating the process of verifying de-identified data provided in an embodiment of this application;

[0073] Figure 5 This is a schematic diagram of the structure of a data desensitization device provided in an embodiment of this application;

[0074] Figure 6 This is a schematic diagram of another data desensitization device provided in an embodiment of this application;

[0075] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0076] The accompanying drawings have illustrated specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to specific embodiments. Detailed Implementation

[0077] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0078] The collection, storage, use, processing, transmission, provision, and disclosure of financial data or user data involved in the technical solution of this application all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0079] It should be noted that in the embodiments of this application, certain software, components, models and other existing solutions in the industry may be mentioned. These should be regarded as exemplary and are only intended to illustrate the feasibility of implementing the technical solution of this application. However, it does not mean that the applicant has used or necessarily used the solution.

[0080] To facilitate understanding, the following will be combined with... Figure 1The system architecture applicable to the embodiments of this application will be described.

[0081] Figure 1 This is a schematic diagram of the system architecture provided for an embodiment of this application. Please refer to [link / reference]. Figure 1 This includes calling devices and electronic devices. Calling devices can be user terminal devices, clients, etc., while electronic devices can be devices with on-device computing capabilities, such as terminal devices or servers. The electronic devices may run business systems, which generate log data during operation. Calling devices can send data query requests to the electronic devices. Upon receiving the query request, the electronic devices can retrieve the data to be queried from an internal database or data warehouse, perform data anonymization processing, and then return the data to the user's calling device.

[0082] In related technologies, databases can process data row by row through iterative processing of single tuples. Specifically, sequential scan nodes, acting as leaf nodes in the query execution plan, read data from the base table row by row and pass single tuples to upper-level nodes. However, in this method, each iteration requires significant computational resources, leading to wasted resources and reduced utilization.

[0083] To address the aforementioned technical issues, in this embodiment, when data is accessed via an interface, the accessed data needs to be anonymized. This can be achieved by receiving a data query request from the accessing device through a preset interface. This query request is used to access data from a database. Based on the query request, a first parameter indicating the identity information of the accessing device and the first data to be anonymized in the database are determined. A strategy template is obtained, indicating the correspondence between the parameter and the anonymization strategy. Based on the strategy template and the first parameter, the target anonymization strategy corresponding to the first data is determined. The first data is then anonymized according to the target anonymization strategy to obtain anonymized data, which is then sent to the accessing device. In this way, the anonymization strategy can be determined within a preset strategy template based on the first parameter indicating the identity information of the accessing device (i.e., the input parameter) and the first data to be anonymized (i.e., the output parameter), thereby anonymizing the data without requiring interface modifications, thus improving the efficiency of data anonymization.

[0084] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0085] Figure 2 This is a schematic flowchart illustrating a data anonymization method provided in an embodiment of this application. Please refer to [link / reference]. Figure 2 As shown, the method may include the following steps:

[0086] S201. Receive data query requests sent by the calling device through a preset interface.

[0087] The execution subject of this application embodiment can be an electronic device or a data desensitization device installed in an electronic device. The data desensitization device can be implemented by software or by a combination of software and hardware.

[0088] The preset interface can define a data transmission channel with predefined communication rules for calling devices and electronic devices. The calling device can request and query data through the preset interface of the electronic device.

[0089] The calling device can refer to the user's terminal device, that is, the terminal device that initiates the data query request.

[0090] A data query request can be a request sent from a calling device to an electronic device. It can be used to retrieve data within a database. For example, a data query request can be used to retrieve log data from an electronic device.

[0091] Understandably, after receiving a data query request, an electronic device can retrieve data from a database and / or data warehouse based on the request. The electronic device needs to de-identify the data before returning the de-identified data to the calling device.

[0092] S202. Based on the data query request, determine the first parameter indicating the identity information of the device to be called, and determine the first data to be de-identified in the database.

[0093] The first parameter can be used to indicate the identity information of the calling device. It can be understood that the first parameter can be the input parameter for data query. The first parameter may include the system type of the calling device, device identifier, login account permissions, application scenario, and the functional module that triggers the data query request.

[0094] In one possible implementation, the first parameter can be determined based on the request message of the data query request, that is, by parsing and extracting the request message of the data query request to determine the first parameter.

[0095] The first data can refer to the raw data retrieved from the database based on the query conditions in the query request, which may contain sensitive information. It can be understood that the first data can be a data set, meaning it can contain multiple data items. For example, the first data could be log data, order data, historical transaction data, etc.

[0096] The database can be an internal database of an electronic device or a data warehouse. Specifically, an internal database can be a database that stores daily business data, while a data warehouse can be an integrated database that integrates multiple sources.

[0097] In one possible implementation, the first data can be determined based on the request message of the data query request. That is, the data location, data query range, data query conditions, etc. in the request message can be extracted, and the first data can be determined in the database based on the data location, data query range, and data query conditions.

[0098] S203, Obtain the strategy template.

[0099] The strategy template can be a pre-set set of rules used to indicate the correspondence between parameters and de-identification strategies.

[0100] In one possible implementation, the first data may include multiple fields and their corresponding field values. Different fields may correspond to different desensitization strategies. For example, assuming field 1 is "residential address", there are two desensitization strategies for the residential address field. The first desensitization strategy is to keep only the province and city information and hide the specific street and house number information. The second desensitization strategy is to keep only the first and last characters of the province, city, specific street, and house number information fields and hide the rest of the fields.

[0101] In one possible implementation, a strategy template can be generated as follows: Obtain multiple second fields and multiple second parameters, where the values ​​of the second fields need to be anonymized, and the second parameters are input parameters of a preset interface; generate an interface strategy library based on the multiple second fields and multiple second parameters; obtain at least one second strategy corresponding to the multiple second fields and an anonymization level corresponding to the at least one second strategy; parse the interface strategy library, at least one second strategy, and at least one anonymization level to obtain a machine-recognizable strategy template, which can be carried in any of the following forms: independent system form, static library form, and fixed plugin form.

[0102] The second field can be any sensitive data field that needs to be de-identified. For example, the second field can include sensitive data such as name, identity information, address, bank card number, and mobile phone number.

[0103] The second parameter can be any of the possible input parameters, such as system type, device identifier, login account permissions, application scenario, etc. The interface policy library can refer to a data set including all input and output parameters.

[0104] The second strategy can refer to the specific de-identification operation for the second field. For example, the second strategy could be: retain the first three and last three digits of the ID number. The de-identification level can be used to indicate the strength of the de-identification; understandably, the stronger the de-identification level, the stronger the de-identification strategy and the better the security. Understandably, the second strategy and the corresponding de-identification level can be preset by the user.

[0105] Parsing processing can refer to the process of integrating and formatting the interface strategy library, at least one second strategy, and the corresponding de-identification levels of at least one second strategy. It can be understood that the interface strategy library, at least one second strategy, and the corresponding de-identification levels of at least one second strategy output by the user are in natural language format. After parsing processing, machine-readable code or language can be obtained.

[0106] The carrier form of a policy template can refer to its deployment format. Policy templates support three carrier forms to adapt to different de-identification system architectures. Specifically, the independent system form means that the policy template is deployed in an independent policy management system, and electronic devices obtain the policy through interface calls, which is suitable for distributed de-identification systems; the static library form means that the policy template is compiled into a static link library and embedded into the code of the electronic device, which is suitable for stand-alone de-identification systems; and the fixed plug-in form means that the policy template is encapsulated as a pluggable plug-in, which is suitable for scenarios where policies are frequently updated.

[0107] S204. Based on the strategy template and the first parameter, determine the target de-identification strategy corresponding to the first data.

[0108] The target de-identification strategy can refer to the de-identification strategy matched from the strategy template for the first data corresponding to the data query request.

[0109] In one possible implementation, the target de-identification strategy can be determined as follows: based on the first parameter, determine the business scenario of the first data and the user type of the calling device, whereby the business scenario indicates the usage scenario of the first data; based on the business scenario, determine the first field to be de-identified within the first data; based on the user type and the first field, determine the target de-identification strategy corresponding to the first data in the strategy template.

[0110] Among them, the business scenario can refer to the specific use scenario of the first data, that is, the purpose and use of calling the device to query the data. For example, the business scenario can include external scenarios and internal scenarios. Specifically, the external scenario can include the review scenario, and the internal scenario can include the query scenario. Understandably, the anonymization requirements for external scenarios are higher, while the anonymization requirements for internal scenarios are lower.

[0111] The first field can refer to the specific field in the first set of data that needs to be anonymized, i.e., a sensitive field, such as customer name, ID number, bank card number, or mobile phone number. Understandably, the first field is related to the business scenario; that is, the fields requiring anonymization may differ in different scenarios.

[0112] S205. De-identify the first data according to the target de-identification strategy to obtain de-identified data, and send the de-identified data to the calling device.

[0113] Desensitization processing can refer to the process of hiding or replacing sensitive information in the first field of the first data according to the target desensitization strategy.

[0114] Desensitized data can be the data obtained after the original data has been desensitized. As you can understand, desensitized data is secure data with sensitive information removed. Desensitized data retains the non-sensitive parts and data format of the original data and can meet the normal use requirements of the calling device, but it cannot restore the original sensitive information.

[0115] In one possible implementation, the desensitization process can be performed as follows: determine the value of the first field corresponding to the first field; determine the desensitization range corresponding to the first field according to the target desensitization strategy; determine the target character within the desensitization range based on the desensitization range value; and perform a replacement process on the target character within the first field value value, wherein the replacement process is used to replace the target character with a preset character.

[0116] The value of the first field can refer to the specific content of the first field. For example, if the first field is an ID number, the value of the first field can be 1234567890.

[0117] The desensitization range can refer to the range of characters that need to be desensitized as specified in the target desensitization strategy. For example, the desensitization range can be from the 3rd character to the 10th character.

[0118] The target character can refer to a specific character within the desensitization range of the first field value.

[0119] Preset characters can refer to predefined characters or strings used to replace target characters. Preset characters can be characters without actual meaning, for example, a preset character can be "*".

[0120] For example, assuming the value of the first field is "1234567890", according to the target desensitization strategy, the desensitization range corresponding to the first field is determined to be the 3rd to 9th characters. Then the target character within the desensitization range can be determined to be "3456789". Assuming the preset character is "*", after replacing the target character within the value of the first field, the desensitized data obtained is "12*******0".

[0121] In this embodiment, when data anonymization is required, a data query request sent by a calling device can be received through a preset interface. The preset interface can be a data transmission channel for which communication rules are predefined between the calling device and the electronic device. The calling device can refer to a user's terminal device, and the data query request can be used to retrieve data from a database. Based on the data query request, a first parameter indicating the identity information of the calling device and a first data to be anonymized in the database are determined. The first parameter can be used to indicate the identity information of the calling device, and the first data can refer to the original data that may contain sensitive information retrieved from the database according to the query conditions in the query request. A strategy template is obtained, which can be a set of rules set in advance. Based on the strategy template and the first parameter, a target anonymization strategy corresponding to the first data is determined. The target anonymization strategy can refer to the anonymization strategy matched by the first data corresponding to the data query request from the strategy template. The first data is anonymized according to the target anonymization strategy to obtain anonymized data, and the anonymized data is sent to the calling device. The anonymization process can refer to the process of hiding or replacing sensitive information in the first field of the first data according to the target anonymization strategy. In this way, by using the above method, the desensitization strategy can be determined within the preset strategy template based on the first parameter (i.e., input parameter) of the device's identity information and the first data to be desensitized (i.e., output parameter), thereby desensitizing the data without modifying the interface, avoiding intrusive operations that directly modify the business system code, thus improving the efficiency of data desensitization.

[0122] Based on any of the above embodiments, the following, in conjunction with Figure 3 The process of determining the target desensitization strategy is explained in detail.

[0123] Figure 3 This is a schematic diagram illustrating the process of determining the target desensitization strategy provided in an embodiment of this application. Please refer to... Figure 3 The method may include:

[0124] S301. Based on the first parameter, determine the business scenario of the first data and the user type of the device calling.

[0125] Business scenarios can be used to indicate the usage scenarios of primary data. For example, business scenarios can include external audit scenarios, internal operation and maintenance scenarios, etc.

[0126] User type can refer to the user identity type corresponding to the device being called. For example, user type can include administrator, internal user, external user, etc. Understandably, different user types can be associated with the degree of desensitization. For example, the desensitization degree of the administrator is the lowest, the desensitization degree of the external user is the highest, and the desensitization degree of the internal user can be higher than that of the external user but lower than that of the administrator.

[0127] In one possible implementation, the business scenario of the first data and the user type of the calling device can be determined by extracting the fields of the business scenario of the first data and the user type of the calling device from the first parameter.

[0128] S302. Based on the business scenario, determine the first field to be de-identified within the first data.

[0129] The first field can refer to the sensitive field in the first data that needs to be de-identified.

[0130] It's understandable that different business scenarios may require different fields to be de-identified.

[0131] For example, for external consultation business scenarios, it is necessary to de-identify ID card number, home address, user name, etc., that is, the first field to be de-identified can include ID card number, home address, user name, order number; for internal query business scenarios, only home address can be de-identified, that is, the first field to be de-identified can include home address.

[0132] In one possible implementation, multiple third fields within the first data can be obtained. Based on the business scenario, the target field to be de-identified corresponding to the business scenario can be determined in a preset lookup table. The field that is the same as the target field to be de-identified is determined as the first field to be de-identified.

[0133] S303. Based on the user type and the first field, determine the target de-identification strategy corresponding to the first data in the strategy template.

[0134] In one possible implementation, the target de-identification strategy can be determined as follows: based on the first field, determine at least one first strategy corresponding to the first field in the strategy template; based on the user type, determine the de-identification level corresponding to the user; based on the de-identification level, determine the target de-identification strategy corresponding to the first data in at least one first strategy.

[0135] Among them, the desensitization level can be used to indicate the degree of data desensitization, that is, the desensitization level can be a quantitative indicator to measure the intensity of desensitization.

[0136] Understandably, the level of desensitization is related to the user type; that is, different user types correspond to different levels of desensitization. For example, suppose the desensitization levels include a first level, a second level, and a third level, where the first level has the highest degree of desensitization, the second level has a lower degree of desensitization, and the third level has a lower degree of desensitization.

[0137] Based on the strategy template, at least one first strategy can be determined for each first field. Each first strategy can correspond to different de-identification levels. Thus, based on the de-identification level corresponding to the user, the target de-identification strategy corresponding to the first data can be determined from at least one first strategy.

[0138] exist Figure 3 In the illustrated embodiment, when it is necessary to determine the target de-identification strategy, the business scenario of the first data and the user type of the calling device can be determined based on the first parameter. The business scenario can indicate the usage scenario of the first data, and the user type can refer to the user identity type corresponding to the calling device. Based on the business scenario, the first field to be de-identified is determined within the first data. Based on the user type and the first field, the target de-identification strategy corresponding to the first data is determined in the strategy template. In this way, the target de-identification strategy can be determined in the strategy template based on the de-identification level corresponding to the user type and the first field corresponding to the business scenario. This enables multi-dimensional matching, thereby ensuring dynamic de-identification of sensitive data under different business scenarios and guaranteeing data availability under high-privilege scenarios.

[0139] Based on any of the above embodiments, the following, in conjunction with Figure 4 The verification process after obtaining the anonymized data is explained in detail.

[0140] Figure 4 This is a schematic diagram illustrating the process of verifying de-identified data as provided in an embodiment of this application. Please refer to [link / reference]. Figure 4 The method may include:

[0141] S401. Obtain the length of the first field of the first data and the length of the second field of the de-identified data.

[0142] The first data can be the original, un-anonymized data, and the anonymized data can be the data after anonymization. Understandably, the length of the data before and after anonymization should remain unchanged.

[0143] For example, the length of the first field can be 10, and the length of the second field can also be 10, that is, the lengths of the first field and the second field are the same.

[0144] S402. Determine if the lengths of the first field and the second field are the same.

[0145] It is understandable that when the lengths of the first and second fields are the same, it can be assumed that the field lengths of the first data and the de-identified data are the same, that is, the field length validation passes.

[0146] If so, then execute S403.

[0147] If not, then execute S405.

[0148] S403. Based on the target desensitization strategy, determine the length and position of the field to be replaced, as well as the length and position of the replaced field in the desensitized data.

[0149] The length of the field to be replaced can refer to the length of the target character, while the length of the replaced field can be the length of the preset character.

[0150] The position of the field to be replaced can be determined based on the desensitization range of the target desensitization strategy. In one possible implementation, the start and end positions of the desensitization range can be determined, and the position between the start and end positions can be determined as the position of the field to be replaced.

[0151] The position of the replaced field can be determined based on the position of the preset character, that is, the position of the actual replaced character.

[0152] S404. Determine whether the length of the field to be replaced is different from the length of the field already replaced, or whether the position of the field to be replaced is different from the position of the field already replaced.

[0153] If so, then execute S405.

[0154] If not, then execute S406.

[0155] Understandably, if the length of the field to be replaced is different from the length of the field already replaced, or the position of the field to be replaced is different from the position of the field already replaced, it can be considered that the data before and after the data masking is different, that is, the data masking has failed; if the length of the field to be replaced is the same as the length of the field already replaced, and the position of the field to be replaced is the same as the position of the field already replaced, it can be considered that the data masking is correct, that is, the data masking verification has passed.

[0156] S405. Generate desensitization error information.

[0157] The de-identification error message can be a structured prompt message generated when the verification fails.

[0158] In one possible implementation, the de-identification error information may include error type, error field, suggested correction scheme, etc. That is, the de-identification error information may include the first field length and the second field length being different, or the length and position of the field to be replaced, as well as the length and position of the field that has been replaced in the de-identified data being different.

[0159] Anonymized error messages can be pushed to the terminal devices of maintenance personnel.

[0160] S406. The verification of the de-identified data has been passed.

[0161] exist Figure 4In the illustrated embodiment, when it is necessary to verify the de-identified data, the length of the first field of the first data and the length of the second field of the de-identified data can be obtained. It is then determined whether the lengths of the first and second fields are the same. If the lengths of the first and second fields are different, a de-identification error message is generated. If the lengths of the first and second fields are the same, it can be considered that the field lengths of the first data and the de-identified data are the same, i.e., the field length verification passes. Further verification of the de-identification position is then performed. Based on the target de-identification strategy, the length and position of the field to be replaced, as well as the length and position of the replaced field in the de-identified data, are determined. It is then determined whether the lengths of the field to be replaced and the replaced field are different, or whether the positions of the field to be replaced and the replaced field are different. If the lengths of the field to be replaced and the replaced field are different, or the positions of the field to be replaced and the replaced field are different, it can be considered that the data before and after de-identification are different, i.e., a data de-identification error has occurred. If the lengths of the field to be replaced and the replaced field are the same, and the positions of the field to be replaced and the replaced field are the same, it can be considered that the de-identification is correct, i.e., the de-identified data verification passes. In this way, the above method can ensure the compliance of de-identified data through dual verification. At the same time, based on the de-identification error information, a complete process from verification to repair can be formed, thereby achieving accurate location and traceability of de-identification errors.

[0162] Figure 5 This is a schematic diagram of a data desensitization device provided in an embodiment of this application. Please refer to [link / reference]. Figure 5 The data desensitization device 10 includes: a receiving module 11, a first determining module 12, an acquiring module 13, a second determining module 14, and a desensitization processing module 15, wherein,

[0163] The receiving module 11 is used to receive data query requests sent by the calling device through a preset interface. The query requests are used to retrieve data from the database.

[0164] The first determining module 12 is used to determine, based on the query request, the first parameter indicating the identity information of the device to be called, and the first data to be de-identified in the database;

[0165] The acquisition module 13 is used to acquire a strategy template, which is used to indicate the correspondence between parameters and desensitization strategies.

[0166] The second determining module 14 is used to determine the target de-identification strategy corresponding to the first data based on the strategy template and the first parameter.

[0167] The desensitization processing module 15 is used to desensitize the first data according to the target desensitization strategy, obtain desensitized data, and send the desensitized data to the calling device.

[0168] The data desensitization device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be described again here.

[0169] In one possible design, the second determining module 14 is specifically used for,

[0170] Based on the first parameter, the business scenario of the first data and the user type of the calling device are determined. The business scenario is used to indicate the usage scenario of the first data.

[0171] Based on the business scenario, determine the first field to be de-identified within the first data;

[0172] Based on the user type and the first field, determine the target de-identification strategy corresponding to the first data in the strategy template.

[0173] In one possible design, the second determining module 14 is specifically used for,

[0174] Based on the first field, determine at least one first strategy corresponding to the first field in the strategy template;

[0175] Based on the user type, determine the corresponding de-identification level for the user. The de-identification level is used to indicate the degree to which the data is de-identified.

[0176] Based on the desensitization level, determine the target desensitization strategy corresponding to the first data in at least one first strategy.

[0177] In one possible design, the second determining module 14 is specifically used for,

[0178] Determine the value of the first field corresponding to the first field;

[0179] Based on the target desensitization strategy, determine the desensitization range corresponding to the first field;

[0180] Based on the desensitization range, determine the target character within the desensitization range within the first field value;

[0181] The target character within the first field value is replaced using a preset character.

[0182] The data desensitization device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be described again here.

[0183] Figure 6 This is a schematic diagram of another data desensitization device provided in an embodiment of this application. Figure 5 Based on this, please refer to Figure 6 The data anonymization device 10 further includes: a generation module 16 and a verification module 17, wherein,

[0184] The generation module 16 is used to obtain multiple second fields and multiple second parameters. The values ​​of the second fields corresponding to the second fields need to be de-identified, and the second parameters are the input parameters of the preset interface.

[0185] Generate an interface strategy library based on multiple second fields and multiple second parameters;

[0186] Obtain at least one second strategy corresponding to multiple second fields and the desensitization level corresponding to at least one second strategy;

[0187] The interface strategy library, at least one second strategy, and the desensitization level corresponding to at least one second strategy are parsed to obtain a strategy template that can be recognized by a machine. The strategy template can be carried in any of the following forms: independent system form, static library form, and fixed plug-in form.

[0188] The verification module 17 is used to obtain the length of the first field of the first data and the length of the second field of the de-identified data;

[0189] When the lengths of the first field and the second field are different, a de-identification error message is generated;

[0190] When the lengths of the first and second fields are the same, the length and position of the field to be replaced are determined according to the target desensitization strategy.

[0191] Determine the length and position of the replaced field in the de-identified data. Generate de-identification error messages when the length of the field to be replaced and the length of the replaced field are different, or when the position of the field to be replaced and the position of the replaced field are different.

[0192] The data desensitization device provided in this application embodiment can execute the technical solution shown in the above method embodiment. Its implementation principle and beneficial effects are similar, and will not be described again here.

[0193] Figure 7 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Figure 7 As shown, the electronic device 20 may include: a transceiver 21, a processor 22, and a memory 23.

[0194] Processor 22 executes computer execution instructions stored in memory, causing processor 22 to perform the scheme in the above embodiments. Processor 22 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0195] The memory 23 is connected to the processor 22 via the system bus and completes communication between them. The memory 23 is used to store computer program instructions.

[0196] Transceiver 21 can be used to obtain the task to be run and the configuration information of the task to be run.

[0197] The system bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The system bus can be divided into address bus, data bus, control bus, etc. For ease of representation, only one thick line is used in the diagram, but this does not indicate that there is only one bus or one type of bus. Transceivers are used to enable communication between database access devices and other computers (e.g., clients, read-write libraries, and read-only libraries). Memory may include random access memory (RAM) and may also include non-volatile memory.

[0198] The electronic device provided in this application embodiment can be the terminal device described in the above embodiments.

[0199] This application also provides a chip for executing instructions, which is used to execute the data desensitization method described in the above embodiments.

[0200] This application also provides a computer-readable storage medium storing computer instructions. When the computer instructions are executed on a computer, the computer performs the data desensitization method described in the above embodiments.

[0201] This application also provides a computer program product, which includes a computer program stored in a computer-readable storage medium. At least one processor can read the computer program from the computer-readable storage medium, and when the at least one processor executes the computer program, it can implement the technical solution of the data desensitization method in the above embodiments.

[0202] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or modules, and may be electrical, mechanical, or other forms.

[0203] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to implement the solution of this embodiment according to actual needs.

[0204] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The unit composed of the above modules can be implemented in hardware or in the form of hardware plus software functional units.

[0205] The integrated modules described above, implemented as software functional modules, can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods of the various embodiments of this application.

[0206] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0207] The memory may include high-speed RAM, and may also include non-volatile storage (NVM), such as at least one disk storage device, and may also be a USB flash drive, external hard drive, read-only memory, disk or optical disc, etc.

[0208] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0209] The aforementioned storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0210] An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Alternatively, the storage medium can be an integral part of the processor. The processor and storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and storage medium can exist as discrete components in an electronic control unit or main control device.

[0211] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0212] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A data anonymization method, characterized in that, include: The system receives data query requests sent by the calling device through a preset interface. These data query requests are used to retrieve data from the database. Based on the data query request, a first parameter indicating the identity information of the calling device is determined, and a first piece of data to be de-identified is determined in the database; Obtain a strategy template, which indicates the correspondence between parameters and desensitization strategies; Based on the strategy template and the first parameter, determine the target de-identification strategy corresponding to the first data; The first data is de-identified according to the target de-identification strategy to obtain de-identified data, and the de-identified data is sent to the calling device.

2. The method according to claim 1, characterized in that, Based on the strategy template and the first parameter, determine the target de-identification strategy corresponding to the first data, including: Based on the first parameter, the business scenario of the first data and the user type of the calling device are determined, wherein the business scenario is used to indicate the usage scenario of the first data; Based on the business scenario, determine the first field to be de-identified within the first data; Based on the user type and the first field, the target de-identification strategy corresponding to the first data is determined in the strategy template.

3. The method according to claim 2, characterized in that, Based on the user type and the first field, the target de-identification strategy corresponding to the first data is determined in the strategy template, including: Based on the first field, at least one first strategy corresponding to the first field is determined in the strategy template; Based on the user type, determine the corresponding de-identification level for the user, whereby the de-identification level indicates the degree to which the data is de-identified. Based on the desensitization level, the target desensitization strategy corresponding to the first data is determined in the at least one first strategy.

4. The method according to claim 3, characterized in that, The first data is de-identified according to the target de-identification strategy, including: Determine the value of the first field corresponding to the first field; Based on the target desensitization strategy, determine the desensitization range corresponding to the first field; Based on the desensitization range, determine the target character located within the desensitization range within the first field value; The target character within the first field value is replaced using a preset character.

5. The method according to any one of claims 1-4, characterized in that, Before obtaining the strategy template, it also includes: Obtain multiple second fields and multiple second parameters. The values ​​of the second fields corresponding to the second fields need to be de-identified. The second parameters are the input parameters of the preset interface. An interface strategy library is generated based on the plurality of second fields and the plurality of second parameters; Obtain at least one second strategy corresponding to the plurality of second fields and the desensitization level corresponding to the at least one second strategy; The interface strategy library, the at least one second strategy, and the desensitization level corresponding to the at least one second strategy are parsed to generate a strategy template that can be recognized by a machine. The strategy template can be carried in any of the following forms: independent system form, static library form, and fixed plug-in form.

6. The method according to any one of claims 1-4, characterized in that, After desensitizing the first data according to the target desensitization strategy to obtain the desensitized data, the process further includes: Obtain the length of the first field of the first data and the length of the second field of the de-identified data; When the lengths of the first field and the second field are different, a de-identification error message is generated; When the lengths of the first field and the second field are the same, the length and position of the field to be replaced are determined according to the target desensitization strategy. Determine the length and position of the replaced field in the de-identified data. If the length of the field to be replaced is different from the length of the replaced field, or if the position of the field to be replaced is different from the position of the replaced field, generate a de-identification error message.

7. A data desensitization device, characterized in that, include: The module comprises a receiving module, a first determining module, an acquiring module, a second determining module, and a de-identification processing module, wherein... The receiving module is used to receive a data query request sent by the calling device through a preset interface, and the data query request is used to call data in the database; The first determining module is used to determine, based on the query request, a first parameter indicating the identity information of the calling device, and a first piece of data to be de-identified in the database; The acquisition module is used to acquire a strategy template, which is used to indicate the correspondence between parameters and desensitization strategies; The second determining module is used to determine the target de-identification strategy corresponding to the first data based on the strategy template and the first parameter; The desensitization processing module is used to desensitize the first data according to the target desensitization strategy to obtain desensitized data, and send the desensitized data to the calling device.

8. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method as described in any one of claims 1 to 6.

Images