A distributed message queue encryption method and device based on sensitivity awareness

Abstract

The application provides a sensitivity-aware-based distributed message queue encryption method and device, and relates to the technical fields of data security and distributed message middleware. The method comprises the following steps: obtaining a field sensitivity level corresponding to a target message field based on a sensitivity mapping table; performing selective encryption processing on the target message field based on the field sensitivity level; generating a secure routing mapping value or a comparable filtering identifier for a sensitive field participating in routing or filtering, and performing message routing and message filtering processing based on the secure routing mapping value or the comparable filtering identifier to obtain a target consumption message; in response to a decryption request of a consumption end, obtaining a field permission level corresponding to the target consumption message, and performing on-demand decryption processing; and performing compatibility management processing based on target message content. The application solves the problem that a message queue system cannot perform message routing and message filtering based on sensitive fields after message encryption.

Description

Technical Field

[0001] This application relates to the field of hash algorithms, and more particularly to a sensitivity-aware distributed message queue encryption method and apparatus. Background Technology

[0002] Distributed message queues are widely used in internet platforms, financial systems, IoT platforms, and cloud computing services. They enable asynchronous communication, traffic shaping, and service decoupling between different business systems through message publishing and subscription mechanisms. Common distributed message queues include Kafka, RocketMQ, and RabbitMQ. They typically use message topics, message tags, message attributes, and message keys to perform message routing, filtering, and distribution, thereby improving system scalability and concurrency.

[0003] Existing message queue systems typically protect data security by uniformly encrypting the entire message body, thereby reducing the risk of data leakage during transmission. However, when message topic routing rules or message filtering rules rely on sensitive fields in the message, these sensitive fields cannot be directly identified by the message queue system after encryption. The message queue broker struggles to perform routing or filtering based on these sensitive fields in the encrypted state. This often necessitates sending a large number of messages to the consumer first, followed by secondary filtering by the consumer, increasing network transmission overhead and consumer processing overhead, and reducing message processing efficiency.

[0004] Therefore, there is an urgent need for a sensitivity-aware distributed message queue encryption method and device. Summary of the Invention

[0005] This application provides a sensitivity-aware distributed message queue encryption method and apparatus, which solves the problem that message queue systems cannot perform message routing and message filtering based on sensitive fields after message encryption.

[0006] The first aspect of this application provides a sensitivity-aware distributed message queue encryption method, the method comprising: obtaining the field sensitivity level corresponding to each target message field in the target message based on a sensitivity mapping table; performing selective encryption processing on the target message fields based on the field sensitivity level, and outputting plaintext field information and protected field information; generating plaintext routing information for the plaintext field information, and performing message routing processing based on the plaintext routing information to obtain a first target consumption message; generating a secure routing mapping value or a comparable filtering identifier that does not expose the plaintext of the protected field fields configured to participate in routing or filtering, and performing secure routing processing based on the protected field information. The routing mapping value or comparable filtering identifier is used to perform message routing and / or message filtering on the first target consumption message to obtain the second target consumption message; in response to the access request from the consumer, the corresponding field permission level of the consumer is obtained; based on the field permission level, on-demand decryption processing is performed on each target message field in the second target consumption message to obtain the target message content; on-demand decryption processing includes plaintext reading processing, decryption processing, desensitization processing, and access restriction processing; based on the message structure definition version information and protection policy version information, compatibility management processing is performed on the target message content: plaintext routing information, protected field information.

[0007] Optionally, a sensitivity mapping table is constructed, specifically including: parsing the sensitivity annotations of target message fields to obtain annotated and unannotated target message fields; for annotated target message fields, obtaining the corresponding sensitivity level through the annotation information; for unannotated target message fields, obtaining the corresponding sensitivity level through a dual verification mechanism; the dual verification mechanism includes an automatic inference rule mechanism and a format verification mechanism; the sensitivity levels include public level, internal level, confidential level, and top secret level; establishing a first correspondence between annotated target message fields and sensitivity levels, and establishing a second correspondence between unannotated target message fields and sensitivity levels; and constructing a sensitivity mapping table based on the first and second correspondences.

[0008] Optionally, selective encryption processing is performed on the target message field based on the field sensitivity level, and plaintext routing information and protected field information are output. Specifically, when the field sensitivity level is public or internal, plaintext preservation processing is performed on the target message field to obtain plaintext routing information; when the field sensitivity level is confidential or top secret, field-level encryption processing is performed on the target message field to obtain protected field information.

[0009] Optionally, field-level encryption is performed on the target message field, specifically including: when the field sensitivity level is confidential, a first encryption strategy is used to encrypt the target message field; when the field sensitivity level is top secret, a second encryption strategy is used to encrypt the target message field; the encryption strength of the second encryption strategy is higher than that of the first encryption strategy; during the encryption process, encryption context information is constructed based on the message subject identifier, message structure definition identifier, field path identifier, and protection version identifier, and the encryption result is bound and authenticated based on the encryption context information.

[0010] Optionally, in response to an access request from the consumer, the field permission level corresponding to the target consumed message is obtained. Specifically, this includes: obtaining the consumer identifier information and the field identifier information corresponding to the field to be accessed from the consumer; constructing a field permission matrix based on the consumer identifier information and the field identifier information, wherein the field permission matrix includes a permission association structure with the consumer group identifier as the first-level index and the field identifier as the second-level index; establishing the permission association relationship between the consumer group identifier and the field identifier based on the field permission matrix, and constructing a field permission evaluation model according to a preset permission mapping rule; and outputting the field permission level corresponding to the field based on the field permission evaluation model.

[0011] Optionally, on-demand decryption processing is performed on the target consumed message based on the field permission level, specifically including: performing integrity verification processing on the target consumed message; when the integrity verification processing passes, obtaining the protection policy version information corresponding to the target consumed message; determining the target decryption key corresponding to the target message field based on the protection policy version information; parsing the field storage type identifier in the target consumed message; when the field storage type identifier corresponds to a plaintext type, reading the field value of the corresponding target message field; when the field storage type identifier corresponds to an encrypted type and the field permission level is the full access permission level, performing decryption processing on the corresponding target message field based on the target decryption key; when the field storage type identifier corresponds to an encrypted type and the field permission level is the de-identification access permission level, obtaining the de-identification mapping value of the corresponding target message field; when the field storage type identifier corresponds to an encrypted type and the field permission level is the prohibited access permission level, performing access restriction processing on the corresponding target message field.

[0012] Optionally, compatibility management processing is performed based on the target message content, specifically including: constructing a key version chain containing the current key version and historical key versions; constructing a version association chain containing the current message structure definition version and historical message structure definition versions; performing compatibility verification processing on the key version chain and version association chain; when the compatibility verification passes, matching the target message structure definition of the corresponding version according to the message structure definition version information, and matching the target protection policy of the corresponding version according to the protection version information; and performing compatibility management processing based on the target message structure definition and the target protection policy.

[0013] A second aspect of this application provides a sensitivity-aware distributed message queue encryption device, which includes a sensitivity-aware module, a selective encryption module, a secure routing module, an on-demand decryption module, and a compatibility assurance module, wherein... The sensitivity perception module is used to obtain the sensitivity level of each field in the target message based on the sensitivity mapping table, which is used to obtain the protected field information of the plaintext routing information.

[0014] The selective encryption module is used to perform selective encryption processing on target message fields based on field sensitivity levels, and output plaintext field information and protected field information.

[0015] The secure routing module is used to generate plaintext routing information for plaintext field information, and perform message routing processing based on the plaintext routing information to obtain the first target consumption message; for target fields configured to participate in routing or filtering in protected field information, it generates secure routing mapping values ​​or comparable filtering identifiers that do not expose the plaintext of the fields, and performs message routing processing and / or message filtering processing on the first target consumption message based on the secure routing mapping values ​​or comparable filtering identifiers to obtain the second target consumption message.

[0016] The on-demand decryption module is used to respond to access requests from the consumer and obtain the corresponding field permission level from the consumer. Based on the field permission level, it performs on-demand decryption processing on each target message field in the second target consumer message to obtain the target message content. On-demand decryption processing includes plaintext reading processing, decryption processing, de-identification processing, and access restriction processing.

[0017] The compatibility assurance module is used to perform compatibility management processing on the target message content based on the message structure definition version information and protection policy version information.

[0018] A third aspect of this application provides an electronic device including a processor, a memory, a user interface, and a network interface. The memory is used to store instructions, the user interface and the network interface are used to communicate with other devices, and the processor is used to execute the instructions stored in the memory to cause the electronic device to perform the method as described above.

[0019] A fourth aspect of this application provides a non-transitory computer-readable storage medium storing a computer program, the computer program being executed by a processor using any of the methods described above.

[0020] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages: 1. Obtain the sensitivity level of the target message field based on the sensitivity mapping table; perform selective encryption on the target message field based on the sensitivity level to obtain plaintext routing information and protected field information; perform message routing processing based on the plaintext routing information and protected field information respectively to obtain the first routing result and the second routing result; perform message filtering processing based on the first routing result and the second routing result to obtain the target consumption message; respond to the decryption request from the consumer, obtain the field permission level corresponding to the target consumption message, and perform on-demand decryption processing based on the field permission level to obtain the target message content; perform compatibility management processing based on the target message content, thereby solving the problem that sensitive fields cannot participate in message routing and message filtering after encryption, and improving the accuracy and efficiency of message distribution.

[0021] 2. When the field sensitivity level is confidential, the first encryption strategy is used to encrypt the target message field; when the field sensitivity level is top secret, the second encryption strategy is used to encrypt the target message field; the encryption strength of the second encryption strategy is higher than that of the first encryption strategy; during the encryption process, encryption context information is constructed based on the message subject identifier, message structure definition identifier, field path identifier, and protection version identifier, and the encryption result is bound and authenticated based on the encryption context information, thereby achieving differentiated security protection for data with different sensitivity levels and preventing encrypted data from being illegally migrated and tampered with across message subjects, message structure definition versions, or protection versions.

[0022] 3. Perform integrity verification on the target consumed message; when the integrity verification passes, obtain the protection version information corresponding to the target consumed message; determine the target decryption key based on the protection version information; parse the field storage type identifier in the target consumed message; when the field storage type identifier corresponds to plaintext, read the field value of the corresponding target message field; when the field storage type identifier corresponds to encryption and the field permission level is full access permission level, perform decryption processing on the corresponding target message field based on the target decryption key; when the field storage type identifier corresponds to encryption and the field permission level is desensitized access permission level, obtain the desensitized mapping value of the corresponding target message field; when the field storage type identifier corresponds to encryption and the field permission level is prohibited access permission level, perform access restriction processing on the corresponding target message field, thereby ensuring the security of sensitive data while enabling differentiated access to target message fields by different consumers and reducing the risk of sensitive data leakage. Attached Figure Description

[0023] Figure 1 This is a flowchart illustrating a sensitivity-aware distributed message queue encryption method provided in an embodiment of this application. Figure 2This is a schematic diagram illustrating the sensitivity grading and labeling of message fields provided in an embodiment of this application; Figure 3 This is a schematic diagram of an on-demand decryption process provided in an embodiment of this application; Figure 4 This is a schematic diagram of a sensitivity-aware distributed message queue encryption device provided in an embodiment of this application; Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application.

[0024] Explanation of reference numerals in the attached diagram: 41. Sensitive sensing module; 42. Selective encryption module; 43. Secure routing module; 44. On-demand decryption module; 45. Compatibility assurance module; 501. Processor; 502. Communication bus; 503. User interface; 504. Network interface; 505. Memory. Detailed Implementation

[0025] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments.

[0026] The terminology used in the following embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification of this application, the singular expressions “a,” “an,” “the,” “the,” “the,” and “this” are intended to include the plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this application refers to and includes any or all possible combinations of one or more of the listed items.

[0027] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0028] To enable those skilled in the art to better understand the technical solution of the present invention, the present invention will be further described in detail below with reference to the accompanying drawings.

[0029] Please refer to Figure 1 The diagram illustrates a flowchart of a sensitivity-aware distributed message queue encryption method provided in this application embodiment. The flowchart mainly includes the following steps: S101 to S107.

[0030] Step S101: Obtain the field sensitivity level corresponding to each target message field in the target message based on the sensitivity mapping table.

[0031] Specifically, before sending the target message, the message producer first obtains the message structure definition corresponding to the target message and parses the field identifier information corresponding to each target message field from the message structure definition. For target message fields with configured sensitivity labels, the corresponding sensitivity level is directly read; for target message fields without configured sensitivity labels, the corresponding sensitivity level is determined based on a preset automatic inference rule mechanism and format verification mechanism. The target message is the business message to be sent by the message producer to the distributed message queue. The target message includes multiple target message fields with preset semantic meanings. Target message fields are data units in the target message, used to represent the attribute information corresponding to the business object. Target message fields include at least one of the following: user identifier field, identity information field, contact information field, account information field, transaction information field, and other business data fields.

[0032] In one possible implementation, step S101 further includes: performing field sensitivity annotation parsing on the target message fields to obtain annotated target message fields and unannotated target message fields; for annotated target message fields, obtaining the corresponding sensitivity level through annotation information; for unannotated target message fields, obtaining the corresponding sensitivity level through a dual verification mechanism; the dual verification mechanism includes an automatic inference rule mechanism and a format verification mechanism; the sensitivity levels include public level, internal level, confidential level, and top secret level; establishing a first correspondence between annotated target message fields and sensitivity levels, and establishing a second correspondence between unannotated target message fields and sensitivity levels; and constructing a sensitivity mapping table based on the first and second correspondences.

[0033] Specifically, to achieve automatic identification and accurate classification of message field sensitivity, field sensitivity annotation information is pre-embedded in the message structure definition, and an automatic field sensitivity perception mechanism is established to identify sensitive and non-sensitive fields in the target message. This embodiment employs a dual verification mechanism of "annotation priority, automatic inference, and cross-validation" to determine the sensitivity level corresponding to the target message fields, thereby improving the accuracy and reliability of sensitivity determination.

[0034] Sensitivity levels include Public, Internal, Confidential, and Top Secret. Public level corresponds to target message fields that can be publicly accessed without posing a security risk; Internal level corresponds to target message fields that can only be accessed by internal systems; Confidential level corresponds to target message fields that, if leaked, may cause business losses; and Top Secret level corresponds to target message fields that, if leaked, may cause serious compliance or security risks. Please refer to [reference needed]. Figure 2 The document presents a schematic diagram illustrating the sensitivity grading and labeling of message fields provided in an embodiment of this application.

[0035] When parsing and annotating the sensitivity of target message fields, the sensitivity annotation information can be read from the corresponding message structure definition. The message structure definition includes at least one of the following: message structure defined based on Avro Schema, message structure defined based on Protobuf, and message structure defined based on JSON Schema. Within the message structure definition, the sensitivity level of the target message fields can be annotated using extended attributes, field annotations, or custom options, ensuring that target message fields in different serialization formats can be managed using a unified sensitivity annotation semantic.

[0036] For labeled target message fields, the corresponding sensitivity level is determined directly based on the field sensitivity labeling information. For example, when the field sensitivity labeling information for a target message field is PUBLIC, the corresponding target message field is determined to be at the public level; when the field sensitivity labeling information is INTERNAL, the corresponding target message field is determined to be at the internal level; when the field sensitivity labeling information is CONFIDENTIAL, the corresponding target message field is determined to be at the confidential level; and when the field sensitivity labeling information is SECRET, the corresponding target message field is determined to be at the top secret level.

[0037] For unlabeled target message fields, a dual-validation mechanism is used to determine the corresponding sensitivity level. The automatic inference rule mechanism determines candidate sensitivity levels based on the field name characteristics, field content characteristics, and data dictionary relationships corresponding to the target message fields. The format validation mechanism verifies the candidate sensitivity levels based on the data format characteristics of the field values ​​corresponding to the target message fields.

[0038] The automatic inference rule mechanism includes field name matching rules, data format recognition rules, data dictionary association rules, and default policy rules. Field name matching rules detect whether the target message field name contains preset sensitive keywords and determine candidate sensitivity levels based on the detection results. Data format recognition rules identify whether the corresponding field value of the target message field conforms to sensitive data formats such as ID card number format, bank card number format, and mobile phone number format, and determine candidate sensitivity levels based on the recognition results. Data dictionary association rules determine whether the target message field establishes an association relationship with fields in the preset sensitive data dictionary and determine candidate sensitivity levels based on the association results. The default policy rule determines the corresponding target message field as an internal level when the sensitivity level cannot be determined.

[0039] The format verification mechanism is used to verify the candidate sensitivity levels obtained by the automatic inference rule mechanism based on the data format characteristics of the corresponding field values ​​of the target message field. When the automatic inference rule mechanism and the format verification mechanism obtain consistent verification results, the corresponding sensitivity level is taken as the final sensitivity level of the target message field; when the automatic inference rule mechanism and the format verification mechanism obtain inconsistent verification results, the higher sensitivity level is selected as the final sensitivity level of the target message field to ensure the security of sensitive data protection.

[0040] After determining the sensitivity levels corresponding to labeled and unlabeled target message fields, a first correspondence is established between labeled target message fields and their corresponding sensitivity levels, and a second correspondence is established between unlabeled target message fields and their corresponding sensitivity levels. Subsequently, the first and second correspondences are summarized and integrated to form a mapping relationship between target message fields and sensitivity levels, thereby constructing a sensitivity mapping table for subsequent selective encryption processing.

[0041] Step S102: Perform selective encryption processing on the target message field based on the field sensitivity level, and output plaintext field information and protected field information.

[0042] Specifically, after obtaining the sensitivity level of each target message field, differentiated processing is performed on each target message field according to the data protection requirements corresponding to different sensitivity levels. For target message fields with a sensitivity level of public or internal, the original field content is retained, and the corresponding fields are organized into plaintext routing information to support subsequent message routing, message filtering, and business access processing. For target message fields with a sensitivity level of confidential or top secret, field-level encryption processing is performed on the corresponding fields. Confidential fields are encrypted using the first protection strategy, and top secret fields are encrypted using the second protection strategy. Corresponding de-identification mapping information is generated for the encrypted fields, thus forming protected field information. Subsequently, the plaintext routing information and protected field information are organized and stored according to a preset message format. The plaintext routing information corresponds to field content that does not require encryption protection, and the protected field information corresponds to field content that has been securely protected, for use in subsequent message routing processing, message filtering processing, and on-demand decryption processing.

[0043] In this embodiment, the target message fields corresponding to the public and internal levels typically constitute the majority of all target message fields, maintaining the original routing and filtering capabilities of the message queue system by preserving the plaintext content; the target message fields corresponding to the confidential and top secret levels adopt a field-level security protection mechanism to reduce the risk of sensitive data leakage and support subsequent on-demand decryption access based on field permission levels.

[0044] In one possible implementation, step S102 further includes: when the field sensitivity level is public or internal, performing plaintext preservation processing on the target message field to obtain plaintext routing information; when the field sensitivity level is confidential or top secret, performing field-level encryption processing on the target message field to obtain protected field information; when the field sensitivity level is confidential, encrypting the target message field using a first encryption strategy; when the field sensitivity level is top secret, encrypting the target message field using a second encryption strategy; the encryption strength of the second encryption strategy is higher than that of the first encryption strategy; during the encryption processing, constructing encryption context information based on the message subject identifier, message structure definition identifier, field path identifier, and protection version identifier, and binding authentication processing of the encryption result based on the encryption context information.

[0045] Specifically, after obtaining the sensitivity level of each target message field, selective encryption is performed on the target message fields according to their sensitivity levels to achieve differentiated protection between sensitive and non-sensitive data. Target message fields with sensitivity levels of Public and Internal are treated as non-sensitive fields, while target message fields with sensitivity levels of Confidential and Top Secret are treated as sensitive fields.

[0046] For target message fields with a sensitivity level of public or internal, no encryption is performed. Instead, the original field content is preserved, and the corresponding fields are organized into plaintext routing information. Public level fields correspond to data fields that are publicly accessible and pose no security risk, such as log level, message type, and timestamps. Internal level fields correspond to data fields that are only accessible to internal systems, such as user identifiers, device models, and network addresses. Since these fields do not involve highly sensitive information, they are stored in plaintext to maintain the original message routing and filtering capabilities of the message queue system and reduce the performance overhead of encryption.

[0047] For target message fields with a sensitivity level of Confidential or Top Secret, field-level encryption is performed, and the processing result is organized into protected field information. Confidential fields correspond to data fields that could cause business losses if leaked, such as mobile phone numbers, email addresses, and home addresses; Top Secret fields correspond to data fields that could pose serious compliance risks if leaked, such as ID card numbers, bank card numbers, and password digests.

[0048] Before performing field-level encryption, a field-level key derivation mechanism is first established. This involves obtaining the message topic identifier, field path identifier, field sensitivity level identifier, and protection version identifier, and combining these with the topic master key corresponding to the message topic to generate a field-level encryption key. The topic master key is used for unified key management at the message topic level, while the field-level encryption key is used for data encryption protection at the target message field level. Since the field-level encryption key is derived from the topic master key, different target message fields correspond to different field-level encryption keys, and different message topics correspond to different field-level encryption keys, thereby achieving field-level isolation and message topic-level isolation.

[0049] The field-level encryption key is generated using a key derivation function based on HMAC-SHA256. During key derivation, message subject identifier, field path identifier, field sensitivity level identifier, and protection version identifier are introduced as derivation factors. The field path identifier uniquely identifies the position of the target message field within the message structure definition; for example, the user's phone number field corresponds to the path "user.phone", and the city field in the user's address corresponds to the path "user.address.city". Introducing the field path identifier ensures that different target message fields generate different field-level encryption keys; introducing the message subject identifier ensures that the same field generates different field-level encryption keys in different message subjects; and introducing the protection version identifier ensures that a new version of the field-level encryption key is automatically generated during key rotation, without needing to update the key for each target message field individually.

[0050] After generating the field-level encryption key, the corresponding encryption strategy is selected based on the field's sensitivity level. When the field sensitivity level is confidential, the first encryption strategy is used to encrypt the target message field; when the field sensitivity level is top secret, the second encryption strategy is used to encrypt the target message field. The second encryption strategy has a higher encryption strength than the first encryption strategy.

[0051] In one implementation, the first encryption strategy uses a 128-bit key length authentication encryption algorithm to encrypt the target message field, balancing system performance and security requirements. The second encryption strategy uses a 256-bit key length authentication encryption algorithm to encrypt the target message field, enhancing the protection strength of highly sensitive data. Confidential level fields are processed using the first encryption strategy, while top-secret level fields are processed using the second encryption strategy, thus achieving differentiated protection capabilities matching the sensitivity level of the fields.

[0052] During the encryption process, an initialization vector is generated independently for each target message field. The initialization vector enhances the randomness of the encryption result, ensuring different encryption outcomes even if multiple target message fields contain the same value. Subsequently, ciphertext information is generated using the field-level encryption key, the initialization vector, and the original field values ​​corresponding to the target message fields.

[0053] Simultaneously, encryption context information is constructed, and the encryption result is bound to authentication processing based on the encryption context information. The encryption context information includes a message subject identifier, a message structure definition identifier, a field path identifier, and a protection version identifier. Specifically, the message subject identifier identifies the message subject to which the target message belongs; the message structure definition identifier identifies the message structure definition version corresponding to the target message; the field path identifier identifies the position of the target message fields within the message structure definition; and the protection version identifier identifies the key version corresponding to the current encryption process.

[0054] By incorporating encryption context information into the authentication calculation process, a binding relationship is established between the generated ciphertext result and the corresponding business context. When an attacker attempts to migrate the ciphertext from a message to other message topics, other message structure definitions, or other key version environments, the authentication verification will fail due to the change in encryption context information. This prevents the ciphertext from being reused across message topics, ported across message structure definitions, or maliciously tampered with.

[0055] After field encryption is completed, de-identification mapping information is further generated for confidential and top-secret fields. This de-identification mapping information is obtained by applying preset de-identification rules to the original field values. Different types of target message fields can correspond to different de-identification rules. For example, for an ID card number field, the first and last few digits are retained, while the middle characters are replaced with de-identified characters; for a bank card number field, the last few digits are retained, while the remaining digits are replaced with de-identified characters; for a mobile phone number field, the first and last number segments are retained, while the middle numbers are replaced with de-identified characters; for an email address field, the first character and domain name are retained, while the middle characters are replaced with de-identified characters; for a monetary amount field, some numerical information is retained, while the rest is replaced with de-identified characters.

[0056] The generated de-identified mapping information is stored in plaintext within the protected field information, for use in low-privilege access scenarios, audit log scenarios, and business statistical analysis scenarios. De-identification rules can be uniformly configured through the access control system, and different de-identification templates can be configured for different target message fields.

[0057] After generating the plaintext routing information and protected field information, a selectively encrypted message is constructed. The selectively encrypted message adopts a binary structure, including a message header area and field data areas.

[0058] The message header area includes format identification information, message format version information, function identification information, message structure definition identifier, protection version identifier, and integrity verification information. Specifically, the format identification information identifies that the current message uses a selectively encrypted message format; the message format version information identifies the message format version; the function identifier information indicates whether it contains de-identified mapping information and whether it is in a key rotation state; the message structure definition identifier identifies the message structure definition version; the protection version identifier identifies the key version corresponding to the current message; and the integrity verification information verifies whether the message header area has been corrupted during transmission.

[0059] The field data area consists of multiple field entries, each of which includes field identification information and field storage type identification information. The field identification information is used to uniquely identify the target message field; the field storage type identification information is used to identify whether the target message field is stored in plaintext or encrypted form.

[0060] For field entries corresponding to plaintext routing information, record field identifier information, field storage type identifier information, field length information, and field value information; for field entries corresponding to protected field information, record field identifier information, field storage type identifier information, encryption algorithm identifier information, initialization vector, ciphertext information, authentication information, and de-identification mapping information.

[0061] Upon receiving a selectively encrypted message, the consumer determines the parsing method for the corresponding target message field based on the field storage type identifier. When the field storage type identifier indicates plaintext storage, the field value is read directly. When the field storage type identifier indicates encrypted storage, the ciphertext information, authentication information, and desensitization mapping information are read according to the encrypted field parsing process. Because the consumer performs parsing based on the field storage type identifier rather than the sensitivity labeling information in the current message structure definition, even if the sensitivity level of the target message field is adjusted, historical messages can still be parsed according to the original storage format, thus ensuring compatibility during the evolution of the message structure definition.

[0062] Step S103: Generate plaintext routing information for the plaintext field information, and perform message routing processing based on the plaintext routing information to obtain the first target consumption message.

[0063] Specifically, the target message field configured as the routing basis is extracted from the plaintext field information, and plaintext routing information is generated based on the target message field. Subsequently, the routing path corresponding to the target message is determined based on the plaintext routing information, and message routing processing is performed to distribute the target message to the target message set that matches the plaintext routing information, thus obtaining the first target consumption message. Here, the plaintext field information corresponds to either a public level field or an internal level field; therefore, the message queue system can complete the routing calculation and message distribution of plaintext routing information without performing decryption processing. The first target consumption message refers to the set of candidate messages that meet the plaintext field routing conditions obtained after completing message routing processing based on the first plaintext routing information.

[0064] In this embodiment, the target message field in the plaintext routing information participates in the message routing process as a routing dependency field. When the message queue system adopts a partitioned routing mechanism based on message identifiers, it generates corresponding plaintext routing information based on the message identifier field in the plaintext routing information; when the message queue system adopts a routing mechanism based on message attributes, it generates corresponding plaintext routing information based on the message attribute field in the plaintext routing information; and when the message queue system adopts a routing mechanism based on tag information, it generates corresponding plaintext routing information based on the tag field in the plaintext routing information. Since the corresponding fields remain in plaintext, route calculation can be completed without decryption, thereby maintaining the original message routing capabilities of the message queue system.

[0065] Step S104: For the target fields configured to participate in routing or filtering in the protected field information, generate a secure routing mapping value or a comparable filtering identifier that does not expose the plaintext of the field, and perform message routing processing and / or message filtering processing on the first target consumption message based on the secure routing mapping value or the comparable filtering identifier to obtain the second target consumption message.

[0066] Specifically, target fields configured to participate in routing or filtering processes are identified from the protected field information. A secure routing mapping value or a comparable filtering identifier, corresponding to the plaintext of the target field and not reversibly parsed to obtain the plaintext, is generated based on the target field. Subsequently, for the first target consumption message, message routing processing is performed according to the secure routing mapping value, or message filtering processing is performed according to the comparable filtering identifier, to determine the set of target messages that meet the protected field processing conditions, resulting in the second target consumption message. The secure routing mapping value is used to achieve message routing without exposing the plaintext content of the target field, and the comparable filtering identifier is used to achieve message filtering without decrypting the target field. This processing method allows the protected field to participate in message routing and filtering while maintaining its encrypted state. The second target consumption message refers to the set of target messages that meet the protected field routing and / or filtering conditions after processing based on the secure routing mapping value or the comparable filtering identifier.

[0067] Step S105: In response to the access request from the consumer, obtain the corresponding field permission level from the consumer.

[0068] Specifically, when a consumer initiates an access request for a target message, it first obtains the authentication and access authorization information corresponding to the consumer, and determines the consumer group to which the consumer belongs. Then, it parses the field identifier information from the target message and determines the corresponding field permission level based on the consumer group information and the field identifier information.

[0069] In one possible implementation, step S105 further includes: obtaining consumer identification information from the consumer end and field identification information corresponding to the field to be accessed; constructing a field permission matrix based on the consumer identification information and the field identification information, wherein the field permission matrix includes a permission association structure with consumer group identification as the first-level index and field identification as the second-level index; establishing the permission association relationship between consumer group identification and field identification based on the field permission matrix, and constructing a field permission evaluation model according to a preset permission mapping rule; and outputting the field permission level corresponding to the field based on the field permission evaluation model.

[0070] Specifically, the consumer identification information corresponding to the consumer end and the field identification information corresponding to the field to be accessed are obtained; wherein, the consumer identification information is used to represent the identity information of the consumer group to which the consumer end belongs, and the field identification information is used to represent the field path information or field unique identification information corresponding to the target message field.

[0071] Subsequently, a field permission matrix is ​​constructed based on consumer identifier information and field identifier information. The field permission matrix includes a primary index and a secondary index. The primary index is the consumer group identifier, used to locate the permission configuration set of the corresponding consumer group; the secondary index is the field identifier, used to locate the permission configuration item of the corresponding target message field. The permission association between consumer groups and target message fields is established through the combination of the primary and secondary indexes.

[0072] In this embodiment, the field permission matrix can be represented as: in, Represents the field permission matrix; Indicates the number of consumer groups; Indicates the number of fields in the target message; Indicates the first The first consumer group to the first The permission configuration results corresponding to each target message field. Further, each permission configuration result can be represented as:

[0073] in, Indicates the access permission type; access permission types include full access permission, de-identified access permission, and prohibited access permission; Indicates the desensitization rule identifier; This indicates the effective status of permissions. A permission association relationship between consumer group identifiers and field identifiers is established based on the field permission matrix, and a field permission evaluation model is constructed according to preset permission mapping rules. The preset permission mapping rules include: when a consumer group is granted plaintext access to a field, the corresponding field is mapped to the full access permission level; when a consumer group is granted anonymized access to a field, the corresponding field is mapped to the anonymized access permission level; when a consumer group is not granted field access permission, the corresponding field is mapped to the prohibited access permission level. When constructing the field permission evaluation model based on the field permission matrix, the permission vectors corresponding to the consumer group identifiers and the field identifiers are first extracted; then, association calculation processing is performed on the permission vectors to obtain the permission association strength. The permission association strength can be expressed as:

[0074] in, This indicates the strength of the permission association between the consumer group and the target message field; , and This represents the weighting coefficient, with values ​​ranging from 0 to 1, and satisfying the following: in, Used to characterize the degree of influence of access permission type on the permission determination result; Used to characterize the degree of influence of de-identification rules on the permission determination results; It is used to characterize the degree to which the effective status of permissions affects the result of permission determination.

[0075] Then, based on the strength of the permission association, the corresponding permission level is output: when Output the full access level; when Output the desensitization access level; when Output the level of access restrictions. This represents the threshold for determining full access permissions, with a value ranging from 0.7 to 1. This represents the threshold for determining de-identification access permissions, with a value range of 0.3 to 0.7.

[0076] Finally, the field permission evaluation model outputs the field permission level corresponding to the target message field based on the permission configuration corresponding to the consumer group identifier and the permission configuration corresponding to the field identifier, providing a basis for permission decisions for subsequent plaintext reading, decryption, anonymization and access restriction processing.

[0077] Step S106: Perform on-demand decryption processing on each target message field in the second target consumption message based on the field permission level to obtain the target message content; the on-demand decryption processing includes plaintext reading processing, decryption processing, desensitization processing, and access restriction processing.

[0078] Specifically, the process involves acquiring each target message field contained in the second target consumption message and determining the corresponding data access method based on the field permission level of each target message field. For target message fields that are allowed direct access, plaintext reading is performed. For protected fields that are allowed to retrieve the original content, decryption is performed to restore the original data of the corresponding field. For protected fields that are only allowed to retrieve partial information, desensitization is performed to generate field data with some sensitive content hidden. For protected fields that do not have access permissions, access restriction is performed to prevent the corresponding field content from being read. Subsequently, the processing results of each field obtained through plaintext reading, decryption, desensitization, and access restriction are combined to obtain the target message content that matches the field permission level.

[0079] The process includes: plaintext reading, decryption, and access restriction. Plaintext reading involves directly reading the field value corresponding to the plaintext field; decryption involves performing decryption operations on the protected field to restore the original field content; desensitization involves partially hiding the field content according to preset desensitization rules and then outputting the desensitized result; and access restriction involves prohibiting the output of the corresponding field content or returning an inaccessible state. Through these processing methods, different consumers can obtain message content of different granularities based on their own permissions.

[0080] In one possible implementation, step S106 further includes: performing integrity verification processing on the target consumed message; when the integrity verification processing passes, obtaining the protection policy version information corresponding to the target consumed message; determining the target decryption key corresponding to the target message field based on the protection policy version information; parsing the field storage type identifier in the target consumed message; when the field storage type identifier corresponds to a plaintext type, reading the field value of the corresponding target message field; when the field storage type identifier corresponds to an encryption type and the field permission level is the full access permission level, performing decryption processing on the corresponding target message field based on the target decryption key; when the field storage type identifier corresponds to an encryption type and the field permission level is the desensitization access permission level, obtaining the desensitization mapping value of the corresponding target message field; when the field storage type identifier corresponds to an encryption type and the field permission level is the prohibited access permission level, performing access restriction processing on the corresponding target message field.

[0081] Specifically, when the consumer receives the target message, it first performs an integrity check. This involves parsing the integrity check information in the target message and performing consistency checks on the message header and field data areas based on preset check rules. If the integrity check fails, it is determined that the target message has been corrupted or tampered with during transmission, and the subsequent decryption process is terminated; if the integrity check passes, the subsequent on-demand decryption process continues.

[0082] Subsequently, the protection policy version information corresponding to the target consumed message is obtained, and the corresponding version's topic master key is retrieved from the key management service based on the protection policy version information. Further, the target decryption key for the corresponding target message field is derived based on the message topic identifier, field path identifier, field sensitivity level, and protection policy version information, for use in subsequent field-level decryption processing.

[0083] In this embodiment, a field-level access permission model is established to achieve differentiated access control for different target message fields by different consumer groups. The field-level access permission model is constructed using a two-level mapping structure of consumer groups and field paths, where consumer groups serve as the first-level index, field paths serve as the second-level index, and access permissions serve as the output result, thereby establishing the access control relationship between consumer groups and target message fields.

[0084] The field-level access permission model can be represented as: in, This represents a field-level access permission model; Indicates the first Consumer groups; Indicates the first Each field path; Consumer group field path The corresponding field permission level; Represents field path Related desensitization rules.

[0085] The field permission levels satisfy: in, Indicates the full access level; Indicates the level of access permissions for data masking; This indicates a level of access restriction that is prohibited.

[0086] To facilitate quick retrieval of permission information on the consumer side, a field permission index matrix can be further constructed: In this matrix, rows represent consumer groups; columns represent field paths; and elements represent the permission levels of the corresponding fields.

[0087] After obtaining the field permission information corresponding to the current consumer group, the consumer traverses each target message field in the target consumption message and parses the corresponding field storage type identifier.

[0088] When the field storage type identifier corresponds to a plaintext type, the field value of the corresponding target message field is read directly, and field type parsing processing is performed according to the message structure definition.

[0089] When the field storage type identifier corresponds to the encryption type, differentiated access processing is performed according to the corresponding field permission level.

[0090] When the field permission level is full access level, decryption processing is performed on the corresponding target message field based on the target decryption key. Specifically, a field-level decryption key is first derived based on the field path identifier, field sensitivity level, and protection policy version information, and then the original field value of the corresponding target message field is recovered using the field-level decryption key.

[0091] In one implementation, the field-level decryption key derivation process can be represented as: in, Indicates the field-level decryption key; Represents the key derivation function; Indicates the message subject identifier; Indicates the subject master key; Indicates the field path identifier; Indicates the sensitivity level of the field; This indicates the protection policy version information.

[0092] When the field permission level is the de-identification access level, the original text decryption is not performed. Instead, the de-identification mapping value associated with the corresponding target message field is directly obtained.

[0093] To achieve a unified access control mechanism, an access decision function can be constructed: in, Indicates field path The corresponding final access result; This represents the original field value after decryption; Indicates the desensitization mapping value; This indicates the result of the access restriction.

[0094] When the field permission level is prohibited, the original field value of the corresponding target message field is not returned, and decryption is not performed. Instead, the encrypted content is retained or a null value is returned as the access result, thereby preventing unauthorized consumers from obtaining sensitive data.

[0095] Furthermore, to reduce the computational overhead caused by repeated derivation of field-level keys, a field-level decryption key caching mechanism can be established. The consumer caches the derived field-level decryption keys in its local cache space and constructs a cache index identifier based on the message topic identifier, field path identifier, field sensitivity level, and protection policy version information.

[0096] in, Indicates the cache index identifier; Indicates the message subject identifier; Indicates the field path identifier; Indicates the sensitivity level of the field; Indicates the protection policy version information; This indicates a combination operation.

[0097] The consumer first queries the local cache based on the cache index identifier. If the corresponding field-level decryption key exists, it is called directly. If the corresponding field-level decryption key does not exist, the key derivation process is re-executed and the local cache is updated.

[0098] Furthermore, for multiple encrypted fields in the same target consumption message, the same topic master key acquisition process is shared, and field-level decryption key derivation is completed in batches, thereby reducing the system overhead caused by repeated access to the key management service.

[0099] Meanwhile, the consumer-side system checks whether the current processor supports hardware-accelerated instruction sets. If hardware-accelerated instruction sets are supported, the hardware acceleration module is invoked to perform decryption; if hardware-accelerated instruction sets are not supported, the software decryption module is invoked to perform decryption, thereby improving the overall on-demand decryption efficiency.

[0100] After processing all target message fields, the plaintext field values, decrypted original field values, and anonymized mapping values ​​are uniformly assembled to generate the target message content. This target message content is then returned to the corresponding business system, enabling on-demand access control of sensitive data. The target message content refers to the message data content generated after performing plaintext reading, decryption, anonymization mapping, or access restriction processing on each target message field in the target consumed message based on field permission levels, and conforming to the current consumer's access permission range. Please refer to [reference needed]. Figure 3 The document presents a schematic diagram of an on-demand decryption process provided in an embodiment of this application.

[0101] Step S107: Perform compatibility management processing on the target message content based on the message structure definition version information and protection policy version information.

[0102] Specifically, compatibility management is performed on the message structure definition and protection policy corresponding to the target message content, and an evolution relationship between the message structure definition and the protection policy is established. The message structure definition refers to the field organization method and structural constraints between fields upon which the target message content is based, while the protection policy refers to the field protection method, key usage method, and field access method adopted for each field in the target message content. Subsequently, compatibility processing is performed on field additions, deletions, renamings, type adjustments, and sensitivity level adjustments in the target message content based on the message structure definition evolution relationship. Compatibility processing is also performed on the historical and current protection policies corresponding to the target message content based on the protection policy evolution relationship. Finally, based on the compatibility processing results, the target message content is parsed and accessed, thereby ensuring the continued accessibility and compatibility of the target message content under scenarios of message structure definition adjustments, field sensitivity level changes, and key rotation.

[0103] In one possible implementation, step S108 further includes: constructing a key version chain containing the current key version and historical key versions; constructing a version association chain containing the current message structure definition version and historical message structure definition versions; performing compatibility verification processing on the key version chain and the version association chain; when the compatibility verification passes, matching the target message structure definition of the corresponding version according to the message structure definition version information, and matching the target protection policy of the corresponding version according to the protection policy version information; and performing compatibility management processing based on the target message structure definition and the target protection policy.

[0104] Specifically, a key version chain containing the current key version and historical key versions is constructed, along with a version association chain containing the current message structure definition version and historical message structure definition versions. The key version chain records the generation time, expiration time, version status, and version inheritance relationship for each key version; the key version currently in use is designated as the current key version, while key versions that are historically retained and still possess decryption capabilities are designated as historical key versions. The version association chain records the version inheritance relationship and field change relationship formed during the evolution of the message structure definition, thereby establishing the association between historical message structure definition versions and the current message structure definition version.

[0105] Subsequently, compatibility verification is performed on the key version chain and the version association chain. Specifically, the corresponding version association chain node is determined based on the message structure definition version associated with the target message content, and the corresponding key version chain node is determined based on the protection policy version associated with the target message content. Then, it is determined whether the version association chain node has a corresponding message structure definition mapping relationship, and whether the key version chain node has a corresponding key version mapping relationship. If both mapping relationships exist, the compatibility verification is considered successful; otherwise, the compatibility verification is considered to have failed.

[0106] When the compatibility verification passes, the target message structure definition is matched to the corresponding version based on the message structure definition version corresponding to the target message content, and the target protection policy is matched to the corresponding version based on the protection policy version corresponding to the target message content; then, compatibility management processing is performed based on the target message structure definition and the target protection policy.

[0107] In the message structure definition compatibility management process, compatibility processing is performed for field changes during the evolution of the message structure definition. For newly added fields, the new fields are identified and protected according to the current target protection strategy, enabling them to participate in subsequent message access. For deleted fields, the corresponding fields in historical messages are retained, and deleted fields are ignored during the current version's parsing process, ensuring that historical messages can still be accessed normally. For renamed fields, a mapping relationship is established between historical field identifiers and current field identifiers, and field conversion is performed based on this mapping relationship, enabling the association between historical and current fields. For adjusted field types, a compatibility judgment is performed based on the field types before and after the adjustment. If the compatibility conditions are met, field parsing is completed according to the corresponding type mapping relationship; if the compatibility conditions are not met, the field is marked as needing migration. For adjusted field sensitivity levels, access control and decryption processing are performed based on the field sensitivity level corresponding to the target message content generation, ensuring that historical and current messages are accessed using their respective corresponding field sensitivity levels.

[0108] Furthermore, during the evolution of the message structure definition, a snapshot of the corresponding field sensitivity level is saved for each version of the message structure definition. When parsing the target message content, the corresponding version's field sensitivity level snapshot information is first obtained. Then, field-level access control and field-level decryption processing are performed based on the field sensitivity level snapshot information, thereby avoiding the problem of historical messages not being parsed correctly due to changes in the sensitivity level of the current version.

[0109] During the protection policy compatibility management process, the target key version in the key version chain is located based on the protection policy version corresponding to the target message content, and the corresponding decryption process is performed based on the target key version. Specifically, after the system completes key rotation, newly generated messages are protected using the current key version, while historical messages retain the decryption capabilities corresponding to their historical key versions. Historical key versions no longer participate in the protection processing of new messages, but continue to retain the ability to access historical messages, thus forming a continuous decryption chain containing multiple historical key versions and the current key version.

[0110] Furthermore, during the key rotation process, when a new key version is generated, the new key version is marked as the current usage state, and the previous key version is marked as the historical retention state. The producer uses the current key version to perform new message protection processing. The consumer automatically locates the corresponding key version according to the protection policy version associated with the target message content, and uses the corresponding key version to perform decryption processing. When the historical key version reaches the preset retention period, it is then invalidated.

[0111] During the key rotation transition phase, a version association is established between the current key version and historical key versions. When parsing target message content, the consumer prioritizes matching the protection policy corresponding to the current key version; if no match is found, it then matches the corresponding historical key version based on the version association, thereby ensuring that the target message content generated before and after the key rotation can be accessed correctly.

[0112] Ultimately, based on the target message structure definition and target protection strategy, compatibility management of target message content is completed, ensuring that target message content generated by different message structure definition versions and target message content generated by different protection strategy versions can be correctly parsed, accessed, and decrypted, thereby guaranteeing continuous compatibility under message structure definition evolution, field sensitivity level adjustment, and key rotation scenarios.

[0113] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0114] Please refer to Figure 4 This illustration shows a schematic diagram of a sensitivity-aware distributed message queue encryption device according to an embodiment of this application. The device includes a sensitivity-aware module 41, a selective encryption module 42, a secure routing module 43, an on-demand decryption module 44, and a compatibility assurance module 45. Sensitivity perception module 41 is used to obtain the field sensitivity level corresponding to each field in the target message based on the sensitivity mapping table.

[0115] The selective encryption module 42 is used to perform selective encryption processing on the target message field based on the field sensitivity level, and output plaintext field information and protected field information.

[0116] The secure routing module 43 is used to generate plaintext routing information for plaintext field information, and perform message routing processing based on the plaintext routing information to obtain a first target consumption message; for target fields configured to participate in routing or filtering in protected field information, it generates a secure routing mapping value or a comparable filtering identifier that does not expose the plaintext of the field, and performs message routing processing and / or message filtering processing on the first target consumption message based on the secure routing mapping value or the comparable filtering identifier to obtain a second target consumption message.

[0117] The on-demand decryption module 44 is used to respond to the access request from the consumer and obtain the field permission level corresponding to the consumer; based on the field permission level, it performs on-demand decryption processing on each target message field in the second target consumption message to obtain the target message content; the on-demand decryption processing includes plaintext reading processing, decryption processing, desensitization processing, and access restriction processing.

[0118] The compatibility assurance module 45 is used to perform compatibility management processing on the target message content based on the message structure definition version information and protection policy version information.

[0119] In one possible implementation, the sensitivity perception module 41 is used to construct a sensitivity mapping table, specifically including: parsing the sensitivity annotation of target message fields to obtain annotated target message fields and unannotated target message fields; for annotated target message fields, obtaining the corresponding sensitivity level through the annotation information; for unannotated target message fields, obtaining the corresponding sensitivity level through a dual verification mechanism; the dual verification mechanism includes an automatic inference rule mechanism and a format verification mechanism; the sensitivity levels include public level, internal level, confidential level, and top secret level; establishing a first correspondence between annotated target message fields and sensitivity levels, and establishing a second correspondence between unannotated target message fields and sensitivity levels; and constructing a sensitivity mapping table based on the first and second correspondences.

[0120] In one possible implementation, the selective encryption module 42 is used to perform selective encryption processing on the target message field based on the field sensitivity level, and output plaintext routing information and protected field information. Specifically, when the field sensitivity level is public or internal, plaintext preservation processing is performed on the target message field to obtain plaintext routing information; when the field sensitivity level is confidential or top secret, field-level encryption processing is performed on the target message field to obtain protected field information.

[0121] In one possible implementation, the selective encryption module 42 is used to perform field-level encryption processing on the target message field, specifically including: when the field sensitivity level is confidential, encrypting the target message field using a first encryption strategy; when the field sensitivity level is top secret, encrypting the target message field using a second encryption strategy; the encryption strength of the second encryption strategy is higher than that of the first encryption strategy; during the encryption processing, encryption context information is constructed based on the message subject identifier, message structure definition identifier, field path identifier, and protection version identifier, and the encryption result is bound and authenticated based on the encryption context information.

[0122] In one possible implementation, the on-demand decryption module 44 is used to obtain the field permission level corresponding to the target consumed message in response to the access request from the consumer. Specifically, this includes: obtaining the consumer identifier information and the field identifier information corresponding to the field to be accessed from the consumer; constructing a field permission matrix based on the consumer identifier information and the field identifier information, wherein the field permission matrix includes a permission association structure with the consumer group identifier as the first-level index and the field identifier as the second-level index; establishing the permission association relationship between the consumer group identifier and the field identifier based on the field permission matrix, and constructing a field permission evaluation model according to a preset permission mapping rule; and outputting the field permission level corresponding to the field based on the field permission evaluation model.

[0123] In one possible implementation, the on-demand decryption module 44 is used to perform on-demand decryption processing on the target consumed message based on the field permission level, specifically including: performing integrity verification processing on the target consumed message; when the integrity verification processing passes, obtaining the protection policy version information corresponding to the target consumed message; determining the target decryption key corresponding to the target message field based on the protection policy version information; parsing the field storage type identifier in the target consumed message; when the field storage type identifier corresponds to a plaintext type, reading the field value of the corresponding target message field; when the field storage type identifier corresponds to an encrypted type and the field permission level is the full access permission level, performing decryption processing on the corresponding target message field based on the target decryption key; when the field storage type identifier corresponds to an encrypted type and the field permission level is the de-identification access permission level, obtaining the de-identification mapping value of the corresponding target message field; when the field storage type identifier corresponds to an encrypted type and the field permission level is the prohibited access permission level, performing access restriction processing on the corresponding target message field.

[0124] In one possible implementation, the compatibility assurance module 45 is used to perform compatibility management processing based on the target message content, specifically including: constructing a key version chain containing the current key version and historical key versions; constructing a version association chain containing the current message structure definition version and historical message structure definition versions; performing compatibility verification processing on the key version chain and the version association chain; when the compatibility verification passes, matching the target message structure definition of the corresponding version according to the message structure definition version information, and matching the target protection policy of the corresponding version according to the protection version information; and performing compatibility management processing based on the target message structure definition and the target protection policy.

[0125] It should be noted that the above embodiments of the apparatus are only illustrated by the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the apparatus and method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0126] This application also provides an electronic device. (See reference...) Figure 5 , Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device may include: at least one processor 501, at least one communication bus 502, a user interface 503, at least one network interface 504, and a memory 505.

[0127] The communication bus 502 is used to enable communication between these components.

[0128] The user interface 503 may include a display screen and a camera. Optionally, the user interface 503 may also include a standard wired interface and a wireless interface.

[0129] The network interface 504 may optionally include a standard wired interface or a wireless interface (such as a Wi-Fi interface).

[0130] The processor 501 may include one or more processing cores. The processor 501 connects to various parts of the server using various interfaces and lines, and performs various server functions and processes data by running or executing instructions, programs, code sets, or instruction sets stored in memory 505, and by calling data stored in memory 505. Optionally, the processor 501 may be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). The processor 501 may integrate one or a combination of several of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the content to be displayed on the screen; and the modem handles wireless communication. It is understood that the modem may also not be integrated into the processor 501 and may be implemented as a separate chip.

[0131] The memory 505 may include random access memory (RAM) or read-only memory. Optionally, the memory 505 may include a non-transitory computer-readable storage medium. The memory 505 may be used to store instructions, programs, code, code sets, or instruction sets. The memory 505 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as touch function, sound playback function, image playback function, etc.), instructions for implementing the above-described method embodiments, etc.; the data storage area may store data involved in the above-described method embodiments, etc. Optionally, the memory 505 may also be at least one storage device located remotely from the aforementioned processor 501. (Refer to...) Figure 5The memory 505, which serves as a computer storage medium, may include an operating system, a network communication module, a user interface module, and a sensitivity-aware distributed message queue encryption application.

[0132] exist Figure 5 In the illustrated electronic device, the user interface 503 is primarily used to provide an input interface for the user and acquire user input data; while the processor 501 can be used to call the sensitivity-aware distributed message queue encryption application stored in the memory 505. When executed by one or more processors 501, the electronic device performs one or more of the methods described in the above embodiments. It should be noted that, for the foregoing method embodiments, for the sake of simplicity, they are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, because according to this application, some steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also understand that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0133] This application also provides a non-transitory computer-readable storage medium storing instructions. When executed by one or more processors, these instructions cause an electronic device to perform one or more of the methods described in the above embodiments.

[0134] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0135] In the various embodiments provided in this application, it should be understood that the disclosed apparatus can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some service interface; the indirect coupling or communication connection between apparatuses or units may be electrical or other forms.

[0136] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0137] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0138] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage device (CMD). Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a memory and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned memory includes various media capable of storing program code, such as USB flash drives, portable hard drives, magnetic disks, or optical disks.

[0139] The above description is merely an exemplary embodiment disclosed in this application and should not be construed as limiting the scope of this application. Any equivalent changes and modifications made in accordance with the teachings of this application shall still fall within the scope of this application.

[0140] This application is intended to cover any variations, uses, or adaptations disclosed herein that follow the general principles disclosed herein and include common knowledge or customary technical means in the art that are not described in this application.

Claims

1. A sensitivity-aware distributed message queue encryption method, characterized in that, The method includes: Based on the sensitivity mapping table, obtain the field sensitivity level corresponding to each field in the target message; Based on the field sensitivity level, selective encryption is performed on the target message field, and plaintext field information and protected field information are output. Plaintext routing information is generated for the plaintext field information, and message routing processing is performed based on the plaintext routing information to obtain the first target consumption message; For the target fields configured to participate in routing or filtering in the protected field information, a secure routing mapping value or a comparable filtering identifier that does not expose the plaintext of the field is generated, and message routing processing and / or message filtering processing are performed on the first target consumption message based on the secure routing mapping value or the comparable filtering identifier to obtain the second target consumption message; In response to an access request from the consumer, obtain the field permission level corresponding to the consumer; Based on the field permission level, on-demand decryption processing is performed on each target message field in the second target consumption message to obtain the target message content; the on-demand decryption processing includes plaintext reading processing, decryption processing, desensitization processing, and access restriction processing; Based on the message structure definition version information and protection policy version information, compatibility management processing is performed on the target message content.

2. The method according to claim 1, characterized in that, Constructing the sensitivity mapping table specifically includes: The target message fields are parsed for field sensitivity annotation to obtain annotated and unannotated target message fields; For the labeled target message field, the corresponding sensitivity level is obtained through the labeling information; For the unlabeled target message fields, the corresponding sensitivity level is obtained through a dual verification mechanism; the dual verification mechanism includes an automatic inference rule mechanism and a format verification mechanism; the sensitivity levels include public level, internal level, confidential level, and top secret level; Establish a first correspondence between the labeled target message fields and the sensitivity levels, and establish a second correspondence between the unlabeled target message fields and the sensitivity levels; The sensitivity mapping table is constructed based on the first correspondence and the second correspondence.

3. The method according to claim 2, characterized in that, The selective encryption processing of the target message field based on the field sensitivity level, and the output of plaintext routing information and protected field information, specifically includes: When the sensitivity level of the field is the public level or the internal level, plaintext preservation processing is performed on the target message field to obtain the plaintext routing information; When the sensitivity level of the field is confidential or top secret, field-level encryption is performed on the target message field to obtain the protected field information.

4. The method according to claim 3, characterized in that, The specific steps of performing field-level encryption on the target message field include: When the sensitivity level of the field is the confidential level, the target message field is encrypted using the first encryption strategy; When the sensitivity level of the field is the top secret level, the target message field is encrypted using a second encryption strategy; the encryption strength of the second encryption strategy is higher than that of the first encryption strategy. During encryption processing, encryption context information is constructed based on message subject identifier, message structure definition identifier, field path identifier, and protection version identifier, and the encryption result is bound and authenticated based on the encryption context information.

5. The method according to claim 1, characterized in that, In response to access requests from the consumer, the system retrieves the field permission level corresponding to the target message to be consumed, specifically including: Obtain the consumer identification information from the consumer terminal and the field identification information corresponding to the field to be accessed; A field permission matrix is ​​constructed based on the consumer identification information and the field identification information. The field permission matrix includes a permission association structure with the consumer group identifier as the first-level index and the field identifier as the second-level index. Based on the field permission matrix, establish the permission association relationship between consumer group identifiers and field identifiers, and construct a field permission evaluation model according to the preset permission mapping rules; The field permission level is output based on the field permission evaluation model.

6. The method according to claim 5, characterized in that, Based on the field permission level, perform on-demand decryption processing on the target consumed message, specifically including: Perform integrity verification processing on the target consumed message; When the integrity verification process passes, the protection policy version information corresponding to the target consumption message is obtained; Determine the target decryption key corresponding to the target message field based on the protection policy version information; Parse the field storage type identifier in the target consumed message; When the field storage type identifier corresponds to a plaintext type, read the field value corresponding to the target message field; When the field storage type identifier corresponds to the encryption type and the field permission level is the full access permission level, decryption processing is performed on the corresponding target message field based on the target decryption key; When the field storage type identifier corresponds to the encryption type and the field permission level is the de-identification access permission level, obtain the de-identification mapping value corresponding to the target message field; When the field storage type identifier corresponds to the encryption type and the field permission level is the prohibited access level, access restriction processing is performed on the corresponding target message field.

7. The method according to claim 1, characterized in that, The compatibility management process based on the target message content specifically includes: Establish a key version chain that includes the current key version and historical key versions; Establish a version association chain that includes the current message structure definition version and the historical message structure definition versions; Perform compatibility verification on the key version chain and the version association chain; When the compatibility check passes, the target message structure definition of the corresponding version is matched according to the message structure definition version information, and the target protection strategy of the corresponding version is matched according to the protection version information. The compatibility management process is performed based on the target message structure definition and the target protection policy.

8. A sensitivity-aware distributed message queue encryption device, characterized in that, The device includes a sensitive sensing module, a selective encryption module, a secure routing module, an on-demand decryption module, and a compatibility assurance module, wherein... The sensitivity perception module is used to obtain the field sensitivity level corresponding to each field in the target message based on the sensitivity mapping table. The selective encryption module is used to perform selective encryption processing on the target message field based on the field sensitivity level, and output plaintext field information and protected field information; The secure routing module is used to generate plaintext routing information for the plaintext field information, and perform message routing processing based on the plaintext routing information to obtain a first target consumption message; for the target fields configured to participate in routing or filtering in the protected field information, it generates a secure routing mapping value or a comparable filtering identifier that does not expose the plaintext of the field, and performs message routing processing and / or message filtering processing on the first target consumption message based on the secure routing mapping value or the comparable filtering identifier to obtain a second target consumption message; The on-demand decryption module is used to respond to the access request from the consumer end, obtain the field permission level corresponding to the consumer end, and perform on-demand decryption processing on each target message field in the second target consumption message based on the field permission level to obtain the target message content; the on-demand decryption processing includes plaintext reading processing, decryption processing, desensitization processing, and access restriction processing. The compatibility assurance module is used to perform compatibility management processing on the target message content based on the message structure definition version information and protection policy version information.

9. An electronic device, characterized in that, It includes a processor, a memory, and a network interface; the memory stores a computer program, which, when executed by the processor, enables the electronic device to implement the sensitivity-aware distributed message queue encryption method as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium stores instructions that, when executed, perform the method as described in any one of claims 1 to 7.

Images