Sensitive data dynamic desensitization method, device, storage medium and product

Abstract

The application discloses a sensitive data dynamic desensitization method, device, storage medium and product, relates to the technical field of information security, and comprises the following steps: obtaining a SQL query request of a user and a sensitive data white list, performing dynamic desensitization on corresponding sensitive data based on the SQL query request to obtain desensitized data, determining a white list field to which the user has obtained a viewing permission based on the sensitive data white list, determining target desensitized data corresponding to the white list field from the desensitized data, and performing plaintext display on the target desensitized data and non-sensitive data corresponding to the SQL query request. The application is not based on user access permission control of corresponding data rows, but determines the fields that can be accessed by each user, realizes column-level access permission control, controls different sensitive fields that can be accessed by different users through column-level access permission, and thus the fine granularity of sensitive data desensitization is improved.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to methods, devices, storage media and products for dynamic desensitization of sensitive data. Background Technology

[0002] Data breaches are a widespread security threat globally, causing not only enormous economic losses but also potentially triggering serious social problems. Sensitive data, once leaked, illegally used, or misused, is highly susceptible to causing significant damage. Therefore, to ensure data security, sensitive data needs to be anonymized.

[0003] Current methods for desensitizing sensitive data typically employ user role-based data access control. However, user role-based data access control can only control access to the data rows that users can access, meaning that current methods can only desensitize the entire row of data, resulting in low granularity in sensitive data desensitization. Summary of the Invention

[0004] The main purpose of this application is to provide a method, device, storage medium and product for dynamic desensitization of sensitive data, which aims to solve the technical problem of low granularity in sensitive data desensitization.

[0005] To achieve the above objectives, this application proposes a method for dynamic desensitization of sensitive data, the method comprising: Obtain the user's SQL query requests and sensitive data whitelist; Based on the SQL query request, the sensitive data corresponding to the SQL query request is dynamically de-identified to obtain de-identified data; Based on the sensitive data whitelist, determine the whitelist fields for which the user has viewing permissions, and determine the target de-identified data corresponding to the whitelist fields from the de-identified data; The target de-identified data and the non-sensitive data corresponding to the SQL query request are displayed in plaintext.

[0006] In one embodiment, the step of dynamically de-identifying the sensitive data corresponding to the SQL query request based on the SQL query request to obtain de-identified data includes: Based on the SQL query request, determine the sensitive data to be queried and the sensitive fields corresponding to the sensitive data; Based on the aforementioned sensitive fields, determine the data desensitization rules to be used when desensitizing each of the aforementioned sensitive data; Based on the data anonymization rules, the sensitive data is anonymized to obtain the anonymized data.

[0007] In one embodiment, the data anonymization rules include full anonymization rules and non-full anonymization rules. The step of anonymizing the sensitive data based on the data anonymization rules to obtain the anonymized data includes: If the data desensitization rule is the full desensitization rule, then the full text of the sensitive data is desensitized to obtain the desensitized data; If the data desensitization rule is the non-full desensitization rule, then determine the plaintext retention bits corresponding to the non-full desensitization rule; Based on the number of plaintext bits to be retained, the data of the corresponding number of bits in the sensitive data is retained in plaintext, and the data in the sensitive data other than the plaintext-retained data is desensitized to obtain the desensitized data.

[0008] In one embodiment, the step of determining the data desensitization rules used when desensitizing each of the sensitive data based on the sensitive fields includes: Based on preset field data desensitization settings, the data desensitization rules used when desensitizing each of the sensitive data are determined, wherein the field data desensitization settings include the correspondence settings between each of the sensitive fields and the data desensitization rules; From the sensitive data, determine the function-sensitive data obtained after processing by the data processing function; The data desensitization rule corresponding to the function-sensitive data is determined as the full desensitization rule.

[0009] In one embodiment, before the step of determining the whitelist field for which the user has viewing permission based on the sensitive data whitelist, and determining the target de-identified data corresponding to the whitelist field from the de-identified data, the method further includes: When a user requests permission to access sensitive fields, the sensitive fields corresponding to the sensitive data are determined. Obtain the target sensitive fields that the user needs to request to view, and the corresponding field permission period for each target sensitive field; Write the target sensitive field and the field permission period into the sensitive data whitelist.

[0010] In one embodiment, after the step of dynamically desensitizing the sensitive data corresponding to the SQL query request based on the SQL query request to obtain desensitized data, the method further includes: When a user's data processing operation is received for the sensitive data, the sensitive data to be processed is determined. Determine the derived data generated by data processing operations on the sensitive data to be processed, and mark the derived data as the sensitive data; The sensitive data whitelist is updated based on the derived data.

[0011] In one embodiment, the step of updating the sensitive data whitelist based on the derived data includes: Based on the sensitive data whitelist, determine the target sensitive data that the user has been granted viewing permissions from the sensitive data to be processed; From the derived data, determine the target derived data generated by performing the data processing operation on the target sensitive data; Add the target derived data to the sensitive data whitelist and update the sensitive data whitelist.

[0012] In addition, to achieve the above objectives, this application also proposes a sensitive data dynamic desensitization device, the device comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the sensitive data dynamic desensitization method described above.

[0013] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the dynamic desensitization method for sensitive data as described above.

[0014] In addition, to achieve the above objectives, this application also provides a computer program product, which includes a computer program that, when executed by a processor, implements the steps of the dynamic desensitization method for sensitive data as described above.

[0015] One or more technical solutions proposed in this application have at least the following technical effects: This application obtains the user's SQL query request and sensitive data whitelist. Based on the SQL query request, it dynamically de-identifies the sensitive data corresponding to the SQL query request to obtain de-identified data. Based on the sensitive data whitelist, it determines the whitelist fields that the user has the right to view. It then determines the target de-identified data corresponding to the whitelist fields from the de-identified data and displays the target de-identified data and the non-sensitive data corresponding to the SQL query request in plaintext.

[0016] Compared to current methods that only perform data anonymization on entire rows, resulting in low granularity, this application implements column-level access control for sensitive fields, thereby improving the granularity of sensitive data anonymization. Specifically, this application dynamically anonymizes sensitive data corresponding to SQL query requests and determines the sensitive fields that users can view through a sensitive data whitelist, displaying the sensitive data of the corresponding fields and the non-sensitive data queried by the user in plaintext. In other words, this application does not control access permissions based on individual data rows, but rather determines the fields that each user can access, implementing column-level access control. By controlling the access of different sensitive fields by different users through column-level access permissions, the granularity of sensitive data anonymization is improved. Attached Figure Description

[0017] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0018] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart illustrating an embodiment of the dynamic desensitization method for sensitive data in this application. Figure 2 This is a schematic diagram of the system module functions provided in Embodiment 1 of the sensitive data dynamic desensitization method of this application; Figure 3 This is a schematic diagram of the system interface structure and interaction provided for Embodiment 1 of the sensitive data dynamic desensitization method of this application; Figure 4 This is a flowchart illustrating Embodiment 2 of the method for dynamically de-identifying sensitive data in this application. Figure 5 This is a schematic diagram of the device structure of the hardware operating environment involved in the dynamic desensitization method for sensitive data in the embodiments of this application; Figure 6 This is a schematic diagram illustrating the data acquisition consent process involved in the dynamic desensitization method for sensitive data in this application embodiment.

[0020] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0021] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0022] To better understand the technical solution of this application, a detailed description will be provided below in conjunction with the accompanying drawings and specific implementation methods.

[0023] It should be noted that the executing entity in this embodiment can be a computing service device with data processing, network communication, and program execution functions, such as a tablet computer, personal computer, or mobile phone, or an electronic device or a sensitive data dynamic desensitization device capable of performing the above functions. The following description uses a sensitive data dynamic desensitization device as an example to illustrate this embodiment and the subsequent embodiments.

[0024] Data breaches are a widespread security threat globally, causing not only enormous economic losses but also potentially triggering serious social problems. Sensitive data, once leaked, illegally used, or misused, is highly susceptible to causing significant damage. Therefore, to ensure data security, sensitive data needs to be anonymized.

[0025] Current methods for desensitizing sensitive data typically employ user role-based data access control. However, user role-based data access control can only control access to individual rows of data, limiting the desensitization process to entire rows and resulting in low granularity. Furthermore, current methods primarily implement row-level access control, failing to meet the demands for flexible access control.

[0026] Furthermore, current methods require users to switch to other systems and request permissions to view plaintext data, which is cumbersome and inefficient. Additionally, they lack an effective lineage control mechanism for new data generated based on sensitive fields. Moreover, current methods are mostly static data masking, unable to achieve dynamic masking during access, and do not support flexible adjustments to masking rules.

[0027] Based on this, embodiments of this application provide a method for dynamically de-identifying sensitive data, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the sensitive data dynamic desensitization method of this application.

[0028] In this embodiment, the dynamic desensitization method for sensitive data includes steps S10 to S40: Step S10: Obtain the user's SQL query requests and sensitive data whitelist; It should be noted that an SQL (Structured Query Language) query request refers to a structured query language command submitted by a user through a data query tool to retrieve data from a Gaussian analytics cluster. A sensitive data whitelist refers to a list of users authorized to view plaintext data of sensitive fields and their corresponding sensitive field information.

[0029] It should also be noted that the sensitive data dynamic desensitization method in this embodiment is implemented through a sensitive data dynamic desensitization and access control system. The various modules and functions of the sensitive data dynamic desensitization and access control system in this embodiment are as follows: Figure 2 As shown.

[0030] according to Figure 2 As can be seen, the sensitive data dynamic desensitization and access control system of this embodiment mainly includes the following functional modules: The data query module (DataCube SQLCODE (database operation return code)) is responsible for receiving SQL query statements submitted by users, forwarding the query request to the Gaussian analysis cluster for execution, and obtaining the query results. The sensitive data identification module (Audit Map) is responsible for identifying sensitive fields in the query results and determining the sensitivity level of the fields according to preset data security classification rules. The dynamic de-identification module (BIX-CODE (Dynamic Information Exchange) tool) is responsible for dynamically de-identifying sensitive field data according to preset de-identification rules and generating de-identified display data.

[0031] The permission request module (DataCube Permission Service) handles user requests for permissions on plaintext data in sensitive fields, including request form generation, approval process triggering, and permission whitelist updates. The permission whitelist management module (DataCube SQLCODE) maintains the whitelist of authorized users' sensitive field permissions, supporting both manual and automatic refreshes. The lineage control module (BIX-CODE tool) tracks the data flow of sensitive fields, ensuring that new data generated based on sensitive fields automatically inherits sensitive attributes.

[0032] It is understood that when this embodiment receives a user's SQL query request, it simultaneously obtains the whitelist of sensitive data of authorized users, so that the system can have the basic information to determine the user's access permissions to each field in the query results before the data is returned.

[0033] Furthermore, this embodiment describes the structure of the interfaces and storage of various components of the sensitive data dynamic desensitization and access control system, as well as the interface interactions, which can be referenced from [reference needed]. Figure 3 This embodiment integrates functions such as data query, anonymized display, permission application, and permission refresh into a unified entry point, making user operation smooth and eliminating the need to switch systems.

[0034] Step S20: Based on the SQL query request, dynamically de-identify the sensitive data corresponding to the SQL query request to obtain de-identified data; It should be noted that sensitive data refers to field data that is identified as having a sensitive level and requiring access control protection according to preset data security classification rules. Dynamic data masking refers to processing sensitive data in real time according to preset masking rules when a user accesses data, generating masked display data without changing the underlying original data. Masked data: refers to the data generated after applying masking rules to the original sensitive data, which is used to display to unauthorized users.

[0035] It is understandable that this embodiment adopts a dynamic desensitization method for sensitive data corresponding to SQL query requests, that is, desensitization is performed in real time when the user accesses the data rather than pre-desensitizing it during storage. This allows the original sensitive data to be completely preserved in the underlying storage, while unauthorized users can only see the desensitized data. This satisfies the requirements of data security protection and solves the problem that static desensitization leads to the loss of the original data, which cannot meet the needs of plaintext viewing scenarios such as auditing.

[0036] In one feasible implementation, the specific implementation of dynamically desensitizing the sensitive data corresponding to the SQL query request based on the SQL query request to obtain desensitized data can also be: Based on the SQL query request, determine the sensitive data to be queried and the sensitive fields corresponding to the sensitive data; Based on the aforementioned sensitive fields, determine the data desensitization rules to be used when desensitizing each of the aforementioned sensitive data; Based on the data anonymization rules, the sensitive data is anonymized to obtain the anonymized data.

[0037] It should be noted that sensitive fields refer to columns in the database table structure that store sensitive data. Each sensitive field has a corresponding field name and sensitivity level. Data anonymization rules refer to the specific processing logic preset for sensitive fields of different sensitivity levels or types, used to convert the original data into anonymized data. Specifically, this can be full anonymization, retaining only the first n characters, retaining only the last n characters, format anonymization, etc.

[0038] It is understandable that this embodiment, through a series of processing steps—first locating sensitive fields, then matching the corresponding de-identification rules based on the fields, and finally executing the de-identification according to the rules—enables the de-identification operation to be precisely applied to column-level sensitive data, and different fields can be adapted to different de-identification rules. This achieves fine-grained and differentiated dynamic de-identification capabilities, avoiding the lack of flexibility caused by indiscriminate de-identification of the entire table. At the same time, it ensures that each sensitive field is appropriately de-identified according to its preset security level, improving the flexibility of sensitive data access control in a Gaussian cluster environment.

[0039] In one feasible implementation, the data anonymization rules include full anonymization rules and non-full anonymization rules. The specific implementation of anonymizing the sensitive data based on the data anonymization rules to obtain the anonymized data can also be: If the data desensitization rule is the full desensitization rule, then the full text of the sensitive data is desensitized to obtain the desensitized data; If the data desensitization rule is the non-full desensitization rule, then determine the plaintext retention bits corresponding to the non-full desensitization rule; Based on the number of plaintext bits to be retained, the data of the corresponding number of bits in the sensitive data is retained in plaintext, and the data in the sensitive data other than the plaintext-retained data is desensitized to obtain the desensitized data.

[0040] It should be noted that a full masking rule refers to masking all characters of sensitive data, without retaining any original plaintext. A partial masking rule refers to masking only a portion of the sensitive data, while retaining a specified number or proportion of the original plaintext. The plaintext retention limit refers to the number of characters that the system presets to be retained in the original plaintext state when applying a partial masking rule.

[0041] It should also be noted that the data anonymization rules in this embodiment include email address format anonymization rules applicable to email addresses and IP address format anonymization rules applicable to IP addresses. In addition to retaining a preset number of characters, the non-full anonymization rules in this embodiment are further divided into rules for retaining the first n characters for account numbers, the last n characters for names, and the first n percent for addresses, based on the position of the plaintext.

[0042] It is understood that this embodiment executes different desensitization logic according to the type of desensitization rule, and further controls the range of plaintext retention precisely according to the number of plaintext bits in the case of non-full desensitization. This enables the desensitization process to achieve thorough desensitization protection for highly sensitive data, while retaining necessary identifiable information for low-sensitivity data to maintain data availability. It achieves a balance between desensitization security and data usability, and meets the differentiated desensitization needs under different sensitivity levels.

[0043] In one possible implementation, the specific implementation of determining the data desensitization rules used when desensitizing each of the sensitive data based on the sensitive fields can also be: Based on preset field data desensitization settings, the data desensitization rules used when desensitizing each of the sensitive data are determined, wherein the field data desensitization settings include the correspondence settings between each of the sensitive fields and the data desensitization rules; From the sensitive data, determine the function-sensitive data obtained after processing by the data processing function; The data desensitization rule corresponding to the function-sensitive data is determined as the full desensitization rule.

[0044] It should be noted that field data anonymization settings refer to pre-configured information used to record the mapping relationship between each sensitive field and the data anonymization rules to be applied. Data processing functions refer to functions that perform calculations, transformations, or aggregations on original field values ​​during data querying or processing, specifically including summation, concatenation, truncation, and encryption. Function-sensitive data refers to the new data values ​​generated after the original sensitive data has been processed by the data processing function.

[0045] It is understood that this embodiment not only determines the desensitization rules for ordinary sensitive fields based on the preset mapping relationship between fields and rules, but also additionally identifies function-sensitive data obtained after data processing functions, and forces the desensitization rules for such data to be set as full desensitization rules. This enables new data generated based on sensitive fields through calculation, transformation and other operations to be automatically inherited and adopt the most stringent desensitization protection, avoiding the risk of plaintext leakage caused by the weakening or loss of sensitive attributes after data processing, and realizing the secure control of derived data in the entire chain of sensitive data lineage.

[0046] Step S30: Based on the sensitive data whitelist, determine the whitelist fields for which the user has viewing permissions, and determine the target de-identified data corresponding to the whitelist fields from the de-identified data; It should be noted that the whitelist fields refer to those sensitive fields in the sensitive data whitelist that have been explicitly authorized for viewing by the current user in plaintext. Target de-identified data refers to the portion of the de-identified data set that corresponds to the whitelist fields and has already undergone de-identification processing.

[0047] It should also be noted that the sensitive data dynamic desensitization and access control system in this embodiment includes a whitelist refresh button. After the user clicks the whitelist refresh button, the system updates the sensitive field permission whitelist for the current user in real time. For sensitive fields that have been granted permissions, the user can view the original plaintext data. After the permissions expire, the user can only view the desensitized data. Every time the user enters the tool page, the system automatically refreshes the sensitive field permission whitelist for the current user.

[0048] Understandably, this embodiment determines the whitelist fields that users have permission to access by using a sensitive data whitelist, and specifically locks the target de-identified data corresponding to these fields from the de-identified data. This enables the system to accurately identify the range of fields that need to be displayed to users in plaintext, achieving fine-grained permission control for authorized users based on dynamic de-identification. This avoids the plaintext leakage of unauthorized fields while ensuring that authorized fields can view the original data normally, thus improving the accuracy of permission control.

[0049] Step S40: Display the target de-identified data and the non-sensitive data corresponding to the SQL query request in plaintext.

[0050] It should be noted that non-sensitive data refers to field data that is identified as not having a sensitive level and does not require desensitization processing according to preset data security classification rules.

[0051] It is understood that this embodiment only displays the target de-identified data and non-sensitive data that the user has granted permission for in plain text, while other sensitive field data that the user has not granted permission for remains de-identified and is not displayed in plain text. This allows the system to achieve differentiated permission control at the field level in the same query result display interface, which not only ensures the security of unauthorized sensitive data, but also allows authorized users to view plain text information without obstacles, without the need to switch systems or apply separately, effectively improving the convenience of data access.

[0052] In summary, this embodiment obtains the user's SQL query request and sensitive data whitelist, dynamically de-identifies the sensitive data corresponding to the SQL query request based on the SQL query request, obtains de-identified data, determines the whitelist fields for which the user has viewing permissions based on the sensitive data whitelist, determines the target de-identified data corresponding to the whitelist fields from the de-identified data, and displays the target de-identified data and the non-sensitive data corresponding to the SQL query request in plaintext.

[0053] Compared to current methods that only perform data anonymization on entire rows, resulting in low granularity, this embodiment implements column-level access control for sensitive fields, thereby improving the granularity of sensitive data anonymization. Specifically, this embodiment dynamically anonymizes sensitive data corresponding to SQL query requests and determines the sensitive fields that users can view through a sensitive data whitelist, displaying the sensitive data of the corresponding fields and the non-sensitive data queried by the user in plaintext. In other words, this embodiment does not control access permissions based on individual data rows, but rather determines the fields that each user can access, implementing column-level access control. By controlling different sensitive fields accessible to different users through column-level access permissions, the granularity of sensitive data anonymization is improved.

[0054] Based on the first embodiment of this application, in the second embodiment of this application, the content that is the same as or similar to that in Embodiment 1 above can be referred to the above description, and will not be repeated hereafter. Based on this, please refer to... Figure 4 Before step S30, the dynamic desensitization method for sensitive data further includes steps S01 to S03: Step S01: When a user initiates a request for permission to access sensitive fields, determine the sensitive fields corresponding to the sensitive data. It should be noted that a sensitive field permission request refers to a user's application submitted through the system interface to request permission to view plaintext data of one or more sensitive fields. When a user's query results contain sensitive fields, a "Request Sensitive Field Permission" button is displayed on the page. After the user clicks the button, a permission request pop-up window appears, displaying all sensitive fields involved in the current query results.

[0055] It should also be noted that the application methods in this embodiment include immediate application and batch application. Immediate application will directly submit the permission application and initiate the approval process. Batch application will first add the sensitive fields to the shopping cart, and then initiate the application together with other sensitive fields.

[0056] It is understood that this embodiment precisely identifies the sensitive field to which the request points when the user initiates a permission request, thereby enabling permission requests to be accurate to the column level and supporting users to select specific sensitive fields for request as needed.

[0057] Step S02: Obtain the target sensitive fields that the user needs to request to view, and the corresponding field permission period for each target sensitive field; It should be noted that the target sensitive field refers to one or more sensitive fields that the user explicitly selects in the permission request and wishes to view in plaintext. The field permission period refers to the effective time range of the permission specified by the user for the requested sensitive field; the permission will automatically expire after this period.

[0058] It is understood that this embodiment not only obtains the target sensitive fields requested by the user, but also obtains the permission period corresponding to each field, thereby enabling permission granting to be bound to the time dimension, supporting the setting of permission validity period as needed, and the permission automatically expires after expiration without manual intervention to revoke it, which meets the temporary data access needs, while avoiding the data security risks brought about by the permanent opening of permissions.

[0059] Step S03: Write the target sensitive field and the field permission period into the sensitive data whitelist.

[0060] It is understood that this embodiment directly writes the target sensitive fields applied for by the user and their corresponding permission periods into the sensitive data whitelist, so that the approved permissions can take effect immediately and have time constraints. They can be identified and used by the dynamic desensitization process in subsequent data queries without the user switching systems or manually refreshing, which effectively improves the real-time effect of permissions and ensures the ability to automatically expire permissions.

[0061] In one feasible implementation, the specific implementation following the step of dynamically desensitizing the sensitive data corresponding to the SQL query request based on the SQL query request to obtain desensitized data can also be: When a user's data processing operation is received for the sensitive data, the sensitive data to be processed is determined. Determine the derived data generated by data processing operations on the sensitive data to be processed, and mark the derived data as the sensitive data; The sensitive data whitelist is updated based on the derived data.

[0062] It should be noted that data processing operations refer to further analysis, transformation, calculation, or processing of sensitive data already retrieved by the user, including data aggregation, function operations, and table joins. Sensitive data to be processed refers to the original data that has been identified as sensitive and is targeted by subsequent data processing operations initiated by the user. Derived data refers to data newly generated based on the sensitive data to be processed after data processing operations, including data in new fields or tables generated through calculations, concatenation, aggregation, etc.

[0063] It is understood that in this embodiment, when a user performs data processing operations on sensitive data and generates derived data, the derived data is automatically marked as sensitive data and the sensitive data whitelist is updated accordingly. This allows the lineage of sensitive data to be fully traced, and new data generated based on sensitive fields can automatically inherit sensitive attributes and access control, thus achieving consistency protection of sensitive data throughout the entire processing chain.

[0064] In one feasible implementation, the specific implementation of updating the sensitive data whitelist based on the derived data may also be: Based on the sensitive data whitelist, determine the target sensitive data that the user has been granted viewing permissions from the sensitive data to be processed; From the derived data, determine the target derived data generated by performing the data processing operation on the target sensitive data; Add the target derived data to the sensitive data whitelist and update the sensitive data whitelist.

[0065] It should be noted that "target sensitive data" refers to the portion of sensitive data to be processed that the user has already gained plaintext viewing permissions through a sensitive data whitelist. "Target derived data" refers to derived data generated after data processing operations are performed on the target sensitive data.

[0066] It is understood that this embodiment adds whitelisted data corresponding to target derived data for which the user has already obtained viewing permissions. This ensures that the scope of permission inheritance is strictly limited to the user's original permission boundaries, which not only ensures that new data generated based on sensitive fields can automatically inherit access permissions, but also avoids improper generalization and expansion of permissions, thus ensuring the accuracy of permission control.

[0067] In one embodiment, the step of updating the sensitive data whitelist based on the derived data further includes: When derived data is generated from multiple source sensitive fields through arithmetic operations, string concatenation, or function combination, the sensitivity level and default desensitization rule of each source sensitive field are obtained, and the highest sensitivity level and the strictest desensitization rule are selected as the sensitive attributes of the derived data. Query the permission status and permission period of each source sensitive field in the current user's sensitive data whitelist. If all source sensitive fields have been authorized and have not expired, take the earliest expiration time of each permission period as the permission period of the derived data and write the derived data into the whitelist. If any source sensitive field is unauthorized or expired, the derived data will not be granted whitelist permissions and will only be displayed with the strictest desensitization rule it inherits.

[0068] It should be noted that function combination refers to passing sensitive fields as parameters to database functions (such as length calculation, substring extraction, case conversion, etc.) for processing. Earliest expiration time refers to selecting the expiration time closest to the current time from the respective permission expiration periods of multiple source sensitive fields.

[0069] It is understandable that in this embodiment, when generating derived data by combining multiple sensitive fields, not only is the highest sensitivity level and the strictest de-identification rules selected, but all source fields are also required to be authorized with the shortest permission period before being granted whitelist permissions. When a new field is generated by concatenating multiple sensitive fields, any unauthorized or expired source field will result in the derived field being unable to be viewed in plaintext, effectively preventing the risk of bypassing permissions by indirectly obtaining highly sensitive information through the combination of low-sensitivity and high-sensitivity fields. At the same time, taking the earliest expiration time as the derived permission period ensures that the permission lifecycle is consistent with the most vulnerable source field, avoiding security vulnerabilities where derived data can still be viewed in plaintext after the permissions of some source fields have expired, thereby significantly improving the security consistency of sensitive data throughout the entire processing chain.

[0070] In one embodiment, the step of obtaining the sensitivity level and default desensitization rule of each source sensitive field, and selecting the highest sensitivity level and the strictest desensitization rule as the sensitive attribute of the derived data includes: Identify the data type and desensitization rule type of each source sensitive field. The data type includes numeric, character, and date types, and the desensitization rule type includes full desensitization, format desensitization, retaining the first N characters, and retaining the last N characters. If the derived data is generated through arithmetic operations, the desensitization rules for the derived data are determined using a preset operation desensitization priority table based on the operator type of the arithmetic operation and the desensitization rules of the source field. When any source field adopts a full desensitization rule, the derived data is forced to adopt a full desensitization rule. When multiple source fields adopt non-full desensitization rules, the rule with the highest degree of masking is selected, with the masking degree from high to low as follows: retain the last N characters, retain the first N characters, and format masking. If the derived data is generated through string concatenation or function combination, the rule with the highest degree of masking is selected from all the masking rules of the source fields as the masking rule for the derived data. The masking degree from high to low is as follows: full masking, retaining the last N characters, retaining the first N characters, and format masking.

[0071] It should be noted that data type refers to the data format category of the sensitive field stored in the database. This application involves three types: numeric, character, and date. The desensitization rule type refers to the specific method of desensitizing sensitive data, including full desensitization, format desensitization, retaining the first N characters, and retaining the last N characters.

[0072] Arithmetic operations refer to basic mathematical calculation operations such as addition, subtraction, multiplication, and division. Operator type: refers to the specific operator for arithmetic operations, such as addition, subtraction, multiplication, and division.

[0073] The operation desensitization priority table refers to a pre-configured mapping table of output desensitization rules for different combinations of operators, used to resolve desensitization rule conflicts in arithmetic operations. Masking degree refers to the strength to which the desensitization rule hides information from the original data; the higher the masking degree, the less plaintext information is exposed.

[0074] Understandably, this embodiment addresses complex data processing operations in a bank audit scenario within a Gaussian cluster. It distinguishes between two different derived data generation methods: arithmetic operations and string concatenation, and introduces an operation masking priority table to specifically handle rule conflicts in arithmetic operations. In arithmetic operation scenarios, the sum of two numerical fields retaining only the first N digits may expose information beyond the boundaries of a single field. Using a priority table instead of simply selecting the highest masking level allows for more precise control over the security of the result, such as preventing the derivation of the original value of a highly sensitive field from a low-masking field through summation operations.

[0075] Furthermore, this embodiment blocks the possibility of bypassing sensitive protection by using arithmetic operations through the forced full desensitization transmission rules, thereby significantly improving the security strength of lineage control in scenarios with multiple sources of sensitive fields.

[0076] In summary, this embodiment writes the target sensitive fields and their permission periods into a whitelist when a user initiates a permission request. In subsequent queries, it matches de-identified data with authorized fields and displays them in plaintext based on the same whitelist. This allows permission requests, approvals, and data access to be seamlessly integrated within the same system. Users can complete the entire process from request to viewing plaintext without switching systems, thus solving the technical problem in existing technologies where users need to switch to other systems for permission requests and the operations are cumbersome. At the same time, by setting the field permission period, it achieves flexible permission control based on events, people, and time. Permissions automatically expire after they expire, significantly improving the user experience and the security and convenience of sensitive data access control.

[0077] It should be noted that the above examples are only for understanding this application and do not constitute a limitation on the dynamic desensitization method for sensitive data in this application. Any simple modifications based on this technical concept are within the protection scope of this application.

[0078] This application provides a sensitive data dynamic desensitization device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the sensitive data dynamic desensitization method in the above embodiment 1.

[0079] The following is for reference. Figure 5 The diagram illustrates a structural schematic suitable for implementing a dynamic sensitive data desensitization device in the embodiments of this application. The dynamic sensitive data desensitization device in the embodiments of this application may include, but is not limited to, mobile terminals such as mobile phones, tablets, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PMPs (Portable Media Players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 5 The sensitive data dynamic desensitization device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0080] like Figure 5As shown, the sensitive data dynamic desensitization device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 1002 or a program loaded from a storage device 1003 into a random access memory (RAM) 1004. The RAM 1004 also stores various programs and data required for the operation of the sensitive data dynamic desensitization device. The processing unit 1001, ROM 1002, and RAM 1004 are interconnected via a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Typically, the following systems can be connected to the I / O interface 1006: input devices 1007 including, for example, touchscreens, touchpads, keyboards, mice, image sensors, microphones, accelerometers, gyroscopes, etc.; output devices 1008 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 1003 including, for example, magnetic tapes, hard disks, etc.; and communication devices 1009. Communication device 1009 allows the sensitive data dynamic desensitization device to communicate wirelessly or wiredly with other devices to exchange data. While the figures show sensitive data dynamic desensitization devices with various systems, it should be understood that implementation or possession of all the systems shown is not required. More or fewer systems may be implemented alternatively.

[0081] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from ROM 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0082] The sensitive data dynamic desensitization device provided in this application, employing the sensitive data dynamic desensitization method in the above embodiments, can solve the technical problem of low granularity in sensitive data desensitization. Compared with the prior art, the beneficial effects of the sensitive data dynamic desensitization device provided in this application are the same as those of the sensitive data dynamic desensitization method provided in the above embodiments, and other technical features in this sensitive data dynamic desensitization device are the same as those disclosed in the method of the previous embodiment, and will not be repeated here.

[0083] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0084] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0085] This application provides a computer-readable storage medium having computer-readable program instructions (i.e., a computer program) stored thereon, which are used to execute the sensitive data dynamic desensitization method in the above embodiments.

[0086] The computer-readable storage medium provided in this application may be, for example, a USB flash drive, but is not limited to, electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. The program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination thereof.

[0087] The aforementioned computer-readable storage medium may be included in the sensitive data dynamic desensitization device; or it may exist independently and not be assembled into the sensitive data dynamic desensitization device.

[0088] The aforementioned computer-readable storage medium carries one or more programs, which, when executed by the sensitive data dynamic desensitization device, cause the sensitive data dynamic desensitization device to perform the aforementioned sensitive data dynamic desensitization method.

[0089] Computer program code for performing the operations of this application can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a Local Area Network (LAN) or a Wide Area Network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0090] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0091] The modules described in the embodiments of this application can be implemented in software or hardware. The names of the modules do not necessarily limit the functionality of the unit itself.

[0092] The readable storage medium provided in this application is a computer-readable storage medium that stores computer-readable program instructions (i.e., a computer program) for executing the above-described dynamic desensitization method for sensitive data, thereby solving the technical problem of low granularity in sensitive data desensitization. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided in this application are the same as those of the dynamic desensitization method for sensitive data provided in the above embodiments, and will not be repeated here.

[0093] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the above-described dynamic desensitization method for sensitive data.

[0094] The computer program product provided in this application can solve the technical problem of low granularity in sensitive data desensitization. Compared with the prior art, the beneficial effects of the computer program product provided in this application are the same as those of the sensitive data dynamic desensitization method provided in the above embodiments, and will not be repeated here.

[0095] All user-related data involved in this application was obtained with the user's permission or consent, as per [reference]. Figure 6 In other words, when this application is applied to a specific product or technology, user permission is required to acquire and process the relevant data, and the processing of the relevant data must comply with the relevant laws, regulations and regulatory standards of the relevant countries and regions.

[0096] The above description is only a part of the embodiments of this application and does not limit the scope of protection of this application. All equivalent structural transformations made under the technical concept of this application and using the contents of the specification and drawings of this application, or direct / indirect applications in other related technical fields, are included in the patent protection scope of this application.

Claims

1. A method for dynamically de-identifying sensitive data, characterized in that, The method includes: Obtain the user's SQL query requests and sensitive data whitelist; Based on the SQL query request, the sensitive data corresponding to the SQL query request is dynamically de-identified to obtain de-identified data; Based on the sensitive data whitelist, determine the whitelist fields for which the user has viewing permissions, and determine the target de-identified data corresponding to the whitelist fields from the de-identified data; The target de-identified data and the non-sensitive data corresponding to the SQL query request are displayed in plaintext.

2. The method as described in claim 1, characterized in that, The step of dynamically de-identifying the sensitive data corresponding to the SQL query request based on the SQL query request to obtain de-identified data includes: Based on the SQL query request, determine the sensitive data to be queried and the sensitive fields corresponding to the sensitive data; Based on the aforementioned sensitive fields, determine the data desensitization rules to be used when desensitizing each of the aforementioned sensitive data; Based on the data anonymization rules, the sensitive data is anonymized to obtain the anonymized data.

3. The method as described in claim 2, characterized in that, Data anonymization rules include full anonymization rules and non-full anonymization rules. The step of anonymizing the sensitive data based on the data anonymization rules to obtain the anonymized data includes: If the data desensitization rule is the full desensitization rule, then the full text of the sensitive data is desensitized to obtain the desensitized data; If the data desensitization rule is the non-full desensitization rule, then determine the plaintext retention bits corresponding to the non-full desensitization rule; Based on the number of plaintext bits to be retained, the data of the corresponding number of bits in the sensitive data is retained in plaintext, and the data in the sensitive data other than the plaintext-retained data is desensitized to obtain the desensitized data.

4. The method as described in claim 3, characterized in that, The step of determining the data desensitization rules used for desensitizing each sensitive data based on the sensitive field includes: Based on preset field data desensitization settings, the data desensitization rules used when desensitizing each of the sensitive data are determined, wherein the field data desensitization settings include the correspondence settings between each of the sensitive fields and the data desensitization rules; From the sensitive data, determine the function-sensitive data obtained after processing by the data processing function; The data desensitization rule corresponding to the function-sensitive data is determined as the full desensitization rule.

5. The method as described in claim 1, characterized in that, Before the step of determining the whitelist fields for which the user has viewing permissions based on the sensitive data whitelist, and determining the target de-identified data corresponding to the whitelist fields from the de-identified data, the method further includes: When a user requests permission to access sensitive fields, the sensitive fields corresponding to the sensitive data are determined. Obtain the target sensitive fields that the user needs to request to view, and the corresponding field permission period for each target sensitive field; Write the target sensitive field and the field permission period into the sensitive data whitelist.

6. The method as described in claim 1, characterized in that, After the step of dynamically de-identifying the sensitive data corresponding to the SQL query request based on the SQL query request to obtain the de-identified data, the method further includes: When a user's data processing operation is received for the sensitive data, the sensitive data to be processed is determined. Determine the derived data generated by data processing operations on the sensitive data to be processed, and mark the derived data as the sensitive data; The sensitive data whitelist is updated based on the derived data.

7. The method as described in claim 6, characterized in that, The step of updating the sensitive data whitelist based on the derived data includes: Based on the sensitive data whitelist, determine the target sensitive data that the user has been granted viewing permissions from the sensitive data to be processed; From the derived data, determine the target derived data generated by performing the data processing operation on the target sensitive data; Add the target derived data to the sensitive data whitelist and update the sensitive data whitelist.

8. A device for dynamically desensitizing sensitive data, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the sensitive data dynamic desensitization method as described in any one of claims 1 to 7.

9. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the sensitive data dynamic desensitization method as described in any one of claims 1 to 7.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the steps of the sensitive data dynamic desensitization method as described in any one of claims 1 to 7.

Images