Data protection method and apparatus, electronic device, and computer program product

Abstract

The present disclosure relates to and provides a data protection method and apparatus, an electronic device, and a computer program product. The method comprises: determining target data of a data access command in an abstract syntax tree of code. The method also comprises: on the basis of a data protection label of the target data, determining a data protection policy associated with the data protection label. The method further comprises: modifying the target data of the data access command in the abstract syntax tree on the basis of the data protection policy.

Description

Data protection methods, apparatus, electronic devices and computer program products Technical Field

[0001] This disclosure relates to the field of computer technology, and more specifically, to a data protection method, apparatus, electronic device, computer-readable storage medium, and computer program product. Background Technology

[0002] Logs help developers troubleshoot, trace, or locate problems. However, if developers accidentally print sensitive information in logs, it can pose security risks. Common methods to hide sensitive information include constant replacement, masking, or computed digests, protecting the actual data from being leaked.

[0003] Existing data protection schemes typically use regular expression matching to identify whether logs contain sensitive information. However, this method consumes significant computing resources and negatively impacts performance. Furthermore, sensitive data is diverse, and matching rules cannot fully cover all sensitive information, making it impossible to guarantee the discovery of all sensitive data. Summary of the Invention

[0004] In view of this, embodiments of this disclosure provide a novel data protection scheme. Generally, this technical solution assigns tags to target data requiring protection, where each tag is associated with a corresponding data protection policy. Before code execution, the target data within the code is identified, and the corresponding data protection policy is applied to the target data, thereby achieving effective data anonymization.

[0005] According to a first aspect of this disclosure, a data protection method is provided. The method includes: determining target data of a data access command in an abstract syntax tree of code; determining a data protection policy associated with the data protection label based on the target data; and modifying the target data in the abstract syntax tree based on the data protection policy.

[0006] According to a second aspect of this disclosure, a data protection apparatus is provided. The apparatus includes: a determining unit configured to determine target data of a data access command in an abstract syntax tree of code; a protection policy determining unit configured to determine a data protection policy associated with a data protection label based on a data protection label of the target data; and a modifying unit configured to modify the target data in the abstract syntax tree based on the data protection policy.

[0007] According to a third aspect of this disclosure, an electronic device is provided, comprising: at least one processing unit; at least one memory coupled to the at least one processing unit and storing instructions for execution by the at least one processing unit, the instructions, when executed by the at least one processing unit, causing the computing device to perform the method as described in the first aspect of this disclosure.

[0008] According to a fourth aspect of this disclosure, a non-transient computer storage medium is provided, including machine-executable instructions that, when executed by a device, cause the device to perform the method as described in the first aspect of this disclosure.

[0009] According to a fifth aspect of this disclosure, a computer program product is provided, including machine-executable instructions that, when executed by a device, cause the device to perform the method as described in the first aspect of this disclosure.

[0010] It should be understood that the summary section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0011] The above and other objects, features, and advantages of embodiments of the present disclosure will become more readily understood from the following detailed description with reference to the accompanying drawings. In the drawings, several embodiments of the present disclosure will be described by way of example and non-limitation, wherein:

[0012] Figure 1 shows a schematic diagram of an example environment in which embodiments of the present disclosure may be implemented;

[0013] Figure 2 shows a schematic flowchart of a data protection method according to an embodiment of the present disclosure;

[0014] Figure 3 shows a schematic flowchart of the process of obtaining a data protection tag according to an embodiment of the present disclosure;

[0015] Figure 4 illustrates a schematic diagram of an exemplary implementation of a data protection system according to an embodiment of the present disclosure;

[0016] Figure 5 shows a block diagram of a data protection device according to an embodiment of the present disclosure; and

[0017] Figure 6 shows a block diagram of an electronic device according to an embodiment of the present disclosure.

[0018] In all the accompanying figures, the same or similar reference numerals denote the same or similar elements. Detailed Implementation

[0019] This disclosure will now be discussed with reference to several example implementations. It should be understood that these implementations are discussed only to enable those skilled in the art to better understand and thus implement this disclosure, and not to imply any limitation on the scope of this disclosure.

[0020] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0021] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require the acquisition and use of the user's personal information. This allows the user to independently choose whether to provide personal information to the software or hardware, such as the electronic device, application, server, or storage medium performing the operations of this disclosed technical solution, based on the prompt message.

[0022] As an optional but non-limiting implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide personal information to the electronic device.

[0023] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0024] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0025] In the description of embodiments of this disclosure, the term "comprising" and similar terms should be understood as open-ended inclusion, i.e., "including but not limited to". The term "based on" should be understood as "at least partially based on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The terms "first", "second", etc., may refer to different or the same objects unless explicitly stated. Other explicit and implicit definitions may also be included below.

[0026] Existing data masking solutions typically employ post-event detection: for example, after logs are printed, they are sent to a server or local software development kit (SDK) for detection. If sensitive information is detected in the logs, data protection is implemented, such as masking or replacing it with data containing no actual information. However, detection capabilities are generally based on regular expression matching, which has a certain impact on performance, especially in the case of local SDK detection, which runs alongside business applications, causing performance degradation in those applications. Furthermore, this data masking solution requires various rules for each type of sensitive information, which is exhaustive and may lead to omissions, resulting in potential security risks.

[0027] In view of this, embodiments of this disclosure provide a data protection scheme based on tags in code. According to some embodiments of this disclosure, sensitive information that needs to be protected in the code is pre-tagged and an associated data protection strategy (de-identification algorithm) is configured. Before the code runs, sensitive information in the code is identified, the corresponding data protection strategy is applied to the sensitive information, and the code is modified into a de-identified version, thereby achieving effective data de-identification.

[0028] Figure 1 illustrates a schematic diagram of an example environment 100 that can be implemented according to embodiments of the present disclosure. Environment 100 includes a computing device 110 and a database 150. The computing device 110 can be any electronic device capable of providing a program development environment (e.g., an integrated development environment IDE), such as a server, desktop computer, laptop computer, tablet computer, mobile phone, or other device. The database 150 can include data that may be accessed by the computing device 110, including sensitive and non-sensitive information. For information security reasons, sensitive information is not allowed to be provided to the computing device 110 as is. The computing device 110 can issue a data access request 160 to the database 150 to access sensitive information. In response, the database 150 provides the computing device 110 with protected data 170, such as masked or replaced data that does not contain sensitive information.

[0029] As shown in the figure, computing device 110 includes business logic code 120 (hereinafter referred to as "code" or "source code") written by developers or obtained through other means. Business logic code 120 may include access requests for sensitive information in database 150. Computing device 110 also includes or has installed data protection tool 130 for implementing data protection policies for the sensitive information to ensure that the sensitive information is not provided to computing device 110, resulting in data leakage. Data protection tool 130 can modify the access requests for sensitive information in business logic code 120 to replace the original access requests, wherein the modified data access requests can be considered as de-identified versions of the original access requests, ensuring that the sensitive information is not obtained by computing device 110.

[0030] It should be noted that the environment 100 shown in Figure 1 is merely exemplary, and the embodiments of this disclosure can also be implemented in different environments. For example, the database 150 can be omitted, and the computing device 110 can implement data protection locally so that sensitive information is not stored, printed, or presented locally.

[0031] As mentioned above, the key to data anonymization lies in the identification of sensitive information. The embodiments of this disclosure assign data protection tags (hereinafter referred to as "tags") to sensitive information, replacing the traditional rule-based (e.g., regular expression matching) identification method. Simply put, tags are used to identify all sensitive information, and then corresponding anonymization rules are assigned based on the tag information. It should be noted that, unless otherwise specified, the programming technical details in this disclosure use Golang as an example; however, the various techniques involved (such as reflection, type inference, static code analysis, etc.) have alternatives in other programming languages ​​(such as Java).

[0032] Here is an example of a label set for sensitive information in the code:

[0033] In the code above, var1 is a sensitive information field. It is labeled with the tag "phone," thus identifying it as a sensitive information field of type XX. In some embodiments, configuration of data protection policies (also known as de-identification policies) is also provided for the XX type tags, as shown below:

[0034] This configuration indicates two pieces of information: protection level and protection policy (maskFunction). The protection level indicates the level of de-identification for sensitive information (var1) associated with the tag (XX). The protection policy indicates the de-identification method used. For example, if hash_SHA-256 is pre-configured, this de-identification function will be executed during the de-identification process. Each sensitive information type or tag can be configured with one or more protection policies. In some implementations, if maskFunction is not configured, the default protection policy can be executed based on the protection level. In some implementations, if more than one protection policy is configured, a protection policy can be selected based on the category of the information to be de-identified. The tags set for sensitive information and the associated data protection policies can be stored as metadata information.

[0035] After labeling sensitive information in the code and configuring associated data protection policies, data protection for sensitive information is achieved through a process of automated code security hardening (e.g., method 200 in Figure 2).

[0036] Figure 2 shows a schematic flowchart of a data protection method 200 according to an embodiment of the present disclosure. In some embodiments, method 200 may be implemented by, for example, the data protection tool 130 shown in Figure 1. It should be understood that method 200 may also include additional actions not shown and / or actions shown may be omitted, and the scope of the present disclosure is not limited in this respect.

[0037] Method 200 can be executed before the code is actually run, for example, during the pre-coding or build phase. For instance, if the data protection tool 130 is implemented as a plugin for an integrated development environment (IDE), method 200 can be executed automatically in response to the code being saved and the abstract syntax tree (AST) of the code being generated. Alternatively or additionally, method 200 can be executed during the build phase after the code has been written. In this paper, method 200 can also be used for code hardening.

[0038] In box 210, method 200 may include: determining the target data of a data access command in the abstract syntax tree of the code. In some embodiments, the data access command may be a restricted access command, such as a command to print the target data, a command to store the target data, or a command to request the target data. The target data may include sensitive information (the two are used interchangeably herein).

[0039] In some embodiments, the target data may include variables (also referred to as "fields") defined in a struct. As mentioned above, the target data may be pre-labeled with appropriate data protection tags; for example, tags may be included in the struct information regarding the variable (in Go, this is called a "tag," or in Java, an "annotation").

[0040] In box 220, based on the data protection label of the target data, a data protection policy associated with the data protection label is determined. In some embodiments, the data protection policy can be obtained based on the type inference capabilities and reflection mechanisms of a programming language.

[0041] Figure 3 illustrates a schematic flowchart of a process 300 for obtaining a data protection tag according to an embodiment of the present disclosure. At block 310, information about the corresponding structure is obtained by performing type inference on the target data. For example, type inference can be performed using a static code review tool that supports type inference capabilities for static code analysis. Information about the structure of the target data can be obtained by traversing the abstract syntax tree of the code. Then, at block 320, based on the structure information, the data protection tag for the target data is obtained via reflection.

[0042] As an example, the location of a variable can be found in the log printout of the abstract syntax tree. Then, type inference can be performed to find the corresponding structure information. Reflection can then be used to obtain the label of the field corresponding to this variable (e.g., mask:"XX" in the code example above). The label is configured with an associated data protection policy, so the data protection policy for this field can be determined by identifying the label, including whether the data is sensitive information or its sensitivity level, and the corresponding one or more desensitization functions (e.g., hash_SHA-256 in the code example above). Labels and associated data protection policies can be collectively referred to as metadata and stored in a metadata database.

[0043] Returning to Figure 2, in box 230, the target data of the data access command in the abstract syntax tree is modified based on the data protection policy. In some embodiments, when the data protection policy indicates a function for hiding data, this function can be used to replace the target data in the abstract syntax tree. For example, for the log printing command log.Info("the var1 is %d",Example.var1), where var1 is the target data to be hidden, this command can be modified to log.Info("the var1 is %d",hash_SHA-256(Example.var1)), so that the log printing result is the hash value of variable var1, thereby achieving data anonymization.

[0044] In some embodiments, a tag may have more than one data protection strategy, for example, multiple de-identification functions are configured in the metadata. In this case, one of the data protection strategies can be selected to apply to the target data. In some embodiments, a suitable data protection strategy can be selected based on the category information of the target data (numeric, character, or a combination thereof). A data protection strategy can also be selected based on the length or other characteristics of the target data.

[0045] One consideration when choosing a data protection strategy is to both hide sensitive information in the target data and provide some useful information to pinpoint the problem. For example, if comparing whether two sets of target data are the same, a hash function can be used for data protection, rather than masking. Furthermore, masking is beneficial for target data with a high level of protection, preventing sensitive information from being reverse-engineered.

[0046] Figure 4 illustrates a schematic diagram of an exemplary implementation of a data protection system 400 according to an embodiment of the present disclosure. In the data protection system 400, a computing device 410 is an exemplary implementation of the device 110 shown in Figure 1. The computing device 410 is coupled to a metadata system 450, wherein the metadata system 450 provides metadata information for implementing data protection.

[0047] As shown in the figure, computing device 410 includes business logic code 420 and implicit code replacement component 430. Implicit code replacement component 430 can be an exemplary implementation of the data protection tool 130 of Figure 1, used to replace the target data to be protected in the business logic code with other content. For example, implicit code replacement component 430 can replace the target data in the abstract syntax data of code 420 with encrypted or hidden data without the user's awareness, using the method described with reference to Figure 2.

[0048] The metadata system 450 includes a management console 452, a metadata service 454, and a metadata database 456. The management console 452 provides an interface accessed by the implicit code replacement component 430. The metadata service 454 is responsible for handling metadata-related transactions. The metadata database 456 stores configurations of data protection policies associated with tags.

[0049] For example, in response to the execution of the implicit code replacement component 430, the implicit code replacement component 430 can first query locally whether the metadata of the target data exists. If not, it can send a request to the management console 452 to retrieve the metadata, carrying the tags obtained through type inference and reflection mechanisms. The management console 452 can then pass the request to the metadata service 454, which in turn retrieves the de-identification strategy associated with the tag from the metadata database 456. Afterwards, the metadata system 450 transmits the retrieved de-identification strategy to the computing device 410 so that the implicit code replacement component 430 can apply the corresponding strategy to the relevant target data in the business logic code. The metadata from the metadata database system 450 can be stored locally for later offline use.

[0050] As mentioned above, the data masking process can be performed during the pre-compilation or build phases, ensuring that data masking is actually completed before code execution. This avoids runtime sensitive data checks and improves code execution efficiency. Taking logging as an example, before code execution, an implicit code replacement component replaces the log code with a masked version. During code execution, the masked logs are obtained, and the execution results can be directly saved to the log library 460 for later use.

[0051] In some embodiments, the tags for the target data can be pre-annotated in the code. Tagging eliminates the most performance-intensive step, minimizing performance overhead during data anonymization. The following discussion focuses on how to tag sensitive information. Sensitive information is typically program input (e.g., front-end data entry or input from calls to other service interfaces), program output (e.g., stored in a storage system or sent to other services), or both. In other words, sensitive information may be widely present in code at various levels.

[0052] In some embodiments, the code can be divided into an interface layer, a service layer, and a storage layer, with the service layer located between the interface layer and the storage layer. The interface layer is responsible for interacting with external services or the front end. Requests or responses generally include combinations of fields, which may contain some sensitive information. The fields in the interface layer are relatively fixed, and these fields can be tagged to indicate the protection level of each information field. The information fields in the storage layer are also relatively fixed. For example, if the business uses MySQL, then the fields in MySQL are known, and the corresponding mapping structures in the code are also determined. The service layer includes intermediate structures or objects, which are more complex and flexible than those in the interface layer and storage layer.

[0053] In some embodiments, data protection tags can be applied to data associated with target data in the service layer code, based on interface layer code or service layer code that has been labeled with data protection tags. For example, after tagging the interface layer and service layer code, tags can be added to all information fields involved in the service layer along the request chain of the interface.

[0054] The embodiments of this disclosure have been described above with reference to Figures 1 to 4. In general, the embodiments of this disclosure achieve the separation of data protection and data usage. The target data to be protected is tagged, with each tag associated with a corresponding data protection policy. Before code execution, the target data in the code is identified, and the corresponding data protection policy is applied to the target data, achieving effective data desensitization. Furthermore, no additional desensitization operation is required when the code runs and accesses the target data. The proposed technical solution does not require calling the corresponding desensitization function at every location containing sensitive information. Instead, it identifies the corresponding metadata information at the definition of the sensitive information, enabling automated desensitization in all subsequent uses of this field, achieving "one tag, multiple uses." For existing code, data desensitization can also be achieved through automatic code replacement before code construction.

[0055] Figure 5 shows a schematic block diagram of an apparatus 500 for data protection according to an embodiment of the present disclosure. As shown in Figure 5, the apparatus 500 includes a target data determination unit 502, a protection policy determination unit 504, and a modification unit 506. The target data determination unit 502 is configured to determine target data for a data access command in an abstract syntax tree of code. The protection policy determination unit 504 is configured to determine a data protection policy associated with a data protection label based on the target data. The modification unit 506 is configured to modify the target data in the abstract syntax tree based on the data protection policy.

[0056] In some embodiments, the target data may include variables defined in a structure. The apparatus may further include: a type deduction unit configured to obtain information about the structure by performing type deduction on the variables; and a reflection unit configured to obtain the data protection tag of the target data by reflection based on the information about the structure.

[0057] In some embodiments, the data protection tag may be included in the annotation information about the variable in the information of the structure.

[0058] In some embodiments, the protection policy determination unit 504 may be configured to: obtain metadata corresponding to the data protection tag from a metadata database, the metadata indicating at least one data protection policy; and determine a data protection policy for the target data from the at least one data protection policy.

[0059] In some embodiments, the protection strategy determination unit 504 may be configured to select the data protection strategy based on the category information of the target data.

[0060] In some embodiments, metadata may indicate the protection level of the target data, which is associated with the at least one data protection policy.

[0061] In some embodiments, the data protection policy may instruct a function for hiding data.

[0062] In some embodiments, the modification unit may be configured to replace the target data with the function of the target data in the abstract syntax tree.

[0063] In some embodiments, the data protection label may be pre-annotated in the code.

[0064] In some embodiments, the code includes interface layer code or service layer code, and the apparatus 500 may further include a tagging unit configured to apply the data protection tag to data in the service layer code associated with the target data based on the interface layer code or service layer code with an labeled data protection tag.

[0065] In some embodiments, the data access command may be a restricted access command, which includes at least one of the following: a command to print the target data, a command to store the target data, or a command to request the target data.

[0066] It should be noted that further actions or steps shown in Figures 1 to 4 can be implemented using the device 500 shown in Figure 5. For example, device 500 may include more modules or units to implement the actions or steps described above, or some of the units or modules shown in Figure 5 may be further configured to implement the actions or steps described above. This will not be repeated here.

[0067] Figure 6 shows a schematic block diagram of an example device 600 that can be used to implement embodiments of the present disclosure. As shown, device 600 includes a computing unit 601, which can perform various appropriate actions and processes according to computer program instructions stored in read-only memory (ROM) 602 or loaded from storage unit 606 into random access memory (RAM) 603. Various programs and data required for the operation of device 600 may also be stored in RAM 603. The computing unit 601, ROM 602, and RAM 603 are interconnected via bus 604. Input / output (I / O) interface 605 is also connected to bus 604.

[0068] Multiple components in device 600 are connected to I / O interface 605, including: input unit 606, such as keyboard, mouse, etc.; output unit 607, such as various types of monitors, speakers, etc.; storage unit 608, such as disk, optical disk, etc.; and communication unit 609, such as network card, modem, wireless transceiver, etc. Communication unit 609 allows device 600 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0069] The computing unit 601 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. The computing unit 601 performs the various methods and processes described above, such as method 200. For example, in some embodiments, method 200 may be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 608. In some embodiments, part or all of the computer program may be loaded and / or installed on device 600 via ROM 602 and / or communication unit 609. When the computer program is loaded into RAM 603 and executed by the computing unit 601, one or more steps of method 200 described above may be performed. Alternatively, in other embodiments, the computing unit 601 may be configured to perform method 200 by any other suitable means (e.g., by means of firmware).

[0070] In some embodiments, the methods and processes described above can be implemented as a computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of this disclosure.

[0071] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example—but not limited to—electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination thereof. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0072] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper cables, fiber optic cables, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to computer-readable storage media within the respective computing / processing device.

[0073] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​and conventional procedural programming languages. The computer-readable program instructions may execute entirely on a user's computer, partially on a user's computer, as a standalone software package, partially on a user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0074] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processing unit of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner. Thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0075] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0076] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of devices, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0077] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or technical improvements to the technology in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A data protection method, comprising: Within the code's abstract syntax tree, the target data for data access commands is determined; Based on the data protection label of the target data, determine the data protection strategy associated with the data protection label; as well as Based on the data protection strategy, the target data is modified in the abstract syntax tree.

2. The method according to claim 2, wherein, The target data includes variables defined in a structure, and the method further includes: Information about the structure is obtained by performing type deduction on the variables; and Based on the information in the structure, the data protection tag of the target data is obtained through reflection.

3. The method according to claim 1, wherein, The data protection tag is included in the annotation information about the variable in the information of the structure.

4. The method according to claim 1, wherein, Determining the data protection policy associated with the data protection label includes: Retrieve metadata corresponding to the data protection tag from the metadata database, the metadata indicating at least one data protection policy; and A data protection strategy for the target data is determined from the at least one data protection strategy.

5. The method according to claim 4, wherein, Determining a data protection policy for the target data from the at least one data protection policy includes: The data protection strategy is selected based on the category information of the target data.

6. The method of claim 4, wherein the metadata indicates the protection level of the target data, the protection level being associated with the at least one data protection policy.

7. The method of claim 1, wherein the data protection strategy indicates a function for hiding data.

8. The method according to claim 7, wherein, Modifying the target data in the abstract syntax tree includes: In the abstract syntax tree, the target data is replaced by the function of the target data.

9. The method according to claim 1, wherein the method is executed during the pre-compilation phase or the build phase of the code.

10. The method according to claim 1, wherein, The data protection label is pre-marked in the code.

11. The method according to claim 1, wherein, The code includes interface layer code or service layer code, and the method further includes: Based on the interface layer code or service layer code with labeled data protection tags, the data protection tags are applied to the data associated with the target data in the service layer code.

12. The method according to claim 1, wherein, The data access command is a restricted access command, which includes at least one of the following: a command to print the target data, a command to store the target data, or a command to request the target data.

13. A data protection device, comprising: The target data determination unit is configured to determine the target data for data access commands within the abstract syntax tree of the code; The protection strategy determination unit is configured to determine a data protection strategy associated with the data protection tag based on the data protection tag of the target data; as well as The modification unit is configured to modify the target data in the abstract syntax tree based on the data protection policy.

14. An electronic device comprising: At least one processing unit; At least one memory is coupled to the at least one processing unit and stores instructions for execution by the at least one processing unit, the instructions, when executed by the at least one processing unit, causing the electronic device to perform the method as described in any one of claims 1 to 12.

15. A computer program product comprising machine-executable instructions that, when executed by a device, cause the device to perform the method as described in any one of claims 1 to 12.

Images