CN119089462A - A method, device and electronic device for processing sensitive information - Google Patents
A method, device and electronic device for processing sensitive information Download PDFInfo
- Publication number
- CN119089462A CN119089462A CN202411096967.4A CN202411096967A CN119089462A CN 119089462 A CN119089462 A CN 119089462A CN 202411096967 A CN202411096967 A CN 202411096967A CN 119089462 A CN119089462 A CN 119089462A
- Authority
- CN
- China
- Prior art keywords
- sensitive information
- piece
- information
- configuration
- encryption
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/602—Providing cryptographic facilities or services
-
- G—PHYSICS
- G06—COMPUTING OR CALCULATING; COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
- G06F21/6245—Protecting personal data, e.g. for financial or medical purposes
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Health & Medical Sciences (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Computer Hardware Design (AREA)
- Computer Security & Cryptography (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Databases & Information Systems (AREA)
- Medical Informatics (AREA)
- Storage Device Security (AREA)
Abstract
The present application relates to the field of micro-services, and in particular, to a method and an apparatus for processing sensitive information, and an electronic device. The method comprises the steps of collecting information configured by users with different configuration authorities for sensitive information, wherein the configured information comprises an encryption strategy configured by users with configuration strategy authorities for each piece of sensitive information and a numerical value configured by users with numerical value authorities for each piece of sensitive information, responding to an encryption instruction, and encrypting the numerical value of any piece of sensitive information by utilizing the encryption strategy of any piece of sensitive information for any piece of sensitive information to obtain ciphertext of any piece of sensitive information. By the method, the risk of sensitive information leakage can be effectively reduced.
Description
Technical Field
The present application relates to the field of micro-services, and in particular, to a method and an apparatus for processing sensitive information, and an electronic device.
Background
In the micro service architecture, the configuration center is responsible for storing and managing configuration information of each business service, where the configuration information may include sensitive data such as database passwords, keys of application program interfaces, third party service credentials, and the like. As users' demands for data security and privacy protection increase, protection of sensitive data in configuration centers becomes particularly important.
At present, an encryption scheme of a configuration center is to issue a secret key to a user side, and encrypt and decrypt sensitive data at the user side, and the encryption and decryption modes may enable various levels of related personnel such as research personnel, management personnel and the like at the user side to contact the sensitive information, so that the risk of leakage of the sensitive information is high.
Disclosure of Invention
The embodiment of the application provides a sensitive information processing method and device and electronic equipment, which can reduce the risk of sensitive information leakage.
In a first aspect, an embodiment of the present application provides a method for processing sensitive information, where the method includes:
Acquiring information configured by users with different configuration authorities for sensitive information, wherein the configured information comprises an encryption strategy configured by the users with strategy authority for each piece of sensitive information and a numerical value configured by the users with numerical value authority for each piece of sensitive information;
and responding to the encryption instruction, and encrypting the numerical value of any piece of sensitive information by utilizing the encryption strategy of any piece of sensitive information aiming at any piece of sensitive information to obtain the ciphertext of any piece of sensitive information.
In a possible implementation manner, the configured information further includes an application identifier configured by a user of the configuration identification authority or a user of the configuration policy authority for a target application program, where in a process of running the target application program, a value of the sensitive information is needed;
After the ciphertext of any piece of sensitive information is obtained, the method further comprises the following steps:
and generating a target configuration file corresponding to the application identifier.
In a possible implementation manner, the configured information further includes a decryption policy configured by a user configuring policy rights for each piece of sensitive information;
The generating the target configuration file corresponding to the application identifier includes:
and generating a target configuration file with a file name of the application identifier based on the ciphertext of each piece of sensitive information obtained by encryption and the decryption strategy of each piece of sensitive information.
In one possible implementation manner, after the generating the target configuration file with the file name identified by the application, the method further includes:
Responding to a decryption instruction, determining the identification of a target application program contained in the decryption instruction, and inquiring a target configuration file matched with the identification;
determining ciphertext of any piece of sensitive information in the target configuration file and a decryption strategy corresponding to the ciphertext of any piece of sensitive information according to any piece of sensitive information;
and decrypting the ciphertext of any piece of sensitive information by using the decryption strategy of any piece of sensitive information to obtain the numerical value of any piece of sensitive information.
In one possible embodiment, the method further comprises:
And feeding back the numerical value of each piece of sensitive information obtained through decryption to a target application program, so that equipment where the target application program is located can complete the function of the target application program according to the numerical value of each piece of sensitive information.
In one possible implementation, the responding to the decryption instruction includes:
and responding to a decryption instruction triggered by receiving a decryption request sent by the target application program.
In a possible implementation manner, the configured information further comprises a name configured by a user configuring name authority or a user configuring policy authority for each piece of sensitive information;
before the encryption strategy for encrypting the numerical value of any piece of sensitive information by using any piece of sensitive information, the method further comprises the following steps:
and inputting the numerical value of any piece of sensitive information to a position corresponding to the name of any piece of sensitive information on a display interface.
In a second aspect, an embodiment of the present application provides a device for processing sensitive information, where the device includes:
the system comprises an acquisition module, a storage module and a storage module, wherein the acquisition module is used for acquiring information configured by users with different configuration authorities for sensitive information, the configured information comprises an encryption strategy configured by the users with configuration strategy authorities for each piece of sensitive information, and a numerical value configured by the users with configuration numerical value authorities for each piece of sensitive information;
The encryption module is used for responding to the encryption instruction, encrypting the numerical value of any piece of sensitive information by utilizing the encryption strategy of any piece of sensitive information aiming at any piece of sensitive information, and obtaining the ciphertext of any piece of sensitive information.
In a third aspect, an embodiment of the present application provides an electronic device, including:
the system comprises at least one processor, and a memory communicatively coupled to the at least one processor, wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method as in the first aspect described above.
In a fourth aspect, embodiments of the present application provide a computer program product for causing a computer to perform the method of the first aspect described above.
In a fifth aspect, an embodiment of the present application provides a computer storage medium storing a computer program for causing a computer to execute the method in the first aspect.
The embodiment of the application provides a processing method of sensitive information, which expands the functions of a configuration center, so that the configuration center can allocate different configuration authorities for the sensitive information to users with different roles, further, the numerical value of the sensitive information is only known by the users with the configuration numerical value authorities, the risk of sensitive information leakage is effectively reduced, and encryption and decryption processes are executed in the configuration center instead of a user side, so that the encryption and decryption decoupling of a user side integrated system is completed, and the safety of the sensitive information can be further ensured.
Drawings
Fig. 1 is an application scenario schematic diagram of a processing method of sensitive information provided in an embodiment of the present application;
FIG. 2 is a flow chart of a method for processing sensitive information according to an embodiment of the present application;
FIG. 3 is a schematic flow chart of a configuration method according to an embodiment of the present application;
Fig. 4 is a schematic flow chart of a decryption method according to an embodiment of the present application;
FIG. 5 is a schematic diagram of a device for processing sensitive information according to an embodiment of the present application;
fig. 6 is a schematic diagram of an electronic device according to an embodiment of the present application.
Detailed Description
For the purpose of making the objects, technical solutions and advantages of the present application more apparent, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present application, and it is apparent that the described embodiments are only some embodiments of the present application, not all embodiments of the present application. All other embodiments, which can be made by those skilled in the art based on the embodiments of the application without making any inventive effort, are intended to be within the scope of the application. Embodiments of the application and features of the embodiments may be combined with one another arbitrarily without conflict. Also, while a logical order of illustration is depicted in the flowchart, in some cases the steps shown or described may be performed in a different order than presented.
The data acquisition, storage, use, processing and the like in the embodiment of the application all meet the relevant regulations of national laws and regulations.
First, some concepts related to the embodiments of the present application will be described.
Micro service is composed of single application program, which has its own journey and light weight treatment, and the service is deployed in full-automatic mode according to service function design, and communicates with other service using application program interface of application layer protocol. While services may use minimal scale centralized management (e.g., docker) capabilities, services may be implemented in different programming languages and databases, etc.
The configuration center is arranged in the micro-service system and is used for distributing authorities to all levels of users, then collecting information configured by each user aiming at the sensitive information and correspondingly processing the sensitive information based on the configured information.
The sensitive information, which is the information with higher importance to the user, can be the sensitive information, such as the password of the database, the mobile phone number of the user, the ID card number, etc., and the embodiment of the application does not limit the type of the sensitive information specifically.
The application program is deployed at the user end and is used for completing specific functions, such as the function of the target application program for completing access to the service node 1 when the micro-service system access is performed. In an embodiment of the application, the application is built based on at least one software package.
Service node in the embodiment of the application, the service node can be a Pod, wherein the Pod is the smallest resource management component in K8s, and the Pod is the resource object for minimizing running containerized application. One Pod represents one process running in the cluster. Most of the other components in K8s are supported around Pod and extend Pod functionality.
Encryption component policy is self-developed, namely the encryption policy provided by the existing configuration center. The self-research encryption component technology is a technology for uniformly decrypting ciphertext in a loaded file at the initial stage of system start. Based on the basic loading sequence of the using framework, the method is realized by the research and development personnel in a personalized way according to specific requirements. The technology has the advantages of high flexibility, and customized encryption processing can be performed according to different application scenes and security requirements, namely different secret keys can be provided for different applications, so that unauthorized access or tampering of data can be prevented. While custom encryption techniques can reduce the visibility of the password, lack of authorization and management of the key means that an attacker may acquire the key and attempt to crack the password by analyzing the normal class loading operations of the system.
Jasypt encryption policies-encryption policies provided by existing configuration centers. Jasypt the encryption strategy is excellent in handling encryption and decryption operations in Java applications, and is particularly applicable to scenarios where data security needs to be maintained in these operations. In some applications, the integration process of Jasypt is relatively simple, which allows the developer to more easily apply it to the project. Jasypt support a variety of fixed encryption policies, which means that the developer can choose the most appropriate policy according to his own needs. This flexibility makes Jasypt a very practical tool because it can accommodate a variety of different encryption requirements. One potential problem with Jasypt is the configuration of the key, which is typically hard coded in the code, or in a configuration file, jasypt, lacking authorization management for the key, i.e., the key is vulnerable to compromise. In addition, jasypt has the following problems:
In configuring Jasypt, parameters such as encryption keys and algorithms need to be set correctly, which may increase complexity of configuration, jasypt uses encryption algorithm (PBEWithMD 5 AndDES) by default, which may not meet security requirements of all scenes, and if a higher-level encryption algorithm is needed, a custom encryptor may be needed, and when Jasypt is used, version compatibility problem needs to be paid attention to, different bugs or characteristics may exist in Jasypt of different versions, which may affect stability and security of an application program.
The following describes a method for processing sensitive information in an embodiment of the present application in detail with reference to the accompanying drawings.
Fig. 1 shows an application scenario of a processing method of sensitive information, where the application scenario includes a micro service system 101 and at least one user side (user side 102_1, user side 102_2, user side 102_n in the example in the figure). The micro service system 101 includes a control node 101_1, at least one service node (service node 1, service node 2, service node 3, and the like illustrated in the figure), and a configuration center 101_2.
The service node in the micro service system is configured to provide various business services to at least one user terminal outside the micro service system 101, where the service node may be Pod, and the Pod may be formed by one container or multiple containers. The control node 101_1 is used for managing various nodes in the micro-service system, and the configuration center 101_2 is used for realizing the processing method of the sensitive information provided by the embodiment of the application.
The control node 101_1 and the configuration center 101_2 may be independent physical servers, or may be a server cluster or a distributed system formed by a plurality of physical servers, or may be a cloud server that provides cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content distribution network (Content DeliveryNetwork, CDN), and basic cloud computing services such as big data and an artificial intelligence platform.
Based on the problem that sensitive information is easy to leak in a micro-service scene in the prior art, the embodiment of the application provides a method for processing sensitive information, which is applied to a configuration center, as shown in fig. 2, and comprises the following steps:
S201, information configured by users with different configuration authorities for sensitive information is collected, wherein the configured information comprises encryption strategies configured by users with strategy authority for each piece of sensitive information, and values configured by users with value authority for each piece of sensitive information.
In order to avoid that the multi-level related personnel obtain specific values of the sensitive information, the embodiment of the application expands the authority allocation function for the configuration center, namely, different configuration authorities for the sensitive information are allocated for users with different levels, namely, the users with different configuration authorities can configure different information for the sensitive information, and the allocation authorities of the configuration center can be specifically divided into the following cases.
(1) A user configuring policy rights and a user configuring numerical rights.
For sensitive information, the specific value has higher importance, and in order to avoid leakage, special personnel are needed to configure and manage (such as an administrator), for example, the passwords of the database are "123456@and" 123456@are the values of the passwords of the sensitive information "database", so that a user configuring the value authority configures the value for each piece of sensitive information only, and the name of each piece of sensitive information, the application identifier of the target application program and the encryption policy and decryption policy of each piece of sensitive information can be configured by the user configuring the policy authority. The configuration process can be performed on a display interface.
When a user wants to access the micro service system, the target application program can be accessed, and in the running process of the target application program, different application programs needing sensitive information have different functions. For example, when a user wants to access the service node 1, the user needs to implement the function of accessing the service node 1 through the target application, and in the process that the target application implements the function of accessing the service node 1, sensitive information "the address of the service node 1" is needed.
In one possible implementation, the process of configuring information for sensitive information by a user is as follows:
Firstly, a user configuring policy authority configures the name of each piece of sensitive information, the encryption policy and decryption policy of each piece of sensitive information and the application identifier of a target application program, and then a user configuring numerical value authority configures numerical value for each piece of sensitive information.
For example, the name of the user configuring policy authority is "address of service node 1", encryption/decryption policy is "national encryption algorithm", application identifier of target application is "APP1", and the user configuring numerical authority configures numerical value as "xxx.xxx" for the sensitive information "address of service node 1". The configuration center can expand various encryption/decryption strategies, and a user with the strategy authority can select the required encryption/decryption strategy on the display interface.
(2) A user configuring policy rights, a user configuring identification rights, a user configuring numerical rights, and a user configuring name rights.
In the embodiment of the application, different kinds of information can be respectively configured by users with different configuration authorities, for example, an encryption strategy and a decryption strategy configured by users with configuration strategy authorities for each piece of sensitive information, a numerical value configured by users with configuration numerical value authorities for each piece of sensitive information, an application identifier configured by users with configuration identification authorities for a target application program, and a name configured by users with configuration name authorities or users with configuration strategy authorities for each piece of sensitive information.
In one possible implementation, the process of configuring information for sensitive information by a user is as follows:
firstly, a user configuring policy authority configures the name of each piece of sensitive information, a user configuring policy authority configures the encryption policy and decryption policy of each piece of sensitive information, a user configuring identification authority configures the application identification of a target application program, and then a user configuring numerical value authority configures numerical value for each piece of sensitive information.
For example, the name of the user configured sensitive information of the name authority is "address of service node 1", the user configured encryption/decryption policy of the policy authority is "national encryption algorithm", the application identifier of the target application program configured by the user configured with the identification authority is "APP1", and then the user configured with the numerical authority configures the numerical value as "xxx. The configuration center can expand various types of encryption/decryption policies, and a user with configuration policy authority can select a required encryption/decryption policy on a display interface.
In addition, when the user configuring the numerical value authority configures the numerical value for each piece of sensitive information, the numerical value of any piece of sensitive information can be input to the position corresponding to the name of any piece of sensitive information on the display interface. That is, a user configuring numerical rights may view information configured by other users on the display interface. Furthermore, the authority for modifying the information can be provided for the user configuring the numerical authority, if the user configuring the numerical authority considers that the encryption/decryption strategy configured before is unreasonable, the encryption/decryption strategy can be reselected, and then the configuration center performs encryption/decryption operation on the data of the sensitive information according to the encryption/decryption strategy reselected by the user configuring the numerical authority.
S202, responding to an encryption instruction, and encrypting the numerical value of any piece of sensitive information by utilizing an encryption strategy of any piece of sensitive information aiming at any piece of sensitive information to obtain the ciphertext of any piece of sensitive information.
After users with different configuration authorities complete information configuration aiming at sensitive information, encryption and decryption processes can be implemented in a configuration center, and the method can be concretely implemented as follows:
(1) Encryption.
After the user configuring the numerical rights finishes configuring the numerical value for each piece of sensitive information, a 'submit' or 'finish' button can be clicked on a display interface, or an encryption instruction is triggered in a voice mode, so that a configuration center can encrypt the numerical value of any piece of sensitive information by utilizing an encryption strategy of any piece of sensitive information to obtain a ciphertext of any piece of sensitive information, and the embodiment of the application does not limit the specific mode for responding to the encryption instruction.
After the ciphertext of each sensitive information is obtained, a target configuration file with a file name of an application identifier is further generated based on a decryption strategy of each sensitive information, so that the decryption process is conveniently executed in a configuration center. The target profile may be as shown in table 1 below.
TABLE 1
(2) Decrypting.
The decryption process is started when the configuration center responds to a decryption instruction, wherein the decryption instruction can be triggered by receiving a decryption request sent by the target application program. Since the value of the sensitive information needs to be used when the target application program runs, if the value of the sensitive information is encrypted, the decryption needs to be performed to the configuration center. The specific process is as follows:
Firstly, user equipment accesses a micro-service system by running a target application program, the value of sensitive information is needed in the process of running the target application program, when the value encryption of the sensitive information is determined, a request for inquiring a configuration file is sent to a configuration center, the request carries an application identifier of the target application program, such as APP1, the configuration center inquires a matched target configuration file according to the APP1, then the configuration center decrypts ciphertext of the corresponding sensitive information by utilizing a decryption strategy in the target configuration file to obtain the value of the sensitive information, which can also be called plaintext, and finally the decrypted value of each sensitive information is fed back to the target application program, so that equipment where the target application program is located can complete the function of the target application program according to the value of each sensitive information.
In one possible implementation manner, when configuring the sensitive information, for some unimportant sensitive information, an encryption policy may not be configured, and then the piece of sensitive information exists in a plaintext form in a configuration file of the configuration center, that is, the configuration file contains ciphertext and plaintext, and when decrypting, only the ciphertext is decrypted, and then the encrypted plaintext and the original plaintext are fed back to the user side together. Although the sensitive information is not encrypted, the plaintext of the sensitive information is stored in the configuration center, not at the client, and the security of the sensitive information can be ensured.
A detailed description of a flow of configuring information of sensitive information according to an embodiment of the present application is provided below based on fig. 3.
The method comprises the steps of applying a configuration strategy authority to a configuration center of a micro-service system by a developer through a user side, distributing the configuration strategy authority to the developer after the configuration center receives a request of the developer, configuring an encryption strategy, a decryption strategy and a name of each piece of sensitive information and an application identifier of a target application program on a display interface of the user side after the developer obtains the authority, and submitting the encryption strategy, the decryption strategy and the name to the configuration center, wherein the sensitive information is needed in the running process of the target application program, and the configuration center stores the information configured by the developer after receiving the information configured by the developer for subsequent use.
After the configuration of the research personnel is confirmed, the administrator applies for configuration numerical value authority to the configuration center through the user side, the configuration center distributes configuration numerical value authority to the administrator after receiving the request, and feeds back the encryption strategy, decryption strategy and name of each piece of sensitive information configured by the research personnel and the application identifier of the target application program to the user side, the administrator inputs corresponding numerical values at the positions corresponding to the names of each piece of sensitive information on the display interface and submits the corresponding numerical values to the configuration center, the configuration center encrypts the numerical values of the sensitive information configured by the administrator by utilizing the encryption strategy configured by the research personnel to obtain ciphertext of each piece of sensitive information, and then generates and stores a target configuration file with the file name of the application identifier based on the decryption strategy and the ciphertext so as to execute the subsequent decryption flow.
The administrator applies for the configuration numerical rights to the configuration center, which can be applied simultaneously with the developer, or after the developer applies for the configuration policy rights or after the configuration is completed, the embodiment of the application is not particularly limited. The above embodiment provides only two levels of information implementation manners for configuring the sensitive information by the user, and in addition, four levels of users may apply for configuration rights, which is not limited in detail.
A decryption flow according to an embodiment of the present application will be described in detail below based on fig. 4.
The method comprises the steps that a user side sends a query request to a configuration center through a target application program, wherein the query request carries an application identifier of the target application program, the configuration center queries a target configuration file matched with the application identifier of the target application program after receiving the request, decrypts ciphertext of sensitive information by using a decryption strategy of the target configuration file to obtain values of the sensitive information, feeds the values of the sensitive information back to the user side, and the user side completes corresponding functions by using the values of the sensitive information through the target application program after receiving the values of the sensitive information.
The embodiment of the application provides a processing method of sensitive information, which is applied to a configuration center, and by expanding the functions of the configuration center, the configuration center can allocate different configuration authorities for users with different levels:
The research personnel creates relevant configuration information corresponding to own service on a console interface of the configuration center, and initializes the needed sensitive information respectively. The developer can configure the name of the sensitive information, the encryption strategy, the decryption strategy and the application identification of the target application program. After submission, these configurations will await an audit by the administrator. During the configuration process, the developer needs to log into the console interface of the configuration center, and they will see a series of available configuration options and tools, so that they can easily create and manage configuration information related to their own services. To further protect the security of sensitive information, developers can choose the encryption strategy required by the system. This may involve encrypting the sensitive information using an encryption algorithm to prevent unauthorized access or tampering, the choice of encryption policy depending on the security requirements of the organization and the specific needs of the system.
After the administrator successfully logs in the configuration center, the administrator has the authority to configure values for the sensitive information and the authority to audit the information configured by the research and development personnel. The administrator may fill in the values of the sensitive information. When filling out the sensitive information, plain text information, i.e., original text that has not undergone any encryption processing, is input. Such plaintext information may contain important data such as passwords, keys, or other confidential information. After the administrator completes filling in the sensitive information and clicks the submit button, the configuration center encrypts the plaintext information according to the encryption policy configured before. The encryption process uses advanced encryption algorithms to convert plaintext information into ciphertext that is difficult to crack, thereby protecting sensitive information from access or tampering by unauthorized persons. Once the sensitive information is encrypted, it is only possible to view the encrypted sensitive information at the configuration center. Such encryption information may be used as needed, but the original plaintext content cannot be directly obtained. The 'split-right' mechanism ensures the security of sensitive information in the transmission and storage processes, and reduces the risk of data leakage.
After logging in the configuration center, the administrator can also audit the configuration submitted by the researchers and fill in and modify the encryption strategy for the sensitive information in the configuration. In this way, sensitive information is effectively protected, and the developer can access and use the encrypted sensitive information when needed.
Based on the same inventive concept, the embodiment of the application also provides a sensitive information processing device, as shown in fig. 5, which comprises:
the collection module 501 is configured to collect information configured by users with different configuration authorities for sensitive information, where the configured information includes an encryption policy configured by a user with configuration policy authorities for each piece of sensitive information, and a numerical value configured by a user with configuration numerical value authorities for each piece of sensitive information;
the encryption module 502 is configured to respond to an encryption instruction, encrypt, for any piece of sensitive information, a value of the any piece of sensitive information by using an encryption policy of the any piece of sensitive information, and obtain a ciphertext of the any piece of sensitive information.
In a possible implementation manner, the configured information further includes an application identifier configured by a user of the configuration identification authority or a user of the configuration policy authority for a target application program, where in a process of running the target application program, a value of the sensitive information is needed;
The device also comprises a generation module for generating a target configuration file corresponding to the application identifier.
In a possible implementation manner, the configured information further comprises a decryption policy configured by a user configuring policy rights for each piece of sensitive information;
The generation module is used for generating a target configuration file with a file name of the application identifier based on the ciphertext of each piece of sensitive information obtained by encryption and the decryption strategy of each piece of sensitive information.
In a possible embodiment, the apparatus further comprises a decryption module for:
The method comprises the steps of responding to a decryption instruction, determining an identification of a target application program contained in the decryption instruction, inquiring a target configuration file matched with the identification, determining a ciphertext of any one piece of sensitive information in the target configuration file and a decryption strategy corresponding to the ciphertext of any one piece of sensitive information aiming at any one piece of sensitive information, and decrypting the ciphertext of any one piece of sensitive information by utilizing the decryption strategy of any one piece of sensitive information to obtain a numerical value of any one piece of sensitive information.
In one possible implementation, the decryption module is configured to:
And feeding back the numerical value of each piece of sensitive information obtained through decryption to a target application program, so that equipment where the target application program is located can complete the function of the target application program according to the numerical value of each piece of sensitive information.
In one possible implementation, the decryption module is configured to:
and responding to a decryption instruction triggered by receiving a decryption request sent by the target application program.
In a possible implementation manner, the configured information further comprises a name configured by a user configuring name authority or a user configuring policy authority for each piece of sensitive information;
the device also comprises an input module which is used for inputting the numerical value of any piece of sensitive information to the position corresponding to the name of any piece of sensitive information on the display interface.
Based on the same inventive concept, the embodiment of the application also provides an electronic device, which comprises:
The system comprises at least one processor, and a memory communicatively coupled to the at least one processor, wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform a method of processing sensitive information as described above.
An electronic device 60 according to this embodiment of the application is described below with reference to fig. 6. The electronic device 60 shown in fig. 6 is merely an example and should not be construed as limiting the functionality and scope of use of embodiments of the present application.
As shown in fig. 6, the electronic device 60 is in the form of a general-purpose electronic device. The components of the electronic device 60 may include, but are not limited to, the at least one processor 61, the at least one memory 62, and a bus 63 that connects the various system components, including the memory 62 and the processor 61.
The processor 61 is configured to read and execute the instructions in the memory 62, so that the at least one processor can execute a method for processing sensitive information provided in the foregoing embodiment.
Bus 63 represents one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, a processor, or a local bus using any of a variety of bus architectures.
Memory 62 may include readable media in the form of volatile memory, such as Random Access Memory (RAM) 621 and/or cache memory 622, and may further include Read Only Memory (ROM) 623.
Memory 62 may also include a program/utility 625 with a set (at least one) of program modules 624, such program modules 624 including, but not limited to, an operating system, one or more application programs, other program modules, and program data, each or some combination of which may include an implementation of a network environment.
The electronic device 60 may also communicate with one or more external devices 64 (e.g., keyboard, pointing device, etc.), one or more devices that enable an administrator to interact with the electronic device 60, and/or any device (e.g., router, modem, etc.) that enables the electronic device 60 to communicate with one or more other electronic devices. Such communication may occur through an input/output (I/O) interface 65. Also, the electronic device 60 may communicate with one or more networks such as a Local Area Network (LAN), a Wide Area Network (WAN) and/or a public network, such as the Internet, through a network adapter 66. As shown, network adapter 66 communicates with other modules for electronic device 60 over bus 63. It should be appreciated that although not shown, other hardware and/or software modules may be used in connection with electronic device 60, including, but not limited to, microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, data backup storage systems, and the like.
In some possible embodiments, aspects of a method for processing sensitive information provided by the present application may also be implemented as a program product, which includes program code for causing a computer device to perform the steps of the method for processing sensitive information according to the various exemplary embodiments of the present application as described in the present specification, when the program product is run on a computer device.
In addition, the present application also provides a computer-readable storage medium storing a computer program for causing a computer to execute the method of any one of the above embodiments.
These computer program instructions may be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
While preferred embodiments of the present application have been described, additional variations and modifications in those embodiments may occur to those skilled in the art once they learn of the basic inventive concepts. It is therefore intended that the following claims be interpreted as including the preferred embodiments and all such alterations and modifications as fall within the scope of the application.
It will be apparent to those skilled in the art that various modifications and variations can be made to the present application without departing from the spirit or scope of the application. Thus, it is intended that the present application also include such modifications and alterations insofar as they come within the scope of the appended claims or the equivalents thereof.
Claims (11)
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202411096967.4A CN119089462A (en) | 2024-08-09 | 2024-08-09 | A method, device and electronic device for processing sensitive information |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202411096967.4A CN119089462A (en) | 2024-08-09 | 2024-08-09 | A method, device and electronic device for processing sensitive information |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN119089462A true CN119089462A (en) | 2024-12-06 |
Family
ID=93661151
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202411096967.4A Pending CN119089462A (en) | 2024-08-09 | 2024-08-09 | A method, device and electronic device for processing sensitive information |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN119089462A (en) |
-
2024
- 2024-08-09 CN CN202411096967.4A patent/CN119089462A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US8971535B2 (en) | Multi-level key management | |
| US11290446B2 (en) | Access to data stored in a cloud | |
| EP1522167B1 (en) | A method and an apparatus for retrieving a value secured in a key management system | |
| WO2019214211A1 (en) | Block chain-based user data authorization method and apparatus, and medium and computing device | |
| US8850593B2 (en) | Data management using a virtual machine-data image | |
| US9319394B2 (en) | System and method for pool-based identity authentication for service access without use of stored credentials | |
| US11537733B2 (en) | Database access control service in networks | |
| CN103095720B (en) | A kind of method for managing security of cloud storage system of dialogue-based management server | |
| JP2007511821A (en) | Distributed document version control | |
| WO2014081698A2 (en) | Delegate authorization in cloud-based storage system | |
| US8977857B1 (en) | System and method for granting access to protected information on a remote server | |
| US11954672B1 (en) | Systems and methods for cryptocurrency pool management | |
| AU2020305390A1 (en) | Cryptographic key orchestration between trusted containers in a multi-node cluster | |
| TWI865290B (en) | Method, computer program product, and apparatus for attribute based encryption key based third party data access authorization | |
| US9864853B2 (en) | Enhanced security mechanism for authentication of users of a system | |
| CN119691723A (en) | Service authorization method and related device | |
| JP7361384B2 (en) | Electronic application assistance method, electronic application assistance system, electronic application assistance system program and its recording medium | |
| CN119089462A (en) | A method, device and electronic device for processing sensitive information | |
| Pereira et al. | Secure, dynamic and distributed access control stack for database applications | |
| US9501658B1 (en) | Avoiding file content reading using machine information | |
| WO2024032833A1 (en) | Data encryption system and method | |
| CN116488903A (en) | Key management method, device, computer equipment and storage medium | |
| HK40027360B (en) | Access control method and apparatus, computer device and storage medium | |
| NZ618683B2 (en) | Access control to data stored in a cloud |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |