Sensitive information processing method, device and server, and security determination system

Patent metadata

Field	Value
Publication number	US-10505934-B2
Application number	US-201715448504-A
Country	US
Kind code	B2
Filing date	Mar 2, 2017
Priority date	Sep 3, 2014
Publication date	Dec 10, 2019
Grant date	Dec 10, 2019

Abstract

A sensitive information processing method, device and server, and a security determination system. The method includes acquiring to-be-processed information in a page; determining whether the to-be-processed information is sensitive information according to a preset sensitive information identification strategy; performing processing according to a preset sensitive information processing strategy when the to-be-processed information is sensitive information, to form processed sensitive information; and substituting the corresponding to-be-processed information in the page with the processed sensitive information, to form a page with the processed sensitive information. By using the example embodiments of the present application, identification and processing for sensitive information in a page returned to a user may be completed on a server terminal, which improves the security of the sensitive information in the page.

First claim

What is claimed is:

1. A method comprising:
acquiring to-be-processed information in a page, the to-be-processed information including a value of variable information;
determining that the to-be-processed information is sensitive information according to a variable name corresponding to the value;
performing processing according to a preset sensitive information processing strategy to form processed sensitive information, the performing including setting the preset sensitive information processing strategy according to a privilege of a domain group to which the value belongs, different values corresponding to different preset sensitive information processing strategies for the variable name; and
substituting the to-be-processed information in the page with the processed sensitive information, to form a page with the processed sensitive information.

2. The method of claim 1 , wherein the acquiring the to-be-processed information in the page includes:
acquiring the to-be-processed information in the page by using an interceptor after a Controller in an MVC framework structure is invoked and before a view is rendered; or
acquiring the to-be-processed information in the page by using an interceptor after a Velocity in an MVC framework structure is invoked.

3. The method of claim 1 , wherein the to-be-processed information includes:
the variable information in a ModelMap in an MVC framework structure of a page server.

4. The method of claim 3 , wherein the determining that the to-be-processed information is the sensitive information includes:
acquiring the variable name in the ModelMap in the MVC framework structure of the page server;
comparing the acquired variable name in the ModelMap with sensitive information stored in a sensitive information library; and
determining that the to-be-processed information is the sensitive information in response to determining that the variable name is in the sensitive information library.

5. The method of claim 4 , further comprising:
determining, according to a preset sensitive information monitoring strategy, whether the value in the ModelMap in the MVC framework structure of the page server is to-be-processed sensitive information; and
sending a variable name corresponding to the value of the variable information to the sensitive information library when it is determined according to the sensitive information monitoring strategy that the value of the variable information is to-be-processed sensitive information.

6. The method of claim 3 , wherein the performing processing according to the preset sensitive information processing strategy includes:
setting the preset sensitive information processing strategy for values corresponding to different variable names according to the different variable names.

7. The method of claim 6 , wherein the preset sensitive information processing strategy includes at least one of the followings:
non-processing;
display of a predetermined part;
completion of masking;
privilege-based masking;
display after transformation; and
misinformation.

8. A device comprising:
one or more processors; and
one or more memories having stored thereon computer-readable instructions, which when executed, cause the one or more processors to perform acts comprising:
acquiring to-be-processed information in a page, the to-be-processed information including a value of variable information;
determining that the to-be-processed information is sensitive information on the basis of a variable name corresponding to the value stored in a sensitive information library; and
performing processing according to a preset sensitive information processing strategy to form processed sensitive information, the performing including setting the preset sensitive information processing strategy according to a privilege of a domain group to which the value belongs, different values corresponding to different preset sensitive information processing strategies for the variable name.

9. The device of claim 8 , wherein the to-be-processed information includes:
the variable information in a ModelMap in an MVC framework structure of a page server.

10. The device of claim 9 , wherein the performing processing according to the preset sensitive information processing strategy includes:
setting the preset sensitive information processing strategy for values corresponding to different variable names according to the different variable names.

11. The device of claim 9 , wherein the preset sensitive information processing strategy includes at least one of the following:
displaying a particular field of the value corresponding to the variable name according to a predetermined display rule;
masking all fields of the value corresponding to the variable name according to a predetermined masking rule;
processing the value corresponding to the variable name according to a privilege of a specified field;
transforming the value corresponding to the variable name according to a predetermined transformation rule, and use the transformed value as the value of the variable name; and
skipping processing the value corresponding to the variable name.

12. The device of claim 9 , wherein the determining that the to-be-processed information is the sensitive information includes:
acquiring the variable name in the ModelMap in the MVC framework structure of the page server;
determining that the acquired variable name in the ModelMap is the same as the sensitive information stored in a sensitive information library; and
determining that the to-be-processed information is the sensitive information.

13. The device of claim 9 , wherein the acts further comprise:
storing a preset sensitive information monitoring strategy;
determining, according to the preset sensitive information monitoring strategy, whether a value of the variable information in the ModelMap in the MVC framework structure of the page server is to-be-processed sensitive information; and
sending the variable name corresponding to the value of the variable information to the sensitive information library in response to determining that the value of the variable information is to-be-processed sensitive information.

14. The device of claim 9 , wherein the acts further comprise:
directly sending the processed sensitive information to a server by using an interceptor.

15. The device of claim 9 , wherein the acts further comprise:
substituting the to-be-processed information in the page with the processed sensitive information.

16. One or more memories having stored thereon computer-readable instructions, which when executed, cause one or more processors to perform acts comprising:
acquiring to-be-processed information in a page, the to-be-processed information including a value of variable information;
determining that the to-be-processed information is sensitive information according to a variable name corresponding to the value;
performing processing according to a preset sensitive information processing strategy to form processed sensitive information, the performing including setting the preset sensitive information processing strategy according to a privilege of a domain group to which the value belongs, different values corresponding to different preset sensitive information processing strategies for the variable name.

17. The one or more memories of claim 16 , wherein the acts further comprise substituting the to-be-processed information in the page with the processed sensitive information, to form a page with the processed sensitive information.

Assignees

• Alibaba Group Holding Ltd

Inventors

• Zhang Xiang
• Lv Jianping
• Chen Zhengrong
• Yang Ke
• Xu Huiqing
• Mou Wei
• Wang Xingang
• Sun Chao
• Yu Xiaoxue
• Jiang Qinfei
• Xiao Hanxiao

Classifications

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L2209/04

  Masking or blinding · CPC title

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04L29/06

  Electricity · mapped topic

• H04L63/0281 Primary

  Proxies · CPC title