Home » Electronic News » Frontier | The evolution of three generations of dynamic desensitization technology in the context of “Data Security Law”

Frontier | The evolution of three generations of dynamic desensitization technology in the context of “Data Security Law”

Posted by: Yoyokuo 2022-07-07 Comments Off on Frontier | The evolution of three generations of dynamic desensitization technology in the context of “Data Security Law”

The promulgation of the “Data Security Law” has brought the construction of data security into a new era of legal compliance and construction. The implementation of the security law requires the joint efforts of the government, regulators, enterprises, security capability providers, and the society. At the same time, it also requires the introduction of advanced technologies, scientific governance methods, and sound institutional processes. Among them, effective security technology guarantee is the key.

Under the framework of data security governance and data life cycle management, it is necessary to establish corresponding technical countermeasures for each link and step of data collection, transmission, processing, storage, use, deletion and destruction, so as to be tailored. Today, we focus on the security response of data in the process of data transmission, use and other shared circulation – data desensitization technology.

1. Germination of technology

The importance of data to an enterprise is self-evident. The business development, decision analysis, and market innovation of an enterprise are all deeply dependent on the value of data. The use of data assets by enterprises is not only full of expectations for the maximization of data value release, but also holds a cautious attitude towards the process of data circulation and use. Therefore, every effort is made to ensure the security of data flow by means of constantly evolving technologies.

Once data flows, it faces a variety of contacts with complex identities, such as internal or external personnel. Different roles have different job responsibilities, and the scope of data that is allowed to be viewed is also different. Once different roles are given the same and greater permissions than they need, security risks will follow. Therefore, saying goodbye to one size fits all and adopting flexible management methods for data can achieve a balance between data security and the importance of data circulation and utilization to the digital economy.

What counts as a flexible management approach? Let’s first look at a counter-example – reducing or revoking some permissions for the contacted party. In view of the complexity of the business, it is very difficult to accurately recover permissions. Once the permission recovery is excessive or unbalanced, it will inevitably affect the development of daily work, so this idea will not work. Then change the way of thinking – solve the problem of unauthorized access to data without changing the permissions of the contacting party. In order to go through this road, we need to introduce the technology we are going to discuss today – data desensitization technology.

2. Technical classification

Data desensitization, as the name suggests, refers to the masking and deformation of some sensitive information through desensitization algorithms, and the sensitivity level is lowered and then released to the outside world, or for access, to achieve reliable protection of sensitive private data. The desensitization technology determines which data is displayed in the form of plaintext data and which data is displayed in a masked or deformed form according to the different permissions, responsibilities and scenarios of the contact parties, so that all contact parties can view and use the data appropriately. , and the development of some work will not be affected due to the recovery of permissions. Different application scenarios have spawned two technical forms of static desensitization and dynamic desensitization. The deployment and implementation principles of the two are very different, and they each perform their own duties and cannot be replaced.

● Static desensitization

Application Scenario – Before production data leaves the production environment, it is usually used in non-production environments or out of native business systems.

Databases of non-production systems such as training, development testing, analysis, data sharing, and scientific research are typical application scenarios for static desensitization. Static desensitization is to deform and bleach the sensitive data in the full amount of data before allowing it to leave the production environment. In most cases, the cooperation of data simulation technology and data association technology is required to ensure that the desensitized data can be used in the same way as the real data. same effect.

Example: The original data is “18612345678”, which is transformed into “13587654321” using static desensitization technology. The desensitized data has all the characteristics of the original data, ensuring the availability and security of the desensitized data.

● Dynamic desensitization

Application Scenario – When production data is accessed and circulated in the production environment.

The purpose of dynamic masking is to prevent real sensitive data from being viewed without authority, so it is not necessary to maintain data characteristics in most cases. At the same time, in order to improve masking efficiency and meet masking requirements under large-scale and high concurrent access, data masking is usually used. desensitization method. For example, when the application needs to present data, but does not want some application accounts to see all the data, real-time desensitization of sensitive data can be performed according to the roles and permissions of different personnel. Taking operation and maintenance personnel as an example, when they are only required to perform the duty of maintaining the table structure for system tuning, it is not allowed to retrieve or export some sensitive real data. At this time, the cooperation of dynamic desensitization technology is required.

Example: The original data is “18612345678”, and the deformed data is “186******78” using dynamic desensitization technology. The desensitized data can effectively prevent leakage and ensure the timeliness and security of data desensitization.

Next, this article will focus on the development and sharing of the first, second and third generation evolution of dynamic desensitization technology.

3. Technology Evolution

The evolution and evolution of technology are driven by real scenario requirements. After years of development and changes in the IT business environment and continuous improvement of technical requirements, the data dynamic desensitization technology also maintains a high-spirited passion, iterating and evolving all the way.

The mainstream or mature dynamic technology on the market is roughly divided into two types: “result set rewriting” of the first-generation dynamic technology and “SQL statement rewriting” of the second-generation dynamic technology. With the complexity of application scenarios and requirements, the two technology types continue to derive four subdivision technology routes (see the chart below). These four technology routes have their own advantages and disadvantages. By constantly adapting to the complex business environment of rapid iterative evolution and The demand scenario has completed the step-by-step evolution to the third-generation dynamic desensitization technology-hybrid mode dynamic desensitization.

Dynamic Desensitization Technology Evolution Roadmap

★ The first generation of dynamic desensitization technology

1. Dynamic desensitization at the database layer (result set rewriting technology)

At the earliest, the dynamic desensitization technology was realized by rewriting the result set, which was the first generation of dynamic desensitization technology. The result set rewriting technology is based on the result set parsing technology. After the database returns the results, it determines which data in the result set needs to be desensitized on the desensitization device, and performs desensitization processing in the device. The deployment method of this technology: Generally, database protocol reverse proxy technology is used to proxy database access requests to achieve the goal of data desensitization.

With the development of technology, the database layer desensitization route is derived from this technology, which means that the result set is desensitized before returning to the application system. After desensitization, the data can be returned to the application system and displayed on the terminal.

(1) Advantages

High compatibility

The result set rewriting is based on the result set parsing technology and is loosely coupled with the database. In theory, it can be applied to any database platform with extremely high compatibility.

blurred desensitization

When the user cannot grasp the location of the target data, he can only specify the target data type as the desensitization target. No matter where the target data is, as long as it appears in the result set, desensitization can be completed to ensure data security.

Easy to use

There is no need to configure complex desensitization rules in advance, and there is no need to sort out the detailed target library and table structure. You only need to specify the data type to be desensitized, and you can start work, reducing the learning cost and usage cost of users.

(2) Disadvantages

low efficiency

The result set rewriting technology requires data rewriting row by row at the desensitization device, which is inefficient and may become a performance bottleneck of the business flow.

Cannot desensitize accurately

If the result set contains multiple identical fields, but the desensitization requirement is limited to one of the fields, it cannot be achieved by the result set rewriting method.

2. Application layer dynamic desensitization (result set rewriting technology)

The market’s requirements for dynamic desensitization are getting higher and higher, and the requirements are becoming more and more complex. The dynamic desensitization technology of the database layer is not enough for this performance, because the dynamic desensitization of the database layer is a database protocol of the agent. Before it is deployed in the database, the application system account information cannot be obtained in principle. If you want to install the plug-in on the application system to obtain the login account information and return and link it, it will cause problems such as the stability and reliability of the plug-in and the resource occupation of the application server, resulting in low user acceptance and market response. mediocre.

In the face of strong market demand, the evolution of technology is imperative. After research and development and verification, the application layer dynamic desensitization technology was born. It adopts HTTP/HTTPS protocol proxy technology and is deployed before the application system, and has the natural advantage of obtaining the login account information of the application system.

The desensitization process is that after the application system obtains the data and before the terminal obtains the data, it can effectively realize the dynamic desensitization requirement of decentralizing the rights and roles according to the account of the application system. The application-layer dynamic desensitization technology is still based on the principle of result set desensitization. By changing the proxy protocol and deployment location, it meets the needs of the market, but in essence, it still belongs to the first-generation dynamic desensitization category.

(1) Advantages

Decentralized desensitization

The desensitization target can be divided into permissions and roles according to the application system account.

High compatibility

High compatibility, independent of database type, and can be applied to business systems using any database type.

(2) Disadvantages

Narrow scope of application

The scope of application is narrow, and it can only solve the desensitization on the application side, but cannot solve the desensitization on the operation and maintenance side.

low efficiency

Using the result set desensitization method, it is necessary to desensitize the results one by one, and the efficiency is low.

complex configuration

Each page needs to configure policies, and each page also needs to configure policies by account and role, and the configuration is complicated.

complex to implement

It is necessary to investigate the situation and business flow of all target business systems. It is necessary to investigate the URL, Display content, users, desensitization targets and other information of each page. The implementation workload is large and the implementation period is long.

Poor usability

The complex configuration determines the high cost of learning and use for users, and poor ease of use.

3. Dynamic desensitization of API layer (result set rewriting technology)

At present, a common business model has emerged, that is, data interaction between multiple systems through API interfaces, which not only increases the risk of data leakage during the interaction process, but also brings the risk of data leakage after the implementation of other business systems. , especially the cross-network, cross-domain, cross-department, and cross-enterprise API data interaction, the risk of data leakage is extremely high. In response to this scenario, the API layer dynamic desensitization technology has been derived from the market. This technology still uses the principle of result set desensitization, which is a variant of the first generation of dynamic desensitization technology. It adopts HTTP/HTTPS protocol proxy technology and is deployed between application systems. The desensitization process is after application system A obtains and transmits data, and before application system B obtains data.

(1) Advantages

Easy to use

It is easy to use, just determine the desensitization data of each API interface.

High compatibility

High compatibility, independent of database type, and can be applied to business systems using any database type.

Simple to implement

It is simple to implement and less risky.

(2) Disadvantages

Narrow scope of application

The scope of application is very limited, and it can only solve API desensitization, but cannot solve desensitization on the operation and maintenance side.

low efficiency

Using the result set desensitization method, it is necessary to desensitize the results one by one, and the efficiency is low.

The analysis found that although the result set rewriting technology has the advantages of wide application range and high compatibility, with the diversification of usage scenarios, its low efficiency can no longer adapt to the usage scenarios of large-scale businesses. Sensitive technical route and bring to market.

From the above-mentioned technical routes, the biggest bottleneck of the first-generation dynamic release technology is efficiency. In order to break through this bottleneck, the first-generation dynamic release technology needs to complete the evolution to the second-generation dynamic release technology.

★ Second-generation dynamic desensitization technology

4. Dynamic desensitization of database layer (SQL statement rewriting technology)

The SQL statement rewriting technology still realizes the dynamic desensitization goal of the database layer through the reverse proxy of the database protocol, and also desensitizes the data before returning it to the application system. The advent of this technology solves the problem of low efficiency of result set rewriting, which can be called the second-generation dynamic desensitization technology.

Based on SQL statement parsing technology, it rewrites query statements containing sensitive fields, and uses functional operations on sensitive fields, allowing the database to return the rewritten results that do not contain sensitive data. The operation process is fast, which is almost the same as the execution of standard SQL statements, and the process execution is in the database, so the desensitization equipment will not become the performance bottleneck of the business.

(1) Advantages

High desensitization efficiency

SQL statement rewriting technology can improve the efficiency of dynamic desensitization to the extreme, and the speed is extremely high.

Get rid of performance bottlenecks

Dynamic masking using SQL statement rewriting technology has little impact on business efficiency, and dynamic masking equipment will not become a performance bottleneck for business flows.

targeted desensitization

When the query statement covers multiple fields that store the same data type, and the user only needs to desensitize one of the fields, and the other same fields do not need to be desensitized, the SQL rewriting technology can accurately desensitize them.

(2) Disadvantages

low compatibility

The SQL statement rewriting utilizes the language mechanism of the database itself, which is tightly coupled with the database type and language mechanism, and has low compatibility.

Difficult to deal with complex sentences

When faced with complex statements such as unpacked statements, nested statements, and super-long statements, it is a great challenge or even an unsolvable problem for SQL statement rewriting technology.

Poor usability

The SQL statement rewriting technology must sort out the table structure of the target database. It is cumbersome to configure the desensitization strategy, which will greatly increase the learning cost of users.

No field information desensitization

Dynamic desensitization is aimed at query statements, but many query statements do not contain field information, which will cause the SQL rewriting technology to fail to identify whether the statement target contains data that needs to be desensitized, and cannot be desensitized. For this scenario, SQL statement rewriting has a certain ability to cope, such as select * from user, but there are too many statements without sensitive field information, technically unable to deal with all of them, resulting in the failure of the desensitization function in some scenarios.

The analysis found that the SQL statement rewriting technology is tightly coupled with the database, and uses the language mechanism of the database itself to desensitize, which makes its database compatibility a major weakness, and the database interaction language is ever-changing. How to deal with various query statements has become a difficult problem to be solved. and pain points. Therefore, the market needs a dynamic release technology that can take into account both performance and compatibility.

From the specific scenario application of the second-generation dynamic removal technology, that is, the SQL statement rewriting technology, the fundamental problem that needs to be solved is the compatibility problem. evolution.

★ The third generation of dynamic desensitization technology

5. Mixed-mode dynamic desensitization

Whether it is the first generation, the second generation of mobile technology, or the four subdivision technology routes as different application modes, each has its own advantages and disadvantages, and some scenarios cannot be replaced by each other, so the evolution direction of mobile technology has become Be clear – a dynamic desensitization technology that can take into account the advantages of both technology types and cover different application modes. Hybrid masking technology emerged as the times require. It can support both result set rewriting and SQL statement rewriting. It can flexibly change the deployment location according to requirements to cover four application scenarios. We call it the third-generation dynamic masking technology.

The third-generation dynamic desensitization technology combines the advantages of the first and second-generation technologies, breaking through the bottleneck of the above four technical routes to a certain extent. The background intelligently determines which desensitization technology is suitable for the current scene, without manual intervention, to achieve compatibility and high performance , the best balance of applicability. Of course, in some single scenarios, the third-generation dynamic technology still has the problem of low performance of the first-generation, but on the whole it can achieve the best balance.

(1) Advantages

Strong availability

Hybrid-mode dynamic deactivation has all the advantages of the first- and second-generation desensitization technologies, and intelligent judgment is realized in the background. Users do not need to pay attention to which scene is suitable for which technical mode. The focus only needs to be focused on the target data to be desensitized to help users. To achieve fool-like operation.

Wide range of applications

It has a wide range of applications and can cover all desensitization scenarios at the database layer, application layer and API layer.

Desensitization and intelligence

It is not a simple stacking technology, but realizes intelligent invocation of different technologies through the underlying mechanism, without user participation, and achieves the goal of intelligent desensitization.

Comparison map of the five major technology routes

4. Conclusion

As long as there is demand, there is no end to technological progress. The development and evolution of mobile desensitization technology is achieved by the market under the scenario of continuously meeting the diverse data desensitization needs of different users. Of course, the satisfaction of the needs of these scenarios is carried out slowly under the big context of the “Data Security Law” and the big framework of data security governance. The improvement of enterprise data security construction capabilities must depend on the continuous iterative evolution and strong driving of core technologies. We believe that technological progress will always be the measure of security progress.

The Links:   LQ104S1DG34 GD400SGX170C2S