Patent Description:
As computer technologies and network technologies develop, an enterprise and a personal user generate massive data every day, and the data is stored using a plurality of storage technologies. For example, massive user information is stored in a plurality of data nodes in a distributed manner using a distributed storage technology. However, when the stored data needs to be processed (for example, deleted, encrypted, or decrypted), the stored data needs to be retrieved in a plurality of data nodes, for example, may be retrieved by using a user identifier. Consequently, data processing efficiency is very low.

A user information processing solution provided in prior art <NUM> is as follows: During collection and storage of user information, an identifier of a user in the collected user information is encrypted first by using a key. The user information including ciphertext of the user identifier is stored to ensure storage security of the user identifier. When the user information needs to deleted, all user information of the user is found based on the ciphertext of the user identifier, and is deleted one by one. When the key needs to be modified, the ciphertext of the user identifier needs to be found in all nodes, the user identifier is restored by using the old key, and then the user identifier is encrypted again by using a new key. In the solution in prior art <NUM>, storage security of a user identifier is protected, but user information needs to be retrieved and deleted in all nodes, and all old ciphertext of the user identifier needs to be refreshed in all the nodes. Due to a very large data volume in the nodes, it needs to take a large amount of time to delete the user information and update the ciphertext of the user identifier.

In prior art <NUM>, a solution for deleting user information "everywhere" is proposed. In this solution, a key is maintained for each user, and when user information is being stored, a user identifier is encrypted first, and then ciphertext of the user identifier and user data are stored in a node. When the user makes a data deletion requirement, the key for the user is directly deleted. The key for the user is deleted, and therefore the ciphertext of the user identifier that is in the node and that is encrypted by using the key cannot be restored. However, in this solution, a large quantity of keys need to be maintained for a large quantity of users, leading to an increase in key management costs. In addition, when a key is modified, ciphertext of a user identifier needs to be retrieved in all nodes, and the ciphertext of the user identifier needs to be refreshed by using a new key. Consequently, it needs to take a large amount of system time to modify the key, affecting service availability.

Therefore, it is urgent to provide a simple, efficient, secure, and reliable user information processing solution.

Prior art document D1 (<CIT>) discloses a patient anonymizing system includes a plurality of hashing appliances and data sources.

Prior art document D2 (<CIT>) discloses data access and data anonymity management within various implementations of content distribution networks.

Prior art document D3 (<CIT>) discloses an unlinkable anonymizing method.

This application provides a user information processing method and apparatus, to provide a simple, efficient, secure, and reliable user information processing solution.

According to an aspect of this application, a user information processing method is provided, including: obtaining first user information of a user, where the first user information includes a user identifier and first user data; generating a first placeholder; storing a correspondence between the first placeholder and ciphertext of the user identifier in a user mapping table; and storing pseudonymized first user information in at least one node, where pseudonymizing the user information means replacing the user identifier in the user information with the first placeholder. In this implementation, the correspondence between the placeholder and the ciphertext of the user identifier is stored in the user mapping table, and the first user information in the node is pseudonymized, so that all subsequent operations on the first user information can be performed in the user mapping table, and there is no need to perform processing in the node, thereby implementing simpler, more efficient, securer, and more reliable processing of the user information.

In a possible implementation, when second user information is re-collected or repeatedly collected, if it is determined that the correspondence between the ciphertext of the user identifier and the first placeholder exists in the user mapping table, the first placeholder in the correspondence is obtained, and the user identifier in the second user information is replaced with the first placeholder, to obtain pseudonymized second user information. In this implementation, when the user information is repeatedly collected or re-collected, whether the correspondence including the ciphertext of the user identifier exists in the user mapping table can be determined first, and if the correspondence exists in the user mapping table, the repeatedly collected or re-collected user information may be pseudonymized and stored based on the correspondence, to ensure global uniqueness of the placeholder.

In another possible implementation, when sensitive data needs to be pseudonymized, a second placeholder is generated based on the first placeholder, a correspondence between the second placeholder and ciphertext of the sensitive data is stored in the user mapping table, and the sensitive data in the user information is replaced with the second placeholder to obtain pseudonymized user information. Specifically, the second placeholder is generated based on the first placeholder and a field attribute corresponding to the ciphertext of the sensitive data. That is, the user mapping table includes two columns used for storage. In this implementation, to pseudonymize the user identifier and the sensitive data, the two-column user mapping table is specifically used for storage. The sensitive data is also pseudonymized, so that a fine-granularity operation can be subsequently performed on the sensitive data. In addition, the two-column user mapping table facilitates extension of a field corresponding to the ciphertext of the sensitive data.

In still another possible implementation, ciphertext of the sensitive data is added to the correspondence between the first placeholder and the ciphertext of the user identifier in the user mapping table, to obtain a correspondence among the first placeholder the ciphertext of the user identifier and the ciphertext of the sensitive data, that is, the user mapping table includes a plurality of columns used for storage. In this implementation, to pseudonymize the user identifier and the sensitive data, the multi-column user mapping table is specifically used for storage. The sensitive data is also pseudonymized, so that a fine-granularity operation can be subsequently performed on the sensitive data.

In still another possible implementation, global uniqueness of the placeholder corresponding to the ciphertext of the user identifier needs to be ensured.

In still another possible implementation, during key updating, ciphertext data needs to be updated only in the user mapping table, and there is no need to perform updating in each data node, thereby dramatically improving key update efficiency.

In still another possible implementation, the correspondence between the first placeholder and the ciphertext of the user identifier in the user mapping table is destroyed, so that the user identifier cannot be restored. Therefore an effect of deleting the entire user information can be achieved without deleting the user information in each data node, thereby dramatically improving user information deletion efficiency.

In still another possible implementation, the correspondence between the second placeholder and the ciphertext of the sensitive data in the user mapping table is destroyed, so that the ciphertext of the sensitive data in the two-column user mapping table is deleted. Therefore, an effect of deleting the sensitive data is achieved, and the sensitive data is deleted at a fine granularity.

In still another possible implementation, the ciphertext of the sensitive data in the correspondence including the ciphertext of the user identifier is cleared, so that the ciphertext of the sensitive data in the multi-column user mapping table is deleted. Therefore, an effect of deleting the sensitive data is achieved, and the sensitive data is deleted at a fine granularity.

In still another possible implementation, a data center node may be authorized to actively de-pseudonymize the user information, to utilize the user information. Specifically, in a case of the two-column user mapping table, the first placeholder in the pseudonymized user information is replaced with the user identifier, and the second placeholder in the pseudonymized user information is replaced with the sensitive data. In a case of the multi-column user mapping table, the first placeholder in the pseudonymized user information is replaced with the user identifier and the sensitive data.

In still another possible implementation, a user information obtaining request from the user may be received, and the pseudonymized user information is de-pseudonymized based on the request, to facilitate user query. Specifically, in a case of the two-column user mapping table, the first placeholder in the pseudonymized user information is replaced with the user identifier, and the second placeholder in the pseudonymized user information is replaced with the sensitive data. In a case of the multi-column user mapping table, the first placeholder in the pseudonymized user information is replaced with the user identifier and the sensitive data.

According to another aspect of this application, a user information processing apparatus is provided. The user information processing apparatus has a function of implementing the actions in the foregoing method. The function may be implemented by hardware, or may be implemented by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the function.

In a possible implementation, the user information processing apparatus includes: an obtaining unit, configured to obtain first user information of a user, where the user information includes a user identifier and first user data; a generation unit, configured to generate a first placeholder; a storage unit, configured to store a correspondence between the first placeholder and ciphertext of the user identifier in a user mapping table, where the ciphertext of the user identifier is obtained by encrypting the user identifier by using a first key; and a pseudonymization unit, further configured to pseudonymize the user information to obtain pseudonymized user information, where the pseudonymizing the user information includes replacing the user identifier in the user information with the first placeholder, where the storage unit is further configured to store the pseudonymized user information in at least one node.

In another possible implementation, the user information processing apparatus includes a memory and a processor, where the memory stores a set of program code, and the processor is configured to invoke the program code stored in the memory, to perform the following operations: obtaining first user information of a user, where the user information includes a user identifier and first user data; generating a first placeholder; storing a correspondence between the first placeholder and ciphertext of the user identifier in a user mapping table, where the ciphertext of the user identifier is obtained by encrypting the user identifier by using a first key; pseudonymizing the user information to obtain pseudonymized user information, where the pseudonymizing the user information includes replacing the user identifier in the user information with the first placeholder; and storing the pseudonymized user information in at least one node.

Based on a same inventive concept, for a problem-resolving principle and beneficial effects of the user information processing apparatus, refer to the foregoing possible method implementations and beneficial effects thereof. Therefore, for implementation of the user information processing apparatus, refer to implementation of the method. No repeated description is provided.

According to still another aspect of this application, a user information processing system is provided. The system includes a terminal device, the user information processing apparatus described in the foregoing implementations, and at least one data node.

According to another aspect of this application, a computer readable storage medium is provided. The computer readable storage medium stores an instruction, and when the instruction is run on a computer, the computer is enabled to perform the method according to the foregoing aspects.

According to still another aspect of this application, a computer program product including an instruction is provided, and when the computer program product is run on a computer, the computer is enabled to perform the method according to the foregoing aspects.

To describe the technical solutions in the embodiments of the present invention or in the background more clearly, the following describes the accompanying drawings required for describing the embodiments of the present invention or the background.

The following several concepts are used in many places in this application, and the concepts are explained first as follows:
Pseudonymization (Pseudonymization): To avoid identifying a data subject by using personal data, identity information included in the personal data may be replaced with a pseudonym. Such a replacement is pseudonymization. Two attributes of the pseudonymization are as follows: (<NUM>) Other attributes associated with the pseudonym are insufficient to identify the data subject associated with these attributes; and (<NUM>) A privacy-related party (for example, a data controller) other than a pseudonym allocator cannot inversely deduce the data subject based on the pseudonym with limited efforts. Pseudonymized data is still personal data.

De-pseudonymization is an inverse process of the pseudonymization.

Anonymization (Anonymization): Anonymization is a process in which personal data cannot be inversely changed. After the anonymization is performed, a data controller cannot directly or indirectly identify a data subject with efforts of the data controller or in cooperation with any third party. In addition to the two attributes of the pseudonymized data, anonymized data further has an attribute of elimination of an association between data. In an anonymization process, identity information is erased or replaced with a pseudonym, and a related function or a conversion table used to generate pseudonymized data is destroyed. In this case, the anonymized data is no longer personal data.

A placeholder is a globally unique symbol, and may be, for example, a globally unique random number or random string.

This application may be applied to a massive data processing scenario. A correspondence between an index identifier of the data and an identifier of a user is stored in a user mapping table, so that data processing efficiency can be improved. If the massive data is user information, the user may be an enterprise user or a personal user. The index identifier may be, for example, a placeholder. If security of the user identifier needs to be considered, the user identifier stored in the user mapping table needs to be encrypted. The massive data may be stored using a plurality of storage technologies, for example, a distributed storage technology.

The following embodiments are described by using big data distributed storage as an example, and massive user information is stored in a big data server in a distributed manner. However, for a user, the big data server serving as a third party is usually considered as "semi-credible" because the big data server may analyze, for profits, the user information stored in the big data server to obtain additional information, which threatens privacy security of the user. The user requires the big data server to provide a personal data deletion capability. With the data deletion function, the user may stop the big data server from using the user information of the user or delete the user information of the user in the big data server as the user expects.

<FIG> is a schematic diagram of a distributed storage architecture applicable to an embodiment of the present invention. As shown in <FIG>, a distributed storage system includes a data center node <NUM>, a key management center <NUM>, one or more data nodes <NUM> (data nodes <NUM> to N in <FIG>), and one or more terminal devices <NUM> (terminal devices <NUM> to N in <FIG>). The data center node receives a user information write request from the terminal device, repeatedly stores user information in the plurality of data nodes based on a specific replication policy and some service requirements, receives a key update request from the key management center and a user information view request and a user information deletion request from the terminal device, and the like. The user information includes a user identifier and user data, and the user data may include some sensitive data, for example, a salary and disease information of a user. The user identifier and the sensitive data need to be pseudonymized before being stored in the data nodes as sensitive information, to protect security of the sensitive information. The key management center is responsible for key generation, storage, distribution, and modification. The terminal device is mainly responsible for authorizing the data center node to collect the user information, sending the user information to the data center node, requesting to delete the user information in the data node, requesting to view the user information in the data node, and the like.

It should be noted that in the embodiments of the present invention, the key management center, the data nodes, and the data center node may be disposed on a same device. For example, the key management center may be a modular unit of the data center node. A specific manner of deploying the key management center, the data nodes, and the data center node is not limited in the present invention.

For the key storage by the key management center, the key management center may encrypt a generated key by using a root key, and store a ciphertext of the encrypted key. The root key is determined based on a plurality of key components. To protect the root key, storage of the plurality of key components needs to be particularly limited: (<NUM>) The plurality of key components are stored in the key management center in a scattered manner, to increase difficulty of obtaining all the key components and obtaining the root key by cracking the key components by an attacker; and (<NUM>) The key components need to be protected by using a rigorous access control mechanism, for example, the key components are not allowed to be accessed by an operator outside the system by using any communications interface (for example, an FTP and an MML). In terms of a function of periodically modifying a key, the key management center provides different keys in different periods, and instructs the data center node to refresh old ciphertext.

A terminal device in this application is a device having a wireless communication function, and may be a handheld device, a vehicle-mounted device, a wearable device, or a computing device that has a wireless communication function or another processing device connected to a modem, or the like. In different networks, the terminal device may have different names, for example, user equipment, an access terminal, a subscriber unit, a subscriber station, a mobile station, a mobile console, a remote station, a remote terminal, a mobile device, a user terminal, a terminal, a wireless communications device, a user agent or a user apparatus, a cellular phone, a cordless phone, a session initiation protocol (Session Initiation Protocol, SIP) phone, a wireless local loop (Wireless Local Loop, WLL) station, a personal digital assistant (Personal Digital Assistant, PDA), and a terminal device in a <NUM> network or a future evolved network.

The embodiments of the present invention provide a user information processing method and a data center node. A correspondence between a placeholder and ciphertext of a user identifier is stored in a user mapping table, and user information in a node is pseudonymized, so that all subsequent operations on the user information can be performed in the user mapping table, and there is no need to perform processing in the node, thereby implementing simpler, more efficient, securer, and more reliable processing of the user information.

<FIG> is a schematic flowchart of a user information processing method according to an embodiment of the present invention. The method may include the following steps.

Obtain first user information of a user.

A data center node may collect first user information of a terminal device or receive first user information sent by a terminal device. The first user information includes a user identifier and first user data. The user herein may be an enterprise user or a personal user. The user identifier is used to identify user data of the user. For example, user information that is shown in Table <NUM> as an example and that is obtained by the data center node, the user identifier may be any information such as a mobile phone number or an email address that may identify the user. In Table <NUM>, description is provided by using the mobile phone number as the user identifier. In Table <NUM>, user data types include age, gender, salary, disease, home address, and position. The data center node obtains the user information, and may first buffer the user information in the data center node. Certainly, in a data storage technology, data is not limited to being stored in a form of a data table.

In this embodiment, the user information is pseudonymized using a placeholder. Therefore, the placeholder PID of the user is generated first. Specifically, a globally unique placeholder is generated for the user, to ensure different placeholders for different users. In other words, global uniqueness of the placeholder needs to be ensured. A manner of generating the placeholder for the user includes but is not limited to the manners described below:
Manner <NUM>: The placeholder may be generated based on a specified algorithm and the user identifier. The specified algorithm includes at least one of the following: HMAC, SHA-<NUM>, and MD5.

The HMAC is used as an example:
In a specific implementation of Manner <NUM> is: performing an HMAC operation on the user identifier to obtain a value as the placeholder.

Another specific implementation of Manner <NUM> is as follows:.

It should be noted that both of the foregoing two implementations are hash mechanisms, and can ensure uniqueness of the generated placeholder. However, if the user identifier is encrypted by using the random string and the HMAC, and the random string is deleted, an encryption result is irreversible, and in this case, a privacy requirement is better met.

Manner <NUM>: The placeholder may be a random number or a random string. Specifically, the following steps are included:.

Store a correspondence between the placeholder and ciphertext of the user identifier in the user mapping table, where the ciphertext of the user identifier is obtained by encrypting the user identifier by using a first key.

The data center node obtains the first key from a key management center and encrypts the user identifier, to obtain the ciphertext of the user identifier. In this embodiment, all users use a same key, and the key management center does not allocate a key to each user. The placeholder and the ciphertext of the user identifier are correspondingly stored in the user mapping table. The user mapping table stores the ciphertext of the user identifier, and therefore security of the user identifier can be ensured.

Processing of the user information in Table <NUM> is still used as an example, and a user mapping table shown in Table <NUM> is obtained, where PhoneCT <NUM> is obtained by encrypting a user identifier Phone <NUM> by using the first key, and PID <NUM> is a corresponding placeholder generated for the user identifier Phone <NUM>.

Pseudonymize the user information to obtain pseudonymized user information, where the pseudonymizing the user information includes replacing the user identifier in the user information with the first placeholder.

Before the user information buffered in the data center node is stored in a data node, the user information needs to be pseudonymized, to improve data storage security. Specifically, the user identifier in the user information is replaced with the placeholder, to obtain the pseudonymized user information. Specifically, for example, in pseudonymized user information shown in Table <NUM>, Phone <NUM> in the user information is replaced with PID <NUM>, and Phone <NUM> in the user information is replaced with PID <NUM>.

Store the pseudonymized user information in at least one node.

The pseudonymized user information in Table <NUM> is stored in one or more data nodes.

It should be noted that a sequence of S103 and S104 and S105 is not limited. The user mapping table may be stored first, and then the user information is pseudonymized and the pseudonymized user information is stored. Alternatively, the user information may be pseudonymized and the pseudonymized user information may be stored first, and then the user mapping table is stored. It can be learned that the user mapping table stores the correspondence between the ciphertext of the important user identifier in the user information and the placeholder. With such a uniform user mapping table, all subsequent operations (for example, deletion and key update) on the user information can be performed in the user mapping table, and there is no need to perform processing in the data node. One user mapping table is very small relative to massive user information in the data node, and therefore processing of the user information is simpler, more efficient, securer, and more reliable.

Further, the user mapping table is stored in the data center node, and the pseudonymized user information is stored in the data node. In this case, subsequent operations such as deletion of the user information, de-pseudonymization, key update, and repeated collection of the user information may be performed as required. The subsequent operations are separately described below.

The user needs to have a right to delete the user information of the user, and a process of deleting the user information is described in this embodiment. <FIG> is a schematic flowchart of another user information processing method according to an embodiment of the present invention. The method may include the following steps.

Receive a user information deletion request, where the user information deletion request includes the user identifier.

Destroy the correspondence between the placeholder and the ciphertext of the user identifier in the user mapping table.

That is, when deleting user information of a user, the data center node only needs to destroy the correspondence between the placeholder and the ciphertext of the user identifier in the user mapping table, and does not need to delete the user information one by one in the data node. Thereby dramatically improving user information deletion efficiency. It should be noted that the destroying the correspondence includes deleting the correspondence or clearing an item in the correspondence. Certainly, any number or symbol may be filled in for an item in the correspondence.

For example, for the user mapping table in Table <NUM>, when the data center node receives a deletion request (carrying the user identifier Phone <NUM>) from the user, the data center node may encrypt the user identifier by using the key to obtain PhoneCT <NUM>, then query the user mapping table using the ciphertext PhoneCT <NUM> of the user identifier, and determine the correspondence between the placeholder and the ciphertext of the user identifier in the user mapping table, as shown in the first row of Table <NUM>. The destroying the correspondence between the placeholder and the ciphertext of the user identifier in the user mapping table may be specifically deleting the first row of Table <NUM>, namely, the user mapping table, deleting PID <NUM> or PhoneCT <NUM> in the first row of Table <NUM>, namely, the user mapping table, clearing (setting to null) PID <NUM> or PhoneCT <NUM> in the first row of Table <NUM>, namely, the user mapping table, or the like.

After the data center node stores the pseudonymized user information in the data node, the data center node may subsequently receive a data query request from the user, that is, the user expects to view the user information of the user. Alternatively, in another scenario, as credited by the user, the data center node may actively obtain the user information from the data node and analyze the user information, to help provide a personalized server for the user. In the two cases, data needs to be restored from pseudonymized data stored in the data node (that is, a de-pseudonymization process).

In a possible implementation, <FIG> is a schematic flowchart of still another user information processing method according to an embodiment of the present invention. When receiving a user information obtaining request from the user, the data center node performs the following steps:.

De-pseudonymization is an inverse process of pseudonymization. During specific implementation, the user identifier included in the user information obtaining request is encrypted, then the placeholder corresponding to the ciphertext of the user identifier is obtained from the user mapping table, the pseudonymized user information of the user is retrieved in the data node based on the placeholder, and the placeholder is replaced with the user identifier, to restore the user information.

In another possible implementation, <FIG> is a schematic flowchart of still another user information processing method according to an embodiment of the present invention. When actively extracting the user information from the data node and analyzing the user information, the data center node performs the following steps:.

A process in which the data center node actively de-pseudonymizes the user information is similar to a process in which the user requests de-pseudonymization except that the data center node directly retrieves the user information based on the placeholder in the user mapping table.

To ensure key security, the key management center may periodically update the key. Specifically, <FIG> is a schematic flowchart of still another user information processing method according to an embodiment of the present invention. The method includes the following steps:.

Specifically, S115 includes the following steps:.

During key update, the data center node only needs to update the ciphertext of the user identifier in the user mapping table, and does not need to update the ciphertext in each data node.

In a data processing process, the data center node may repeatedly collect user data of a same user. An identifier of each user corresponds to a globally unique placeholder. Therefore when repeatedly collecting the user data of the same user, the data center node does not need to generate a new placeholder.

In a possible implementation, <FIG> is a schematic flowchart of still another user information processing method according to an embodiment of the present invention. The method includes the following steps:.

It can be learned that a difference between a process of repeatedly collecting information of the user and steps S101 to S105 is that the correspondence between the ciphertext of the user identifier and the placeholder exists in the user mapping table, the correspondence may be directly obtained, and the user information is pseudonymized by using the placeholder in the correspondence.

According to the user information processing method provided in this embodiment of the present invention, the correspondence between the placeholder and the ciphertext of the user identifier is stored in the user mapping table, and the user information in the node is pseudonymized, so that all subsequent operations on the user information can be performed in the user mapping table, and there is no need to perform processing in the node, thereby implementing simpler, more efficient, securer, and more reliable processing of the user information.

It should be noted that in this embodiment of the present invention, the user identifier stored in the user mapping table is encrypted for the sake of security. A person skilled in the art should understand that when there is no need to consider security, step <NUM> may be changed to the following: Store a correspondence between the placeholder and the user identifier in the user mapping table. In this case, step <NUM> is correspondingly changed to the following: Destroy the correspondence between the placeholder and the user identifier in the user mapping table, and step <NUM> is correspondingly changed to the following: When receiving a user information obtaining request from the user, obtain the placeholder corresponding to the user identifier from the user mapping table based on the user identifier included in the user information obtaining request. In the following embodiments of this application, description is provided by using an example in which the user identifier needs to be encrypted.

In the foregoing embodiment, the user identifier is pseudonymized, so that the user information becomes the pseudonymized user information, to protect security of the user information. In addition, deletion of the user information, key update, and de-pseudonymization are further described after the user identifier is replaced with the placeholder. However, in this embodiment, sensitive data cannot be deleted and de-pseudonymized at a fine granularity. In the following embodiments, fine-granularity processing of the sensitive data is described.

Specifically, a user mapping table may include two columns or a plurality of columns used for storage. In a case of two columns used for storage, one column of a placeholder and one column corresponding to ciphertext of sensitive information are included. In a case of a plurality of columns used for storage, one column of a placeholder and a plurality of columns corresponding to ciphertext of sensitive information are included. The following describes operations of storage, user information deletion, de-pseudonymization, and key update separately by using the two types of user mapping tables.

In the following embodiments in <FIG>, a case in which a user mapping table includes two columns used for storage is described.

<FIG> is a schematic flowchart of another user information processing method according to an embodiment of the present invention. The method may include the following steps.

Obtain user information of a user.

This step is the same as step S101 in the embodiment shown in <FIG>, and therefore details are not described herein again. A difference is that the user information includes a user identifier and user data, and the user data may further include sensitive data and non-sensitive data. For example, in user information in Table <NUM> that is obtained by a data center node, salary and disease are sensitive data, and home address and position are non-sensitive data. The user identifier and the sensitive data may be collectively referred to as sensitive information, and if the sensitive information of the user is stored in a data node in a form of plaintext, the user information may be under a security risk.

Generate a first placeholder, and generate a second placeholder based on the first placeholder.

A process of generating the first placeholder is the same as step S102 in the embodiment shown in <FIG>, and therefore details are not described herein again.

Further, the second placeholder needs to be generated based on the first placeholder. Specifically, the generating the second placeholder based on the first placeholder includes: generating the second placeholder based on the first placeholder and a field attribute corresponding to ciphertext of the sensitive data. The field attribute may be a field name or a transformation of a field name. The transformation of the field name is obtained by encrypting the field name or performing one-to-one mapping encoding on the field name. The user information in Table <NUM> is used as an example. In this table, salary and disease of a user are sensitive data. If the first placeholder is PID, and a field name (salary) corresponding to ciphertext of a salary "<NUM>" of a user <NUM> is encoded as <NUM>, the second placeholder may be PID_1, if a field name corresponding to ciphertext of a disease "gastrosis" of the user <NUM> is encoded as <NUM>, the second placeholder may be PID_2, and so on. It should be noted that the second placeholders herein mean that manners of generating the second placeholders are the same, and do not mean quantities of placeholders.

Store a correspondence between the first placeholder and ciphertext of the user identifier and a correspondence between the second placeholder and ciphertext of the sensitive data in two-column user mapping table, where the ciphertext of the user identifier is obtained by encrypting the user identifier by using a first key, and the ciphertext of the sensitive data is obtained by encrypting the sensitive data by using the first key.

Specifically, in this embodiment, the correspondence among the placeholder the ciphertext of the user identifier and the ciphertext of the sensitive data is represented in a form of a two-column user mapping table. For example, a user mapping table generated based on the user information in Table <NUM> is shown in Table <NUM>:.

It should be noted that when the user information includes a plurality of user identifiers, one of the user identifiers may be selected as an identifier as required, and the other user identifiers are stored as the sensitive data.

Replace the user identifier in the user information with the first placeholder, and replace the sensitive data in the user information with the second placeholder, to obtain pseudonymized user information.

When the user information is to be stored in the data node, the user information needs to be pseudonymized, to protect data security. Specifically, the user identifier in the user information is replaced with the first placeholder, and the sensitive data in the user information is replaced with the second placeholder, to obtain the pseudonymized user information. The user information in Table <NUM> that is shown as an example above is still used as an example. User information obtained by pseudonymizing the user information is shown in Table <NUM>:.

It can be learned that the user identifier is replaced with the first placeholder and the first placeholder is stored in the data node, and user information, namely, salary and disease, for which special security protection is required is also replaced with a corresponding placeholder that is stored in the data node. In this case, even if an unauthorized user obtains the user information, the user cannot identify a specific user to which the user information belongs if the key and the user mapping table are not obtained. Therefore, the user information cannot be further processed.

Store the pseudonymized user information in at least one node.

Further, the user mapping table is stored in the data center node, and the pseudonymized user information is stored in the data node. In this case, subsequent operations such as deletion of the user information, de-pseudonymization, and key update may be performed as required. The subsequent operations are separately described below.

The user needs to have a right to delete the user information of the user, and deleting the user information includes deleting the entire user information and deleting some sensitive data at a fine granularity. That is, if the user does not expect to delete all the user information of the user, but requires deletion only of a specific piece of sensitive data of the user, for example, a salary and/or a disease, only the sensitive data may be deleted at a fine granularity. The following describes a process of deleting the user information.

In a possible implementation, the entire user information needs to be deleted. <FIG> is a schematic flowchart of still another user information processing method according to an embodiment of the present invention. The method may include the following steps:.

The indication information for deleting the sensitive data may be, for example, a field corresponding to the sensitive data. For example, the sensitive data deletion request includes a user identifier Phone <NUM> and a field, namely, salary.

Search the user mapping table for the first placeholder corresponding to the ciphertext of the user identifier.

Determine the second placeholder based on the first placeholder and the indication information for deleting the sensitive data.

For example, the sensitive data deletion request in step <NUM> includes the user identifier Phone <NUM> and the field, namely, salary. Therefore it can be learned, based on the generation method of the second placeholder in step <NUM>, that the second placeholder is PID_1.

Destroy the correspondence between the second placeholder and the ciphertext of the sensitive data in the user mapping table.

Specifically, the data center node receives the sensitive data deletion request from the user. The sensitive data deletion request includes the user identifier and the indication information for deleting the sensitive data, and the indication information for deleting the sensitive data is used to indicate the field attribute corresponding to the ciphertext of the to-be-deleted sensitive data. The data center node encrypts the user identifier by using the key, to obtain the ciphertext of the user identifier, then searches the user mapping table for the first placeholder corresponding to the ciphertext of the user identifier. The data center node obtains the second placeholder corresponding to the sensitive data based on the first placeholder and the field attribute corresponding to the ciphertext of the sensitive data, and deletes the correspondence between the second placeholder and the ciphertext of the sensitive data in the user mapping table. The correspondence between the second placeholder and the ciphertext of the sensitive data is deleted, so that the ciphertext of the sensitive data cannot be found based on the second placeholder in the data node, and the sensitive data cannot be obtained through decryption, thereby achieving an objective of deleting the sensitive data.

For example, the sensitive data deletion request is received, and the request carries the mobile phone number Phone <NUM> and an indication for deleting salary data. In this case, Phone <NUM> is encrypted to obtain PhoneCT <NUM>, the first placeholder PID <NUM> corresponding to PhoneCT <NUM> is found in the user mapping table shown in Table <NUM>, it can be learned, based on a database field number <NUM> corresponding to salary ciphertext, that the second placeholder is PID 1_1, and a correspondence between PID 1_1 and SalaryCT <NUM> is deleted, and an obtained user mapping table in which the sensitive data is deleted is shown in Table <NUM>:.

It should be noted that the destroying the correspondence between the first placeholder and the ciphertext of the user identifier in the user mapping table or the destroying the correspondence between the second placeholder and the ciphertext of the sensitive data in the user mapping table includes deleting the correspondence or clearing an item in the correspondence. For example, during deletion of the sensitive data, the ciphertext of the sensitive information may be cleared, or the second placeholder corresponding to the ciphertext of the sensitive information is cleared. Certainly, a specific value or symbol may be filled in for an item in the correspondence.

After the data center node stores the pseudonymized user information in the data node, the data center node may subsequently receive a data query request from the user, that is, the user expects to view the user information of the user. Alternatively, in another scenario, as credited by the user, the data center node may actively extract the user information from the data node and analyze the user information, to help provide a personalized server for the user. In the two cases, data needs to be restored from pseudonymized data stored in the data node (that is, a de-pseudonymization process).

In a possible implementation, <FIG> is a schematic flowchart of still another user information processing method according to an embodiment of the present invention. When receiving a user obtaining request from the user, the data center node performs the following steps:.

De-pseudonymization is an inverse process of pseudonymization. During specific implementation, the user identifier included in the obtaining request is encrypted, then the first placeholder corresponding to the ciphertext of the user identifier is obtained from the user mapping table, the pseudonymized user information of the user is retrieved in the data node based on the first placeholder, the ciphertext of the sensitive data is obtained from the mapping table based on the ciphertext of the user identifier or the first placeholder, the sensitive data is decrypted, the first placeholder in the pseudonymized user information is replaced with the user identifier, and the second placeholder in the pseudonymized user information is replaced with the sensitive data, to restore the user information.

In another possible implementation, in scenarios of being authorized to release user information, being authorized to perform marketing by using a short message service message, being authorized to make a notification through an email, and the like, the data center node may actively extract the user information from the data node and analyze the user information. <FIG> is a schematic flowchart of still another user information processing method according to an embodiment of the present invention. The method includes the following steps:.

A process in which the data center actively de-pseudonymizes the user information is similar to a process in which the user requests de-pseudonymization except that the data center directly retrieves the user information based on the placeholder in the user mapping table.

The following describes the foregoing specific de-pseudonymization process by using a specific example. For example, the data center node is authorized to actively de-pseudonymize the first piece of user information in the user information in Table <NUM>. First, the data center node retrieves and obtains the pseudonymized user information in the data node based on the first placeholder PID <NUM> in the pseudonymized user information, then, obtains the mobile phone ciphertext PhoneCT <NUM>, the salary ciphertext corresponding to the second placeholder PID 1_1, and the disease ciphertext corresponding to the second placeholder PID1_2 in the correspondence including PID <NUM>, then, obtains the first key from a key management center, decrypts the found mobile phone ciphertext PhoneCT <NUM>, salary ciphertext, and disease ciphertext, to obtain mobile phone number plaintext: Phone <NUM>, salary plaintext information: <NUM>, and disease plaintext information: gastrosis respectively, then, may further obtain the pseudonymized user information from the data node based on the first placeholder PID <NUM>, replaces the first placeholder in the pseudonymized user information with the user identifier, and replaces the second placeholder in the pseudonymized user information with the sensitive data, to obtain the complete de-pseudonymized user information.

The data center node obtains the updated second key from the key management center, and then updates the user mapping table by using the to-be-updated first key and the second key. It should be noted that all users use a same key, and therefore during key update, ciphertext of all user identifiers and ciphertext of all sensitive data in the user mapping table need to be updated.

Specifically, step S218 may specifically include the following steps:.

During specific implementation, during key update, the user mapping table is obtained first. Tthe ciphertext of all the user identifiers and the ciphertext of the sensitive data in the user mapping table are decrypted one by one using the first key. The ciphertext of all the user identifiers and the ciphertext of the sensitive data are encrypted again using the second key, to obtain updated ciphertext of the user identifiers and updated ciphertext of the sensitive data. The ciphertext of the user identifiers and the ciphertext of the sensitive data in the user mapping table are updated respectively by using the updated ciphertext of the user identifiers and the updated ciphertext of the sensitive data. For example, after the key is updated for the user mapping table in Table <NUM>, a two-column user mapping table obtained after the key is updated is shown in Table <NUM>:.

It can be learned that during key update, only the ciphertext of the user identifier and the ciphertext of the sensitive data in the user mapping table need to be updated. Because the user identifier and the sensitive data in each data node are respectively replaced with the first placeholder and the second placeholder, the user information in each data node does not need to be processed, thereby dramatically reducing a key update workload.

It should be noted that for the operations: storage of the user information, de-pseudonymization, deletion of the user identifier or the sensitive data, and key update, not all of the operations are necessary, a sequence of all of the operations can be changed, and any one of the operations may be performed as required.

According to the user information processing method provided in this embodiment of the present invention, the correspondence between the first placeholder and the ciphertext of the user identifier and the correspondence between the second placeholder and the ciphertext of the sensitive data are stored in the user mapping table, the user identifier and the sensitive data in the node are pseudonymized, during deletion of the user information, only the correspondence between the first placeholder and the ciphertext of the user identifier needs to be deleted, during deletion of the sensitive data, only the correspondence between the second placeholder and the ciphertext of the sensitive data needs to be deleted, and during key update, only the ciphertext of the user identifier and the ciphertext of the sensitive data in the user mapping table need to be updated, thereby ensuring secure storage and efficient and fine-granularity deletion of the sensitive information of the user, and efficient key update.

In the following embodiments in <FIG>, a case in which a user mapping table includes a plurality of columns used for storage is described.

<FIG> is a schematic flowchart of still another user information processing method according to an embodiment of the present invention. The method may include the following steps.

Obtain user information of a user, where the user information includes a user identifier and user data.

This step is the same as step S101 in the embodiment shown in <FIG> or step S201 in the embodiment shown in <FIG>, and therefore details are not described herein again. A difference is that the user information includes the user identifier and user data, and the user data may further include sensitive data and non-sensitive data. For example, in user information in Table <NUM> that is obtained by a data center node, salary and disease are sensitive data, and home address and position are non-sensitive data. The user identifier and the sensitive data may be collectively referred to as sensitive information.

This step is the same as step S102 in the embodiment shown in <FIG>, and therefore details are not described herein again.

Store a correspondence among the first placeholder ciphertext of the user identifier and ciphertext of the sensitive data in a user mapping table, where the ciphertext of the user identifier is obtained by encrypting the user identifier by using a first key, and the ciphertext corresponding to the sensitive data is obtained by encrypting the sensitive data by using the first key. The user mapping table includes fields: a placeholder field, a user identifier ciphertext field, and a sensitive data ciphertext field. It should be noted that the user mapping table may include a plurality of sensitive data ciphertext fields.

Specifically, in this embodiment, the correspondence among the placeholder, the ciphertext of the user identifier and the ciphertext of the sensitive data is represented in a form of a multi-column user mapping table. For example, a user mapping table generated based on the user information in Table <NUM> is shown in Table <NUM>:.

Replace the user identifier in the user information with the first placeholder, and replace the sensitive data in the user information with the first placeholder, to obtain pseudonymized user information.

When the user information is to be stored in a data node, the user information needs to be pseudonymized, to protect data security. Specifically, the user identifier in the user information is replaced with the first placeholder, and the sensitive data in the user information is replaced with the first placeholder, to obtain the pseudonymized user information. The user information in Table <NUM> that is shown as an example above is still used as an example. User information obtained by pseudonymizing the user information is shown in Table <NUM>:.

Store the pseudonymized user information in at least one node.

In a possible implementation, the entire user information needs to be deleted. For a deletion process, refer to the description of the corresponding part in the foregoing embodiment.

In another possible implementation, the sensitive data is deleted at a fine granularity. <FIG> is a schematic flowchart of still another user information processing method according to an embodiment of the present invention. The method may include the following steps:.

Specifically, the data center node receives the sensitive data deletion request from the user. The sensitive data deletion request includes the user identifier and indication information for deleting the sensitive data, and the indication information is used to instruct to delete ciphertext of sensitive data of a field. Then, the correspondence including the ciphertext of the user identifier is obtained from the user mapping table. That is, the ciphertext of the sensitive data may be found, and the ciphertext of the sensitive data in the correspondence in the user mapping table is cleared. The ciphertext of the sensitive data is cleared, so that the sensitive data cannot be obtained through decryption, thereby achieving an objective of deleting the sensitive data.

For example, the sensitive data deletion request is received, and the request carries a mobile phone number Phone <NUM> and an indication for deleting salary data. In this case, Phone <NUM> is encrypted to obtain PhoneCT <NUM>, a correspondence including PhoneCT <NUM> is found in the user mapping table shown in Table <NUM>, then a salary ciphertext field is found, and the salary ciphertext field in the correspondence is cleared, and an obtained user mapping table in which the sensitive data is deleted is shown in Table <NUM>:.

The following describes the foregoing specific de-pseudonymization process by using a specific example. For example, the data center node is authorized to actively de-pseudonymize the first piece of user information in Table <NUM>. First, the data center node retrieves and obtains the pseudonymized user information in the data node based on the first placeholder PID <NUM> in the pseudonymized user information, then, obtains the mobile phone ciphertext PhoneCT <NUM>, salary ciphertext, disease ciphertext in the correspondence including PID <NUM>, then, obtains the first key from a key management center, decrypts the found mobile phone ciphertext PhoneCT <NUM>, salary ciphertext, and disease ciphertext, to obtain mobile phone number plaintext: Phone <NUM>, salary plaintext information: <NUM>, and disease plaintext information: gastrosis respectively, and then, replaces the first placeholder PID <NUM> in the fields of "user identifier", "salary" and "disease" in the first piece of user information in Table <NUM> with the user identifier, the salary plaintext information "<NUM>", and the disease plaintext information "gastrosis" respectively. In this replacement process, a field name in Table <NUM> needs to be associated with a field name in the mapping table. For example, the first placeholder PID <NUM> in the field of "salary" in Table <NUM> needs to be replaced with a decryption result of the field of "salary ciphertext" in the mapping table, that is, replaced with salary plaintext. Other fields are processed similarly.

To ensure key security, the key management center may periodically update the key. A key update process is similar to the description of the corresponding part in the foregoing embodiment, and therefore details are not described herein again.

According to the user information processing method provided in this embodiment of the present invention, the correspondence between the placeholder and each of the ciphertext of the user identifier and the ciphertext of the sensitive data is stored in the user mapping table, the user identifier and the sensitive data in the node are pseudonymized, during deletion of the user information, only the correspondence between the placeholder and the ciphertext of the user identifier needs to be deleted, during deletion of the sensitive data, only the correspondence between the placeholder and the ciphertext of the sensitive data needs to be deleted, and during key update, only the ciphertext of the user identifier and the ciphertext of the sensitive data in the user mapping table need to be updated, thereby ensuring secure storage and efficient and fine-granularity deletion of the sensitive information of the user, and efficient key update.

In a further implementation, predistribution is performed in a data table based on a field, so that data including a same field value is distributed in a same node. In this case, when different data tables are associated by using the field value, data association needs to be performed only in the node, and no cross-node association is required, thereby improving efficiency of association between different data tables.

There are many predistribution methods. For example, for data in a table, if a modulus result N is obtained after a hash value of a field mod a quantity of data nodes, the data is stored in a node N. Hash values of content of a same field are the same, and therefore nodes to which data is stored are also the same.

In a de-pseudonymization process, to obtain plaintext corresponding to personal data ciphertext in a user data table in a big data node, the user data table needs to be first associated with a mapping table by using a placeholder, to obtain the corresponding personal data ciphertext, and then the ciphertext is decrypted. To implement rapid association, predistribution is performed in the mapping table and the user data table based on a placeholder by using a big data calculation feature.

Similarly, in a pseudonymization process, to obtain a placeholder corresponding to personal data plaintext in a user data table, deterministic encryption is first performed on personal data including a personal identifier, and then the encrypted user data table is associated with a mapping table by using ciphertext of the personal identifier, to obtain the corresponding placeholder. To implement rapid association, predistribution is performed in the mapping table and the encrypted user data table based on the ciphertext of the personal identifier by using a big data calculation feature.

The method according to the embodiments of the present invention is described above in detail, and an apparatus according to the embodiments of the present invention is provided below.

<FIG> is a schematic modular diagram of a user information processing apparatus according to an embodiment of the present invention. The apparatus <NUM> includes a first obtaining unit <NUM>, a generation unit <NUM>, a storage unit <NUM>, and a pseudonymization unit <NUM>.

The first obtaining unit <NUM> is configured to obtain first user information of a user, where the first user information includes a user identifier and first user data.

The generation unit <NUM> is configured to generate a first placeholder.

The storage unit <NUM> is configured to store a correspondence between the first placeholder and ciphertext of the user identifier in a user mapping table, where the ciphertext of the user identifier is obtained by encrypting the user identifier using a first key.

The pseudonymization unit <NUM> is configured to pseudonymize the first user information to obtain pseudonymized first user information, where the pseudonymizing the first user information includes replacing the user identifier in the first user information with the first placeholder.

The storage unit <NUM> is further configured to store the pseudonymized user information in at least one node.

Further, when the user information processing apparatus collects again or re-collects the user information,.

Further, the following separately describes details (not shown) of modules in cases of a two-column user mapping table and a multi-column user mapping table.

In the case of the two-column user mapping table,.

The generation unit is specifically configured to generate the second placeholder based on the first placeholder and a field attribute corresponding to the ciphertext of the sensitive data.

Further, to ensure key security, a key management center may periodically update the key. Therefore, the user information processing apparatus may further include:.

The key update unit is specifically configured to:.

Further, the user needs to have a right to delete the user information of the user. In a possible implementation, the entire user information needs to be deleted, and the user information processing apparatus may further include:.

In another possible implementation, the sensitive data is deleted at a fine granularity, and the user information processing apparatus may further include:.

The destroying the correspondence includes deleting the correspondence or clearing an item in the correspondence.

Further, after the user information processing apparatus stores the pseudonymized user information in the data node, the user information processing apparatus may subsequently receive a data query request from the user, that is, the user expects to view the user information of the user. Alternatively, in another scenario, as credited by the user, the user information processing apparatus may actively extract the user information from the data node and analyze the user information, to help provide a personalized server for the user. In the two cases, data needs to be restored from pseudonymized data stored in the data node (that is, a de-pseudonymization process).

In another implementation, when the user information processing apparatus actively extracts the user information from the data node and analyzes the user information, the user information processing apparatus may further include:.

In another implementation, when the user information processing apparatus receives a user information obtaining request from the user, the user information processing apparatus may further include:.

In the case of the multi-column user mapping table,.

For implementation of functions of these units, refer to the description in the foregoing method embodiments.

According to the user information processing apparatus provided in this embodiment of the present invention, the correspondence between the placeholder and the ciphertext of the user identifier is stored in the user mapping table, and the user information in the node is pseudonymized, so that all subsequent operations on the user information can be performed in the user mapping table, and there is no need to perform processing in the node, thereby implementing simpler, more efficient, securer, and more reliable processing of the user information.

<FIG> is an architectural diagram of hardware of a user information processing device according to an embodiment of the present invention. The user information processing device <NUM> may include a memory <NUM>, a processor <NUM>, and a communications interface <NUM>. The memory <NUM>, the processor <NUM>, and the communications interface <NUM> are connected to each other by using a bus <NUM>.

The processor <NUM> is configured to control an operation of the user information processing device <NUM>, and the processor <NUM> may also be referred to as a central processing unit (English: central processing unit, CPU for short). In specific application, the various components of the user information processing device <NUM> are coupled to each other by using a bus system. In addition to a data bus, the bus system may further include a power bus, a control bus, a status signal bus, and the like. However, for clarity of description, various buses are referred to as the bus system in <FIG>.

The memory <NUM> may be a read-only memory (English: read-only memory, ROM for short) or a random access memory (English: random access memory, RAM for short), or may be another memory or a storage medium, and provides an instruction and data for the processor <NUM>. A part of the memory <NUM> may further include a non-volatile random access memory (English: non-volatile random access memory, NVRAM for short). The memory <NUM> stores an operating system, an operation instruction, and an executable module or data structure, or a subset or an extension set thereof. The operation instruction may be various operation instructions, and the various operation instructions are used to implement various operations. The operating system may include various system programs used to implement various basic services and process a hardware-based task. The memory <NUM> further stores data, signaling, and the like used in this embodiment of this application.

The processor <NUM> may be an integrated circuit chip and has a signal processing capability. In an implementation process of this embodiment of this application, various steps performed by the user information processing device in this embodiment of this application may be completed by an integrated logic circuit of the hardware in the processor <NUM> or an instruction in a form of software. The processor <NUM> may be a general purpose processor, a digital signal processor (English: digital signal processor, DSP for short), an application-specific integrated circuit (English: application-specific integrated circuit, ASIC for short), a field programmable gate array (English: field-programmable gate array, FPGA for short) or another programmable logic device, a discrete gate or a transistor logic device, or a discrete hardware component. The processor may implement or perform the various methods, steps, and logical block diagrams disclosed in the embodiments of this application. The general purpose processor may be a microprocessor, or the processor may be any conventional processor or the like. The steps of the methods disclosed with reference to the embodiments of this application may be directly performed and completed by a hardware decoding processor, or may be performed and completed by using a combination of hardware in a decoding processor and a software module. The software module may be located in a mature storage medium in the art, such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, an electrically erasable programmable memory, or a register.

The communications interface <NUM> may be configured to receive or send information/data, for example, configured to: receive user information and the like fed back by a terminal device, and generate a signal related to function control, to process the user information.

The processor <NUM> runs the program in the memory, to perform the following operations:.

In a possible implementation, the processor <NUM> is further configured to perform the following operations:.

In another possible implementation, the first user data includes sensitive data, and the processor <NUM> is further configured to perform the following operations:.

In still another possible implementation, the generating a second placeholder based on the first placeholder includes:
generating the second placeholder based on the first placeholder and a field attribute corresponding to the ciphertext of the sensitive data.

In still another possible implementation, the first user data includes sensitive data, and the processor <NUM> is further configured to perform the following operations:.

In still another possible implementation, the first placeholder is globally unique.

In still another possible implementation, the processor <NUM> is further configured to perform the following operations:.

In still another possible implementation, that the processor <NUM> performs the operation of updating the user mapping table by using the first key and the second key includes:.

In still another possible implementation, the destroying the correspondence includes deleting the correspondence or clearing an item in the correspondence.

In still another possible implementation, the processor <NUM> is further configured to perform the following operations: after storing the pseudonymized user information in the at least one node:.

For details, refer to the description in the foregoing method embodiments.

It may be understood that <FIG> merely shows a simplified design of the user information processing device. In actual application, the user information processing device may further include other necessary elements, including but not limited to any quantity of transceivers, processors, controllers, and memories. All terminal devices that can implement the present invention fall within the protection scope of the present invention.

According to the user information processing device provided in this embodiment of the present invention, the correspondence between the placeholder and the ciphertext of the user identifier is stored in the user mapping table, and the user information in the node is pseudonymized, so that all subsequent operations on the user information can be performed in the user mapping table, and there is no need to perform processing in the node, thereby implementing simpler, more efficient, securer, and more reliable processing of the user information.

According to still another aspect of this application, a computer readable storage medium is provided. The computer readable storage medium stores an instruction, and when the instruction is run on a computer, the computer is enabled to perform the method according to the foregoing aspects.

A person of ordinary skill in the art may be aware that units and algorithm steps in the examples described with reference to the embodiments disclosed in this specification may be implemented by electronic hardware or a combination of computer software and electronic hardware.

It may be clearly understood by a person skilled in the art that for the purpose of convenient and brief description, for a detailed working process of the foregoing system, apparatus, and unit, refer to the corresponding process in the foregoing method embodiments.

The indirect couplings or communication connections between the apparatuses or units may be implemented in an electronic form, a mechanical form, or another form.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one position, or may be distributed in a plurality of network units. Some or all of the units may be selected based on an actual requirement to achieve the objectives of the solutions of the embodiments.

All or some of the foregoing embodiments may be implemented by software, hardware, firmware, or any combination thereof. When software is used to implement the embodiments, some or all of the embodiments may be implemented in a form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, some or all of the procedures or functions according to the embodiments of the present invention are generated. The computer may be a general purpose computer, a dedicated computer, a computer network, or another programmable apparatus. The computer instructions may be stored in a computer readable storage medium, or may be transmitted by using the computer readable storage medium. The computer instructions may be transmitted from a website, computer, server, or data center to another website, computer, server, or data center in a wired (for example, a coaxial cable, an optical fiber, or a digital subscriber line (DSL)) or wireless (for example, infrared, radio, or microwave) manner. The computer readable storage medium may be any usable medium accessible by a computer, or a data storage device, such as a server or a data center, integrating one or more usable media. The usable medium may be a magnetic medium (for example, a floppy disk, a hard disk, or a magnetic tape), an optical medium (for example, a DVD), a semiconductor medium (for example, a solid state disk (Solid State Disk, SSD)), or the like.

Claim 1:
A user information processing method, wherein the method comprises:
obtaining (<NUM>) first user information of a user, wherein the first user information comprises a user identifier and first user data;
generating (<NUM>) a first placeholder, wherein the first placeholder is a globally unique random number or a globally unique random string;
storing (<NUM>) in a user mapping table a correspondence between a ciphertext of the user identifier and the globally unique random number or the globally unique random string,
wherein the ciphertext of the user identifier is obtained by encrypting the user identifier using a first key;
pseudonymizing (<NUM>) the first user information to obtain pseudonymized first user information, wherein the pseudonymizing the first user information comprises replacing the user identifier in the first user information with the globally unique random number or the globally unique random string; and
storing (<NUM>) the pseudonymized first user information in at least one node.