Dynamic desensitization whitelists allow specified users to access plaintext data during defined periods and scenarios without affecting query results. You can create, edit, clone, and delete whitelist rules as needed.
Permission description
-
Security administrators and global custom roles with permissions for desensitization rule and data classification management can create and manage dynamic desensitization whitelists.
-
Primary directory administrators can configure desensitization whitelists for the data classifications under their purview.
-
Owners of desensitization rules can manage the whitelists they oversee, subject to data classification management permissions.
Create dynamic desensitization whitelist rules
-
Navigate to the Dataphin home page, in the top menu bar, select Administration > Data Security.
-
In the left-side navigation pane, choose Sensitive Data Protection > Desensitization Rule. On the Desensitization Rule page, single click the Dynamic Desensitization Whitelist tab, then single click the +create Dynamic Desensitization Whitelist button.
-
In the Create Dynamic Desensitization Whitelist dialog box, fill in the parameters as follows:
Parameter
Description
Whitelist Name
Enter a name for the whitelist. The name must meet the following requirements:
-
Supports Chinese, English, numbers, underscores (_), and hyphens (-).
-
Must not exceed 50 characters.
Whitelist Description
Provide a description for the whitelist.
Data Class
Choose the data classifications for which you have management permissions.
Escape Account
Select the user account to which the whitelist will apply.
Effective Scenario
Select the scenario in which the whitelist takes effect. Supported scenarios include Ad Hoc Query and Write Into Dev Table.
Effective Scope
Configure the effective scope of the whitelist. All conditions use an and relationship, meaning only tables that meet all criteria are included in the whitelist and exempt from desensitization during queries. You can scope by business unit, table project, and data table.
-
Business Unit: Select the business segment for the data table.
-
Select All to include all business segments.
-
Choose Enumeration and specify the business segments. Multiple selections are allowed.
-
Select Customize and enter a regular expression to match the business segments. For instance, to match all segments containing "test" in their names, use the regular expression
.*test.*.
-
-
Table Project: Select the project for the data table.
-
Select All to include all projects.
-
Choose Enumeration and specify the projects. Multiple selections are allowed.
-
Select Customize and enter a regular expression to match the projects. For example, to match all projects with "test" in their names, use the regular expression
.*test.*.
-
-
Data Table: Select the data table.
-
Select All to include all tables under the project.
-
Choose Customize and enter a regular expression to match the data tables. For instance, to match all tables with "test" in their names, use the regular expression
.*test.*.
-
Effective Period
Set the time period during which the whitelist is effective.
Effective Status
Specify whether to enable the whitelist.
-
-
Click OK to finalize the creation of the dynamic desensitization whitelist.
View dynamic desensitization whitelist rules
You can view desensitization objects, effective accounts, effective periods, filter scenarios, and the status of each whitelist rule.
|
Area |
Description |
|
①Filter and Search Area |
Search by whitelist name or data classification keyword, or filter by Effective Scenario. |
|
②List Area |
Displays columns including Whitelist Name, Data Classification, Escape Account, Owner, Effective Period, Effective Status, Update Time, and Effective Status. You can also Edit, Clone, or Delete entries from the Actions column.
|