Dataphin Asset Security provides unified sensitive data detection and protection across the data lifecycle. By combining data classification, grading, and masking, it helps you build a robust data security framework and ensure compliant data usage.
Prerequisites
The asset security value-added service is purchased and the current tenant has activated the asset security module. For activation, see Tenant management.
Scenarios
Typical scenarios for data security protection in Dataphin:
-
Scenario 1: Sensitive Data Protection in Business Data
Use sensitive data detection and masking to protect plaintext data. For example, "Zhang San" is masked to "*San."
-
Scenario 2: Data Warehouse Construction in the Development Environment
When you transfer sensitive data from production to development environments, built-in detection and masking rules automatically obscure it. This keeps sensitive data confined to the production environment and prevents exposure in less secure development areas.
-
Scenario 3: Flexible Use of Masking Whitelist
The masking whitelist allows designated users to view unmasked data for a specified period. For example:
-
Company executives who need temporary access to plaintext financial data can be added to the whitelist with a set validity period.
-
During e-commerce promotions that require actual sales figures, users can be added to the whitelist for a specified duration to view unmasked sales data.
-
Advantages
-
Rich Built-in Resources: Dataphin provides a wide range of built-in resources, including data classification and grading, sensitive data detection rules, and masking algorithms, enabling you to quickly set up a baseline data security system.
-
Flexible Customization of Detection and Masking Support: You can tailor detection rules by range and priority, with manual adjustments available, to build a comprehensive multi-level, and multi-realm detection rule system. Masking rules support various algorithms with customizable parameters for different data protection requirements.
-
Close Integration with Production and Development Scenarios: Asset security integrates with data forwarding in development and production workflows, ensuring data security throughout the Dataphin data development cycle.
Terms
|
Module |
Concept |
Explanation |
|
Sensitive Data Detection |
Data Grading |
Data grading assigns sensitivity levels to data, from L1 (public) to L4 (top secret) in Dataphin's built-in system. Custom grading tailored to your enterprise needs is also supported. |
|
Data Classification |
Data classification categorizes data by usage domain to differentiate sensitivity levels. For example, company business data is typically more sensitive than production workshop sensor data. Dataphin's built-in classifications include company data, business data, and personal data, with support for custom classifications. |
|
|
Detection Rules |
Detection rules are automated policies for identifying sensitive fields. In production environments with thousands of tables and tens of thousands of fields, manual labeling is impractical. Dataphin can automatically detect sensitive fields based on rules by analyzing field names or content. You can also configure rule priority and scan range to build a comprehensive detection rule system. |
|
|
Identification Record |
The identification record module logs the results of all detection rule executions, showing which rule was triggered by each field and the corresponding sensitivity level and classification. For fields that require special attention, you can manually modify detection rules to ensure accurate results. |
|
|
Sensitive Data Protection |
Data Masking Rules |
Data masking rules define how detected sensitive fields are protected. Methods such as redaction and hashing are available, and you can bind masking rules to detection rules on a one-to-one basis. Rules can be scoped to specific projects when different fields require different treatments. |
|
Data Masking Algorithm |
Lists all supported masking algorithms, including redaction (e.g., "Zhang San" becomes "*San") and hashing (e.g., salted MD5). |
|
|
Dynamic De-identification |
Does not alter the underlying data storage; data is masked only during consumption. Typical use cases include ad hoc queries for data analysis, transferring production data to development environments, and providing data services in data consumption scenarios. |
|
|
Static De-identification |
Modifies the underlying data storage directly; data is encrypted or masked at the storage level, such as with common pn_md5. Typical use cases include encrypting sensitive data during data integration and masking application layer data during data warehouse layering construction. |
|
|
Dynamic Masking Whitelist |
Used to grant temporary real data query access to certain users for specific business objectives. Common use cases include troubleshooting in data development and disclosing sales data during events such as Double 11. |
Asset security usage flow
-
For managing data classifications, see Manage Data Classification and . For data grading tasks, refer to Manage Data Grading and .
Start by defining data classification and grading.
-
For guidance on how to create, configure, and manually trigger detection rules, along with manage them, see this document and .
Dataphin lets you define custom detection rules for sensitive data. These rules run automatically on a daily scan schedule and can also be triggered manually for immediate scanning.
-
Managing Detection Results and .
Review the results from the detection rules.
-
For more information on the data masking algorithm and the , see the referenced documents.
Choose a suitable data masking algorithm from those available within Dataphin.
-
Manage Dynamic Masking Rules and .
Set up masking rules for sensitive fields to protect them.
Notes
Enabling asset security to mask sensitive data can affect data development, querying, and analysis. Key scenarios to consider:
-
Data Query
For example, a local life service provider may receive many complaints in a specific area. If data masking limits addresses to the city level, pinpointing the exact streets with concentrated complaints becomes difficult, affecting operational decision-making.
-
Production Data Writing to Development Environment, Test Environment Data Preparation
For example, a script task needs to check the number of digits in a phone number. If the data table applies the MD5 masking algorithm, an 11-digit phone number becomes a 32-character string, preventing the script from working as expected.
When using asset security, carefully evaluate both security regulations and business requirements to maintain operational continuity while ensuring data compliance.