DataWorks:Data masking

Introduction

Data masking protects sensitive data during its use and transfer and prevents unauthorized exposure. It applies masking or transformation algorithms to sensitive data, identified based on data classification and grading, to ensure secure data presentation in various scenarios.

1. Static desensitization

   • Purpose: Permanently replaces and masks sensitive data when it is written from a source to a destination. The destination stores the masked data, permanently replacing the original data.

   • Use cases: Primarily used for real-time synchronization tasks in DataWorks Data Integration. For example, you can mask real user data from a production database and then synchronize it to a development or test environment for developers to use securely.

   • Features:

     • Physical replacement: The replacement is permanent, providing a high level of security.

     • Data watermark: Supports embedding an invisible digital watermark during the masking process. If a data leak occurs, you can use the watermark to trace the source of the leak.

2. Dynamic desensitization

   • Purpose: Masks sensitive data in real time based on preset policies when users query or access the data. The physically stored original data remains unchanged. Different users see different results when accessing the same data.

   • Use cases: Used to control data visibility for different user roles in a production environment. For example, when a customer service representative queries a user table, a phone number is displayed as "138****1234", whereas their supervisor can see the complete phone number.

   • Features:

     • On-demand masking: Does not alter the original data, offering high flexibility and balancing data security with business usability.

     • Multi-layered protection:

       • Application-level masking: The policy takes effect only when data is accessed through specific DataWorks modules.

       • Engine-level masking (MaxCompute/Hologres): The policy is enforced at the database engine layer. It takes effect regardless of the access tool and has the highest priority.

Core configuration: For both static and dynamic data masking, you create masking rules. A rule specifies a Desensitization mode, such as hashing, masking, or replacement, for a specific Data Type, such as 'phone number'. For dynamic data masking, you also configure a Desensitization strategy to define who triggers these rules and under what conditions.

Limitations

• Applicable users: This feature is available to DataWorks Professional Edition or Enterprise Edition users who have enabled the new version of data security in Security Center.

• Supported regions: China (Hangzhou), China (Shanghai), China (Beijing), China (Zhangjiakou), China (Ulanqab), China (Shenzhen), China (Chengdu), China (Hong Kong), Japan (Tokyo), Singapore, and Indonesia (Jakarta).

• Supported compute engines: MaxCompute and Hologres.

Prerequisites

• The Alibaba Cloud account or a RAM user that you use must meet one of the following conditions:

  • The Alibaba Cloud account or RAM user is attached with the AliyunDataWorksFullAccess policy.

  • The Alibaba Cloud account or RAM user is assigned the tenant security administrator role of DataWorks.

  • The Alibaba Cloud account or RAM user is assigned the tenant administrator role of DataWorks.

• Complete the tasks in the New user guide.

Accessing the data masking page

1. Log on to the DataWorks console. In the top navigation bar, select the desired region. In the left-side navigation pane, choose Data Governance > Security Center. On the page that appears, click Go to Security Center.

2. In the left-side navigation pane, choose Sensitive Data Protection > Data desensitization.

Dynamic data masking policies

Engine desensitization

Engine-level masking is supported for MaxCompute and Hologres. The configuration process is similar to that for dynamic data masking policies, but the supported masking methods differ. For more information, see Dynamic data masking policies.

Static desensitization

Static data masking physically replaces sensitive data at the destination, permanently overwriting the original data.

1. On the Data Masking page, click the Static desensitization tab to go to the list of static masking rules.

2. In the upper-left corner, click New Rule to configure a static masking rule. The following table describes the key parameters.

   Parameter	Description
   Data Type	Select the data type to which you want to apply the masking rule, such as "Bank Card Number". You can select an existing type or create a new one.
   Desensitization rule name	Specify a clear and descriptive name for the rule.
   Desensitization mode	Select a masking method, such as Masking desensitization, Hash Desensitization, or Custom Paohenge transformation. Masking desensitization: Precisely define the character ranges to mask or preserve. For example, for Left to right, mask characters 1 to 2, and do not mask characters 3 to 4. Hash Desensitization: Set a salt value to increase the security of the hash. Custom Paohenge transformation: Set the feature value and the character set for replacement.
   Data watermark	If enabled, the system embeds an invisible watermark into the data during the masking operation. This watermark helps trace the source of sensitive data. For more information, see Data Traceability.
   Enabled	Select Enable Now or Not Enabled. Only enabled rules take effect in relevant synchronization tasks.
   Effect Verification	Use the verification tool to check the masking effect. Enter sample data in the Raw data box, click Verify now, and verify that the Data after desensitization is correct.

3. Click Confirm to save the rule.