DataWorks:Data tracing

Limitations

• Edition: DataWorks Professional Edition or Enterprise Edition. You must also enable the new data security features in Security Center.

• Supported regions: China (Hangzhou), China (Shanghai), China (Beijing), China (Zhangjiakou), China (Ulanqab), China (Shenzhen), China (Chengdu), China (Hong Kong), and Japan (Tokyo).

• Supported compute engines: MaxCompute and Hologres.

Prerequisites

Before you begin, ensure that you have:

• An Alibaba Cloud account or RAM user with one of the following:

  • The AliyunDataWorksFullAccess policy attached

  • The tenant security administrator role in DataWorks

  • The tenant administrator role in DataWorks

• Completed the new user guide

How it works

Data tracing relies on digital watermarks embedded in masked data. For a file to be traceable, complete the following three steps in order — each step builds on the previous one.

Step 1: Classify the data as sensitive

In Sensitive Data Protection > Data classification grading, run a detection task on the target data field (for example, user_phone) and mark it with a data type (for example, Phone Number).

For more information, see Data classification and grading.

Step 2: Configure a masking rule

In Sensitive Data Protection > Data Desensitization, configure a masking rule for the data type (for example, Phone Number) and define a masking policy to set its scope.

For more information, see Data masking.

Step 3: Enable digital watermarking in the masking rule

When configuring or editing a data desensitization rule, set the Data Watermark option to enabled.

When all three steps are complete, the system embeds an invisible watermark — containing the operator, operation time, and SQL query — into the data each time it is masked. After a masked and watermarked CSV file is queried and exported from a module such as Data Analysis or Data Development, the data tracing feature can parse the file to identify the breach source.

Data Tracing Task List

After you enter the Data Traceability page, the system displays all tracing tasks created under the current tenant in a list by default. The list includes columns such as Task Name, Creation time, Traceability Document, Task Status, and Operation. The Traceability Document column is displayed as a clickable link. Click the link to download the original CSV file you uploaded in a new window.

Task status has two values: In execution and Completed. When a task is in the In execution state:

• The View and Delete buttons in the row actions are unavailable.

• Row-level checkboxes are unavailable. Bulk deletion selects only completed tasks.

• The page auto-refreshes the status every 10 seconds until the task becomes Completed.

Create a data tracing task

1. Log on to the DataWorks console. In the top navigation bar, select the target region. In the left-side navigation pane, choose Data Governance > Security Center, then click Go to Security Center.

2. In the left navigation pane, choose Sensitive Data Protection > Data Traceablity.

3. On the Data Tracing page, click New Task in the upper-left corner.

View data tracing results

When a task's Task Status changes to Completed, click View in the Operation column to see the results.

If a potential breach source is detected, the results include the following fields:

Confidence

Operation facts

Scope

When no potential breach source is detected: the details dialog does not display a results table and instead shows a prompt message. Possible reasons include:

• The tracing file has no watermark, or the watermark does not match your data watermark.

• The data volume after deduplication is less than 500 entries, which is insufficient to reconstruct the watermark.

We recommend that you check whether the uploaded file was processed by a masking rule with digital watermarking enabled, and ensure sufficient data volume after deduplication.

Delete a data tracing task

Delete a single task from the Actions column, or select multiple tasks and delete them in bulk.

What's next

• Data classification and grading

• Data masking