Data watermark

Updated at:
Copy as MD

This topic describes how to embed a watermark in a file exported from DMS and how to extract watermark information from an external file.

Prerequisites

The sensitive data protection feature is enabled for the instance. For more information, see Enable sensitive data protection.

Use cases

This feature traces the source of data during its distribution.

Usage notes

  • Use data watermark embedding when you export more than 200 rows of data.

  • To use the watermark extraction feature, ensure that the file contains more than 200 rows of data. Otherwise, watermark extraction may fail.

Watermark embedding

Watermark embedding is the process of embedding identification information into data or a file to make it traceable.

Set watermark before ticket creation

This method requires you to enable file watermarks in Configuration Management (global configuration). After this feature is enabled, a watermark is automatically added to all SQL Result Set Export tickets created by users in the tenant. The watermark format is username + export time, and files are exported in EXCEL format by default.

Step 1: Enable file watermarks in Configuration Management

  1. Log in to DMS 5.0.

  2. In the top navigation bar, choose O&M > Configuration Management.

    Note

    If you use the DMS console in simple mode, move the pointer over the 2023-01-28_15-57-17.png icon in the upper-left corner of the DMS console and choose All Features > O&M > Configuration Management.

  3. In the search box, enter the keyword file watermark and click the search icon.

    The search results show the parameter Enable file watermark for SQL Result Set Export. The current parameter value is N (disabled). The parameter description specifies that Y indicates enabled and N indicates disabled. Click Edit in the Actions column to modify the parameter value.

  4. Click Change, change the parameter value to Y, and then click Confirm Change.

Step 2: Create an SQL Result Set Export ticket

For detailed steps, see Set a watermark when you create an SQL Result Set Export ticket.

Note

After you enable file watermarks in Configuration Management, the Embed watermark option is no longer displayed when you create an SQL Result Set Export ticket.

Set watermark during ticket creation

  1. Log in to DMS 5.0.

  2. In the top navigation bar, choose Database Development > Data Export > SQL Result Set Export.

  3. Configure the following parameters:

    Parameter

    Description

    Database name (Required)

    Select the target database.

    Note

    You must have export permissions on this database. For more information, see View my permissions.

    Reason category (Required)

    Select the reason for exporting the data. This helps you find the ticket later.

    Business background (Required)

    Describe the reason or objective for the data export in detail for clearer communication.

    Affected rows (Required)

    To estimate the number of data rows that will be affected by this export, you can use the count command in the SQL Console.

    Note

    During the precheck, the system displays the actual number of affected rows. You can verify this number to ensure that it meets your expectations and to prevent data security incidents.

    Skip validation (Optional)

    Specifies whether to skip the validation. If you select Skip Validation, you must also provide a reason.

    Warning

    If you select Skip Validation, DMS does not check the number of affected rows. If the data volume is large, this may introduce risks to your production workloads. Use this option with caution.

    Stakeholders (Optional)

    The specified stakeholders can view and collaborate on the ticket. Users who are not stakeholders cannot view the ticket, except for administrators and the DBA.

    Export SQL statement (Required)

    Enter an executable SQL statement, such as SELECT * FROM testtable. When you submit the request, DMS automatically validates the syntax. You cannot submit the request if the syntax is incorrect.

    Note

    Only SELECT query statements are supported.

    Embed watermark (Required)

    Select Yes.

    Embedding method (Required)

    Select an embedding method:

    • Data watermark: Embeds identification information into the data itself. The watermark is invisible to users.

    • File watermark: Embeds identification information into the file. The watermark is visible to data users.

    Data watermark information/File watermark information (Required)

    Enter the watermark information.

    Watermark embedded field (Optional)

    Enter the field where the watermark will be embedded.

    Note

    If you do not specify a field, the system selects one by default.

    Primary key/Unique key (Optional)

    Enter the primary key or unique key. Use commas (,) to separate multiple keys.

    Note

    Providing this information significantly improves the robustness of the data watermark.

    Attachments (Optional)

    You can upload images or documents to provide additional context for the export operation.

  4. After you configure the parameters, click Submit and await approval.

    The system runs an SQL precheck.

  5. Click Submit for Approval and wait for the request to be approved.

    You can view the approval progress in the Approval section of the ticket details page.

    Important

    You must perform the export within 24 hours after the ticket is approved. After this period, the ticket expires, and you must create a new one. For an instance in Security Collaboration mode, you can adjust the time window for performing the export after approval. To do this, navigate to the Security Rules > Data Export settings associated with the instance, and modify the Period for Performing Export after Export Request of SQL Result Set Is Approved parameter.

  6. In the Execute/Automatic Execution section, click Export.

  7. In the Export Settings dialog box, configure the export format.

    Parameter

    Description

    Format (Required)

    The file format for the export. Supported formats include CSV, EXCEL, SQL, and JSON (for NoSQL).

    Note

    If you chose to embed a file watermark, select EXCEL as the export format.

    Character set (Required)

    The character set for the exported content. Supported character sets include Default character set, GBK, UTF-8, and ISO-8859-1.

    Execution strategy (Required)

    The execution strategy. The following options are supported:

    • Run immediately: The system starts the export immediately.

    • Schedule: The system starts the export at a specified time. This is useful for avoiding peak business hours.

      Note

      You cannot modify the configuration after setting a schedule.

    Export mode (Required)

    The export mode. The following options are supported:

    • Speed Mode: The export task cannot be interrupted.

    • Standard Mode: The export task can be interrupted during execution.

    Export timeout (Required)

    The timeout period for the export task, in seconds. The value can range from 0 to 2,147,483. If you do not configure this parameter, the instance-level export timeout is used by default. To view the instance-level export timeout, see Add a database instance to DMS.

    Note

    If the task duration exceeds the specified timeout period before the export is complete, the task fails.

    Add Field Comment (Optional)

    This parameter is available only when the database is of the MySQL type and the export format is CSV.

    If you enable this option, DMS adds a row of field comments below the field name row in the exported file.

    For example, if the field name row contains id, gmt_create, buyer_nam, and seller_nam, the next row displays the corresponding comments, such as primary key, creation time, buyer, and seller, followed by the actual data rows.

    Note

    The system performs the export based on the specified configurations. You can view the export progress in the console.

  8. After the system completes the export, click Download Exported File to download the file to your local computer.

Watermark extraction

For imperceptible watermarks, you can use the watermark extraction feature in DMS to detect whether a file contains embedded watermark information.

  1. Log in to DMS 5.0.

  2. In the top navigation bar, choose Security and Specifications > Data watermark.

  3. On the Data watermark ticket application page, configure the following parameters:

    Parameter

    Description

    File type (Required)

    Select the type of file you want to extract the watermark from. Valid values:

    • CSV

    • EXCEL

    File (Required)

    Upload the file you want to extract the watermark from.

    Note

    Only .xlsx and .csv files are supported.

    Business background (Required)

    Enter the purpose of extracting the file watermark for clearer communication.

    Database name (Optional)

    Select the target database.

    Primary key/Unique key (Optional)

    Enter the primary key or unique key. Use commas (,) to separate multiple keys.

    Note

    To ensure extraction accuracy, if you specified a primary key or unique key during watermark embedding, you must specify the same keys for watermark extraction.

    Watermark embedded field (Optional)

    Enter the field where the watermark is embedded.

  4. Click Submit.

  5. After the ticket is approved, click Execute in the Execute/Automatic Execution section.

    After successful execution, you can view the watermark extraction status and details.