Configure data masking

Procedure

1. Log on to the DataWorks console. In the target region, click Data Development and O&M > Data Development in the left-side navigation pane. Select a workspace from the drop-down list and click Go to Data Development.

2. Hover over the icon and choose Create Node > Data Integration > Real-time Synchronization.

   Alternatively, expand a scheduled workflow, right-click it, and choose Create Node > Data Integration > Real-time Synchronization.

3. In the Create Node dialog box, set Synchronization Method to Single Table (Topic) to Single Table (Topic) ETL, enter a Name, and select a Path.

4. Click Confirm.

5. On the configuration tab of the real-time synchronization node, drag Conversion > Data Masking to the canvas. Then, connect the data masking node to the configured reader node.

6. Click the Data Masking node. In the Data Masking dialog box, configure the parameters.

   

   1. Create a Masking Rule: Click Create Masking Rule. In the Create Masking Rule dialog box, select the Sensitive Data Type, Masking Rule Name, Masking Method, Security Domain, and Replace Character Set.

      1. Create a data masking rule

         1. Configure basic information

            Parameter	Description
            Sensitive Data Type	By default, Select Existing is selected. You can select a predefined or user-created sensitive data type from the drop-down list. You can also select Add Type and enter a name for the new sensitive data type. The name must be 1 to 30 characters in length and can contain Chinese characters, letters, and digits. When naming a new sensitive data type, the system checks if the name matches an existing one, including built-in types and types created by any user in your tenant. If the name is a duplicate, the message Duplicate sensitive field type appears. Note Built-in sensitive data types: Mobile Phone Number, ID Card Number, Bank Card Number, Email_Built-in, IP, License Plate Number, Postal Code, Landline Number, MAC Address, Address, Name, Company Name, Ethnicity, Zodiac Sign, Gender, and Nationality.
            Masking Rule Name	The system automatically populates this text box with the value you entered for Sensitive Data Type, but you can modify it. The name must be 1 to 30 characters in length and can contain Chinese characters, letters, and digits. If the name is already used by a rule created by any user in your tenant, the message Rule name already exists. appears.

         2. DataWorks supports three Masking Method: Pseudonym, Hash, and Mask.

            • Pseudonym

              This method replaces a value with an artificial pseudonym that has the same characteristics, preserving the format of the original data.

              • If you select a built-in Sensitive Data Type such as Mobile Phone Number, ID Card Number, Bank Card Number, Email_Built-in, IP, License Plate Number, Postal Code, Landline Number, MAC Address, Address, Name, or Company Name, you must configure a Security Domain.

                Security Domain: You can select a digit from 0 to 9. Different security domains use different masking policies, yielding different results for the same input data. For example, if the original data is a123, the result might be b124 in security domain 0 but c234 in security domain 1. The same input data and security domain always produce the same masked output.

              • If you select a non-built-in Sensitive Data Type, you must configure the Replace Character Set.

                Replace Character Set: The set of characters that are replaced by others of the same type. Chinese characters are not supported. Data outside this set is not masked. You can enter uppercase letters, lowercase letters, and digits. Use commas (,) to separate multiple characters. For example, if the input data contains digits from 0 to 3 and letters from a to d, the masked data will also be composed of characters from these ranges.

            • Hash

              This method encrypts original data into a fixed-length hash value. If you select this method, you must select a Security Domain.

              Security Domain: You can select a digit from 0 to 9. Different security domains use different masking policies, yielding different results for the same input data. For example, if the original data is a123, the result might be b124 in security domain 0 but c234 in security domain 1. The same input data and security domain always produce the same masked output.

            • Mask

              This method masks parts of the data by replacing characters at specified positions with asterisks (*).

              • Recommended Methods: From the drop-down list, you can select Show Only First and Last Character (selected by default), Show Only First Three and Last Two Characters, or Show Only First Three and Last Four Characters.

              • Customize: This option provides a flexible way to configure masking. You can specify which sections (start, middle, or end) to mask, and define the length of the characters to be masked or unmasked. You can add up to 10 segments, and at least one segment must be set to Remaining Characters.

                Item	Description
                ①	Select Digits or Remaining Characters.
                ②	Enter an integer from 1 to 100.
                ③	Select Masking or Unmasked.

                Example: Mask the first three digits and leave the remaining digits unmasked.

                Example: Mask the last three digits and leave the remaining digits unmasked.

         3. To verify the configuration, enter sample data (0 to 100 characters) in the Sample Data text box and click Verify Masking. The result is displayed in the Masking Effect field.

      2. Click Confirm. The new rule appears in the data masking rule drop-down list and is also synchronized to the data masking rules page in Data Security Guard.

   2. Click Add Condition to add and configure a data masking rule for a data field.

      • In the Field column, select an output field of the upstream node from the drop-down list.

      • In the Masking Rule column, select an active data masking rule from the list of rules in Data Security Guard > Data Masking Configuration.

      • In the Operations column, click Edit.

        • If you created the data masking rule, you can click Edit to modify the rule in the Edit Data Masking Rule dialog box before submitting the real-time synchronization task. You can also enter Sample Data to Verify Masking the rule.

        • If you did not create the data masking rule, click Edit to view the rule details. You can also enter Sample Data to Verify Masking the rule.

      • In the Operations column, click Delete to remove the row for the field.

   3. Output Field: Lists the fields and their data types from the source table to be synchronized.