Data masking

Data masking conceals sensitive data to meet security regulations. Masking methods are either reversible or irreversible — choose the method that fits your scenario.

Common reversible masking methods:

1. Substitution: Partially reversible. Masks fields with fixed formats (such as certificate numbers) by using a lookup table (reversible tokenization) or random range (irreversible) to mask all or part of a field.

2. Encryption: Reversible. Encrypts fields that require back-to-origin access using symmetric encryption algorithms.

3. Data decryption: Reverses encryption for fields that require back-to-origin access. Supports common symmetric encryption algorithms.

Common irreversible masking methods:

1. Hashing: Irreversible. Suitable for password storage or comparison-based verification. Supports common hash algorithms with configurable offset (salt values).

2. Redaction: Irreversible. Replaces parts of text with special characters (such as * or #) for frontend display or data sharing.

3. Shuffling: Irreversible. Masks structured data at the column level by extracting values from a source table, confirming the value range, then discretizing, rearranging, and randomly selecting values to obfuscate the data.

When to use data masking:

1. Transfer production data to a test database for analysis, validation, or testing.

2. Share sensitive data with third parties or downstream suppliers.

3. Display sensitive data in visualization charts.

4. Meet compliance and regulatory requirements for sensitive personal or business data.

Best practices

Apply data masking based on your specific needs. The following table lists common practices:

No.	Scenario	Masking stage	Data masking method
1	Frontend and chart display	Mask data at the display layer: charts, large screens, or web pages.	Apply substitution or redaction in the web code. Source data is transmitted but replaced at the display layer.
2	Transferring from a production database to a test database	Mask data when it is transferred from the production DB to the test DB.	Use the static data masking feature of Alibaba Cloud Data Security Center: Create a masking task. Create a masking template and algorithm. Select the sensitive data table from the production DB. Select the non-sensitive database table in the test DB. Execute the masking task.
3	Real-time masking before data is written to the database	Mask data in real time during generation. Data enters the database already masked.	Use the dynamic data masking SDK of Alibaba Cloud Data Security Center.