Data Security Center (DSC) includes built-in identification templates for industries such as finance, energy, and automotive to detect sensitive data in your assets. You can use these templates directly or customize them to fit your requirements.
Identification templates
An identification template defines data classification and grading criteria tailored to industry-specific standards. You can use it to verify whether sensitive data meets security and compliance requirements.
Defining identification templates
An identification template is defined by one or more identification models, and an identification model is defined by one or more identification features.
|
Concept |
Description |
|
identification feature |
An identification feature detects sensitive data by using content, metadata, or a dictionary. It combines operators such as regular expressions, CONTAINS, and NOT CONTAINS to create detection rules. You can link multiple rules with logical operators such as AND and OR for flexible detection criteria. Data Security Center provides built-in identification features for common sensitive data types and allows you to create custom identification features. |
|
identification model |
An identification model consists of one or more identification features and directly determines the final identification result. You can restrict its scope to specific data assets such as database instances, tables, OSS buckets, or file directories. Data Security Center provides built-in identification models for typical sensitive data and allows you to create custom identification models. |
For details on how to use identification models and identification features, see the View and configure identification models and identification features section later in this topic.
Types of identification templates
Data Security Center provides built-in identification templates for common industries and supports custom identification templates. For more information, see the Add a custom identification template section later in this topic.
|
Type |
Description |
|
Built-in identification template |
DSC provides the Financial Industry Classification and Grading Template, Built-in Cloud Security Internal Assurance Template, Power Industry Classification and Grading Template, Internet of Vehicles (IoV) Classification and Grading Template, and Internet Industry Classification and Grading Template. Select a built-in template based on your business scenario. The identification models within a built-in identification template are called built-in identification models. You can only enable or disable built-in identification templates and built-in identification models. You cannot configure the sensitivity levels, identification features, or identification models for built-in identification models. For more information, see the Built-in identification templates section later in this topic. |
|
Custom identification template |
If built-in templates do not meet your requirements, create a custom identification template by configuring identification features and identification models. You can create up to 10 custom identification templates. For more information, see the Add a custom identification template section later in this topic. |
Identification template sensitivity levels
DSC defines sensitivity levels from S1 to S10, where a higher number indicates greater sensitivity. The available levels for an identification model depend on those defined in its associated template. For more details, see Configure sensitivity levels.
Using an identification template
An identification task scans your assets using the identification models in an identification template, discovers sensitive data, generates scan results, and classifies and grades the data.
Identification tasks require an enabled identification template. Depending on how they are used, enabled templates fall into three categories: main identification templates, active identification templates, and common identification templates.
When you create a custom identification task, you can select one main identification template and up to two active identification templates, with a maximum of two templates in total. For more information, see Add a custom identification task.
|
Category |
Description |
|
main identification template |
The identification template used by default system tasks. By default, the main identification template in DSC is the Internet Industry Classification and Grading Template. A main identification template cannot be disabled. You can have only one main identification template. You can promote an active identification template to become the main template. For more information, see the Enable an identification template and Set the main identification template sections later in this topic. All pages in the DSC console, such as the Asset Insight page under Data Insight, display results detected by the main identification template. |
|
active identification template |
You can enable a built-in identification template or a custom identification template as an active identification template. DSC allows a maximum of two active identification templates. |
|
Common identification template |
This template is used by default only when an identification task uses a built-in identification template. You cannot manually select a common identification template for an identification task. This template protects personal information and privacy rights in accordance with the GB/T 35273-2020 Personal Information Security Specification published by the Standardization Administration of China. It helps organizations manage personal information effectively and control risks. |
For specific procedures on using identification templates, see the Use an identification template section later in this topic.
View and configure identification models and identification features
View built-in identification models and identification features
Built-in identification models
Log on to the Data Security Center console.
In the navigation pane on the left, select .
-
Click the Identification Models tab and select Built-in to view the list of default identification models provided by DSC.
You can enter the name of an identification model in the search box and click the Search
icon to find specific model information.The identification model list contains the following columns: Model name, Source, Template reference, Parent model, Data tag, large model invocation, Status, Last updated, and Actions (which includes Details and Create Submodel links). The page also provides an Add Model button and filtering options by data tag, status, and large model invocation.
-
Click Details in the Actions column for a target identification model to view its model rule configuration and identification threshold configuration.
You can copy the identification feature information and go to the Identification Features tab to view its details. For more information, see Built-in identification features.
The model details page also includes information such as Model name, Model description, Data tag (such as personal sensitive information and personal information), and Data category (which shows the associated classification and grading template, category name, and sensitivity level). The identification threshold configuration includes parameters for minimum hits (unstructured data) and hit ratio (structured data).
Built-in identification features
Log on to the Data Security Center console.
In the navigation pane on the left, select .
-
Click the Identification Features tab and select Built-in to view the list of default identification features provided by DSC.
You can enter a keyword for an identification feature in the search box and click the Search
icon to view details about the specified data feature.The identification feature list includes the following columns: Feature name, Feature type, Feature description, Status, Last updated, and Actions (which includes a Details link). The page also provides an Add Feature button and filtering options by feature type and status.
Add custom identification models and features
Custom identification models
Add model directly
-
On the Identification Models tab, click Create.
-
In the Create panel, configure the parameters and click OK.
Category
Parameter
Description
Basic Information
Model Name
Enter a name for the model.
Model Description
Optional. Enter a description for the model.
Tag
Optional. Select a data tag for the identification model, such as Sensitive Personal Information, Personal Information, or General Information.
Data Category
Optional. From the drop-down list, select the identification template, sensitive information category, and risk level for the new model.
You can only select custom identification templates here. For more information, see the Add a custom identification template section in this topic.
Model Rule
Identification Features
Select the identification features for the model from the drop-down list.
-
You can select both built-in identification features and custom identification features.
-
You can select multiple identification features. The features are evaluated using an OR relationship.
Identification Scope
Optional. Select the asset types where this model applies. By default, it applies to all assets that DSC is authorized to access and can connect to.
You can select multiple asset types. The asset types are evaluated using an OR relationship.
Advanced Settings
Optional. Configure advanced settings for more precise sensitive data identification scope. Follow these steps:
-
Select the asset type to configure from the drop-down list.
You can only select asset types that have already been chosen in the Identification Scope. To configure multiple asset types, click the Add
icon. -
Select the relationship between conditions: AND or OR. To set up multiple condition groups, click Create Group. The added group will be a subset of the first condition group.
-
Configure the identification conditions. Click Add Condition to add multiple conditions.
Identification Threshold
Minimum Hits (Unstructured Data)
Set the minimum number of times an identification feature must be matched within a single unstructured data file (such as in OSS).
If the match count in a single file reaches this minimum, the file is considered sensitive.
For example, if the minimum hits is set to 1 and a file with 10 features matches at least one identification feature from the model, the file is classified as sensitive data of the corresponding type and level.
Hit Ratio (Structured Data)
Set the hit ratio for structured data (such as RDS).
If the ratio of matching entries in a 200-entry sample reaches this threshold, the data is considered sensitive.
For example, if the hit ratio is 50% and 100 data entries in a column match the model, the entire column is classified as sensitive data of the corresponding type and level.
-
Add as submodel
-
On the Identification Models tab, find the target built-in or custom identification model and click Create Submodel in the Actions column.
-
In the Create Submodel panel, configure the parameters and click OK.
The Model and Identification Features parameters cannot be modified. You can add a Complementary Feature. For other parameter descriptions, see Add model directly.
NoteIf the selected custom identification model is already a submodel, the new submodel will inherit the same Model and Identification Features when you create a new submodel.
Custom identification features
-
On the Identification Features tab, click Add Feature.
-
In the Add Feature panel, configure the parameters and click OK.
Parameter
Description
Feature Name
Enter a name for the custom feature.
Match Item
Select one of the following types:
-
Rule Match: Configure feature rules. You can click Add rule to add multiple feature rules. The relationship between multiple rules can be AND or OR.
If you select Exception Rule, you can configure exception rules. Click Add rule to add multiple exception rules. The relationship between multiple exception rules can be AND or OR.
The detection principle is: data is considered sensitive if it matches the configured feature rules but does not match the configured exception rules.
-
Dictionary Match: Enter a keyword and press Enter. A single keyword can be 1 to 128 characters long, and you can configure multiple keywords. Note that keywords cannot contain commas; otherwise, they will be treated as multiple keywords separated by commas. Fuzzy matching is supported.
Data Type
Select the data type that the identification feature applies to. Options are Structured Data and Unstructured Data.
-
Set identification model status
An identification model must be enabled for its rules to take effect in identification tasks. By default, built-in identification models within a built-in template are enabled. You can enable or disable both built-in and custom models based on your needs.
On the Identification Models tab, find the target built-in or custom identification model, and click the switch 
in the Status column to enable or disable it.
This change does not affect currently running identification tasks but takes effect on the next run.
Set large model invocation
Enabling the large AI model improves the accuracy of sensitive information identification. On the Identification Models tab, locate the target identification model and click the switch in the AI Model Invocation column to enable the feature. Once enabled, the system uses the large model for identification with this model.
DSC consumes AI invocation quotas based on the models for which this feature is enabled. If the quota is exhausted, the model falls back to regex-based identification only.
Built-in identification templates
Log on to the Data Security Center console.
In the navigation pane on the left, select .
-
On the Template Management tab, under the Configure Template page, find an identification template in the list where the Type is Built-in.
-
Click View in the Actions column to see the sensitive data categories and identification models included in the template.
Sensitivity level
Description
N/A
No sensitive information defined in the current identification template was detected.
S1
Non-sensitive data. Disclosing this type of data is unlikely to cause harm in most situations. Examples: provinces, cities, and product names.
S2
Generally sensitive data. This type of data is not suitable for public disclosure, and a data breach would have a low impact. Examples: names and addresses.
S3
Critically sensitive data. This data is highly sensitive, and even a minor leak could cause serious harm. Examples: ID documents, account passwords, and database information.
S4
Core confidential data. This data should never be disclosed under any circumstances. Examples: genetic data, fingerprints, and iris scans.
You can copy an identification model name and go to the Identification Models tab to view its identification feature configuration and identification thresholds. For more information, see the View built-in identification models and identification features section of this topic.
For example, when viewing the Internet Industry Classification and Grading Template, the results are displayed in a tree structure. It shows various sensitive data categories such as general sensitive information, key sensitive information, sensitive image information, location sensitive information, personal sensitive information, device sensitive information, and corporate sensitive information. Expanding a category reveals the specific identification models and their corresponding sensitivity level tags.
Add a custom identification template
Create a custom template
Add template directly
-
On the Template Management tab, go to the Configure Template page and click New template.
-
On the New template page, set the Basic Information (template name and description), and click Next.
-
Complete the Configure Template step and click OK.
-
Add sensitive data categories.
-
Under Configure Template Node, click Create Category. In the dialog box that appears, enter a Category for the sensitive data and click OK.
-
Click the Manage
icon next to an added category and click Add Same-level Category or Add Subcategory to add new sensitive data categories.You can repeat this step to add multiple sensitive data categories.
The management menu also includes Add model and Delete options.
-
-
Repeat the following steps to add corresponding identification models under an added sensitive data category.
-
Click the Manage
icon next to the added category and click Create. -
In the Add Model dialog box, select the checkbox next to the target identification model, ensure the icon in the Status column is enabled
, and click OK.You can filter for specific identification models by data tag, model type, and model name. You can select both built-in identification models and custom identification models.
ImportantAfter an identification model is enabled in a template, its rules will take effect in identification tasks that use that template.
-
-
icon next to an added category and click Add Same-level Category or Add Subcategory to add new sensitive data categories.
, and click OK.Add by copying
-
On the Template Management tab's Configure Template page, find a built-in identification template and click Copy in the Actions column. Alternatively, find a custom identification template and click the
icon in the Actions column, then select Copy. -
In the Copy Template dialog box, the Template Name will default to
<Original Template Name>+copy. You can modify the Template Name and then click OK. -
Click Edit in the Actions column for the new template. You can modify the template name, sensitive data categories (including changing category names, adding sibling categories, and deleting categories), and identification models (adding and removing models). Click OK when you are finished.
icon in the Actions column, then select Copy.Other operations
-
Delete an identification template: You can only delete custom identification templates; built-in templates cannot be deleted. On the Configure Template sub-tab, click the Manage
icon in the Actions column of the target template and click Delete. Deleting a template also deletes any of its custom identification models. -
Manage sensitive data categories:
You can only configure sensitive data categories for custom templates; you cannot modify them for built-in templates. On the Configure Template sub-tab, click Edit in the Actions column for the target template, then click Next. Under Configure Template Node, you can perform the following actions:
-
Add a sensitive data category: Click the Manage
icon next to an existing category and click Add Same-level Category. -
Edit a sensitive data category name: Click in the category input box to modify its name.
-
Delete a sensitive data category: Click the Manage
icon next to an existing category and click Delete.
-
-
Manage identification models within a template:
For built-in templates, you can only enable or disable the identification models. For custom templates, you can add or delete identification models on the Configure Template Node page.
-
Add an identification model: Click the Manage
icon next to a sensitive data category, then click Create to add a model and set its status. -
Delete an identification model: Click the expand
icon to the left of a sensitive data category, then click the delete icon next to the target identification model to remove it.
-
icon in the Actions column of the target template and click Delete. Deleting a template also deletes any of its custom identification models.
icon to the left of a sensitive data category, then click the delete 
icon next to the target identification model to remove it.Configure sensitivity levels
-
For built-in identification templates, you cannot add or delete sensitivity levels. You can only edit the description of existing levels.
-
For custom identification templates, you can add, edit, and delete sensitivity levels.
-
Custom templates created directly are pre-configured with 10 levels by default. You can only delete the S10 level.
-
Custom templates created by copying another template will have the same default level configuration as the source template. These default levels cannot be deleted.
-
A custom identification template can have a maximum of 10 levels.
-
On the Template Management tab, go to the Sensitivity Level Configuration page, select the template you are editing from the Current template being edited dropdown menu, and perform the following level configuration operations:
-
Delete a level: Click Delete in the Actions column for the target level.
-
Add a level: Click Custom level configuration to add a new sensitive data level.
-
Edit a level: Click Edit in the Actions column for the target level to modify its description.
Use an identification template
Enable an identification template
If you have not configured any identification templates, the Internet Industry Classification and Grading Template is enabled as the main template by default. To use a different template, enable a built-in or custom template as follows.
You can enable a maximum of two additional identification templates. Enabled templates are displayed in the Enabled Templates list.
-
On the Template Management tab's Configure Template page, find the target built-in or custom identification template in the template list.
-
Click the disabled
icon in the Status column to enable the template. The status will change to .Once enabled, the identification template appears in the Enabled identification templates list, where you can perform operations such as setting it as the Main, View, or Disable.
icon in the Status column to enable the template. The status will change to 
.Set the main identification template
Only an enabled identification template can be set as the main template. Before you change the main template, you must terminate all identification tasks associated with the current main template. For more information, see Terminate an identification task.
To use a different identification template for default system tasks, change the main identification template.
-
On the Template Management tab, on the Configure Template page, in the Enabled Templates list at the top of the page, click Main Template on the card of the identification template that you want to set as the Main Template identification template.
-
In the confirmation dialog box that appears, click Confirm.
After the switch is successful, the template will be marked as Main Template and will be grayed out.
Next steps
Use an enabled identification template when creating an identification task to scan for sensitive data in your authorized assets. For more information, see Scan for sensitive data by using an identification task.
FAQ
Scanning mechanism for structured data
Data Security Center evaluates both field names and field values in a data source to determine sensitivity. Judging sensitivity based on field values alone is not sufficient. An example is age data.
How does sensitive data identification work?
After you authorize data assets, DSC uses built-in rules to discover sensitive data in RDS or OSS and map its distribution. DSC can also perform security controls, such as anomaly auditing, based on the identified data.
Basis for built-in sensitivity levels
The built-in templates in Data Security Center, such as those for the Internet of Vehicles, Finance, Internet, and Power industries, are based on industry-specific data classification and grading standards.