Sensitive data scan and masking

Supported configurations

Billing

This feature is in invitational preview and is free of charge during this period.

Maskable sensitive information

• Personal information

  Name, gender, age, date of birth, marital status, childbirth status, past medical history, symptoms, and hospitalization history.

• Company information

  Business license numbers, organization codes, and tax registration numbers.

• Technical management

  Runtime log information, such as creation time, update time, start time, end time, task ID, and remarks.

• Business data

  Loan types.

• Marketing services

  Product names and product IDs.

• General management

  Invoice codes.

Supported masking algorithms

Usage notes

• Only objects configured for synchronization in the task can be scanned.

• This feature scans data at the source. Therefore, when you configure the Libraries and tables that need to be scanned, the database and table names displayed in the Selected Objects box are the original names before mapping.

• For tasks with sensitive data discovery and masking enabled:

  • The task's Incremental Data Collection module runs only after you configure and start the masking task.

  • Data transfer speed may decrease and may not reach its theoretical maximum.

• When you configure scan objects, you can only select objects at the table level.

• After you configure the scan objects and save the task (for example, by clicking Next: Save Task Settings and Precheck or Save and Return), you can no longer modify the scan objects.

• Data masking is not supported for TIMESTAMP fields.

• If you apply the Masking algorithm to a BIGINT field, the data written to the destination may become 0 or the write operation may fail.

Procedure

1. Enable sensitive data discovery and masking.

   1. Go to the Advanced Configurations step of the synchronization task.

   2. In the Sensitive Data Scanning and Masking section, select Open.

   3. Optional: Select a Sensitive Data Compliance Scan Template.

      Note

      Currently, only the Internet Industry Compliance Template v1.0 is supported. You can keep the default setting.

2. Configure scan objects.

   In the Selected Objects box, select the tables that you want to scan and click the icon to move them to the Selected objects to scan box.

3. Complete the remaining configuration and purchase steps as needed.

4. Configure and start the masking task.

   1. Configure the masking algorithm.

      1. On the data synchronization task list page, find the task and click the instance ID.

      2. Optional: On the Task Management page, click the Sensitive Data Scanning and Masking module.

      3. In the Configure Masking Columns section, configure the masking algorithm in the Masking Configuration column.

         Note

         For fields that contain sensitive data, the default masking algorithm is REPLACE INTO.

         Quick configuration

         In the Masking Configuration column for the target field, click the algorithm name and select a masking algorithm.

         Important

         If you select Masking, you must also set the Masking Range as described in Standard Configuration.

         Standard configuration

         1. In the Masking Configuration column for the target field, click Edit Settings.

         2. In the Masking Configuration dialog box that appears, modify the Desensitization algorithm.

            Note

            • You can also select multiple fields that require the same masking algorithm, click Batch Configuration, and then select a Desensitization algorithm.

            • If you select Masking, you must also set the Masking Range by specifying the start position X and end position Y from left to right.

         3. Click OK.

   2. Start the masking task.

      1. At the bottom of the Sensitive Data Scanning and Masking module, click Configure and start the desensitization task.

      2. In the dialog box that appears, click OK.