Scenario

Figure 1 shows the architecture for database protection to mask sensitive data.

Step 1: Connect a Database to the Database Protection Management System (HexaTier)

After purchasing a database protection instance, you need to connect your database to the database protection management system (HexaTier), configure a log storage path, add a protected database, and modify the configuration file on the service side. Then you can use the monitoring, data reduction, log, and database protection policy functions.

1. Log in to the management console.
2. Go to the database protection login page.
   Figure 2 Accessing the database protection login page
   

3. Enter the login username (admin) and password. Then click Log In or press Enter, as shown in Figure 3.
   Figure 3 Database protection login page
   

4. Configure a log storage path.

   To meet compliance requirements, HexaTier remotely stores logs for future audit and evidence collection. After logging in to HexaTier, you must configure the log storage location before you can enable the monitoring and data reduction functions, and view logs.

   1. Go to the page for configuring remote logs.
      Figure 4 Accessing the page for configuring remote logs
      
   2. On the Log Repository Configuration page, set remote log parameters.
      Figure 5 Configuring remote logs
      
   3. Click Test.
   4. Click Update.

5. Add a protected database.

   To protect a database instance, connect it to HexaTier. After you add the protected database, you can configure sensitive data masking rules and enable the sensitive data discovery function on the HexaTier console.

   1. Go to the page for creating a protected database.
      Figure 6 Accessing the page for creating a protected database
      
   2. On the Log Repository Configuration page, set remote log parameters.
      Figure 7 Creating a protected database
      
   3. Click Create. The created database is displayed in the protected database list.
      Figure 8 Protected database created successfully
      

6. Modify the service side configuration file.

   HexaTier proxy address and port are required if you want to make your firewall policies take effect on protected databases. In the service side configuration file, you need to set the database IP address to the floating IP address of the database protection instance used for logging in to HexaTier, and set the database port number to the proxy port of the protected database.

   

   Manually modify the IP address and port number of every protected database in the service side configuration file.

   1. Obtain the floating IP address 192.168.1.95 of the instance in Figure 2.
   2. Obtain the proxy address interface 3306 of the protected database in Figure 8.
   3. After you log in, specify the floating IP address of the DBSS instance and the proxy port of the protected database in the service side configuration file.

      The following takes JDBC configurations as an example.

      data.datasource.url=jdbc:mysql://192.168.1.95:3306/test

   4. Save the configuration file and restart the application.

      After the configuration is complete, log in to HexaTier, choose Dashboard > Protected Database Servers: Topology and check whether the protected database is successfully connected.

      : The connection between the service side and DBSS failed or has not been set up. If the connection failed, rectify the fault by referring to Database Protection Cannot Connect to the Target Database.

      : The protected database is connected.

Step 2: Create a Sensitive Data Discovery Job

In HexaTier, you can set sensitive data discovery rules to automatically identify and classify sensitive data. If sensitive data is identified, HexaTier will generate the discovery results and GDPR reports.

1. Go to the page for creating a sensitive data discovery job.
   Figure 9 Accessing the page for creating a sensitive data discovery job
   

2. On the Log Repository Configuration page, set remote log parameters.
   Figure 10 Creating a job
   

3. Click Create and Run. The discovery job is created successfully, as shown in Job created.
   Figure 11 Job created
   

Step 3: Generate a Masking Rule Based on the Discovery Job Result

1. In the left navigation pane, choose Discovery Result.
2. On the Discovery Results page, click Details in the View column.
   Figure 12 Discovery job results
   
   

   Click View GDPR Report to view the GDPR report of the detected sensitive data.

3. On the Log Repository Configuration page, set remote log parameters.
   Figure 13 Generating masking rules
   

4. Choose Masking from the main menu. The masking rule generated based on the discovery result is displayed in the masking policy list.
   Figure 14 Generating a masking rule based on the discovery job result
   

Step 4: View Data Masking Logs

After the masking rule is configured, you can choose Masking Logs in the left navigation pane to view the logs.

Figure 15 Viewing data masking logs