Help Center/ Data Security Center/ Best Practices/ Using DSC to Prevent Sensitive Data Leakage
Updated on 2026-08-27 GMT+08:00
View PDF
Share

Using DSC to Prevent Sensitive Data Leakage

Application Scenarios

Sensitive data refers to information that, if accessed, disclosed, or misused without authorization, may pose serious risks to individuals or organizations. For individuals, privacy information such as ID card numbers, addresses, and bank card numbers is considered sensitive data. For enterprises, core information such as customer information, financial information, technical information, and major business decisions is considered sensitive data.

This best practice is recommended for customers in highly sensitive industries such as finance, government, healthcare, and the Internet. On the service side, enterprises often need to supply production environment data for development and testing, data analysis, and external collaboration. On the organizational side, enterprises always need to share data across departments and organizations. Direct circulation of raw production data poses a high data leakage risk. Manual data processing is costly, and it is difficult to unify control standards.

Huawei Cloud Data Security Center (DSC) can mask static data at scale based on masking rules. This feature is suitable for scenarios where production data is delivered to development, testing, and external environments to support services such as development and testing, data sharing, and data research. With this capability, enterprises can securely deliver data across environments and organizations. This ensures normal business operations while keeping sensitive data secure, and helps meet regulatory compliance requirements.

Solution Architecture

Static data masking: DSC enables bulk data masking based on rules (DSC built-in rules or custom rules). Static data masking is typically applied when transferring production data to non-production environments (such as development and testing) or sharing data for research purposes. You can create a data masking task on the DSC console to quickly mask sensitive data in database, OBS, and big data assets.

Figure 1 How it works

Advantages

Data masking protects sensitive information by irreversibly transforming, replacing, or hiding data, ensuring it can be used safely across non-production environments like development, testing, and analytics.

DSC supports multiple data masking methods, including hashing, encryption, character masking, keyword replacement, deletion, roundup, and simulation. These methods ensure secure data output in various scenarios, such as banking, healthcare, and e-commerce, allowing organizations to leverage data value while maintaining data security.

Scenario

Description

Compliance

Comply with regulations, including GDPR and Personal Information Protection Law, to prevent user privacy leaks.

Development and test

Provide programmers and testers with production-like data structures without exposing actual data.

Data analysis

Allow analysts to process production-level data volumes while protecting sensitive fields.

Third-party interconnection

Reduce data leak risks when third-party service providers access data.

Notes and Constraints

Table 1 lists the data sources supported by DSC.

Table 1 Data sources supported by static data masking

Masking Type

Data Source

Data masking

SQLServer, MySQL, TDSQL, PostgreSQL, KingBase, DMDBMS, GaussDB, Oracle, DWS, and Greenplum

Elasticsearch masking

Elasticsearch

Hive masking

Hive

HBase masking

HBase

MRS masking

MRS_HIVE

OBS masking

OBS bucket files (text, images, and LeRobot datasets)

  • Text: .txt, .log, .xml, .ini, .sql, .inf, .java and .json or files whose mime type starts with text
  • Images of the following types can be anonymized: ID cards, passports, driving licenses, vehicle licenses, and social security cards for Chinese mainland, as well as bank card photos and photos containing faces and license plates.
  • Supported LeRobot datasets: text (JSON/JSONL files) and videos (faces and license plates).

Resource and Cost Planning

The following table lists the resources required.

Table 2 Resource and cost planning

Resource

Resource Description

Daily Fee

Data Security Center

Professional edition:

  • Billing mode: Yearly/Monthly
  • Number of supported databases: 2
  • OBS volume that can be added: 100 GB
  • Number of supported API calls: 1 million

For details about the billing modes and standards, see Billing.

Video Tutorial

Procedure

The following describes how to identify sensitive data in an RDS database table and mask it using the SHA256-based hash masking.

Step 1: Purchasing a DSC Professional Edition Instance

  1. Log in to the DSC console.
  2. Click in the upper left corner and select a region or project.
  3. If you are purchasing DSC for the first time, click Buy DSC on the left of the page.
  4. On the Buy DSC page, select the current region and project from the Region and Project drop-down lists.

    Only one DSC edition can be purchased in a region.

  5. Select Professional for Edition.
  6. (Optional) Specify Database Expansion Package and OBS Expansion Package based on your service requirements. For details, see Resource and Cost Planning.

    • Each database expansion package contains one database instance. RDS and DWS databases, user-built databases on ECSs, Elasticsearch, and user-built big data on ECSs are supported.
    • An OBS expansion package offers 1 TB (1,024 GB) of OBS storage.

  7. Specify Required Duration. Click a point on the timeline to select the required duration. The duration ranges from 1 month to 3 years.

    Select Auto-renew to enable the system to renew your service by the required duration you configured when your service is about to expire.

  8. Click Next in the lower right corner.

    If you have any questions about the pricing, click Pricing details.

  9. Confirm the order, read and select I have read and agree to the Data Security Center Service Statement, and click Pay Now.
  10. On the payment page, select a payment method and pay for your order.

Step 2: Authorize DSC to Access RDS Database Assets

  1. In the navigation pane on the left, choose Asset Center > Asset Management.
  2. In the upper left corner of the asset management page, click Modify next to Cloud Asset Authorization.
  3. On the Authorize Access to Cloud Assets page, enable database authorization.

    Figure 2 Enabling database authorization

  4. Click RDS. The RDS Databases tab is displayed.

    Figure 3 RDS database instances

  5. Click the Database Instances tab. Authorization can be performed in either of the following ways:

    • Method 1
      1. Locate the database instance in the list and click Authorize in the Operation column. Then, enter the database information for authorization.
        Figure 4 Database authorization

      2. Configure Permission Settings (required only for RDS databases).
        • Grant the read-only permission: Only the sensitive data identification function can be used.
        • Grant the read and write permission: The sensitive data identification and data anonymization functions can be used.
          • After the RDS read-only permission is authorized, DSC creates the account dsc_readonly in RDS.
            • After the password of the dsc_readonly account is reset in RDS, the new password is not automatically synchronized to DSC. As a result, the sensitive data identification task will fail. For this reason, do not reset the password of this account.
            • If you have reset the password of dsc_readonly in RDS, delete the authorized RDS DB instance in DSC and configure permissions on the instance again.
          • DSC cannot scan and mask sensitive data in MySQL databases within RDS instances where SSL has been enabled.
      3. Enter the database name, asset name, username, and password.
        • The database name can contain only letters, digits, underscores (_), and hyphens (-).
        • The asset name must contain 4 to 255 characters.
      4. (Optional) Select a group from the drop-down list. After selecting a group, you can view the group information on the asset group management page. If you do not select a group, the asset is displayed in default group list by default.
      5. Click Add to add multiple databases for authorization at the same time.
    • Method 2
      1. Click the instance name to go to the instance details page. Click Authorize in the Operation column for database authorization.
        Figure 5 Instance details
      2. Select multiple databases and click Authorize Selected in the upper left corner to authorize them in batches.
      3. Enter the database name, asset name, username, and password.
        • The database name can contain only letters, digits, underscores (_), and hyphens (-).
        • The asset name must contain 4 to 255 characters.
      4. (Optional) Select a group from the drop-down list. After selecting a group, you can view the group information on the asset group management page. If you do not select a group, the asset is displayed in default group list by default.
      5. Click Add to add multiple databases for authorization at the same time.

  6. After the authorization is complete, click the Databases tab to view the connection status of the authorized database.

    After the asset authorization is complete, the Connection Status of the asset is Checking, which means DSC is checking the database connectivity.
    • DSC can access the added database normally if the Connection Status of the database is Succeeded.
    • DSC cannot access the added database normally if the Connection Status of the database is Failed. Hover the cursor over Failed to view the failure cause or rectify the fault by referring to How Do I Troubleshoot the Failure in Connecting to the Added Database?

Step 3: Identify Sensitive Data

  1. In the navigation pane, choose Classification and Grading > Tasks.
  2. Click Create Task. In the displayed dialog box, configure the basic parameters. Set other optional parameters as required.

    Table 3 Parameters for creating a sensitive data identification task

    Parameter

    Description

    Example Value

    Task Name

    You can customize the task name.

    The task name must:

    • Contain 4 to 255 characters.
    • Contain only letters, digits, underscores (_), and hyphens (-).
    • Start with a letter.
    • Be unique.

    test

    Data Source

    Select Database.

    DSC identifies sensitive data of authorized database assets.

    Database > gbx-jiami

    Identification Template

    You can select a built-in or custom template. DSC displays data by level and category based on the template you select.

    General Cloud Data Security Classification Template

    Identification Period

    Set the execution policy of the data identification task.

    • Once: The task will be executed once at a specified time.
    • Daily: The task is executed at a fixed time every day.
    • Weekly: The task is executed at a specified time every week.
    • Monthly: The task is executed at a specified time every month.

    Once

    Identification Method

    Select incremental or full identification.

    • Incremental identification: Identified data will be skipped.
    • Full identification: All data will be checked.

    Full identification

    Identification Method

    Select incremental or full identification.

    • Incremental identification: Identified data will be skipped.
    • Full identification: All data will be checked.

    Full identification

    When to Execute
    This parameter is displayed when Identification Period is set to Once.
    • Now: Select the option and click OK. The system executes the data identification task immediately.
    • As scheduled: The task will be executed at a specified time.

    Now

  3. Click OK. The sensitive data identification task list is displayed.
  4. When the status of the identification task changes to Identification completed. Click View Result in the Operation column to go to the result details page.

    The Birthday and PhoneNumbers columns are identified as sensitive data.

  5. In the Operation column of an asset, click View Details.

    Figure 6 Categorizing and leveling results

  6. Perform operations described in Step 4: Perform Static Data Masking to mask the sensitive data in the Birthday and PhoneNumbers columns of the info1 table in the gbx-jiami database.

Step 4: Perform Static Data Masking

You can use DSC to create data masking tasks for databases, and Elasticsearch, MRS, and Hive assets. This section describes how to create a static data masking task for a database. For details about how to mask data for other data sources, see Creating a Static Data Masking Task.

  1. In the navigation pane on the left, choose Security Management > Data Masking.
  2. Click Create Task to configure the data source.

    Select all data types if you want a complete table that contains all types of data after the data masking is completed.

    Figure 7 Data source configuration

  3. Click Next to switch to Set Masking Algorithm.

    Figure 8 Configuring the data masking algorithm

  4. Click Next to switch to the Configure Data Masking Period page and configure the data masking period.
  5. Click Next to the Set Target Data page and configure the storage location of the table generated after data masking.

    Figure 9 Configuring the storage location of the table generated after data masking

  6. Click Finish to return to the database data masking task list. Click to enable the masking task and then Execute in the Operation column to execute the task.

    If the status changes to Completed, the data masking task has been successfully executed.