Desensitization Rules

Adding desensitization rule

1. Logging in to the Database Operations and Maintenance Management System using the sysadmin system administrator account.
2. On the left navigation bar, select Rule Management > Desensitization Rules. The page displays desensitization rules grouped by database type.
3. By default, the page loads desensitization rules under the first listed database type on the right panel.
4. Click the Add desensitization rule button.
5. The Rule Type is fixed as Field Desensitization and cannot be modified.
6. Enter basic information for the new desensitization rule and select whether to set it as default.
   Figure 1 Adding desensitization rule
   

   Table 1 Parameter escription for basic information of new desensitization rule

   Parameter	Description
   Rule Name	Enter any character-based string for easy management and memorization. (Required)
   Rule Type	Field Desensitization. (Required)
   Group by DB	Database type: Supported database types include but are not limited to: MySQL, Oracle, PostgreSQL, DB2, SQL Server, MariaDB, Kingbase, Dameng, Greenplum,and OpenGauss. (Required)
   Group by Data Domain	Select a data field list. For data field definitions, refer to Data Field Configuration.
   Rule Description	Enter the descriptive information for the current rule.
   Default or not	The newly created desensitization rule becomes the default.

7. Configure response action information.

   Table 2 Parameter escription for response actions of new desensitization rule

   Parameter

   Description

   Masking method

   The desensitization method refers to the approach used for data desensitization. Bitwise masking: Keep before/after: Configurable reserved position parameters. Mask before/after: Configurable masked position parameters. No Masking. Random number: Maximum and minimum values need to be configured. Random String Replacement. SHA-256 Hash: Suitable for the three database types MySQL, SQL Server, and MariaDB.

8. Click OK.

Related Operations

You may perform the following operations on the Dynamic Desensitization Rule page afterwards as needed:

• Edit: Modify the information of the anonymization rule to reset its basic settings. To modify the anonymization rule, perform the following steps:
  1. Click the eye icon next to the database type name in the left tree.
  2. On the right side of the page, display the dynamic anonymization rules for the current database type. Click Edit.
  3. Information for modifying desensitization rules. The steps are similar to Add desensitization rule.
  4. Click OK.
• Delete: To delete the anonymization rule, perform the following steps:
  1. In the database type list on the left tree, select the database type to which the desensitization rule you want to modify belongs.
  2. Click the eye icon next to the database type name.
  3. Display the anonymization rules for the current database type on the right side of the page.
  4. To delete a desensitization rule, select the rule and click Delete.
  5. A prompt pops up: Deleting cannot be undone, are you sure?
  6. Click OK.

• Built-in desensitization rules cannot be edited or deleted. The name of a built-in desensitization rule is marked with a five-pointed star icon.
• The rationale for configuring anonymization rule expressions based on database type stems from the specific anonymization approach employed. Dynamic anonymization involves modifying the access SQL statement to incorporate database functions. Since anonymization functions vary across different database types, distinct anonymization expressions must be configured for each database type.