Help Center/ Data Security Center/ User Guide/ Security Management/ Unified Policy Management/ Policy Management
Updated on 2026-07-27 GMT+08:00
View PDF
Share

Policy Management

DSC allows you to create policies for database audit, database encryption, database watermarking, static database masking, and dynamic database masking; and to deliver the policies to services and instances as needed.

Policy Types

  • Database audit: Monitors and records database activity to ensure data integrity, security, and compliance.
  • Database encryption: Encrypts stored information to ensure confidentiality and integrity while preventing unauthorized access and data leakage.
  • Database watermarking: Embeds invisible identifiers into the database to verify authenticity and ownership, and to trace the source of data leakage.
  • Static database masking: Masks sensitive data at rest to protect privacy and security while preserving the data structure and statistical characteristics.
  • Dynamic database masking: Masks sensitive data in real time during execution to prevent unauthorized access.

Database Types and Versions That Support Database Encryption

Data Source Type

Version

MySQL

5.6, 5.7, 5.8, and 8.0

SQL Server
  • 2019_SE, 2019_EE, and 2019_WEB
  • 2017_SE, 2017_EE, and 2017_WEB
  • 2016_SE, 2016_EE, and 2016_WEB
  • 2014_SE and 2014_EE
  • 2012_SE, 2012_EE, and 2012_WEB
  • 2008_R2_EE and 2008_R2_WEB

Oracle

11, 12

PostgreSQL

13, 12, 11, 10, 9.6, 9.5, and 9.4

Kingbase

V8

DMDBMS (Dameng)

7 and 8

TDSQL

10.3.x

DWS

8.1.X

Creating a Policy

In DSC, you can create policies for database audit, database encryption, database watermarking, static database masking, and dynamic database masking; and deliver the policies to services and instances as needed.

Creating a Database Audit Policy

Connect to the DBSS service to monitor and record database instances that are audited without an agent. This helps to maintain data integrity, security, and compliance.

  1. Configure and enable database audit.
  2. In the upper left corner of the page, click and choose Security & Compliance > Data Security Center.
  3. In the navigation pane on the left, choose Security Management > Unified Policy Management.
  4. On the Policy Management tab page, click Create Policy in the upper left corner.
  5. Select the Database audit policy type.
  6. Click Start configuring. The page for configuring the database audit policy type is displayed.
  7. Set the parameters by referring to Table 1.

    Table 1 Parameters for configuring a database audit policy

    Parameter

    Description

    Policy Name

    Enter a policy name. The name can contain a maximum of 255 characters, including letters, digits, underscores (_), and hyphens (-).

    Organization Member Account

    When multi-account management is enabled, select the account of the database audit instance to apply the policy.

    Associated Instance

    Select a database audit instance from the drop-down list.

    Target Data Source

    Select the target data source from the drop-down list. Only database instances that do not require agent audit are supported.

    Display Result Set

    When the function for recording result sets is enabled, the system logs the SQL result content. You can view this content in the logs. If the function is disabled, the SQL result in the log details will be empty.

    Recording result sets may lead to information leakage. Therefore, it is recommended not to enable this function.

    Mask Privacy Data

    You are advised to set masking rules to prevent sensitive data leakage.

  8. Click Save and Deliver. The policy list is displayed, showing the newly created policy.

Creating a Database Encryption Policy

Encrypt data to ensure data confidentiality and integrity and prevent unauthorized access and data leakage.

  1. Purchase data encryption and access control in DBSS.
  2. Complete sensitive data identification.
  3. In the navigation pane on the left, choose Security Management > Unified Policy Management.
  4. On the Policy Management tab page, click Create Policy in the upper left corner.
  5. Select the Database encryption policy type.
  6. Click Start configuring. The page for configuring a database encryption policy is displayed.
  7. Set the parameters by referring to Table 2.

    Table 2 Parameters for configuring a database encryption policy

    Parameter

    Description

    Policy Name

    Enter a policy name. The name can contain only letters, digits, underscores (_), and hyphens (-).

    Associated Instance

    Database encryption gateway

    Data Source

    Select a data source from the drop-down list. For details about the supported database versions, see Database Types and Versions That Support Database Encryption.

    Proxy Port

    The port numbers range from 14000 to 14999. Different database instances (sharing the same address and port) utilize distinct proxy ports. A single database instance consistently uses the same proxy port. When a data source for the same database instance is added, the proxy port is automatically populated.

    Schema

    Select a value from the drop-down list. This parameter is displayed when you select a DWS data source.

    Policy Template

    Select a template from the available options in the drop-down list. Once a policy template is selected, the system will automatically select the data with a sensitivity level equal to or higher than the sensitivity level specified in the template.

    Encryption Algorithm

    Select an encryption algorithm from the drop-down list box. Currently, only AES128 is available.

    Encrypted Table

    Select an encrypted table from the drop-down list.

    The same target table cannot be selected repeatedly.

    Encrypted Table Information

    This parameter is displayed after you select a table.

    Information about the encrypted table, including Field Name, Field Type, and Data Level.

  8. Click Save and Deliver. The policy list is displayed, showing the newly created policy.

Creating a Database Watermarking Policy

Embed invisible identifiers into data to verify data authenticity and ownership and trace data leakage sources.

  1. Log in to the DSC console.
  2. Click in the upper left corner and select a region or project.
  3. In the navigation pane on the left, choose Security Management > Unified Policy Management.
  4. On the Policy Management tab page, click Create Policy in the upper left corner.
  5. Select the Database Watermark policy type.
  6. Click Start configuring. On the Database Watermarking page that is displayed, create a watermark injection or watermark extraction task. For details, see Injecting or Extracting Database Watermarks.

Creating a Static Database Masking Policy

Mask sensitive data to ensure privacy and security while retaining the data structure and statistics features.

  1. Log in to the DSC console.
  2. Click in the upper left corner and select a region or project.
  3. In the navigation pane on the left, choose Security Management > Unified Policy Management.
  4. On the Policy Management tab page, click Create Policy in the upper left corner.
  5. Select the Static database masking policy type.
  6. Click Start configuring. On the displayed data masking page, create a data masking task. For details, see Creating a Static Data Masking Task.

Configuring a Dynamic Database Masking Policy

Mask sensitive data in real time to ensure that unauthorized data cannot be accessed.

  1. Purchase data encryption and access control in DBSS.
  2. Complete sensitive data identification.
  3. In the navigation pane on the left, choose Security Management > Unified Policy Management.
  4. On the Policy Management tab page, click Create Policy in the upper left corner.
  5. Select the Dynamic database masking policy type.
  6. Click Start configuring. The page for configuring a dynamic database masking policy is displayed.
  7. Set the parameters by referring to Table 3.

    Table 3 Parameters for configuring a dynamic database masking policy

    Parameter

    Description

    Policy Name

    Enter a policy name. The name can contain only letters, digits, underscores (_), and hyphens (-).

    Associated Instance

    Database encryption gateway

    Target Data Source

    Select a target data source from the drop-down list box.

    Masking Service Port

    The port numbers range from 14000 to 14999. Different database instances (sharing the same address and port) utilize distinct proxy ports. A single database instance consistently uses the same proxy port. When a data source for the same database instance is added, the proxy port is automatically populated.

    Policy Template

    Select a policy template from the drop-down list. Data will be masked based on the masking rules configured in the template.

    Table

    Select a table from the drop-down list.

    Table Information

    This parameter is displayed after you select a table.

    Table information, including Field Name, Field Type, Data Level, and Masking Algorithm.

  8. Click Save and Deliver. The policy list is displayed, showing the newly created policy.

Related Operations

  • Disabling a policy: You can click Disable in the Operation column to disable a policy in Enabled (Delivered) state. After the policy is disabled, the Status will be changed to Disable (Delivering).

    An encryption policy in Enabled (Delivered) state cannot be disabled or deleted. To decrypt the policy, click Decrypt in the Operation column of the policy. A decryption suffix will be added to the policy name. Its decryption policy cannot be separately created.

  • Enabling a policy: You can click Enable in the Operation column to enable a policy that has been disabled. After the policy is enabled, the Status will be changed to Enabled (Delivered).
  • Deleting a policy: You can click Delete in the Operation column to delete a policy.
Parent Topic: Unified Policy Management