Configuring Data Masking Rules

Scenarios

An enterprise opens its user information query APIs to partners. The response data contains sensitive fields such as the user's mobile number, ID card number, and bank card number. When a partner calls the API, API data security protection automatically masks sensitive fields in the response based on the preconfigured masking rules and returns the masked data to the partner. This meets service interconnection requirements and ensures that sensitive information is not leaked through APIs. When internal authorized systems call the same API, complete data can be returned based on the differentiated masking rules. In this way, the masking granularity can be flexibly controlled based on the identity of the caller.

Prerequisites

You have added an application asset.

(Optional) Configuring a Masking Template

Before configuring a custom data masking rule, you can configure a masking template and use it to quickly configure a data masking rule.

1. Log in to the API data security protection web console as user sysadmin.
2. In the navigation pane on the left, choose Security Policies > Data Masking and click the Templates tab.
3. In the upper right corner of the page, click Add Template.
4. On the displayed page, configure masking template information, as shown in Figure 1.
   Figure 1 Configuring a masking template
   

5. After the masking template is configured, click Save.

Configuring a Data Masking Rule

Before configuring a data masking rule, ensure that you have added application assets. For details, see Application Services. Ensure that no rules that conflict with the data masking rule are enabled.

1. Log in to the API data security protection web console as user sysadmin.
2. In the navigation pane on the left, choose Security Policies > Data Masking and click the Rules tab.
3. Click Add in the upper right corner of the page.
4. In the displayed dialog box, configure the data masking rule. Figure 2 shows an example of configuring a data masking rule using a template.
   Figure 2 Configuring a data masking rule
   

5. Click OK.

Verifying a Data Masking Rule

1. Enter the proxy IP address and port (172.16.35.44:8182) of the application in the address box of the browser on the client. If sensitive data is masked, the masking rule takes effect. Figure 3 shows an example.
   Figure 3 Verifying the data masking result
   

2. Log in to the API data security protection web console as user sysadmin.
3. Choose Log Management > Retrieval, find the target request record, and click Details. If the request matches the configured data masking rule, the masking rule takes effect.