Masking ID Numbers in ID Card Images Stored in OBS

Scenarios

To ensure that images in PNG, JPG, JPEG, BMP, or WEBP format containing Chinese mainland ID card information stored in specific folders in a private OBS bucket are not disclosed when being shared with other users, you can use DSC image masking. DSC can mask ID numbers. The masked images will be saved to the specified storage path.

Solution Architecture

The following figure shows the image masking process.

To mask and share images, perform the following steps:

1. Creating an OBS bucket and uploading files: Create an OBS bucket with private read and write permissions, and upload an image containing the Chinese mainland ID card information to a folder in the OBS bucket. The image in the folder inherits the private permissions of the bucket.
2. Authorizing access to OBS buckets and interconnecting with DSC: You can perform operations on OBS data only after the authorization.
3. Creating and starting a masking task: Create an image masking task, set the OBS bucket file path of the image to be masked, identify and mask the image in the OBS bucket, and save the masked image to the target storage path.
4. Configuring IAM users to access masked images: Use a bucket policy to grant specified IAM users the read-only permission to access the folder where the masked image is stored. Masked images can be shared this way.

Prerequisites

• You have purchased DSC.
• You have enabled OBS.

Step 1: Create an OBS Bucket and Upload Files

Step 2: Authorize Access to the OBS Bucket and Interconnect with DSC

1. Log in to the DSC console.
2. Choose Asset Center > Asset Management. In the upper left corner of the displayed page, click Modify next to Cloud Asset Authorization. The Authorize Access to Cloud Assets page is displayed.
3. On the displayed page, enable OBS asset authorization.
4. Return to the Asset Management page, and click OBS under OBS. The OBS asset list is displayed.
5. Click Add User-built Bucket in the upper left corner. In the displayed dialog box, select the OBS buckets to be added.
6. Click OK. If the added OBS bucket is displayed in the list, the adding is successful.

Step 3: Create and Start a Masking Task

1. In the navigation pane on the left, choose Security Management > Data Masking.
2. Switch to the OBS tab, click Create Task, and set parameters under Configure Data Source.
   • Enter a custom task name.
   • Select Data Source: Select OBS.
   • Data Source: Select the OBS bucket name and file path of the image uploaded in Step 1: Create an OBS Bucket and Upload Files, and set File Type to Image.

3. Click Next and set parameters under Set Masking Algorithm.

   Under Objects, enable ID card number (Chinese mainland) (), and set Masked by to White block.

4. Click Next, and retain the default settings.
5. Click Next, configure the storage path of the masked image, and set OBS File Path to the root directory.
6. Click Finish. The masking task is displayed in the task list.
7. Locate the target task, ensure the status is in the Enable/Disable column, and click Execute in the Operation column.
8. Wait until Status changes to Completed and view the information about the masked image.
9. Verify the masking result.
   1. Go to the OBS console, and choose Buckets from the navigation pane on the left.
   2. Click the OBS bucket name, open the storage path of the masked image set in 5, and view the masked image. The ID card number is masked.

      In the masked ID card.png image, the name is also replaced with a placeholder, and the ID card photo is masked by an avatar icon.

Step 4: Configure a Specific IAM User to Access the Masked Image

1. Go to the OBS console, and choose Buckets from the navigation pane on the left.
2. Click the OBS bucket name, open the storage path of the masked image set in 5, locate the masked image, and choose More > Configure Object Policy in the Operation column.
   • Enter a custom policy name.
   • Effect: Select Allow.
   • Principal: Select Other accounts and enter the account ID and IAM user ID or name. For details about how to obtain the account ID and IAM user ID, click Learn how to find an account ID, IAM user ID, or IAM username.
   • Retain default settings for other parameters.

3. Click Create.
4. The authorized IAM user can access the masked image on the OBS console via the OBS access address of the authorized image.

   The masked image file ID card.png is displayed in the file list. The IAM user has accessed the authorized image.

Summary

For images containing Chinese mainland ID card information stored in OBS buckets, you can mask the ID card number before sharing them. This prevents property loss, reputation loss, and identity spoofing caused by ID card number leakage.

References

DSC can also mask images containing license plate and facial information stored in OBS buckets. This meets the image masking requirements in various service scenarios and ensures secure sharing of image data in OBS. For more information, see Creating and Running an OBS Masking Task.