What Is Discovery Rule

Discovery Rule: Used for sensitive data discovery tasks; by executing these tasks within a project, specific fields are tagged as a particular Data Domain.

A single data domain can contain one or more discovery rules, designed to identify sensitive data with different data characteristics within the same domain, thereby improving the accuracy of data discovery. For example, a name data domain may include discovery rules for Chinese names, English names, or mixed Chinese–English names, among others.

One of these rules is the Data Domain Default Rule, which serves as the most commonly used discovery rule.

For instructions on managing sensitive data discovery tasks, please refer to the Importing and Exporting.

The Data Domain is a description of data-related knowledge within a database encryption system, primarily used to characterize a specific data business entity. For operational convenience, Data Domain management is not implemented as an independent module but is integrated into the Discovery Rule Module. Typical data domains include: name, mobile phone number, age, business license, etc.

For configuring field encryption, there are two typical approaches:

• When there are few sensitive fields that need to be encrypted – for example, when a business system contains only a few or a dozen sensitive fields requiring encryption – the database encryption module can be configured manually for each field individually.
• When a large number of sensitive fields require encryption – for example, when a business system involves hundreds or even thousands of sensitive fields that need to be encrypted – the system provides a batch encryption configuration method (which links the sensitive data discovery results to the configuration process).

The concept of discovery rules is specific to data domains; that is, discovery rules defined for a particular data domain can be used to determine whether data belongs to that sensitive data domain. As shown in Figure 1, Mobile Phone Number is a data domain, and "Mobile Phone Number Field Search" is the discovery rule for identifying sensitive mobile phone number data.

Figure 1 Data domain and discovery rules