Configuring and Viewing Masking Rules

This method is used to replace a field of the string type with a hash value. In a relational database, if the field length is less than the hash length, the length of the field in the destination database is set to be the same as the hash value length to ensure that the hash value is completely written to the destination database. By default, two hash algorithms, SHA-256 and SHA-512, are configured for DSC.

Hash algorithms are built-in and do not need to be configured. If you want to test the masking effect, perform the following steps:

1. Log in to the management console.
2. Click in the upper left corner and select a region or project.
3. In the navigation tree on the left, click . Choose Security & Compliance > Data Security Center .
4. In the navigation pane, choose Data Asset Protection > Static Data Masking. On the page displayed, click the Masking Rule tab.
   Figure 1 Hash masking
   

5. In the column where the SHA-256 or SHA-512 algorithm is, click Edit and Test.
6. On the Edit and Test page, set Masking Algorithm to Hash, enter Raw Data, and click Test. The masked data is displayed in the Masking Result text box.
   Figure 2 Hash method
   

This method masks data using encryption algorithms and a master key.

1. Log in to the management console.
2. Click in the upper left corner and select a region or project.
3. In the navigation tree on the left, click . Choose Security & Compliance > Data Security Center .
4. In the navigation pane, choose Data Asset Protection > Static Data Masking. On the page displayed, click the Masking Rule tab.
   Figure 3 Hash masking
   

5. Click the Encryption tab.
   • Master Key Algorithm: Select an encryption algorithm from the drop-down list box. Two encryption algorithms are available: AES256 and SM4.

     Table 2 Master key algorithms

     Key Type	Algorithm Type	Key Specifications	Description	Usage
     Symmetric key	AES	AES_256	AES symmetric key	Encrypts and decrypts a small amount of data or data keys.
     Symmetric key	SM4	SM4	SM4 symmetric key	Encrypts and decrypts a small amount of data or data keys.

   • For KMS encryption, the KMS key can be either selected from the drop-down list or entered:
     • Select from Keys: Select an existing master key from the drop-down list. If no master key is available, click Create KMS Key to create one. For details about how to create a KMS key, see Creating a Key.
       

       By default, the master key csm/default is used for encryption.

     • Enter a KMS key ID: Enter the ID of the KMS key in the current region.
   • Select the Data Key Length from the drop-down list box. The options are 128, 192, and 256.

6. After the configuration is complete, click Generate Encryption Configuration.

   If you want to delete a configured encryption configuration, click Delete in the Operation column.

   

   Click to enable the rotation policy. After rotation, the current encryption configuration is updated to improve security.

This method uses the specified character * or a random character to cover part of the content.

There are six masking methods available, including retaining first N and last M, retaining from X to Y, masking first N and last M, masking from X to Y, masking data ahead of special characters, and masking data followed by special characters.

1. Log in to the management console.
2. Click in the upper left corner and select a region or project.
3. In the navigation tree on the left, click . Choose Security & Compliance > Data Security Center .
4. In the navigation pane, choose Data Asset Protection > Static Data Masking. On the page displayed, click the Masking Rule tab.
   Figure 4 Hash masking
   

5. Click the Character Masking tab.
6. Click Add to configure a character masking rule.
   Figure 5 Adding a character masking rule
   

7. Configure the parameters by referring to Table 3. Enter the raw data and click Test. The masking result will be displayed in the Masking Result text box.

   Table 3 Character masking parameters

   Parameter	Description
   Name	Enter a character masking rule name. The name can contain only letters, digits, underscores (_), and hyphens (-), and cannot exceed 255 characters.
   Rule	The following rules are available: Retain first N and last M Retain from X to Y Mask first N and last M Mask from X to Y Mask data ahead of special characters Mask data followed by special characters
   Rule Variable	Enter the value of the corresponding rule. For example, if you select Retain from x to y, set x to 3, and set y to 6, meaning the third to sixth characters are retained.
   Masking Method	The optional masking methods are as follows: Fixed characters: Replace specified characters with fixed characters. Random characters: Replace specified characters with random characters.
   Masked with	This parameter is displayed when Masking Method is set to Fixed Characters. You need to enter the specified characters used to mask data.
   Random Character Type	The random characters include: Random letters Random digits Combination of random digits and letters

8. Verify the testing result and click Save.
   

   • Multiple character masking rules have been preset in DSC. Built-in masking rules cannot be deleted. To delete a custom masking rule, click Delete in the Operation column of the target rule.
   • All rules can be edited. To edit a rule, locate the row containing the rule and click Edit in the Operation column.

This method masks data by replacing matched keywords with custom strings. For example, if the original characters are abcdefgbcdefgkjkoij, the keyword is bcde, and the replacement string is 12, the masking result is a12fg12fgkjkoij.

1. Log in to the management console.
2. Click in the upper left corner and select a region or project.
3. In the navigation tree on the left, click . Choose Security & Compliance > Data Security Center .
4. In the navigation pane, choose Data Asset Protection > Static Data Masking. On the page displayed, click the Masking Rule tab.
   Figure 6 Hash masking
   

5. Click the Keyword Replacement tab.
6. Click Add in the upper left corner. The Add Keyword page is displayed.
7. Set the keyword and the replacement string.

   Then, the keywords matched in raw characters will be replaced with the replacement string.

   Figure 7 Adding a keyword
   

8. Enter the raw data and click Test. The masking result will be displayed in the Masking Result text box.
9. Verify the testing result and click Save.
   • In the Operation column of the keyword replacement rule list, click Edit and Test to modify a masking rule.
   • In the Operation column of the keyword replacement rule list, click Delete to delete a masking rule.

It is a built-in masking rule of DSC and does not need to be configured. To view the masking rule, perform the following steps:

1. Log in to the management console.
2. Click in the upper left corner and select a region or project.
3. In the navigation tree on the left, click . Choose Security & Compliance > Data Security Center .
4. In the navigation pane, choose Data Asset Protection > Static Data Masking. On the page displayed, click the Masking Rule tab.
   Figure 8 Hash masking
   

5. Click the Value Change tab.

1. Log in to the management console.
2. Click in the upper left corner and select a region or project.
3. In the navigation tree on the left, click . Choose Security & Compliance > Data Security Center .
4. In the navigation pane, choose Data Asset Protection > Static Data Masking. On the page displayed, click the Masking Rule tab.
   Figure 9 Hash masking
   

5. Click Round.

   There are two built-in data masking algorithms available:

   • Date Roundup: Used for time-related fields such as timestamp, time, data, and datatime in RDS.
   • Number Roundup: Used for value types fields such as double, float, int, and long. After data masking, the original field type does not change.

6. Click Edit and Test. On the Edit and Test page, select Roundup for Masking Algorithm and set the Roundup result.

   Masking Result: Rounds a given value downwards to a multiple value closest to the raw data. For example, if the given value is 5 and the raw data is 14, the multiple of 5 that is closest to 14 is 10. That is, the masking result is 10.

   Figure 10 Number roundup
   

7. Enter the raw data and click Test. The masking result will be displayed in the Masking Result text box.
8. Verify the testing result and click Save.