Help Center/ Data Security Center/ User Guide/ Security Management/ Data Watermarking/ Injecting or Extracting Database Watermarks
Updated on 2026-08-19 GMT+08:00
View PDF
Share

Injecting or Extracting Database Watermarks

Database watermarking embeds unique identifiers (including copyright claims, ownership metadata, and lineage tracking codes) directly into database records. This technology serves as a critical control for copyright protection, breach tracing, tamper detection, and compliance auditing, making it a foundational tool for data asset security and governance. Its main purposes and functions are as follows:

  1. Copyright protection and ownership proof
    • Purpose: To provide intellectual property protection for database owners and prevent unauthorized copying or theft.
    • Description: By embedding a unique watermark, the source of a data breach can be traced, the legitimate ownership of the data can be proven, and legal rights can be defended.
  2. Data breach tracking and lineage tracing
    • Purpose: Invisible watermarks are used to mark specific recipients or usage scenarios when databases distribute or share data.
    • Description: If data is leaked or illegally distributed, the source of the breach can be pinpointed by extracting the watermark, thereby enhancing data security control.
  3. Anti-tampering and integrity verification
    • Purpose: To embed robust watermarks in critical data to detect unauthorized modifications.
    • Description: By verifying watermark integrity, the service determines whether data has been maliciously altered, ensuring information authenticity and reliability.
  4. Compliance and audit
    • Purpose: To meet data lineage and traceability requirements mandated by industry regulations (including GDPR and data security laws).
    • Description: Companies can check the auditable records of data transfers, fulfilling data governance responsibilities and mitigating compliance risks.

Prerequisites

Constraints

Type

Restriction

Injecting a Watermark
  • DWS data supports the following watermarks: smallint, integer, bigint, float4, float8, varchar, text, and char.
  • MRS Hive data supports the following watermarks: smallint, int, long, float, double, and string.
  • A single column in the embedding target cannot have more than 30% redundant data.
  • The database encoding is UTF-8.
  • The database injection is a non-primary key column.
  • It is recommended that the number of data rows in a data table be greater than 1500.

Extracting a Watermark
  • The source file must be in CSV format and cannot be larger than 20 MB.
  • The table may contain more than 1,500 rows of data.
  • The CSV file content is encoded in UTF-8 mode. Ensure that the data is complete and correct.

Injecting or Extracting Database Watermarks

You can embed watermarks into or extract them from database tables.

After you embed a watermark, DSC converts it into a binary bit sequence and applies Reed-Solomon (RS) error correction coding to enhance robustness. Error correction levels range from 0 to 3 (default: 1), multiplying the encoding length by 1.5x (level 1), 2x (level 2), or 3x (level 3).

A higher error correction level increases the watermark bit count, lowering the Bit Error Rate (BER) during breach tracing. However, a higher level requires a larger target dataset to ensure embedding integrity.

  1. Log in to the DSC console.
  2. Click in the upper left corner and select a region or project.
  3. In the navigation pane on the left, choose Security Management > Data Watermarking.
  4. Click the Database Watermarking tab page. The Inject Watermark tab is displayed.
  5. Click Create Task. The Configure basic information page is displayed.

    Figure 1 Configuring basic information
    Table 1 Parameters for configuring basic information

    Parameter

    Description

    Task Name

    Enter a task name.

    The value can contain only letters, digits, underscores (_), and hyphens (-), and cannot exceed 255 characters.

    Watermark ID

    Enter the watermark identifier to be injected.

    Embedding Scheme

    Click the drop-down list box to select a watermark embedding scheme. The options are as follows:

    • Lossless - pseudo column watermark: A pseudo column is generated based on attributes from the relational table, blending in seamlessly to evade attacker detection. Watermarks are embedded into this pseudo column to prevent distortion or modification of the original data.
    • Lossless - pseudo row watermark: Pseudo rows are generated based on the existing data type, format, and value range. Watermarks are embedded into these pseudo rows to prevent distortion or modification of the original data.
    • Lossy - column watermark: Watermarks are injected into existing column data, which modifies or alters the original values.

  6. Click Next. On the Configure source and target information page, set related parameters by referring to Table 2.

    • Lossless - pseudo column watermark: Embed watermarks to created columns to avoid data loss.
      Figure 2 Pseudo column watermarks
      Table 2 Source and destination parameters of pseudo column watermarks

      Parameter

      Description

      Data Source Type

      Select a data source type from the drop-down list box.

      • When Embedding Scheme is set to Lossy - Column Watermark, the following data source types are supported:
        • DWS
        • MRS_HIVE
      • When Embedding Scheme is set to Lossless pseudo-column watermarking or Lossless pseudo-line watermarking, the following data types are supported:
        • DWS
        • PostgreSQL
        • MySQL

      Database Instance

      Select a Database Instance from the drop-down list. If no database instance is available, add databases by following the instructions provided in sections Adding and Authorizing Database Assets and Adding and Authorizing Big Data Assets.

      Database

      Select a Database from the drop-down list.

      Schema

      This parameter is displayed when Database is DWS or PostgreSQL. Click a Mode as required.

      Source Table

      Select the corresponding Source Table name.

      Column Name

      Only letters, numbers, underscores (_), and hyphens (-) are allowed (255 characters max).

      Column Data Type

      Click to select the data type of the embedded pseudocolumn.

      • Numeric
      • String
      • Date

      Example Value

      Choose Setting Field Rules. The embedded pseudocolumn data example is displayed.

      Setting Field Rules
      • If Column Data Type is set to Numeric, this parameter is a random number. You can specify the range and precision of the random number. If the range and precision are not specified, pseudo data will be randomly generated.
      • When Column Data Type is set to String, you can select pseudo data such as the person name, ID card number, and mobile number from the drop-down list box.
      • When the Column Data Type is set to Date, you can specify a date range. If no date range is specified, pseudo data is randomly generated.

      Add a Pseudo Column

      You can click Add a Pseudo Column to add two pseudo-columns.

      Target Table

      Enter the target table name. The name can contain only letters, digits, underscores (_), and hyphens (-) and cannot exceed 255 characters.
    • Lossless - pseudo-line watermark: Watermarks are embedded into line copies to avoid data loss.
      Figure 3 Pseudo-line watermark
      Table 3 Source and destination parameters of pseudo-line watermarks

      Parameter

      Description

      Data Source Type

      Select a Data Source Type from the drop-down list. The following data source types are supported:

      • DWS
      • PostgreSQL
      • MySQL

      Database Instance

      Select a Database Instance from the drop-down list. If no database instance is available, add databases by following the instructions provided in sections Adding and Authorizing Database Assets and Adding and Authorizing Big Data Assets.

      Database

      Select a Database from the drop-down list.

      Schema

      This parameter is displayed when Database is DWS or PostgreSQL. Click a Mode as required.

      Source Table

      Click and select the corresponding source data table name.

      Number of Pseudo-Line Spans

      Enter a valid integer greater than 1 to specify the number of pseudo-rows inserted into the original data.

      Target Table

      Enter the name of the data storage table with watermarks embedded. The name can contain only letters, digits, underscores (_), and hyphens (-), and cannot exceed 255 characters.
    • Lossy - column watermark: Embed watermarks directly to the column data.
      Figure 4 Lossy column watermarks
      Table 4 Source and destination parameters of lossy column watermarks

      Parameter

      Description

      Data Source Type

      Select a Data Source Type from the drop-down list. The following data source types are supported:

      • DWS
      • MRS-HIVE

      Database Instance

      Select a Database Instance from the drop-down list. If no database instance is available, add databases by following the instructions provided in sections Adding and Authorizing Database Assets and Adding and Authorizing Big Data Assets.

      Database

      Select a Database from the drop-down list.

      Schema

      This parameter is displayed when the Database is DWS. Click a Mode as required.

      Source Table

      Select the corresponding Source Table name.

      Watermark Embedding Bar

      Click to select the column data to which watermarks are embedded. You can select multiple columns.

      NOTE:
      • The source database character set must be UTF-8.
      • A single column in the embedding target cannot have more than 30% redundant data.

      Target Table

      Enter the name of the data storage table with watermarks embedded. The name can contain only letters, digits, underscores (_), and hyphens (-), and cannot exceed 255 characters.

  7. Click Next. The Configuring scheduling page is displayed.

    Figure 5 Configuring scheduling
    • If the Scheduling Parameter is set to Once, you can select Now or As scheduled to start the watermark embedding task.
    • If the Scheduling Parameter is set to Daily, Weekly, or Monthly, start the watermark embedding task at a specified time daily, weekly, or monthly.

  8. Click Finish.

    You can view the task progress in the Status column.

  1. Log in to the DSC console.
  2. Click in the upper left corner and select a region or project.
  3. In the navigation pane on the left, choose Security Management > Data Watermarking.
  4. Click the Database Watermarking tab page. The Inject Watermark tab is displayed.
  5. Click the Extract Watermark tab.
  6. Click Create Task. In the displayed dialog box, set parameters based on Table 5.

    Figure 6 Creating an extraction task
    Table 5 Creating a watermark extraction task

    Parameter

    Description

    Task Name

    Enter a task name.

    Source Files

    The source file must be in CSV format and cannot be larger than 20 MB. The table may contain more than 1,500 rows of data. The CSV file content is encoded in UTF-8 mode. Ensure that the data is complete and correct.

    Extraction Mode

    Select a watermark extraction mode from the drop-down list box. For lossy column embedding and lossless column embedding, extract watermarks by column. For lossless line embedding, extract watermarks by row.

    Delimiter

    Delimiters in a file. For example: comma (,)

  7. Click OK. The watermark extraction task is created.

Related Operations

  • A running watermark embedding task cannot be edited or deleted.
    • In the Inject Watermark tab, locate the target task and click Edit in the Operation column to modify the configurations of the watermark injection task.
    • In the Inject Watermark tab, locate the target task and click Delete in the Operation column to delete the watermark injection task. You can also select multiple tasks and click Batch Delete to delete them.

      The deletion operation cannot be undone.

  • In the Inject Watermark tab, locate the target task and choose More > Start Task in the Operation column to start the task.
  • In the Inject Watermark tab, locate the target task and choose More > Stop Task in the Operation column to stop the task.
  • In the Inject Watermark tab, locate the target task and choose More > Run in the Operation column to execute the task.
  • In the Extract Watermark tab, locate the target task and click Delete in the Operation column to delete the watermark extraction task. You can also select multiple tasks and click Batch Delete to delete them.

    The deletion operation cannot be undone.

  • In the Extract Watermark tab, locate the target task and click View Result in the Operation column to view the extracted invisible watermark content.

References

Parent Topic: Data Watermarking