Skip to main content

Manage data masking algorithms

Data masking algorithms define how NineData masks sensitive columns. Use predefined algorithms for common masking patterns, or create custom algorithms when your organization needs a specific masking result.

Before you begin​

  • You have created or joined an organization, and this organization has subscribed to either DevOps Pro or DevOps Enterprise. Please ensure that your annual or monthly subscription is still active. For more information, please refer to Manage Organizations.
  • Your current account has switched to the target organization. For more information, please refer to Switching to an Organization.

Procedure​

Create masking algorithms​

NineData provides 33 predefined masking algorithms that cover common masking methods. If none of the predefined algorithms fit your scenario, create a custom masking algorithm.

  1. Sign in to the NineData Console.

  2. In the left navigation bar, click Datasource>Sensitive Data.

  1. Click the Masking Algorithm tab, and then click Create Masking Algorithm.

    tip

    Alternatively, click Duplicate in the Actions column of an existing masking algorithm to create a custom algorithm based on it.

  2. Define the following parameters, and then click Create Masking Algorithm.

    Parameter
    		Description
    NameEnter the name of the masking algorithm.
    Algorithm Types Select the masking algorithm type. For details, see Appendix: Algorithm types.
    DescriptionEnter a description of the masking algorithm to make later maintenance easier.

    To preview the masking result, enter sample data in Mock String, then click Test Algorithm. The preview appears in Data Masking Result.

Delete masking algorithms​

If a custom masking algorithm is no longer in use, delete it.

Notes

  • Only manually created masking algorithms can be deleted. System predefined algorithms cannot be deleted.
  • Before deleting a masking algorithm, make sure it is not associated with any table fields or sensitive data types.

Procedure

  1. Sign in to the NineData Console.

  2. In the left navigation bar, click Datasource>Sensitive Data.

  1. Click the Masking Algorithm tab, and click Delete in the Actions column of the target masking algorithm.

  2. In the confirmation dialog, click OK.

Result​

Created masking algorithms become available for sensitive data masking rules. Deleted algorithms are removed from the custom algorithm list.

Appendix: Algorithm types​

Algorithm Type
DescriptionMasking Effect
Full maskReplaces all characters of sensitive data with specific symbols, fully hiding the original content. This algorithm provides the following configurable parameter:
Mask Character: Enter any character. The masked portion of the original content will be replaced by this character.
  • Before masking: NineData
  • After masking: ********
Fixed Position maskMasks only specific position characters in the data field, leaving the rest visible to display part of the content. This algorithm provides the following configurable parameters:
  • Mask Character: Enter any character. The masked portion of the original content will be replaced by this character.
  • Mask Position: Defines the positions of characters to mask in the format (start position, end position). For example, (5, -5) masks all content from the 5th character from the left to the 4th character from the right.
  • Before masking: Zhejiang Province, City, District, Street
  • After masking: Zhejiang Province********
Fixed Character maskReplaces specific characters in the data field with a specified symbol, often used to mask certain characters of sensitive information. This algorithm provides the following configurable parameters:
  • Mask Character: Enter any character. The masked portion of the original content will be replaced by this character.
  • Masked Character: Defines the character(s) to be masked. For example, Zhang San, all instances of Zhang San in the target field will be replaced or masked.
  • Before masking: Owner: Zhang San
  • After masking: Owner: **
MD5Uses the MD5 algorithm to convert the target data into a 32-character hash value. This algorithm provides the following configurable parameter:
Salt: A salt value can be added to the original data, which can be any random data to enhance the uniqueness and security of the hash.
  • Before masking: 12345
  • After masking: 109889f941...
SHA1Uses the SHA1 algorithm to convert the target data into a 40-character hash value. This algorithm provides the following configurable parameter:
Salt: A salt value can be added to the original data, which can be any random data to enhance the uniqueness and security of the hash.
  • Before masking: 12345
  • After masking: b85ec06d48...
SHA256Uses the SHA256 algorithm to convert the target data into a 64-character hash value. This algorithm provides the following configurable parameter:
Salt: A salt value can be added to the original data, which can be any random data to enhance the uniqueness and security of the hash.
  • Before masking: 12345
  • After masking: e2f5e4f6f0...
AESA symmetric encryption algorithm widely used for data protection. Symmetric encryption means that the same key is used to both encrypt and decrypt the data. AES requires a 16-digit numeric password as the encryption key.
Password: Enter a 16-digit numeric password.
  • Before masking: 12345
  • After masking: M5RMO9SiEl...