You open the Data Masking agent configuration dialog from a workflow configuration: double-click the agent icon.
The Data Masking agent configuration
The agent can be set to different masking methods, based on the chosen method a different tab will be available for additional configuration. Depending on the configuration, different Storage Fields can also be added. The mapping of which UDR fields is done in the referenced Data Masking profiles. You have the option of referencing one or several Data Masking Profiles.
The Masking Method you select in the Fields In the Data Masking profile you configure the masking method you want to use, which UDR types and field you want to mask/unmask, and any masking method specific settings.
There are four different masking methods that you can use:
Crypto - Uses cryptographic algorithm that can be configured to either derive its key from a passphrase or a Keystore. It uses either AES-128 or AES-256 for data encryption.
Database - Enables data model masking to store masked and unmasked data. The data can be unmasked later when required.
Hash (one way) - Employs a salt-based encryption scheme for obscuring data only. All masked data using this method cannot be unmasked.
Hash/Database - Uses a combination of the database and hash mode.
For more information on the supported data types, refer to Supported Data Types.
Configuration
The Data masking profile consists of five tabs:
| Table of Contents | ||||
|---|---|---|---|---|
|
Fields Tab
The masking method that is selected in the Fields tab determines which of the other three four tabs that will be active , since as these tabs contain masking method - specific configurations.
Data Masking
...
This will use a cryptographic algorithm that can be configured to either derive its key from a passphrase or from a Keystore. The following options are available in the dedicated Crypto tab:
...
Profile - Fields tab
| Setting | Description | |||||
|---|---|---|---|---|---|---|
| Masking Method | Select the masking method to be used in the profile. | |||||
| Storage Fields | Add the fields to map the UDR fields to.
| |||||
| UDR Field Mappings | All all the UDR types and fields for the profile to process. | |||||
| Random Algorithm (Only for String type) | The supported algorithms are:
| |||||
| Regex Pattern | For more information on the regex pattern, refer to RegExr: Learn, Build, & Test RegEx. | |||||
| String Length | ||||||
| Output Format |
Crypto Tab
This tab is enabled only when the Crypto masking method is selected in the Fields tab.
Data Masking Profile - Crypto tab
| Setting Description | Description |
|---|---|
| Derive Key from Passphrase |
...
| Select this option for the cryptographic engine |
...
| to use a key from |
...
| the passphrase. |
...
| The Passphrase and Algorithm fields will be enabled. | ||||||
| Passphrase | Enter a passphrase manually or click the Random button to generate a random key. The passphrase is then hashed and it is use as the key.
| |||||
| Algorithm | Select the algorithm to be used, either the AES-128 or AES-256.
|
...
| |
| Read Key from Keystore |
...
Select this option to use a key from a designated |
...
keystore. The |
...
keystore must be |
...
a JCEKS. The Keystore Path, Keystore Password, Key Name and Key Password fields will b e enabled.
| |||||||
| Keystore Path | Enter the path to the |
...
| keystore file. | |
| Keystore Password | Enter the associated password. |
| Key Name | This field is optional. Enter the associated key name. |
| Key Password | This field is optional. Enter the associated key password if required, otherwise the Keystore Password is used as the default password. |
Database Tab
This tab is enabled only when the Database Storage masking method is selected in the Fields tab.
...
This option enables database data model masking. By selecting the target database using the Browser button, the view list will be expanded with the appropriate information. In a table view, the following fields will be shown in columns:
...
Data Masking Profile - Database tab
| Setting | Description |
|---|---|
Database Model | |
| Database | Browse and select the Database profile to use. |
| Table | Select the database table to view the following information:
|
...
|
...
|
...
In a separate Advanced section, additional parameters can be configured: the queue size, the maximum number of workers, and the maximum select batch size value.
...
Hash (One way)
...
The one-way hash masking method employs a salt-based encryption scheme. The Salt input box allows for manual entry of the relevant hash, optionally a Random button can be pushed to generate a random entry.
...
Hash/Database
...
| |||||
| Advanced | |||||
| Queue Size | Set the queue size for the workers. The queue size will be split between the workers. | ||||
| Max Number of Workers | Enter the maximum number of workers. | ||||
| Max Select Batch Size | Enter the maximum size of the batch when making large select statements to retrieve data. | ||||
Hash Tab
This tab is enabled only when the Hash masking method is selected in the Fields tab.
Data Masking Profile - Hash tab
| Setting | Description |
|---|---|
| Salt | Enter the entry of the relevant hash or click the Random button to generate a random entry. |
Hash/Database Tab
This tab is enabled only when the Hash/Database masking method is selected in the Fields tab.
Data Masking Profile - Hash/Database tab
| Setting | Description | |||||
|---|---|---|---|---|---|---|
| Data Model | ||||||
| Database | Browse and select the Database profile to use. | |||||
| Table | Select the database table to view the following information:
| |||||
| Hash | ||||||
| Salt | Enter the entry of the relevant hash or click the Random button to generate a random entry. | |||||
| Advanced | ||||||
| Queue Size | Set the queue size for the workers. The queue size will be split between the workers. | |||||
| Max Number of Workers | Enter the number of workers. | |||||
| Max Select Batch Size | Enter the maximum size of the batch when making large select statements to retrieve data. | |||||
| Anchor | ||||
|---|---|---|---|---|
|
The supported data types for each masking method are as follows:
| Data type | Crypto | Database | Hash | Hash/Database |
|---|---|---|---|---|
| string | ||||
| integer | ||||
| long | ||||
| short | ||||
| double | ||||
| byte | ||||
| bytearray |