Group Masking

Group masking, also known as compound masking, enables you to mask related columns together as a group, ensuring that the masked data across the related columns retain the same relationship. You can use the group masking feature when you create data masking jobs.

About Group Masking

In a masking policy, the columns being masked as a group must belong to the same table. You can use the Shuffle, User Defined Function, Deterministic Substitution, and Random Substitution masking formats for group masking. The Deterministic Substitution and Random Substitution masking formats use data from another table to mask your sensitive data.

Group Masking Example Using Shuffle

The following is an example of group masking using the Shuffle masking format. Suppose that you have customers from across the world. You have their details stored in a table, as shown below.

You don’t want your developers to know the location of your customers. So, you want to mask the CITY, STATE and COUNTRY columns before sharing this data with the development team. But you want to have realistic masked data. For example, Richard lives in Santa Clara, California in the United States. After masking, if the city and state are Atlanta and Georgia respectively, India as the country is not valid. In this case, you want to ensure that the country remains the United States.

You can group these columns and use the Shuffle masking format to shuffle them together. After shuffling, your masked data might look like the data shown below.

Group Masking Example Using Deterministic Substitution

This example shows you how to use the Deterministic Substitution masking format with group masking to mask sensitive data with data from another table. Suppose that you have customers from across the world. You have their details stored in a table, as shown below.

Let’s assume that you want to use the data from the following table for group masking:

After masking these columns using the group masking option with the Deterministic Substitution masking format, your masked data might look like the data shown below.

Mask Related Columns Together as a Group (Group Masking)

You can mask related columns together as a group, ensuring that the masked data across the related columns retain the same relationship.

1. Under Data Safe - Database Security, select Data masking.

2. Under Data masking, select Masking policies.

3. Select the Masking Columns tab.

4. Select Assign group masking from the ... menu at the end of the row for one of the columns that is part of the group.

   The Edit Masking Format page displayed. By default, the Group Name field, Masking Format Entry drop-down list, and the column are displayed. You can add and remove columns from the group.

5. In the Group Name field, enter a new group name if this is the beginning of a group masking configuration. Or, select an existing group name if you want to add the column to an existing group masking configuration.

6. From the Masking Format Entry drop-down list, select the masking format that you want to apply to the columns in the group. You can select Shuffle, Deterministic Substitution, Random Substitution, or User Defined Function.

7. If you selected Shuffle as the masking format in step 4, you can optionally enter “group by” column names in the Group Columns box.

8. If you selected Deterministic Substitutionas the masking format in step 4, enter the name of the substitution schema and table. Also, for each column listed, enter the name of the substitution column. Before you can submit the data masking job, you will need to enter a seed value because you are configuring deterministic substitution.

9. If you selected Random Substitution as the masking format in step 4, enter the name of the substitution schema and table. Also, for each column listed, enter the name of the substitution column. For random substitution, you will not need to enter a seed value before you submit the data masking job.

10. If you selected User Defined Function as the masking format in step 4, enter the name of the schema and function for each column listed. Optionally, you can also enter a package name.

11. To add another column to the group, click Add Column.

    You can repeat this step until all columns in the table are listed, after which point the Add Column button becomes unavailable. Make sure that the column you initially selected to configure in step 2 is listed.

12. To remove a column from the group, select the check box for the column, and then clickRemove Column.

13. Click Update.