Group Masking

Group masking lets you mask related columns together while preserving their relationships in the masked data.

About Group Masking

In a masking policy, the columns being masked as a group must belong to the same table. You can use the Shuffle, User Defined Function, Deterministic Substitution, and Random Substitution masking formats for group masking. The Deterministic Substitution and Random Substitution masking formats use data from another table to mask your sensitive data.

Group Masking Example Using Shuffle

The following is an example of group masking using the Shuffle masking format. Suppose that you have customers from around the world. You have their details stored in a table, as shown below.

You don’t want your developers to know the locations of your customers, so you want to mask the CITY, STATE, and COUNTRY columns before sharing the data with the development team. However, you want the masked data to remain realistic. For example, Richard lives in Santa Clara, California, in the United States. After masking, if the city and state are Atlanta and Georgia, respectively, India is not a valid country. In this case, you want to ensure that the country remains the United States.

You can group these columns and use the Shuffle masking format to shuffle them together. After shuffling, your masked data might look like the data shown below.

Group Masking Example Using Deterministic Substitution

This example shows you how to use the Deterministic Substitution masking format with group masking to mask sensitive data with data from another table. Suppose that you have customers from around the world. You have their details stored in a table, as shown below.

Suppose that you want to use the data from the following table for group masking:

After masking these columns using the group masking option with the Deterministic Substitution masking format, your masked data might look like the data shown below.

You can apply a column-level condition to a column within a masking group to control when the masked value is applied. For example, suppose that you define a condition on LAST_NAME using REGEXP_LIKE(LAST_NAME, '^[A-Za-z0-9 ]+$'). The condition evaluates to true only when LAST_NAME contains letters, numbers, and spaces and does not contain special characters.

If the condition evaluates to true, the grouped masked value is applied to the column. If it evaluates to false, the original value for that column is preserved. This configuration lets you retain the benefits of group masking while applying more granular control to an individual column within the group. Column-level conditions are supported only for group masking with Deterministic Substitution and Random Substitution.

Mask Related Columns Together as a Group (Group Masking)

You can mask related columns together as a group, ensuring that the masked data across the related columns retain the same relationship.

Group mask columns should have only one masking format entry and share the same condition and format entry.

If you are editing a group mask and need to remove a column from the group, first set the group name as empty (“”), then you can change the format.

1. Under Data Safe - Database Security, select Data masking.

2. Under Data masking, select Masking policies.

3. Select the Masking Columns tab.

4. Under Masking columns, from the Actions menu, select Assign group masking.

   The Assign group masking panel opens.

5. In the Masking format entry field, select Shuffle, Random Substitution, Deterministic Substitution, or User Defined Function.

   The fields adjust according to your selection.

6. In the Group Name field, enter a new group name.

7. In the Table name field, enter the name of the table that contains the columns that you want to include in the masking group.

8. Add a condition.

   • Only one condition is supported (either default or non-default). The default is 1=1.
   • For a non-default condition, the condition can reference any column in the selected table (not just the group mask columns); for example, DEPARTMENT_ID=1.
   • If the group mask uses the Shuffle masking format with a grouping column, then only default condition is supported.

9. Add columns for group masking according to the masking format that you selected in step 5. To add another column to the group, select Add column. You can keep adding columns until all columns in the table are listed, after which point the Add column button becomes unavailable.

   The following table describes how to configure each column for each masking format.

   Masking format entry	How to configure columns for group masking
   Shuffle	Select a column name in the Group masking column name drop-down list.
   Random Substitution or Deterministic Substitution	Select a column name in the Group masking column name drop-down list and enter a name in the Substitution column name field. (Optional) Enter a Column-level condition.
   User Defined Function	Select a column name in the Group masking column name drop-down list. Enter a Schema name and Function name. (Optional) Enter a Package name and Column-level condition.

10. (Optional) Configure optional parameters for the masking format that you selected in step 5.

    The following table lists optional parameters for each masking format.

    Masking format	Optional parameters
    Shuffle	Group columns
    Random Substitution	Substitution schema name, Substitution table name Substitution schema name and Substitution table name should be the same.
    Deterministic Substitution	Substitution schema name, Substitution table name, Hashing columns Substitution schema name and Substitution table name should be the same.
    User Defined Function	(none)

11. To remove a column from the group, select X to the right of the column.

12. Select Continue.

    Note
    
    Note: For Deterministic Substitution, you will need to enter a seed value before you submit the data masking job. For Random Substitution, you will not need to enter a seed value before you submit the data masking job.

13. From the Actions menu, select Save masking formats.