GBase 8a Data Masking

Data masking is a data protection technique that transforms, obscures, or replaces sensitive information—such as ID numbers, phone numbers, and bank card details—while preserving the usability of the data for legitimate purposes. It effectively reduces the risk of sensitive data exposure.

In GBase 8a, data masking is configured at the column level. When a user queries a masked column, the system automatically applies the predefined masking rules to the result set before returning it, leaving the underlying stored data unchanged. This approach balances business query requirements with robust privacy protection.

Use Cases

Development and Testing Environments

Apply masked production data to prevent developers and testers from accessing real sensitive information.

Data Analytics and Reporting

When generating reports or performing analytics, present masked data to external viewers to avoid unintended disclosure.

Third-Party Data Sharing

Mask data before delivering it to external partners or third-party systems, ensuring compliance with data protection policies.

Masking Types

GBase 8a supports multiple masking methods, including:

Default Masking

Predefined rules per data type: numeric types return 0, date types return 1900-01-01, and so forth.

Random Substitution

Replaces original data with randomly generated values.

SHA Masking

Applies SHA hashing functions to mask data.

Custom Masking

Partially preserves characters while masking the rest—for example, a phone number displayed as 122***4231, showing only the first three and last four digits.

Position-Based Masking

Replaces characters at specified positions with a designated symbol.

Considerations

Performance Impact

Data masking takes effect during the result materialization phase of query execution. For queries returning very large result sets, performance may be affected.

Consistency of Masking Policies

Ensure that the same type of sensitive data uses consistent masking rules across tables and scenarios. Inconsistent policies can lead to data exposure during cross-table or cross-system analysis.

Regular Auditing

Periodically review masking policies to confirm they remain effective and identify any new sensitive fields that should be brought under masking coverage.

Backup and Restore with Masking

Since masking applies only to query results and leaves the underlying raw data intact, special attention must be paid to the secure storage and handling of original data during backup and restore operations.

Summary

GBase 8a's data masking capability is simple to implement—configured entirely via SQL statements at the database level, eliminating the need for complex application-layer coding.

Security: Effectively limits exposure of sensitive data (ID numbers, phone numbers, bank card details, etc.) across development, testing, analytics, and third-party sharing scenarios.

Minimal Performance Overhead: As a lightweight feature, it imposes negligible impact on overall query performance.

Granular Access Control: Data visibility is governed by role-based permissions. Users without the UNMASK privilege see only masked data, while authorized users can access the original values.

In short, GBase 8a's data masking provides an efficient, flexible, and secure data protection mechanism that enables organizations to maximize the value of their data without compromising security.