• Welcome
• Projects
• Presentations
• Research

Data Masking

Introduction

The Oracle Data Masking and Subsetting Pack is an Enterprise Manager cost option

The pack incorporates the previous Data Masking and Test Data Management Pack

Data Masking is designed to mask regulated or confidential data in test or development systems.

A data mask must be associated with an application data model

Data masks can only be defined for columns marked as sensitive in the application data model

EMCLI Commands

To list masking definitions that are currently defined in the Management Repository use:

$OMS_HOME/bin/emcli list_masking_definitions
DEFINITION           APPLICATION DATA MODEL  TARGET     STATUS
MASKING_DEFINITION1  ADM1                    DB1        Masking Job Succeeded
MASKING_DEFINITION2  ADM2                    DB3        Masking Job Succeeded
MASKING_DEFINITION3  ADM1                    DB2        Script Generated
MASKING_DEFINITION4  ADM3                    DB1        Script Generated

To export a masking definition use export_masking_definition. For example:

$OMS_HOME/bin/emcli export_masking_definition \
-definition_name="MASKING_DEFINITION2" -path=`pwd` 
Export masking definition completed successfully

The above command creates a file with a system-generated name in the current working directory. For example masking_def201505271433.xml

To specify an output file name use the -file option. For example:

$OMS_HOME/bin/emcli export_masking_definition \
-definition_name="MASKING_DEFINITION2" -file=/tmp/MASKING_DEFINITION2.xml
Export masking definition completed successfully

To import a masking definition, use import_masking_definition. For example:

$OMS_HOME/bin/emcli import_masking_definition \
-file=/tmp/MASKING_DEFINITION3.xml -definition_name="MASKING_DEFINITION3"
Import masking definition completed successfully

To generate a masking script use generate_masking_script. For example:

$OMS_HOME/bin/emcli generate_masking_script \
-definition_name="MASKING_DEFINITION2" -credential_name=SYS
Data masking script generation completed successfully.

Masking Formats

The following table shows masking formats available for common data types:

Repository Tables

The following repository tables are used by data masking:

• MGMT_DM_ALITEMS
• MGMT_DM_COLUMN_RULES
• MGMT_DM_IMPACT_ENTRIES
• MGMT_DM_INFCONS_COLUMNS
• MGMT_DM_JOB_EXECUTIONS
• MGMT_DM_RULEENTRY
• MGMT_DM_RULETEMPLATES
• MGMT_DM_SCOPESPECS
• MGMT_DM_SS_COLUMNS

MGMT_DM_SCOPESPECS

Contains one row for each data masking definition

SS_NAME is data masking definition name

SS_OWNER is EM owner e.g. SYSMAN

Primary key based on MGMT_DM_SCOPESPECS_PK (SS_GUID)

Unique index based on MGMT_DM_SCOPESPECS_UC (SS_OWNER,SS_NAME)

MGMT_DM_SS_COLUMNS

Contains one row for each column in each data masking definition

Primary key based on MGMT_DM_COLUMNS_PK (SS_GUID,TABLE_SCHEMA,TABLE_NAME,COLUMN_NAME)

MGMT_DM_COLUMN_RULES

Contains multiple rows for each column in each data masking definition

No primary key

Non-unique index MGMT_DM_COLUMN_RULES_IX1 (SS_GUID)

Non-unique index MGMT_DM_COLUMN_RULES_IX2 (RULE_GUID)

Non-unique index MGMT_DM_COLUMN_RULES_IX3 (TABLE_SCHEMA,TABLE_NAME,COLUMN_NAME)

MGMT_DM_RULETEMPLATES

Contains supplied and user-defined rule templates

For user-defined rules RULE_NAME = RULE_GUID

Primary key index MGMT_DM_RULETEMPLATES_PK (RULE_GUID)

Unique index MGMT_DM_RULETEMPLATES_UC (RULE_OWNER,RULE_NAME)

MGMT_DM_RULEENTRY

Primary key is index MGMT_DM_RULEENTRY_PK (RULE_GUID,ENTRY_ORDER)