Dynamic Data Masking with DataSunrise: Masking with Lua scripts

DataSunrise is a robust security solution that offers dynamic data masking capabilities for a wide range of databases. This feature allows sensitive data to be obfuscated in real time, ensuring that it remains protected even when accessed by authorized users. In this article, we will delve into how DataSunrise handles dynamic data masking and how you can customize this feature using Lua scripts.

Understanding Dynamic Data Masking in DataSunrise

Dynamic data masking in DataSunrise works by modifying the SQL query at the request stage for most standard masking algorithms. However, for more complex masking methods, DataSunrise modifies the response data itself. This flexibility allows for a high degree of customization and ensures that sensitive data is adequately protected.

DataSunrise supports dynamic data masking for a lot of databases, but masking on response only for the following databases:

• PostgreSQL
• Greenplum
• Amazon Redshift
• MySQL
• MariaDB
• MongoDB
• Amazon
• Athena
• Elasticsearch
• Amazon S3
• Amazon DynamoDB
• TiDB
• GaussDB
• AlloyDB
• Hydra
• SQL Server

Customizing Data Masking with Lua Scripts

One of the powerful features of DataSunrise is the ability to customize data masking methods using Lua scripts. Lua is a lightweight, high-level programming language designed for extending applications. DataSunrise leverages Lua’s capabilities to allow users to define their own data masking methods.

Here is an example of a Lua script that masks the first and last parts of names:

if columnType == 1 then
    for i = 1, #batchRecords do
            local parts = {}
            for part in string.gmatch(batchRecords[i], "%S+")
            do
                table.insert(parts, part)
            end
            parts[1] = '*****'
            parts[#parts] = '*****'
            batchRecords[i] = table.concat(parts, ' ')
        end
    end

This script works by splitting the name into parts and replacing the first and last parts with asterisks.

How to Add and Test a Lua Script in DataSunrise

To add a Lua script to DataSunrise and test it, follow these steps:

Step 1: Create a Lua script.

• In the DataSunrise console, navigate to the Configuration section of the submenu Lua Scripts and click on Create Lua Script.
• In the Script field, enter your Lua script. Make sure to replace the example script with your own.
• Click on Save to save the rule.

Picture 1.Create Lua script

Step 2: Create a new masking rule with the Lua method.

• In the DataSunrise console, navigate to the Data Masking section and click on Add Rule.
• Choose the database and the columns to which you want to apply the Masking Rule.
• In the Masking Method dropdown list, select Masking with Lua script.
• In the Lua script menu, choose the Lua script you have created in Step 1.
• Click on Save to save the rule.
• To test the rule, execute a query on the masked columns. The results should show the masked data.

Picture 2. Create a new masking rule with the Lua method.

In the images below, you can see the result with masked and not masked columns in MySQL:

Picture 3. Not masked results

Picture 4. Masked results

Remember, the effectiveness of data masking largely depends on the complexity of the masking method. By using Lua scripts, you can create complex masking methods that provide a higher level of protection for your sensitive data.

Conclusion

DataSunrise offers a powerful and flexible solution for dynamic data masking. Whether you’re using one of the many supported databases or customizing your masking methods with Lua scripts, DataSunrise has the tools you need to protect your sensitive data.