GBase 8a MPP Cluster implements dynamic data masking — the original data never changes on disk. Instead, the database applies masking rules in real time during queries, based on the user's permissions. This post explains the three‑part mechanism: column attributes, built‑in masking functions, and the UNMASK privilege.
How Dynamic Masking Works
1. Define Masked Columns
Use the MASKED WITH clause in DDL to attach a masking function to a column:
CREATE TABLE customer (
id INT,
name VARCHAR(100) MASKED WITH (FUNCTION = 'default()'),
phone VARCHAR(20) MASKED WITH (FUNCTION = 'partial(\"***\", 3, 4)'),
email VARCHAR(50) MASKED WITH (FUNCTION = 'keymask(\"@\", \"****\", 0)')
);
You can also add masking to an existing column with ALTER TABLE ... MODIFY COLUMN.
2. Five Built‑in Masking Functions
| Function | Data Type | Example (Original → Masked) |
|---|---|---|
default() |
Any |
'Brad Stevens' → 'XXXX'
|
random(start, end) |
Numeric |
42 → random value in range |
partial(prefix, padding, suffix) |
String |
'Hello' (keeps first and last char, fills rest) |
sha() |
String |
'Hello' → SHA hash |
keymask(substr, padding, pos) |
String |
'gbase@gbase.cn' → '****@gbase.cn'
|
3. The UNMASK Privilege — Who Sees What
-
Without
UNMASK: the user sees the masked result. -
With
UNMASK: the user sees the original value.
GRANT UNMASK ON db_name.table_name TO user_name@'host';
REVOKE UNMASK ON db_name.table_name FROM user_name@'host';
Dynamic vs. Static Masking
| Feature | GBase 8a Dynamic | Static Masking |
|---|---|---|
| Storage | Original data untouched | Data permanently replaced |
| When it happens | Query time | ETL / offline batch |
| Flexibility | High — different views per user | Low — same masked view for all |
| Primary use | Production real‑time compliance | Test / dev data provisioning |
| Built‑in support | Yes, via DDL and privileges | Requires external ETL tools |
Because the underlying columnar storage never changes, dynamic masking in a gbase database keeps your analytical workloads fast while meeting security requirements. It's a native, low‑overhead way to protect sensitive data in GBASE's MPP platform.
If you're working with a gbase database in production, consider enabling dynamic masking on PII columns — your compliance team will thank you.