Hello and welcome to the SAP HANA Academy.
The topic of this video tutorial series is SAP HANA Service and in this video we will
take a look at Data Masking, a security topic.
This video has been recorded in January 2019.
For earlier or later releases, please check the playlist on the SAP HANA Academy.
Hi, I am Denys van Kempen.
With Data Masking you can mask, you can hide, column values from view.
It is an additional layer of access control but unlike regular object privileges where
you either get to see the data or you get a ‘not authorised” message, with data
masking everyone gets to see data but for those that do not have the UNMASKED object
privilege it will be garbled, unrecognisable.
Data Masking was introduced with SAP HANA 2.0 SPS 01, April 2017, and is available on
all HANA editions, it is not specific to the HANA Service.
Here we have a basic example.
You can find the code in the SQL Reference Guide.
I have uploaded it to our GitHub repository and will put a link in the description of
this video below.
First, we are going to create our demo users.
Best practice, keep the privileges separated.
We have a mask owner, a data owner, and an end user.
Next, we are going to connect as the data owner and create a simple table: credit_tab
with two columns, name and credit card, and then we are going to insert some data.
For credit card, I am using a varchar here, could be an int, most data types are supported
and you can find this documented in the security guide.
Next, we are going to connect as the mask owner and create a simple function.
You can make it as complicated as you want (SQL Script).
Just returning the first 4 and last 4 characters.
We also grant execute privileges on the mask to data owner.
Connect as data owner again and now create the view on the credit table with —and here
is the secret sauce— with mask column name using and then specify the mask.
In this case our mask is a function mask_owner.credit_mask on the credit card column.
Now we are going to grant select privileges on the credit view to end user.
Connect as end user and query the view from data owner.
This returns the credit card column masked as defined in the function.
OK
Let’s connect as data owner again.
Just to show.
When data owner select the view, she gets to see the entire column.
No surprise.
Now we are going to alter the view and this time WITH MASK column name using, and just
hard code a simple mask.
One for the name and one for the credit card column.
This works as well, no need to create functions.
Check the SQL Reference for your options here.
OK.
We can drop the mask.
And then end user gets to see all the data.
Not what we want.
Let’s add the original mask back again, the one with the function.
Double check.
Yes, this works.
But this time, we are going to grant this particular end user the unmasked object privilege
on the view.
Query as end user again and, you guessed it, end user can now see the data.
What you can grant, you can revoke as well —at least in the world of SQL,
Revoke unmasked from
Query the data, and the mask is back again.
That’s it.
Some basic examples using data masking.
Thanks for watching.
You can find more video tutorials on our YouTube channel.
If you would like to be informed about new video tutorials, please subscribe to our channel.
You can connect with us on LinkedIn or follow us on Twitter, as well for updates, and if
you are watching this video on YouTube, do not hesitate to leave your comments to the
video page and, if you like, give us your vote on this video.
Thank you for watching the SAP HANA Academy