| <!DOCTYPE html> |
| <html lang="en"> |
| <head> |
| <meta charset="utf-8"> |
| <meta name="viewport" content="width=device-width,initial-scale=1.0"> |
| <title>Dynamic Data Masking (DDM) | Apache Cassandra Documentation</title> |
| <link rel="stylesheet" href="../../../../../assets/css/site.css"> |
| <meta name="description" content="Dynamic Data Masking (DDM) is a method for making sensitive data unavailable to non-privileged users."> |
| <link rel="schema.dcterms" href="https://purl.org/dc/terms/"> |
| <meta name="dcterms.subject" content="Cassandra"> |
| <meta name="dcterms.identifier" content="5.0"> |
| <meta name="generator" content="Antora 2.3.4"> |
| <link rel="icon" href="../../../../../assets/img/favicon.ico" type="image/x-icon"> |
| <script> |
| const script = document.createElement("script"); |
| const domain = window.location.hostname; |
| script.type = "text/javascript"; |
| script.src = "https://plausible.cassandra.apache.org/js/plausible.js"; |
| script.setAttribute("data-domain",domain); |
| script.setAttribute("defer",'true'); |
| script.setAttribute("async",'true'); |
| document.getElementsByTagName("head")[0].appendChild(script); |
| </script> </head> |
| <body class="docs-wrapper article"> |
| <div class="container mx-auto relative"> |
| <script src="https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js"></script> |
| <meta property="og:type" content="website" /> |
| <meta property="og:description" content="" /> |
| <meta property="og:url" content="/" /> |
| <meta property="og:site_name" content="Apache Cassandra" /> |
| |
| <header id="top-nav"> |
| <div class="inner relative"> |
| <div class="header-social-icons text-right"> |
| <a href="https://twitter.com/cassandra?lang=en" target="_blank" styles="margin-left: 20px;"><img src="../../../../../assets/img/twitter-icon-circle-white.svg" alt="twitter icon" width="24"></a> |
| <a href="https://www.linkedin.com/company/apache-cassandra/" target="_blank" styles="margin-left: 20px;"><img src="../../../../../assets/img/LI-In-Bug.png" alt="linked-in icon" width="24"></a> |
| <a href="https://www.youtube.com/c/PlanetCassandra" target="_blank" styles="margin-left: 20px;"><img src="../../../../../assets/img/youtube-icon.png" alt="youtube icon" width="24"></a> |
| </div> |
| <div class="cf"> |
| <div class="logo left"><a href="/"><img src="../../../../../assets/img/logo-white-r.png" alt="Cassandra Logo"></a></div> |
| <div class="mobile-nav-icon right"> |
| <img class="toggle-icon" src="../../../../../assets/img/hamburger-nav.svg"> |
| </div> |
| <ul class="main-nav nav-links right flex flex-vert-center flex-space-between"> |
| <li> |
| <a class="nav-link hide-mobile">Get Started</a> |
| <ul class="sub-menu bg-white"> |
| <li class="pa-micro"> |
| <a href="/_/cassandra-basics.html"> |
| <div class="sub-nav-icon"> |
| <img src="../../../../../assets/img/sub-menu-basics.png" alt="cassandra basics icon"> |
| </div> |
| <div class="sub-nav-text teal py-small"> |
| Cassandra Basics |
| </div> |
| </a> |
| </li> |
| <li class="pa-micro"> |
| <a href="/_/quickstart.html"> |
| <div class="sub-nav-icon"> |
| <img src="../../../../../assets/img/sub-menu-rocket.png" alt="cassandra basics icon"> |
| </div> |
| <div class="sub-nav-text teal py-small"> |
| Quickstart |
| </div> |
| </a> |
| </li> |
| <li class="pa-micro"> |
| <a href="/_/ecosystem.html"> |
| <div class="sub-nav-icon"> |
| <img src="../../../../../assets/img/sub-menu-ecosystem.png" alt="cassandra basics icon"> |
| </div> |
| <div class="sub-nav-text teal py-small"> |
| Ecosystem |
| </div> |
| </a> |
| </li> |
| </ul> |
| </li> |
| <li><a class="nav-link" href="/doc/latest/">Documentation</a></li> |
| <li> |
| <a class="nav-link" href="/_/community.html">Community</a> |
| <ul class="sub-menu bg-white"> |
| <li class="pa-micro"> |
| <a href="/_/community.html#code-of-conduct"> |
| <div class="sub-nav-icon"> |
| <img src="../../../../../assets/img/sub-menu-welcome.png" alt="welcome icon"> |
| </div> |
| <div class="sub-nav-text teal py-small"> |
| Welcome |
| </div> |
| </a> |
| </li> |
| <li class="pa-micro hide-mobile"> |
| <a href="/_/community.html#discussions"> |
| <div class="sub-nav-icon"> |
| <img src="../../../../../assets/img/sub-menu-discussions.png" alt="discussions icon"> |
| </div> |
| <div class="sub-nav-text teal py-small"> |
| Discussions |
| </div> |
| </a> |
| </li> |
| <li class="pa-micro hide-mobile"> |
| <a href="/_/community.html#project-governance"> |
| <div class="sub-nav-icon"> |
| <img src="../../../../../assets/img/sub-menu-governance.png" alt="Governance icon"> |
| </div> |
| <div class="sub-nav-text teal py-small"> |
| Governance |
| </div> |
| </a> |
| </li> |
| <li class="pa-micro hide-mobile"> |
| <a href="/_/community.html#how-to-contribute"> |
| <div class="sub-nav-icon"> |
| <img src="../../../../../assets/img/sub-menu-contribute.png" alt="Contribute icon"> |
| </div> |
| <div class="sub-nav-text teal py-small"> |
| Contribute |
| </div> |
| </a> |
| </li> |
| <li class="pa-micro hide-mobile"> |
| <a href="/_/community.html#meet-the-community"> |
| <div class="sub-nav-icon"> |
| <img src="../../../../../assets/img/sub-menu-community.png" alt="Meet the Community icon"> |
| </div> |
| <div class="sub-nav-text teal py-small"> |
| Meet the Community |
| </div> |
| </a> |
| </li> |
| <li class="pa-micro hide-mobile"> |
| <a href="/_/cassandra-catalyst-program.html"> |
| <div class="sub-nav-icon"> |
| <img src="../../../../../assets/img/sub-menu-catalyst.png" alt="Catalyst icon"> |
| </div> |
| <div class="sub-nav-text teal py-small"> |
| Catalyst Program |
| </div> |
| </a> |
| </li> |
| <li class="pa-micro hide-mobile"> |
| <a href="/_/events.html"> |
| <div class="sub-nav-icon"> |
| <img src="../../../../../assets/img/sub-menu-events.png" alt="Events icon"> |
| </div> |
| <div class="sub-nav-text teal py-small"> |
| Events |
| </div> |
| </a> |
| </li> |
| </ul> |
| </li> |
| <li> |
| <a class="nav-link hide-mobile">Learn</a> |
| <ul class="sub-menu bg-white"> |
| <li class="pa-micro"> |
| <a href="/_/Apache-Cassandra-5.0-Moving-Toward-an-AI-Driven-Future.html"> |
| <div class="sub-nav-icon"> |
| <img src="../../../../../assets/img/sub-menu-basics.png" alt="Basics icon"> |
| </div> |
| <div class="sub-nav-text teal py-small"> |
| Cassandra 5.0 |
| </div> |
| </a> |
| </li> |
| <li class="pa-micro"> |
| <a href="/_/case-studies.html"> |
| <div class="sub-nav-icon"> |
| <img src="../../../../../assets/img/sub-menu-case-study.png" alt="Case Studies icon"> |
| </div> |
| <div class="sub-nav-text teal py-small"> |
| Case Studies |
| </div> |
| </a> |
| </li> |
| <li class="pa-micro"> |
| <a href="/_/resources.html"> |
| <div class="sub-nav-icon"> |
| <img src="../../../../../assets/img/sub-menu-resources.png" alt="Resources icon"> |
| </div> |
| <div class="sub-nav-text teal py-small"> |
| Resources |
| </div> |
| </a> |
| </li> |
| <li class="pa-micro"> |
| <a href="/_/blog.html"> |
| <div class="sub-nav-icon"> |
| <img src="../../../../../assets/img/sub-menu-blog.png" alt="Blog icon"> |
| </div> |
| <div class="sub-nav-text teal py-small"> |
| Blog |
| </div> |
| </a> |
| </li> |
| </ul> |
| </li> |
| <li><a class="nav-link btn btn--filled" href="/_/download.html">Download Now</a></li> |
| </ul> |
| </div> |
| </div> |
| </header> |
| |
| <div class="hero hero--home grad"> |
| <div class="eye"></div> |
| <div id="docs-content" class="text-center flex flex-center flex-column relative z2 ma-xlarge"> |
| <h2>Cassandra Documentation</h2> |
| </div> |
| </div> |
| <div class="body px-medium py-medium container"> |
| <div class="docs-nav-bar flex flex-space-between mb-medium"> |
| <div id="mobile-docs-nav-burger" class="hidden"> |
| <svg viewBox="0 0 24 24" width="36" height="36" stroke="#1c81a0" stroke-width="2.5" fill="none" stroke-linecap="round" stroke-linejoin="round" class="css-i6dzq1"><line x1="3" y1="12" x2="21" y2="12"></line><line x1="3" y1="6" x2="21" y2="6"></line><line x1="3" y1="18" x2="21" y2="18"></line></svg> |
| </div> |
| <div class="docs-nav-item relative"> |
| <input id="search-input" type="text" placeholder="Search docs"> |
| </div> |
| <div class="versions-wrapper"> |
| <h4>Version:</h4> |
| <div class="nav-panel-explore" data-panel="explore"> |
| |
| <div id="version-toggle" class="context"> |
| <span class="version">5.0</span> |
| </div> |
| <ul id="versions-list" class="components"> |
| <li class="component"> |
| <ul class="versions"> |
| <li class="version is-latest"> |
| <a href="../../../../../_/index.html">master</a> |
| </li> |
| </ul> |
| </li> |
| <li class="component is-current"> |
| <ul class="versions"> |
| <li class="version"> |
| <a href="../../../../trunk/index.html">trunk</a> |
| </li> |
| <li class="version is-current"> |
| <a href="../../../index.html">5.0</a> |
| </li> |
| <li class="version is-latest"> |
| <a href="../../../../4.1/index.html">4.1</a> |
| </li> |
| <li class="version"> |
| <a href="../../../../4.0/index.html">4.0</a> |
| </li> |
| <li class="version"> |
| <a href="../../../../3.11/index.html">3.11</a> |
| </li> |
| </ul> |
| </li> |
| </ul> |
| </div> |
| </div> </div> |
| <div class="cf relative"> |
| <nav class="nav docs-nav full-800"> |
| <div class="nav-menu"> |
| <ul class="nav-list"> |
| <li class="nav-item is-active" data-depth="0"> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="1"> |
| <span class="nav-line"> |
| <button class="nav-toggle"></button> |
| <a class="nav-link" href="../../../index.html">Main</a> |
| </span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../../../../_/glossary.html">Glossary</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../../../../_/bugs.html">How to report bugs</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../../../../_/contactus.html">Contact us</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <span class="nav-line"> |
| <button class="nav-toggle"></button> |
| <a class="nav-link" href="../../../../../_/development/index.html">Development</a> |
| </span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../../../../_/development/gettingstarted.html">Getting started</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../../../../_/development/ide.html">Building and IDE integration</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../../../../_/development/testing.html">Testing</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../../../../_/development/patches.html">Contributing code changes</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../../../../_/development/code_style.html">Code style</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../../../../_/development/how_to_review.html">Review checklist</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../../../../_/development/how_to_commit.html">How to commit</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../../../../_/development/documentation.html">Working on documentation</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../../../../_/development/ci.html">Jenkins CI environment</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../../../../_/development/dependencies.html">Dependency management</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../../../../_/development/release_process.html">Release process</a> |
| </span> |
| </li> |
| </ul> |
| </li> |
| </ul> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item is-active" data-depth="0"> |
| <ul class="nav-list"> |
| <li class="nav-item is-current-path is-active" data-depth="1"> |
| <span class="nav-line"> |
| <button class="nav-toggle"></button> |
| <span class="nav-text">Cassandra</span> |
| </span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="2"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../overview/faq/index.html">FAQ</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <span class="nav-line"> |
| <button class="nav-toggle"></button> |
| <a class="nav-link" href="../../getting-started/index.html">Getting Started</a> |
| </span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../getting-started/cassandra-quickstart.html">Cassandra Quickstart</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../getting-started/sai-quickstart.html">SAI Quickstart</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../getting-started/vector-search-quickstart.html">Vector Search Quickstart</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../installing/installing.html">Installing Cassandra</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../getting-started/configuring.html">Configuring Cassandra</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../getting-started/querying.html">Inserting and querying</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../getting-started/drivers.html">Client drivers</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../getting-started/production.html">Production recommendations</a> |
| </span> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <span class="nav-line"> |
| <button class="nav-toggle"></button> |
| <a class="nav-link" href="../../new/index.html">What’s new</a> |
| </span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../reference/java17.html">Support for Java</a> |
| </span> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <span class="nav-line"> |
| <button class="nav-toggle"></button> |
| <a class="nav-link" href="../../architecture/index.html">Architecture</a> |
| </span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../architecture/overview.html">Overview</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../architecture/dynamo.html">Dynamo</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../architecture/storage-engine.html">Storage Engine</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../architecture/guarantees.html">Guarantees</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../architecture/messaging.html">Improved Internode Messaging</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../architecture/streaming.html">Improved Streaming</a> |
| </span> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <span class="nav-line"> |
| <button class="nav-toggle"></button> |
| <a class="nav-link" href="../data-modeling/index.html">Data Modeling</a> |
| </span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../data-modeling/intro.html">Introduction</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../data-modeling/data-modeling_conceptual.html">Conceptual data modeling</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../data-modeling/data-modeling_rdbms.html">RDBMS design</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../data-modeling/data-modeling_queries.html">Defining application queries</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../data-modeling/data-modeling_logical.html">Logical data modeling</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../data-modeling/data-modeling_physical.html">Physical data modeling</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../data-modeling/data-modeling_refining.html">Evaluating and refining data models</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../data-modeling/data-modeling_schema.html">Defining database schema</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../data-modeling/data-modeling_tools.html">Cassandra data modeling tools</a> |
| </span> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item is-current-path is-active" data-depth="2"> |
| <span class="nav-line"> |
| <button class="nav-toggle"></button> |
| <a class="nav-link" href="index.html">Cassandra Query Language (CQL)</a> |
| </span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="definitions.html">Definitions</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="types.html">Data types</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="ddl.html">Data definition (DDL)</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="dml.html">Data manipulation (DML)</a> |
| </span> |
| </li> |
| <li class="nav-item is-current-page is-active" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="dynamic-data-masking.html">Dynamic Data Masking (DDM)</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="operators.html">Operators</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <button class="nav-toggle"></button> |
| <a class="nav-link" href="indexing/indexing-concepts.html">Indexing concepts</a> |
| </span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <button class="nav-toggle"></button> |
| <a class="nav-link" href="indexing/sai/sai-overview.html">SAI Overview</a> |
| </span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="5"> |
| <span class="nav-line"> |
| <a class="nav-link" href="indexing/sai/sai-concepts.html">Concepts</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="5"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../getting-started/sai-quickstart.html">SAI Quickstart</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="5"> |
| <span class="nav-line"> |
| <a class="nav-link" href="indexing/sai/sai-faq.html">SAI FAQ</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="5"> |
| <span class="nav-line"> |
| <a class="nav-link" href="indexing/sai/sai-working-with.html">Working with SAI</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="5"> |
| <span class="nav-line"> |
| <a class="nav-link" href="indexing/sai/operations/sai-operations.html">SAI operations</a> |
| </span> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <button class="nav-toggle"></button> |
| <a class="nav-link" href="indexing/2i/2i-overview.html">Secondary indexes (2i) overview</a> |
| </span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="5"> |
| <span class="nav-line"> |
| <a class="nav-link" href="indexing/2i/2i-concepts.html">Concepts</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="5"> |
| <span class="nav-line"> |
| <a class="nav-link" href="indexing/2i/2i-working-with.html">Working with 2i</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="5"> |
| <span class="nav-line"> |
| <a class="nav-link" href="indexing/2i/operations/2i-build.html">Rebuild 2i</a> |
| </span> |
| </li> |
| </ul> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="mvs.html">Materialized views</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="functions.html">Functions</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="json.html">JSON</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="security.html">Security</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="triggers.html">Triggers</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="appendices.html">Appendices</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="changes.html">Changes</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="SASI.html">SASI</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="cql_singlefile.html">Single file of CQL information</a> |
| </span> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <span class="nav-line"> |
| <button class="nav-toggle"></button> |
| <a class="nav-link" href="../../vector-search/overview.html">Vector Search overview</a> |
| </span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <button class="nav-toggle"></button> |
| <a class="nav-link" href="../../vector-search/concepts.html">Concepts</a> |
| </span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../vector-search/data-modeling.html">Data Modeling</a> |
| </span> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../getting-started/vector-search-quickstart.html">Vector Search Quickstart</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../vector-search/vector-search-working-with.html">Working with Vector Search</a> |
| </span> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <span class="nav-line"> |
| <button class="nav-toggle"></button> |
| <a class="nav-link" href="../../managing/index.html">Managing</a> |
| </span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <button class="nav-toggle"></button> |
| <a class="nav-link" href="../../managing/configuration/index.html">Configuring</a> |
| </span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/configuration/cass_yaml_file.html">cassandra.yaml</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/configuration/cass_rackdc_file.html">cassandra-rackdc.properties</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/configuration/cass_env_sh_file.html">cassandra-env.sh</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/configuration/cass_topo_file.html">cassandra-topologies.properties</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/configuration/cass_cl_archive_file.html">commitlog-archiving.properties</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/configuration/cass_logback_xml_file.html">logback.xml</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/configuration/cass_jvm_options_file.html">jvm-* files</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/configuration/configuration.html">Liberating cassandra.yaml Parameters' Names from Their Units</a> |
| </span> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <button class="nav-toggle"></button> |
| <a class="nav-link" href="../../managing/operating/index.html">Operating</a> |
| </span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/operating/backups.html">Backups</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/operating/bloom_filters.html">Bloom filters</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/operating/bulk_loading.html">Bulk loading</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/operating/cdc.html">Change Data Capture (CDC)</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/operating/compaction/index.html">Compaction</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/operating/compression.html">Compression</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/operating/hardware.html">Hardware</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/operating/hints.html">Hints</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <button class="nav-toggle"></button> |
| <a class="nav-link" href="../../managing/operating/logging.html">Logging</a> |
| </span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="5"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/operating/auditlogging.html">Audit logging</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="5"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/operating/audit_logging.html">Audit logging 2</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="5"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/operating/fqllogging.html">Full query logging</a> |
| </span> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/operating/metrics.html">Monitoring metrics</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/operating/repair.html">Repair</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/operating/read_repair.html">Read repair</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/operating/security.html">Security</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/operating/snitch.html">Snitches</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/operating/topo_changes.html">Topology changes</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/operating/transientreplication.html">Transient replication</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/operating/virtualtables.html">Virtual tables</a> |
| </span> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <button class="nav-toggle"></button> |
| <a class="nav-link" href="../../managing/tools/index.html">Tools</a> |
| </span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/tools/cqlsh.html">cqlsh: the CQL shell</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/tools/nodetool/nodetool.html">nodetool</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../managing/tools/sstable/index.html">SSTable tools</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="4"> |
| <span class="nav-line"> |
| <a class="nav-link" href="#cassandra:managing/tools/cassandra_stress.adoc">cassandra-stress</a> |
| </span> |
| </li> |
| </ul> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <span class="nav-line"> |
| <button class="nav-toggle"></button> |
| <a class="nav-link" href="../../troubleshooting/index.html">Troubleshooting</a> |
| </span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../troubleshooting/finding_nodes.html">Finding misbehaving nodes</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../troubleshooting/reading_logs.html">Reading Cassandra logs</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../troubleshooting/use_nodetool.html">Using nodetool</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../troubleshooting/use_tools.html">Using external tools to deep-dive</a> |
| </span> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <span class="nav-line"> |
| <button class="nav-toggle"></button> |
| <a class="nav-link" href="../../reference/index.html">Reference</a> |
| </span> |
| <ul class="nav-list"> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../reference/cql-commands/alter-table.html">ALTER TABLE</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../reference/cql-commands/create-index.html">CREATE INDEX</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../reference/cql-commands/create-custom-index.html">CREATE CUSTOM INDEX</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../reference/cql-commands/create-table.html">CREATE TABLE</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../reference/cql-commands/drop-index.html">DROP INDEX</a> |
| </span> |
| </li> |
| <li class="nav-item" data-depth="3"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../reference/cql-commands/drop-table.html">DROP TABLE</a> |
| </span> |
| </li> |
| </ul> |
| </li> |
| <li class="nav-item" data-depth="2"> |
| <span class="nav-line"> |
| <a class="nav-link" href="../../integrating/plugins/index.html">Plug-ins</a> |
| </span> |
| </li> |
| </ul> |
| </li> |
| </ul> |
| </li> |
| </ul> |
| </div> |
| </nav> |
| <aside class="toc sidebar"> |
| <div class="toc-menu"></div> |
| </aside> |
| <main class="article default-main full-800" data-ceiling="topbar"> |
| <div class="article-banner"> |
| <p>You are viewing the documentation for a prerelease version.</p> |
| </div> |
| <div class="article-header"> |
| <nav class="crumbs" aria-label="breadcrumbs"> |
| <ul> |
| <li class="crumb">Cassandra</li> |
| <li class="crumb"><a href="index.html">Cassandra Query Language (CQL)</a></li> |
| <li class="crumb"><a href="dynamic-data-masking.html">Dynamic Data Masking (DDM)</a></li> |
| </ul> |
| </nav> |
| <div class="tools" role="navigation"> |
| <ul> |
| <li class="tool edit"><a href="https://github.com/apache/cassandra/edit/cassandra-5.0/doc/modules/cassandra/pages/developing/cql/dynamic-data-masking.adoc" title="Edit Page" target="_blank" rel="noopener">Edit</a></li> |
| </ul> |
| </div> |
| </div> |
| <article class="doc"> |
| <h1 class="page">Dynamic Data Masking (DDM)</h1> |
| <div id="preamble"> |
| <div class="sectionbody"> |
| <div class="paragraph"> |
| <p>Dynamic data masking (DDM) obscures sensitive information while still allowing access to the masked columns. |
| DDM doesn’t alter the stored data. |
| Instead, it just presents the data in its obscured form during <code>SELECT</code> queries. |
| This aims to provide some degree of protection against accidental data exposure. However, anyone with direct access to the SSTable files will be able to read the clear data.</p> |
| </div> |
| </div> |
| </div> |
| <div class="sect1"> |
| <h2 id="masking-functions"><a class="anchor" href="#masking-functions"></a>Masking functions</h2> |
| <div class="sectionbody"> |
| <div class="paragraph"> |
| <p>DDM is based on a set of CQL native functions that obscure sensitive information. |
| The available functions are:</p> |
| </div> |
| <table class="tableblock frame-all grid-all stretch"> |
| <colgroup> |
| <col style="width: 50%;"> |
| <col style="width: 50%;"> |
| </colgroup> |
| <thead> |
| <tr> |
| <th class="tableblock halign-left valign-top">Function</th> |
| <th class="tableblock halign-left valign-top">Description</th> |
| </tr> |
| </thead> |
| <tbody> |
| <tr> |
| <td class="tableblock halign-left valign-top"><p class="tableblock"><code>mask_null(value)</code></p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">Replaces the first argument with a <code>null</code> column. |
| The returned value is always a non-existent column, and not a not-null column representing a <code>null</code> value.</p> |
| <p class="tableblock">Examples:</p> |
| <p class="tableblock"><code>mask_null('Alice')</code> → <code>null</code></p> |
| <p class="tableblock"><code>mask_null(123)</code> → <code>null</code></p></td> |
| </tr> |
| <tr> |
| <td class="tableblock halign-left valign-top"><p class="tableblock"><code>mask_default(value)</code></p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">Replaces its argument by an arbitrary, fixed default value of the same type. |
| This will be <code><strong>*</strong>***</code> for text values, zero for numeric values, <code>false</code> for booleans, etc.</p> |
| <p class="tableblock">Variable-length multi-valued types such as lists, sets and maps are masked as empty collections.</p> |
| <p class="tableblock">Fixed-length multi-valued types such as tuples, user-defined types (UDTs) and vectors are masked by replacing each of their values by the default masking value of the value type.</p> |
| <p class="tableblock">Examples:</p> |
| <p class="tableblock"><code>mask_default('Alice')</code> → <code>'****'</code></p> |
| <p class="tableblock"><code>mask_default(123)</code> → <code>0</code></p> |
| <p class="tableblock"><code>mask_default((list<int>) [1, 2, 3])</code> → <code>[]</code></p> |
| <p class="tableblock"><code>mask_default((vector<int, 3>) [1, 2, 3])</code> → <code>[0, 0, 0]</code></p></td> |
| </tr> |
| <tr> |
| <td class="tableblock halign-left valign-top"><p class="tableblock"><code>mask_replace(value, replacement])</code></p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">Replaces the first argument by the replacement value on the second argument. |
| The replacement value needs to have the same type as the replaced value.</p> |
| <p class="tableblock">Examples:</p> |
| <p class="tableblock"><code>mask_replace('Alice', 'REDACTED')</code> → <code>'REDACTED'</code></p> |
| <p class="tableblock"><code>mask_replace(123, -1)</code> → <code>-1</code></p></td> |
| </tr> |
| <tr> |
| <td class="tableblock halign-left valign-top"><p class="tableblock"><code>mask_inner(value, begin, end, [padding])</code></p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">Returns a copy of the first <code>text</code>, <code>varchar</code> or <code>ascii</code> argument, replacing each character except the first and last ones by a padding character. |
| The second and third arguments are the size of the exposed prefix and suffix. |
| The optional fourth argument is the padding character, <code>\*</code> by default.</p> |
| <p class="tableblock">Examples:</p> |
| <p class="tableblock"><code>mask_inner('Alice', 1, 2)</code> → <code>'A<strong>ce'</code></p> |
| <p class="tableblock"><code>mask_inner('Alice', 1, null)</code> → <code>'A</strong><strong>'</code></p> |
| <p class="tableblock"><code>mask_inner('Alice', null, 2)</code> → <code>'</strong>*ce'</code></p> |
| <p class="tableblock"><code>mask_inner('Alice', 2, 1, '#')</code> → <code>'Al##e'</code></p></td> |
| </tr> |
| <tr> |
| <td class="tableblock halign-left valign-top"><p class="tableblock"><code>mask_outer(value, begin, end, [padding])</code></p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">Returns a copy of the first <code>text</code>, <code>varchar</code> or <code>ascii</code> argument, replacing the first and last character by a padding character. |
| The second and third arguments are the size of the exposed prefix and suffix. |
| The optional fourth argument is the padding character, <code>\*</code> by default.</p> |
| <p class="tableblock">Examples:</p> |
| <p class="tableblock"><code>mask_outer('Alice', 1, 2)</code> → <code>'*li<strong>'</code></p> |
| <p class="tableblock"><code>mask_outer('Alice', 1, null)</code> → <code>'*lice'</code></p> |
| <p class="tableblock"><code>mask_outer('Alice', null, 2)</code> → <code>'Ali</strong>'</code></p> |
| <p class="tableblock"><code>mask_outer('Alice', 2, 1, '#')</code> → <code>'##ic#'</code></p></td> |
| </tr> |
| <tr> |
| <td class="tableblock halign-left valign-top"><p class="tableblock"><code>mask_hash(value, [algorithm])</code></p></td> |
| <td class="tableblock halign-left valign-top"><p class="tableblock">Returns a <code>blob</code> containing the hash of the first argument. |
| The optional second argument is the hashing algorithm to be used, according the available Java security provider. |
| The default hashing algorithm is <code>SHA-256</code>.</p> |
| <p class="tableblock">Examples:</p> |
| <p class="tableblock"><code>mask_hash('Alice')</code></p> |
| <p class="tableblock"><code>mask_hash('Alice', 'SHA-512')</code></p></td> |
| </tr> |
| </tbody> |
| </table> |
| <div class="paragraph"> |
| <p>Those functions can be used on <code>SELECT</code> queries to get an obscured view of the data. |
| For example:</p> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre class="highlightjs highlight"><code class="language-cql hljs" data-lang="cql">CREATE TABLE patients ( |
| id timeuuid PRIMARY KEY, |
| name text, |
| birth date |
| ); |
| |
| INSERT INTO patients(id, name, birth) VALUES (now(), 'alice', '1982-01-02'); |
| INSERT INTO patients(id, name, birth) VALUES (now(), 'bob', '1982-01-02'); |
| |
| SELECT mask_inner(name, 1, null), mask_default(birth) FROM patients; |
| |
| // system.mask_inner(name, 1, NULL) | system.mask_default(birth) |
| // -----------------------------------+---------------------------- |
| // b** | 1970-01-01 |
| // a**** | 1970-01-01</code></pre> |
| </div> |
| </div> |
| </div> |
| </div> |
| <div class="sect1"> |
| <h2 id="attaching-masking-functions-to-table-columns"><a class="anchor" href="#attaching-masking-functions-to-table-columns"></a>Attaching masking functions to table columns</h2> |
| <div class="sectionbody"> |
| <div class="paragraph"> |
| <p>A masking function can be permanently attached to any column of a table. |
| If a masking column is defined, <code>SELECT</code> queries will always return the column values in their masked form. |
| The masking will be transparent to the users running <code>SELECT</code> queries. |
| The only way to know that a column is masked is to consult the table definition.</p> |
| </div> |
| <div class="paragraph"> |
| <p>This is an optional feature that is disabled by default. |
| To use the feature, enable the <code>dynamic_data_masking_enabled</code> property in <code>cassandra.yaml</code>.</p> |
| </div> |
| <div class="paragraph"> |
| <p>The masks of the columns of a table can be defined in the <code>CREATE TABLE</code> to create the table schema. This example uses the <code>mask_inner</code> function with two arguments:</p> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre class="highlightjs highlight"><code class="language-cql hljs" data-lang="cql">CREATE TABLE patients ( |
| id timeuuid PRIMARY KEY, |
| name text MASKED WITH mask_inner(1, null), |
| birth date MASKED WITH mask_default() |
| );</code></pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>When using a <code>SELECT</code> query on this data, three arguments are required for the <code>mask_inner</code> function, but the first argument is always omitted when attaching the function to the table schema. |
| The value of that first argument is always interpreted as the value of the masked column, in this case a <code>text</code> column.</p> |
| </div> |
| <div class="paragraph"> |
| <p>For the same reason, using the masking function <code>mask_default</code> doesn’t have any argument when creating the table schema, but it requires one argument when used on <code>SELECT</code> queries.</p> |
| </div> |
| <div class="paragraph"> |
| <p>Data can be normally inserted into the masked table without alteration. |
| For example:</p> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre class="highlightjs highlight"><code class="language-cql hljs" data-lang="cql">INSERT INTO patients(id, name, birth) VALUES (now(), 'alice', '1984-01-02'); |
| INSERT INTO patients(id, name, birth) VALUES (now(), 'bob', '1982-02-03');</code></pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>The <code>SELECT</code> query will return the masked data. |
| The masking function will be automatically applied to the column values.</p> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre class="highlightjs highlight"><code class="language-cql hljs" data-lang="cql">SELECT name, birth FROM patients; |
| |
| // name | birth |
| // -------+------------ |
| // a**** | 1970-01-01 |
| // b** | 1970-01-01</code></pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>An <code>ALTER TABLE</code> query can be used to make changes to a masking function on a table column.</p> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre class="highlightjs highlight"><code class="language-cql hljs" data-lang="cql">ALTER TABLE patients ALTER name |
| MASKED WITH mask_default();</code></pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>In a similar way, a masking function can be detached from a column with an <code>ALTER TABLE</code> query:</p> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre class="highlightjs highlight"><code class="language-cql hljs" data-lang="cql">ALTER TABLE patients ALTER name |
| DROP MASKED;</code></pre> |
| </div> |
| </div> |
| </div> |
| </div> |
| <div class="sect1"> |
| <h2 id="permissions"><a class="anchor" href="#permissions"></a>Permissions</h2> |
| <div class="sectionbody"> |
| <div class="paragraph"> |
| <p>Ordinary users are created without the <code>UNMASK</code> permission and will see masked values. |
| Giving a user the <code>UNMASK</code> permission allows them to retrieve the unmasked values of masked columns. |
| Superusers are automatically created with the <code>UNMASK</code> permission, |
| and will see the unmasked values in a <code>SELECT</code> query results.</p> |
| </div> |
| <div class="paragraph"> |
| <p>For example, suppose that we have a table with masked columns:</p> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre class="highlightjs highlight"><code class="language-cql hljs" data-lang="cql">CREATE TABLE patients ( |
| id timeuuid PRIMARY KEY, |
| name text MASKED WITH mask_inner(1, null), |
| birth date MASKED WITH mask_default() |
| );</code></pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>And we insert some data into the table:</p> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre class="highlightjs highlight"><code class="language-cql hljs" data-lang="cql">INSERT INTO patients(id, name, birth) VALUES (now(), 'alice', '1984-01-02'); |
| INSERT INTO patients(id, name, birth) VALUES (now(), 'bob', '1982-02-03');</code></pre> |
| </div> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre class="highlightjs highlight"><code class="language-cql hljs" data-lang="cql">LOGIN unprivileged |
| SELECT name, birth FROM patients; |
| |
| // name | birth |
| // -------+------------ |
| // a**** | 1970-01-01 |
| // b** | 1970-01-01</code></pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>Then we create two users with <code>SELECT</code> permission for the table, but we only grant the <code>UNMASK</code> permission to one of the users:</p> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre class="highlightjs highlight"><code class="language-cql hljs" data-lang="cql">CREATE USER privileged WITH PASSWORD 'xyz'; |
| GRANT SELECT ON TABLE patients TO privileged; |
| GRANT UNMASK ON TABLE patients TO privileged; |
| |
| CREATE USER unprivileged WITH PASSWORD 'xyz'; |
| GRANT SELECT ON TABLE patients TO unprivileged;</code></pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>The user with the <code>UNMASK</code> permission can see the clear, unmasked data:</p> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre class="highlightjs highlight"><code class="language-cql hljs" data-lang="cql">LOGIN privileged |
| SELECT name, birth FROM patients; |
| |
| // name | birth |
| // -------+------------ |
| // alice | 1984-01-02 |
| // bob | 1982-02-03</code></pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>The user without the <code>UNMASK</code> permission can only see the masked data:</p> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre class="highlightjs highlight"><code class="language-cql hljs" data-lang="cql">LOGIN unprivileged |
| SELECT name, birth FROM patients; |
| |
| // name | birth |
| // -------+------------ |
| // a**** | 1970-01-01 |
| // b** | 1970-01-01</code></pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>The <code>UNMASK</code> permission works like any other permission, and can be revoked at will:</p> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre class="highlightjs highlight"><code class="language-cql hljs" data-lang="cql">REVOKE UNMASK ON TABLE patients |
| FROM privileged;</code></pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>Please note that, when authentication is disabled, the anonymous default user has all the permissions, including the <code>UNMASK</code> permission, and can see the unmasked data. |
| In other words, attaching data masking functions to columns only makes sense if authentication is enabled.</p> |
| </div> |
| <div class="paragraph"> |
| <p>Only users with the <code>UNMASK</code> permission are allowed to use masked columns in the <code>WHERE</code> clause of a <code>SELECT</code> query. |
| Users without the <code>UNMASK</code> permission cannot use this feature. |
| This feature prevents malicious users seeing clear data by running exhaustive, brute force queries. |
| The user without the <code>UNMASK</code> permission will see the following:</p> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre class="highlightjs highlight"><code class="language-cql hljs" data-lang="cql">CREATE USER untrusted_user WITH PASSWORD 'xyz'; |
| GRANT SELECT ON TABLE patients TO untrusted_user; |
| LOGIN untrusted_user |
| SELECT name, birth FROM patients WHERE name = 'Alice' ALLOW FILTERING; |
| |
| // Unauthorized: Error from server: code=2100 [Unauthorized] message="User untrusted_user has no UNMASK nor SELECT_UNMASK permission on table k.patients"</code></pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>There are some use cases where a trusted database user needs to produce masked data that untrusted external users will query. |
| For instance, a trusted app can connect to the database and with a query extract masked data that will be displayed to its end users. |
| In that case, the trusted user (the app) can be given the <code>SELECT_MASKED</code> permission. |
| This permission lets the user query masked columns in the <code>WHERE</code> clause of a <code>SELECT</code> query, |
| while still only seeing the masked data in the query results:</p> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre class="highlightjs highlight"><code class="language-cql hljs" data-lang="cql">CREATE USER trusted_user WITH PASSWORD 'xyz'; |
| GRANT SELECT, SELECT_MASKED ON TABLE patients TO trusted_user; |
| LOGIN trusted_user |
| SELECT name, birth FROM patients WHERE name = 'Alice' ALLOW FILTERING; |
| |
| // name | birth |
| // -------+------------ |
| // a**** | 1970-01-01</code></pre> |
| </div> |
| </div> |
| </div> |
| </div> |
| <div class="sect1"> |
| <h2 id="custom-functions"><a class="anchor" href="#custom-functions"></a>Custom functions</h2> |
| <div class="sectionbody"> |
| <div class="paragraph"> |
| <p><a href="functions.html#user-defined-functions" class="page">User-defined functions (UDFs)</a> can be attached to a table column. |
| The UDFs used for masking should belong to the same keyspace as the masked table. |
| The column value to mask will be passed as the first argument of the attached UDF. |
| Thus, the UDFs attached to a column should have at least one argument, |
| and that argument should have the same type as the masked column. |
| Also, the attached UDF should return values of the same type as the masked column:</p> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre class="highlightjs highlight"><code class="language-cql hljs" data-lang="cql">CREATE FUNCTION redact(input text) |
| CALLED ON NULL INPUT |
| RETURNS text |
| LANGUAGE java |
| AS 'return "redacted";'; |
| |
| CREATE TABLE patients ( |
| id timeuuid PRIMARY KEY, |
| name text MASKED WITH redact(), |
| birth date |
| );</code></pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>This creates a dependency between the table schema and the functions. |
| Any attempt to drop the function will be rejected while this dependency exists. |
| Consequently, you must drop the mask column in the table before dropping the function:</p> |
| </div> |
| <div class="listingblock"> |
| <div class="content"> |
| <pre class="highlightjs highlight"><code class="language-cql hljs" data-lang="cql">ALTER TABLE patients ALTER name |
| DROP MASKED;</code></pre> |
| </div> |
| </div> |
| <div class="paragraph"> |
| <p>Dropping the column, or its containing table, or its containing keyspace will also remove the dependency.</p> |
| </div> |
| <div class="paragraph"> |
| <p><a href="functions.html#aggregate-functions" class="page">Aggregate functions</a> cannot be used as masking functions.</p> |
| </div> |
| </div> |
| </div> |
| </article> |
| </main> |
| </div> |
| </div> |
| <footer class="grad grad--two flex-center pb-xlarge"> |
| <div class="inner text-center z2 relative"> |
| <h2 class="white py-small">Get started with Cassandra, fast.</h2> |
| <a id="footer-cta" href="/_/quickstart.html" class="btn btn--filled ma-medium">Quickstart Guide</a> |
| </div> |
| <div class="inner flex flex-distribute-items mt-xlarge z2 relative"> |
| <div class="col-2"> |
| <div id="footer-logo" class="logo logo--footer mb-medium"><img src="../../../../../assets/img/logo-white-r.png" alt="Cassandra Logo"></div> |
| <p>Apache Cassandra<img src="../../../../../assets/img/registered.svg" alt="®" style="width:18px;"> powers mission-critical deployments with improved performance and unparalleled levels of scale in the cloud.</p> |
| <div class="footer-social-icons"> |
| <a href="https://twitter.com/cassandra?lang=en" target="_blank"><img src="../../../../../assets/img/twitter-icon-circle-white.svg" alt="twitter icon" width="24"></a> |
| <a href="https://www.linkedin.com/company/apache-cassandra/" target="_blank"><img src="../../../../../assets/img/LI-In-Bug.png" alt="linked-in icon" width="24"></a> |
| <a href="https://www.youtube.com/c/PlanetCassandra" target="_blank"><img src="../../../../../assets/img/youtube-icon.png" alt="youtube icon" width="24"></a> |
| </div> |
| </div> |
| <div class="col-2 flex flex-center"> |
| <ul class="columns-2"> |
| <li class="mb-small"><a href="/">Home</a></li> |
| <li class="mb-small"><a href="/_/cassandra-basics.html">Cassandra Basics</a></li> |
| <li class="mb-small"><a href="/_/quickstart.html">Quickstart</a></li> |
| <li class="mb-small"><a href="/_/ecosystem.html">Ecosystem</a></li> |
| <li class="mb-small"><a href="/doc/latest/">Documentation</a></li> |
| <li class="mb-small"><a href="/_/community.html">Community</a></li> |
| <li class="mb-small"><a href="/_/case-studies.html">Case Studies</a></li> |
| <li class="mb-small"><a href="/_/resources.html">Resources</a></li> |
| <li class="mb-small"><a href="/_/blog.html">Blog</a></li> |
| </ul> |
| </div> |
| </div> |
| </footer> |
| <div class="lower-footer bg-white pa-medium"> |
| <div class="flex flex-row flex-vert-center"> |
| <div class="pr-medium"><img src="../../../../../assets/img//feather-small.png" alt="ASF" width="20"></div> |
| <div class="pr-medium"><a href="http://www.apache.org/" target="_blank">Foundation</a></div> |
| <div class="pr-medium"><a href="https://www.apache.org/events/current-event.html" target="_blank">Events</a></div> |
| <div class="pr-medium"><a href="https://www.apache.org/licenses/" target="_blank">License</a></div> |
| <div class="pr-medium"><a href="https://www.apache.org/foundation/thanks" target="_blank">Thanks</a></div> |
| <div class="pr-medium"><a href="https://www.apache.org/security" target="_blank">Security</a></div> |
| <div class="pr-medium"><a href="https://privacy.apache.org/policies/privacy-policy-public.html" target="_blank">Privacy</a></div> |
| <div class="pr-medium"><a href="https://www.apache.org/foundation/sponsorship" target="_blank">Sponsorship</a></div> |
| </div> |
| <p class="my-medium">© 2009-<script>document.write(new Date().getFullYear())</script> <a href="https://apache.org" target="_blank">The Apache Software Foundation</a> under the terms of the Apache License 2.0. Apache, the Apache feather logo, Apache Cassandra, Cassandra, and the Cassandra logo, are either registered trademarks or trademarks of The Apache Software Foundation.</p> |
| </div> |
| <div id="fade" class="hidden"></div> |
| <div id="modal" class="hidden"> |
| <div id="close-modal" class="cursor-pointer"><svg viewBox="0 0 24 24" width="24" height="24" stroke="currentColor" stroke-width="2" fill="none" stroke-linecap="round" stroke-linejoin="round" class="css-i6dzq1"><line x1="18" y1="6" x2="6" y2="18"></line><line x1="6" y1="6" x2="18" y2="18"></line></svg></div> |
| <div id="mod-content" class="vid-mod-content resp-container"></div> |
| </div> |
| <script src="../../../../../assets/js/site.js"></script> |
| <script async src="../../../../../assets/js/vendor/highlight.js"></script> |
| <script src="../../../../../assets/js/vendor/lunr.js"></script> |
| <script src="../../../../../assets/js/vendor/search.js" id="search-script" data-base-path="../../../../.." data-page-path="/Cassandra/5.0/cassandra/developing/cql/dynamic-data-masking.html"></script> |
| <script async src="../../../../../assets/../search-index.js"></script> |
| <script> |
| jQuery(function(){ |
| var windowW = $(window).width(); |
| $(document) |
| .on('click','.mobile-nav-icon',function(){ |
| $('.main-nav').fadeIn(); |
| }) |
| .on('click','.main-nav',function(){ |
| if(windowW <= 1000){ |
| $(this).fadeOut(); |
| } |
| }) |
| .on('click','#version-toggle',function(){ |
| $(this).toggleClass('active'); |
| $(this).next().fadeToggle(); |
| }) |
| .on('click','#mobile-docs-nav-burger', function(){ |
| $(this).toggleClass('active'); |
| $('.docs-nav').toggleClass('active'); |
| }); |
| var url = window.location.pathname; |
| var isQuickstart = url.includes('quickstart.html'); |
| if(isQuickstart){ |
| var footerCTA = document.getElementById('footer-cta'); |
| footerCTA.innerHTML = 'Get latest updates'; |
| footerCTA.setAttribute('href', '/_/blog.html'); |
| } |
| }); |
| </script> |
| </div> |
| </body> |
| </html> |
