Oracle 10g数据屏蔽

Question

I have Oracle 10g database. I want to mask my record of tables. It doesn't really need to make sense, it doesn't need to be readable. Just needs to be masked. For example:

select *
from customer;

LAST_NAME      FIRST_NAME     ADDRESS
-------------- -------------- --------------------
Doe            John           10 someroad st

i convert to this :

LAST_NAME      FIRST_NAME     ADDRESS
-------------- -------------- --------------------
Ahd            Uiea           55 xxxx ue

I need open source software that can do this work. What should i use?

Answer 1

You can use ORA_HASH or DBMS_CRYPTO package to full fill your requirements. Giving solution using DBMS_CRYPTO:

--Source data:

create table customer(last_name varchar2(50),first_name varchar2(50), address varchar2(200));

--Encrypt Function(Script Source ):

CREATE OR REPLACE FUNCTION encrypt_value (p_in IN varchar2, p_key IN raw) RETURN raw IS l_enc_val raw (2000);

 l_mod number := dbms_crypto.ENCRYPT_AES128 + dbms_crypto.CHAIN_CBC + dbms_crypto.PAD_PKCS5;

 BEGIN l_enc_val := dbms_crypto.encrypt ( UTL_I18N.STRING_TO_RAW (p_in, 'AL32UTF8'), l_mod, p_key );

 RETURN l_enc_val;

 END;

--Function Implementation:

select encrypt_value(last_name,'AABBCC'),encrypt_value(first_name,'AABBCC'), encrypt_value(address,'AABBCC') from customer;

Answer 2

If you're using the Enterprise version of Oracle, you can use a Virtual Private Database (VPD) for this.

A VPD allows you to fine-grained access control (based on the account used to connect to the database). It can:

• return only a subset of rows
• use column masking to display sensitive columns as NULL values

It achieves this by appending a custom WHERE clause to every query run against the table. There's no way to circumvent it, and no need to adapt existing applications (for using a custom-built view etc.)

To create a VPD for your customer table, you need to:

• create a function for generating the WHERE clause
• create a policy for your database table
• enable the policy

Function

CREATE OR REPLACE FUNCTION hide_address (
 v_schema IN VARCHAR2, 
 v_objname IN VARCHAR2)

RETURN VARCHAR2 AS
 result VARCHAR2 (200);

BEGIN
 result := '1=0'; -- evaluates to FALSE for every account
 RETURN (result);
END hide_address;

Creating a policy

BEGIN
 DBMS_RLS.ADD_POLICY(
   object_schema         => 'scott', 
   object_name           => 'customer',
   policy_name           => 'hide_address_policy', 
   policy_function       => 'hide_address',
   sec_relevant_cols     =>' address',
   sec_relevant_cols_opt => dbms_rls.ALL_ROWS);
END;

After enabling the policy, every query trying to access CUSTOMER.ADDRESS will return NULL . Depending on your requirements, you might want to add a view to access the table that returns a random address instead of NULL :

select name, 
  (case when address is NULL 
   then dbms_random.string('', 15) 
   else address end) as address
from 
  customer