oracle 12c 中的数据屏蔽

Question

how to update the values of particular columns of a table after masking in oracle 12c?

My table:

detail_table(
 id number,
 source_num varchar2(20), 
 destination_num varchar2(20)
) 

it contains 250 million records. How to mask the columns source_num, destination_num like this:

                source_num 
before masking: 1234567896
after masking:  123456XXXX (excluding first six characters all need to be replaced by X).

the same rule will be applied for destination_num also.the existing values in the table need to replaced by the masked values. i have read some articles regarding data redaction in oracle 12c but its mentioned as only we can select the masked data but no the updates.

Answer 1

WITH tst AS
  (SELECT '1234567890' AS col FROM dual
  )
SELECT col    AS col1,
  LENGTH(col) AS col2,
  REGEXP_REPLACE(col, '.', 'x', 7) col3,
  LENGTH(REGEXP_REPLACE(col, '.', 'x', 7)) col4
FROM tst

I don't know what you mean by 25 Cr records . Assuming it's a lot of data (millions) I would recommend:

• creating a new table with the updated columns
• dropping the first table (keep in mind indexes and other stuff which need to be disabled during this operation)
• renaming the new table to be like the original

How to create the new table:

CREATE TABLE detail_table_1 AS
SELECT id,
  REGEXP_REPLACE(source_num, '.', 'x', 7) AS source_num,
  REGEXP_REPLACE(destination_num , '.', 'x', 7) AS destination_num 
FROM detail_table

Answer 2

update detail_table 
  set source_num = rpad(substr(source_num, 1,6), length(source_num),'X')
     ,destination_num = rpad(substr(destination_num , 1,6), length(destination_num ),'X'); 

add update for both columns destination_num and source_num

Answer 3

I think this one is shorter:

update detail_table
set source_num = REGEXP_REPLACE(source_num, '.', 'x', 7);

Answer 4

One important concept here, which only Marius touched upon, is recreating the table from scratch, instead of updating the existing one. update generates undo and redo, which takes a lot of time and resources. If you have indexes, updating them while you update the values in your table will add that much more overhead. There is a lot of discussion, for example on AskTom, about this issue (and this suggestion - of creating a NEW table in such a case, instead of updating the existing one). You will see that they always remind you to make a note of indexes, triggers etc. that may exist on your table, so you can recreate them after you create the new table, drop the old one, and rename the new one to the old name.

For example: https://asktom.oracle.com/pls/asktom/f?p=100:11:0::NO::P11_QUESTION_ID:6407993912330

Then, since you have a very large number of rows (in relational database terminology there are no "records"), it is best not to use regular expressions. Michael offered a very efficient way to get the desired result using just standard string functions. Alternatively, if all your input strings are the same length, say ten characters (or if you don't really care to preserve the length - once you mask the "numbers" perhaps preserving their original length is irrelevant anyway) you may even do something like substr(source_num, 1, 6) || 'XXXX' substr(source_num, 1, 6) || 'XXXX' - saving the repeated calls to length() and rpad() , one for each row in your table.

Answer 5

if your ultimate goal is to hide the data then Oracle redaction features available since 11gR2 is a very powerful and advanced feature but it is licensed under advanced security feature which will ensure that unwanted users will not be able to see unwanted data or see partial data.

Let me know if you need more details on the same.