[
https://issues.apache.org/jira/browse/CASSANDRA-18068?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17680302#comment-17680302
]
Andres de la Peña edited comment on CASSANDRA-18068 at 1/24/23 11:29 PM:
-------------------------------------------------------------------------
The proposed patch allows to attach masking functions to the table column
definitions in the schema:
||PR||CI||
|[trunk|https://github.com/apache/cassandra/pull/2110]|[j8|https://app.circleci.com/pipelines/github/adelapena/cassandra/2583/workflows/ce7e6777-1223-4bfb-a5a0-a6c57b240ea6]
[j11|https://app.circleci.com/pipelines/github/adelapena/cassandra/2583/workflows/67d25890-9923-444c-9bdb-183d73298a5a]|
That way, one can do things like:
{code:java}
> CREATE TABLE t (k int PRIMARY KEY, v text MASKED WITH
> mask_replace('redacted'));
>
> ALTER TABLE t ALTER v WITHOUT MASK;
> ALTER TABLE t ALTER v MASKED WITH mask_inner(1, null, '*');
> ALTER TABLE t ADD v2 text MASKED WITH DEFAULT;
>
> INSERT INTO t(k, v, v2) VALUES (0, 'Alice', 'Alice');
> INSERT INTO t(k, v, v2) VALUES (1, 'Bob', 'Bob');
> SELECT * FROM t;
k | v | v2
---+-------+------
1 | *ob | ****
0 | *lice | ****
{code}
This patch is based on the functions proposed in CASSANDRA-17941.
This doesn't include the {{UNMASK}} and {{SELECT_UNMASKED}} permissions that
are described on [the
CEP|https://cwiki.apache.org/confluence/display/CASSANDRA/CEP-20%3A+Dynamic+Data+Masking].
Those permissions will be added by CASSANDRA-18069 and CASSANDRA-18070. Their
absence makes this patch mostly useless, since once the columns are masked
there isn't a way to see the clear values. Thus, this should be committed into
a feature branch until we have the permissions ready.
was (Author: adelapena):
The proposed patch allows to attach masking functions to the table column
definitions in the schema:
||PR||CI||
|[trunk|https://github.com/apache/cassandra/pull/2110]|[j8|https://app.circleci.com/pipelines/github/adelapena/cassandra/2582/workflows/c2ac3c84-a00e-44b2-bbf9-f8bffd975295]
[j11|https://app.circleci.com/pipelines/github/adelapena/cassandra/2582/workflows/4c217b4e-29f0-470c-a672-06ecc5534033]|
That way, one can do things like:
{code:java}
> CREATE TABLE t (k int PRIMARY KEY, v text MASKED WITH
> mask_replace('redacted'));
>
> ALTER TABLE t ALTER v WITHOUT MASK;
> ALTER TABLE t ALTER v MASKED WITH mask_inner(1, null, '*');
> ALTER TABLE t ADD v2 text MASKED WITH DEFAULT;
>
> INSERT INTO t(k, v, v2) VALUES (0, 'Alice', 'Alice');
> INSERT INTO t(k, v, v2) VALUES (1, 'Bob', 'Bob');
> SELECT * FROM t;
k | v | v2
---+-------+------
1 | *ob | ****
0 | *lice | ****
{code}
This patch is based on the functions proposed in CASSANDRA-17941.
This doesn't include the {{UNMASK}} and {{SELECT_UNMASKED}} permissions that
are described on [the
CEP|https://cwiki.apache.org/confluence/display/CASSANDRA/CEP-20%3A+Dynamic+Data+Masking].
Those permissions will be added by CASSANDRA-18069 and CASSANDRA-18070. Their
absence makes this patch mostly useless, since once the columns are masked
there isn't a way to see the clear values. Thus, this should be committed into
a feature branch until we have the permissions ready.
> Allow to attach native masking functions to table columns
> ---------------------------------------------------------
>
> Key: CASSANDRA-18068
> URL: https://issues.apache.org/jira/browse/CASSANDRA-18068
> Project: Cassandra
> Issue Type: New Feature
> Components: Feature/Dynamic Data Masking
> Reporter: Andres de la Peña
> Assignee: Andres de la Peña
> Priority: Normal
> Time Spent: 10m
> Remaining Estimate: 0h
>
> Allow to attach the native masking functions added by CASSANDRA-17941 to
> table columns, as defined by
> [CEP-20|https://cwiki.apache.org/confluence/display/CASSANDRA/CEP-20%3A+Dynamic+Data+Masking].
>
> {{CREATE TABLE}} statements would look like:
> {code}
> > CREATE TABLE patients (
> id timeuuid PRIMARY KEY,
> name text MASKED WITH partial(2, 1),
> birth date MASKED WITH default()
> );
> > INSERT INTO patients(id, name, birth) VALUES (now(), 'alice', '1982-12-21);
>
> > SELECT name, birth FROM patients;
>
> name | birth
> ---------+------------
> alXXXXe | 1900-01-01
> {code}
> {{ALTER TABLE}} statements would look like:
> {code}
> > ALTER TABLE patients ALTER name MASKED WITH partial(2, 1);
> > ALTER TABLE patients ALTER name WITHOUT MASK;
> {code}
> It won't be possible to use masked columns in the WHERE and IF clauses of
> SELECT and UPDATE statements.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
