tDataMasking properties for Apache Spark Streaming - 7.3

Data privacy

Version
7.3
Language
English (United States)
Product
Talend Big Data Platform
Talend Data Fabric
Talend Data Management Platform
Talend Data Services Platform
Talend MDM Platform
Talend Real-Time Big Data Platform
Module
Talend Studio
Content
Data Governance > Third-party systems > Data Quality components > Data privacy components
Data Quality and Preparation > Third-party systems > Data Quality components > Data privacy components
Design and Development > Third-party systems > Data Quality components > Data privacy components

These properties are used to configure tDataMasking running in the Spark Streaming Job framework.

The Spark Streaming tDataMasking component belongs to the Data Quality family.

This component is available in Talend Real Time Big Data Platform and Talend Data Fabric.

Basic settings

Schema and Edit Schema

A schema is a row description. It defines the number of fields (columns) to be processed and passed on to the next component. When you create a Spark Job, avoid the reserved word line when naming the fields.

Click Sync columns to retrieve the schema from the previous component connected in the Job.

Click Edit schema to make changes to the schema. If the current schema is of the Repository type, three options are available:

  • View schema: choose this option to view the schema only.

  • Change to built-in property: choose this option to change the schema to Built-in for local changes.

  • Update repository connection: choose this option to change the schema stored in the repository and decide whether to propagate the changes to all the Jobs upon completion. If you just want to propagate the changes to the current Job, you can select No upon completion and choose this schema metadata again in the Repository Content window.

The output schema of this component contains read-only columns:
  • TWEAK: Is generated when the Use tweaks with FF1 Encryption check box is selected. This column contains the tweak necessary to decrypt the data.
  • ORIGINAL_MARK: Identifies by true or false if the record is an original record or a substitute record respectively.

 

Built-In: You create and store the schema locally for this component only.

 

Repository: You have already created the schema and stored it in the Repository. You can reuse it in various projects and Job designs.

Modifications

Define in the table what fields to change and how to change them:

Input Column: Select the column from the input flow that contains the data to be masked.

The supported data types are: Date, Double, Float, Integer, Long and String.

These modifications are based on the function you select in the Function column.

Category: select a category of masking functions from the list.
  • Character Handling
  • Data Handling
  • Number Handling
  • Bank Account Generation
  • Data Generation
  • Phone Number generation
  • SSN Generation
  • Bank Account Masking
  • Address Masking
  • Email Masking
  • Credit Card Masking
  • Phone Masking
  • SSN Masking
  • Set to null

Function: Select the function that will hide or obfuscate the original data with substitutes. For example, you can replace digits or letters with the substitute of your choice, replace values with synonyms from an index file or nullify values.

The functions you can select from the Function list depend on the data type of the input column.

For example, if the column type is Long, you can use the Numeric variance function. If the column type is String, the Numeric variance function will not be available. Also, the Function list for a Date column is date-specific, it allows you to decide the type of modification you want to do on date values.

Method: Select the Basic method or one FF1 algorithm (Format-Preserving Encrytion (FPE)), FF1 with AES or FF1 with SHA-2:

The Basic method is the default algorithm.

Note: As the masking methods are stronger, it is recommended to use the FF1 algorithms rather than the Basic method.

The FF1 with AES method is based on the Advanced Encryption Standard in CBC mode. The FF1 with SHA-2 method depends on the secure hash function HMAC-256.

Note: Java 8u161 is the minimum required version to use the FF1 with AES method. To be able to use this FPE method with Java versions earlier than 8u161, download the Java Cryptography Extension (JCE) unlimited strength jurisdiction policy files from Oracle website.

The FF1 with AES and FF1 with SHA-2 methods require a password to be specified in the Password for FF1 methods field of the Advanced settings to generate unique masked values.

The Method list is only available for functions that use Format-Preserving Encryption algorithms.

When using the Replace all, Replace characters between two positions, Replace n first digits and Replace n last digits with FPE methods, you can select an alphabet.

Characters that belong to the selected alphabets are masked with characters from the same character type within the selected alphabet.

When selecting the Best guess alphabet, masked values contain characters from all alphabets represented in the input values. Best guess is the default alphabet.

Any unrecognized character is copied to the output as is.

Extra Parameter: This field is used by some of the functions, it will be disabled when not applicable. When applicable, enter a number or a letter to decide the behavior of the function you have selected.

Keep format: this function is only used on Strings. Select this check box to keep the input format when using the Generate account number and keep original country, Generate credit card number and keep original bank, Bank Account Masking, Credit Card Masking, Phone Masking and SSN Masking functions or categories. That is to say, if there are spaces, dots ('.'), hyphens ('-') or slashes ('/') in the input, those characters are kept in the output. If you select this check box when using Phone Masking functions, the characters that are not numbers from the input are copied to the output as is.

Advanced settings

Password for FF1 methods

Set the password required for the FF1 with AES and FF1 with SHA-2 methods to generate unique masked values. If the password is not set, a random password is created at each Job execution. When using the FF1 with AES and FF1 with SHA-2 methods and a password, the seed from the Seed for random generator field is not used.

Use tweaks with FF1 Encryption

Select this check box to use tweaks. A unique tweak is generated for each record and applies to all data of a record.

If bijective masking is necessary, do not use this functionality. For more information about tweaks, see the data masking functions.

Seed for random generator

Set a random number if you want to generate the same sample of substitute data in each execution of the Job. The seed is not set by default.

This field is of Long type. The value range is [-263, 263-1].

If you do not set the seed, the component creates a new random seed for each Job execution. Repeating the execution with a different seed will result in a different sample being generated.

Encoding

Select the encoding from the list or select Custom and define it manually. If you select Custom and leave the field empty, the supported encodings depend on the JVM that you are using. This field is compulsory for the file encoding.

When you set Function to Generate from file/list, define the file path in Extra Parameter.

Output the original row

Select this check box to output original data rows in addition to the substitute data. Outputting both the original and substitute data can be useful in debug or test processes.

Should null input return null

This check box is selected by default. When selected, the component outputs null when input values are null. Otherwise, the component returns the default value when the input is null, that is an empty string for string values, 0 for numeric values and the current date for date values.

Should empty input return empty

When this check box is selected, empty values are left unchanged in the output data. Otherwise, the selected functions are applied to the input data.

Send invalid data to "Invalid" output flow
This check box is selected by default.
  • Selected: When the data can be masked, they are sent to the main flow. Otherwise, the data are sent to the "Invalid" output flow.
  • Cleared: The data are sent to the main flow.
The data are considered invalid when:

tStat Catcher Statistics

Select this check box to gather the Job processing metadata at the Job level as well as at each component level.

Usage

Usage rule

This component, along with the Spark Streaming component Palette it belongs to, appears only when you are creating a Spark Streaming Job.

This component is used as an intermediate step.

You need to use the Spark Configuration tab in the Run view to define the connection to a given Spark cluster for the whole Job.

This connection is effective on a per-Job basis.

For further information about a Talend Spark Streaming Job, see the sections describing how to create, convert and configure a Talend Spark Streaming Job of the Talend Open Studio for Big Data Getting Started Guide .

Note that in this documentation, unless otherwise explicitly stated, a scenario presents only Standard Jobs, that is to say traditional Talend data integration Jobs.

Spark Connection

In the Spark Configuration tab in the Run view, define the connection to a given Spark cluster for the whole Job. In addition, since the Job expects its dependent jar files for execution, you must specify the directory in the file system to which these jar files are transferred so that Spark can access these files:
  • Yarn mode (Yarn client or Yarn cluster):
    • When using Google Dataproc, specify a bucket in the Google Storage staging bucket field in the Spark configuration tab.

    • When using HDInsight, specify the blob to be used for Job deployment in the Windows Azure Storage configuration area in the Spark configuration tab.

    • When using Altus, specify the S3 bucket or the Azure Data Lake Storage for Job deployment in the Spark configuration tab.
    • When using Qubole, add a tS3Configuration to your Job to write your actual business data in the S3 system with Qubole. Without tS3Configuration, this business data is written in the Qubole HDFS system and destroyed once you shut down your cluster.
    • When using on-premise distributions, use the configuration component corresponding to the file system your cluster is using. Typically, this system is HDFS and so use tHDFSConfiguration.

  • Standalone mode: use the configuration component corresponding to the file system your cluster is using, such as tHDFSConfiguration or tS3Configuration.

    If you are using Databricks without any configuration component present in your Job, your business data is written directly in DBFS (Databricks Filesystem).

This connection is effective on a per-Job basis.