MySQL 8.4 Release Notes
Note
MySQL 企业数据掩码与去标识化是包含在 MySQL 企业版中的扩展，这是一个商业产品。要了解更多关于商业产品的信息，请访问 https://www.mysql.com/products/。MySQL Enterprise Data Masking and De-Identification is an extension included in MySQL Enterprise Edition, a commercial product. To learn more about commercial products, https://www.mysql.com/products/.
MySQL 企业版提供数据掩码和去标识化功能：MySQL Enterprise Edition provides data masking and de-identification capabilities:
将现有数据进行转换以进行掩码处理并移除识别特征，例如将信用卡号的所有数字（除最后四位外）更改为
'X'字符。Transformation of existing data to mask it and remove identifying characteristics, such as changing all digits of a credit card number but the last four to'X'characters.生成随机数据，例如电子邮件地址和支付卡号。Generation of random data, such as email addresses and payment card numbers.
用数据库中存储的字典中的数据替换数据。这些词典很容易以标准方式复制。管理仅限于被授予特殊权限的授权用户，因此只有他们才能创建和修改字典。Substitution of data by data from dictionaries stored in the database. The dictionaries are easily replicated in a standard way. Administration is restricted to authorized users who are granted special privileges so that only they can create and modify the dictionaries.
Note
MySQL 企业数据掩码和去标识化最初作为插件库在 MySQL 中实现。从 MySQL 8.4 起，MySQL 企业版还提供了访问数据掩码和去标识化功能的组件。有关相似性和差异的信息，请参见 表 8.45，“数据掩码组件与插件元素的比较”。MySQL Enterprise Data Masking and De-Identification was implemented originally in MySQL as a plugin library. As of MySQL 8.4, MySQL Enterprise Edition also provides components to access data masking and de-identification capabilities. For information about the similarities and differences, see Table 8.45, “Comparison Between Data-Masking Components and Plugin Elements”.
如果您是第一次使用 MySQL 企业数据掩码和去标识化功能，建议安装组件以访问仅通过组件基础设施提供的持续增强功能。If you are using MySQL Enterprise Data Masking and De-Identification for the first time, consider installing the components for access to the ongoing enhancements only available with component infrastructure.
应用程序使用这些功能的方式取决于数据的使用目的以及访问者：The way that applications use these capabilities depends on the purpose for which the data is used and who accesses it:
使用敏感数据的应用程序可以通过执行数据掩码来保护数据，并允许使用部分掩码的数据进行客户身份识别。例如：呼叫中心可能会要求客户提供其社会安全号码的最后四位数字。Applications that use sensitive data may protect it by performing data masking and permitting use of partially masked data for client identification. Example: A call center may ask for clients to provide their last four Social Security Number digits.
需要正确格式化数据但不一定需要原始数据的应用程序，可以生成示例数据。例如：正在测试数据验证器但无法访问原始数据的应用程序开发人员，可以生成具有相同格式的随机数据。Applications that require properly formatted data, but not necessarily the original data, can synthesize sample data. Example: An application developer who is testing data validators but has no access to original data may synthesize random data with the same format.
必须用词典术语替换真实姓名以保护敏感信息的应用程序，但仍需向应用程序用户提供真实内容示例：受限于查看地址的培训用户会从词典中得到一个随机的
city names，而不是实际的城市名称。此情景的一种变体可能是，仅当实际城市名称存在于usa_city_names中时才进行替换。Applications that must substitute a real name with a dictionary term to protect to protect sensitive information, but still provide realistic content to application users. Example: A user in training who is restricted from viewing addresses gets a random term from dictionarycity namesinstead of the real city name. A variant of this scenario may be that the real city name is replaced only if it exists inusa_city_names.
示例 1：Example 1:
医疗研究机构可能会保存包含个人和医疗数据混合的患者数据。这可能包括基因序列（长字符串）、以 JSON 格式存储的测试结果以及其他数据类型。尽管这些数据可能主要由自动分析软件使用，但仍有可能访问特定患者的基因组数据或测试结果。在这种情况下，应使用数据屏蔽以使这些信息无法个人识别。Medical research facilities can hold patient data that comprises a mix of personal and medical data. This may include genetic sequences (long strings), test results stored in JSON format, and other data types. Although the data may be used mostly by automated analysis software, access to genome data or test results of particular patients is still possible. In such cases, data masking should be used to render this information not personally identifiable.
示例 2：Example 2:
一家信用卡处理公司使用敏感数据提供一系列服务，例如：A credit card processor company provides a set of services using sensitive data, such as:
每秒处理大量金融事务。Processing a large number of financial transactions per second.
存储大量事务相关数据。Storing a large amount of transaction-related data.
以严格的个人数据要求保护事务相关数据。Protecting transaction-related data with strict requirements for personal data.
使用可逆或部分屏蔽的数据处理客户关于事务的投诉。Handling client complaints about transactions using reversible or partially masked data.
一次典型的事务可能包含多种敏感信息，包括：A typical transaction may include many types of sensitive information, including:
信用卡号。Credit card number.
事务类型和金额。Transaction type and amount.
商户类型。Merchant type.
事务密码（用于确认事务合法性）。Transaction cryptogram (to confirm transaction legitimacy).
具备 GPS 功能终端的地理位置（用于防欺诈）。Geolocation of GPS-equipped terminal (for fraud detection).
这些类型的信息随后可能会在银行或其他发卡金融机构中与客户个人数据结合，如：Those types of information may then be joined within a bank or other card-issuing financial institution with client personal data, such as:
客户全名（个人或公司）。Full client name (either person or company).
地址。Address.
出生日期。Date of birth.
社会安全号码。Social Security number.
电子邮件地址。Email address.
电话号码。Phone number.
卡处理公司及金融机构内的各种员工角色需要访问这些数据。有些角色可能只需要访问屏蔽数据。其他角色可能需要根据具体情况访问原始数据，并记录在审计日志中。Various employee roles within both the card processing company and the financial institution require access to that data. Some of these roles may require access only to masked data. Other roles may require access to the original data on a case-to-case basis, which is recorded in audit logs.
掩码和去标识化是合规监管的核心，因此 MySQL 企业数据掩码和去标识化可以帮助应用程序开发人员满足隐私要求：Masking and de-identification are core to regulatory compliance, so MySQL Enterprise Data Masking and De-Identification can help application developers satisfy privacy requirements:
PCI – DSS：支付卡数据。PCI – DSS: Payment Card Data.
HIPAA：健康数据隐私、《经济与临床健康信息技术法案》(HITECH 法案)。HIPAA: Privacy of Health Data, Health Information Technology for Economic and Clinical Health Act (HITECH Act).
欧盟通用数据保护条例 (GDPR)：个人数据保护。EU General Data Protection Directive (GDPR): Protection of Personal Data.
数据保护法（英国）：个人数据保护。Data Protection Act (UK): Protection of Personal Data.
萨班斯-奥克斯利法案、GLBA、美国爱国者法案、1998 年身份盗窃和假冒防止法。Sarbanes Oxley, GLBA, The USA Patriot Act, Identity Theft and Assumption Deterrence Act of 1998.
FERPA – 学生数据、NASD、CA SB1386 和 AB 1950、各州数据保护法、巴塞尔协议 II。FERPA – Student Data, NASD, CA SB1386 and AB 1950, State Data Protection Laws, Basel II.
以下各节介绍了 MySQL 企业数据掩码和去标识化的组成元素，讨论了如何安装和使用，并提供了其元素的参考信息。The following sections describe the elements of MySQL Enterprise Data Masking and De-Identification, discuss how to install and use it, and provide reference information for its elements.