Enabling database-native masking in IBM Db2 databases

Edit online

To enable database-native data masking in Db2®, install the IBM® Optim Data Privacy Java™ User-Defined Function (UDF) into your IBM Db2 for Linux®, UNIX, and Windows database.

Before you begin

Before you begin, ensure that you have the following items:

  • Access to the IBM Optim runtime container (optim-runtime)
  • A Db2 database connection with appropriate privileges to install JAR files and create functions
  • The masking-udf-db2-1.0.0-SNAPSHOT.jar file from the optim-runtime container

About this task

The installation process involves copying the JAR file from the container, installing it into Db2, and creating the udfBasicMask UDF function.

Installing the IBM Optim Data Privacy UDF

To install the IBM Optim Data Privacy udfBasicMask UDF function into your Db2 database:

  1. Copy the masking UDF JAR file from the optim-runtime container to your local file system.
    podman cp optim-runtime:/masking-udf/masking-udf-db2-1.0.0-SNAPSHOT.jar /tmp
  2. Connect to your Db2 database.
    db2
connect to sample

    Replace sample with your database name.

  3. Install the JAR file into Db2.
    call sqlj.install_jar('file:/tmp/masking-udf-db2-1.0.0-SNAPSHOT.jar','OptimMaskingUDF')
  4. Refresh the Java classes in Db2.
    call sqlj.refresh_classes()
  5. Create the UDF function.
    CREATE FUNCTION udfBasicMask(sourceVal VARCHAR(256), format VARCHAR(128), processor VARCHAR(128), config VARCHAR(1024) DEFAULT NULL, metadata VARCHAR(1024) DEFAULT NULL, iv VARCHAR(128) DEFAULT NULL, key VARCHAR(128) DEFAULT NULL) RETURNS VARCHAR(256) EXTERNAL NAME 'OptimMaskingUDF:com.ibm.optim.tdm.runtime.udf.db2.MaskingFunctions.udfBasicMask' LANGUAGE JAVA PARAMETER STYLE JAVA FENCED NULL CALL NO EXTERNAL ACTION NO SQL

The udfBasicMask function is now available in your Db2 database. You can use it in SQL queries to mask sensitive data.

Using the udfBasicMask function

The following example shows how to use the udfBasicMask function to mask names in a table containing customer data:

SELECT udfBasicMask(name, 'USPersonName', 'RandomFormatFabricationProcessor') FROM customers;

This query masks the name column using the US person name format and the random format fabrication processor.

Note: The first time you invoke the UDF takes longer than subsequent invocations because the UDF must be initialized and the masking formats must be loaded.

Uninstalling the IBM Optim Data Privacy UDF

To uninstall the udfBasicMask UDF:

  1. Drop the function: 
    drop function udfBasicMask(VARCHAR(), VARCHAR(), VARCHAR(), VARCHAR(), VARCHAR(), VARCHAR(), VARCHAR())
  2. Remove the JAR file: 
    CALL SQLJ.REMOVE_JAR('OptimMaskingUDF')