Data masking in SAP HANA Cloud to read into SAC planning models

[shyam_uthaman]

Hi All,

Since Planning models require an Odata connection to HANA Cloud which uses a generated username and secret key to connect, data masking functionality doesn't work when data is sent to SAC planning leading to sensitive data getting exposed. Since live connections aren't available, what's the path to handling sensitive data here?

[SJohnson]

Hi Shyam,
Can you provide a few more details on what you're trying to do? As Planning models within SAC-P require the data to be acquired then having masked data in the data packet could provide issues, especially if the masked item is a dimension member ID or a measure value. If the masked data represents an attribute of a dimension (e.g. SIN could be a masked attribute of the Employee ID) then this could be worked around. For example:

• the master data could be loaded using an ODATA Connection that is designed to use Basic Authentication and a hard coded user name or password, This would result in the attributes to be masked when loaded in to SAC
• the attributes could be manually masked either using an SAC script, using the Data Import API or potentially using a custom widget
• the attribute could be excluded - for example you could decide that the SIN attribute is not key to the planning function

If the masked data represents a value/measure that SAC will need to perform calculations against (e.g. Salary, Bonus, etc.) then you will need to handle this level of security within the SAC model itself. SAC does not support masking of data but it does provide granular row-level security where you can configure who can see what data. If you wish to PLAN against the loaded data then this will be your only approach for working with this data.

One other option would be to use a hybrid approach, so using a Live Connection against your HANA Cloud (although you mentioned that this will not work?) and have it display the dimensions with the masked values and blend this data with the data coming from your Planning table. Again this won't work if you're wanting to mask a measure value but it should work for masking dimension values providing the linking keys are not masked.

The key thing to remember is that with Planning models the data MUST be loaded into an SAC model. ODATA does not have an inherent way to UNMASK data, so if SAC tries to load MASKED data into an SAC Model which has UNMASKED master data then it will result in inconsistent and unreliable data.

Take for example, if I had an Employee dimension that was using their SIN as the member ID, so I have the following two employees with their corresponding salaries and hire dates:

• 123456789 - $100,000 - 04/01/2023
• 321764589 - $150,000 - 06/01/2023

If this data was masked to only show the last 2 digits of the SIN and loaded into SAC, then the ODATA packet would look something like:

"Data":[{

"id":*******89,
"HireDate":"20230401",
"Salary":100000

},
{
"id":*******89,
"HireDate":"20230601",
"Salary":150000
}]

If the Import Job is setup to allow for new members to be added on the fly then the result in SAC would be to create a new Employee with ID *******89, and then on 20230401 it would add 100000 to the Salary measure and on 20230601 it would add another 150000. So the full year value for this new employee would be 250000. This is just an example, it may not be what you're trying to do but I hope it highlights the issue of trying to LOAD masked data into SAC.

Again, if you can provide more details on what data you want to mask I can probably provide a more concise answer.

Regards,
Sean