Masking columns in a table

Question

Hello,
I have requirement to mask some of the columns in the databaes table. Lets say table test1 has 5 columns and i need to mask 1 column so that the user will not be able to see it. how can i do this?
If i mask this columns, i should be able to unmask also later.

Answer 1

I assume that by "mask" you mean "obscure or occlude data by replacing it with a meaningless placeholder." I had a similar requirement where only certain roles where able to see an entire credit card number in the database. All others, regardless of means of connection (isql, web, application, etc) were limted to seeing the last four digits. The year/month of the expiration date was also limited to year. This was very strictly controlled.
The way to accomplish this was to provide a view on the table where the card_number and card_expiry were masked and only grant select on the view, not the underlying table. DBAs would obviously be able to see the entire columns' data, but that was an acceptable risk since they had access to all the other data anyway, implying trust at a much greater level than a handful of columns.
A hypothetical example might be (you can cut-n-paste all of the below to isql or equiv, although you might have to clean up line-breaks a little):
--get rid of the table, in case you've made changes:
drop table t_cust purge;
--create "customer" table:
CREATE TABLE T_CUST(
CUST_ID NUMBER NOT NULL,
CUST_NAME VARCHAR2(200) NOT NULL,
CARD_NBR VARCHAR2(15) NOT NULL,
CARD_EXPIRY DATE NOT NULL,
CONSTRAINT PK_CUST PRIMARY KEY(CUST_ID)
*yeah, I know you wouldn't put card info in the same table as customer, but this is an
--example not a 3NF logical data model, dangit.
--make sure nobody but owners and ubers can select from the base table:
REVOKE SELECT ON T_CUST FROM PUBLIC;
--create the "masked" view:
CREATE OR REPLACE VIEW V_CUST_SECURE AS
SELECT CUST_ID, CUST_NAME,
'###########'||SUBSTR(CARD_NBR,12,4) as CARD_NBR,
'##/'||to_char(CARD_EXPIRY,'YY') as CARD_EXPIRY
FROM T_CUST;
--let everyone see the masked version:
GRANT SELECT ON V_CUST_SECURE TO PUBLIC;
--insert some rows:
INSERT INTO T_CUST values(1,'John Doe','123456789011111',to_date('1/1/2008','MM/DD/YYYY'));
INSERT INTO T_CUST values(2,'John Doe','123456789012222',to_date('2/1/2008','MM/DD/YYYY'));
INSERT INTO T_CUST values(3,'John Doe','123456789013333',to_date('3/1/2008','MM/DD/YYYY'));
INSERT INTO T_CUST values(4,'John Doe','123456789014444',to_date('4/1/2008','MM/DD/YYYY'));
INSERT INTO T_CUST values(5,'John Doe','123456789015555',to_date('5/1/2008','MM/DD/YYYY'));
--see the un-masked version:
select * from T_CUST;
--see the masked version:
select * from V_CUST_SECURE;