Data security for semantic models

Applies to: Kyvos Enterprise  Kyvos Cloud (SaaS on AWS) Kyvos AWS Marketplace

Kyvos Azure Marketplace   Kyvos GCP Marketplace Kyvos Single Node Installation (Kyvos SNI)

Security settings allow you to limit access to data by the criteria you specify, such as region or by department (group). Configure data security at the row or column level or both for saved semantic models. You can specify security access for individual users or groups. Right-click an existing rule to modify or delete it. Data security rules can be exported along with the data. Use And or Or to create complex rule conditions. Each rule can have a separate column and row-level security.

Kyvos also allows unconditional column data masking, which is another form of security. It enables you to protect sensitive data by masking columns instead of restricting them. This feature allows for easy masking of any column data, such as SSNs, mobile numbers, credit card numbers, and email IDs, while browsing the semantic model on any BI tool.

See the section Column masking for column-level security for more details.  

Setting semantic model data security

To set semantic model data security, perform the following steps. 

1. From the Toolbox, click Semantic Models.

2. Click the Actions menu (...) in the work area then click Data Security.

   

3. In the Groups/ Users section, select users or groups that should have access to this semantic model.

4. Click to select one or more existing rules.

   

5. You can also set up rules. Click the plus sign in the Rules column to add a rule.

6. Click Swap to swap groups and users, and rule lists.
   This option allows groups to be mapped with rules or rules to be mapped by groups.

7. Click Save.

Adding semantic model security rule

To add a rule, perform the following steps.

1. From the Toolbox, click Semantic Models.

2. Click the Action menu (...) in the work area, then click Data Security.

3.  Click users or groups that this rule will apply to.

4. Click the plus sign in the Rules column.

5. Add a rule name and description.

6. Click Row Level or Column Level.

   

7. For Rows, choose the fields, criteria, and enter the values you want to only be accessible to the user or group.

   

8. For Columns, select a dimension, level, hierarchy, attribute, or measure.
   The available choices vary depending upon the data you are using. The fields selected in this rule will not be accessible to the user or group.

9. Click the plus sign to add additional criteria.

10. Click Add.

    

To set up quick rules, perform the following steps. 

1. From the Toolbox, click Semantic Models.

2. Select the semantic model name from the list and click the Processtab if needed.

3. Click the Actions menu (...) in the work area, then click Data Security.

4. Click users or groups to which you want to apply the rule.

5. Click one of the options in the Rules list:

   • Allow all columns

   • Allow all rows

Setting up row-level security

To set up row-level security (RLS), perform the following steps.

1. From the Toolbox, click Semantic Models.

2. Select the semantic model name from the list and click the Process tab if needed.

3. From Properties, scroll down to Data Security and choose one of the following as an endpoint source:

   • Kyvos Internal

   • CustomRLS: Displayed only if the corresponding JAR files are uploaded through Custom Data Security Configurations on the Kyvos Manager.

4. Select an endpoint.

5. Click the Define Rule and Mapping link and select Groups or Users and select the groups or users you want to use or use Search to find them.

6. For Rules, click Allow All Columns, Allow All Rows, or click the Plus sign next to Rules to add a custom rule. 

   

7. On the Add Rule dialog, provide Rule Name and Description. 

   

8. From the Row Level area, click the field link and select the field on which you want to apply the RLS.

9. Select the condition (And / Or) using the and link.

   

10. Click the value link, and the dialog box is displayed where you can search or select the values on which you can apply the RLS. The available choices vary depending on the data you are using.  

    

11. Click Add. The RLS is applied to the selected values. you can also apply RLS on the Key value when the Hierarchy/attribute contains description (display field).

12. Click Row Level, and then select the click the field link, and then select the field on which you want to apply the RLS security on key field.

    

13. The RLS on Key field is applied to the values.

    

Setting up Column Level Security

To set up column-level security (CLS), perform the following steps. 

1. From the Toolbox, click Semantic Models.

2. Select the semantic model name from the list and click the Process tab if needed.

3. From Properties, scroll down to Data Security and choose one of the following as an endpoint source:

   • Kyvos Internal

   • CustomRLS: Displayed only if the corresponding JAR files are uploaded through Custom Data Security Configurations on the Kyvos Manager.

4. Select an endpoint.

5. Click the Define Rule and Mapping link and select Groups or Users and select the groups or users you want to use or use Search to find them.

6. For Rules, click Allow All Columns, Allow All Rows, or click the Plus sign next to Rules to add a custom rule. 

7. On the Add Rule dialog, provide Rule Name and Description. 

   

8. From the Column Level area, select any of the following from Restrict and select the field on which you want to apply the restriction.

   1. Data: Type of column level security in which only data of the column will be restricted. Any queries involving the restricted columns while browsing the semantic models are failed.

   2. Data and Metadata: Type of column-level security in which both data and metadata (visibility) of the column will be restricted. If this option is selected, the restricted columns will not be visible while browsing the semantic model on any of the BI tools.

Column masking for Column Level Security 

Masking can be applied to a single-level hierarchy, multilevel hierarchy, parent-child hierarchy, attributes, base measures, calculated measures, and measures used in calculations. For column-level security, both unconditional and conditional masking can be applied. By implementing masking at the column level, you can effectively manage data accessibility and privacy, ensuring that users only access information necessary for their roles while protecting sensitive data from exposure.

• Unconditional column masking: Applies masking to specific columns. It is supported only for Spark-based deployments.

• Conditional column masking (Beta): Applies masking only part of the data while masking based on specific conditions It is supported for both Spark and No-Spark-based deployments.

Unconditional column masking

Unconditional column masking is used in Spark-based deployments where the entire column is masked uniformly. In this approach, any user who accesses the masked column will see only obfuscated or masked values rather than the actual data, regardless of their access permissions.

To apply unconditional column masking for Column Level Security (CLS), perform the following steps. 

1. From the Toolbox, click Semantic Models.

2. Select the semantic model name from the list and click the Process tab if needed.

3. Click the Action menu (...) in the work area, then click Data Security.
   If the option is not displayed, you must save the semantic model and try again.

4. Click users or groups that this rule will apply to.

5. Click the plus sign in the Rules column.

6. Add a rule name and description.

7. From the Column Level area, click the Mask Data link, and then select the field on which you want to apply the column masking. By default, the Mask data is applied. This indicates unconditional data mask.

   

8. Click the value link, and the Mask with dialog box is displayed. You must enter the required value for unconditional column masking. The available choices vary depending on the data you are using.  

   

   1. For any string data type, choose one of the following: 

      • Fixed: Use this option to specify a fixed value for column masking. Enter a value that you want to apply for column masking. The entered value is displayed in the Preview area. 
        NOTE: You can specify any character or special characters, such as #, *, @. If you keep the field blank, then while semantic model browsing, the field value is displayed as blank.  

      • Regex: Use this option to specify a Regex expression for column masking.

        

        1. Enter a Regex expression that you want to specify for the field value, and then provide a value that you want to use for column masking.

        2. You can also select a Regex expression from the Choose from common expressions list. 

        3. To verify whether the Regex expression is successfully masked with the value, enter a relevant value in the Test Value field. The result is displayed in the Preview field. If the expression is not masked successfully, you can modify the expression, as needed.  
           NOTE: In an expression, the Delimiter (/) and the flags (g,m,i,u,s,d) are not supported.

9. Click the plus sign to add additional fields, if required.  

10. Click Add. 

Conditional masking (Beta)

Conditional column masking allows for more granular control by masking data in a column based on certain conditions.

To apply conditional column masking for Column Level Security (CLS), perform the following steps. 

1. From the Toolbox, click Semantic Models.

2. Select the semantic model name from the list and click the Process tab if needed.

3. Click the Action menu (...) in the work area, then click Data Security.
   If the option is not displayed, you must save the semantic model and try again.

4. Click users or groups that this rule will apply to.

5. Click the plus sign in the Rules column.

6. Add a rule name and description.

7. From the Column Level area, click Mask Data and select Conditionally mask data, and then select the field on which you want to apply the column masking. 

   

8. Click the Conditional Mask Data link and click the field link. The field list is displayed. Select the field that you want to conditionally mask.

9. Click the value link, and the Conditional Mask with dialog box is displayed. You must enter the required value for conditional column masking. The available choices vary depending on the data you are using.  

   1. For any string data type, choose one of the following: 

      • Fixed: Use this option to specify a fixed value for column masking. 
        For any string data type, choose one of the following: 

        

        • Enter a value that you want to apply for column masking. The entered value is displayed in the Preview area. 
          NOTE: You can specify any character or special characters, such as #, *, @. If you keep the field blank, then while semantic model browsing, the field value is displayed as blank.  

      • Regex: Use this option to specify a Regex expression for column masking.

        

        1. Enter a Regex expression that you want to specify for the field value, and then provide a value that you want to use for column masking.

        2. You can also select a Regex expression from the Choose from common expressions list. 

        3. To verify whether the Regex expression is successfully masked with the value, enter a relevant value in the Test Value field. The result is displayed in the Preview field. If the expression is not masked successfully, you can modify the expression, as needed.  
           NOTE: In an expression, the Delimiter (/) and the flags (g,m,i,u,s,d) are not supported.

10. Click the field link to select the field on which you want to apply conditional column masking.

    

11. Click the plus sign to add additional fields, if required.  

12. Click Add. 

Examples of rule criteria

You can specify criteria for values in a field such as:

• Is in the list

• Is not in the list

• Starts with 

• Contains

• Ends with

Row Level Security using LDAP

You can set up a Parameterized Row Level Security (RLS) filter to control access to rows in a database table by using custom attributes on an LDAP server.

To use this feature, users and their details must be set up on an LDAP server. Set up custom attributes on the LDAP server and create a group in Kyvos of these users. Then, define a parameterized RLS filter on the semantic model for this group. The filter contains a parameter that is resolved at the time of the query.

To define a parameterized RLS filter, perform the following steps: 

1. From the Toolbox, click Semantic Models.

2. Click the Actions menu (...) in the work area and then click Data Security.

3. Click users or groups that this rule will apply.

4. Click the plus sign in the Rules column.

5. Add a rule name and description.

6. Click Row Level.

7. Specify the field name and for criteria choose the parameter. Then select an LDAP custom attribute.

   

8. Click Add.