- Platform Release 6.5
- Privacera Platform Installation
- Privacera Platform User Guide
- Privacera Discovery User Guide
- Privacera Encryption Guide
- Privacera Access Management User Guide
- AWS User Guide
- Overview of Privacera on AWS
- Configure policies for AWS services
- Using Athena with data access server
- Using DynamoDB with data access server
- Databricks access manager policy
- Accessing Kinesis with data access server
- Accessing Firehose with Data Access Server
- EMR user guide
- AWS S3 bucket encryption
- Getting started with Minio
- Plugins
- How to Get Support
- Coordinated Vulnerability Disclosure (CVD) Program of Privacera
- Shared Security Model
- Privacera Platform documentation changelog
Schemes
Encryption schemes
Encryption schemes are schemes that encrypt and decrypt your data.
Important
When using encryption schemes, make sure to:
Keep a record of which schemes you use to encrypt or transform which data. You need to use the same scheme to decrypt that data.
Protect your active schemes. Consider exporting them to a secure location.
Never delete your active schemes.
Otherwise, you will be unable to decrypt your data.
Privacera-supplied encryption schemes
After encryption has been enabled, the default Privacera-supplied system encryption schemes are also enabled.
The following is a list of the Privacera-supplied system encryption schemes. The name of a scheme in general describes the type of data the scheme is designed to encrypt.
SYSTEM_US_PHONE_FORMATTED
SYSTEM_ACCOUNT
SYSTEM_PERSON_NAME
SYSTEM_SSN
SYSTEM_EMAIL
SYSTEM_ADDRESS
SYSTEM_CREDITCARD
View encryption schemes
To view your encryption schemes, select Encryption & Masking > Schemes from the Privacera Portal navigation menu.
Formats, algorithms, and scopes
In Privacera Encryption, a scheme is composed of formats, algorithms, and scopes. The formats, algorithms, and scopes associated with each scheme are described in Encryption formats, algorithms, and scopes.
The following sections explain formats, algorithms, and scopes.
Formats
A format is the data type and structure of the input data to be encrypted.
For example, the format of your input data could be:
Numeric
Date
Credit card
Social security number
Algorithms
Algorithms are the mathematics used to encrypt your data.
There are two types of algorithms:
Two-way encryption and decryption
One-way hashes
About LITERAL
One type of one-way transformation is the LITERAL
replacement of data. This option replaces the specified data with the name of the tag associated with the data.
For example, if a database field is tagged as PERSON_NAME
, when an encryption transform is applied as LITERAL
, the field's value is replaced with PERSON_NAME
.
Caution
If you use LITERAL
, the original data cannot be recovered.
Scopes
Scopes define the extent of your data encryption, such as the first four digits, an IP domain, or all data.
The ALL scope is recommended as the most comprehensive treatment of the extent of the data. However, you can choose from other available scopes.
Create custom encryption schemes
In addition to Privacera's default encryption schemes, you can also create your own custom encryption schemes.
Prerequisites:
Before you create a custom encryption scheme, prepare the following details:
A useful name for the encryption scheme
A description of the encryption scheme
The names of the tags that you want to encrypt
The data format, datatype, algorithm, and scope that you want to apply. See Encryption formats, algorithms, and scopes for more information.
To create custom encryption schemes in the Privacera Portal, follow these steps:
From the navigation menu, select Encryption & Masking > Schemes.
Click Add to add a new scheme.
The Add Encryption Scheme dialog displays.
Enter the following details into the respective fields:
Name: the name of the scheme, such as US_PHONE_3rdParty
Description: a description of the scheme
Encryption API: PRIVACERA (default) or BOUNCY_CASTLE
Format type: the encryption format type, such as FPE_ALPHA_NUMERIC, alphanumeric
Scope: all
Value: the value of the scheme
Algorithm: the encryption algorithm: FPE, Hash, Token, Mask, Standard 256, SHA_256, SHA_512
Click Save.
The encryption scheme is created.
Presentation schemes
For background information, see Overview of Privacera Encryption
Presentation schemes control how decrypted data is presented to authorized users. After data is decrypted, a presentation scheme displays the data in a suitable form. If no presentation scheme is specified, the decrypted data is shown in its original form.
If a user is not permitted to view the data, an error message is displayed. For information about granting user access to schemes, see Scheme Policies.
View presentation schemes
You can import, export, define, and modify presentation schemes using the Privacera Portal.
To view your presentation schemes, follow these steps:
From the navigation menu, select Encryption & Masking > Schemes.
Click the Presentation Scheme tab.
.
Privacera-supplied presentation schemes
The following is a list of the Privacera-supplied system presentation schemes. The name of the schemes describe the type of data the scheme is designed to encrypt.
The formats, algorithms, and scopes associated with each scheme are described in Encryption formats, algorithms, and scopes.
SYSTEM_PRESENTATION_PERSON_NAME
SYSTEM_PRESENTATION_SSN
SYSTEM_PRESENTATION_EMAIL
SYSTEM_PRESENTATION_ADDRESS
SYSTEM_PRESENTATION_CREDITCARD
SYSTEM_PRESENTATION_US_PHONE_FORMATTED
SYSTEM_PRESENTATION_ACCOUNT
Create custom presentation schemes
In addition to the Privacera-supplied presentation schemes, you can also create custom presentation schemes using the Privacera Portal.
Before creating a presentation scheme, plan what you want it to do. See Encryption formats, algorithms, and scopes for more information.
To create a custom presentation scheme, follow these steps:
From the navigation menu, select Encryption & Masking > Schemes.
Click the Presentation Scheme tab.
Click Add to create a new presentation scheme.
The Add Presentation Scheme dialog displays.
Enter the following information into the respective fields:
Name: the name of the scheme
Description: a useful description of the scheme
Format Type: the format that you want to use.
Scope: the extent of the data transform. The available scopes depend on which format you have chosen.
Value: an optional field for certain types of scopes.
Algorithm: the required algorithm, which depends on the format you have chosen.
Click Save.
The presentation scheme is created.
Masking schemes
Masking schemes are one-way transformations of data that do not allow for decryption. Once a masking scheme is applied, the original data is completely replaced and cannot be unmasked.
Masking techniques
There are two different techniques that a masking scheme can use to mask your data:
Nullify: the original string is completely removed
Redaction: the original string is overwritten with a masking character. You can specify a masking character, or use the default x.
You can redact a string with a masking character that is repeated five times, or you can retain the format and length of the original string. This preserves all of the special characters in the original string and replaces the alphanumeric characters with the masking character.
For example:
Original string:
somebody@BigCo.com
Result without maintaining format and length:
xxxxx
Result with maintaining format and length:
xxxxxxxx@xxxxx.xxx
Masking with the Encryption REST API
Masking schemes use the /protect
REST API endpoint. Input to /protect
must be in JSON format.
Because masking is one-way, do not use masking schemes with the /unprotect
endpoint. Using a masking scheme with /unprotect
returns an error.
You can combine masking and encryption in a single API request, so that you encrypt some fields and mask other fields at the same time.
Create custom masking schemes
You can create custom masking schemes to use with the encryption REST API.
Prerequisites:
Choose a name for the masking scheme that is easy to remember.
Think of a helpful description for the masking scheme.
Decide which format you want to use for the masking scheme.
Decide if the masking scheme should use the nullify or redaction masking technique.
If the scheme is to redact:
Decide on a suitable masking character to replace the original characters.
Decide if you want to retain the original string's format and length.
To create a custom masking scheme, follow these steps:
From the navigation menu, select Encryption & Masking > Schemes.
Click the Masking Scheme tab.
Click Add.
The Add Masking Scheme dialog displays.
In the Name field, enter a name for the masking scheme.
In the Description field, enter a description of the masking scheme (optional).
From the Format Type dropdown, select a format.
In the Choose Masking Technique section, select either Nullify or Redaction.
If you chose Redaction, fill out the following details in the Redaction Settings section:
In the Masking Character field, enter a masking character or use the default x.
If you want to maintain the original formatting and length of the masked data, select Maintain original formatting and length.
Click Save.
The masking scheme is created.
Privacera-supplied encryption schemes for the Privacera API
The following combinations can be used with the Privacera API.
The request and response examples show the datalist
JSON array.
Format: Alphanumeric
Algorithm: Alphanumeric, Scope: All
Example
Request:
"datalist": [ [ "TUCSON AZ 85705,USA", "testdata115", "105 Sikes Hall, Clemson, SC 29634, USA", "177A Bleecker Street", null ] ]
Response:
"datalist": [ [ "hGL8f5ycfDDrxguRRZhDTPINOfHZmlxik5bW2xz9Mbg=", "7GEWk9XuIigzkTczc9Ntzg==", "9e6obWu6mh9vK2xkEcFvOeXSYwve2Ws9jQ1AEBVxc3zj5lFGNcBPxxLpgyyZin0u", "MDtays2tyyOv5egH+OXbk9UqL2RDTZRhqNYxaEULsjs=", null ] ]
Format: ASCII
7-bit ASCII character set, excluding control characters.
Algorithm: FPE, Scope: All
Example
Request:
"datalist": [ [ "testvalue123", "This is a sample text", "This is sample 123 alphanumeric text 123.", "123456789098765", "123!@#R)(*&^4567JHG", null ] ]
Response:
"datalist": [ [ "[pa&xA_)1qs=", "?xUs.H';NIy>BJ0@y9{qq", "o/|R7&k)d>dmp^Am}.%-F]_Ym7c]@B~Xm)eOB+=w*", "/apLBEweK)?| *t", "{lD+U%cMLKM]k+`lt}.", null ] ],
Format: CC
Credit card. Numeric from 14 to 19 digits. Hyphens and spaces allowed.
Algorithm: FPE, Scope: All
Algorithm: FPE, Scope: First 4 digits
Algorithm: FPE, Scope: Last 4 digits
Example of FPE, All
Request:
"datalist": [ [ "236864479139819", "160201209940524", "41228020889831", "7529274609013685", null, "6536921047107462", "4766530513049409" ] ]
Response:
"datalist": [ [ "524312768689370", "535332579591178", "79759512315352", "1072002057261056", null, "3907516129227718", "6712017221140690" ] ]
Formats: DATE and Date_DD_MM
Algorithm: FPE, Scope: All
For details on allowable formats, see Date input formats and ranges.
Example
Request:
"datalist": [ [ "16/12/3352", "09/02/3508", "16-12-3352", "21-03-3421", "19/12/3224 21:01:24:202", null ] ]
Response:
"datalist": [ [ "16/12/3352", "09/02/3508", "16-12-3352", "21-03-3421", "12/07/3871 20:44:36:480", null ] ]
Format: Driver License
Algorithm: FPE, Scope: All
Example
Request:
"datalist": [ [ "A123456789012", "12345678X", null, "123456789", "m1234567", "12345678123456789", "123456789", null, "113654424", "999000680", "B13654424", "G544-061-73-925-0", "AA123456Z", null ] ]
Response:
"datalist": [ [ "09HnovI2QR9jw", "pIJijAhlj", null, "pnZaDghd0", "ICSdAHiD", "92SRB3QE5S6TunSRA", "pnZaDghd0", null, "J1XT5UuBq", "SHdt78Two", "PMGoghnkh", "rusP-R4U-EG-nVV-r", "YslNiR2As", null ] ]
Format: Email
Must include @ sign.
Algorithm: FPE, Scope: All
Algorithm: FPE, Scope: masked username
Algorithm: FPE, Scope: masked domain
Example of FPE, All
Request:
"datalist": [ [ "test@domain.com", "lastname@domain.com", "test.email.with+symbol@domain.com", "id-with-dash@domain.com", "example-abc@abc-domain.com", "admin@mailserver1", "#!$%&'*+-/=?^_{}|~@domain.org", "example@localhost", "example@s.solutions", "test@com", "test@localserver", null ] ]
Response:
"datalist": [ [ "T~oi@GaRxEU.ZFq", "R82`Rs7E@GaRxEU.ZFq", "s%x{.&FEi!.qPEjpST2gK#@GaRxEU.ZFq", "t+g_4s+Vn_?7@GaRxEU.ZFq", "bPVRw9_x_J`@DmF-AyWNGj.gxA", "BnAIk@lhGbMXvogj1", "GZhp3&iMy^X|0Jij%s@WCXdsf.BYi", "vUnO=Fb@IWyJfKkFW", "vUnO=Fb@X.wpkHRwTbu", "T~oi@nZF", "T~oi@EfwTCYFFfgu", null ] ]
Format: FPE_ALPHA_NUMERIC
Algorithm: Alphanumeric, Scope: All
Algorithm: FPE, Scope: All
Algorithm: Standard, Scope: All
Algorithm: Standard 256-bit, Scope: All
Example of FPE, All
Request:
"datalist": [ [ "Acc965121354", "testdata123samplevalue", "sample value 2nd instance", "221, baker street", null ] ]
Response:
"datalist": [ [ "4eOPie2yXN1f", "SsGfMkh12uH1ndQnsDaa1V", "j8pHr5 CdFLR LUc 0zw1ZuhK", "om5, KUR9R bBjjd2", null ] ]
Format: HASHING
Same as Format: ASCII. These are one-way hashes.
Algorithm: SHA-256, Scope: All
Algorithm: SHA-512, Scope: All
Example of SHA-256, All
Request:
"datalist": [ [ "8743b52063cd84097a65d1633f5c74f5", "hashvalue115", "Test123Text", null ] ]
Response:
"datalist": [ [ "74ee1fae245edd6f27bf36efc3604942479fceefbadab5dc5c0b538c196eb0f1", "492c94273948d5140dcfef60b15a99b9c2cd5e730a5d40d2991548255825d473", "c9ecc7cecff05b064da8a89befa266e84da87409a7d8624ec15252affb70d732", null ] ]
Format: Host/Domain
Internet standard domain name, or portion thereof, with periods.
Algorithm: FPE, Scope: All
Example
Request:
"datalist": [ [ "cornell.edu", "www.google.com", "en.wikipedia.org", ".com", "www.privacera.com", "www.privacera.com", ".edu", "10.211.95.191", null ] ]
Response:
"datalist": [ [ "uf8T8tY.u54", "1Wr.f6NCmk.M9m", "fj.dbwLIn9DR.BfV", ".qCB", "XGY.GPRNgo1Wo.x7t", "XGY.GPRNgo1Wo.x7t", ".B56", "y4.VTB.Uh.V2H", null ] ]
Format: IP
Internet Protocol v4 or v6 standard address
Algorithm: FPE, Scope: All
Example
Request:
"datalist": [ [ null, "10.211.95.191", "ABCD:EF01:2345:6789:ABCD:EF01:2345:6789", "2001:DB8:0:0:8:800:200C:417A", "123.123.12.1", null, "0.0.0.0", "10.31.31.54", null ] ]
Response:
"datalist": [ [ null, "184.54.42.61", "ABCD:EF6a:e277:216a:ABCD:EFf9:5b8c:3a24", "9623:DB5:5:6:4:b3a:34cC:9ecA", "33.71.6.126", null, "223.195.44.37", "138.217.142.157", null ] ]
Format: LITERAL
Free-form: no specific format required.
Algorithm: FPE, Scope: All
Algorithm: Standard 256-bit, Scope: All
Example of FPE, All
Request:
"datalist": [ [ "TRUE", "FALSE", "123876.0988", "123876", "Literal", "Test123Text", null ] ]
Response:
"datalist": [ [ "", "", "", "", "", "", null ] ]
Format: Numeric
Digits from 0 through 9.
Algorithm: FPE, Scope: All
Example
Request:
"datalist": [ [ null, "a9876543211098", "9876543211098", "a9876543211098", "acn9876543211098", null, "1234567890897654321", "1ab4 df56 7qwer2343", "1234543 5434 23454", "priv9876543211098", "acn9876543211098", null ] ]
Response:
"datalist": [ [ null, "a8440422448831", "5980689261168", "a8440422448831", "acn1390446821808", null, "3963413609305412090", "4ab6 df25 4qwer6711", "3073815 5226 34978", "priv1617217642784", "acn1390446821808", null ] ]
Algorithm: FPE, Scope: All
Format: SSN
US Social Security Number. Nine digits. Hyphens and spaces allowed.
Algorithm: FPE, Scope: Last 4 digits
Algorithm: FPE, Scope: All
Example of FPE, All
Request:
"datalist": [ [ "778-62-8144", "030 72 7381", "709066491", "163254042", null, "805 14 1893", "401318448" ] ]
Response:
"datalist": [ [ "932-88-1456", "828 92 5898", "954061516", "998726200", null, "980 21 5905", "191897078" ] ]
Format: Text
Algorithm: FPE, Scope: All
Example of FPE, All
Request:
"datalist": [ [ "778-62-8144", "030 72 7381", "709066491", "163254042", null, "805 14 1893", "401318448" ] ]
Response:
"datalist": [ [ "932-88-1456", "828 92 5898", "954061516", "998726200", null, "980 21 5905", "191897078" ] ]
Privacera-supplied encryption schemes for the Bouncy Castle API
The following table displays the Privacera-supplied encryption schemes that can be used with the Bouncy Castle API.
The only allowable scope for schemes that use the Bouncy Castle API is All.
Format | Algorithm | Scope |
---|---|---|
Alphanumeric |
| All |
ASCII |
| All |
CC |
| All |
Date |
| All |
DateTime |
| All |
| All | |
Host/Domain |
| All |
IP |
| All |
Numeric |
| All |
SSN |
| All |
Text |
| All |
Deprecated encryption formats, algorithms, and scopes
Deprecated encryption formats, algorithms, and scopes
The following schemes are deprecated as of Privacera Platform release 6.3 and will not be supported in a future release.
Deprecated: IP
Format Type: IP, Scope: ALL, Algorithm: AlphaNumeric
Deprecated: Host/Domain
Format Type: Host/Domain, Scope: ALL, Algorithm: AlphaNumeric
Format Type: Host/Domain, Scope: ALL, Algorithm: Standard
Format Type: Host/Domain, Scope: ALL, Algorithm: Standard 256 bit
Deprecated: Text
Format Type: Text, Scope: ALL, Algorithm: AlphaNumeric
Format Type: Text, Scope: ALL, Algorithm: Standard
Format Type: Text, Scope: ALL, Algorithm: Standard 256 bit
Deprecated: Driver License
Format Type: Driver License, Scope: ALL, Algorithm: AlphaNumeric
Format Type: Driver License, Scope: ALL, Algorithm: Hash
Format Type: Driver License, Scope: ALL, Algorithm: Mask
Format Type: Driver License, Scope: ALL, Algorithm: Standard
Format Type: Driver License, Scope: ALL, Algorithm: Standard 256 bit
Format Type: Driver License, Scope: ALL, Algorithm: SHA_256 Hash
Deprecated: LITERAL
Format Type: LITERAL, Scope: ALL, Algorithm: AlphaNumeric
Format Type: LITERAL, Scope: ALL, Algorithm: Standard
Deprecated: Alphanumeric
Format Type: Alphanumeric, Scope: ALL, Algorithm: FPE
Format Type: Alphanumeric, Scope: ALL, Algorithm: Standard
Format Type: Alphanumeric, Scope: ALL, Algorithm: Standard 256 bit
API date input formats
Dates supplied to the Privacera or Bouncy Castle API must be in one of the formats listed in this topic.
Legend:
yyyy
oruuuu
is 4-digit year.uuuu
is a year format that does not need the specification of the era CE (Common Era) or BCE (Before Common Era). A positive number indicates CE, while a negative number indicates BCE.MM
is the 2-digit, zero-padded month ofyyyy
oruuuu
.dd
is the 2-digit, zero-padded day ofMM
.HH
is the 2-digit, zero-padded 24-hour clock hour ofdd
.mm
is the 2-digit, zero-padded minute ofHH
.ss
is the 2-digit, zero-padded second ofmm
.SSS
is the 3-digit, zero-padded microsecond ofss
.The literal
T
is the time indicator and the literalZ
is the indicator for time zone offset, as described in W3C's Time & date: Essential concepts.Note
The time zone offset is not encrypted.
The string literals
AM
andPM
are before noon and afternoon in the analog 12-hour clock.
Supported day-first date input formats
Day-first formats begin with the numeric, zero-padded day:
dd/mm/uuuu
dd/mm/uuuuHH:mm:ss:SSS
Supported month-first date input formats
Month-first formats begin with the numeric, zero-padded month:
mm/dd/uuuu HH:mm:ss,SSS
mm/dd/uuuu HH:mm:ss,SSSZ
mm/dd/uuuu HH:mm:ss.SSS
mm/dd/uuuu HH:mm:ss.SSSZ
mm/dd/uuuu HH:mm:ss
mm/dd/uuuu HH:mm:ss AM
mm/dd/uuuu HH:mm:ss PM
mm/dd/uuuu HH:mm:ssZ
mm/dd/uuuu HH:mm
mm/dd/uuuu HH:mmZ
mm/dd/uuuu
mm/dd/uuuuTHH:mm:ss,SSS
mm/dd/uuuuTHH:mm:ss,SSSZ
mm/dd/uuuuTHH:mm:ss.SSS
mm/dd/uuuuTHH:mm:ss.SSSZ
mm/dd/uuuuTHH:mm:ss
mm/dd/uuuuTHH:mm:ssZ
mm/dd/uuuuTHH:mm
mm/dd/uuuuTHH:mmZ
Supported year-first date input formats
Year-first formats begin with the year:
uuuu-mm-dd
uuuu-mm-dd AM
uuuu-mm-dd PM
uuuu-mm-dd HH:mm AM
uuuu-mm-dd HH:mm PM
uuuu-mm-dd HH:mm:ss,SSS
uuuu-mm-dd HH:mm:ss.SSS
uuuu-mm-dd HH:mm:ss,SSS AM
uuuu-mm-dd HH:mm:ss,SSS PM
uuuu-mm-dd HH:mm:ss.SSS AM
uuuu-mm-dd HH:mm:ss.SSS PM
uuuu-mm-dd HH:mm:ss
uuuu-mm-dd HH:mm
uuuu-mm-ddTHH:mm:ss,SSS
uuuu-mm-ddTHH:mm:ss,SSSZ
uuuu-mm-ddTHH:mm:ss.SSS
uuuu-mm-ddTHH:mm:ss.SSSZ
uuuu-mm-ddTHH:mm:ss
uuuu-mm-ddTHH:mm:ssZ
uuuu-mm-ddTHH:mm
uuuu-mm-ddTHH:mmZ
uuuu/mm/dd HH:mm:ss,SSS
uuuu/mm/dd HH:mm:ss.SSS
uuuu/mm/dd HH:mm:ss
uuuu/mm/dd HH:mm
uuuu/mm/dd
uuuu/mm/ddTHH:mm:ss,SSS
uuuu/mm/ddTHH:mm:ss,SSSZ
uuuu/mm/ddTHH:mm:ss.SSS
uuuu/mm/ddTHH:mm:ss.SSSZ
uuuu/mm/ddTHH:mm:ss
uuuu/mm/ddTHH:mm:ssZ
uuuu/mm/ddTHH:mm
uuuu/mm/ddTHH:mmZ
Examples of supported date input formats
1900-01-01
1912/01/02
1912-01-02 03:10:50
1912/01/02 03:10:50
1912-01-02 03:10:50.000
1912/01/02 03:10:50.000
1950/02/03T05:20:30.213+1000
2099-12-31T05:20:30.213+1000
Supported date ranges
The range of dates supported by DateTime is from 1900/01/01 to 2099/12/31, inclusive.
Note
This range is irrespective of delimiters in the input. It specifies only the lower and upper limits of the values of year, month, and day, and does not apply to any specific hour, day, or minute.