이 주제에서는 Sensitive Data Protection에서 사용 가능한 익명화 기술, 즉 변환을 다룹니다.
익명화 기술의 유형
익명화할 데이터 종류와 데이터를 익명화하려는 용도에 따라 선택하는 익명화 변환이 달라집니다. Sensitive Data Protection에서 지원하는 익명화 기술은 다음과 같은 일반적인 카테고리로 분류됩니다.
- 수정: 감지된 민감한 값의 전체 또는 일부를 삭제합니다.
- 대체: 감지된 민감한 값을 지정된 서로게이트 값으로 바꿉니다.
- 마스킹: 민감한 값의 문자 수를 해시(#) 또는 별표(*)와 같은 지정된 서로게이트 문자로 바꿉니다.
- 암호화 기반 토큰화: 암호화 키를 사용하여 원래의 민감한 정보 값을 암호화합니다. Sensitive Data Protection은 되돌리거나 '재식별화'될 수 있는 변환을 포함하여 여러 유형의 토큰화를 지원합니다.
- 버케팅: 민감한 값을 값의 범위로 바꿔 '일반화'합니다. 예를 들어 특정 연령을 연령대로 바꾸거나 온도를 'hot', 'medium', 'cold'에 해당하는 범위로 바꿉니다.
- 날짜 이동: 민감한 날짜 값을 무작위 시간만큼 이동합니다.
- 시간 추출: 날짜 및 시간 값의 지정된 부분을 추출하거나 보존합니다.
이 주제의 나머지 부분에서는 서로 다른 유형의 익명화 변환을 설명하고 사용 사례를 제공합니다.
변환 메서드
다음 표에는 민감한 정보 익명화를 위해 Sensitive Data Protection에서 제공하는 변환이 나와 있습니다.
| 변환 | 객체 | 설명 | 가역1 | 참조 무결성2 | 입력 유형 |
|---|---|---|---|---|---|
| 수정 | RedactConfig |
값을 삭제하여 수정합니다. | 모두 | ||
| 대체 | ReplaceValueConfig |
각 입력 값을 주어진 값으로 대체합니다. | 모두 | ||
| 사전으로 바꾸기 | ReplaceDictionaryConfig
|
입력 값을 단어 목록에서 무작위로 선택한 값으로 바꿉니다. | 모두 | ||
| infoType으로 대체 | ReplaceWithInfoTypeConfig |
해당 infoType의 이름으로 입력 값을 대체합니다. | 모두 | ||
| 문자로 마스킹 | CharacterMaskConfig |
지정된 수의 문자를 지정된 고정 문자로 대체함으로써 문자열 전체 또는 일부를 마스킹합니다. | 모두 | ||
| 입력 값을 암호화 해시로 대체하여 가명처리 | CryptoHashConfig |
주어진 데이터 암호화 키를 사용하여 생성된 32바이트 16진수 문자열로 입력 값을 대체합니다. 자세한 내용은 가명처리 개념 문서를 참조하세요. | ✔ | 문자열 또는 정수 | |
| 암호화 형식 보존 토큰으로 대체하여 가명처리 | CryptoReplaceFfxFpeConfig |
FFX 작업 모드로 형식 보존 암호화(FPE)를 사용하여 같은 길이의 토큰 또는 서로게이트 값으로 입력 값을 대체합니다. 따라서 길이에 대한 형식 유효성 검사가 있는 시스템에서 출력을 사용할 수 있으며, 문자열 길이를 그대로 유지해야 하는 이전 시스템에 유용합니다.
중요: 입력 문자열 길이가 다양하거나 32바이트보다 긴 경우 CryptoDeterministicConfig를 사용하세요.
보안을 유지하기 위해 미국 국립 표준 기술 연구소(National Institute of Standard and Technology)의 권고에 따라 다음 한도를 적용합니다.
|
✔ | ✔ | 제한된 수의 문자를 포함하고 길이가 일정한 문자열 또는 정수. 알파벳은 최소 2자 이상이어야 하며 95자를 넘지 않아야 합니다. |
| 암호화 토큰으로 대체하여 가명처리 | CryptoDeterministicConfig |
합성 초기화 벡터 모드의 AES(AES-SIV)를 사용하여 같은 길이의 토큰 또는 서로게이트 값으로 입력 값을 대체합니다. 이 변환 메서드는 형식 보존 토큰화와는 달리 지원되는 문자열의 문자 집합에 제한이 없고, 입력 값이 동일한 각 인스턴스에 대해 동일한 토큰을 생성하며, 서로게이트를 사용하여 원래의 암호화 키를 바탕으로 재식별화가 가능하게 합니다. | ✔ | ✔ | 모두 |
| 고정된 크기 범위 기반의 버킷 값 | FixedSizeBucketingConfig |
입력 값을 버킷 또는 입력 값이 속한 범위로 대체하여 마스킹합니다. | 모두 | ||
| 커스텀 크기 범위 기반의 버킷 값 | BucketingConfig |
사용자 구성이 가능한 범위 기반의 버킷 입력 값과 대체 값 | 모두 | ||
| 날짜 이동 | DateShiftConfig |
동일한 컨텍스트에 대해 일관적인 옵션으로 무작위 일수만큼 날짜를 이동합니다. | ✔ 시퀀스 및 기간 보존 |
날짜/시간 | |
| 시간 데이터 추출 | TimePartConfig |
Date, Timestamp, TimeOfDay 값의 일부 영역을 추출 또는 보존합니다. |
날짜/시간 |
각주
1
가역 변환을 사용하면
content.reidentify 메서드를 사용하여 민감한 정보를 재식별화할 수 있습니다.
2
참조 무결성은 레코드가 데이터를 익명화하면서 다른 레코드와의 관계를 유지할 수 있게 해줍니다. 예를 들어 암호화 키와 컨텍스트가 동일할 경우 데이터는 변환될 때마다 동일한 난독화된 형식으로 대체되어 레코드 간의 연결이 보존됩니다.
수정
입력 콘텐츠에서 민감한 정보만 간단히 삭제하려는 경우, Sensitive Data Protection에서 수정 변환(DLP API의 RedactConfig)을 지원합니다.
예를 들어 모든 EMAIL_ADDRESS infoType을 간단히 수정하려는 경우 다음 문자열이 Sensitive Data Protection로 전송되었다고 가정해보겠습니다.
My name is Alicia Abernathy, and my email address is aabernathy@example.com.
다음과 같은 문자열이 반환됩니다.
My name is Alicia Abernathy, and my email address is .
여러 언어로 된 다음 JSON 예 및 코드는 API 요청을 작성하는 방법과 DLP API에서 반환하는 항목을 보여줍니다.
C#
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
using System;
using System.Collections.Generic;
using Google.Api.Gax.ResourceNames;
using Google.Cloud.Dlp.V2;
public class DeidentifyDataUsingRedactWithMatchedInputValues
{
public static DeidentifyContentResponse Deidentify(
string projectId,
string text,
IEnumerable<InfoType> infoTypes = null)
{
// Instantiate the client.
var dlp = DlpServiceClient.Create();
// Construct inspect config.
var inspectConfig = new InspectConfig
{
InfoTypes = { infoTypes ?? new InfoType[] { new InfoType { Name = "EMAIL_ADDRESS" } } },
};
// Construct redact config.
var redactConfig = new RedactConfig();
// Construct deidentify config using redact config.
var deidentifyConfig = new DeidentifyConfig
{
InfoTypeTransformations = new InfoTypeTransformations
{
Transformations =
{
new InfoTypeTransformations.Types.InfoTypeTransformation
{
PrimitiveTransformation = new PrimitiveTransformation
{
RedactConfig = redactConfig
}
}
}
}
};
// Construct a request.
var request = new DeidentifyContentRequest
{
ParentAsLocationName = new LocationName(projectId, "global"),
DeidentifyConfig = deidentifyConfig,
InspectConfig = inspectConfig,
Item = new ContentItem { Value = text }
};
// Call the API.
var response = dlp.DeidentifyContent(request);
// Check the deidentified content.
Console.WriteLine($"Deidentified content: {response.Item.Value}");
return response;
}
}
Go
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import (
"context"
"fmt"
"io"
dlp "cloud.google.com/go/dlp/apiv2"
"cloud.google.com/go/dlp/apiv2/dlppb"
)
// deidentifyWithRedact de-identify the data by redacting with matched input values
func deidentifyWithRedact(w io.Writer, projectID, inputStr string, infoTypeNames []string) error {
// projectID := "my-project-id"
// inputStr := "My name is Alicia Abernathy, and my email address is aabernathy@example.com."
// infoTypeNames := []string{"EMAIL_ADDRESS"}
ctx := context.Background()
// Initialize a client once and reuse it to send multiple requests. Clients
// are safe to use across goroutines. When the client is no longer needed,
// call the Close method to cleanup its resources.
client, err := dlp.NewClient(ctx)
if err != nil {
return fmt.Errorf("dlp.NewClient: %w", err)
}
// Closing the client safely cleans up background resources.
defer client.Close()
// Specify the content to be inspected.
contentItem := &dlppb.ContentItem{
DataItem: &dlppb.ContentItem_Value{
Value: inputStr,
},
}
// Specify the type of info the inspection will look for.
// See https://cloud.google.com/dlp/docs/infotypes-reference for complete list of info types
var infoTypes []*dlppb.InfoType
for _, it := range infoTypeNames {
infoTypes = append(infoTypes, &dlppb.InfoType{Name: it})
}
inspectConfig := &dlppb.InspectConfig{
InfoTypes: infoTypes,
}
// Define type of de-identification.
primitiveTransformation := &dlppb.PrimitiveTransformation{
Transformation: &dlppb.PrimitiveTransformation_RedactConfig{
RedactConfig: &dlppb.RedactConfig{},
},
}
// Associate de-identification type with info type.
transformation := &dlppb.InfoTypeTransformations_InfoTypeTransformation{
InfoTypes: infoTypes,
PrimitiveTransformation: primitiveTransformation,
}
// Construct the configuration for the Redact request and list all desired transformations.
redactConfig := &dlppb.DeidentifyConfig{
Transformation: &dlppb.DeidentifyConfig_InfoTypeTransformations{
InfoTypeTransformations: &dlppb.InfoTypeTransformations{
Transformations: []*dlppb.InfoTypeTransformations_InfoTypeTransformation{
transformation,
},
},
},
}
// Create a configured request.
req := &dlppb.DeidentifyContentRequest{
Parent: fmt.Sprintf("projects/%s/locations/global", projectID),
DeidentifyConfig: redactConfig,
InspectConfig: inspectConfig,
Item: contentItem,
}
// Send the request.
resp, err := client.DeidentifyContent(ctx, req)
if err != nil {
return err
}
// Print the result.
fmt.Fprintf(w, "output: %v", resp.GetItem().GetValue())
return nil
}
Java
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import com.google.cloud.dlp.v2.DlpServiceClient;
import com.google.privacy.dlp.v2.ContentItem;
import com.google.privacy.dlp.v2.DeidentifyConfig;
import com.google.privacy.dlp.v2.DeidentifyContentRequest;
import com.google.privacy.dlp.v2.DeidentifyContentResponse;
import com.google.privacy.dlp.v2.InfoType;
import com.google.privacy.dlp.v2.InfoTypeTransformations;
import com.google.privacy.dlp.v2.InfoTypeTransformations.InfoTypeTransformation;
import com.google.privacy.dlp.v2.InspectConfig;
import com.google.privacy.dlp.v2.LocationName;
import com.google.privacy.dlp.v2.PrimitiveTransformation;
import com.google.privacy.dlp.v2.RedactConfig;
public class DeIdentifyWithRedaction {
public static void main(String[] args) throws Exception {
// TODO(developer): Replace these variables before running the sample.
String projectId = "your-project-id";
String textToInspect =
"My name is Alicia Abernathy, and my email address is aabernathy@example.com.";
deIdentifyWithRedaction(projectId, textToInspect);
}
// Inspects the provided text.
public static void deIdentifyWithRedaction(String projectId, String textToRedact) {
// Initialize client that will be used to send requests. This client only needs to be created
// once, and can be reused for multiple requests. After completing all of your requests, call
// the "close" method on the client to safely clean up any remaining background resources.
try (DlpServiceClient dlp = DlpServiceClient.create()) {
// Specify the content to be inspected.
ContentItem item = ContentItem.newBuilder().setValue(textToRedact).build();
// Specify the type of info the inspection will look for.
// See https://cloud.google.com/dlp/docs/infotypes-reference for complete list of info types
InfoType infoType = InfoType.newBuilder().setName("EMAIL_ADDRESS").build();
InspectConfig inspectConfig = InspectConfig.newBuilder().addInfoTypes(infoType).build();
// Define type of deidentification.
PrimitiveTransformation primitiveTransformation =
PrimitiveTransformation.newBuilder()
.setRedactConfig(RedactConfig.getDefaultInstance())
.build();
// Associate deidentification type with info type.
InfoTypeTransformation transformation =
InfoTypeTransformation.newBuilder()
.addInfoTypes(infoType)
.setPrimitiveTransformation(primitiveTransformation)
.build();
// Construct the configuration for the Redact request and list all desired transformations.
DeidentifyConfig redactConfig =
DeidentifyConfig.newBuilder()
.setInfoTypeTransformations(
InfoTypeTransformations.newBuilder().addTransformations(transformation))
.build();
// Construct the Redact request to be sent by the client.
DeidentifyContentRequest request =
DeidentifyContentRequest.newBuilder()
.setParent(LocationName.of(projectId, "global").toString())
.setItem(item)
.setDeidentifyConfig(redactConfig)
.setInspectConfig(inspectConfig)
.build();
// Use the client to send the API request.
DeidentifyContentResponse response = dlp.deidentifyContent(request);
// Parse the response and process results
System.out.println("Text after redaction: " + response.getItem().getValue());
} catch (Exception e) {
System.out.println("Error during inspectString: \n" + e.toString());
}
}
}Node.js
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
// Imports the Google Cloud Data Loss Prevention library
const DLP = require('@google-cloud/dlp');
// Instantiates a client
const dlp = new DLP.DlpServiceClient();
// TODO(developer): Replace these variables before running the sample.
// const projectId = "your-project-id";
// The string to deidentify
// const string =
// 'My name is Alicia Abernathy, and my email address is aabernathy@example.com.';
// The infoTypes of information to match
// See https://cloud.google.com/dlp/docs/concepts-infotypes for more information
// about supported infoTypes.
// const infoTypes = [{name: 'EMAIL_ADDRESS'}];
async function deIdentifyRedaction() {
// Construct deidentify configuration
const deidentifyConfig = {
infoTypeTransformations: {
transformations: [
{
infoTypes: infoTypes,
primitiveTransformation: {
redactConfig: {},
},
},
],
},
};
// Construct inspect configuration
const inspectConfig = {
infoTypes: infoTypes,
};
// Construct Item
const item = {
value: string,
};
// Combine configurations into a request for the service.
const request = {
parent: `projects/${projectId}/locations/global`,
item,
deidentifyConfig,
inspectConfig,
};
// Send the request and receive response from the service
const [response] = await dlp.deidentifyContent(request);
// Print the results
console.log(`Text after redaction: ${response.item.value}`);
}
deIdentifyRedaction();PHP
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
use Google\Cloud\Dlp\V2\Client\DlpServiceClient;
use Google\Cloud\Dlp\V2\ContentItem;
use Google\Cloud\Dlp\V2\DeidentifyConfig;
use Google\Cloud\Dlp\V2\DeidentifyContentRequest;
use Google\Cloud\Dlp\V2\InfoType;
use Google\Cloud\Dlp\V2\InfoTypeTransformations;
use Google\Cloud\Dlp\V2\InfoTypeTransformations\InfoTypeTransformation;
use Google\Cloud\Dlp\V2\InspectConfig;
use Google\Cloud\Dlp\V2\PrimitiveTransformation;
use Google\Cloud\Dlp\V2\RedactConfig;
/**
* De-identify data: Redacting with matched input values
* Uses the Data Loss Prevention API to de-identify sensitive data in a string by redacting matched input values.
*
* @param string $callingProjectId The Google Cloud project id to use as a parent resource.
* @param string $textToInspect The string to deidentify (will be treated as text).
*/
function deidentify_redact(
// TODO(developer): Replace sample parameters before running the code.
string $callingProjectId,
string $textToInspect = 'My name is Alicia Abernathy, and my email address is aabernathy@example.com.'
): void {
// Instantiate a client.
$dlp = new DlpServiceClient();
// Specify the content to be de-identify.
$contentItem = (new ContentItem())
->setValue($textToInspect);
// Specify the type of info the inspection will look for.
$infoType = (new InfoType())
->setName('EMAIL_ADDRESS');
$inspectConfig = (new InspectConfig())
->setInfoTypes([$infoType]);
// Define type of de-identification.
$primitiveTransformation = (new PrimitiveTransformation())
->setRedactConfig(new RedactConfig());
// Associate de-identification type with info type.
$transformation = (new InfoTypeTransformation())
->setInfoTypes([$infoType])
->setPrimitiveTransformation($primitiveTransformation);
// Construct the configuration for the Redact request and list all desired transformations.
$deidentifyConfig = (new DeidentifyConfig())
->setInfoTypeTransformations((new InfoTypeTransformations())
->setTransformations([$transformation]));
$parent = "projects/$callingProjectId/locations/global";
// Run request
$deidentifyContentRequest = (new DeidentifyContentRequest())
->setParent($parent)
->setDeidentifyConfig($deidentifyConfig)
->setInspectConfig($inspectConfig)
->setItem($contentItem);
$response = $dlp->deidentifyContent($deidentifyContentRequest);
// Print results
printf('Text after redaction: %s', $response->getItem()->getValue());
}Python
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
from typing import List
import google.cloud.dlp
def deidentify_with_redact(
project: str,
input_str: str,
info_types: List[str],
) -> None:
"""Uses the Data Loss Prevention API to deidentify sensitive data in a
string by redacting matched input values.
Args:
project: The Google Cloud project id to use as a parent resource.
input_str: The string to deidentify (will be treated as text).
info_types: A list of strings representing info types to look for.
Returns:
None; the response from the API is printed to the terminal.
"""
# Instantiate a client
dlp = google.cloud.dlp_v2.DlpServiceClient()
# Convert the project id into a full resource id.
parent = f"projects/{project}/locations/global"
# Construct inspect configuration dictionary
inspect_config = {"info_types": [{"name": info_type} for info_type in info_types]}
# Construct deidentify configuration dictionary
deidentify_config = {
"info_type_transformations": {
"transformations": [{"primitive_transformation": {"redact_config": {}}}]
}
}
# Construct item
item = {"value": input_str}
# Call the API
response = dlp.deidentify_content(
request={
"parent": parent,
"deidentify_config": deidentify_config,
"inspect_config": inspect_config,
"item": item,
}
)
# Print out the results.
print(response.item.value)
REST
JSON과 함께 DLP API를 사용하는 데 대한 자세한 내용은 JSON 빠른 시작을 참조하세요.
HTTP 메서드 및 URL
POST https://dlp.googleapis.com/v2/projects/PROJECT_ID/content:deidentify
PROJECT_ID를 프로젝트 ID로 바꿉니다.
JSON 입력
{
"item":{
"value":"My name is Alicia Abernathy, and my email address is aabernathy@example.com."
},
"deidentifyConfig":{
"infoTypeTransformations":{
"transformations":[
{
"infoTypes":[
{
"name":"EMAIL_ADDRESS"
}
],
"primitiveTransformation":{
"redactConfig":{
}
}
}
]
}
},
"inspectConfig":{
"infoTypes":[
{
"name":"EMAIL_ADDRESS"
}
]
}
}
JSON 출력
{
"item":{
"value":"My name is Alicia Abernathy, and my email address is ."
},
"overview":{
"transformedBytes":"22",
"transformationSummaries":[
{
"infoType":{
"name":"EMAIL_ADDRESS"
},
"transformation":{
"redactConfig":{
}
},
"results":[
{
"count":"1",
"code":"SUCCESS"
}
],
"transformedBytes":"22"
}
]
}
}
대체
대체 변환은 각 입력 값을 지정된 토큰 값 또는 해당 infoType의 이름으로 바꿉니다.
기본 대체
기본 대체 변환(DLP API의 ReplaceValueConfig)은 감지된 민감한 정보 값을 지정된 값으로 바꿉니다. 예를 들어 Sensitive Data Protection에 '[fake@example.com]'을 사용하여 모든 감지된 EMAIL_ADDRESS infoType을 수정하도록 지시했다고 가정해봅시다. 그러면 다음 문자열이 Sensitive Data Protection로 전송됩니다.
My name is Alicia Abernathy, and my email address is aabernathy@example.com.
다음과 같은 문자열이 반환됩니다.
My name is Alicia Abernathy, and my email address is [fake@example.com].
여러 언어로 된 다음 JSON 예 및 코드는 API 요청을 작성하는 방법과 DLP API에서 반환하는 항목을 보여줍니다.
C#
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
using System;
using System.Collections.Generic;
using Google.Api.Gax.ResourceNames;
using Google.Cloud.Dlp.V2;
public class DeidentifyWithReplacement
{
public static DeidentifyContentResponse Deidentify(
string projectId,
string text,
string replaceText = null,
IEnumerable<InfoType> infoTypes = null)
{
// Instantiate the client.
var dlp = DlpServiceClient.Create();
// Set the info type if null.
var infotypes = infoTypes ?? new InfoType[] { new InfoType { Name = "EMAIL_ADDRESS" } };
// Construct the inspect config.
var inspectConfig = new InspectConfig
{
InfoTypes = { infotypes }
};
// Construct the replace value config.
var replaceConfig = new ReplaceValueConfig
{
NewValue = new Value { StringValue = replaceText ?? "[email-address]" }
};
// Construct the deidentify config using replace value config.
var deidentifyConfig = new DeidentifyConfig
{
InfoTypeTransformations = new InfoTypeTransformations
{
Transformations =
{
new InfoTypeTransformations.Types.InfoTypeTransformation
{
InfoTypes = { infotypes },
PrimitiveTransformation = new PrimitiveTransformation
{
ReplaceConfig = replaceConfig
}
}
},
}
};
// Construct the request.
var request = new DeidentifyContentRequest
{
ParentAsLocationName = new LocationName(projectId, "global"),
DeidentifyConfig = deidentifyConfig,
InspectConfig = inspectConfig,
Item = new ContentItem { Value = text }
};
// Call the API.
var response = dlp.DeidentifyContent(request);
// Check the deidentified content.
Console.WriteLine($"Deidentified content: {response.Item.Value}");
return response;
}
}
Go
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import (
"context"
"fmt"
"io"
dlp "cloud.google.com/go/dlp/apiv2"
"cloud.google.com/go/dlp/apiv2/dlppb"
)
// deidentifyWithReplacement de-identifies sensitive data by replacing matched input values
func deidentifyWithReplacement(w io.Writer, projectID, inputStr string, infoTypeNames []string, replaceVal string) error {
// projectId := "your-project-id"
// inputStr := "My name is Alicia Abernathy, and my email address is aabernathy@example.com."
// infoTypeNames := []string{"EMAIL_ADDRESS"}
// replaceVal := "[email-address]"
ctx := context.Background()
// Initialize a client once and reuse it to send multiple requests. Clients
// are safe to use across goroutines. When the client is no longer needed,
// call the Close method to cleanup its resources.
client, err := dlp.NewClient(ctx)
if err != nil {
return err
}
// Closing the client safely cleans up background resources.
defer client.Close()
// item to be analyzed
item := &dlppb.ContentItem{
DataItem: &dlppb.ContentItem_Value{Value: inputStr},
}
// Specify the type of info the inspection will look for.
// See https://cloud.google.com/dlp/docs/infotypes-reference for complete list of info types
var infoTypes []*dlppb.InfoType
for _, v := range infoTypeNames {
infoTypes = append(infoTypes, &dlppb.InfoType{Name: v})
}
inspectConfig := &dlppb.InspectConfig{
InfoTypes: infoTypes,
}
// Specify replacement string to be used for the finding.
replaceValueConfig := &dlppb.ReplaceValueConfig{
NewValue: &dlppb.Value{
Type: &dlppb.Value_StringValue{
StringValue: replaceVal,
},
},
}
// Define type of de-identification as replacement.
primitiveTransformation := &dlppb.PrimitiveTransformation_ReplaceConfig{
ReplaceConfig: replaceValueConfig,
}
// Associate de-identification type with info type.
infoTypeTransformation := &dlppb.InfoTypeTransformations_InfoTypeTransformation{
InfoTypes: infoTypes,
PrimitiveTransformation: &dlppb.PrimitiveTransformation{
Transformation: primitiveTransformation,
},
}
deIdentifyConfig := &dlppb.DeidentifyConfig{
Transformation: &dlppb.DeidentifyConfig_InfoTypeTransformations{
InfoTypeTransformations: &dlppb.InfoTypeTransformations{
Transformations: []*dlppb.InfoTypeTransformations_InfoTypeTransformation{
infoTypeTransformation,
},
},
},
}
// Construct the de-identification request to be sent by the client.
req := &dlppb.DeidentifyContentRequest{
Parent: fmt.Sprintf("projects/%s/locations/global", projectID),
DeidentifyConfig: deIdentifyConfig,
InspectConfig: inspectConfig,
Item: item,
}
// Send the request.
resp, err := client.DeidentifyContent(ctx, req)
if err != nil {
return err
}
// Print the results.
fmt.Fprintf(w, "output : %v", resp.GetItem().GetValue())
return nil
}
Java
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import com.google.cloud.dlp.v2.DlpServiceClient;
import com.google.privacy.dlp.v2.ContentItem;
import com.google.privacy.dlp.v2.DeidentifyConfig;
import com.google.privacy.dlp.v2.DeidentifyContentRequest;
import com.google.privacy.dlp.v2.DeidentifyContentResponse;
import com.google.privacy.dlp.v2.InfoType;
import com.google.privacy.dlp.v2.InfoTypeTransformations;
import com.google.privacy.dlp.v2.InfoTypeTransformations.InfoTypeTransformation;
import com.google.privacy.dlp.v2.InspectConfig;
import com.google.privacy.dlp.v2.LocationName;
import com.google.privacy.dlp.v2.PrimitiveTransformation;
import com.google.privacy.dlp.v2.ReplaceValueConfig;
import com.google.privacy.dlp.v2.Value;
public class DeIdentifyWithReplacement {
public static void main(String[] args) throws Exception {
// TODO(developer): Replace these variables before running the sample.
String projectId = "your-project-id";
String textToInspect =
"My name is Alicia Abernathy, and my email address is aabernathy@example.com.";
deIdentifyWithReplacement(projectId, textToInspect);
}
// Inspects the provided text.
public static void deIdentifyWithReplacement(String projectId, String textToRedact) {
// Initialize client that will be used to send requests. This client only needs to be created
// once, and can be reused for multiple requests. After completing all of your requests, call
// the "close" method on the client to safely clean up any remaining background resources.
try (DlpServiceClient dlp = DlpServiceClient.create()) {
// Specify the content to be inspected.
ContentItem item = ContentItem.newBuilder().setValue(textToRedact).build();
// Specify the type of info the inspection will look for.
// See https://cloud.google.com/dlp/docs/infotypes-reference for complete list of info types
InfoType infoType = InfoType.newBuilder().setName("EMAIL_ADDRESS").build();
InspectConfig inspectConfig = InspectConfig.newBuilder().addInfoTypes(infoType).build();
// Specify replacement string to be used for the finding.
ReplaceValueConfig replaceValueConfig =
ReplaceValueConfig.newBuilder()
.setNewValue(Value.newBuilder().setStringValue("[email-address]").build())
.build();
// Define type of deidentification as replacement.
PrimitiveTransformation primitiveTransformation =
PrimitiveTransformation.newBuilder().setReplaceConfig(replaceValueConfig).build();
// Associate deidentification type with info type.
InfoTypeTransformation transformation =
InfoTypeTransformation.newBuilder()
.addInfoTypes(infoType)
.setPrimitiveTransformation(primitiveTransformation)
.build();
// Construct the configuration for the Redact request and list all desired transformations.
DeidentifyConfig redactConfig =
DeidentifyConfig.newBuilder()
.setInfoTypeTransformations(
InfoTypeTransformations.newBuilder().addTransformations(transformation))
.build();
// Construct the Redact request to be sent by the client.
DeidentifyContentRequest request =
DeidentifyContentRequest.newBuilder()
.setParent(LocationName.of(projectId, "global").toString())
.setItem(item)
.setDeidentifyConfig(redactConfig)
.setInspectConfig(inspectConfig)
.build();
// Use the client to send the API request.
DeidentifyContentResponse response = dlp.deidentifyContent(request);
// Parse the response and process results
System.out.println("Text after redaction: " + response.getItem().getValue());
} catch (Exception e) {
System.out.println("Error during inspectString: \n" + e.toString());
}
}
}Node.js
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
// Imports the Google Cloud Data Loss Prevention library
const DLP = require('@google-cloud/dlp');
// Instantiates a client
const dlp = new DLP.DlpServiceClient();
// The project ID to run the API call under
// const projectId = 'my-project';
// The string to deidentify
// const string = 'My SSN is 372819127';
// The string to replace sensitive information with
// const replacement = "[REDACTED]"
async function deidentifyWithReplacement() {
// Construct deidentification request
const item = {value: string};
const request = {
parent: `projects/${projectId}/locations/global`,
deidentifyConfig: {
infoTypeTransformations: {
transformations: [
{
primitiveTransformation: {
replaceConfig: {
newValue: {
stringValue: replacement,
},
},
},
},
],
},
},
item: item,
};
// Run deidentification request
const [response] = await dlp.deidentifyContent(request);
const deidentifiedItem = response.item;
console.log(deidentifiedItem.value);
}
deidentifyWithReplacement();PHP
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
use Google\Cloud\Dlp\V2\Client\DlpServiceClient;
use Google\Cloud\Dlp\V2\ContentItem;
use Google\Cloud\Dlp\V2\DeidentifyConfig;
use Google\Cloud\Dlp\V2\DeidentifyContentRequest;
use Google\Cloud\Dlp\V2\InfoType;
use Google\Cloud\Dlp\V2\InfoTypeTransformations;
use Google\Cloud\Dlp\V2\InfoTypeTransformations\InfoTypeTransformation;
use Google\Cloud\Dlp\V2\InspectConfig;
use Google\Cloud\Dlp\V2\PrimitiveTransformation;
use Google\Cloud\Dlp\V2\ReplaceValueConfig;
use Google\Cloud\Dlp\V2\Value;
/**
* De-identify sensitive data: Replacing matched input values.
* Uses the Data Loss Prevention API to de-identify sensitive data in a string by replacing matched input values with a value that you specify.
*
* @param string $callingProjectId The Google Cloud project id to use as a parent resource.
* @param string $string The string to deidentify (will be treated as text).
*/
function deidentify_replace(
// TODO(developer): Replace sample parameters before running the code.
string $callingProjectId,
string $string = 'My name is Alicia Abernathy, and my email address is aabernathy@example.com.'
): void {
// Instantiate a client.
$dlp = new DlpServiceClient();
$parent = "projects/$callingProjectId/locations/global";
// Specify the content to be deidentify.
$content = (new ContentItem())
->setValue($string);
// Specify the type of info the inspection will look for.
$emailAddressInfoType = (new InfoType())
->setName('EMAIL_ADDRESS');
// Create the configuration object
$inspectConfig = (new InspectConfig())
->setInfoTypes([$emailAddressInfoType]);
// Specify replacement string to be used for the finding.
$replaceValueConfig = (new ReplaceValueConfig())
->setNewValue((new Value())
->setStringValue('[email-address]'));
// Define type of deidentification as replacement.
$primitiveTransformation = (new PrimitiveTransformation())
->setReplaceConfig($replaceValueConfig);
// Associate deidentification type with info type.
$infoTypeTransformation = (new InfoTypeTransformation())
->setPrimitiveTransformation($primitiveTransformation)
->setInfoTypes([$emailAddressInfoType]);
$infoTypeTransformations = (new InfoTypeTransformations())
->setTransformations([$infoTypeTransformation]);
// Construct the configuration for the Redact request and list all desired transformations.
$deidentifyConfig = (new DeidentifyConfig())
->setInfoTypeTransformations($infoTypeTransformations);
// Run request
$deidentifyContentRequest = (new DeidentifyContentRequest())
->setParent($parent)
->setDeidentifyConfig($deidentifyConfig)
->setItem($content)
->setInspectConfig($inspectConfig);
$response = $dlp->deidentifyContent($deidentifyContentRequest);
// Print the results
printf('Deidentified content: %s' . PHP_EOL, $response->getItem()->getValue());
}Python
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
from typing import List
import google.cloud.dlp
def deidentify_with_replace(
project: str,
input_str: str,
info_types: List[str],
replacement_str: str = "REPLACEMENT_STR",
) -> None:
"""Uses the Data Loss Prevention API to deidentify sensitive data in a
string by replacing matched input values with a value you specify.
Args:
project: The Google Cloud project id to use as a parent resource.
input_str: The string to deidentify (will be treated as text).
info_types: A list of strings representing info types to look for.
replacement_str: The string to replace all values that match given
info types.
Returns:
None; the response from the API is printed to the terminal.
"""
# Instantiate a client
dlp = google.cloud.dlp_v2.DlpServiceClient()
# Convert the project id into a full resource id.
parent = f"projects/{project}/locations/global"
# Construct inspect configuration dictionary
inspect_config = {"info_types": [{"name": info_type} for info_type in info_types]}
# Construct deidentify configuration dictionary
deidentify_config = {
"info_type_transformations": {
"transformations": [
{
"primitive_transformation": {
"replace_config": {
"new_value": {"string_value": replacement_str}
}
}
}
]
}
}
# Construct item
item = {"value": input_str}
# Call the API
response = dlp.deidentify_content(
request={
"parent": parent,
"deidentify_config": deidentify_config,
"inspect_config": inspect_config,
"item": item,
}
)
# Print out the results.
print(response.item.value)
REST
JSON과 함께 DLP API를 사용하는 데 대한 자세한 내용은 JSON 빠른 시작을 참조하세요.
HTTP 메서드 및 URL
POST https://dlp.googleapis.com/v2/projects/PROJECT_ID/content:deidentify
PROJECT_ID를 프로젝트 ID로 바꿉니다.
JSON 입력
{
"item":{
"value":"My name is Alicia Abernathy, and my email address is aabernathy@example.com."
},
"deidentifyConfig":{
"infoTypeTransformations":{
"transformations":[
{
"infoTypes":[
{
"name":"EMAIL_ADDRESS"
}
],
"primitiveTransformation":{
"replaceConfig":{
"newValue":{
"stringValue":"[email-address]"
}
}
}
}
]
}
},
"inspectConfig":{
"infoTypes":[
{
"name":"EMAIL_ADDRESS"
}
]
}
}
JSON 출력
{
"item":{
"value":"My name is Alicia Abernathy, and my email address is [email-address]."
},
"overview":{
"transformedBytes":"22",
"transformationSummaries":[
{
"infoType":{
"name":"EMAIL_ADDRESS"
},
"transformation":{
"replaceConfig":{
"newValue":{
"stringValue":"[email-address]"
}
}
},
"results":[
{
"count":"1",
"code":"SUCCESS"
}
],
"transformedBytes":"22"
}
]
}
}
사전 대체
사전 대체(ReplaceDictionaryConfig)는 감지된 민감한 정보의 각 부분을 Sensitive Data Protection에서 제공된 단어 목록에서 무작위로 선택한 값으로 바꿉니다.
이 변환 방법은 실제와 같은 대리 값을 사용하려는 경우에 유용합니다.
Sensitive Data Protection에서 이메일 주소를 감지하고 각 감지된 값을 3개의 대리 이메일 주소 중 하나로 바꾸도록 한다고 가정해보세요.
대리 이메일 주소 목록과 함께 다음 입력 문자열을 Sensitive Data Protection에 전송합니다.
입력 문자열
My name is Alicia Abernathy, and my email address is aabernathy@example.com.
단어 목록
- izumi@example.com
- alex@example.com
- tal@example.com
반환된 문자열은 다음 중 하나일 수 있습니다.
My name is Alicia Abernathy, and my email address is izumi@example.com.
My name is Alicia Abernathy, and my email address is alex@example.com.
My name is Alicia Abernathy, and my email address is tal@example.com.
다음 JSON 예는 API 요청을 작성하는 방법과 DLP API에서 반환하는 항목을 보여줍니다.
JSON과 함께 DLP API를 사용하는 데 대한 자세한 내용은 JSON 빠른 시작을 참조하세요.
HTTP 메서드 및 URL
POST https://dlp.googleapis.com/v2/projects/PROJECT_ID/content:deidentify
PROJECT_ID를 프로젝트 ID로 바꿉니다.
JSON 입력
{
"item": {
"value": "My name is Alicia Abernathy, and my email address is aabernathy@example.com."
},
"deidentifyConfig": {
"infoTypeTransformations": {
"transformations": [
{
"infoTypes": [
{
"name": "EMAIL_ADDRESS"
}
],
"primitiveTransformation": {
"replaceDictionaryConfig": {
"wordList": {
"words": [
"izumi@example.com",
"alex@example.com",
"tal@example.com"
]
}
}
}
}
]
}
},
"inspectConfig": {
"infoTypes": [
{
"name": "EMAIL_ADDRESS"
}
]
}
}
JSON 출력
{
"item": {
"value": "My name is Alicia Abernathy, and my email address is izumi@example.com."
},
"overview": {
"transformedBytes": "22",
"transformationSummaries": [
{
"infoType": {
"name": "EMAIL_ADDRESS"
},
"transformation": {
"replaceDictionaryConfig": {
"wordList": {
"words": [
"izumi@example.com",
"alex@example.com",
"tal@example.com"
]
}
}
},
"results": [
{
"count": "1",
"code": "SUCCESS"
}
],
"transformedBytes": "22"
}
]
}
}
C#
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
using System;
using System.Collections.Generic;
using Google.Api.Gax.ResourceNames;
using Google.Cloud.Dlp.V2;
public class DeidentifyDataUsingDictionaryReplacement
{
public static DeidentifyContentResponse Deidentify(
string projectId,
string text,
IEnumerable<InfoType> infoTypes = null,
IEnumerable<string> words = null)
{
// Instantiate the client.
var dlp = DlpServiceClient.Create();
// Construct inspect config by specifying the type of info to be inspected.
var inspectConfig = new InspectConfig
{
InfoTypes = { infoTypes ?? new InfoType[] { new InfoType { Name = "EMAIL_ADDRESS" } } },
};
// Construct dictionary replace config by specifying the list of value which will
// be replaced by any mentioned values below.
var replaceConfig = new ReplaceDictionaryConfig
{
WordList = new CustomInfoType.Types.Dictionary.Types.WordList
{
Words =
{
words ?? new string[]
{
"izumi@example.com", "alex@example.com", "tal@example.com"
}
}
}
};
// Construct deidentify config using above created replace config.
var deidentifyConfig = new DeidentifyConfig
{
InfoTypeTransformations = new InfoTypeTransformations
{
Transformations =
{
new InfoTypeTransformations.Types.InfoTypeTransformation
{
PrimitiveTransformation = new PrimitiveTransformation
{
ReplaceDictionaryConfig = replaceConfig
}
}
}
}
};
// Construct a request.
var request = new DeidentifyContentRequest
{
ParentAsLocationName = new LocationName(projectId, "global"),
DeidentifyConfig = deidentifyConfig,
InspectConfig = inspectConfig,
Item = new ContentItem { Value = text }
};
// Call the API.
var response = dlp.DeidentifyContent(request);
// Check the deidentified content.
Console.WriteLine($"Deidentified content: {response.Item.Value}");
return response;
}
}
Go
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import (
"context"
"fmt"
"io"
dlp "cloud.google.com/go/dlp/apiv2"
"cloud.google.com/go/dlp/apiv2/dlppb"
)
// deidentifyDataReplaceWithDictionary de-identifies sensitive data in a string by replacing
// each piece of detected sensitive data with a value that Cloud DLP randomly selects from
// a list of words that you provide.
func deidentifyDataReplaceWithDictionary(w io.Writer, projectID, textToDeIdentify string) error {
// projectId := "my-project-id"
// textToDeIdentify := "My name is Alicia Abernathy, and my email address is aabernathy@example.com."
ctx := context.Background()
// Initialize a client once and reuse it to send multiple requests. Clients
// are safe to use across goroutines. When the client is no longer needed,
// call the Close method to cleanup its resources.
client, err := dlp.NewClient(ctx)
if err != nil {
return err
}
// Closing the client safely cleans up background resources.
defer client.Close()
// Specify the content to be inspected.
item := &dlppb.ContentItem{
DataItem: &dlppb.ContentItem_Value{
Value: textToDeIdentify,
},
}
// Specify the type of info the inspection will look for.
// See https://cloud.google.com/dlp/docs/infotypes-reference for complete list of info types
infoType := &dlppb.InfoType{
Name: "EMAIL_ADDRESS",
}
// Specify the infotypes to be inspected.
inspectConfig := &dlppb.InspectConfig{
InfoTypes: []*dlppb.InfoType{
infoType,
},
}
// Specify list of values which will be randomly picked to replace identified email addresses.
wordList := &dlppb.ReplaceDictionaryConfig_WordList{
WordList: &dlppb.CustomInfoType_Dictionary_WordList{
Words: []string{"izumi@example.com", "alex@example.com"},
},
}
// Specify the Dictionary to use for selecting replacement values for the finding.
replaceDictionaryConfig := &dlppb.ReplaceDictionaryConfig{
Type: wordList,
}
// Define type of de-identification as replacement with items from dictionary.
primitiveTransformation := &dlppb.PrimitiveTransformation{
Transformation: &dlppb.PrimitiveTransformation_ReplaceDictionaryConfig{
ReplaceDictionaryConfig: replaceDictionaryConfig,
},
}
transformation := &dlppb.InfoTypeTransformations_InfoTypeTransformation{
InfoTypes: []*dlppb.InfoType{
infoType,
},
PrimitiveTransformation: primitiveTransformation,
}
// Combine configurations into a request for the service.
deIdentifyConfig := &dlppb.DeidentifyConfig{
Transformation: &dlppb.DeidentifyConfig_InfoTypeTransformations{
InfoTypeTransformations: &dlppb.InfoTypeTransformations{
Transformations: []*dlppb.InfoTypeTransformations_InfoTypeTransformation{
transformation,
},
},
},
}
// Construct the de-identification request to be sent by the client.
req := &dlppb.DeidentifyContentRequest{
Parent: fmt.Sprintf("projects/%s/locations/global", projectID),
DeidentifyConfig: deIdentifyConfig,
InspectConfig: inspectConfig,
Item: item,
}
// Send the request.
resp, err := client.DeidentifyContent(ctx, req)
if err != nil {
return err
}
// Print the results.
fmt.Fprint(w, "output: ", resp.GetItem().GetValue())
return nil
}
Java
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import com.google.cloud.dlp.v2.DlpServiceClient;
import com.google.privacy.dlp.v2.ContentItem;
import com.google.privacy.dlp.v2.CustomInfoType.Dictionary.WordList;
import com.google.privacy.dlp.v2.DeidentifyConfig;
import com.google.privacy.dlp.v2.DeidentifyContentRequest;
import com.google.privacy.dlp.v2.DeidentifyContentResponse;
import com.google.privacy.dlp.v2.InfoType;
import com.google.privacy.dlp.v2.InfoTypeTransformations;
import com.google.privacy.dlp.v2.InspectConfig;
import com.google.privacy.dlp.v2.LocationName;
import com.google.privacy.dlp.v2.PrimitiveTransformation;
import com.google.privacy.dlp.v2.ReplaceDictionaryConfig;
import java.io.IOException;
public class DeIdentifyDataReplaceWithDictionary {
public static void main(String[] args) throws Exception {
// TODO(developer): Replace these variables before running the sample.
// The Google Cloud project id to use as a parent resource.
String projectId = "your-project-id";
// The string to de-identify
String textToDeIdentify =
"My name is Charlie and email address is charlie@example.com.";
deidentifyDataReplaceWithDictionary(projectId, textToDeIdentify);
}
// Performs data de-identification by replacing identified email addresses in a given text with
// randomly selected values from a dictionary.
public static void deidentifyDataReplaceWithDictionary(String projectId, String textToDeIdentify)
throws IOException {
// Initialize client that will be used to send requests. This client only needs to be created
// once, and can be reused for multiple requests. After completing all of your requests, call
// the "close" method on the client to safely clean up any remaining background resources.
try (DlpServiceClient dlp = DlpServiceClient.create()) {
// Specify what content you want the service to de-identify.
ContentItem item = ContentItem.newBuilder().setValue(textToDeIdentify).build();
// Specify the type of info the inspection will look for.
// See https://cloud.google.com/dlp/docs/infotypes-reference for complete list of info types
InfoType infoType = InfoType.newBuilder().setName("EMAIL_ADDRESS").build();
InspectConfig inspectConfig = InspectConfig.newBuilder().addInfoTypes(infoType).build();
// Specify list of value which will randomly replace identified email addresses.
WordList wordList =
WordList.newBuilder().addWords("izumi@example.com").addWords("alex@example.com").build();
// Specify the dictionary to use for selecting replacement values for the finding.
ReplaceDictionaryConfig replaceDictionaryConfig =
ReplaceDictionaryConfig.newBuilder().setWordList(wordList).build();
// Define type of de-identification as replacement with items from dictionary.
PrimitiveTransformation primitiveTransformation =
PrimitiveTransformation.newBuilder()
.setReplaceDictionaryConfig(replaceDictionaryConfig)
.build();
InfoTypeTransformations.InfoTypeTransformation transformation =
InfoTypeTransformations.InfoTypeTransformation.newBuilder()
.addInfoTypes(infoType)
.setPrimitiveTransformation(primitiveTransformation)
.build();
DeidentifyConfig deidentifyConfig =
DeidentifyConfig.newBuilder()
.setInfoTypeTransformations(
InfoTypeTransformations.newBuilder().addTransformations(transformation))
.build();
// Combine configurations into a request for the service.
DeidentifyContentRequest request =
DeidentifyContentRequest.newBuilder()
.setParent(LocationName.of(projectId, "global").toString())
.setItem(item)
.setDeidentifyConfig(deidentifyConfig)
.setInspectConfig(inspectConfig)
.build();
// Use the client to send the API request.
DeidentifyContentResponse response = dlp.deidentifyContent(request);
// Parse the response and process results.
System.out.print("Text after de-identification: " + response.getItem().getValue());
}
}
}Node.js
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
// Imports the Google Cloud Data Loss Prevention library
const DLP = require('@google-cloud/dlp');
// Instantiates a client
const dlp = new DLP.DlpServiceClient();
// The project ID to run the API call under
// const projectId = 'my-project';
// The string to de-identify
// const string = 'My name is Alicia Abernathy, and my email address is aabernathy@example.com.';
// The infoTypes of information to match
// const infoTypes = [{ name: 'EMAIL_ADDRESS' }];
// The words to replace sensitive information with
// const words = ['izumi@example.com', 'alex@example.com', 'tal@example.com'];
async function deidentifyWithDictionaryReplacement() {
// Construct word list to be used for replacement
const wordList = {
words: words,
};
// Construct item to de-identify
const item = {value: string};
// Specify replacement dictionary config using word list.
const replaceDictionaryConfig = {
wordList: wordList,
};
// Associate replacement dictionary config with infotype transformation.
const infoTypeTransformations = {
transformations: [
{
infoTypes: infoTypes,
primitiveTransformation: {
replaceDictionaryConfig: replaceDictionaryConfig,
},
},
],
};
// Combine configurations into a request for the service.
const request = {
parent: `projects/${projectId}/locations/global`,
deidentifyConfig: {
infoTypeTransformations: infoTypeTransformations,
},
item: item,
};
// Run de-identification request.
const [response] = await dlp.deidentifyContent(request);
const deidentifiedItem = response.item;
// Print results.
console.log(deidentifiedItem.value);
}
deidentifyWithDictionaryReplacement();PHP
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
use Google\Cloud\Dlp\V2\Client\DlpServiceClient;
use Google\Cloud\Dlp\V2\ContentItem;
use Google\Cloud\Dlp\V2\CustomInfoType\Dictionary\WordList;
use Google\Cloud\Dlp\V2\DeidentifyConfig;
use Google\Cloud\Dlp\V2\DeidentifyContentRequest;
use Google\Cloud\Dlp\V2\InfoType;
use Google\Cloud\Dlp\V2\InfoTypeTransformations;
use Google\Cloud\Dlp\V2\InfoTypeTransformations\InfoTypeTransformation;
use Google\Cloud\Dlp\V2\InspectConfig;
use Google\Cloud\Dlp\V2\PrimitiveTransformation;
use Google\Cloud\Dlp\V2\ReplaceDictionaryConfig;
/**
* Dictionary replacement
* Dictionary replacement (ReplaceDictionaryConfig) replaces each piece of detected sensitive data with a
* value that Cloud DLP randomly selects from a list of words that you provide. This transformation method
* is useful if you want to use realistic surrogate values.Suppose you want Cloud DLP to detect email addresses
* and replace each detected value with one of three surrogate email addresses.
*
* @param string $callingProjectId The project ID to run the API call under.
* @param string $textToDeIdentify The String you want the service to DeIdentify.
*/
function deidentify_dictionary_replacement(
// TODO(developer): Replace sample parameters before running the code.
string $callingProjectId,
string $textToDeIdentify = 'My name is Charlie and email address is charlie@example.com.'
): void {
// Instantiate a client.
$dlp = new DlpServiceClient();
// Specify what content you want the service to de-identify.
$contentItem = (new ContentItem())
->setValue($textToDeIdentify);
// Specify the type of info the inspection will look for.
// See https://cloud.google.com/dlp/docs/infotypes-reference for complete list of info types
$emailAddress = (new InfoType())
->setName('EMAIL_ADDRESS');
$inspectConfig = (new InspectConfig())
->setInfoTypes([$emailAddress]);
// Define type of de-identification as replacement with items from dictionary.
$primitiveTransformation = (new PrimitiveTransformation())
->setReplaceDictionaryConfig(
// Specify the dictionary to use for selecting replacement values for the finding.
(new ReplaceDictionaryConfig())
->setWordList(
// Specify list of value which will randomly replace identified email addresses.
(new WordList())
->setWords(['izumi@example.com', 'alex@example.com', 'tal@example.com'])
)
);
$transformation = (new InfoTypeTransformation())
->setInfoTypes([$emailAddress])
->setPrimitiveTransformation($primitiveTransformation);
// Construct the configuration for the de-identification request and list all desired transformations.
$deidentifyConfig = (new DeidentifyConfig())
->setInfoTypeTransformations(
(new InfoTypeTransformations())
->setTransformations([$transformation])
);
// Send the request and receive response from the service.
$parent = "projects/$callingProjectId/locations/global";
$deidentifyContentRequest = (new DeidentifyContentRequest())
->setParent($parent)
->setDeidentifyConfig($deidentifyConfig)
->setInspectConfig($inspectConfig)
->setItem($contentItem);
$response = $dlp->deidentifyContent($deidentifyContentRequest);
// Print the results.
printf('Text after replace with infotype config: %s', $response->getItem()->getValue());
}Python
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
from typing import List
import google.cloud.dlp
def deindentify_with_dictionary_replacement(
project: str,
input_str: str,
info_types: List[str],
word_list: List[str],
) -> None:
"""Uses the Data Loss Prevention API to de-identify sensitive data in a
string by replacing each piece of detected sensitive data with a value
that Cloud DLP randomly selects from a list of words that you provide.
Args:
project: The Google Cloud project id to use as a parent resource.
input_str: The string to deidentify (will be treated as text).
info_types: A list of strings representing infoTypes to look for.
word_list: List of words or phrases to search for in the data.
"""
# Instantiate a client
dlp = google.cloud.dlp_v2.DlpServiceClient()
# Construct list of info types
info_types = [{"name": info_type} for info_type in info_types]
# Construct deidentify configuration dictionary
deidentify_config = {
"info_type_transformations": {
"transformations": [
{
"info_types": info_types,
"primitive_transformation": {
"replace_dictionary_config": {"word_list": {"words": word_list}}
},
}
]
}
}
# Construct the `item`
item = {"value": input_str}
# Convert the project id into a full resource id.
parent = f"projects/{project}/locations/global"
# Call the API
response = dlp.deidentify_content(
request={
"parent": parent,
"deidentify_config": deidentify_config,
"inspect_config": {"info_types": info_types},
"item": item,
}
)
# Print out the results.
print(f"De-identified Content: {response.item.value}")
InfoType 대체
infoType 대체(DLP API의 ReplaceWithInfoTypeConfig)를 지정할 수도 있습니다. 이 변환은 기본 대체 변환과 동일한 작업을 수행하지만, 각각의 감지된 민감한 정보 값을 감지된 값의 infoType으로 바꿉니다.
예를 들어 Sensitive Data Protection에 이메일 주소와 성을 감지한 후 각각의 감지된 값을 해당 값의 infoType으로 대체하도록 지시했다고 가정해보겠습니다. Sensitive Data Protection에 다음 문자열을 보냅니다.
My name is Alicia Abernathy, and my email address is aabernathy@example.com.
다음과 같은 문자열이 반환됩니다.
My name is Alicia LAST_NAME, and my email address is EMAIL_ADDRESS.
마스킹
각 문자를 별표 (*) 또는 해시 (#)와 같은 고정된 단일 마스킹 문자로 대체하여 Sensitive Data Protection에서 감지된 민감한 값(DLP API의 CharacterMaskConfig)을 전부 또는 부분적으로 마스킹하도록 구성할 수 있습니다. 마스킹은 문자열의 시작 또는 끝부터 시작할 수 있습니다. 이 변환은 long 정수와 같은 숫자 유형에서도 작동합니다.
Sensitive Data Protection 마스킹 방식에는 다음과 같은 옵션이 있습니다.
- 마스킹 문자(DLP API의
maskingCharacter인수): 민감한 값의 각 문자를 마스킹하는 데 사용하는 문자입니다. 예를 들어 신용카드 번호와 같은 일련의 숫자를 마스킹하는 데 별표(*) 또는 달러 기호($)를 지정할 수 있습니다. - 마스킹할 문자 수(
numberToMask): 이 값을 지정하지 않으면 모든 문자가 마스킹됩니다 - 역순 적용 여부(
reverseOrder): 역순으로 문자를 마스킹할지 여부입니다. 순서를 반대로 하면 일치하는 값의 문자가 값의 끝에서 시작 방향으로 마스킹됩니다. - 무시할 문자(
charactersToIgnore): 마스킹할 때 건너뛸 하나 이상의 문자입니다. 예를 들어 전화번호를 마스킹할 때 Sensitive Data Protection에 하이픈을 그대로 두도록 지시할 수 있습니다. 또한 마스킹할 때 무시할 공통 문자 그룹(CharsToIgnore)을 지정할 수도 있습니다.
다음 문자열을 Sensitive Data Protection에 전송하고 이메일 주소에 문자 마스킹 변환을 사용하도록 지시했다고 가정해보겠습니다.
My name is Alicia Abernathy, and my email address is aabernathy@example.com.
마스킹 문자를 '#'로 지정하고 무시할 문자를 공통 문자 집합으로 설정하였으며 그 외의 경우 기본 설정이면 Sensitive Data Protection은 다음을 반환합니다.
My name is Alicia Abernathy, and my email address is ##########@#######.###.
다음 JSON 및 코드 예시는 마스킹 변환의 작동 방식을 보여줍니다.
Java
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import com.google.cloud.dlp.v2.DlpServiceClient;
import com.google.privacy.dlp.v2.CharacterMaskConfig;
import com.google.privacy.dlp.v2.ContentItem;
import com.google.privacy.dlp.v2.DeidentifyConfig;
import com.google.privacy.dlp.v2.DeidentifyContentRequest;
import com.google.privacy.dlp.v2.DeidentifyContentResponse;
import com.google.privacy.dlp.v2.InfoType;
import com.google.privacy.dlp.v2.InfoTypeTransformations;
import com.google.privacy.dlp.v2.InfoTypeTransformations.InfoTypeTransformation;
import com.google.privacy.dlp.v2.InspectConfig;
import com.google.privacy.dlp.v2.LocationName;
import com.google.privacy.dlp.v2.PrimitiveTransformation;
import java.io.IOException;
import java.util.Arrays;
public class DeIdentifyWithMasking {
public static void main(String[] args) throws Exception {
// TODO(developer): Replace these variables before running the sample.
String projectId = "your-project-id";
String textToDeIdentify = "My SSN is 372819127";
deIdentifyWithMasking(projectId, textToDeIdentify);
}
public static void deIdentifyWithMasking(String projectId, String textToDeIdentify)
throws IOException {
// Initialize client that will be used to send requests. This client only needs to be created
// once, and can be reused for multiple requests. After completing all of your requests, call
// the "close" method on the client to safely clean up any remaining background resources.
try (DlpServiceClient dlp = DlpServiceClient.create()) {
// Specify what content you want the service to DeIdentify
ContentItem contentItem = ContentItem.newBuilder().setValue(textToDeIdentify).build();
// Specify the type of info the inspection will look for.
// See https://cloud.google.com/dlp/docs/infotypes-reference for complete list of info types
InfoType infoType = InfoType.newBuilder().setName("US_SOCIAL_SECURITY_NUMBER").build();
InspectConfig inspectConfig =
InspectConfig.newBuilder().addAllInfoTypes(Arrays.asList(infoType)).build();
// Specify how the info from the inspection should be masked.
CharacterMaskConfig characterMaskConfig =
CharacterMaskConfig.newBuilder()
.setMaskingCharacter("X") // Character to replace the found info with
.setNumberToMask(5) // How many characters should be masked
.build();
PrimitiveTransformation primitiveTransformation =
PrimitiveTransformation.newBuilder()
.setCharacterMaskConfig(characterMaskConfig)
.build();
InfoTypeTransformation infoTypeTransformation =
InfoTypeTransformation.newBuilder()
.setPrimitiveTransformation(primitiveTransformation)
.build();
InfoTypeTransformations transformations =
InfoTypeTransformations.newBuilder().addTransformations(infoTypeTransformation).build();
DeidentifyConfig deidentifyConfig =
DeidentifyConfig.newBuilder().setInfoTypeTransformations(transformations).build();
// Combine configurations into a request for the service.
DeidentifyContentRequest request =
DeidentifyContentRequest.newBuilder()
.setParent(LocationName.of(projectId, "global").toString())
.setItem(contentItem)
.setInspectConfig(inspectConfig)
.setDeidentifyConfig(deidentifyConfig)
.build();
// Send the request and receive response from the service
DeidentifyContentResponse response = dlp.deidentifyContent(request);
// Print the results
System.out.println("Text after masking: " + response.getItem().getValue());
}
}
}Node.js
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
// Imports the Google Cloud Data Loss Prevention library
const DLP = require('@google-cloud/dlp');
// Instantiates a client
const dlp = new DLP.DlpServiceClient();
// The project ID to run the API call under
// const projectId = 'my-project-id';
// The string to deidentify
// const string = 'My SSN is 372819127';
// (Optional) The maximum number of sensitive characters to mask in a match
// If omitted from the request or set to 0, the API will mask any matching characters
// const numberToMask = 5;
// (Optional) The character to mask matching sensitive data with
// const maskingCharacter = 'x';
// Construct deidentification request
const item = {value: string};
async function deidentifyWithMask() {
const request = {
parent: `projects/${projectId}/locations/global`,
deidentifyConfig: {
infoTypeTransformations: {
transformations: [
{
primitiveTransformation: {
characterMaskConfig: {
maskingCharacter: maskingCharacter,
numberToMask: numberToMask,
},
},
},
],
},
},
item: item,
};
// Run deidentification request
const [response] = await dlp.deidentifyContent(request);
const deidentifiedItem = response.item;
console.log(deidentifiedItem.value);
}
deidentifyWithMask();Python
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
from typing import List
import google.cloud.dlp
def deidentify_with_mask(
project: str,
input_str: str,
info_types: List[str],
masking_character: str = None,
number_to_mask: int = 0,
) -> None:
"""Uses the Data Loss Prevention API to deidentify sensitive data in a
string by masking it with a character.
Args:
project: The Google Cloud project id to use as a parent resource.
input_str: The string to deidentify (will be treated as text).
info_types: A list of strings representing info types to look for.
A full list of info type categories can be fetched from the API.
masking_character: The character to mask matching sensitive data with.
number_to_mask: The maximum number of sensitive characters to mask in
a match. If omitted or set to zero, the API will default to no
maximum.
Returns:
None; the response from the API is printed to the terminal.
"""
# Instantiate a client
dlp = google.cloud.dlp_v2.DlpServiceClient()
# Convert the project id into a full resource id.
parent = f"projects/{project}/locations/global"
# Construct inspect configuration dictionary
inspect_config = {"info_types": [{"name": info_type} for info_type in info_types]}
# Construct deidentify configuration dictionary
deidentify_config = {
"info_type_transformations": {
"transformations": [
{
"primitive_transformation": {
"character_mask_config": {
"masking_character": masking_character,
"number_to_mask": number_to_mask,
}
}
}
]
}
}
# Construct item
item = {"value": input_str}
# Call the API
response = dlp.deidentify_content(
request={
"parent": parent,
"deidentify_config": deidentify_config,
"inspect_config": inspect_config,
"item": item,
}
)
# Print out the results.
print(response.item.value)
Go
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import (
"context"
"fmt"
"io"
dlp "cloud.google.com/go/dlp/apiv2"
"cloud.google.com/go/dlp/apiv2/dlppb"
)
// mask deidentifies the input by masking all provided info types with maskingCharacter
// and prints the result to w.
func mask(w io.Writer, projectID, input string, infoTypeNames []string, maskingCharacter string, numberToMask int32) error {
// projectID := "my-project-id"
// input := "My SSN is 111222333"
// infoTypeNames := []string{"US_SOCIAL_SECURITY_NUMBER"}
// maskingCharacter := "+"
// numberToMask := 6
// Will print "My SSN is ++++++333"
ctx := context.Background()
client, err := dlp.NewClient(ctx)
if err != nil {
return fmt.Errorf("dlp.NewClient: %w", err)
}
defer client.Close()
// Convert the info type strings to a list of InfoTypes.
var infoTypes []*dlppb.InfoType
for _, it := range infoTypeNames {
infoTypes = append(infoTypes, &dlppb.InfoType{Name: it})
}
// Create a configured request.
req := &dlppb.DeidentifyContentRequest{
Parent: fmt.Sprintf("projects/%s/locations/global", projectID),
InspectConfig: &dlppb.InspectConfig{
InfoTypes: infoTypes,
},
DeidentifyConfig: &dlppb.DeidentifyConfig{
Transformation: &dlppb.DeidentifyConfig_InfoTypeTransformations{
InfoTypeTransformations: &dlppb.InfoTypeTransformations{
Transformations: []*dlppb.InfoTypeTransformations_InfoTypeTransformation{
{
InfoTypes: []*dlppb.InfoType{}, // Match all info types.
PrimitiveTransformation: &dlppb.PrimitiveTransformation{
Transformation: &dlppb.PrimitiveTransformation_CharacterMaskConfig{
CharacterMaskConfig: &dlppb.CharacterMaskConfig{
MaskingCharacter: maskingCharacter,
NumberToMask: numberToMask,
},
},
},
},
},
},
},
},
// The item to analyze.
Item: &dlppb.ContentItem{
DataItem: &dlppb.ContentItem_Value{
Value: input,
},
},
}
// Send the request.
r, err := client.DeidentifyContent(ctx, req)
if err != nil {
return fmt.Errorf("DeidentifyContent: %w", err)
}
// Print the result.
fmt.Fprint(w, r.GetItem().GetValue())
return nil
}
PHP
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
use Google\Cloud\Dlp\V2\CharacterMaskConfig;
use Google\Cloud\Dlp\V2\Client\DlpServiceClient;
use Google\Cloud\Dlp\V2\ContentItem;
use Google\Cloud\Dlp\V2\DeidentifyConfig;
use Google\Cloud\Dlp\V2\DeidentifyContentRequest;
use Google\Cloud\Dlp\V2\InfoType;
use Google\Cloud\Dlp\V2\InfoTypeTransformations;
use Google\Cloud\Dlp\V2\InfoTypeTransformations\InfoTypeTransformation;
use Google\Cloud\Dlp\V2\PrimitiveTransformation;
/**
* Deidentify sensitive data in a string by masking it with a character.
*
* @param string $callingProjectId The GCP Project ID to run the API call under
* @param string $string The string to deidentify
* @param int $numberToMask (Optional) The maximum number of sensitive characters to mask in a match
* @param string $maskingCharacter (Optional) The character to mask matching sensitive data with (defaults to "x")
*/
function deidentify_mask(
string $callingProjectId,
string $string,
int $numberToMask = 0,
string $maskingCharacter = 'x'
): void {
// Instantiate a client.
$dlp = new DlpServiceClient();
// The infoTypes of information to mask
$ssnInfoType = (new InfoType())
->setName('US_SOCIAL_SECURITY_NUMBER');
$infoTypes = [$ssnInfoType];
// Create the masking configuration object
$maskConfig = (new CharacterMaskConfig())
->setMaskingCharacter($maskingCharacter)
->setNumberToMask($numberToMask);
// Create the information transform configuration objects
$primitiveTransformation = (new PrimitiveTransformation())
->setCharacterMaskConfig($maskConfig);
$infoTypeTransformation = (new InfoTypeTransformation())
->setPrimitiveTransformation($primitiveTransformation)
->setInfoTypes($infoTypes);
$infoTypeTransformations = (new InfoTypeTransformations())
->setTransformations([$infoTypeTransformation]);
// Create the deidentification configuration object
$deidentifyConfig = (new DeidentifyConfig())
->setInfoTypeTransformations($infoTypeTransformations);
$item = (new ContentItem())
->setValue($string);
$parent = "projects/$callingProjectId/locations/global";
// Run request
$deidentifyContentRequest = (new DeidentifyContentRequest())
->setParent($parent)
->setDeidentifyConfig($deidentifyConfig)
->setItem($item);
$response = $dlp->deidentifyContent($deidentifyContentRequest);
// Print the results
$deidentifiedValue = $response->getItem()->getValue();
print($deidentifiedValue);
}C#
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
using System;
using Google.Api.Gax.ResourceNames;
using Google.Cloud.Dlp.V2;
public class DeidentifyWithMasking
{
public static DeidentifyContentResponse Deidentify(string projectId, string text)
{
// Instantiate a client.
var dlp = DlpServiceClient.Create();
// Construct a request.
var transformation = new InfoTypeTransformations.Types.InfoTypeTransformation
{
PrimitiveTransformation = new PrimitiveTransformation
{
CharacterMaskConfig = new CharacterMaskConfig
{
MaskingCharacter = "*",
NumberToMask = 5,
ReverseOrder = false,
}
}
};
var request = new DeidentifyContentRequest
{
Parent = new LocationName(projectId, "global").ToString(),
InspectConfig = new InspectConfig
{
InfoTypes =
{
new InfoType { Name = "US_SOCIAL_SECURITY_NUMBER" }
}
},
DeidentifyConfig = new DeidentifyConfig
{
InfoTypeTransformations = new InfoTypeTransformations
{
Transformations = { transformation }
}
},
Item = new ContentItem { Value = text }
};
// Call the API.
var response = dlp.DeidentifyContent(request);
// Inspect the results.
Console.WriteLine($"Deidentified content: {response.Item.Value}");
return response;
}
}
REST
JSON과 함께 DLP API를 사용하는 데 대한 자세한 내용은 JSON 빠른 시작을 참조하세요.
HTTP 메서드 및 URL
POST https://dlp.googleapis.com/v2/projects/PROJECT_ID/content:deidentify
PROJECT_ID를 프로젝트 ID로 바꿉니다.
JSON 입력
{
"item":{
"value":"My name is Alicia Abernathy, and my email address is aabernathy@example.com."
},
"deidentifyConfig":{
"infoTypeTransformations":{
"transformations":[
{
"infoTypes":[
{
"name":"EMAIL_ADDRESS"
}
],
"primitiveTransformation":{
"characterMaskConfig":{
"maskingCharacter":"#",
"reverseOrder":false,
"charactersToIgnore":[
{
"charactersToSkip":".@"
}
]
}
}
}
]
}
},
"inspectConfig":{
"infoTypes":[
{
"name":"EMAIL_ADDRESS"
}
]
}
}
JSON 출력
{
"item":{
"value":"My name is Alicia Abernathy, and my email address is ##########@#######.###."
},
"overview":{
"transformedBytes":"22",
"transformationSummaries":[
{
"infoType":{
"name":"EMAIL_ADDRESS"
},
"transformation":{
"characterMaskConfig":{
"maskingCharacter":"#",
"charactersToIgnore":[
{
"charactersToSkip":".@"
}
]
}
},
"results":[
{
"count":"1",
"code":"SUCCESS"
}
],
"transformedBytes":"22"
}
]
}
}
암호화 기반 토큰화 변환
암호화 기반 토큰화('가명처리'라고도 함) 변환은 원래의 민감한 정보 값을 암호화된 값으로 바꾸는 익명화 방법입니다. Sensitive Data Protection은 되돌릴 수 있는 변환을 포함하여 다음과 같은 유형의 토큰화를 지원하고 재식별화를 허용합니다.
- 암호화 해싱:
CryptoKey가 지정된 경우 Sensitive Data Protection은 SHA-256 기반 메시지 인증 코드(HMAC-SHA-256)을 입력한 후 입력 값을 base64로 인코딩된 해시 값으로 바꿉니다. 다른 유형의 암호화 기반 변환과 달리 이 유형의 변환을 되돌릴 수 없습니다. - 형식 보존 암호화: FFX 작업 모드로 형식 보존 암호화(FPE)를 사용하여 생성된 토큰으로 입력 값을 대체합니다. 이 변환 메서드는 입력 값과 동일한 알파벳을 사용하고 길이가 같은 토큰을 생성합니다. FPE는 원래의 암호화 키를 바탕으로 한 재식별화도 지원합니다.
- 확정적 암호화: 합성 초기화 벡터 모드의 AES(AES-SIV)를 사용하여 생성된 토큰으로 입력 값을 대체합니다. 이 변환 메서드는 지원되는 문자열의 문자 집합에 제한이 없고, 입력 값이 동일한 각 인스턴스에 대해 동일한 토큰을 생성하며, 서로게이트를 사용하여 원래의 암호화 키를 바탕으로 재식별화가 가능하게 합니다.
암호화 해싱
암호화 해싱 변환(DLP API의 CryptoHashConfig)은 입력 값(Sensitive Data Protection이 감지한 민감한 정보)을 해시 값으로 바꿉니다. 해시 값은 CryptoKey가 지정된 입력 값에 SHA-256 기반 메시지 인증 코드(HMAC-SHA-256)를 사용하여 생성됩니다.
Sensitive Data Protection은 해시된 입력 값의 원래 값을 대신하는 base64로 인코딩된 표현을 출력합니다.
암호화 해싱 변환을 사용할 때는 다음 사항을 고려하세요.
- 입력 값은 암호화되지 않고 해시 처리됩니다.
- 이 변환은 되돌릴 수 없습니다. 즉, 변환의 해시 출력 값과 원래 암호화 키를 바탕으로 원래 값을 복원할 방법이 없습니다.
- 현재 문자열과 정수 값만 해시 처리할 수 있습니다.
- 변환의 해시 출력은 암호화 키의 크기를 기준으로 항상 동일합니다. 예를 들어 10자리 전화번호에 암호화 해싱 변환을 사용하는 경우 각 전화번호는 base64로 인코딩된 고정 길이 해시 값으로 대체됩니다.
형식 보존 암호화
형식 보존 암호화(FPE) 변환 메서드(DLP API의 CryptoReplaceFfxFpeConfig)는 입력 값(Sensitive Data Protection이 감지한 민감한 정보)을 FFX 모드의 형식 보존 암호화와 CryptoKey를 사용하여 암호화한 다음 원래 값을 암호화된 값 또는 토큰으로 바꿉니다.
입력 값의 특성은 다음과 같습니다.
- 최소 2자여야 합니다(또는 빈 문자열).
- ASCII로 인코딩되어야 합니다.
- 알파벳(입력 값에 허용되는 2~95자의 문자 집합)으로 지정된 문자로 구성되어야 합니다. 자세한 내용은
CryptoReplaceFfxFpeConfig의 알파벳 필드를 참조하세요.
생성된 토큰의 특성은 다음과 같습니다.
- 암호화된 입력 값입니다.
- 암호화 후 입력 값의 문자 집합('알파벳')과 길이를 보존합니다.
- 지정된 암호화 키를 사용하는 형식 보존 암호화(FPE)를 FFX 모드에서 사용하여 계산됩니다.
- 입력 값이 동일한 각 인스턴스는 동일한 토큰으로 익명화되기 때문에 반드시 고유하지는 않습니다. 따라서 참조 무결성을 사용 설정할 수 있으므로 익명화된 데이터를 보다 효율적으로 검색할 수 있습니다. 컨텍스트에 설명된 대로 컨텍스트를 일부 '조정'하여 이 동작을 변경할 수 있습니다.
소스 콘텐츠에 입력 값의 인스턴스가 여러 개 있으면 각 인스턴스는 동일한 토큰으로 익명화됩니다. FPE는 길이와 알파벳 공간(문자 집합)을 모두 보존하며, 길이는 95자로 제한됩니다. 컨텍스트를 일부 '조정'하여 이 동작을 변경하면 보안을 개선할 수 있습니다. 변환에 컨텍스트 조정을 추가하면 Sensitive Data Protection에서 동일한 입력 값의 여러 인스턴스를 다른 토큰으로 익명화할 수 있습니다. 원래 값의 길이와 알파벳 공간을 보존하지 않아도 되는 경우 아래에 설명 된 확정적 암호화를 사용하세요.
Sensitive Data Protection은 암호화 키를 사용하여 대체 토큰을 계산합니다. 이 키는 다음 세 가지 방법 중 하나로 제공합니다.
- API 요청에 암호화되지 않은 상태로 삽입 이는 권장되지 않습니다.
- Sensitive Data Protection을 생성하도록 요청
- API 요청에 암호화된 상태로 삽입
API 요청에 키를 삽입하도록 선택한 경우 키를 만들고 Cloud Key Management Service(Cloud KMS) 키를 사용하여 래핑(암호화)해야 합니다. 자세한 내용은 래핑된 키 만들기를 참조하세요. 반환된 값은 기본적으로 Base64 인코딩 문자열입니다. Sensitive Data Protection에서 이 값을 설정하려면 바이트 문자열로 디코딩해야 합니다. 다음 코드 스니펫은 여러 언어로 이 작업을 수행하는 방법을 보여줍니다. 엔드 투 엔드 예시는 이러한 스니펫 뒤에 제공됩니다.
Java
KmsWrappedCryptoKey.newBuilder()
.setWrappedKey(ByteString.copyFrom(BaseEncoding.base64().decode(wrappedKey)))
Python
# The wrapped key is base64-encoded, but the library expects a binary
# string, so decode it here.
import base64
wrapped_key = base64.b64decode(wrapped_key)
PHP
// Create the wrapped crypto key configuration object
$kmsWrappedCryptoKey = (new KmsWrappedCryptoKey())
->setWrappedKey(base64_decode($wrappedKey))
->setCryptoKeyName($keyName);
C#
WrappedKey = ByteString.FromBase64(wrappedKey)
Cloud KMS를 사용한 데이터 암호화 및 복호화에 대한 자세한 내용은 데이터 암호화 및 복호화를 참조하세요.
형식 보존 암호화 예시: 익명화
이 예시에서는 CryptoReplaceFfxFpeConfig 변환 메서드를 사용하여 민감한 정보를 익명화합니다. 자세한 내용은 이 페이지의 형식 보존 암호화를 참조하세요
Java
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import com.google.cloud.dlp.v2.DlpServiceClient;
import com.google.common.io.BaseEncoding;
import com.google.privacy.dlp.v2.ContentItem;
import com.google.privacy.dlp.v2.CryptoKey;
import com.google.privacy.dlp.v2.CryptoReplaceFfxFpeConfig;
import com.google.privacy.dlp.v2.CryptoReplaceFfxFpeConfig.FfxCommonNativeAlphabet;
import com.google.privacy.dlp.v2.DeidentifyConfig;
import com.google.privacy.dlp.v2.DeidentifyContentRequest;
import com.google.privacy.dlp.v2.DeidentifyContentResponse;
import com.google.privacy.dlp.v2.InfoType;
import com.google.privacy.dlp.v2.InfoTypeTransformations;
import com.google.privacy.dlp.v2.InfoTypeTransformations.InfoTypeTransformation;
import com.google.privacy.dlp.v2.InspectConfig;
import com.google.privacy.dlp.v2.KmsWrappedCryptoKey;
import com.google.privacy.dlp.v2.LocationName;
import com.google.privacy.dlp.v2.PrimitiveTransformation;
import com.google.protobuf.ByteString;
import java.io.IOException;
import java.util.Arrays;
public class DeIdentifyWithFpe {
public static void main(String[] args) throws Exception {
// TODO(developer): Replace these variables before running the sample.
String projectId = "your-project-id";
String textToDeIdentify = "I'm Gary and my SSN is 552096781";
String kmsKeyName =
"projects/YOUR_PROJECT/"
+ "locations/YOUR_KEYRING_REGION/"
+ "keyRings/YOUR_KEYRING_NAME/"
+ "cryptoKeys/YOUR_KEY_NAME";
String wrappedAesKey = "YOUR_ENCRYPTED_AES_256_KEY";
deIdentifyWithFpe(projectId, textToDeIdentify, kmsKeyName, wrappedAesKey);
}
public static void deIdentifyWithFpe(
String projectId, String textToDeIdentify, String kmsKeyName, String wrappedAesKey)
throws IOException {
// Initialize client that will be used to send requests. This client only needs to be created
// once, and can be reused for multiple requests. After completing all of your requests, call
// the "close" method on the client to safely clean up any remaining background resources.
try (DlpServiceClient dlp = DlpServiceClient.create()) {
// Specify what content you want the service to DeIdentify
ContentItem contentItem = ContentItem.newBuilder().setValue(textToDeIdentify).build();
// Specify the type of info the inspection will look for.
// See https://cloud.google.com/dlp/docs/infotypes-reference for complete list of info types
InfoType infoType = InfoType.newBuilder().setName("US_SOCIAL_SECURITY_NUMBER").build();
InspectConfig inspectConfig =
InspectConfig.newBuilder().addAllInfoTypes(Arrays.asList(infoType)).build();
// Specify an encrypted AES-256 key and the name of the Cloud KMS key that encrypted it
KmsWrappedCryptoKey kmsWrappedCryptoKey =
KmsWrappedCryptoKey.newBuilder()
.setWrappedKey(ByteString.copyFrom(BaseEncoding.base64().decode(wrappedAesKey)))
.setCryptoKeyName(kmsKeyName)
.build();
CryptoKey cryptoKey = CryptoKey.newBuilder().setKmsWrapped(kmsWrappedCryptoKey).build();
// Specify how the info from the inspection should be encrypted.
InfoType surrogateInfoType = InfoType.newBuilder().setName("SSN_TOKEN").build();
CryptoReplaceFfxFpeConfig cryptoReplaceFfxFpeConfig =
CryptoReplaceFfxFpeConfig.newBuilder()
.setCryptoKey(cryptoKey)
// Set of characters in the input text. For more info, see
// https://cloud.google.com/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#DeidentifyTemplate.FfxCommonNativeAlphabet
.setCommonAlphabet(FfxCommonNativeAlphabet.NUMERIC)
.setSurrogateInfoType(surrogateInfoType)
.build();
PrimitiveTransformation primitiveTransformation =
PrimitiveTransformation.newBuilder()
.setCryptoReplaceFfxFpeConfig(cryptoReplaceFfxFpeConfig)
.build();
InfoTypeTransformation infoTypeTransformation =
InfoTypeTransformation.newBuilder()
.setPrimitiveTransformation(primitiveTransformation)
.build();
InfoTypeTransformations transformations =
InfoTypeTransformations.newBuilder().addTransformations(infoTypeTransformation).build();
DeidentifyConfig deidentifyConfig =
DeidentifyConfig.newBuilder().setInfoTypeTransformations(transformations).build();
// Combine configurations into a request for the service.
DeidentifyContentRequest request =
DeidentifyContentRequest.newBuilder()
.setParent(LocationName.of(projectId, "global").toString())
.setItem(contentItem)
.setInspectConfig(inspectConfig)
.setDeidentifyConfig(deidentifyConfig)
.build();
// Send the request and receive response from the service
DeidentifyContentResponse response = dlp.deidentifyContent(request);
// Print the results
System.out.println(
"Text after format-preserving encryption: " + response.getItem().getValue());
}
}
}Node.js
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
// Imports the Google Cloud Data Loss Prevention library
const DLP = require('@google-cloud/dlp');
// Instantiates a client
const dlp = new DLP.DlpServiceClient();
// The project ID to run the API call under
// const projectId = 'my-project';
// The string to deidentify
// const string = 'My SSN is 372819127';
// The set of characters to replace sensitive ones with
// For more information, see https://cloud.google.com/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#ffxcommonnativealphabet
// const alphabet = 'ALPHA_NUMERIC';
// The name of the Cloud KMS key used to encrypt ('wrap') the AES-256 key
// const keyName = 'projects/YOUR_GCLOUD_PROJECT/locations/YOUR_LOCATION/keyRings/YOUR_KEYRING_NAME/cryptoKeys/YOUR_KEY_NAME';
// The encrypted ('wrapped') AES-256 key to use
// This key should be encrypted using the Cloud KMS key specified above
// const wrappedKey = 'YOUR_ENCRYPTED_AES_256_KEY'
// (Optional) The name of the surrogate custom info type to use
// Only necessary if you want to reverse the deidentification process
// Can be essentially any arbitrary string, as long as it doesn't appear
// in your dataset otherwise.
// const surrogateType = 'SOME_INFO_TYPE_DEID';
async function deidentifyWithFpe() {
// Construct FPE config
const cryptoReplaceFfxFpeConfig = {
cryptoKey: {
kmsWrapped: {
wrappedKey: wrappedKey,
cryptoKeyName: keyName,
},
},
commonAlphabet: alphabet,
};
if (surrogateType) {
cryptoReplaceFfxFpeConfig.surrogateInfoType = {
name: surrogateType,
};
}
// Construct deidentification request
const item = {value: string};
const request = {
parent: `projects/${projectId}/locations/global`,
deidentifyConfig: {
infoTypeTransformations: {
transformations: [
{
primitiveTransformation: {
cryptoReplaceFfxFpeConfig: cryptoReplaceFfxFpeConfig,
},
},
],
},
},
item: item,
};
// Run deidentification request
const [response] = await dlp.deidentifyContent(request);
const deidentifiedItem = response.item;
console.log(deidentifiedItem.value);
}
deidentifyWithFpe();Python
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import base64
from typing import List
import google.cloud.dlp
def deidentify_with_fpe(
project: str,
input_str: str,
info_types: List[str],
alphabet: str = None,
surrogate_type: str = None,
key_name: str = None,
wrapped_key: str = None,
) -> None:
"""Uses the Data Loss Prevention API to deidentify sensitive data in a
string using Format Preserving Encryption (FPE).
Args:
project: The Google Cloud project id to use as a parent resource.
input_str: The string to deidentify (will be treated as text).
info_types: A list of strings representing info types to look for.
alphabet: The set of characters to replace sensitive ones with. For
more information, see https://cloud.google.com/dlp/docs/reference/
rest/v2beta2/organizations.deidentifyTemplates#ffxcommonnativealphabet
surrogate_type: The name of the surrogate custom info type to use. Only
necessary if you want to reverse the deidentification process. Can
be essentially any arbitrary string, as long as it doesn't appear
in your dataset otherwise.
key_name: The name of the Cloud KMS key used to encrypt ('wrap') the
AES-256 key. Example:
key_name = 'projects/YOUR_GCLOUD_PROJECT/locations/YOUR_LOCATION/
keyRings/YOUR_KEYRING_NAME/cryptoKeys/YOUR_KEY_NAME'
wrapped_key: The encrypted ('wrapped') AES-256 key to use. This key
should be encrypted using the Cloud KMS key specified by key_name.
Returns:
None; the response from the API is printed to the terminal.
"""
# Instantiate a client
dlp = google.cloud.dlp_v2.DlpServiceClient()
# Convert the project id into a full resource id.
parent = f"projects/{project}/locations/global"
# The wrapped key is base64-encoded, but the library expects a binary
# string, so decode it here.
wrapped_key = base64.b64decode(wrapped_key)
# Construct FPE configuration dictionary
crypto_replace_ffx_fpe_config = {
"crypto_key": {
"kms_wrapped": {"wrapped_key": wrapped_key, "crypto_key_name": key_name}
},
"common_alphabet": alphabet,
}
# Add surrogate type
if surrogate_type:
crypto_replace_ffx_fpe_config["surrogate_info_type"] = {"name": surrogate_type}
# Construct inspect configuration dictionary
inspect_config = {"info_types": [{"name": info_type} for info_type in info_types]}
# Construct deidentify configuration dictionary
deidentify_config = {
"info_type_transformations": {
"transformations": [
{
"primitive_transformation": {
"crypto_replace_ffx_fpe_config": crypto_replace_ffx_fpe_config
}
}
]
}
}
# Convert string to item
item = {"value": input_str}
# Call the API
response = dlp.deidentify_content(
request={
"parent": parent,
"deidentify_config": deidentify_config,
"inspect_config": inspect_config,
"item": item,
}
)
# Print results
print(response.item.value)
Go
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import (
"context"
"encoding/base64"
"fmt"
"io"
dlp "cloud.google.com/go/dlp/apiv2"
"cloud.google.com/go/dlp/apiv2/dlppb"
)
// deidentifyFPE deidentifies the input with FPE (Format Preserving Encryption).
// keyFileName is the file name with the KMS wrapped key and cryptoKeyName is the
// full KMS key resource name used to wrap the key. surrogateInfoType is an
// optional identifier needed for reidentification. surrogateInfoType can be any
// value not found in your input.
// Info types can be found with the infoTypes.list method or on https://cloud.google.com/dlp/docs/infotypes-reference
func deidentifyFPE(w io.Writer, projectID, input string, infoTypeNames []string, kmsKeyName, wrappedAESKey, surrogateInfoType string) error {
// projectID := "my-project-id"
// input := "My SSN is 123456789"
// infoTypeNames := []string{"US_SOCIAL_SECURITY_NUMBER"}
// kmsKeyName := "projects/YOUR_GCLOUD_PROJECT/locations/YOUR_LOCATION/keyRings/YOUR_KEYRING_NAME/cryptoKeys/YOUR_KEY_NAME"
// wrappedAESKey := "YOUR_ENCRYPTED_AES_256_KEY"
// surrogateInfoType := "AGE"
ctx := context.Background()
client, err := dlp.NewClient(ctx)
if err != nil {
return fmt.Errorf("dlp.NewClient: %w", err)
}
defer client.Close()
// Convert the info type strings to a list of InfoTypes.
var infoTypes []*dlppb.InfoType
for _, it := range infoTypeNames {
infoTypes = append(infoTypes, &dlppb.InfoType{Name: it})
}
// Specify an encrypted AES-256 key and the name of the Cloud KMS key that encrypted it.
kmsWrappedCryptoKey, err := base64.StdEncoding.DecodeString(wrappedAESKey)
if err != nil {
return err
}
// Create a configured request.
req := &dlppb.DeidentifyContentRequest{
Parent: fmt.Sprintf("projects/%s/locations/global", projectID),
InspectConfig: &dlppb.InspectConfig{
InfoTypes: infoTypes,
},
DeidentifyConfig: &dlppb.DeidentifyConfig{
Transformation: &dlppb.DeidentifyConfig_InfoTypeTransformations{
InfoTypeTransformations: &dlppb.InfoTypeTransformations{
Transformations: []*dlppb.InfoTypeTransformations_InfoTypeTransformation{
{
InfoTypes: []*dlppb.InfoType{}, // Match all info types.
PrimitiveTransformation: &dlppb.PrimitiveTransformation{
Transformation: &dlppb.PrimitiveTransformation_CryptoReplaceFfxFpeConfig{
CryptoReplaceFfxFpeConfig: &dlppb.CryptoReplaceFfxFpeConfig{
CryptoKey: &dlppb.CryptoKey{
Source: &dlppb.CryptoKey_KmsWrapped{
KmsWrapped: &dlppb.KmsWrappedCryptoKey{
WrappedKey: kmsWrappedCryptoKey,
CryptoKeyName: kmsKeyName,
},
},
},
// Set the alphabet used for the output.
Alphabet: &dlppb.CryptoReplaceFfxFpeConfig_CommonAlphabet{
CommonAlphabet: dlppb.CryptoReplaceFfxFpeConfig_ALPHA_NUMERIC,
},
// Set the surrogate info type, used for reidentification.
SurrogateInfoType: &dlppb.InfoType{
Name: surrogateInfoType,
},
},
},
},
},
},
},
},
},
// The item to analyze.
Item: &dlppb.ContentItem{
DataItem: &dlppb.ContentItem_Value{
Value: input,
},
},
}
// Send the request.
r, err := client.DeidentifyContent(ctx, req)
if err != nil {
return fmt.Errorf("DeidentifyContent: %w", err)
}
// Print the result.
fmt.Fprint(w, r.GetItem().GetValue())
return nil
}
PHP
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
use Google\Cloud\Dlp\V2\Client\DlpServiceClient;
use Google\Cloud\Dlp\V2\ContentItem;
use Google\Cloud\Dlp\V2\CryptoKey;
use Google\Cloud\Dlp\V2\CryptoReplaceFfxFpeConfig;
use Google\Cloud\Dlp\V2\CryptoReplaceFfxFpeConfig\FfxCommonNativeAlphabet;
use Google\Cloud\Dlp\V2\DeidentifyConfig;
use Google\Cloud\Dlp\V2\DeidentifyContentRequest;
use Google\Cloud\Dlp\V2\InfoType;
use Google\Cloud\Dlp\V2\InfoTypeTransformations;
use Google\Cloud\Dlp\V2\InfoTypeTransformations\InfoTypeTransformation;
use Google\Cloud\Dlp\V2\KmsWrappedCryptoKey;
use Google\Cloud\Dlp\V2\PrimitiveTransformation;
/**
* Deidentify a string using Format-Preserving Encryption (FPE).
*
* @param string $callingProjectId The GCP Project ID to run the API call under
* @param string $string The string to deidentify
* @param string $keyName The name of the Cloud KMS key used to encrypt (wrap) the AES-256 key
* @param string $wrappedKey The name of the Cloud KMS key use, encrypted with the KMS key in $keyName
* @param string $surrogateTypeName (Optional) surrogate custom info type to enable reidentification
*/
function deidentify_fpe(
string $callingProjectId,
string $string,
string $keyName,
string $wrappedKey,
string $surrogateTypeName = ''
): void {
// Instantiate a client.
$dlp = new DlpServiceClient();
// The infoTypes of information to mask
$ssnInfoType = (new InfoType())
->setName('US_SOCIAL_SECURITY_NUMBER');
$infoTypes = [$ssnInfoType];
// Create the wrapped crypto key configuration object
$kmsWrappedCryptoKey = (new KmsWrappedCryptoKey())
->setWrappedKey(base64_decode($wrappedKey))
->setCryptoKeyName($keyName);
// The set of characters to replace sensitive ones with
// For more information, see https://cloud.google.com/dlp/docs/reference/rest/V2/organizations.deidentifyTemplates#ffxcommonnativealphabet
$commonAlphabet = FfxCommonNativeAlphabet::NUMERIC;
// Create the crypto key configuration object
$cryptoKey = (new CryptoKey())
->setKmsWrapped($kmsWrappedCryptoKey);
// Create the crypto FFX FPE configuration object
$cryptoReplaceFfxFpeConfig = (new CryptoReplaceFfxFpeConfig())
->setCryptoKey($cryptoKey)
->setCommonAlphabet($commonAlphabet);
if ($surrogateTypeName) {
$surrogateType = (new InfoType())
->setName($surrogateTypeName);
$cryptoReplaceFfxFpeConfig->setSurrogateInfoType($surrogateType);
}
// Create the information transform configuration objects
$primitiveTransformation = (new PrimitiveTransformation())
->setCryptoReplaceFfxFpeConfig($cryptoReplaceFfxFpeConfig);
$infoTypeTransformation = (new InfoTypeTransformation())
->setPrimitiveTransformation($primitiveTransformation)
->setInfoTypes($infoTypes);
$infoTypeTransformations = (new InfoTypeTransformations())
->setTransformations([$infoTypeTransformation]);
// Create the deidentification configuration object
$deidentifyConfig = (new DeidentifyConfig())
->setInfoTypeTransformations($infoTypeTransformations);
$content = (new ContentItem())
->setValue($string);
$parent = "projects/$callingProjectId/locations/global";
// Run request
$deidentifyContentRequest = (new DeidentifyContentRequest())
->setParent($parent)
->setDeidentifyConfig($deidentifyConfig)
->setItem($content);
$response = $dlp->deidentifyContent($deidentifyContentRequest);
// Print the results
$deidentifiedValue = $response->getItem()->getValue();
print($deidentifiedValue);
}C#
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
using System;
using System.Collections.Generic;
using Google.Api.Gax.ResourceNames;
using Google.Cloud.Dlp.V2;
using Google.Protobuf;
using static Google.Cloud.Dlp.V2.CryptoReplaceFfxFpeConfig.Types;
public class DeidentifyWithFpe
{
public static DeidentifyContentResponse Deidentify(
string projectId,
string dataValue,
IEnumerable<InfoType> infoTypes,
string keyName,
string wrappedKey,
FfxCommonNativeAlphabet alphabet)
{
var deidentifyConfig = new DeidentifyConfig
{
InfoTypeTransformations = new InfoTypeTransformations
{
Transformations =
{
new InfoTypeTransformations.Types.InfoTypeTransformation
{
PrimitiveTransformation = new PrimitiveTransformation
{
CryptoReplaceFfxFpeConfig = new CryptoReplaceFfxFpeConfig
{
CommonAlphabet = alphabet,
CryptoKey = new CryptoKey
{
KmsWrapped = new KmsWrappedCryptoKey
{
CryptoKeyName = keyName,
WrappedKey = ByteString.FromBase64 (wrappedKey)
}
},
SurrogateInfoType = new InfoType
{
Name = "TOKEN"
}
}
}
}
}
}
};
var dlp = DlpServiceClient.Create();
var response = dlp.DeidentifyContent(
new DeidentifyContentRequest
{
Parent = new LocationName(projectId, "global").ToString(),
InspectConfig = new InspectConfig
{
InfoTypes = { infoTypes }
},
DeidentifyConfig = deidentifyConfig,
Item = new ContentItem { Value = dataValue }
});
Console.WriteLine($"Deidentified content: {response.Item.Value}");
return response;
}
}
형식 보존 암호화 예시: 서로게이트 유형으로 익명화
이 예시에서는 CryptoReplaceFfxFpeConfig 변환 메서드를 사용하여 민감한 정보를 익명화합니다. 자세한 내용은 이 페이지의 형식 보존 암호화를 참조하세요
Go
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import (
"context"
"encoding/base64"
"fmt"
"io"
dlp "cloud.google.com/go/dlp/apiv2"
"cloud.google.com/go/dlp/apiv2/dlppb"
)
// deidentifyFreeTextWithFPEUsingSurrogate de-identifies free text with FPE by using a surrogate
func deidentifyFreeTextWithFPEUsingSurrogate(w io.Writer, projectID, inputStr, infoType, surrogateType, unwrappedKey string) error {
// projectId := "your-project-id"
// inputStr := "My phone number is 9824376677"
// infoType := "PHONE_NUMBER"
// surrogateType := "PHONE_TOKEN"
// unwrappedKey := "The base64-encoded AES-256 key to use"
ctx := context.Background()
// Initialize a client once and reuse it to send multiple requests. Clients
// are safe to use across goroutines. When the client is no longer needed,
// call the Close method to cleanup its resources.
client, err := dlp.NewClient(ctx)
if err != nil {
return err
}
// Closing the client safely cleans up background resources.
defer client.Close()
// decoding the unwrapped key
keyDecode, err := base64.StdEncoding.DecodeString(unwrappedKey)
if err != nil {
return err
}
inspectConfig := &dlppb.InspectConfig{
InfoTypes: []*dlppb.InfoType{
{Name: infoType},
},
MinLikelihood: dlppb.Likelihood_UNLIKELY,
}
// specify the content to be de-identified
contentItem := &dlppb.ContentItem{
DataItem: &dlppb.ContentItem_Value{
Value: inputStr,
},
}
// Specify how the content should be encrypted.
cryptoReplaceConfig := &dlppb.CryptoReplaceFfxFpeConfig{
CryptoKey: &dlppb.CryptoKey{
Source: &dlppb.CryptoKey_Unwrapped{
Unwrapped: &dlppb.UnwrappedCryptoKey{
Key: keyDecode,
},
},
},
Alphabet: &dlppb.CryptoReplaceFfxFpeConfig_CommonAlphabet{
CommonAlphabet: dlppb.CryptoReplaceFfxFpeConfig_NUMERIC,
},
SurrogateInfoType: &dlppb.InfoType{
Name: surrogateType,
},
}
// Apply crypto replace config to primitive transformation.
primitiveTransformation := &dlppb.PrimitiveTransformation{
Transformation: &dlppb.PrimitiveTransformation_CryptoReplaceFfxFpeConfig{
CryptoReplaceFfxFpeConfig: cryptoReplaceConfig,
},
}
infoTypeTransformation := &dlppb.DeidentifyConfig_InfoTypeTransformations{
InfoTypeTransformations: &dlppb.InfoTypeTransformations{
Transformations: []*dlppb.InfoTypeTransformations_InfoTypeTransformation{
{
InfoTypes: []*dlppb.InfoType{
{Name: infoType},
},
PrimitiveTransformation: primitiveTransformation,
},
},
},
}
// Construct the de-identification request to be sent by the client.
req := &dlppb.DeidentifyContentRequest{
Parent: fmt.Sprintf("projects/%s/locations/global", projectID),
DeidentifyConfig: &dlppb.DeidentifyConfig{
Transformation: infoTypeTransformation,
},
InspectConfig: inspectConfig,
Item: contentItem,
}
// Send the request.
resp, err := client.DeidentifyContent(ctx, req)
if err != nil {
return err
}
// Print the results.
fmt.Fprintf(w, "output: %v", resp.GetItem().GetValue())
return nil
}
Java
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import com.google.cloud.dlp.v2.DlpServiceClient;
import com.google.common.io.BaseEncoding;
import com.google.privacy.dlp.v2.ContentItem;
import com.google.privacy.dlp.v2.CryptoKey;
import com.google.privacy.dlp.v2.CryptoReplaceFfxFpeConfig;
import com.google.privacy.dlp.v2.DeidentifyConfig;
import com.google.privacy.dlp.v2.DeidentifyContentRequest;
import com.google.privacy.dlp.v2.DeidentifyContentResponse;
import com.google.privacy.dlp.v2.InfoType;
import com.google.privacy.dlp.v2.InfoTypeTransformations;
import com.google.privacy.dlp.v2.InfoTypeTransformations.InfoTypeTransformation;
import com.google.privacy.dlp.v2.InspectConfig;
import com.google.privacy.dlp.v2.LocationName;
import com.google.privacy.dlp.v2.PrimitiveTransformation;
import com.google.privacy.dlp.v2.UnwrappedCryptoKey;
import com.google.protobuf.ByteString;
import java.io.IOException;
import java.util.Base64;
import java.util.Collections;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
public class DeidentifyFreeTextWithFpeUsingSurrogate {
public static void main(String[] args) throws Exception {
// TODO(developer): Replace these variables before running the sample.
// The Google Cloud project id to use as a parent resource.
String projectId = "your-project-id";
// The string to de-identify.
String textToDeIdentify = "My phone number is 4359916732";
// The base64-encoded key to use.
String base64EncodedKey = "your-base64-encoded-key";
deIdentifyWithFpeSurrogate(projectId, textToDeIdentify, base64EncodedKey);
}
/**
* Uses the Data Loss Prevention API to deidentify sensitive data in a string using Format
* Preserving Encryption (FPE).The encryption is performed with an unwrapped key.
*
* @param projectId The Google Cloud project id to use as a parent resource.
* @param textToDeIdentify The string to deidentify.
* @param unwrappedKey The base64-encoded AES-256 key to use.
*/
public static String deIdentifyWithFpeSurrogate(
String projectId, String textToDeIdentify, String unwrappedKey) throws IOException {
// Initialize client that will be used to send requests. This client only needs to be created
// once, and can be reused for multiple requests. After completing all of your requests, call
// the "close" method on the client to safely clean up any remaining background resources.
try (DlpServiceClient dlp = DlpServiceClient.create()) {
// Set the text to be de-identified.
ContentItem contentItem = ContentItem.newBuilder().setValue(textToDeIdentify).build();
// Specify the InfoType the inspection will look for.
// See https://cloud.google.com/dlp/docs/infotypes-reference for complete list of info types
InfoType infoType = InfoType.newBuilder()
.setName("PHONE_NUMBER").build();
InspectConfig inspectConfig =
InspectConfig.newBuilder()
.addAllInfoTypes(Collections.singletonList(infoType)).build();
// Specify an unwrapped crypto key.
UnwrappedCryptoKey unwrappedCryptoKey =
UnwrappedCryptoKey.newBuilder()
.setKey(ByteString.copyFrom(BaseEncoding.base64().decode(unwrappedKey)))
.build();
CryptoKey cryptoKey = CryptoKey.newBuilder().setUnwrapped(unwrappedCryptoKey).build();
InfoType surrogateInfoType = InfoType.newBuilder().setName("PHONE_TOKEN").build();
// Specify how the info from the inspection should be encrypted.
CryptoReplaceFfxFpeConfig cryptoReplaceFfxFpeConfig =
CryptoReplaceFfxFpeConfig.newBuilder()
.setCryptoKey(cryptoKey)
// Set of characters in the input text. For more info, see
// https://cloud.google.com/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#DeidentifyTemplate.FfxCommonNativeAlphabet
.setCommonAlphabet(CryptoReplaceFfxFpeConfig.FfxCommonNativeAlphabet.NUMERIC)
.setSurrogateInfoType(surrogateInfoType)
.build();
PrimitiveTransformation primitiveTransformation =
PrimitiveTransformation.newBuilder()
.setCryptoReplaceFfxFpeConfig(cryptoReplaceFfxFpeConfig)
.build();
InfoTypeTransformation infoTypeTransformation =
InfoTypeTransformation.newBuilder()
.setPrimitiveTransformation(primitiveTransformation)
.build();
InfoTypeTransformations transformations =
InfoTypeTransformations.newBuilder()
.addTransformations(infoTypeTransformation).build();
DeidentifyConfig deidentifyConfig =
DeidentifyConfig.newBuilder()
.setInfoTypeTransformations(transformations).build();
// Combine configurations into a request for the service.
DeidentifyContentRequest request =
DeidentifyContentRequest.newBuilder()
.setParent(LocationName.of(projectId, "global").toString())
.setItem(contentItem)
.setInspectConfig(inspectConfig)
.setDeidentifyConfig(deidentifyConfig)
.build();
// Send the request and receive response from the service.
DeidentifyContentResponse response = dlp.deidentifyContent(request);
// Print the results.
System.out.println("Text after de-identification: " + response.getItem().getValue());
return response.getItem().getValue();
}
}
}
Node.js
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
// Imports the Google Cloud Data Loss Prevention library
const DLP = require('@google-cloud/dlp');
// Instantiates a client
const dlp = new DLP.DlpServiceClient();
// The project ID to run the API call under
// const projectId = 'my-project';
// The string to de-identify
// const string = 'My phone number is 4359916732';
// The set of characters to replace sensitive ones with
// For more information, see https://cloud.google.com/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#ffxcommonnativealphabet
// const alphabet = 'NUMERIC';
// InfoTypes
// const infoTypes = [{name: 'PHONE_NUMBER'}];
// Surrogate Type
// const surrogateType = 'PHONE_TOKEN';
// The base64-encoded AES-256 key to use
// const unwrappedKey = 'YWJjZGVmZ2hpamtsbW5vcA==';
async function deidentifyWithFpeSurrogate() {
// Specify an unwrapped crypto key.
unwrappedKey = Buffer.from(unwrappedKey, 'base64');
// Specify how the info from the inspection should be encrypted.
const cryptoReplaceFfxFpeConfig = {
cryptoKey: {
unwrapped: {
key: unwrappedKey,
},
},
commonAlphabet: alphabet,
surrogateInfoType: {name: surrogateType},
};
// Construct the inspect configuration.
const inspectConfig = {
infoTypes: infoTypes,
minLikelihood: DLP.protos.google.privacy.dlp.v2.Likelihood.UNLIKELY,
};
// Set the text to be de-identified.
const item = {value: string};
// Combine configurations into a request for the service.
const request = {
parent: `projects/${projectId}/locations/global`,
deidentifyConfig: {
infoTypeTransformations: {
transformations: [
{
primitiveTransformation: {
cryptoReplaceFfxFpeConfig: cryptoReplaceFfxFpeConfig,
},
},
],
},
},
item: item,
inspectConfig: inspectConfig,
};
// Run de-identification request
const [response] = await dlp.deidentifyContent(request);
const deidentifiedItem = response.item;
// Print results
console.log(deidentifiedItem.value);
}
deidentifyWithFpeSurrogate();PHP
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
/**
* Deidentify free text with fpe using surrogate.
* Uses the Data Loss Prevention API to de-identify sensitive data in a string using format-preserving
* encryption (FPE). The encryption is performed with an unwrapped key.
*
* @param string $callingProjectId The GCP Project ID to run the API call under.
* @param string $string The string to deidentify (will be treated as text).
* @param string $unwrappedKey The base64-encoded AES-256 key to use.
* @param string $surrogateTypeName The name of the surrogate custom info type to use.
* Can be essentially any arbitrary string, as long as it doesn't appear in your dataset otherwise.
*/
function deidentify_free_text_with_fpe_using_surrogate(
// TODO(developer): Replace sample parameters before running the code.
string $callingProjectId,
string $string = 'My PHONE NUMBER IS 731997681',
string $unwrappedKey = 'YWJjZGVmZ2hpamtsbW5vcA==',
string $surrogateTypeName = 'PHONE_TOKEN'
): void {
// Instantiate a client.
$dlp = new DlpServiceClient();
$parent = "projects/$callingProjectId/locations/global";
// Specify an unwrapped crypto key.
$unwrapped = (new UnwrappedCryptoKey())
->setKey(base64_decode($unwrappedKey));
$cryptoKey = (new CryptoKey())
->setUnwrapped($unwrapped);
// Create the surrogate type configuration object.
$surrogateType = (new InfoType())
->setName($surrogateTypeName);
// The set of characters to replace sensitive ones with.
// For more information, see https://cloud.google.com/dlp/docs/reference/rest/V2/organizations.deidentifyTemplates#ffxcommonnativealphabet
$commonAlphabet = FfxCommonNativeAlphabet::NUMERIC;
// Specify how to decrypt the previously de-identified information.
$cryptoReplaceFfxFpeConfig = (new CryptoReplaceFfxFpeConfig())
->setCryptoKey($cryptoKey)
->setCommonAlphabet($commonAlphabet)
->setSurrogateInfoType($surrogateType);
// Create the information transform configuration objects.
$primitiveTransformation = (new PrimitiveTransformation())
->setCryptoReplaceFfxFpeConfig($cryptoReplaceFfxFpeConfig);
// The infoTypes of information to mask.
$infoType = (new InfoType())
->setName('PHONE_NUMBER');
$infoTypes = [$infoType];
$infoTypeTransformation = (new InfoTypeTransformation())
->setPrimitiveTransformation($primitiveTransformation)
->setInfoTypes($infoTypes);
$infoTypeTransformations = (new InfoTypeTransformations())
->setTransformations([$infoTypeTransformation]);
// Create the deidentification configuration object.
$deidentifyConfig = (new DeidentifyConfig())
->setInfoTypeTransformations($infoTypeTransformations);
// Specify the content to be de-identify.
$content = (new ContentItem())
->setValue($string);
// Create the configuration object.
$inspectConfig = (new InspectConfig())
/* Construct the inspect config, trying to finding all PII with likelihood
higher than UNLIKELY */
->setMinLikelihood(likelihood::UNLIKELY)
->setInfoTypes($infoTypes);
// Run request.
$deidentifyContentRequest = (new DeidentifyContentRequest())
->setParent($parent)
->setDeidentifyConfig($deidentifyConfig)
->setItem($content)
->setInspectConfig($inspectConfig);
$response = $dlp->deidentifyContent($deidentifyContentRequest);
// Print the results.
printf($response->getItem()->getValue());
}Python
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import base64
import google.cloud.dlp
def deidentify_free_text_with_fpe_using_surrogate(
project: str,
input_str: str,
alphabet: str = "NUMERIC",
info_type: str = "PHONE_NUMBER",
surrogate_type: str = "PHONE_TOKEN",
unwrapped_key: str = "YWJjZGVmZ2hpamtsbW5vcA==",
) -> None:
"""Uses the Data Loss Prevention API to deidentify sensitive data in a
string using Format Preserving Encryption (FPE).
The encryption is performed with an unwrapped key.
Args:
project: The Google Cloud project id to use as a parent resource.
input_str: The string to deidentify (will be treated as text).
alphabet: The set of characters to replace sensitive ones with. For
more information, see https://cloud.google.com/dlp/docs/reference/
rest/v2beta2/organizations.deidentifyTemplates#ffxcommonnativealphabet
info_type: The name of the info type to de-identify
surrogate_type: The name of the surrogate custom info type to use. Can
be essentially any arbitrary string, as long as it doesn't appear
in your dataset otherwise.
unwrapped_key: The base64-encoded AES-256 key to use.
Returns:
None; the response from the API is printed to the terminal.
"""
# Instantiate a client
dlp = google.cloud.dlp_v2.DlpServiceClient()
# Convert the project id into a full resource id.
parent = f"projects/{project}/locations/global"
# The wrapped key is base64-encoded, but the library expects a binary
# string, so decode it here.
unwrapped_key = base64.b64decode(unwrapped_key)
# Construct de-identify config
transformation = {
"info_types": [{"name": info_type}],
"primitive_transformation": {
"crypto_replace_ffx_fpe_config": {
"crypto_key": {"unwrapped": {"key": unwrapped_key}},
"common_alphabet": alphabet,
"surrogate_info_type": {"name": surrogate_type},
}
},
}
deidentify_config = {
"info_type_transformations": {"transformations": [transformation]}
}
# Construct the inspect config, trying to finding all PII with likelihood
# higher than UNLIKELY
inspect_config = {
"info_types": [{"name": info_type}],
"min_likelihood": google.cloud.dlp_v2.Likelihood.UNLIKELY,
}
# Convert string to item
item = {"value": input_str}
# Call the API
response = dlp.deidentify_content(
request={
"parent": parent,
"deidentify_config": deidentify_config,
"inspect_config": inspect_config,
"item": item,
}
)
# Print results
print(response.item.value)
C#
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
using System;
using System.Collections.Generic;
using Google.Api.Gax.ResourceNames;
using Google.Cloud.Dlp.V2;
using Google.Protobuf;
using static Google.Cloud.Dlp.V2.CryptoReplaceFfxFpeConfig.Types;
public class DeidentifyFreeTextWithFpeUsingSurrogate
{
public static DeidentifyContentResponse Deidentify(
string projectId,
string text,
string unwrappedKey,
IEnumerable<InfoType> infoTypes = null,
FfxCommonNativeAlphabet alphabet = FfxCommonNativeAlphabet.Numeric,
InfoType surrogateType = null)
{
// Instantiate a client.
var dlp = DlpServiceClient.Create();
// Specify the type of info to be inspected and construct the inspect config.
var inspectConfig = new InspectConfig
{
InfoTypes =
{
infoTypes ?? new InfoType[]
{
new InfoType { Name = "PHONE_NUMBER" }
}
},
MinLikelihood = Likelihood.Unlikely
};
// Construct the crypto replace ffxfpe config by providing the unwrapped crypto key.
var cryptoReplaceFfxFpeConfig = new CryptoReplaceFfxFpeConfig
{
CommonAlphabet = alphabet,
CryptoKey = new CryptoKey
{
Unwrapped = new UnwrappedCryptoKey
{
Key = ByteString.FromBase64(unwrappedKey)
}
},
SurrogateInfoType = surrogateType ?? new InfoType { Name = "PHONE_TOKEN" }
};
// Construct the deidentify config using crypto config created above.
var deidentifyConfig = new DeidentifyConfig
{
InfoTypeTransformations = new InfoTypeTransformations
{
Transformations =
{
new InfoTypeTransformations.Types.InfoTypeTransformation
{
PrimitiveTransformation = new PrimitiveTransformation
{
CryptoReplaceFfxFpeConfig = cryptoReplaceFfxFpeConfig
}
}
}
}
};
// Construct the request.
var request = new DeidentifyContentRequest
{
ParentAsLocationName = new LocationName(projectId, "global"),
DeidentifyConfig = deidentifyConfig,
InspectConfig = inspectConfig,
Item = new ContentItem { Value = text }
};
// Call the API.
DeidentifyContentResponse response = dlp.DeidentifyContent(request);
// Check the de-identified content.
Console.WriteLine($"De-identified content: {response.Item.Value}");
return response;
}
}
형식 보존 암호화 예시: 테이블에서 민감한 정보 익명화
이 예시에서는 CryptoReplaceFfxFpeConfig 변환 메서드를 사용하여 테이블의 민감한 정보를 익명화합니다. 자세한 내용은 이 페이지의 형식 보존 암호화를 참조하세요
C#
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
using System;
using Google.Api.Gax.ResourceNames;
using Google.Cloud.Dlp.V2;
using Google.Protobuf;
using static Google.Cloud.Dlp.V2.CryptoReplaceFfxFpeConfig.Types;
public class DeidentifyTableWithFpe
{
public static Table DeidentifyTable(
string projectId,
string keyName,
string wrappedKey,
FfxCommonNativeAlphabet alphabet = FfxCommonNativeAlphabet.Numeric,
Table tableToInspect = null)
{
// Instantiate a client.
var dlp = DlpServiceClient.Create();
// Construct the table if null.
if (tableToInspect == null)
{
var row1 = new Value[]
{
new Value { StringValue = "11111" },
new Value { StringValue = "2015" },
new Value { StringValue = "$10" }
};
var row2 = new Value[]
{
new Value { StringValue = "33333" },
new Value { StringValue = "2016" },
new Value { StringValue = "$20" }
};
var row3 = new Value[]
{
new Value { StringValue = "22222" },
new Value { StringValue = "2016" },
new Value { StringValue = "$15" }
};
tableToInspect = new Table
{
Headers =
{
new FieldId { Name = "Employee ID" },
new FieldId { Name = "Date" },
new FieldId { Name = "Compensation" }
},
Rows =
{
new Table.Types.Row { Values = { row1 } },
new Table.Types.Row { Values = { row2 } },
new Table.Types.Row { Values = { row3 } }
}
};
}
// Provide the table and construct the content item.
var contentItem = new ContentItem { Table = tableToInspect };
// Specify an encrypted AES-256 key and the name of the Cloud KMS Key that
// encrypted it and specify how it should be encrypted.
var cryptoReplaceFfxFpeConfig = new CryptoReplaceFfxFpeConfig
{
CryptoKey = new CryptoKey
{
KmsWrapped = new KmsWrappedCryptoKey
{
CryptoKeyName = keyName,
WrappedKey = ByteString.FromBase64(wrappedKey)
}
},
CommonAlphabet = alphabet
};
// Specify fields to be encrypted.
var fields = new FieldId[] { new FieldId { Name = "Employee ID" } };
// Construct the deidentify config using crypto replace config created above.
var deidentifyConfig = new DeidentifyConfig
{
RecordTransformations = new RecordTransformations
{
FieldTransformations =
{
new FieldTransformation
{
PrimitiveTransformation = new PrimitiveTransformation
{
CryptoReplaceFfxFpeConfig = cryptoReplaceFfxFpeConfig
},
Fields = { fields }
}
}
}
};
// Construct the request.
var request = new DeidentifyContentRequest
{
ParentAsLocationName = new LocationName(projectId, "global"),
DeidentifyConfig = deidentifyConfig,
Item = contentItem,
};
// Call the API.
DeidentifyContentResponse response = dlp.DeidentifyContent(request);
// Inspect the response.
Console.WriteLine(response.Item.Table);
return response.Item.Table;
}
}
Go
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import (
"context"
"encoding/base64"
"fmt"
"io"
dlp "cloud.google.com/go/dlp/apiv2"
"cloud.google.com/go/dlp/apiv2/dlppb"
)
// deidentifyTableFPE de-identifies table data with format preserving encryption.
func deidentifyTableFPE(w io.Writer, projectID string, kmsKeyName, wrappedAESKey string) error {
// projectId := "your-project-id"
/* keyFileName := "projects/YOUR_PROJECT/"
+ "locations/YOUR_KEYRING_REGION/"
+ "keyRings/YOUR_KEYRING_NAME/"
+ "cryptoKeys/YOUR_KEY_NAME"
*/
// wrappedAESKey := "YOUR_ENCRYPTED_AES_256_KEY"git
// define your table.
row1 := &dlppb.Table_Row{
Values: []*dlppb.Value{
{Type: &dlppb.Value_StringValue{StringValue: "11111"}},
{Type: &dlppb.Value_StringValue{StringValue: "2015"}},
{Type: &dlppb.Value_StringValue{StringValue: "$10"}},
},
}
row2 := &dlppb.Table_Row{
Values: []*dlppb.Value{
{Type: &dlppb.Value_StringValue{StringValue: "22222"}},
{Type: &dlppb.Value_StringValue{StringValue: "2016"}},
{Type: &dlppb.Value_StringValue{StringValue: "$20"}},
},
}
row3 := &dlppb.Table_Row{
Values: []*dlppb.Value{
{Type: &dlppb.Value_StringValue{StringValue: "33333"}},
{Type: &dlppb.Value_StringValue{StringValue: "2016"}},
{Type: &dlppb.Value_StringValue{StringValue: "$15"}},
},
}
table := &dlppb.Table{
Headers: []*dlppb.FieldId{
{Name: "Employee ID"},
{Name: "Date"},
{Name: "Compensation"},
},
Rows: []*dlppb.Table_Row{
{Values: row1.Values},
{Values: row2.Values},
{Values: row3.Values},
},
}
ctx := context.Background()
// Initialize a client once and reuse it to send multiple requests. Clients
// are safe to use across goroutines. When the client is no longer needed,
// call the Close method to cleanup its resources.
client, err := dlp.NewClient(ctx)
if err != nil {
return err
}
// Closing the client safely cleans up background resources.
defer client.Close()
// Specify what content you want the service to de-identify.
contentItem := &dlppb.ContentItem{
DataItem: &dlppb.ContentItem_Table{
Table: table,
},
}
// Specify an encrypted AES-256 key and the name of the Cloud KMS key that encrypted it.
kmsKeyDecode, err := base64.StdEncoding.DecodeString(wrappedAESKey)
if err != nil {
return fmt.Errorf("error in decoding key: %v", err)
}
kmsWrappedCryptoKey := &dlppb.KmsWrappedCryptoKey{
WrappedKey: kmsKeyDecode,
CryptoKeyName: kmsKeyName,
}
cryptoKey := &dlppb.CryptoKey_KmsWrapped{
KmsWrapped: kmsWrappedCryptoKey,
}
// Specify how the content should be encrypted.
cryptoReplaceFfxFpeConfig := &dlppb.CryptoReplaceFfxFpeConfig{
CryptoKey: &dlppb.CryptoKey{
Source: cryptoKey,
},
Alphabet: &dlppb.CryptoReplaceFfxFpeConfig_CommonAlphabet{
CommonAlphabet: dlppb.CryptoReplaceFfxFpeConfig_NUMERIC,
},
}
primitiveTransformation := &dlppb.PrimitiveTransformation{
Transformation: &dlppb.PrimitiveTransformation_CryptoReplaceFfxFpeConfig{
CryptoReplaceFfxFpeConfig: cryptoReplaceFfxFpeConfig,
},
}
// Specify field to be encrypted.
fieldId := &dlppb.FieldId{
Name: "Employee ID",
}
// Associate the encryption with the specified field.
fieldTransformation := &dlppb.FieldTransformation{
Fields: []*dlppb.FieldId{
fieldId,
},
Transformation: &dlppb.FieldTransformation_PrimitiveTransformation{
PrimitiveTransformation: primitiveTransformation,
},
}
transformations := &dlppb.RecordTransformations{
FieldTransformations: []*dlppb.FieldTransformation{
fieldTransformation,
},
}
// Construct the de-identification request to be sent by the client.
req := &dlppb.DeidentifyContentRequest{
Parent: fmt.Sprintf("projects/%s/locations/global", projectID),
DeidentifyConfig: &dlppb.DeidentifyConfig{
Transformation: &dlppb.DeidentifyConfig_RecordTransformations{
RecordTransformations: transformations,
},
},
Item: contentItem,
}
// Send the request.
resp, err := client.DeidentifyContent(ctx, req)
if err != nil {
return err
}
// Print the results.
fmt.Fprintf(w, "De-identify Table after format-preserving encryption : %+v", resp.GetItem().GetTable())
return nil
}
Java
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import com.google.cloud.dlp.v2.DlpServiceClient;
import com.google.common.io.BaseEncoding;
import com.google.privacy.dlp.v2.ContentItem;
import com.google.privacy.dlp.v2.CryptoKey;
import com.google.privacy.dlp.v2.CryptoReplaceFfxFpeConfig;
import com.google.privacy.dlp.v2.CryptoReplaceFfxFpeConfig.FfxCommonNativeAlphabet;
import com.google.privacy.dlp.v2.DeidentifyConfig;
import com.google.privacy.dlp.v2.DeidentifyContentRequest;
import com.google.privacy.dlp.v2.DeidentifyContentResponse;
import com.google.privacy.dlp.v2.FieldId;
import com.google.privacy.dlp.v2.FieldTransformation;
import com.google.privacy.dlp.v2.KmsWrappedCryptoKey;
import com.google.privacy.dlp.v2.LocationName;
import com.google.privacy.dlp.v2.PrimitiveTransformation;
import com.google.privacy.dlp.v2.RecordTransformations;
import com.google.privacy.dlp.v2.Table;
import com.google.privacy.dlp.v2.Table.Row;
import com.google.privacy.dlp.v2.Value;
import com.google.protobuf.ByteString;
import java.io.IOException;
public class DeIdentifyTableWithFpe {
public static void main(String[] args) throws Exception {
// TODO(developer): Replace these variables before running the sample.
String projectId = "your-project-id";
String kmsKeyName =
"projects/YOUR_PROJECT/"
+ "locations/YOUR_KEYRING_REGION/"
+ "keyRings/YOUR_KEYRING_NAME/"
+ "cryptoKeys/YOUR_KEY_NAME";
String wrappedAesKey = "YOUR_ENCRYPTED_AES_256_KEY";
Table tableToDeIdentify =
Table.newBuilder()
.addHeaders(FieldId.newBuilder().setName("Employee ID").build())
.addHeaders(FieldId.newBuilder().setName("Date").build())
.addHeaders(FieldId.newBuilder().setName("Compensation").build())
.addRows(
Row.newBuilder()
.addValues(Value.newBuilder().setStringValue("11111").build())
.addValues(Value.newBuilder().setStringValue("2015").build())
.addValues(Value.newBuilder().setStringValue("$10").build())
.build())
.addRows(
Row.newBuilder()
.addValues(Value.newBuilder().setStringValue("22222").build())
.addValues(Value.newBuilder().setStringValue("2016").build())
.addValues(Value.newBuilder().setStringValue("$20").build())
.build())
.addRows(
Row.newBuilder()
.addValues(Value.newBuilder().setStringValue("33333").build())
.addValues(Value.newBuilder().setStringValue("2016").build())
.addValues(Value.newBuilder().setStringValue("$15").build())
.build())
.build();
deIdentifyTableWithFpe(projectId, tableToDeIdentify, kmsKeyName, wrappedAesKey);
}
public static void deIdentifyTableWithFpe(
String projectId, Table tableToDeIdentify, String kmsKeyName, String wrappedAesKey)
throws IOException {
// Initialize client that will be used to send requests. This client only needs to be created
// once, and can be reused for multiple requests. After completing all of your requests, call
// the "close" method on the client to safely clean up any remaining background resources.
try (DlpServiceClient dlp = DlpServiceClient.create()) {
// Specify what content you want the service to de-identify.
ContentItem contentItem = ContentItem.newBuilder().setTable(tableToDeIdentify).build();
// Specify an encrypted AES-256 key and the name of the Cloud KMS key that encrypted it
KmsWrappedCryptoKey kmsWrappedCryptoKey =
KmsWrappedCryptoKey.newBuilder()
.setWrappedKey(ByteString.copyFrom(BaseEncoding.base64().decode(wrappedAesKey)))
.setCryptoKeyName(kmsKeyName)
.build();
CryptoKey cryptoKey = CryptoKey.newBuilder().setKmsWrapped(kmsWrappedCryptoKey).build();
// Specify how the content should be encrypted.
CryptoReplaceFfxFpeConfig cryptoReplaceFfxFpeConfig =
CryptoReplaceFfxFpeConfig.newBuilder()
.setCryptoKey(cryptoKey)
// Set of characters in the input text. For more info, see
// https://cloud.google.com/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#DeidentifyTemplate.FfxCommonNativeAlphabet
.setCommonAlphabet(FfxCommonNativeAlphabet.NUMERIC)
.build();
PrimitiveTransformation primitiveTransformation =
PrimitiveTransformation.newBuilder()
.setCryptoReplaceFfxFpeConfig(cryptoReplaceFfxFpeConfig)
.build();
// Specify field to be encrypted.
FieldId fieldId = FieldId.newBuilder().setName("Employee ID").build();
// Associate the encryption with the specified field.
FieldTransformation fieldTransformation =
FieldTransformation.newBuilder()
.setPrimitiveTransformation(primitiveTransformation)
.addFields(fieldId)
.build();
RecordTransformations transformations =
RecordTransformations.newBuilder().addFieldTransformations(fieldTransformation).build();
DeidentifyConfig deidentifyConfig =
DeidentifyConfig.newBuilder().setRecordTransformations(transformations).build();
// Combine configurations into a request for the service.
DeidentifyContentRequest request =
DeidentifyContentRequest.newBuilder()
.setParent(LocationName.of(projectId, "global").toString())
.setItem(contentItem)
.setDeidentifyConfig(deidentifyConfig)
.build();
// Send the request and receive response from the service.
DeidentifyContentResponse response = dlp.deidentifyContent(request);
// Print the results.
System.out.println(
"Table after format-preserving encryption: " + response.getItem().getTable());
}
}
}Node.js
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
// Imports the Google Cloud Data Loss Prevention library
const DLP = require('@google-cloud/dlp');
// Instantiates a client
const dlp = new DLP.DlpServiceClient();
// The project ID to run the API call under
// const projectId = 'my-project';
// The set of characters to replace sensitive ones with
// For more information, see https://cloud.google.com/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#ffxcommonnativealphabet
// const alphabet = 'NUMERIC';
// The name of the Cloud KMS key used to encrypt ('wrap') the AES-256 key
// const keyName = 'projects/YOUR_GCLOUD_PROJECT/locations/YOUR_LOCATION/keyRings/YOUR_KEYRING_NAME/cryptoKeys/YOUR_KEY_NAME';
// The encrypted ('wrapped') AES-256 key to use
// This key should be encrypted using the Cloud KMS key specified above
// const wrappedKey = 'YOUR_ENCRYPTED_AES_256_KEY'
// Table to de-identify
const tablularData = {
headers: [{name: 'Employee ID'}, {name: 'Date'}, {name: 'Compensation'}],
rows: [
{
values: [
{stringValue: '11111'},
{stringValue: '2015'},
{stringValue: '$10'},
],
},
{
values: [
{stringValue: '22222'},
{stringValue: '2016'},
{stringValue: '$20'},
],
},
{
values: [
{stringValue: '33333'},
{stringValue: '2016'},
{stringValue: '$15'},
],
},
],
};
async function deidentifyTableWithFpe() {
// Specify field to be encrypted.
const fieldIds = [{name: 'Employee ID'}];
// Specify an encrypted AES-256 key and the name of the Cloud KMS key that encrypted it
const cryptoKeyConfig = {
kmsWrapped: {
wrappedKey: wrappedKey,
cryptoKeyName: keyName,
},
};
// Specify how the content should be encrypted.
const cryptoReplaceFfxFpeConfig = {
cryptoKey: cryptoKeyConfig,
commonAlphabet: alphabet,
};
// Associate the encryption with the specified field.
const fieldTransformations = [
{
fields: fieldIds,
primitiveTransformation: {
cryptoReplaceFfxFpeConfig,
},
},
];
// Combine configurations into a request for the service.
const request = {
parent: `projects/${projectId}/locations/global`,
deidentifyConfig: {
recordTransformations: {
fieldTransformations,
},
},
item: {
table: tablularData,
},
};
// Send the request and receive response from the service.
const [response] = await dlp.deidentifyContent(request);
// Print the results.
console.log(
`Table after de-identification: ${JSON.stringify(response.item.table)}`
);
}
await deidentifyTableWithFpe();PHP
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
use Google\Cloud\Dlp\V2\Client\DlpServiceClient;
use Google\Cloud\Dlp\V2\ContentItem;
use Google\Cloud\Dlp\V2\CryptoKey;
use Google\Cloud\Dlp\V2\CryptoReplaceFfxFpeConfig;
use Google\Cloud\Dlp\V2\CryptoReplaceFfxFpeConfig\FfxCommonNativeAlphabet;
use Google\Cloud\Dlp\V2\DeidentifyConfig;
use Google\Cloud\Dlp\V2\DeidentifyContentRequest;
use Google\Cloud\Dlp\V2\FieldId;
use Google\Cloud\Dlp\V2\FieldTransformation;
use Google\Cloud\Dlp\V2\KmsWrappedCryptoKey;
use Google\Cloud\Dlp\V2\PrimitiveTransformation;
use Google\Cloud\Dlp\V2\RecordTransformations;
use Google\Cloud\Dlp\V2\Table;
use Google\Cloud\Dlp\V2\Table\Row;
use Google\Cloud\Dlp\V2\Value;
/**
* De-identify table data with format-preserving encryption.
* Demonstrates encrypting sensitive data in a table while maintaining format.
*
* @param string $callingProjectId The Google Cloud project id to use as a parent resource.
* @param string $inputCsvFile The input file(csv) path to deidentify.
* @param string $outputCsvFile The oupt file path to save deidentify content.
* @param string $encryptedFieldNames The field to be encrypted.
* @param string $kmsKeyName The name of the Cloud KMS key used to encrypt ('wrap') the AES-256 key.
* Example: key_name = 'projects/YOUR_GCLOUD_PROJECT/locations/YOUR_LOCATION/keyRings/YOUR_KEYRING_NAME/cryptoKeys/YOUR_KEY_NAME'
* @param string $wrappedAesKey The encrypted ('wrapped') AES-256 key to use.
* */
function deidentify_table_fpe(
string $callingProjectId,
string $inputCsvFile,
string $outputCsvFile,
string $encryptedFieldNames,
string $kmsKeyName,
string $wrappedAesKey
): void {
// Instantiate a client.
$dlp = new DlpServiceClient();
$parent = "projects/$callingProjectId/locations/global";
// Read a CSV file.
$csvLines = file($inputCsvFile, FILE_IGNORE_NEW_LINES);
$csvHeaders = explode(',', $csvLines[0]);
$csvRows = array_slice($csvLines, 1);
// Convert CSV file into protobuf objects.
$tableHeaders = array_map(function ($csvHeader) {
return (new FieldId)
->setName($csvHeader);
}, $csvHeaders);
$tableRows = array_map(function ($csvRow) {
$rowValues = array_map(function ($csvValue) {
return (new Value())
->setStringValue($csvValue);
}, explode(',', $csvRow));
return (new Row())
->setValues($rowValues);
}, $csvRows);
// Construct the table object.
$tableToDeIdentify = (new Table())
->setHeaders($tableHeaders)
->setRows($tableRows);
// Specify the content to be de-identify.
$content = (new ContentItem())
->setTable($tableToDeIdentify);
// Specify an encrypted AES-256 key and the name of the Cloud KMS key that encrypted it.
$kmsWrappedCryptoKey = (new KmsWrappedCryptoKey())
->setWrappedKey(base64_decode($wrappedAesKey))
->setCryptoKeyName($kmsKeyName);
$cryptoKey = (new CryptoKey())
->setKmsWrapped($kmsWrappedCryptoKey);
// Specify how the content should be encrypted.
$cryptoReplaceFfxFpeConfig = (new CryptoReplaceFfxFpeConfig())
->setCryptoKey($cryptoKey)
->setCommonAlphabet(FfxCommonNativeAlphabet::NUMERIC);
$primitiveTransformation = (new PrimitiveTransformation())
->setCryptoReplaceFfxFpeConfig($cryptoReplaceFfxFpeConfig);
// Specify field to be encrypted.
$encryptedFields = array_map(function ($encryptedFieldName) {
return (new FieldId())
->setName($encryptedFieldName);
}, explode(',', $encryptedFieldNames));
// Associate the encryption with the specified field.
$fieldTransformation = (new FieldTransformation())
->setPrimitiveTransformation($primitiveTransformation)
->setFields($encryptedFields);
$recordtransformations = (new RecordTransformations())
->setFieldTransformations([$fieldTransformation]);
$deidentifyConfig = (new DeidentifyConfig())
->setRecordTransformations($recordtransformations);
// Run request.
$deidentifyContentRequest = (new DeidentifyContentRequest())
->setParent($parent)
->setDeidentifyConfig($deidentifyConfig)
->setItem($content);
$response = $dlp->deidentifyContent($deidentifyContentRequest);
// Print the results.
$csvRef = fopen($outputCsvFile, 'w');
fputcsv($csvRef, $csvHeaders);
foreach ($response->getItem()->getTable()->getRows() as $tableRow) {
$values = array_map(function ($tableValue) {
return $tableValue->getStringValue();
}, iterator_to_array($tableRow->getValues()));
fputcsv($csvRef, $values);
};
printf('Table after format-preserving encryption (File Location): %s', $outputCsvFile);
}Python
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
from typing import List
import google.cloud.dlp
def deidentify_table_with_fpe(
project: str,
table_header: List[str],
table_rows: List[List[str]],
deid_field_names: List[str],
key_name: str = None,
wrapped_key: bytes = None,
alphabet: str = None,
) -> None:
"""Uses the Data Loss Prevention API to de-identify sensitive data in a
table while maintaining format.
Args:
project: The Google Cloud project id to use as a parent resource.
table_header: List of strings representing table field names.
table_rows: List of rows representing table data.
deid_field_names: A list of fields in table to de-identify.
key_name: The name of the Cloud KMS key used to encrypt ('wrap') the
AES-256 key. Example:
key_name = 'projects/YOUR_GCLOUD_PROJECT/locations/YOUR_LOCATION/
keyRings/YOUR_KEYRING_NAME/cryptoKeys/YOUR_KEY_NAME'
wrapped_key: The decrypted ('wrapped', in bytes) AES-256 key to use. This key
should be encrypted using the Cloud KMS key specified by key_name.
alphabet: The set of characters to replace sensitive ones with. For
more information, see https://cloud.google.com/dlp/docs/reference/
rest/v2/projects.deidentifyTemplates#ffxcommonnativealphabet
"""
# Instantiate a client.
dlp = google.cloud.dlp_v2.DlpServiceClient()
# Construct the `table`. For more details on the table schema, please see
# https://cloud.google.com/dlp/docs/reference/rest/v2/ContentItem#Table
headers = [{"name": val} for val in table_header]
rows = []
for row in table_rows:
rows.append({"values": [{"string_value": cell_val} for cell_val in row]})
table = {"headers": headers, "rows": rows}
# Construct the `item` for table.
item = {"table": table}
# Specify fields to be de-identified.
deid_field_names = [{"name": _i} for _i in deid_field_names]
# Construct FPE configuration dictionary
crypto_replace_ffx_fpe_config = {
"crypto_key": {
"kms_wrapped": {"wrapped_key": wrapped_key, "crypto_key_name": key_name},
},
"common_alphabet": alphabet,
}
# Construct deidentify configuration dictionary
deidentify_config = {
"record_transformations": {
"field_transformations": [
{
"primitive_transformation": {
"crypto_replace_ffx_fpe_config": crypto_replace_ffx_fpe_config
},
"fields": deid_field_names,
}
]
}
}
# Convert the project id into a full resource id.
parent = f"projects/{project}/locations/global"
# Call the API.
response = dlp.deidentify_content(
request={"parent": parent, "deidentify_config": deidentify_config, "item": item}
)
# Print out results.
print(f"Table after de-identification: {response.item.table}")
형식 보존 암호화 예시: 재식별
다음은 Sensitive Data Protection을 사용하여 CryptoReplaceFfxFpeConfig 변환 메서드를 통해 익명화된 민감한 정보를 재식별하는 방법을 보여주는 여러 언어로 된 샘플 코드입니다. 자세한 내용은 이 페이지의 형식 보존 암호화를 참조하세요
Go
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import (
"context"
"encoding/base64"
"fmt"
"io"
dlp "cloud.google.com/go/dlp/apiv2"
"cloud.google.com/go/dlp/apiv2/dlppb"
)
// reidentifyFPE reidentifies the input with FPE (Format Preserving Encryption).
// keyFileName is the file name with the KMS wrapped key and cryptoKeyName is the
// full KMS key resource name used to wrap the key. surrogateInfoType is an
// the identifier used during deidentification.
// Info types can be found with the infoTypes.list method or on https://cloud.google.com/dlp/docs/infotypes-reference
func reidentifyFPE(w io.Writer, projectID, input, kmsKeyName, wrappedAesKey, surrogateInfoType string) error {
// projectID := "my-project-id"
// input := "My SSN is 123456789"
// keyFileName := "projects/YOUR_GCLOUD_PROJECT/locations/YOUR_LOCATION/keyRings/YOUR_KEYRING_NAME/cryptoKeys/YOUR_KEY_NAME"
// cryptoKeyName := "YOUR_ENCRYPTED_AES_256_KEY"
// surrogateInfoType := "AGE"
ctx := context.Background()
client, err := dlp.NewClient(ctx)
if err != nil {
return fmt.Errorf("dlp.NewClient: %w", err)
}
defer client.Close()
// Specify an encrypted AES-256 key and the name of the Cloud KMS key that encrypted it.
kmsWrappedCryptoKey, err := base64.StdEncoding.DecodeString(wrappedAesKey)
if err != nil {
fmt.Fprintf(w, "error %v", err)
return err
}
// Specify the crypto key configuration that will used for encryption.
cryptoKey := &dlppb.CryptoKey{
Source: &dlppb.CryptoKey_KmsWrapped{
KmsWrapped: &dlppb.KmsWrappedCryptoKey{
WrappedKey: kmsWrappedCryptoKey,
CryptoKeyName: kmsKeyName,
},
},
}
// Create a configured request.
req := &dlppb.ReidentifyContentRequest{
Parent: fmt.Sprintf("projects/%s/locations/global", projectID),
ReidentifyConfig: &dlppb.DeidentifyConfig{
Transformation: &dlppb.DeidentifyConfig_InfoTypeTransformations{
InfoTypeTransformations: &dlppb.InfoTypeTransformations{
Transformations: []*dlppb.InfoTypeTransformations_InfoTypeTransformation{
{
InfoTypes: []*dlppb.InfoType{},
PrimitiveTransformation: &dlppb.PrimitiveTransformation{
Transformation: &dlppb.PrimitiveTransformation_CryptoReplaceFfxFpeConfig{
CryptoReplaceFfxFpeConfig: &dlppb.CryptoReplaceFfxFpeConfig{
CryptoKey: cryptoKey,
// Set the alphabet used for the encrypted fields.
Alphabet: &dlppb.CryptoReplaceFfxFpeConfig_CommonAlphabet{
CommonAlphabet: dlppb.CryptoReplaceFfxFpeConfig_ALPHA_NUMERIC,
},
// Set the surrogate info type used during deidentification.
SurrogateInfoType: &dlppb.InfoType{
Name: surrogateInfoType,
},
},
},
},
},
},
},
},
},
// The InspectConfig must identify the surrogate info type to reidentify.
InspectConfig: &dlppb.InspectConfig{
CustomInfoTypes: []*dlppb.CustomInfoType{
{
InfoType: &dlppb.InfoType{
Name: surrogateInfoType,
},
Type: &dlppb.CustomInfoType_SurrogateType_{
SurrogateType: &dlppb.CustomInfoType_SurrogateType{},
},
},
},
},
// The item to analyze.
Item: &dlppb.ContentItem{
DataItem: &dlppb.ContentItem_Value{
Value: input,
},
},
}
// Send the request.
r, err := client.ReidentifyContent(ctx, req)
if err != nil {
return fmt.Errorf("ReidentifyContent: %w", err)
}
// Print the result.
fmt.Fprint(w, r.GetItem().GetValue())
return nil
}
Java
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import com.google.cloud.dlp.v2.DlpServiceClient;
import com.google.common.io.BaseEncoding;
import com.google.privacy.dlp.v2.ContentItem;
import com.google.privacy.dlp.v2.CryptoKey;
import com.google.privacy.dlp.v2.CryptoReplaceFfxFpeConfig;
import com.google.privacy.dlp.v2.CryptoReplaceFfxFpeConfig.FfxCommonNativeAlphabet;
import com.google.privacy.dlp.v2.CustomInfoType;
import com.google.privacy.dlp.v2.CustomInfoType.SurrogateType;
import com.google.privacy.dlp.v2.DeidentifyConfig;
import com.google.privacy.dlp.v2.InfoType;
import com.google.privacy.dlp.v2.InfoTypeTransformations;
import com.google.privacy.dlp.v2.InfoTypeTransformations.InfoTypeTransformation;
import com.google.privacy.dlp.v2.InspectConfig;
import com.google.privacy.dlp.v2.KmsWrappedCryptoKey;
import com.google.privacy.dlp.v2.LocationName;
import com.google.privacy.dlp.v2.PrimitiveTransformation;
import com.google.privacy.dlp.v2.ReidentifyContentRequest;
import com.google.privacy.dlp.v2.ReidentifyContentResponse;
import com.google.protobuf.ByteString;
import java.io.IOException;
public class ReIdentifyWithFpe {
public static void main(String[] args) throws Exception {
// TODO(developer): Replace these variables before running the sample.
String projectId = "your-project-id";
String textToReIdentify = "My SSN is SSN_TOKEN(9):731997681";
String kmsKeyName =
"projects/YOUR_PROJECT/"
+ "locations/YOUR_KEYRING_REGION/"
+ "keyRings/YOUR_KEYRING_NAME/"
+ "cryptoKeys/YOUR_KEY_NAME";
String wrappedAesKey = "YOUR_ENCRYPTED_AES_256_KEY";
reIdentifyWithFpe(projectId, textToReIdentify, kmsKeyName, wrappedAesKey);
}
public static void reIdentifyWithFpe(
String projectId, String textToReIdentify, String kmsKeyName, String wrappedAesKey)
throws IOException {
// Initialize client that will be used to send requests. This client only needs to be created
// once, and can be reused for multiple requests. After completing all of your requests, call
// the "close" method on the client to safely clean up any remaining background resources.
try (DlpServiceClient dlp = DlpServiceClient.create()) {
// Specify what content you want the service to re-identify
ContentItem contentItem = ContentItem.newBuilder().setValue(textToReIdentify).build();
// Specify the type of info the inspection will re-identify. This must use the same custom
// into type that was used as a surrogate during the initial encryption.
InfoType surrogateInfoType = InfoType.newBuilder().setName("SSN_TOKEN").build();
CustomInfoType customInfoType =
CustomInfoType.newBuilder()
.setInfoType(surrogateInfoType)
.setSurrogateType(SurrogateType.getDefaultInstance())
.build();
InspectConfig inspectConfig =
InspectConfig.newBuilder().addCustomInfoTypes(customInfoType).build();
// Specify an encrypted AES-256 key and the name of the Cloud KMS key that encrypted it
KmsWrappedCryptoKey kmsWrappedCryptoKey =
KmsWrappedCryptoKey.newBuilder()
.setWrappedKey(ByteString.copyFrom(BaseEncoding.base64().decode(wrappedAesKey)))
.setCryptoKeyName(kmsKeyName)
.build();
CryptoKey cryptoKey = CryptoKey.newBuilder().setKmsWrapped(kmsWrappedCryptoKey).build();
// Specify how to un-encrypt the previously de-identified information
CryptoReplaceFfxFpeConfig cryptoReplaceFfxFpeConfig =
CryptoReplaceFfxFpeConfig.newBuilder()
.setCryptoKey(cryptoKey)
// Set of characters in the input text. For more info, see
// https://cloud.google.com/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#DeidentifyTemplate.FfxCommonNativeAlphabet
.setCommonAlphabet(FfxCommonNativeAlphabet.NUMERIC)
.setSurrogateInfoType(surrogateInfoType)
.build();
PrimitiveTransformation primitiveTransformation =
PrimitiveTransformation.newBuilder()
.setCryptoReplaceFfxFpeConfig(cryptoReplaceFfxFpeConfig)
.build();
InfoTypeTransformation infoTypeTransformation =
InfoTypeTransformation.newBuilder()
.setPrimitiveTransformation(primitiveTransformation)
.addInfoTypes(surrogateInfoType)
.build();
InfoTypeTransformations transformations =
InfoTypeTransformations.newBuilder().addTransformations(infoTypeTransformation).build();
DeidentifyConfig reidentifyConfig =
DeidentifyConfig.newBuilder().setInfoTypeTransformations(transformations).build();
// Combine configurations into a request for the service.
ReidentifyContentRequest request =
ReidentifyContentRequest.newBuilder()
.setParent(LocationName.of(projectId, "global").toString())
.setItem(contentItem)
.setInspectConfig(inspectConfig)
.setReidentifyConfig(reidentifyConfig)
.build();
// Send the request and receive response from the service
ReidentifyContentResponse response = dlp.reidentifyContent(request);
// Print the results
System.out.println("Text after re-identification: " + response.getItem().getValue());
}
}
}Node.js
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
// Imports the Google Cloud Data Loss Prevention library
const DLP = require('@google-cloud/dlp');
// Instantiates a client
const dlp = new DLP.DlpServiceClient();
// The project ID to run the API call under
// const projectId = 'my-project';
// The string to reidentify
// const string = 'My SSN is PHONE_TOKEN(9):#########';
// The set of characters to replace sensitive ones with
// For more information, see https://cloud.google.com/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#ffxcommonnativealphabet
// const alphabet = 'ALPHA_NUMERIC';
// The name of the Cloud KMS key used to encrypt ('wrap') the AES-256 key
// const keyName = 'projects/YOUR_GCLOUD_PROJECT/locations/YOUR_LOCATION/keyRings/YOUR_KEYRING_NAME/cryptoKeys/YOUR_KEY_NAME';
// The encrypted ('wrapped') AES-256 key to use
// This key should be encrypted using the Cloud KMS key specified above
// const wrappedKey = 'YOUR_ENCRYPTED_AES_256_KEY'
// The name of the surrogate custom info type to use when reidentifying data
// const surrogateType = 'SOME_INFO_TYPE_DEID';
async function reidentifyWithFpe() {
// Construct deidentification request
const item = {value: string};
const request = {
parent: `projects/${projectId}/locations/global`,
reidentifyConfig: {
infoTypeTransformations: {
transformations: [
{
primitiveTransformation: {
cryptoReplaceFfxFpeConfig: {
cryptoKey: {
kmsWrapped: {
wrappedKey: wrappedKey,
cryptoKeyName: keyName,
},
},
commonAlphabet: alphabet,
surrogateInfoType: {
name: surrogateType,
},
},
},
},
],
},
},
inspectConfig: {
customInfoTypes: [
{
infoType: {
name: surrogateType,
},
surrogateType: {},
},
],
},
item: item,
};
// Run reidentification request
const [response] = await dlp.reidentifyContent(request);
const reidentifiedItem = response.item;
console.log(reidentifiedItem.value);
}
reidentifyWithFpe();PHP
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
use Google\Cloud\Dlp\V2\Client\DlpServiceClient;
use Google\Cloud\Dlp\V2\ContentItem;
use Google\Cloud\Dlp\V2\CryptoKey;
use Google\Cloud\Dlp\V2\CryptoReplaceFfxFpeConfig;
use Google\Cloud\Dlp\V2\CryptoReplaceFfxFpeConfig\FfxCommonNativeAlphabet;
use Google\Cloud\Dlp\V2\CustomInfoType;
use Google\Cloud\Dlp\V2\CustomInfoType\SurrogateType;
use Google\Cloud\Dlp\V2\DeidentifyConfig;
use Google\Cloud\Dlp\V2\InfoType;
use Google\Cloud\Dlp\V2\InfoTypeTransformations;
use Google\Cloud\Dlp\V2\InfoTypeTransformations\InfoTypeTransformation;
use Google\Cloud\Dlp\V2\InspectConfig;
use Google\Cloud\Dlp\V2\KmsWrappedCryptoKey;
use Google\Cloud\Dlp\V2\PrimitiveTransformation;
use Google\Cloud\Dlp\V2\ReidentifyContentRequest;
/**
* Reidentify a deidentified string using Format-Preserving Encryption (FPE).
*
* @param string $callingProjectId The GCP Project ID to run the API call under
* @param string $string The string to reidentify
* @param string $keyName The name of the Cloud KMS key used to encrypt (wrap) the AES-256 key
* @param string $wrappedKey The name of the Cloud KMS key use, encrypted with the KMS key in $keyName
* @param string $surrogateTypeName (Optional) Surrogate custom info type to enable reidentification
*/
function reidentify_fpe(
string $callingProjectId,
string $string,
string $keyName,
string $wrappedKey,
string $surrogateTypeName
): void {
// Instantiate a client.
$dlp = new DlpServiceClient();
// The infoTypes of information to mask
$ssnInfoType = (new InfoType())
->setName('US_SOCIAL_SECURITY_NUMBER');
$infoTypes = [$ssnInfoType];
// The set of characters to replace sensitive ones with
// For more information, see https://cloud.google.com/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#ffxcommonnativealphabet
$commonAlphabet = FfxCommonNativeAlphabet::NUMERIC;
// Create the wrapped crypto key configuration object
$kmsWrappedCryptoKey = (new KmsWrappedCryptoKey())
->setWrappedKey(base64_decode($wrappedKey))
->setCryptoKeyName($keyName);
// Create the crypto key configuration object
$cryptoKey = (new CryptoKey())
->setKmsWrapped($kmsWrappedCryptoKey);
// Create the surrogate type object
$surrogateType = (new InfoType())
->setName($surrogateTypeName);
$customInfoType = (new CustomInfoType())
->setInfoType($surrogateType)
->setSurrogateType(new SurrogateType());
// Create the crypto FFX FPE configuration object
$cryptoReplaceFfxFpeConfig = (new CryptoReplaceFfxFpeConfig())
->setCryptoKey($cryptoKey)
->setCommonAlphabet($commonAlphabet)
->setSurrogateInfoType($surrogateType);
// Create the information transform configuration objects
$primitiveTransformation = (new PrimitiveTransformation())
->setCryptoReplaceFfxFpeConfig($cryptoReplaceFfxFpeConfig);
$infoTypeTransformation = (new InfoTypeTransformation())
->setPrimitiveTransformation($primitiveTransformation);
$infoTypeTransformations = (new InfoTypeTransformations())
->setTransformations([$infoTypeTransformation]);
// Create the inspect configuration object
$inspectConfig = (new InspectConfig())
->setCustomInfoTypes([$customInfoType]);
// Create the reidentification configuration object
$reidentifyConfig = (new DeidentifyConfig())
->setInfoTypeTransformations($infoTypeTransformations);
$item = (new ContentItem())
->setValue($string);
$parent = "projects/$callingProjectId/locations/global";
// Run request
$reidentifyContentRequest = (new ReidentifyContentRequest())
->setParent($parent)
->setReidentifyConfig($reidentifyConfig)
->setInspectConfig($inspectConfig)
->setItem($item);
$response = $dlp->reidentifyContent($reidentifyContentRequest);
// Print the results
$reidentifiedValue = $response->getItem()->getValue();
print($reidentifiedValue);
}Python
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import base64
import google.cloud.dlp
def reidentify_with_fpe(
project: str,
input_str: str,
alphabet: str = None,
surrogate_type: str = None,
key_name: str = None,
wrapped_key: str = None,
) -> None:
"""Uses the Data Loss Prevention API to reidentify sensitive data in a
string that was encrypted by Format Preserving Encryption (FPE).
Args:
project: The Google Cloud project id to use as a parent resource.
input_str: The string to deidentify (will be treated as text).
alphabet: The set of characters to replace sensitive ones with. For
more information, see https://cloud.google.com/dlp/docs/reference/
rest/v2beta2/organizations.deidentifyTemplates#ffxcommonnativealphabet
surrogate_type: The name of the surrogate custom info type to used
during the encryption process.
key_name: The name of the Cloud KMS key used to encrypt ('wrap') the
AES-256 key. Example:
keyName = 'projects/YOUR_GCLOUD_PROJECT/locations/YOUR_LOCATION/
keyRings/YOUR_KEYRING_NAME/cryptoKeys/YOUR_KEY_NAME'
wrapped_key: The encrypted ('wrapped') AES-256 key to use. This key
should be encrypted using the Cloud KMS key specified by key_name.
Returns:
None; the response from the API is printed to the terminal.
"""
# Instantiate a client
dlp = google.cloud.dlp_v2.DlpServiceClient()
# Convert the project id into a full resource id.
parent = f"projects/{project}/locations/global"
# The wrapped key is base64-encoded, but the library expects a binary
# string, so decode it here.
wrapped_key = base64.b64decode(wrapped_key)
# Construct Deidentify Config
reidentify_config = {
"info_type_transformations": {
"transformations": [
{
"primitive_transformation": {
"crypto_replace_ffx_fpe_config": {
"crypto_key": {
"kms_wrapped": {
"wrapped_key": wrapped_key,
"crypto_key_name": key_name,
}
},
"common_alphabet": alphabet,
"surrogate_info_type": {"name": surrogate_type},
}
}
}
]
}
}
inspect_config = {
"custom_info_types": [
{"info_type": {"name": surrogate_type}, "surrogate_type": {}}
]
}
# Convert string to item
item = {"value": input_str}
# Call the API
response = dlp.reidentify_content(
request={
"parent": parent,
"reidentify_config": reidentify_config,
"inspect_config": inspect_config,
"item": item,
}
)
# Print results
print(response.item.value)
C#
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
using System;
using Google.Api.Gax.ResourceNames;
using Google.Cloud.Dlp.V2;
using Google.Protobuf;
using static Google.Cloud.Dlp.V2.CryptoReplaceFfxFpeConfig.Types;
public class ReidentifyContentUsingFpe
{
public static ReidentifyContentResponse ReidentifyContent(
string projectId,
string text,
string keyName,
string wrappedKey,
FfxCommonNativeAlphabet alphabet = FfxCommonNativeAlphabet.Numeric,
InfoType surrogateType = null)
{
// Instantiate the client.
var dlp = DlpServiceClient.Create();
// Specify the type of info the inspection will re-identify. This must use the same custom
// info type that was used as a surrogate during the initial encryption.
var infotype = surrogateType ?? new InfoType { Name = "SSN_TOKEN" };
// Specify how to un-encrypt the previously de-identified information.
var cryptoReplaceFfxFpeConfig = new CryptoReplaceFfxFpeConfig
{
CryptoKey = new CryptoKey
{
KmsWrapped = new KmsWrappedCryptoKey
{
CryptoKeyName = keyName,
WrappedKey = ByteString.FromBase64(wrappedKey)
}
},
CommonAlphabet = alphabet,
SurrogateInfoType = infotype
};
// Construct reidentify config using above created crypto replace config.
var reidentifyConfig = new DeidentifyConfig
{
InfoTypeTransformations = new InfoTypeTransformations
{
Transformations =
{
new InfoTypeTransformations.Types.InfoTypeTransformation
{
PrimitiveTransformation = new PrimitiveTransformation
{
CryptoReplaceFfxFpeConfig = cryptoReplaceFfxFpeConfig,
},
InfoTypes = { infotype }
}
}
}
};
// Construct the inspect config.
var inspectConfig = new InspectConfig
{
CustomInfoTypes =
{
new CustomInfoType
{
InfoType = infotype,
SurrogateType = new CustomInfoType.Types.SurrogateType()
}
}
};
// Construct the request.
var request = new ReidentifyContentRequest
{
ParentAsLocationName = new LocationName(projectId, "global"),
InspectConfig = inspectConfig,
ReidentifyConfig = reidentifyConfig,
Item = new ContentItem { Value = text },
};
// Call the API.
var response = dlp.ReidentifyContent(request);
// Inspect the response.
Console.WriteLine($"Reidentified content: {response.Item.Value}");
return response;
}
}
형식 보존 암호화 예시: 텍스트 재식별
다음은 Sensitive Data Protection을 사용하여 CryptoReplaceFfxFpeConfig 변환 메서드를 통해 익명화된 민감한 텍스트를 재식별하는 방법을 보여주는 여러 언어로 된 샘플 코드입니다. 자세한 내용은 이 페이지의 형식 보존 암호화를 참조하세요
C#
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
using System;
using Google.Api.Gax.ResourceNames;
using Google.Cloud.Dlp.V2;
using Google.Protobuf;
using static Google.Cloud.Dlp.V2.CryptoReplaceFfxFpeConfig.Types;
public class ReidentifyFreeTextFpe
{
public static ReidentifyContentResponse ReidentifyContent(
string projectId,
string text,
string keyName,
string wrappedKey,
FfxCommonNativeAlphabet alphabet = FfxCommonNativeAlphabet.Numeric,
InfoType surrogateType = null)
{
// Instantiate the client.
var dlp = DlpServiceClient.Create();
// Construct the infoType which will be used as both surrogate type and infoType.
var infotype = surrogateType ?? new InfoType { Name = "PHONE_TOKEN" };
// Specify how to un-encrypt the previously de-identified information.
var cryptoReplaceFfxFpeConfig = new CryptoReplaceFfxFpeConfig
{
CryptoKey = new CryptoKey
{
KmsWrapped = new KmsWrappedCryptoKey
{
CryptoKeyName = keyName,
WrappedKey = ByteString.FromBase64(wrappedKey)
}
},
CommonAlphabet = alphabet,
SurrogateInfoType = infotype
};
// Construct re-identify config using the CryptoReplaceFfxFpeConfig transformation method.
var reidentifyConfig = new DeidentifyConfig
{
InfoTypeTransformations = new InfoTypeTransformations
{
Transformations =
{
new InfoTypeTransformations.Types.InfoTypeTransformation
{
PrimitiveTransformation = new PrimitiveTransformation
{
CryptoReplaceFfxFpeConfig = cryptoReplaceFfxFpeConfig,
},
InfoTypes = { infotype }
}
}
}
};
// Construct the inspect config using custom infoTypes.
var inspectConfig = new InspectConfig
{
CustomInfoTypes =
{
new CustomInfoType
{
InfoType = infotype,
SurrogateType = new CustomInfoType.Types.SurrogateType()
}
}
};
// Construct the request.
var request = new ReidentifyContentRequest
{
ParentAsLocationName = new LocationName(projectId, "global"),
InspectConfig = inspectConfig,
ReidentifyConfig = reidentifyConfig,
Item = new ContentItem { Value = text },
};
// Call the API.
ReidentifyContentResponse response = dlp.ReidentifyContent(request);
// Inspect the response.
Console.WriteLine($"Reidentified content: {response.Item.Value}");
return response;
}
}
Go
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import (
"context"
"encoding/base64"
"fmt"
"io"
dlp "cloud.google.com/go/dlp/apiv2"
"cloud.google.com/go/dlp/apiv2/dlppb"
)
// ReidTextDataWithFPE re-identifies text data with FPE
func reidTextDataWithFPE(w io.Writer, projectID, textToReidentify, kmsKeyName, wrappedAESKey, surrogateInfoType string) error {
// projectId := "my-project-id"
// textToReidentify := "My SSN is AGE(9):FHKByqA13"
/* kmsKeyName := "projects/YOUR_PROJECT/"
+ "locations/YOUR_KEYRING_REGION/"
+ "keyRings/YOUR_KEYRING_NAME/"
+ "cryptoKeys/YOUR_KEY_NAME"
*/
// wrappedAesKey := "YOUR_ENCRYPTED_AES_256_KEY"
// surrogateInfoType := "AGE"
ctx := context.Background()
// Initialize a client once and reuse it to send multiple requests. Clients
// are safe to use across goroutines. When the client is no longer needed,
// call the Close method to cleanup its resources.
client, err := dlp.NewClient(ctx)
if err != nil {
return err
}
// Closing the client safely cleans up background resources.
defer client.Close()
// Specify what content you want the service to re-identify.
contentItem := &dlppb.ContentItem{
DataItem: &dlppb.ContentItem_Value{
Value: textToReidentify,
},
}
// Specify the type of info the inspection will re-identify. This must use the same custom
// into type that was used as a surrogate during the initial encryption.
infotype := &dlppb.InfoType{
Name: surrogateInfoType,
}
customInfotype := &dlppb.CustomInfoType{
InfoType: infotype,
Type: &dlppb.CustomInfoType_SurrogateType_{
SurrogateType: &dlppb.CustomInfoType_SurrogateType{},
},
}
inspectConfig := &dlppb.InspectConfig{
CustomInfoTypes: []*dlppb.CustomInfoType{
customInfotype,
},
}
// Specify an encrypted AES-256 key and the name of the Cloud KMS key that encrypted it.
kmsWrappedCryptoKey, err := base64.StdEncoding.DecodeString(wrappedAESKey)
if err != nil {
return err
}
cryptoKey := &dlppb.CryptoKey{
Source: &dlppb.CryptoKey_KmsWrapped{
KmsWrapped: &dlppb.KmsWrappedCryptoKey{
WrappedKey: kmsWrappedCryptoKey,
CryptoKeyName: kmsKeyName,
},
},
}
// Specify how to un-encrypt the previously de-identified information.
cryptoReplaceFfxFpeConfig := &dlppb.CryptoReplaceFfxFpeConfig{
CryptoKey: cryptoKey,
Alphabet: &dlppb.CryptoReplaceFfxFpeConfig_CommonAlphabet{
CommonAlphabet: dlppb.CryptoReplaceFfxFpeConfig_ALPHA_NUMERIC,
},
SurrogateInfoType: infotype,
}
primitiveTransformation := &dlppb.PrimitiveTransformation_CryptoReplaceFfxFpeConfig{
CryptoReplaceFfxFpeConfig: cryptoReplaceFfxFpeConfig,
}
InfoTypeTransformations := &dlppb.InfoTypeTransformations{
Transformations: []*dlppb.InfoTypeTransformations_InfoTypeTransformation{
{
PrimitiveTransformation: &dlppb.PrimitiveTransformation{
Transformation: primitiveTransformation,
},
InfoTypes: []*dlppb.InfoType{
infotype,
},
},
},
}
// Combine configurations into a request for the service.
reidentifyConfig := &dlppb.DeidentifyConfig{
Transformation: &dlppb.DeidentifyConfig_InfoTypeTransformations{
InfoTypeTransformations: InfoTypeTransformations,
},
}
// Construct the Inspect request to be sent by the client.
req := &dlppb.ReidentifyContentRequest{
Parent: fmt.Sprintf("projects/%s/locations/global", projectID),
ReidentifyConfig: reidentifyConfig,
Item: contentItem,
InspectConfig: inspectConfig,
}
// Send the request.
r, err := client.ReidentifyContent(ctx, req)
if err != nil {
return err
}
// Print the result.
fmt.Fprintf(w, "output: %v", r.GetItem().GetValue())
return nil
}
Java
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import com.google.cloud.dlp.v2.DlpServiceClient;
import com.google.common.io.BaseEncoding;
import com.google.privacy.dlp.v2.ContentItem;
import com.google.privacy.dlp.v2.CryptoKey;
import com.google.privacy.dlp.v2.CryptoReplaceFfxFpeConfig;
import com.google.privacy.dlp.v2.CryptoReplaceFfxFpeConfig.FfxCommonNativeAlphabet;
import com.google.privacy.dlp.v2.CustomInfoType;
import com.google.privacy.dlp.v2.CustomInfoType.SurrogateType;
import com.google.privacy.dlp.v2.DeidentifyConfig;
import com.google.privacy.dlp.v2.InfoType;
import com.google.privacy.dlp.v2.InfoTypeTransformations;
import com.google.privacy.dlp.v2.InfoTypeTransformations.InfoTypeTransformation;
import com.google.privacy.dlp.v2.InspectConfig;
import com.google.privacy.dlp.v2.KmsWrappedCryptoKey;
import com.google.privacy.dlp.v2.LocationName;
import com.google.privacy.dlp.v2.PrimitiveTransformation;
import com.google.privacy.dlp.v2.ReidentifyContentRequest;
import com.google.privacy.dlp.v2.ReidentifyContentResponse;
import com.google.protobuf.ByteString;
import java.io.IOException;
public class ReIdentifyTextWithFpe {
public static void main(String[] args) throws Exception {
// TODO(developer): Replace these variables before running the sample.
String projectId = "your-project-id";
String textToReIdentify = "My phone number is PHONE_TOKEN(10):9617256398";
String kmsKeyName =
"projects/YOUR_PROJECT/"
+ "locations/YOUR_KEYRING_REGION/"
+ "keyRings/YOUR_KEYRING_NAME/"
+ "cryptoKeys/YOUR_KEY_NAME";
String wrappedAesKey = "YOUR_ENCRYPTED_AES_256_KEY";
reIdentifyTextWithFpe(projectId, textToReIdentify, kmsKeyName, wrappedAesKey);
}
public static void reIdentifyTextWithFpe(
String projectId, String textToReIdentify, String kmsKeyName, String wrappedAesKey)
throws IOException {
// Initialize client that will be used to send requests. This client only needs to be created
// once, and can be reused for multiple requests. After completing all of your requests, call
// the "close" method on the client to safely clean up any remaining background resources.
try (DlpServiceClient dlp = DlpServiceClient.create()) {
// Specify what content you want the service to re-identify.
ContentItem contentItem = ContentItem.newBuilder().setValue(textToReIdentify).build();
// Specify the type of info the inspection will re-identify. This must use the same custom
// into type that was used as a surrogate during the initial encryption.
InfoType surrogateInfoType = InfoType.newBuilder().setName("PHONE_NUMBER").build();
CustomInfoType customInfoType =
CustomInfoType.newBuilder()
.setInfoType(surrogateInfoType)
.setSurrogateType(SurrogateType.getDefaultInstance())
.build();
InspectConfig inspectConfig =
InspectConfig.newBuilder().addCustomInfoTypes(customInfoType).build();
// Specify an encrypted AES-256 key and the name of the Cloud KMS key that encrypted it.
KmsWrappedCryptoKey kmsWrappedCryptoKey =
KmsWrappedCryptoKey.newBuilder()
.setWrappedKey(ByteString.copyFrom(BaseEncoding.base64().decode(wrappedAesKey)))
.setCryptoKeyName(kmsKeyName)
.build();
CryptoKey cryptoKey = CryptoKey.newBuilder().setKmsWrapped(kmsWrappedCryptoKey).build();
// Specify how to un-encrypt the previously de-identified information.
CryptoReplaceFfxFpeConfig cryptoReplaceFfxFpeConfig =
CryptoReplaceFfxFpeConfig.newBuilder()
.setCryptoKey(cryptoKey)
// Set of characters in the input text. For more info, see
// https://cloud.google.com/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#DeidentifyTemplate.FfxCommonNativeAlphabet
.setCommonAlphabet(FfxCommonNativeAlphabet.NUMERIC)
.setSurrogateInfoType(surrogateInfoType)
.build();
PrimitiveTransformation primitiveTransformation =
PrimitiveTransformation.newBuilder()
.setCryptoReplaceFfxFpeConfig(cryptoReplaceFfxFpeConfig)
.build();
InfoTypeTransformation infoTypeTransformation =
InfoTypeTransformation.newBuilder()
.setPrimitiveTransformation(primitiveTransformation)
.addInfoTypes(surrogateInfoType)
.build();
InfoTypeTransformations transformations =
InfoTypeTransformations.newBuilder().addTransformations(infoTypeTransformation).build();
DeidentifyConfig reidentifyConfig =
DeidentifyConfig.newBuilder().setInfoTypeTransformations(transformations).build();
// Combine configurations into a request for the service.
ReidentifyContentRequest request =
ReidentifyContentRequest.newBuilder()
.setParent(LocationName.of(projectId, "global").toString())
.setItem(contentItem)
.setInspectConfig(inspectConfig)
.setReidentifyConfig(reidentifyConfig)
.build();
// Send the request and receive response from the service
ReidentifyContentResponse response = dlp.reidentifyContent(request);
// Print the results
System.out.println("Text after re-identification: " + response.getItem().getValue());
}
}
}Node.js
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
// Imports the Google Cloud Data Loss Prevention library
const DLP = require('@google-cloud/dlp');
// Instantiates a client
const dlp = new DLP.DlpServiceClient();
// The project ID to run the API call under
// const projectId = 'my-project';
// The string to reidentify
// const string = 'My phone number is PHONE_TOKEN(10):9617256398';
// The set of characters to replace sensitive ones with
// For more information, see https://cloud.google.com/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#ffxcommonnativealphabet
// const alphabet = 'NUMERIC';
// The name of the Cloud KMS key used to encrypt ('wrap') the AES-256 key
// const keyName = 'projects/YOUR_GCLOUD_PROJECT/locations/YOUR_LOCATION/keyRings/YOUR_KEYRING_NAME/cryptoKeys/YOUR_KEY_NAME';
// The encrypted ('wrapped') AES-256 key to use
// This key should be encrypted using the Cloud KMS key specified above
// const wrappedKey = 'YOUR_ENCRYPTED_AES_256_KEY'
// The name of the surrogate custom info type to use when reidentifying data
// const surrogateType = 'SOME_INFO_TYPE_DEID';
async function reidentifyTextWithFpe() {
// Construct deidentification request
const item = {value: string};
// Construt Crypto Key Configuration
const cryptoKeyConfig = {
kmsWrapped: {
wrappedKey: wrappedKey,
cryptoKeyName: keyName,
},
};
// Construct primitive transformation configuration
const primitiveTransformation = {
cryptoReplaceFfxFpeConfig: {
cryptoKey: cryptoKeyConfig,
commonAlphabet: alphabet,
surrogateInfoType: {
name: surrogateType,
},
},
};
// Combine configurations and construct re-identify request
const request = {
parent: `projects/${projectId}/locations/global`,
reidentifyConfig: {
infoTypeTransformations: {
transformations: [
{
primitiveTransformation: primitiveTransformation,
},
],
},
},
inspectConfig: {
customInfoTypes: [
{
infoType: {
name: surrogateType,
},
surrogateType: {},
},
],
},
item: item,
};
// Run re-identification request
const [response] = await dlp.reidentifyContent(request);
const reidentifiedItem = response.item;
// Print results
console.log(reidentifiedItem.value);
}
await reidentifyTextWithFpe();PHP
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
use Google\Cloud\Dlp\V2\Client\DlpServiceClient;
use Google\Cloud\Dlp\V2\ContentItem;
use Google\Cloud\Dlp\V2\CryptoKey;
use Google\Cloud\Dlp\V2\CryptoReplaceFfxFpeConfig;
use Google\Cloud\Dlp\V2\CryptoReplaceFfxFpeConfig\FfxCommonNativeAlphabet;
use Google\Cloud\Dlp\V2\CustomInfoType;
use Google\Cloud\Dlp\V2\CustomInfoType\SurrogateType;
use Google\Cloud\Dlp\V2\DeidentifyConfig;
use Google\Cloud\Dlp\V2\InfoType;
use Google\Cloud\Dlp\V2\InfoTypeTransformations;
use Google\Cloud\Dlp\V2\InfoTypeTransformations\InfoTypeTransformation;
use Google\Cloud\Dlp\V2\InspectConfig;
use Google\Cloud\Dlp\V2\KmsWrappedCryptoKey;
use Google\Cloud\Dlp\V2\PrimitiveTransformation;
use Google\Cloud\Dlp\V2\ReidentifyContentRequest;
/**
* Reidentify a deidentified string using Format-Preserving Encryption (FPE).
*
* @param string $callingProjectId The GCP Project ID to run the API call under.
* @param string $string The string to reidentify.
* @param string $keyName The name of the Cloud KMS key used to encrypt (wrap) the AES-256 key.
* @param string $wrappedKey The name of the Cloud KMS key use, encrypted with the KMS key in $keyName.
* @param string $surrogateTypeName Surrogate custom info type to enable reidentification.
*/
function reidentify_text_fpe(
string $callingProjectId,
string $string,
string $keyName,
string $wrappedKey,
string $surrogateTypeName
): void {
// Instantiate a client.
$dlp = new DlpServiceClient();
$parent = "projects/$callingProjectId/locations/global";
// Specify what content you want the service to re-identify.
$item = (new ContentItem())
->setValue($string);
// Specify the type of info the inspection will re-identify. This must use the same custom
// into type that was used as a surrogate during the initial encryption.
$surrogateType = (new InfoType())
->setName($surrogateTypeName);
$customInfoType = (new CustomInfoType())
->setInfoType($surrogateType)
->setSurrogateType(new SurrogateType());
// Create the inspect configuration object.
$inspectConfig = (new InspectConfig())
->setCustomInfoTypes([$customInfoType]);
// Set of characters in the input text. For more info, see
// https://cloud.google.com/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#DeidentifyTemplate.FfxCommonNativeAlphabet
$commonAlphabet = FfxCommonNativeAlphabet::NUMERIC;
// Specify an encrypted AES-256 key and the name of the Cloud KMS key that encrypted it.
$kmsWrappedCryptoKey = (new KmsWrappedCryptoKey())
->setWrappedKey(base64_decode($wrappedKey))
->setCryptoKeyName($keyName);
// Create the crypto key configuration object.
$cryptoKey = (new CryptoKey())
->setKmsWrapped($kmsWrappedCryptoKey);
// Specify how to un-encrypt the previously de-identified information.
$cryptoReplaceFfxFpeConfig = (new CryptoReplaceFfxFpeConfig())
->setCryptoKey($cryptoKey)
->setCommonAlphabet($commonAlphabet)
->setSurrogateInfoType($surrogateType);
// Create the information transform configuration objects.
$primitiveTransformation = (new PrimitiveTransformation())
->setCryptoReplaceFfxFpeConfig($cryptoReplaceFfxFpeConfig);
$infoTypeTransformation = (new InfoTypeTransformation())
->setPrimitiveTransformation($primitiveTransformation);
$infoTypeTransformations = (new InfoTypeTransformations())
->setTransformations([$infoTypeTransformation]);
// Create the reidentification configuration object.
$reidentifyConfig = (new DeidentifyConfig())
->setInfoTypeTransformations($infoTypeTransformations);
// Run request.
$reidentifyContentRequest = (new ReidentifyContentRequest())
->setParent($parent)
->setReidentifyConfig($reidentifyConfig)
->setInspectConfig($inspectConfig)
->setItem($item);
$response = $dlp->reidentifyContent($reidentifyContentRequest);
// Print the results.
printf($response->getItem()->getValue());
}Python
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import base64
import google.cloud.dlp
def reidentify_text_with_fpe(
project: str,
input_str: str,
key_name: str = None,
wrapped_key: str = None,
) -> None:
"""
Uses the Data Loss Prevention API to re-identify sensitive data in a
string using Format Preserving Encryption (FPE).
Args:
project: The Google Cloud project id to use as a parent resource.
input_str: The string to re-identify (will be treated as text).
key_name: The name of the Cloud KMS key used to encrypt ('wrap') the
AES-256 key. Example:
key_name = 'projects/YOUR_GCLOUD_PROJECT/locations/YOUR_LOCATION/
keyRings/YOUR_KEYRING_NAME/cryptoKeys/YOUR_KEY_NAME'
wrapped_key: The encrypted ('wrapped') AES-256 key to use. This key
should be encrypted using the Cloud KMS key specified by key_name.
"""
# Instantiate a client.
dlp = google.cloud.dlp_v2.DlpServiceClient()
# The wrapped key is base64-encoded, but the library expects a binary
# string, so decode it here.
wrapped_key = base64.b64decode(wrapped_key)
# Specify the type of info the inspection will re-identify.
# This must use the same custom infoType that was used as a
# surrogate during the initial encryption.
surrogate_info_type = {"name": "PHONE_NUMBER"}
# Construct FPE configuration dictionary
crypto_replace_ffx_fpe_config = {
"crypto_key": {
"kms_wrapped": {"wrapped_key": wrapped_key, "crypto_key_name": key_name}
},
"common_alphabet": "NUMERIC",
"surrogate_info_type": surrogate_info_type,
}
# Construct re-identify configuration dictionary
reidentify_config = {
"info_type_transformations": {
"transformations": [
{
"primitive_transformation": {
"crypto_replace_ffx_fpe_config": crypto_replace_ffx_fpe_config,
},
"info_types": [surrogate_info_type],
}
]
}
}
# Construct inspect configuration dictionary
inspect_config = {
"custom_info_types": [{"info_type": surrogate_info_type, "surrogate_type": {}}]
}
# Construct the `item`.
item = {"value": input_str}
# Convert the project id into a full resource id.
parent = f"projects/{project}/locations/global"
# Call the API.
response = dlp.reidentify_content(
request={
"parent": parent,
"reidentify_config": reidentify_config,
"inspect_config": inspect_config,
"item": item,
}
)
# Print results
print(f"Text after re-identification: {response.item.value}")
형식 보존 암호화 예시: 서로게이트 유형으로 재식별
다음은 Sensitive Data Protection을 사용하여 CryptoReplaceFfxFpeConfig 변환 메서드를 통해 익명화된 민감한 정보를 재식별하는 방법을 보여주는 여러 언어로 된 샘플 코드입니다. 자세한 내용은 이 페이지의 형식 보존 암호화를 참조하세요
C#
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
using System;
using Google.Api.Gax.ResourceNames;
using Google.Cloud.Dlp.V2;
using Google.Protobuf;
using static Google.Cloud.Dlp.V2.CryptoReplaceFfxFpeConfig.Types;
public class ReidentifyFreeTextWithFpeUsingSurrogate
{
public static ReidentifyContentResponse ReidentifyFreeText(
string projectId,
string text,
string unwrappedKey,
FfxCommonNativeAlphabet alphabet = FfxCommonNativeAlphabet.Numeric,
InfoType surrogateType = null)
{
// Instantiate dlp client.
var dlp = DlpServiceClient.Create();
// Construct the infoType which will be used as surrogate type and infoType both.
var infoType = surrogateType ?? new InfoType { Name = "PHONE_TOKEN" };
// Construct crypto replace config using crypto key name and wrapped key.
var cryptoReplaceFfxFpeConfig = new CryptoReplaceFfxFpeConfig
{
CryptoKey = new CryptoKey
{
Unwrapped = new UnwrappedCryptoKey
{
Key = ByteString.FromBase64(unwrappedKey)
}
},
CommonAlphabet = alphabet,
SurrogateInfoType = infoType
};
// Construct the re-identify config using crypto replace config.
var reidentifyConfig = new DeidentifyConfig
{
InfoTypeTransformations = new InfoTypeTransformations
{
Transformations =
{
new InfoTypeTransformations.Types.InfoTypeTransformation
{
PrimitiveTransformation = new PrimitiveTransformation
{
CryptoReplaceFfxFpeConfig = cryptoReplaceFfxFpeConfig
}
}
}
}
};
// Construct the inspect config with the help of custom info type.
var inspectConfig = new InspectConfig
{
CustomInfoTypes =
{
new CustomInfoType
{
InfoType = infoType,
SurrogateType = new CustomInfoType.Types.SurrogateType()
}
}
};
// Construct the request.
var request = new ReidentifyContentRequest
{
ParentAsLocationName = new LocationName(projectId, "global"),
ReidentifyConfig = reidentifyConfig,
InspectConfig = inspectConfig,
Item = new ContentItem { Value = text }
};
// Call the API.
ReidentifyContentResponse response = dlp.ReidentifyContent(request);
// Inspect the response.
Console.WriteLine($"Re-identified content: {response.Item.Value}");
return response;
}
}
Go
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import (
"context"
"encoding/base64"
"fmt"
"io"
dlp "cloud.google.com/go/dlp/apiv2"
"cloud.google.com/go/dlp/apiv2/dlppb"
)
// reidentifyFreeTextWithFPEUsingSurrogate re-identifies free text with FPE using surrogate
func reidentifyFreeTextWithFPEUsingSurrogate(w io.Writer, projectID, inputStr, surrogateType, unWrappedKey string) error {
// projectId := "your-project-id"
// inputStr := "My phone number is PHONE_TOKEN(10):4068372189"
// surrogateType := "PHONE_TOKEN"
// unWrappedKey := "hXribiHR6kvVKmj5ptTZLRTj8+u0eBQzwcrEPwyGhe8="
ctx := context.Background()
// Initialize a client once and reuse it to send multiple requests. Clients
// are safe to use across goroutines. When the client is no longer needed,
// call the Close method to cleanup its resources.
client, err := dlp.NewClient(ctx)
if err != nil {
return err
}
// Closing the client safely cleans up background resources.
defer client.Close()
// The wrapped key is base64-encoded, but the library expects a binary
// string, so decode it here.
keyBytes, err := base64.StdEncoding.DecodeString(unWrappedKey)
if err != nil {
return err
}
// using the unwrapped key and surrogate info type construct cryptoReplaceConfig
cryptoReplaceConfig := &dlppb.CryptoReplaceFfxFpeConfig{
CryptoKey: &dlppb.CryptoKey{
Source: &dlppb.CryptoKey_Unwrapped{
Unwrapped: &dlppb.UnwrappedCryptoKey{
Key: keyBytes,
},
},
},
Alphabet: &dlppb.CryptoReplaceFfxFpeConfig_CommonAlphabet{
CommonAlphabet: dlppb.CryptoReplaceFfxFpeConfig_NUMERIC,
},
SurrogateInfoType: &dlppb.InfoType{
Name: surrogateType,
},
}
// construct infoType transformations
infoTypeTransformations := &dlppb.InfoTypeTransformations{
Transformations: []*dlppb.InfoTypeTransformations_InfoTypeTransformation{
{
PrimitiveTransformation: &dlppb.PrimitiveTransformation{
Transformation: &dlppb.PrimitiveTransformation_CryptoReplaceFfxFpeConfig{
CryptoReplaceFfxFpeConfig: cryptoReplaceConfig,
},
},
},
},
}
// construct re-identify config
reIdentifyConfig := &dlppb.DeidentifyConfig{
Transformation: &dlppb.DeidentifyConfig_InfoTypeTransformations{
InfoTypeTransformations: infoTypeTransformations,
},
}
// construct inspect config to pass in req
inspectConfig := &dlppb.InspectConfig{
CustomInfoTypes: []*dlppb.CustomInfoType{
{
InfoType: &dlppb.InfoType{
Name: surrogateType,
},
Type: &dlppb.CustomInfoType_SurrogateType_{
SurrogateType: &dlppb.CustomInfoType_SurrogateType{},
},
},
},
}
// Construct the de-identification request to be sent by the client.
req := &dlppb.ReidentifyContentRequest{
Parent: fmt.Sprintf("projects/%s/locations/global", projectID),
ReidentifyConfig: reIdentifyConfig,
InspectConfig: inspectConfig,
Item: &dlppb.ContentItem{
DataItem: &dlppb.ContentItem_Value{
Value: inputStr,
},
},
}
// Send the request.
r, err := client.ReidentifyContent(ctx, req)
if err != nil {
return err
}
// Print the result.
fmt.Fprintf(w, "output: %v", r.GetItem().GetValue())
return nil
}
Java
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import com.google.cloud.dlp.v2.DlpServiceClient;
import com.google.common.io.BaseEncoding;
import com.google.privacy.dlp.v2.ContentItem;
import com.google.privacy.dlp.v2.CryptoKey;
import com.google.privacy.dlp.v2.CryptoReplaceFfxFpeConfig;
import com.google.privacy.dlp.v2.CustomInfoType;
import com.google.privacy.dlp.v2.DeidentifyConfig;
import com.google.privacy.dlp.v2.InfoType;
import com.google.privacy.dlp.v2.InfoTypeTransformations;
import com.google.privacy.dlp.v2.InspectConfig;
import com.google.privacy.dlp.v2.LocationName;
import com.google.privacy.dlp.v2.PrimitiveTransformation;
import com.google.privacy.dlp.v2.ReidentifyContentRequest;
import com.google.privacy.dlp.v2.ReidentifyContentResponse;
import com.google.privacy.dlp.v2.UnwrappedCryptoKey;
import com.google.protobuf.ByteString;
import java.io.IOException;
import java.util.Base64;
import javax.crypto.KeyGenerator;
import javax.crypto.SecretKey;
public class ReidentifyFreeTextWithFpeUsingSurrogate {
public static void main(String[] args) throws Exception {
// TODO(developer): Replace these variables before running the sample.
// The Google Cloud project id to use as a parent resource.
String projectId = "your-project-id";
// The string to de-identify.
String textToDeIdentify = "My phone number is 4359916731";
// The base64-encoded AES-256 key to use.
String base64EncodedKey = "your-base64-encoded-key";
// Obtain the de-identified text.
String textToReIdentify =
DeidentifyFreeTextWithFpeUsingSurrogate.deIdentifyWithFpeSurrogate(
projectId, textToDeIdentify, base64EncodedKey);
reIdentifyWithFpeSurrogate(projectId, textToReIdentify, base64EncodedKey);
}
// Re-identifies sensitive data in a string that was encrypted by Format Preserving Encryption
// (FPE) with surrogate type.
public static void reIdentifyWithFpeSurrogate(
String projectId, String textToReIdentify, String unwrappedKey) throws IOException {
// Initialize client that will be used to send requests. This client only needs to be created
// once, and can be reused for multiple requests. After completing all of your requests, call
// the "close" method on the client to safely clean up any remaining background resources.
try (DlpServiceClient dlp = DlpServiceClient.create()) {
// Specify what content you want the service to re-identify.
ContentItem contentItem = ContentItem.newBuilder().setValue(textToReIdentify).build();
CustomInfoType.SurrogateType surrogateType =
CustomInfoType.SurrogateType.newBuilder().build();
// Specify the surrogate type used at time of de-identification.
InfoType surrogateInfoType = InfoType.newBuilder().setName("PHONE_TOKEN").build();
CustomInfoType customInfoType =
CustomInfoType.newBuilder()
.setInfoType(surrogateInfoType)
.setSurrogateType(surrogateType)
.build();
InspectConfig inspectConfig =
InspectConfig.newBuilder().addCustomInfoTypes(customInfoType).build();
// Specify an unwrapped crypto key.
UnwrappedCryptoKey unwrappedCryptoKey =
UnwrappedCryptoKey.newBuilder()
.setKey(ByteString.copyFrom(BaseEncoding.base64().decode(unwrappedKey)))
.build();
CryptoKey cryptoKey = CryptoKey.newBuilder().setUnwrapped(unwrappedCryptoKey).build();
// Specify how to decrypt the previously de-identified information.
CryptoReplaceFfxFpeConfig cryptoReplaceFfxFpeConfig =
CryptoReplaceFfxFpeConfig.newBuilder()
.setCryptoKey(cryptoKey)
// Set of characters in the input text. For more info, see
// https://cloud.google.com/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#DeidentifyTemplate.FfxCommonNativeAlphabet
.setCommonAlphabet(CryptoReplaceFfxFpeConfig.FfxCommonNativeAlphabet.NUMERIC)
.setSurrogateInfoType(surrogateInfoType)
.build();
PrimitiveTransformation primitiveTransformation =
PrimitiveTransformation.newBuilder()
.setCryptoReplaceFfxFpeConfig(cryptoReplaceFfxFpeConfig)
.build();
InfoTypeTransformations.InfoTypeTransformation infoTypeTransformation =
InfoTypeTransformations.InfoTypeTransformation.newBuilder()
.setPrimitiveTransformation(primitiveTransformation)
.build();
InfoTypeTransformations transformations =
InfoTypeTransformations.newBuilder().addTransformations(infoTypeTransformation).build();
DeidentifyConfig reidentifyConfig =
DeidentifyConfig.newBuilder().setInfoTypeTransformations(transformations).build();
// Combine configurations into a request for the service.
ReidentifyContentRequest request =
ReidentifyContentRequest.newBuilder()
.setParent(LocationName.of(projectId, "global").toString())
.setItem(contentItem)
.setInspectConfig(inspectConfig)
.setReidentifyConfig(reidentifyConfig)
.build();
// Send the request and receive response from the service.
ReidentifyContentResponse response = dlp.reidentifyContent(request);
// Print the results.
System.out.println("Text after re-identification: " + response.getItem().getValue());
}
}
}Node.js
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
// Imports the Google Cloud Data Loss Prevention library
const DLP = require('@google-cloud/dlp');
// Instantiates a client
const dlp = new DLP.DlpServiceClient();
// The project ID to run the API call under
// const projectId = 'my-project';
// The string to Re-identify
// const string = 'PHONE_TOKEN(10):########';
// The set of characters to replace sensitive ones with
// For more information, see https://cloud.google.com/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#ffxcommonnativealphabet
// const alphabet = 'NUMERIC';
// InfoTypes
// const infoTypes = [{name: 'PHONE_NUMBER'}];
// Surrogate Type
// const surrogateType = 'PHONE_TOKEN';
// The base64-encoded AES-256 key to use
// const unwrappedKey = 'YWJjZGVmZ2hpamtsbW5vcA==';
async function reidentifyWithFpeSurrogate() {
// Specify an unwrapped crypto key.
unwrappedKey = Buffer.from(unwrappedKey, 'base64');
// Specify how the info from the inspection should be encrypted.
const cryptoReplaceFfxFpeConfig = {
cryptoKey: {
unwrapped: {
key: unwrappedKey,
},
},
commonAlphabet: alphabet,
surrogateInfoType: {name: surrogateType},
};
// Construct the inspect configuration.
const inspectConfig = {
customInfoTypes: [
{
infoType: {
name: surrogateType,
},
surrogateType: {},
},
],
};
// Set the text to be re-identified.
const item = {value: string};
// Combine configurations into a request for the service.
const request = {
parent: `projects/${projectId}/locations/global`,
reidentifyConfig: {
infoTypeTransformations: {
transformations: [
{
primitiveTransformation: {
cryptoReplaceFfxFpeConfig: cryptoReplaceFfxFpeConfig,
},
},
],
},
},
item: item,
inspectConfig: inspectConfig,
};
// Run re-identification request
const [response] = await dlp.reidentifyContent(request);
const reidentifiedItem = response.item;
// Print results
console.log(reidentifiedItem.value);
}
reidentifyWithFpeSurrogate();PHP
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
/**
* Re-identify free text with FPE using a surrogate.
* Uses the Cloud Data Loss Prevention API to re-identify sensitive data in a string that was
* encrypted by format-preserving encryption (FPE) with a surrogate type. The encryption is
* performed with an unwrapped key.
*
* @param string $callingProjectId The GCP Project ID to run the API call under.
* @param string $string The string to reidentify.
* @param string $unwrappedKey The base64-encoded AES-256 key to use.
* @param string $surrogateTypeName The name of the surrogate custom info type to used during
* the encryption process.
*/
function reidentify_free_text_with_fpe_using_surrogate(
// TODO(developer): Replace sample parameters before running the code.
string $callingProjectId,
string $string,
string $unwrappedKey = 'YWJjZGVmZ2hpamtsbW5vcA==',
string $surrogateTypeName = 'PHONE_TOKEN'
): void {
// Instantiate a client.
$dlp = new DlpServiceClient();
$parent = "projects/$callingProjectId/locations/global";
// Specify an unwrapped crypto key.
$unwrapped = (new UnwrappedCryptoKey())
->setKey(base64_decode($unwrappedKey));
$cryptoKey = (new CryptoKey())
->setUnwrapped($unwrapped);
// Specify the surrogate type used at time of de-identification.
$surrogateType = (new InfoType())
->setName($surrogateTypeName);
// The set of characters to replace sensitive ones with.
// For more information, see https://cloud.google.com/dlp/docs/reference/rest/V2/organizations.deidentifyTemplates#ffxcommonnativealphabet
$commonAlphabet = FfxCommonNativeAlphabet::NUMERIC;
// Specify how to decrypt the previously de-identified information.
$cryptoReplaceFfxFpeConfig = (new CryptoReplaceFfxFpeConfig())
->setCryptoKey($cryptoKey)
->setCommonAlphabet($commonAlphabet)
->setSurrogateInfoType($surrogateType);
// Create the information transform configuration objects.
$primitiveTransformation = (new PrimitiveTransformation())
->setCryptoReplaceFfxFpeConfig($cryptoReplaceFfxFpeConfig);
$infoTypeTransformation = (new InfoTypeTransformation())
->setPrimitiveTransformation($primitiveTransformation);
$infoTypeTransformations = (new InfoTypeTransformations())
->setTransformations([$infoTypeTransformation]);
// Create the reidentification configuration object.
$reidentifyConfig = (new DeidentifyConfig())
->setInfoTypeTransformations($infoTypeTransformations);
// Create the inspect configuration object.
// Specify the type of info the inspection will look for.
$infotype = (new InfoType())
->setName($surrogateTypeName);
$customInfoType = (new CustomInfoType())
->setInfoType($infotype)
->setSurrogateType((new SurrogateType()));
$inspectConfig = (new InspectConfig())
->setCustomInfoTypes([$customInfoType]);
// Specify the content to be re-identify.
$content = (new ContentItem())
->setValue($string);
// Run request.
$reidentifyContentRequest = (new ReidentifyContentRequest())
->setParent($parent)
->setReidentifyConfig($reidentifyConfig)
->setInspectConfig($inspectConfig)
->setItem($content);
$response = $dlp->reidentifyContent($reidentifyContentRequest);
// Print the results.
printf($response->getItem()->getValue());
}Python
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import base64
import google.cloud.dlp
def reidentify_free_text_with_fpe_using_surrogate(
project: str,
input_str: str,
alphabet: str = "NUMERIC",
surrogate_type: str = "PHONE_TOKEN",
unwrapped_key: str = "YWJjZGVmZ2hpamtsbW5vcA==",
) -> None:
"""Uses the Data Loss Prevention API to reidentify sensitive data in a
string that was encrypted by Format Preserving Encryption (FPE) with
surrogate type. The encryption is performed with an unwrapped key.
Args:
project: The Google Cloud project id to use as a parent resource.
input_str: The string to deidentify (will be treated as text).
alphabet: The set of characters to replace sensitive ones with. For
more information, see https://cloud.google.com/dlp/docs/reference/
rest/v2beta2/organizations.deidentifyTemplates#ffxcommonnativealphabet
surrogate_type: The name of the surrogate custom info type to used
during the encryption process.
unwrapped_key: The base64-encoded AES-256 key to use.
Returns:
None; the response from the API is printed to the terminal.
"""
# Instantiate a client
dlp = google.cloud.dlp_v2.DlpServiceClient()
# Convert the project id into a full resource id.
parent = f"projects/{project}/locations/global"
# The wrapped key is base64-encoded, but the library expects a binary
# string, so decode it here.
unwrapped_key = base64.b64decode(unwrapped_key)
# Construct Deidentify Config
transformation = {
"primitive_transformation": {
"crypto_replace_ffx_fpe_config": {
"crypto_key": {"unwrapped": {"key": unwrapped_key}},
"common_alphabet": alphabet,
"surrogate_info_type": {"name": surrogate_type},
}
}
}
reidentify_config = {
"info_type_transformations": {"transformations": [transformation]}
}
inspect_config = {
"custom_info_types": [
{"info_type": {"name": surrogate_type}, "surrogate_type": {}}
]
}
# Convert string to item
item = {"value": input_str}
# Call the API
response = dlp.reidentify_content(
request={
"parent": parent,
"reidentify_config": reidentify_config,
"inspect_config": inspect_config,
"item": item,
}
)
# Print results
print(response.item.value)
형식 보존 암호화 예시: 테이블에서 민감한 정보 재식별
다음은 Sensitive Data Protection을 사용하여 CryptoReplaceFfxFpeConfig 변환 메서드를 통해 익명화된 테이블에서 민감한 정보를 재식별하는 방법을 보여주는 여러 언어로 된 샘플 코드입니다. 자세한 내용은 이 페이지의 형식 보존 암호화를 참조하세요
C#
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
using System;
using Google.Api.Gax.ResourceNames;
using Google.Cloud.Dlp.V2;
using Google.Protobuf;
using static Google.Cloud.Dlp.V2.CryptoReplaceFfxFpeConfig.Types;
public class ReidentifyTableDataWithFpe
{
public static Table ReidentifyTableData(
string projectId,
string keyName,
string wrappedKey,
FfxCommonNativeAlphabet alphabet = FfxCommonNativeAlphabet.Numeric,
Table tableToInspect = null)
{
// Instantiate a client.
var dlp = DlpServiceClient.Create();
// Construct the table if null.
var table = tableToInspect;
if (table == null)
{
var row1 = new Value[]
{
new Value { StringValue = "28777" },
new Value { StringValue = "Justin" }
};
var row2 = new Value[]
{
new Value { StringValue = "28778" },
new Value { StringValue = "Gary" }
};
table = new Table
{
Headers =
{
new FieldId { Name = "Employee ID" },
new FieldId { Name = "Employee Name" }
},
Rows =
{
new Table.Types.Row { Values = { row1 } },
new Table.Types.Row { Values = { row2 } }
}
};
}
// Construct the content item by providing the table.
var contentItem = new ContentItem { Table = table };
// Specify how to decrypt the previously de-identified information.
var cryptoReplaceFfxFpeConfig = new CryptoReplaceFfxFpeConfig
{
CryptoKey = new CryptoKey
{
KmsWrapped = new KmsWrappedCryptoKey
{
CryptoKeyName = keyName,
WrappedKey = ByteString.FromBase64(wrappedKey)
}
},
CommonAlphabet = alphabet
};
// Specify the field to be decrypted.
var fields = new FieldId[] { new FieldId { Name = "Employee ID" } };
// Construct the re-identify config and specify the transformation.
var reidentifyConfig = new DeidentifyConfig
{
RecordTransformations = new RecordTransformations
{
FieldTransformations =
{
new FieldTransformation
{
PrimitiveTransformation = new PrimitiveTransformation
{
CryptoReplaceFfxFpeConfig = cryptoReplaceFfxFpeConfig,
},
Fields = { fields }
}
}
}
};
// Construct the request.
var request = new ReidentifyContentRequest
{
Parent = new LocationName(projectId, "global").ToString(),
Item = contentItem,
ReidentifyConfig = reidentifyConfig
};
// Call the API.
ReidentifyContentResponse response = dlp.ReidentifyContent(request);
// Inspect the response.
Console.WriteLine($"Table after re-identification: {response.Item.Table}");
return response.Item.Table;
}
}
Go
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import (
"context"
"encoding/base64"
"fmt"
"io"
dlp "cloud.google.com/go/dlp/apiv2"
"cloud.google.com/go/dlp/apiv2/dlppb"
)
// reidTableDataWithFPE re-identifies table data with FPE
func reidTableDataWithFPE(w io.Writer, projectID, kmsKeyName, wrappedAesKey string) error {
// projectId := "my-project-id"
/* kmsKeyName := "projects/YOUR_PROJECT/"
+ "locations/YOUR_KEYRING_REGION/"
+ "keyRings/YOUR_KEYRING_NAME/"
+ "cryptoKeys/YOUR_KEY_NAME"
*/
// wrappedAesKey := "YOUR_ENCRYPTED_AES_256_KEY"
ctx := context.Background()
// Initialize a client once and reuse it to send multiple requests. Clients
// are safe to use across goroutines. When the client is no longer needed,
// call the Close method to cleanup its resources.
client, err := dlp.NewClient(ctx)
if err != nil {
return err
}
// Closing the client safely cleans up background resources.
defer client.Close()
// Specify the table data that needs to be re-identified.
tableToReIdentify := &dlppb.Table{
Headers: []*dlppb.FieldId{
{Name: "Employee ID"},
},
Rows: []*dlppb.Table_Row{
{
Values: []*dlppb.Value{
{
Type: &dlppb.Value_StringValue{
StringValue: "90511",
},
},
},
},
},
}
// Specify the content you want to re-identify.
contentItem := &dlppb.ContentItem{
DataItem: &dlppb.ContentItem_Table{
Table: tableToReIdentify,
},
}
// Specify an encrypted AES-256 key and the name of the Cloud KMS key that encrypted it.
kmsWrappedCryptoKey, err := base64.StdEncoding.DecodeString(wrappedAesKey)
if err != nil {
return err
}
cryptoKey := &dlppb.CryptoKey{
Source: &dlppb.CryptoKey_KmsWrapped{
KmsWrapped: &dlppb.KmsWrappedCryptoKey{
WrappedKey: kmsWrappedCryptoKey,
CryptoKeyName: kmsKeyName,
},
},
}
// Specify how to un-encrypt the previously de-identified information.
cryptoReplaceFfxFpeConfig := &dlppb.CryptoReplaceFfxFpeConfig{
CryptoKey: cryptoKey,
Alphabet: &dlppb.CryptoReplaceFfxFpeConfig_CommonAlphabet{
CommonAlphabet: dlppb.CryptoReplaceFfxFpeConfig_NUMERIC,
},
}
primitiveTransformation := &dlppb.PrimitiveTransformation{
Transformation: &dlppb.PrimitiveTransformation_CryptoReplaceFfxFpeConfig{
CryptoReplaceFfxFpeConfig: cryptoReplaceFfxFpeConfig,
},
}
// Specify field to be decrypted.
fieldId := &dlppb.FieldId{
Name: "Employee ID",
}
// Associate the decryption with the specified field.
fieldTransformation := &dlppb.FieldTransformation{
Transformation: &dlppb.FieldTransformation_PrimitiveTransformation{
PrimitiveTransformation: primitiveTransformation,
},
Fields: []*dlppb.FieldId{
fieldId,
},
}
recordTransformations := &dlppb.RecordTransformations{
FieldTransformations: []*dlppb.FieldTransformation{
fieldTransformation,
},
}
deidentifyConfig := &dlppb.DeidentifyConfig{
Transformation: &dlppb.DeidentifyConfig_RecordTransformations{
RecordTransformations: recordTransformations,
},
}
// Combine configurations into a request for the service.
req := &dlppb.ReidentifyContentRequest{
Parent: fmt.Sprintf("projects/%s/locations/global", projectID),
ReidentifyConfig: deidentifyConfig,
Item: contentItem,
}
// Send the request and receive response from the service.
resp, err := client.ReidentifyContent(ctx, req)
if err != nil {
return err
}
// Print the result.
fmt.Fprintf(w, "Table after re-identification : %v", resp.GetItem().GetTable())
return nil
}
Java
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import com.google.cloud.dlp.v2.DlpServiceClient;
import com.google.common.io.BaseEncoding;
import com.google.privacy.dlp.v2.ContentItem;
import com.google.privacy.dlp.v2.CryptoKey;
import com.google.privacy.dlp.v2.CryptoReplaceFfxFpeConfig;
import com.google.privacy.dlp.v2.CryptoReplaceFfxFpeConfig.FfxCommonNativeAlphabet;
import com.google.privacy.dlp.v2.DeidentifyConfig;
import com.google.privacy.dlp.v2.FieldId;
import com.google.privacy.dlp.v2.FieldTransformation;
import com.google.privacy.dlp.v2.KmsWrappedCryptoKey;
import com.google.privacy.dlp.v2.LocationName;
import com.google.privacy.dlp.v2.PrimitiveTransformation;
import com.google.privacy.dlp.v2.RecordTransformations;
import com.google.privacy.dlp.v2.ReidentifyContentRequest;
import com.google.privacy.dlp.v2.ReidentifyContentResponse;
import com.google.privacy.dlp.v2.Table;
import com.google.privacy.dlp.v2.Table.Row;
import com.google.privacy.dlp.v2.Value;
import com.google.protobuf.ByteString;
import java.io.IOException;
public class ReIdentifyTableWithFpe {
public static void main(String[] args) throws Exception {
// TODO(developer): Replace these variables before running the sample.
String projectId = "your-project-id";
String kmsKeyName =
"projects/YOUR_PROJECT/"
+ "locations/YOUR_KEYRING_REGION/"
+ "keyRings/YOUR_KEYRING_NAME/"
+ "cryptoKeys/YOUR_KEY_NAME";
String wrappedAesKey = "YOUR_ENCRYPTED_AES_256_KEY";
Table tableToReIdentify =
Table.newBuilder()
.addHeaders(FieldId.newBuilder().setName("Employee ID").build())
.addRows(
Row.newBuilder()
.addValues(Value.newBuilder().setStringValue("28777").build())
.build())
.build();
reIdentifyTableWithFpe(projectId, tableToReIdentify, kmsKeyName, wrappedAesKey);
}
public static void reIdentifyTableWithFpe(
String projectId, Table tableToReIdentify, String kmsKeyName, String wrappedAesKey)
throws IOException {
// Initialize client that will be used to send requests. This client only needs to be created
// once, and can be reused for multiple requests. After completing all of your requests, call
// the "close" method on the client to safely clean up any remaining background resources.
try (DlpServiceClient dlp = DlpServiceClient.create()) {
// Specify what content you want the service to re-identify.
ContentItem contentItem = ContentItem.newBuilder().setTable(tableToReIdentify).build();
// Specify an encrypted AES-256 key and the name of the Cloud KMS key that encrypted it.
KmsWrappedCryptoKey kmsWrappedCryptoKey =
KmsWrappedCryptoKey.newBuilder()
.setWrappedKey(ByteString.copyFrom(BaseEncoding.base64().decode(wrappedAesKey)))
.setCryptoKeyName(kmsKeyName)
.build();
CryptoKey cryptoKey = CryptoKey.newBuilder().setKmsWrapped(kmsWrappedCryptoKey).build();
// Specify how to un-encrypt the previously de-identified information.
CryptoReplaceFfxFpeConfig cryptoReplaceFfxFpeConfig =
CryptoReplaceFfxFpeConfig.newBuilder()
.setCryptoKey(cryptoKey)
// Set of characters in the input text. For more info, see
// https://cloud.google.com/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#DeidentifyTemplate.FfxCommonNativeAlphabet
.setCommonAlphabet(FfxCommonNativeAlphabet.NUMERIC)
.build();
PrimitiveTransformation primitiveTransformation =
PrimitiveTransformation.newBuilder()
.setCryptoReplaceFfxFpeConfig(cryptoReplaceFfxFpeConfig)
.build();
// Specify field to be decrypted.
FieldId fieldId = FieldId.newBuilder().setName("Employee ID").build();
// Associate the decryption with the specified field.
FieldTransformation fieldTransformation =
FieldTransformation.newBuilder()
.setPrimitiveTransformation(primitiveTransformation)
.addFields(fieldId)
.build();
RecordTransformations transformations =
RecordTransformations.newBuilder().addFieldTransformations(fieldTransformation).build();
DeidentifyConfig reidentifyConfig =
DeidentifyConfig.newBuilder().setRecordTransformations(transformations).build();
// Combine configurations into a request for the service.
ReidentifyContentRequest request =
ReidentifyContentRequest.newBuilder()
.setParent(LocationName.of(projectId, "global").toString())
.setItem(contentItem)
.setReidentifyConfig(reidentifyConfig)
.build();
// Send the request and receive response from the service
ReidentifyContentResponse response = dlp.reidentifyContent(request);
// Print the results
System.out.println("Table after re-identification: " + response.getItem().getValue());
}
}
}Node.js
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
// Imports the Google Cloud Data Loss Prevention library
const DLP = require('@google-cloud/dlp');
// Instantiates a client
const dlp = new DLP.DlpServiceClient();
// The project ID to run the API call under
// const projectId = 'my-project';
// The set of characters to replace sensitive ones with
// For more information, see https://cloud.google.com/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#ffxcommonnativealphabet
// const alphabet = 'ALPHA_NUMERIC';
// The name of the Cloud KMS key used to encrypt ('wrap') the AES-256 key
// const keyName = 'projects/YOUR_GCLOUD_PROJECT/locations/YOUR_LOCATION/keyRings/YOUR_KEYRING_NAME/cryptoKeys/YOUR_KEY_NAME';
// The encrypted ('wrapped') AES-256 key to use
// This key should be encrypted using the Cloud KMS key specified above
// const wrappedKey = 'YOUR_ENCRYPTED_AES_256_KEY'
// The name of the surrogate custom info type to use when reidentifying data
// const surrogateType = 'SOME_INFO_TYPE_DEID';
// Table to re-identify
const tablularData = {
headers: [{name: 'Employee ID'}],
rows: [{values: [{stringValue: '90511'}]}],
};
async function reidentifyTableWithFpe() {
// Specify field to be re-identified.
const fieldIds = [{name: 'Employee ID'}];
// Specify an encrypted AES-256 key and the name of the Cloud KMS key that encrypted it
const cryptoKeyConfig = {
kmsWrapped: {
wrappedKey: wrappedKey,
cryptoKeyName: keyName,
},
};
// Associate transformation with crypto key congurations.
const primitiveTransformation = {
cryptoReplaceFfxFpeConfig: {
cryptoKey: cryptoKeyConfig,
commonAlphabet: alphabet,
},
};
// Combine configurations into a request for the service.
const request = {
parent: `projects/${projectId}/locations/global`,
reidentifyConfig: {
recordTransformations: {
fieldTransformations: [
{
fields: fieldIds,
primitiveTransformation: primitiveTransformation,
},
],
},
},
item: {
table: tablularData,
},
};
// Send the request and receive response from the service.
const [response] = await dlp.reidentifyContent(request);
// Print the results.
console.log(
`Table after re-identification: ${JSON.stringify(response.item.table)}`
);
}
await reidentifyTableWithFpe();PHP
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
use Google\Cloud\Dlp\V2\Client\DlpServiceClient;
use Google\Cloud\Dlp\V2\ContentItem;
use Google\Cloud\Dlp\V2\CryptoKey;
use Google\Cloud\Dlp\V2\CryptoReplaceFfxFpeConfig;
use Google\Cloud\Dlp\V2\CryptoReplaceFfxFpeConfig\FfxCommonNativeAlphabet;
use Google\Cloud\Dlp\V2\DeidentifyConfig;
use Google\Cloud\Dlp\V2\FieldId;
use Google\Cloud\Dlp\V2\FieldTransformation;
use Google\Cloud\Dlp\V2\KmsWrappedCryptoKey;
use Google\Cloud\Dlp\V2\PrimitiveTransformation;
use Google\Cloud\Dlp\V2\RecordTransformations;
use Google\Cloud\Dlp\V2\ReidentifyContentRequest;
use Google\Cloud\Dlp\V2\Table;
use Google\Cloud\Dlp\V2\Table\Row;
use Google\Cloud\Dlp\V2\Value;
/**
* Re-identify table data with FPE.
*
* @param string $callingProjectId The Google Cloud project id to use as a parent resource.
* @param string $inputCsvFile The input file(csv) path to reidentify.
* @param string $outputCsvFile The oupt file path to save reidentify content.
* @param string $encryptedFieldNames The field to be encrypted.
* @param string $kmsKeyName The name of the Cloud KMS key used to encrypt ('wrap') the AES-256 key.
* Example: key_name = 'projects/YOUR_GCLOUD_PROJECT/locations/YOUR_LOCATION/keyRings/YOUR_KEYRING_NAME/cryptoKeys/YOUR_KEY_NAME'
* @param string $wrappedAesKey The encrypted ('wrapped') AES-256 key to use.
*
* */
function reidentify_table_fpe(
string $callingProjectId,
string $inputCsvFile,
string $outputCsvFile,
string $encryptedFieldNames,
string $kmsKeyName,
string $wrappedAesKey
): void {
// Instantiate a client.
$dlp = new DlpServiceClient();
$parent = "projects/$callingProjectId/locations/global";
// Read a CSV file.
$csvLines = file($inputCsvFile, FILE_IGNORE_NEW_LINES);
$csvHeaders = explode(',', $csvLines[0]);
$csvRows = array_slice($csvLines, 1);
// Convert CSV file into protobuf objects.
$tableHeaders = array_map(function ($csvHeader) {
return (new FieldId)
->setName($csvHeader);
}, $csvHeaders);
$tableRows = array_map(function ($csvRow) {
$rowValues = array_map(function ($csvValue) {
return (new Value())
->setStringValue($csvValue);
}, explode(',', $csvRow));
return (new Row())
->setValues($rowValues);
}, $csvRows);
// Construct the table object.
$tableToDeIdentify = (new Table())
->setHeaders($tableHeaders)
->setRows($tableRows);
// Specify the content to be reidentify.
$content = (new ContentItem())
->setTable($tableToDeIdentify);
// Specify an encrypted AES-256 key and the name of the Cloud KMS key that encrypted it.
$kmsWrappedCryptoKey = (new KmsWrappedCryptoKey())
->setWrappedKey(base64_decode($wrappedAesKey))
->setCryptoKeyName($kmsKeyName);
$cryptoKey = (new CryptoKey())
->setKmsWrapped($kmsWrappedCryptoKey);
// Specify how to un-encrypt the previously de-identified information.
$cryptoReplaceFfxFpeConfig = (new CryptoReplaceFfxFpeConfig())
->setCryptoKey($cryptoKey)
->setCommonAlphabet(FfxCommonNativeAlphabet::NUMERIC);
$primitiveTransformation = (new PrimitiveTransformation())
->setCryptoReplaceFfxFpeConfig($cryptoReplaceFfxFpeConfig);
// Specify field to be decrypted.
$encryptedFields = array_map(function ($encryptedFieldName) {
return (new FieldId())
->setName($encryptedFieldName);
}, explode(',', $encryptedFieldNames));
// Associate the decryption with the specified field.
$fieldTransformation = (new FieldTransformation())
->setPrimitiveTransformation($primitiveTransformation)
->setFields($encryptedFields);
$recordtransformations = (new RecordTransformations())
->setFieldTransformations([$fieldTransformation]);
$reidentifyConfig = (new DeidentifyConfig())
->setRecordTransformations($recordtransformations);
// Run request.
$reidentifyContentRequest = (new ReidentifyContentRequest())
->setParent($parent)
->setReidentifyConfig($reidentifyConfig)
->setItem($content);
$response = $dlp->reidentifyContent($reidentifyContentRequest);
// Print the results.
$csvRef = fopen($outputCsvFile, 'w');
fputcsv($csvRef, $csvHeaders);
foreach ($response->getItem()->getTable()->getRows() as $tableRow) {
$values = array_map(function ($tableValue) {
return $tableValue->getStringValue();
}, iterator_to_array($tableRow->getValues()));
fputcsv($csvRef, $values);
};
printf('Table after re-identification (File Location): %s', $outputCsvFile);
}Python
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import base64
from typing import List
import google.cloud.dlp
def reidentify_table_with_fpe(
project: str,
table_header: List[str],
table_rows: List[List[str]],
reid_field_names: List[str],
key_name: str = None,
wrapped_key: bytes = None,
alphabet: str = None,
) -> None:
"""Uses the Data Loss Prevention API to re-identify sensitive data in a
table that was encrypted by Format Preserving Encryption (FPE).
Args:
project: The Google Cloud project id to use as a parent resource.
table_header: List of strings representing table field names.
table_rows: List of rows representing table data.
reid_field_names: A list of fields in table to re-identify.
key_name: The name of the Cloud KMS key used to encrypt ('wrap') the
AES-256 key. Example:
key_name = 'projects/YOUR_GCLOUD_PROJECT/locations/YOUR_LOCATION/
keyRings/YOUR_KEYRING_NAME/cryptoKeys/YOUR_KEY_NAME'
wrapped_key: The decrypted ('wrapped', in bytes) AES-256 key to use. This key
should be encrypted using the Cloud KMS key specified by key_name.
alphabet: The set of characters to replace sensitive ones with. For
more information, see https://cloud.google.com/dlp/docs/reference/
rest/v2/projects.deidentifyTemplates#ffxcommonnativealphabet
"""
# Instantiate a client.
dlp = google.cloud.dlp_v2.DlpServiceClient()
# Construct the `table`. For more details on the table schema, please see
# https://cloud.google.com/dlp/docs/reference/rest/v2/ContentItem#Table
headers = [{"name": val} for val in table_header]
rows = []
for row in table_rows:
rows.append({"values": [{"string_value": cell_val} for cell_val in row]})
table = {"headers": headers, "rows": rows}
# Convert table to `item`
item = {"table": table}
# Specify fields to be re-identified/decrypted.
reid_field_names = [{"name": _i} for _i in reid_field_names]
# Construct FPE configuration dictionary
crypto_replace_ffx_fpe_config = {
"crypto_key": {
"kms_wrapped": {"wrapped_key": wrapped_key, "crypto_key_name": key_name}
},
"common_alphabet": alphabet,
}
# Construct reidentify configuration dictionary
reidentify_config = {
"record_transformations": {
"field_transformations": [
{
"primitive_transformation": {
"crypto_replace_ffx_fpe_config": crypto_replace_ffx_fpe_config,
},
"fields": reid_field_names,
}
]
}
}
# Convert the project id into a full resource id.
parent = f"projects/{project}/locations/global"
# Call the API.
response = dlp.reidentify_content(
request={
"parent": parent,
"reidentify_config": reidentify_config,
"item": item,
}
)
# Print out results.
print(f"Table after re-identification: {response.item.table}")
확정적 암호화
확정적 암호화 변환 메서드(DLP API의 CryptoDeterministicConfig)는 입력 값(Sensitive Data Protection이 감지한 민감한 정보)을 CryptoKey와 함께 AES-SIV를 사용하여 암호화한 다음 원래 값을 암호화된 값의 base64 인코딩된 표현으로 바꿉니다.
확정적 암호화 변환을 사용하면 암호화된 데이터를 보다 효율적으로 검색할 수 있습니다.
입력 값의 특성은 다음과 같습니다.
- 길이는 1자 이상이어야 합니다.
- 문자 집합 제한이 없습니다.
생성된 토큰의 특성은 다음과 같습니다.
- 암호화된 값을 base64로 인코딩한 표현입니다.
- 암호화 후 입력 값의 문자 집합('알파벳') 또는 길이가 보존되지 않습니다.
CryptoKey와 함께 SIV 모드의 AES 암호화를 사용하여 계산됩니다.- 입력 값이 동일한 각 인스턴스는 동일한 토큰으로 익명화되기 때문에 반드시 고유하지는 않습니다. 따라서 암호화된 데이터를 보다 효율적으로 검색할 수 있습니다. 컨텍스트에 설명된 대로 컨텍스트를 일부 '조정'하여 이 동작을 변경할 수 있습니다.
[SURROGATE_TYPE]([LENGTH]):형식의 프리픽스가 추가된 형태로 생성됩니다. 여기서[SURROGATE_TYPE]은 입력 값을 설명하는 서로게이트 infoType을,[LENGTH]는 문자 길이를 나타냅니다. 서로게이트를 사용하면 익명화에 사용된 원래 암호화 키를 사용하여 토큰을 재식별화할 수 있습니다.
다음은 확정적 암호화를 사용하여 익명화하는 JSON 구성의 예시입니다. 전화번호를 익명화하는 중이므로 'PHONE_SURROGATE'를 설명이 포함된 서로게이트 유형으로 사용하도록 선택했습니다.
[CRYPTO_KEY]는 Cloud KMS에서 가져온 래핑되지 않은 암호화 키를 나타냅니다.
{
"deidentifyConfig":{
"infoTypeTransformations":{
"transformations":[
{
"infoTypes":[
{
"name":"PHONE_NUMBER"
}
],
"primitiveTransformation":{
"cryptoDeterministicConfig":{
"cryptoKey":{
"unwrapped":{
"key":"[CRYPTO_KEY]"
}
},
"surrogateInfoType":{
"name":"PHONE_SURROGATE"
}
}
}
}
]
}
},
"inspectConfig":{
"infoTypes":[
{
"name":"PHONE_NUMBER"
}
]
},
"item":{
"value":"My phone number is 206-555-0574, call me"
}
}
이 변환을 사용하여 'My phone number is 206-555-0574' 문자열을 익명화하면 다음과 같은 익명화된 문자열이 생성됩니다.
My phone number is PHONE_SURROGATE(36):ATZBu5OCCSwo+e94xSYnKYljk1OQpkW7qhzx, call me
이 문자열을 재식별화하려면 다음과 같은 JSON 요청을 사용할 수 있습니다. 여기서 [CREPTO_KEY]는 콘텐츠를 익명화하는 데 사용되는 것과 동일한 암호화 키입니다.
{
"reidentifyConfig":{
"infoTypeTransformations":{
"transformations":[
{
"infoTypes":[
{
"name":"PHONE_SURROGATE"
}
],
"primitiveTransformation":{
"cryptoDeterministicConfig":{
"cryptoKey":{
"unwrapped":{
"key":"[CRYPTO_KEY]"
}
},
"surrogateInfoType":{
"name":"PHONE_SURROGATE"
}
}
}
}
]
}
},
"inspectConfig":{
"customInfoTypes":[
{
"infoType":{
"name":"PHONE_SURROGATE"
},
"surrogateType":{
}
}
]
},
"item":{
"value":"My phone number is [PHONE_SURROGATE](36):ATZBu5OCCSwo+e94xSYnKYljk1OQpkW7qhzx, call me"
}
}
이 문자열을 재식별화하면 원래 문자열이 결과로 생성됩니다.
My phone number is 206-555-0574, call me
보안 강화를 위해 래핑된(암호화된) CryptoKey를 대신 사용하려면 빠른 시작: 민감한 텍스트 익명화 및 재식별을 참조하세요. 클라이언트 라이브러리를 사용하여 콘텐츠를 익명화할 준비가 되면 이 페이지에 설명된 형식 보존 암호화를 참조해 래핑된 키(기본적으로 base64 인코딩 문자열)를 디코딩해야 합니다.
확정적 암호화 예시: 익명화
이 예시에서는 CryptoDeterministicConfig 변환 메서드를 사용하여 민감한 정보를 익명화합니다. 자세한 내용은 이 페이지의 확정적 암호화를 참조하세요.
C#
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
using System;
using System.Collections.Generic;
using Google.Api.Gax.ResourceNames;
using Google.Cloud.Dlp.V2;
public class DeidentifyWithDeterministic
{
public static DeidentifyContentResponse Deidentify(
string projectId,
string text,
string keyName,
string wrapperKey,
InfoType surrogateType = null,
IEnumerable<InfoType> infoTypes = null)
{
// Instantiate a client.
var dlp = DlpServiceClient.Create();
// Construct the inspect config by specifying the type of info to be inspected.
var inspectConfig = new InspectConfig
{
InfoTypes =
{
infoTypes ?? new InfoType[] { new InfoType { Name = "PHONE_NUMBER" } }
}
};
// Construct the crypto deterministic config by providing key name, wrapped key and surrogate type.
var cryptoDeterministicConfig = new CryptoDeterministicConfig
{
CryptoKey = new CryptoKey
{
KmsWrapped = new KmsWrappedCryptoKey
{
CryptoKeyName = keyName,
WrappedKey = Google.Protobuf.ByteString.FromBase64(wrapperKey)
}
},
SurrogateInfoType = surrogateType ?? new InfoType { Name = "PHONE_TOKEN" }
};
// Construct the deidentify config using crypto deterministic config.
var deidentifyConfig = new DeidentifyConfig
{
InfoTypeTransformations = new InfoTypeTransformations
{
Transformations =
{
new InfoTypeTransformations.Types.InfoTypeTransformation
{
PrimitiveTransformation = new PrimitiveTransformation
{
CryptoDeterministicConfig = cryptoDeterministicConfig
}
}
}
}
};
// Construct the request.
var request = new DeidentifyContentRequest
{
ParentAsLocationName = new LocationName(projectId, "global"),
DeidentifyConfig = deidentifyConfig,
InspectConfig = inspectConfig,
Item = new ContentItem { Value = text }
};
// Call the API.
DeidentifyContentResponse response = dlp.DeidentifyContent(request);
// Check the de-identified content.
Console.WriteLine($"De-identified content: {response.Item.Value}");
return response;
}
}
Go
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import (
"context"
"encoding/base64"
"fmt"
"io"
dlp "cloud.google.com/go/dlp/apiv2"
"cloud.google.com/go/dlp/apiv2/dlppb"
)
// deIdentifyDeterministicEncryption de-identifies through deterministic encryption
func deIdentifyDeterministicEncryption(w io.Writer, projectID, inputStr string, infoTypeNames []string, keyFileName, cryptoKeyName, surrogateInfoType string) error {
// projectId := "your-project-id"
// inputStr := "My SSN is 111111111"
// infoTypeNames := []string{"US_SOCIAL_SECURITY_NUMBER"}
/* keyFileName := "projects/YOUR_PROJECT/"
+ "locations/YOUR_KEYRING_REGION/"
+ "keyRings/YOUR_KEYRING_NAME/"
+ "cryptoKeys/YOUR_KEY_NAME"
*/
// cryptoKeyName := "YOUR_ENCRYPTED_AES_256_KEY"
// surrogateInfoType := "SSN_TOKEN"
ctx := context.Background()
// Initialize a client once and reuse it to send multiple requests. Clients
// are safe to use across goroutines. When the client is no longer needed,
// call the Close method to cleanup its resources.
client, err := dlp.NewClient(ctx)
if err != nil {
return err
}
// Closing the client safely cleans up background resources.
defer client.Close()
// Specify an encrypted AES-256 key and the name of the Cloud KMS key that encrypted it.
wrappedKey, err := base64.StdEncoding.DecodeString(cryptoKeyName)
if err != nil {
return err
}
// Specify the type of info the inspection will look for.
// See https://cloud.google.com/dlp/docs/infotypes-reference for complete list of info types
var infoTypes []*dlppb.InfoType
for _, it := range infoTypeNames {
infoTypes = append(infoTypes, &dlppb.InfoType{Name: it})
}
// Specify the key used by the encryption function for deterministic encryption.
cryptoReplaceDeterministicConfig := &dlppb.CryptoDeterministicConfig{
CryptoKey: &dlppb.CryptoKey{
Source: &dlppb.CryptoKey_KmsWrapped{
KmsWrapped: &dlppb.KmsWrappedCryptoKey{
WrappedKey: wrappedKey,
CryptoKeyName: keyFileName,
},
},
},
SurrogateInfoType: &dlppb.InfoType{
Name: surrogateInfoType,
},
}
// Specifying the info-types to look for.
inspectConfig := &dlppb.InspectConfig{
InfoTypes: infoTypes,
}
// Specify what content you want the service to de-identify.
contentItem := &dlppb.ContentItem{
DataItem: &dlppb.ContentItem_Value{
Value: inputStr,
},
}
// Specifying the deterministic crypto.
primitiveTransformation := &dlppb.PrimitiveTransformation{
Transformation: &dlppb.PrimitiveTransformation_CryptoDeterministicConfig{
CryptoDeterministicConfig: cryptoReplaceDeterministicConfig,
},
}
// Construct a de-identification config for de-identify deterministic request.
deIdentifyConfig := &dlppb.DeidentifyConfig{
Transformation: &dlppb.DeidentifyConfig_InfoTypeTransformations{
InfoTypeTransformations: &dlppb.InfoTypeTransformations{
Transformations: []*dlppb.InfoTypeTransformations_InfoTypeTransformation{
{
PrimitiveTransformation: primitiveTransformation,
},
},
},
},
}
// Construct the de-identification request to be sent by the client.
req := &dlppb.DeidentifyContentRequest{
Parent: fmt.Sprintf("projects/%s/locations/global", projectID),
DeidentifyConfig: deIdentifyConfig,
InspectConfig: inspectConfig,
Item: contentItem,
}
// Send the request.
resp, err := client.DeidentifyContent(ctx, req)
if err != nil {
return err
}
// Print the results.
fmt.Fprintf(w, "output : %v", resp.GetItem().GetValue())
return nil
}
Java
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import com.google.cloud.dlp.v2.DlpServiceClient;
import com.google.privacy.dlp.v2.ContentItem;
import com.google.privacy.dlp.v2.CryptoDeterministicConfig;
import com.google.privacy.dlp.v2.CryptoKey;
import com.google.privacy.dlp.v2.DeidentifyConfig;
import com.google.privacy.dlp.v2.DeidentifyContentRequest;
import com.google.privacy.dlp.v2.DeidentifyContentResponse;
import com.google.privacy.dlp.v2.InfoType;
import com.google.privacy.dlp.v2.InfoTypeTransformations;
import com.google.privacy.dlp.v2.InspectConfig;
import com.google.privacy.dlp.v2.KmsWrappedCryptoKey;
import com.google.privacy.dlp.v2.LocationName;
import com.google.privacy.dlp.v2.PrimitiveTransformation;
import com.google.protobuf.ByteString;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.util.Collections;
import org.apache.commons.codec.binary.Base64;
public class DeIdenitfyWithDeterministicEncryption {
public static void main(String[] args) throws Exception {
// TODO(developer): Replace these variables before running the sample.
//The Google Cloud project id to use as a parent resource.
String projectId = "your-project-id";
// The string to de-identify.
String textToDeIdentify = "My SSN is 372819127";
// The encrypted ('wrapped') AES-256 key to use.
// This key should be encrypted using the Cloud KMS key specified by key_name.
String wrappedKey = "YOUR_ENCRYPTED_AES_256_KEY";
// The name of the Cloud KMS key used to encrypt ('wrap') the AES-256 key.
String kmsKeyName =
"projects/YOUR_PROJECT/"
+ "locations/YOUR_KEYRING_REGION/"
+ "keyRings/YOUR_KEYRING_NAME/"
+ "cryptoKeys/YOUR_KEY_NAME";
deIdentifyWithDeterministicEncryption(projectId, textToDeIdentify, wrappedKey, kmsKeyName);
}
// De-identifies sensitive data in a string using deterministic encryption. The encryption is
// performed with a wrapped key.
public static String deIdentifyWithDeterministicEncryption(
String projectId, String textToDeIdentify, String wrappedKey, String key) throws IOException {
// Initialize client that will be used to send requests. This client only needs to be created
// once, and can be reused for multiple requests. After completing all of your requests, call
// the "close" method on the client to safely clean up any remaining background resources.
try (DlpServiceClient dlp = DlpServiceClient.create()) {
// Specify what content you want the service to de-identify.
ContentItem contentItem = ContentItem.newBuilder()
.setValue(textToDeIdentify)
.build();
// Specify the type of info the inspection will look for.
// See https://cloud.google.com/dlp/docs/infotypes-reference for complete list of info types
InfoType infoType = InfoType.newBuilder()
.setName("US_SOCIAL_SECURITY_NUMBER")
.build();
InspectConfig inspectConfig = InspectConfig.newBuilder()
.addAllInfoTypes(Collections.singletonList(infoType))
.build();
// Specify an encrypted AES-256 key and the name of the Cloud KMS key that encrypted it.
KmsWrappedCryptoKey unwrappedCryptoKey = KmsWrappedCryptoKey.newBuilder()
.setWrappedKey(ByteString.copyFrom(
Base64.decodeBase64(wrappedKey.getBytes(StandardCharsets.UTF_8))))
.setCryptoKeyName(key)
.build();
CryptoKey cryptoKey = CryptoKey.newBuilder()
.setKmsWrapped(unwrappedCryptoKey)
.build();
// Specify how the info from the inspection should be encrypted.
InfoType surrogateInfoType = InfoType.newBuilder()
.setName("SSN_TOKEN")
.build();
CryptoDeterministicConfig cryptoDeterministicConfig = CryptoDeterministicConfig.newBuilder()
.setSurrogateInfoType(surrogateInfoType)
.setCryptoKey(cryptoKey)
.build();
PrimitiveTransformation primitiveTransformation = PrimitiveTransformation.newBuilder()
.setCryptoDeterministicConfig(cryptoDeterministicConfig)
.build();
InfoTypeTransformations.InfoTypeTransformation infoTypeTransformation =
InfoTypeTransformations.InfoTypeTransformation.newBuilder()
.setPrimitiveTransformation(primitiveTransformation)
.build();
InfoTypeTransformations transformations = InfoTypeTransformations.newBuilder()
.addTransformations(infoTypeTransformation)
.build();
DeidentifyConfig deidentifyConfig = DeidentifyConfig.newBuilder()
.setInfoTypeTransformations(transformations)
.build();
// Combine configurations into a request for the service.
DeidentifyContentRequest request = DeidentifyContentRequest.newBuilder()
.setParent(LocationName.of(projectId, "global").toString())
.setItem(contentItem)
.setInspectConfig(inspectConfig)
.setDeidentifyConfig(deidentifyConfig)
.build();
// Send the request and receive response from the service.
DeidentifyContentResponse response = dlp.deidentifyContent(request);
// Print the results.
System.out.println(
"Text after de-identification: " + response.getItem().getValue());
return response.getItem().getValue();
}
}
}
Node.js
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
// Imports the Google Cloud Data Loss Prevention library
const DLP = require('@google-cloud/dlp');
// Instantiates a client
const dlp = new DLP.DlpServiceClient();
// The project ID to run the API call under
// const projectId = 'my-project';
// The string to deidentify
// const string = 'My name is Alicia Abernathy, and my email address is aabernathy@example.com.';
// The infoTypes of information to match
// const infoTypes = [{ name: 'EMAIL_ADDRESS' }];
// The name of the Cloud KMS key used to encrypt ('wrap') the AES-256 key
// const keyName = 'projects/YOUR_GCLOUD_PROJECT/locations/YOUR_LOCATION/keyRings/YOUR_KEYRING_NAME/cryptoKeys/YOUR_KEY_NAME';
// The encrypted ('wrapped') AES-256 key to use
// This key should be encrypted using the Cloud KMS key specified above
// const wrappedKey = 'YOUR_ENCRYPTED_AES_256_KEY'
// The name of the surrogate custom info type to use
// Only necessary if you want to reverse the deidentification process
// Can be essentially any arbitrary string, as long as it doesn't appear
// in your dataset otherwise.
// const surrogateType = 'EMAIL_ADDRESS_TOKEN';
async function deidentifyDeterministic() {
// Specify an encrypted AES-256 key and the name of the Cloud KMS key that encrypted it
const cryptoDeterministicEncryption = {
cryptoKey: {
kmsWrapped: {
wrappedKey: wrappedKey,
cryptoKeyName: keyName,
},
},
surrogateInfoType: {name: surrogateType},
};
// Construct inspect configuration to match information
const inspectConfig = {
infoTypes,
};
// Associate the encryption with the infotype transformation.
const infoTypeTransformations = {
transformations: [
{
infoTypes,
primitiveTransformation: {
cryptoDeterministicConfig: cryptoDeterministicEncryption,
},
},
],
};
// Construct item to inspect
const item = {value: string};
// Combine configurations into a request for the service.
const request = {
parent: `projects/${projectId}/locations/global`,
deidentifyConfig: {
infoTypeTransformations: infoTypeTransformations,
},
inspectConfig,
item: item,
};
// Run de-identification request
const [response] = await dlp.deidentifyContent(request);
const deidentifiedItem = response.item;
// Print results
console.log(deidentifiedItem.value);
}
await deidentifyDeterministic();PHP
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
use Google\Cloud\Dlp\V2\Client\DlpServiceClient;
use Google\Cloud\Dlp\V2\ContentItem;
use Google\Cloud\Dlp\V2\CryptoDeterministicConfig;
use Google\Cloud\Dlp\V2\CryptoKey;
use Google\Cloud\Dlp\V2\DeidentifyConfig;
use Google\Cloud\Dlp\V2\DeidentifyContentRequest;
use Google\Cloud\Dlp\V2\InfoType;
use Google\Cloud\Dlp\V2\InfoTypeTransformations;
use Google\Cloud\Dlp\V2\InfoTypeTransformations\InfoTypeTransformation;
use Google\Cloud\Dlp\V2\InspectConfig;
use Google\Cloud\Dlp\V2\KmsWrappedCryptoKey;
use Google\Cloud\Dlp\V2\PrimitiveTransformation;
/**
* De-identify content through deterministic encryption.
* Use the Data Loss Prevention API to de-identify sensitive data in a string using deterministic encryption,
* which is a reversible cryptographic method. The encryption is performed with a wrapped key.
*
* @param string $callingProjectId The Google Cloud project id to use as a parent resource.
* @param string $inputString The string to deidentify (will be treated as text).
* @param string $kmsKeyName The name of the Cloud KMS key used to encrypt ('wrap') the AES-256 key.
* Example: key_name = 'projects/YOUR_GCLOUD_PROJECT/locations/YOUR_LOCATION/keyRings/YOUR_KEYRING_NAME/cryptoKeys/YOUR_KEY_NAME'.
* @param string $infoTypeName The Info type name to be inspect.
* @param string $surrogateTypeName The name of the surrogate custom info type to use.
* Only necessary if you want to reverse the deidentification process. Can be essentially any arbitrary
* string, as long as it doesn't appear in your dataset otherwise.
* @param string $wrappedAesKey The encrypted ('wrapped') AES-256 key to use.
*
* */
function deidentify_deterministic(
string $callingProjectId,
string $kmsKeyName,
string $wrappedAesKey,
string $inputString = 'My PHONE NUMBER IS 731997681',
string $infoTypeName = 'PHONE_NUMBER',
string $surrogateTypeName = 'PHONE_TOKEN'
): void {
// Instantiate a client.
$dlp = new DlpServiceClient();
$parent = "projects/$callingProjectId/locations/global";
// Specify what content you want the service to DeIdentify.
$content = (new ContentItem())->setValue($inputString);
// Specify an encrypted AES-256 key and the name of the Cloud KMS key that encrypted it.
$kmsWrappedCryptoKey = (new KmsWrappedCryptoKey())
->setWrappedKey(base64_decode($wrappedAesKey))
->setCryptoKeyName($kmsKeyName);
$cryptoKey = (new CryptoKey())
->setKmsWrapped($kmsWrappedCryptoKey);
// Specify how the info from the inspection should be encrypted.
$cryptoDeterministicConfig = (new CryptoDeterministicConfig())
->setCryptoKey($cryptoKey);
if (!empty($surrogateTypeName)) {
$cryptoDeterministicConfig = $cryptoDeterministicConfig->setSurrogateInfoType((new InfoType())
->setName($surrogateTypeName));
}
// Specify the type of info the inspection will look for.
$infoType = (new InfoType())
->setName($infoTypeName);
$inspectConfig = (new InspectConfig())
->setInfoTypes([$infoType]);
$primitiveTransformation = (new PrimitiveTransformation())
->setCryptoDeterministicConfig($cryptoDeterministicConfig);
$infoTypeTransformation = (new InfoTypeTransformation())
->setPrimitiveTransformation($primitiveTransformation);
$infoTypeTransformations = (new InfoTypeTransformations())
->setTransformations([$infoTypeTransformation]);
$deidentifyConfig = (new DeidentifyConfig())
->setInfoTypeTransformations($infoTypeTransformations);
// Send the request and receive response from the service.
$deidentifyContentRequest = (new DeidentifyContentRequest())
->setParent($parent)
->setDeidentifyConfig($deidentifyConfig)
->setItem($content)
->setInspectConfig($inspectConfig);
$response = $dlp->deidentifyContent($deidentifyContentRequest);
// Print the results.
printf($response->getItem()->getValue());
}Python
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import base64
from typing import List
import google.cloud.dlp
def deidentify_with_deterministic(
project: str,
input_str: str,
info_types: List[str],
surrogate_type: str = None,
key_name: str = None,
wrapped_key: str = None,
) -> None:
"""Deidentifies sensitive data in a string using deterministic encryption.
Args:
project: The Google Cloud project id to use as a parent resource.
input_str: The string to deidentify (will be treated as text).
info_types: A list of strings representing info types to look for.
surrogate_type: The name of the surrogate custom info type to use. Only
necessary if you want to reverse the deidentification process. Can
be essentially any arbitrary string, as long as it doesn't appear
in your dataset otherwise.
key_name: The name of the Cloud KMS key used to encrypt ('wrap') the
AES-256 key. Example:
key_name = 'projects/YOUR_GCLOUD_PROJECT/locations/YOUR_LOCATION/
keyRings/YOUR_KEYRING_NAME/cryptoKeys/YOUR_KEY_NAME'
wrapped_key: The encrypted ('wrapped') AES-256 key to use. This key
should be encrypted using the Cloud KMS key specified by key_name.
Returns:
None; the response from the API is printed to the terminal.
"""
# Instantiate a client
dlp = google.cloud.dlp_v2.DlpServiceClient()
# Convert the project id into a full resource id.
parent = f"projects/{project}/locations/global"
# The wrapped key is base64-encoded, but the library expects a binary
# string, so decode it here.
wrapped_key = base64.b64decode(wrapped_key)
# Construct Deterministic encryption configuration dictionary
crypto_replace_deterministic_config = {
"crypto_key": {
"kms_wrapped": {"wrapped_key": wrapped_key, "crypto_key_name": key_name}
},
}
# Add surrogate type
if surrogate_type:
crypto_replace_deterministic_config["surrogate_info_type"] = {
"name": surrogate_type
}
# Construct inspect configuration dictionary
inspect_config = {"info_types": [{"name": info_type} for info_type in info_types]}
# Construct deidentify configuration dictionary
deidentify_config = {
"info_type_transformations": {
"transformations": [
{
"primitive_transformation": {
"crypto_deterministic_config": crypto_replace_deterministic_config
}
}
]
}
}
# Convert string to item
item = {"value": input_str}
# Call the API
response = dlp.deidentify_content(
request={
"parent": parent,
"deidentify_config": deidentify_config,
"inspect_config": inspect_config,
"item": item,
}
)
# Print results
print(response.item.value)
확정적 암호화 예시: 재식별
이 예시에서는 CryptoDeterministicConfig 변환 메서드를 통해 익명화된 민감한 정보를 재식별하는 방법을 보여줍니다. 자세한 내용은 이 페이지의 확정적 암호화를 참조하세요.
C#
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
using System;
using Google.Api.Gax.ResourceNames;
using Google.Cloud.Dlp.V2;
using Google.Protobuf;
public class ReidentifyContentUsingDeterministic
{
public static ReidentifyContentResponse ReidentifyDeterministic(
string projectId,
string text,
string keyName,
string wrappedKey,
InfoType surrogateType = null)
{
// Instantiate the client.
var dlp = DlpServiceClient.Create();
// Construct the infoType if null which will be used as surrogate type and infoType both.
var infoType = surrogateType ?? new InfoType { Name = "PHONE_TOKEN" };
// Construct crypto deterministic config using the crypto key name and wrapped key.
var cryptoDeterministicConfig = new CryptoDeterministicConfig
{
CryptoKey = new CryptoKey
{
KmsWrapped = new KmsWrappedCryptoKey
{
CryptoKeyName = keyName,
WrappedKey = ByteString.FromBase64(wrappedKey)
}
},
SurrogateInfoType = infoType,
};
// Construct the reidentify config using crypto config.
var reidentifyConfig = new DeidentifyConfig
{
InfoTypeTransformations = new InfoTypeTransformations
{
Transformations =
{
new InfoTypeTransformations.Types.InfoTypeTransformation
{
PrimitiveTransformation = new PrimitiveTransformation
{
CryptoDeterministicConfig = cryptoDeterministicConfig
}
}
}
}
};
// Construct the inspect config.
var inspectConfig = new InspectConfig
{
CustomInfoTypes =
{
new CustomInfoType
{
InfoType = infoType,
SurrogateType = new CustomInfoType.Types.SurrogateType()
}
}
};
// Construct the request.
var request = new ReidentifyContentRequest
{
ParentAsLocationName = new LocationName(projectId, "global"),
ReidentifyConfig = reidentifyConfig,
InspectConfig = inspectConfig,
Item = new ContentItem { Value = text },
};
// Call the API.
ReidentifyContentResponse response = dlp.ReidentifyContent(request);
// Inspect the response.
Console.WriteLine($"Reidentified content: {response.Item.Value}");
return response;
}
}
Go
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import (
"context"
"encoding/base64"
"fmt"
"io"
dlp "cloud.google.com/go/dlp/apiv2"
"cloud.google.com/go/dlp/apiv2/dlppb"
)
// reidentifyWithDeterministic re-identifies content encrypted by deterministic encryption.
func reidentifyWithDeterministic(w io.Writer, projectID, inputStr, surrogateType, keyName, wrappedKey string) error {
// projectId := "my-project-id"
// inputStr := "EMAIL_ADDRESS_TOKEN(52):AVAx2eIEnIQP5jbNEr2j9wLOAd5m4kpSBR/0jjjGdAOmryzZbE/q"
// surrogateType := "EMAIL_ADDRESS_TOKEN"
/* keyName := "projects/YOUR_PROJECT/"
+ "locations/YOUR_KEYRING_REGION/"
+ "keyRings/YOUR_KEYRING_NAME/"
+ "cryptoKeys/YOUR_KEY_NAME"
*/
// wrappedKey := "YOUR_ENCRYPTED_AES_256_KEY"
ctx := context.Background()
// Initialize a client once and reuse it to send multiple requests. Clients
// are safe to use across goroutines. When the client is no longer needed,
// call the Close method to cleanup its resources.
client, err := dlp.NewClient(ctx)
if err != nil {
return err
}
// Closing the client safely cleans up background resources.
defer client.Close()
// The wrapped key is base64-encoded, but the library expects a binary
// string, so decode it here.
keyBytes, err := base64.StdEncoding.DecodeString(wrappedKey)
if err != nil {
return err
}
// Create crypto deterministic config.
cryptoDeterministicConfig := &dlppb.CryptoDeterministicConfig{
CryptoKey: &dlppb.CryptoKey{
Source: &dlppb.CryptoKey_KmsWrapped{
KmsWrapped: &dlppb.KmsWrappedCryptoKey{
WrappedKey: keyBytes,
CryptoKeyName: keyName,
},
},
},
SurrogateInfoType: &dlppb.InfoType{
Name: surrogateType,
},
}
// Create a config for primitive transformation.
primitiveTransformation := &dlppb.PrimitiveTransformation{
Transformation: &dlppb.PrimitiveTransformation_CryptoDeterministicConfig{
CryptoDeterministicConfig: cryptoDeterministicConfig,
},
}
transformation := &dlppb.DeidentifyConfig_InfoTypeTransformations{
InfoTypeTransformations: &dlppb.InfoTypeTransformations{
Transformations: []*dlppb.InfoTypeTransformations_InfoTypeTransformation{
{
PrimitiveTransformation: primitiveTransformation,
},
},
},
}
// Construct config to re-identify the config.
reIdentifyConfig := &dlppb.DeidentifyConfig{
Transformation: transformation,
}
// Construct a config for inspection.
inspectConfig := &dlppb.InspectConfig{
CustomInfoTypes: []*dlppb.CustomInfoType{
{
InfoType: &dlppb.InfoType{
Name: surrogateType,
},
Type: &dlppb.CustomInfoType_SurrogateType_{
SurrogateType: &dlppb.CustomInfoType_SurrogateType{},
},
},
},
}
// Item to be analyzed.
item := &dlppb.ContentItem{
DataItem: &dlppb.ContentItem_Value{
Value: inputStr,
},
}
// Construct the Inspect request to be sent by the client.
req := &dlppb.ReidentifyContentRequest{
Parent: fmt.Sprintf("projects/%s/locations/global", projectID),
ReidentifyConfig: reIdentifyConfig,
InspectConfig: inspectConfig,
Item: item,
}
// Send the request.
r, err := client.ReidentifyContent(ctx, req)
if err != nil {
return err
}
// Print the result.
fmt.Fprintf(w, "output: %v", r.GetItem().GetValue())
return nil
}
Java
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import com.google.cloud.dlp.v2.DlpServiceClient;
import com.google.privacy.dlp.v2.ContentItem;
import com.google.privacy.dlp.v2.CryptoDeterministicConfig;
import com.google.privacy.dlp.v2.CryptoKey;
import com.google.privacy.dlp.v2.CustomInfoType;
import com.google.privacy.dlp.v2.DeidentifyConfig;
import com.google.privacy.dlp.v2.InfoType;
import com.google.privacy.dlp.v2.InfoTypeTransformations;
import com.google.privacy.dlp.v2.InspectConfig;
import com.google.privacy.dlp.v2.KmsWrappedCryptoKey;
import com.google.privacy.dlp.v2.LocationName;
import com.google.privacy.dlp.v2.PrimitiveTransformation;
import com.google.privacy.dlp.v2.ReidentifyContentRequest;
import com.google.privacy.dlp.v2.ReidentifyContentResponse;
import com.google.protobuf.ByteString;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
import org.apache.commons.codec.binary.Base64;
public class ReidentifyWithDeterministicEncryption {
public static void main(String[] args) throws Exception {
// TODO(developer): Replace these variables before running the sample.
// The Google Cloud project id to use as a parent resource.
String projectId = "your-project-id";
// The string to de-identify.
String textToIdentify = "My SSN is 372819127";
// The encrypted ('wrapped') AES-256 key to use.
// This key should be encrypted using the Cloud KMS key specified by key_name.
String wrappedKey = "YOUR_ENCRYPTED_AES_256_KEY";
// The name of the Cloud KMS key used to encrypt ('wrap') the AES-256 key.
String kmsKeyName =
"projects/YOUR_PROJECT/"
+ "locations/YOUR_KEYRING_REGION/"
+ "keyRings/YOUR_KEYRING_NAME/"
+ "cryptoKeys/YOUR_KEY_NAME";
// The string to re-identify.
String textToReIdentify =
DeIdenitfyWithDeterministicEncryption.deIdentifyWithDeterministicEncryption(
projectId, textToIdentify, wrappedKey, kmsKeyName);
reIdentifyWithDeterminsiticEncryption(projectId, textToReIdentify, wrappedKey, kmsKeyName);
}
// Re-identifies sensitive data in a string that was previously de-identified through
// deterministic encryption.
public static void reIdentifyWithDeterminsiticEncryption(
String projectId, String textToReIdentify, String wrappedKey, String key) throws IOException {
// Initialize client that will be used to send requests. This client only needs to be created
// once, and can be reused for multiple requests. After completing all of your requests, call
// the "close" method on the client to safely clean up any remaining background resources.
try (DlpServiceClient dlp = DlpServiceClient.create()) {
// Specify what content you want the service to re-identify.
ContentItem contentItem = ContentItem.newBuilder().setValue(textToReIdentify).build();
CustomInfoType.SurrogateType surrogateType =
CustomInfoType.SurrogateType.newBuilder().build();
// Specify the surrogate type used at time of de-identification.
InfoType surrogateInfoType = InfoType.newBuilder()
.setName("SSN_TOKEN")
.build();
CustomInfoType customInfoType = CustomInfoType.newBuilder()
.setInfoType(surrogateInfoType)
.setSurrogateType(surrogateType)
.build();
InspectConfig inspectConfig = InspectConfig.newBuilder()
.addCustomInfoTypes(customInfoType)
.build();
// Specify an encrypted AES-256 key and the name of the Cloud KMS key that encrypted it.
KmsWrappedCryptoKey unwrappedCryptoKey = KmsWrappedCryptoKey.newBuilder()
.setWrappedKey(
ByteString.copyFrom(
Base64.decodeBase64(wrappedKey.getBytes(StandardCharsets.UTF_8))))
.setCryptoKeyName(key)
.build();
CryptoKey cryptoKey = CryptoKey.newBuilder()
.setKmsWrapped(unwrappedCryptoKey)
.build();
CryptoDeterministicConfig cryptoDeterministicConfig = CryptoDeterministicConfig.newBuilder()
.setSurrogateInfoType(surrogateInfoType)
.setCryptoKey(cryptoKey)
.build();
PrimitiveTransformation primitiveTransformation = PrimitiveTransformation.newBuilder()
.setCryptoDeterministicConfig(cryptoDeterministicConfig)
.build();
InfoTypeTransformations.InfoTypeTransformation infoTypeTransformation =
InfoTypeTransformations.InfoTypeTransformation.newBuilder()
.setPrimitiveTransformation(primitiveTransformation)
.build();
InfoTypeTransformations transformations = InfoTypeTransformations.newBuilder()
.addTransformations(infoTypeTransformation)
.build();
DeidentifyConfig deidentifyConfig = DeidentifyConfig.newBuilder()
.setInfoTypeTransformations(transformations)
.build();
// Combine configurations into a request for the service.
ReidentifyContentRequest request = ReidentifyContentRequest.newBuilder()
.setParent(LocationName.of(projectId, "global").toString())
.setItem(contentItem)
.setInspectConfig(inspectConfig)
.setReidentifyConfig(deidentifyConfig)
.build();
// Send the request and receive response from the service.
ReidentifyContentResponse response = dlp.reidentifyContent(request);
// Print the results.
System.out.println("Text after re-identification: " + response.getItem().getValue());
}
}
}
Node.js
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
// Imports the Google Cloud Data Loss Prevention library
const DLP = require('@google-cloud/dlp');
// Instantiates a client
const dlp = new DLP.DlpServiceClient();
// The project ID to run the API call under
// const projectId = 'my-project';
// The string to deidentify
// const string = 'My name is Alicia Abernathy, and my email address is EMAIL_ADDRESS_TOKEN(52):XXXXXX';
// The name of the Cloud KMS key used to encrypt ('wrap') the AES-256 key
// const keyName = 'projects/YOUR_GCLOUD_PROJECT/locations/YOUR_LOCATION/keyRings/YOUR_KEYRING_NAME/cryptoKeys/YOUR_KEY_NAME';
// The encrypted ('wrapped') AES-256 key to use
// This key should be encrypted using the Cloud KMS key specified above
// const wrappedKey = 'YOUR_ENCRYPTED_AES_256_KEY'
// The name of the surrogate custom info type to use
// Only necessary if you want to reverse the de-identification process
// Can be essentially any arbitrary string, as long as it doesn't appear
// in your dataset otherwise.
// const surrogateType = 'EMAIL_ADDRESS_TOKEN';
async function reidentifyDeterministic() {
// Specify an encrypted AES-256 key and the name of the Cloud KMS key that encrypted it
const cryptoDeterministicEncryption = {
cryptoKey: {
kmsWrapped: {
wrappedKey: wrappedKey,
cryptoKeyName: keyName,
},
},
surrogateInfoType: {name: surrogateType},
};
// Construct custom infotype to match information
const customInfoTypes = [
{
infoType: {
name: surrogateType,
},
surrogateType: {},
},
];
// Associate the encryption with the infotype transformation.
const infoTypeTransformations = {
transformations: [
{
infoTypes: [{name: surrogateType}],
primitiveTransformation: {
cryptoDeterministicConfig: cryptoDeterministicEncryption,
},
},
],
};
// Construct item to inspect
const item = {value: string};
// Combine configurations into a request for the service.
const request = {
parent: `projects/${projectId}/locations/global`,
reidentifyConfig: {
infoTypeTransformations: infoTypeTransformations,
},
inspectConfig: {customInfoTypes},
item,
};
// Run re-identification request
const [response] = await dlp.reidentifyContent(request);
const deidentifiedItem = response.item;
// Print results
console.log(deidentifiedItem.value);
}
await reidentifyDeterministic();PHP
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
use Google\Cloud\Dlp\V2\Client\DlpServiceClient;
use Google\Cloud\Dlp\V2\ContentItem;
use Google\Cloud\Dlp\V2\CryptoDeterministicConfig;
use Google\Cloud\Dlp\V2\CryptoKey;
use Google\Cloud\Dlp\V2\CustomInfoType;
use Google\Cloud\Dlp\V2\CustomInfoType\SurrogateType;
use Google\Cloud\Dlp\V2\DeidentifyConfig;
use Google\Cloud\Dlp\V2\InfoType;
use Google\Cloud\Dlp\V2\InfoTypeTransformations;
use Google\Cloud\Dlp\V2\InfoTypeTransformations\InfoTypeTransformation;
use Google\Cloud\Dlp\V2\InspectConfig;
use Google\Cloud\Dlp\V2\KmsWrappedCryptoKey;
use Google\Cloud\Dlp\V2\PrimitiveTransformation;
use Google\Cloud\Dlp\V2\ReidentifyContentRequest;
/**
* Re-identify content encrypted by deterministic encryption.
* Re-identify content that was previously de-identified through deterministic encryption.
*
* @param string $callingProjectId The GCP Project ID to run the API call under.
* @param string $string The string to reidentify.
* @param string $keyName The name of the Cloud KMS key used to encrypt (wrap) the AES-256 key.
* @param string $wrappedKey The name of the Cloud KMS key use, encrypted with the KMS key in $keyName.
* @param string $surrogateTypeName Surrogate custom info type to enable reidentification.
*/
function reidentify_deterministic(
string $callingProjectId,
string $string,
string $surrogateTypeName,
string $keyName,
string $wrappedKey
): void {
// Instantiate a client.
$dlp = new DlpServiceClient();
$parent = "projects/$callingProjectId/locations/global";
// Specify what content you want the service to Re-identify.
$item = (new ContentItem())
->setValue($string);
// Specify the surrogate type used at time of de-identification.
$surrogateType = (new InfoType())
->setName($surrogateTypeName);
$customInfoType = (new CustomInfoType())
->setInfoType($surrogateType)
->setSurrogateType(new SurrogateType());
// Create the inspect configuration object.
$inspectConfig = (new InspectConfig())
->setCustomInfoTypes([$customInfoType]);
// Specify an encrypted AES-256 key and the name of the Cloud KMS key that encrypted it.
$kmsWrappedCryptoKey = (new KmsWrappedCryptoKey())
->setWrappedKey(base64_decode($wrappedKey))
->setCryptoKeyName($keyName);
// Create the crypto key configuration object.
$cryptoKey = (new CryptoKey())
->setKmsWrapped($kmsWrappedCryptoKey);
// Create the crypto deterministic configuration object.
$cryptoDeterministicConfig = (new CryptoDeterministicConfig())
->setCryptoKey($cryptoKey)
->setSurrogateInfoType($surrogateType);
// Create the information transform configuration objects.
$primitiveTransformation = (new PrimitiveTransformation())
->setCryptoDeterministicConfig($cryptoDeterministicConfig);
$infoTypeTransformation = (new InfoTypeTransformation())
->setPrimitiveTransformation($primitiveTransformation);
$infoTypeTransformations = (new InfoTypeTransformations())
->setTransformations([$infoTypeTransformation]);
// Create the reidentification configuration object.
$reidentifyConfig = (new DeidentifyConfig())
->setInfoTypeTransformations($infoTypeTransformations);
// Run request.
$reidentifyContentRequest = (new ReidentifyContentRequest())
->setParent($parent)
->setReidentifyConfig($reidentifyConfig)
->setInspectConfig($inspectConfig)
->setItem($item);
$response = $dlp->reidentifyContent($reidentifyContentRequest);
// Print the results.
printf($response->getItem()->getValue());
}Python
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import base64
import google.cloud.dlp
def reidentify_with_deterministic(
project: str,
input_str: str,
surrogate_type: str = None,
key_name: str = None,
wrapped_key: str = None,
) -> None:
"""Re-identifies content that was previously de-identified through deterministic encryption.
Args:
project: The Google Cloud project ID to use as a parent resource.
input_str: The string to be re-identified. Provide the entire token. Example:
EMAIL_ADDRESS_TOKEN(52):AVAx2eIEnIQP5jbNEr2j9wLOAd5m4kpSBR/0jjjGdAOmryzZbE/q
surrogate_type: The name of the surrogate custom infoType used
during the encryption process.
key_name: The name of the Cloud KMS key used to encrypt ("wrap") the
AES-256 key. Example:
keyName = 'projects/YOUR_GCLOUD_PROJECT/locations/YOUR_LOCATION/
keyRings/YOUR_KEYRING_NAME/cryptoKeys/YOUR_KEY_NAME'
wrapped_key: The encrypted ("wrapped") AES-256 key previously used to encrypt the content.
This key must have been encrypted using the Cloud KMS key specified by key_name.
Returns:
None; the response from the API is printed to the terminal.
"""
# Instantiate a client
dlp = google.cloud.dlp_v2.DlpServiceClient()
# Convert the project id into a full resource id.
parent = f"projects/{project}/locations/global"
# The wrapped key is base64-encoded, but the library expects a binary
# string, so decode it here.
wrapped_key = base64.b64decode(wrapped_key)
# Construct reidentify Configuration
reidentify_config = {
"info_type_transformations": {
"transformations": [
{
"primitive_transformation": {
"crypto_deterministic_config": {
"crypto_key": {
"kms_wrapped": {
"wrapped_key": wrapped_key,
"crypto_key_name": key_name,
}
},
"surrogate_info_type": {"name": surrogate_type},
}
}
}
]
}
}
inspect_config = {
"custom_info_types": [
{"info_type": {"name": surrogate_type}, "surrogate_type": {}}
]
}
# Convert string to item
item = {"value": input_str}
# Call the API
response = dlp.reidentify_content(
request={
"parent": parent,
"reidentify_config": reidentify_config,
"inspect_config": inspect_config,
"item": item,
}
)
# Print results
print(response.item.value)
버케팅
버케팅 변환은 숫자 데이터를 범위로 '버케팅'하여 익명화합니다. 결과 숫자 범위는 하한, 하이픈, 상한으로 구성되어 하이픈으로 연결된 문자열입니다.
고정 크기 버케팅
Sensitive Data Protection은 고정된 크기 범위(DLP API의 FixedSizeBucketingConfig)를 기준으로 숫자 입력 값을 버케팅할 수 있습니다. 고정 크기 버케팅을 구성하려면 다음을 지정하세요.
- 모든 버킷의 하한 값. 이 값보다 작은 값은 하나의 버킷으로 그룹화됩니다.
- 모든 버킷의 상한 값. 이 값보다 큰 값은 하나의 버킷으로 그룹화됩니다
- 최소 및 최대 버킷을 제외한 각 버킷의 크기.
예를 들어 하한 값이 10으로 설정되고 상한 값이 89로 설정되고 버킷 크기가 10으로 설정되는 경우 사용되는 버킷은 -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+입니다.
버케팅 개념에 대한 자세한 내용은 일반화 및 버케팅을 참조하세요.
맞춤설정 가능한 버케팅
맞춤설정 가능한 버케팅(DLP API의 BucketingConfig)은 고정 크기 버 케팅에 비해 더 유연합니다.
상한 및 하한과 동일한 크기의 버킷을 만들기 위한 간격 값을 지정하는 대신 만들려는 각 버킷의 최댓값 및 최솟값을 지정합니다. 각 최댓값 및 최솟값 쌍의 유형은 동일해야 합니다.
개별 버킷을 지정하여 맞춤설정 가능한 버케팅을 설정합니다. 다음과 같은 속성으로 각 버킷을 설정합니다.
- 버킷 범위의 하한. 하한이 없는 버킷을 만들려면 이 값을 생략합니다.
- 버킷 범위의 상한. 상한이 없는 버킷을 만들려면 이 값을 생략합니다.
- 이 버킷 범위의 대체 값. 이 값은 하한 및 상한 내에 속하는 모든 값지된 값을 대체할 값입니다. 대체 값을 지정하지 않으면 하이픈으로 연결된 최솟값과 최댓값 쌍의 범위가 대신 생성됩니다.
예를 들어 이 버킷 변환에 다음 JSON 구성을 고려해보세요.
"bucketingConfig":{
"buckets":[
{
"min":{
"integerValue":"1"
},
"max":{
"integerValue":"30"
},
"replacementValue":{
"stringValue":"LOW"
}
},
{
"min":{
"integerValue":"31"
},
"max":{
"integerValue":"65"
},
"replacementValue":{
"stringValue":"MEDIUM"
}
},
{
"min":{
"integerValue":"66"
},
"max":{
"integerValue":"100"
},
"replacementValue":{
"stringValue":"HIGH"
}
}
]
}
이는 다음 동작을 정의합니다.
- 1에서 30 사이에 속하는 정수 값은
LOW로 대체되어 마스킹됩니다. - 31에서 65 사이에 속하는 정수 값은
MEDIUM으로 대체되어 마스킹됩니다. - 66에서 100 사이에 속하는 정수 값은
HIGH로 대체되어 마스킹됩니다.
버케팅 개념에 대한 자세한 내용은 일반화 및 버케팅을 참조하세요.
날짜 이동
날짜 입력 값에 날짜 이동 변환(DLP API의 DateShiftConfig)을 사용하면 Sensitive Data Protection에서 날짜를 무작위 일수만큼 이동합니다.
날짜 이동 기법은 날짜 집합을 무작위로 이동하지만 순서와 기간은 보존합니다. 날짜 이동은 일반적으로 개인 또는 항목 컨텍스트에서 수행됩니다. 즉, 특정 개인의 모든 날짜를 동일한 교대 수당을 사용하여 이동하되, 각 개인에 별도의 교대 수당을 사용하고자 하는 경우입니다.
날짜 이동에 대한 자세한 내용은 날짜 이동을 참조하세요.
다음은 Cloud DLP API를 사용하여 날짜 이동으로 날짜를 익명화하는 방법을 보여주는 여러 언어로 된 샘플 코드입니다.
Java
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import com.google.cloud.dlp.v2.DlpServiceClient;
import com.google.common.base.Splitter;
import com.google.privacy.dlp.v2.ContentItem;
import com.google.privacy.dlp.v2.DateShiftConfig;
import com.google.privacy.dlp.v2.DeidentifyConfig;
import com.google.privacy.dlp.v2.DeidentifyContentRequest;
import com.google.privacy.dlp.v2.DeidentifyContentResponse;
import com.google.privacy.dlp.v2.FieldId;
import com.google.privacy.dlp.v2.FieldTransformation;
import com.google.privacy.dlp.v2.LocationName;
import com.google.privacy.dlp.v2.PrimitiveTransformation;
import com.google.privacy.dlp.v2.RecordTransformations;
import com.google.privacy.dlp.v2.Table;
import com.google.privacy.dlp.v2.Value;
import com.google.type.Date;
import java.io.BufferedReader;
import java.io.BufferedWriter;
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.time.LocalDate;
import java.time.format.DateTimeFormatter;
import java.util.Arrays;
import java.util.List;
import java.util.stream.Collectors;
public class DeIdentifyWithDateShift {
public static void main(String[] args) throws Exception {
// TODO(developer): Replace these variables before running the sample.
String projectId = "your-project-id";
Path inputCsvFile = Paths.get("path/to/your/input/file.csv");
Path outputCsvFile = Paths.get("path/to/your/output/file.csv");
deIdentifyWithDateShift(projectId, inputCsvFile, outputCsvFile);
}
public static void deIdentifyWithDateShift(
String projectId, Path inputCsvFile, Path outputCsvFile) throws IOException {
// Initialize client that will be used to send requests. This client only needs to be created
// once, and can be reused for multiple requests. After completing all of your requests, call
// the "close" method on the client to safely clean up any remaining background resources.
try (DlpServiceClient dlp = DlpServiceClient.create()) {
// Read the contents of the CSV file into a Table
List<FieldId> headers;
List<Table.Row> rows;
try (BufferedReader input = Files.newBufferedReader(inputCsvFile)) {
// Parse and convert the first line into header names
headers =
Arrays.stream(input.readLine().split(","))
.map(header -> FieldId.newBuilder().setName(header).build())
.collect(Collectors.toList());
// Parse the remainder of the file as Table.Rows
rows =
input.lines().map(DeIdentifyWithDateShift::parseLineAsRow).collect(Collectors.toList());
}
Table table = Table.newBuilder().addAllHeaders(headers).addAllRows(rows).build();
ContentItem item = ContentItem.newBuilder().setTable(table).build();
// Set the maximum days to shift dates backwards (lower bound) or forward (upper bound)
DateShiftConfig dateShiftConfig =
DateShiftConfig.newBuilder().setLowerBoundDays(5).setUpperBoundDays(5).build();
PrimitiveTransformation transformation =
PrimitiveTransformation.newBuilder().setDateShiftConfig(dateShiftConfig).build();
// Specify which fields the DateShift should apply too
List<FieldId> dateFields = Arrays.asList(headers.get(1), headers.get(3));
FieldTransformation fieldTransformation =
FieldTransformation.newBuilder()
.addAllFields(dateFields)
.setPrimitiveTransformation(transformation)
.build();
RecordTransformations recordTransformations =
RecordTransformations.newBuilder().addFieldTransformations(fieldTransformation).build();
// Specify the config for the de-identify request
DeidentifyConfig deidentifyConfig =
DeidentifyConfig.newBuilder().setRecordTransformations(recordTransformations).build();
// Combine configurations into a request for the service.
DeidentifyContentRequest request =
DeidentifyContentRequest.newBuilder()
.setParent(LocationName.of(projectId, "global").toString())
.setItem(item)
.setDeidentifyConfig(deidentifyConfig)
.build();
// Send the request and receive response from the service
DeidentifyContentResponse response = dlp.deidentifyContent(request);
// Write the results to the target CSV file
try (BufferedWriter writer = Files.newBufferedWriter(outputCsvFile)) {
Table outTable = response.getItem().getTable();
String headerOut =
outTable.getHeadersList().stream()
.map(FieldId::getName)
.collect(Collectors.joining(","));
writer.write(headerOut + "\n");
List<String> rowOutput =
outTable.getRowsList().stream()
.map(row -> joinRow(row.getValuesList()))
.collect(Collectors.toList());
for (String line : rowOutput) {
writer.write(line + "\n");
}
System.out.println("Content written to file: " + outputCsvFile.toString());
}
}
}
// Convert the string from the csv file into com.google.type.Date
public static Date parseAsDate(String s) {
LocalDate date = LocalDate.parse(s, DateTimeFormatter.ofPattern("MM/dd/yyyy"));
return Date.newBuilder()
.setDay(date.getDayOfMonth())
.setMonth(date.getMonthValue())
.setYear(date.getYear())
.build();
}
// Each row is in the format: Name,BirthDate,CreditCardNumber,RegisterDate
public static Table.Row parseLineAsRow(String line) {
List<String> values = Splitter.on(",").splitToList(line);
Value name = Value.newBuilder().setStringValue(values.get(0)).build();
Value birthDate = Value.newBuilder().setDateValue(parseAsDate(values.get(1))).build();
Value creditCardNumber = Value.newBuilder().setStringValue(values.get(2)).build();
Value registerDate = Value.newBuilder().setDateValue(parseAsDate(values.get(3))).build();
return Table.Row.newBuilder()
.addValues(name)
.addValues(birthDate)
.addValues(creditCardNumber)
.addValues(registerDate)
.build();
}
public static String formatDate(Date d) {
return String.format("%s/%s/%s", d.getMonth(), d.getDay(), d.getYear());
}
public static String joinRow(List<Value> values) {
String name = values.get(0).getStringValue();
String birthDate = formatDate(values.get(1).getDateValue());
String creditCardNumber = values.get(2).getStringValue();
String registerDate = formatDate(values.get(3).getDateValue());
return String.join(",", name, birthDate, creditCardNumber, registerDate);
}
}Node.js
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
// Imports the Google Cloud Data Loss Prevention library
const DLP = require('@google-cloud/dlp');
// Instantiates a client
const dlp = new DLP.DlpServiceClient();
// Import other required libraries
const fs = require('fs');
// The project ID to run the API call under
// const projectId = 'my-project';
// The path to the CSV file to deidentify
// The first row of the file must specify column names, and all other rows
// must contain valid values
// const inputCsvFile = '/path/to/input/file.csv';
// The path to save the date-shifted CSV file to
// const outputCsvFile = '/path/to/output/file.csv';
// The list of (date) fields in the CSV file to date shift
// const dateFields = [{ name: 'birth_date'}, { name: 'register_date' }];
// The maximum number of days to shift a date backward
// const lowerBoundDays = 1;
// The maximum number of days to shift a date forward
// const upperBoundDays = 1;
// (Optional) The column to determine date shift amount based on
// If this is not specified, a random shift amount will be used for every row
// If this is specified, then 'wrappedKey' and 'keyName' must also be set
// const contextFieldId = [{ name: 'user_id' }];
// (Optional) The name of the Cloud KMS key used to encrypt ('wrap') the AES-256 key
// If this is specified, then 'wrappedKey' and 'contextFieldId' must also be set
// const keyName = 'projects/YOUR_GCLOUD_PROJECT/locations/YOUR_LOCATION/keyRings/YOUR_KEYRING_NAME/cryptoKeys/YOUR_KEY_NAME';
// (Optional) The encrypted ('wrapped') AES-256 key to use when shifting dates
// This key should be encrypted using the Cloud KMS key specified above
// If this is specified, then 'keyName' and 'contextFieldId' must also be set
// const wrappedKey = 'YOUR_ENCRYPTED_AES_256_KEY'
// Helper function for converting CSV rows to Protobuf types
const rowToProto = row => {
const values = row.split(',');
const convertedValues = values.map(value => {
if (Date.parse(value)) {
const date = new Date(value);
return {
dateValue: {
year: date.getFullYear(),
month: date.getMonth() + 1,
day: date.getDate(),
},
};
} else {
// Convert all non-date values to strings
return {stringValue: value.toString()};
}
});
return {values: convertedValues};
};
async function deidentifyWithDateShift() {
// Read and parse a CSV file
const csvLines = fs
.readFileSync(inputCsvFile)
.toString()
.split('\n')
.filter(line => line.includes(','));
const csvHeaders = csvLines[0].split(',');
const csvRows = csvLines.slice(1);
// Construct the table object
const tableItem = {
table: {
headers: csvHeaders.map(header => {
return {name: header};
}),
rows: csvRows.map(row => rowToProto(row)),
},
};
// Construct DateShiftConfig
const dateShiftConfig = {
lowerBoundDays: lowerBoundDays,
upperBoundDays: upperBoundDays,
};
if (contextFieldId && keyName && wrappedKey) {
dateShiftConfig.context = {name: contextFieldId};
dateShiftConfig.cryptoKey = {
kmsWrapped: {
wrappedKey: wrappedKey,
cryptoKeyName: keyName,
},
};
} else if (contextFieldId || keyName || wrappedKey) {
throw new Error(
'You must set either ALL or NONE of {contextFieldId, keyName, wrappedKey}!'
);
}
// Construct deidentification request
const request = {
parent: `projects/${projectId}/locations/global`,
deidentifyConfig: {
recordTransformations: {
fieldTransformations: [
{
fields: dateFields,
primitiveTransformation: {
dateShiftConfig: dateShiftConfig,
},
},
],
},
},
item: tableItem,
};
// Run deidentification request
const [response] = await dlp.deidentifyContent(request);
const tableRows = response.item.table.rows;
// Write results to a CSV file
tableRows.forEach((row, rowIndex) => {
const rowValues = row.values.map(
value =>
value.stringValue ||
`${value.dateValue.month}/${value.dateValue.day}/${value.dateValue.year}`
);
csvLines[rowIndex + 1] = rowValues.join(',');
});
csvLines.push('');
fs.writeFileSync(outputCsvFile, csvLines.join('\n'));
// Print status
console.log(`Successfully saved date-shift output to ${outputCsvFile}`);
}
deidentifyWithDateShift();Python
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import base64
import csv
from datetime import datetime
from typing import List
import google.cloud.dlp
from google.cloud.dlp_v2 import types
def deidentify_with_date_shift(
project: str,
input_csv_file: str = None,
output_csv_file: str = None,
date_fields: List[str] = None,
lower_bound_days: int = None,
upper_bound_days: int = None,
context_field_id: str = None,
wrapped_key: str = None,
key_name: str = None,
) -> None:
"""Uses the Data Loss Prevention API to deidentify dates in a CSV file by
pseudorandomly shifting them.
Args:
project: The Google Cloud project id to use as a parent resource.
input_csv_file: The path to the CSV file to deidentify. The first row
of the file must specify column names, and all other rows must
contain valid values.
output_csv_file: The path to save the date-shifted CSV file.
date_fields: The list of (date) fields in the CSV file to date shift.
Example: ['birth_date', 'register_date']
lower_bound_days: The maximum number of days to shift a date backward
upper_bound_days: The maximum number of days to shift a date forward
context_field_id: (Optional) The column to determine date shift amount
based on. If this is not specified, a random shift amount will be
used for every row. If this is specified, then 'wrappedKey' and
'keyName' must also be set. Example:
contextFieldId = [{ 'name': 'user_id' }]
key_name: (Optional) The name of the Cloud KMS key used to encrypt
('wrap') the AES-256 key. Example:
key_name = 'projects/YOUR_GCLOUD_PROJECT/locations/YOUR_LOCATION/
keyRings/YOUR_KEYRING_NAME/cryptoKeys/YOUR_KEY_NAME'
wrapped_key: (Optional) The encrypted ('wrapped') AES-256 key to use.
This key should be encrypted using the Cloud KMS key specified by
key_name.
Returns:
None; the response from the API is printed to the terminal.
"""
# Instantiate a client
dlp = google.cloud.dlp_v2.DlpServiceClient()
# Convert the project id into a full resource id.
parent = f"projects/{project}/locations/global"
# Convert date field list to Protobuf type
def map_fields(field: str) -> dict:
return {"name": field}
if date_fields:
date_fields = map(map_fields, date_fields)
else:
date_fields = []
f = []
with open(input_csv_file) as csvfile:
reader = csv.reader(csvfile)
for row in reader:
f.append(row)
# Helper function for converting CSV rows to Protobuf types
def map_headers(header: str) -> dict:
return {"name": header}
def map_data(value: str) -> dict:
try:
date = datetime.strptime(value, "%m/%d/%Y")
return {
"date_value": {"year": date.year, "month": date.month, "day": date.day}
}
except ValueError:
return {"string_value": value}
def map_rows(row: str) -> dict:
return {"values": map(map_data, row)}
# Using the helper functions, convert CSV rows to protobuf-compatible
# dictionaries.
csv_headers = map(map_headers, f[0])
csv_rows = map(map_rows, f[1:])
# Construct the table dict
table_item = {"table": {"headers": csv_headers, "rows": csv_rows}}
# Construct date shift config
date_shift_config = {
"lower_bound_days": lower_bound_days,
"upper_bound_days": upper_bound_days,
}
# If using a Cloud KMS key, add it to the date_shift_config.
# The wrapped key is base64-encoded, but the library expects a binary
# string, so decode it here.
if context_field_id and key_name and wrapped_key:
date_shift_config["context"] = {"name": context_field_id}
date_shift_config["crypto_key"] = {
"kms_wrapped": {
"wrapped_key": base64.b64decode(wrapped_key),
"crypto_key_name": key_name,
}
}
elif context_field_id or key_name or wrapped_key:
raise ValueError(
"""You must set either ALL or NONE of
[context_field_id, key_name, wrapped_key]!"""
)
# Construct Deidentify Config
deidentify_config = {
"record_transformations": {
"field_transformations": [
{
"fields": date_fields,
"primitive_transformation": {
"date_shift_config": date_shift_config
},
}
]
}
}
# Write to CSV helper methods
def write_header(header: types.storage.FieldId) -> str:
return header.name
def write_data(data: types.storage.Value) -> str:
return data.string_value or "{}/{}/{}".format(
data.date_value.month,
data.date_value.day,
data.date_value.year,
)
# Call the API
response = dlp.deidentify_content(
request={
"parent": parent,
"deidentify_config": deidentify_config,
"item": table_item,
}
)
# Write results to CSV file
with open(output_csv_file, "w") as csvfile:
write_file = csv.writer(csvfile, delimiter=",")
write_file.writerow(map(write_header, response.item.table.headers))
for row in response.item.table.rows:
write_file.writerow(map(write_data, row.values))
# Print status
print(f"Successfully saved date-shift output to {output_csv_file}")
Go
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import (
"context"
"fmt"
"io"
dlp "cloud.google.com/go/dlp/apiv2"
"cloud.google.com/go/dlp/apiv2/dlppb"
)
// deidentifyDateShift shifts dates found in the input between lowerBoundDays and
// upperBoundDays.
func deidentifyDateShift(w io.Writer, projectID string, lowerBoundDays, upperBoundDays int32, input string) error {
// projectID := "my-project-id"
// lowerBoundDays := -1
// upperBound := -1
// input := "2016-01-10"
// Will print "2016-01-09"
ctx := context.Background()
client, err := dlp.NewClient(ctx)
if err != nil {
return fmt.Errorf("dlp.NewClient: %w", err)
}
defer client.Close()
// Create a configured request.
req := &dlppb.DeidentifyContentRequest{
Parent: fmt.Sprintf("projects/%s/locations/global", projectID),
DeidentifyConfig: &dlppb.DeidentifyConfig{
Transformation: &dlppb.DeidentifyConfig_InfoTypeTransformations{
InfoTypeTransformations: &dlppb.InfoTypeTransformations{
Transformations: []*dlppb.InfoTypeTransformations_InfoTypeTransformation{
{
InfoTypes: []*dlppb.InfoType{}, // Match all info types.
PrimitiveTransformation: &dlppb.PrimitiveTransformation{
Transformation: &dlppb.PrimitiveTransformation_DateShiftConfig{
DateShiftConfig: &dlppb.DateShiftConfig{
LowerBoundDays: lowerBoundDays,
UpperBoundDays: upperBoundDays,
},
},
},
},
},
},
},
},
// The InspectConfig is used to identify the DATE fields.
InspectConfig: &dlppb.InspectConfig{
InfoTypes: []*dlppb.InfoType{
{
Name: "DATE",
},
},
},
// The item to analyze.
Item: &dlppb.ContentItem{
DataItem: &dlppb.ContentItem_Value{
Value: input,
},
},
}
// Send the request.
r, err := client.DeidentifyContent(ctx, req)
if err != nil {
return fmt.Errorf("DeidentifyContent: %w", err)
}
// Print the result.
fmt.Fprint(w, r.GetItem().GetValue())
return nil
}
PHP
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
use DateTime;
use Exception;
use Google\Cloud\Dlp\V2\Client\DlpServiceClient;
use Google\Cloud\Dlp\V2\ContentItem;
use Google\Cloud\Dlp\V2\CryptoKey;
use Google\Cloud\Dlp\V2\DateShiftConfig;
use Google\Cloud\Dlp\V2\DeidentifyConfig;
use Google\Cloud\Dlp\V2\DeidentifyContentRequest;
use Google\Cloud\Dlp\V2\FieldId;
use Google\Cloud\Dlp\V2\FieldTransformation;
use Google\Cloud\Dlp\V2\KmsWrappedCryptoKey;
use Google\Cloud\Dlp\V2\PrimitiveTransformation;
use Google\Cloud\Dlp\V2\RecordTransformations;
use Google\Cloud\Dlp\V2\Table;
use Google\Cloud\Dlp\V2\Table\Row;
use Google\Cloud\Dlp\V2\Value;
use Google\Type\Date;
/**
* Deidentify dates in a CSV file by pseudorandomly shifting them.
* If contextFieldName is not specified, a random shift amount will be used for every row.
* If contextFieldName is specified, then 'wrappedKey' and 'keyName' must also be set.
*
* @param string $callingProjectId The GCP Project ID to run the API call under
* @param string $inputCsvFile The path to the CSV file to deidentify
* @param string $outputCsvFile The path to save the date-shifted CSV file to
* @param string $dateFieldNames The comma-separated list of (date) fields in the CSV file to date shift
* @param int $lowerBoundDays The maximum number of days to shift a date backward
* @param int $upperBoundDays The maximum number of days to shift a date forward
* @param string $contextFieldName (Optional) The column to determine date shift amount based on
* @param string $keyName (Optional) The encrypted ('wrapped') AES-256 key to use when shifting dates
* @param string $wrappedKey (Optional) The name of the Cloud KMS key used to encrypt (wrap) the AES-256 key
*/
function deidentify_dates(
string $callingProjectId,
string $inputCsvFile,
string $outputCsvFile,
string $dateFieldNames,
int $lowerBoundDays,
int $upperBoundDays,
string $contextFieldName = '',
string $keyName = '',
string $wrappedKey = ''
): void {
// Instantiate a client.
$dlp = new DlpServiceClient();
// Read a CSV file
$csvLines = file($inputCsvFile, FILE_IGNORE_NEW_LINES);
$csvHeaders = explode(',', $csvLines[0]);
$csvRows = array_slice($csvLines, 1);
// Convert CSV file into protobuf objects
$tableHeaders = array_map(function ($csvHeader) {
return (new FieldId)->setName($csvHeader);
}, $csvHeaders);
$tableRows = array_map(function ($csvRow) {
$rowValues = array_map(function ($csvValue) {
if ($csvDate = DateTime::createFromFormat('m/d/Y', $csvValue)) {
$date = (new Date())
->setYear((int) $csvDate->format('Y'))
->setMonth((int) $csvDate->format('m'))
->setDay((int) $csvDate->format('d'));
return (new Value())
->setDateValue($date);
} else {
return (new Value())
->setStringValue($csvValue);
}
}, explode(',', $csvRow));
return (new Row())
->setValues($rowValues);
}, $csvRows);
// Convert date fields into protobuf objects
$dateFields = array_map(function ($dateFieldName) {
return (new FieldId())->setName($dateFieldName);
}, explode(',', $dateFieldNames));
// Construct the table object
$table = (new Table())
->setHeaders($tableHeaders)
->setRows($tableRows);
$item = (new ContentItem())
->setTable($table);
// Construct dateShiftConfig
$dateShiftConfig = (new DateShiftConfig())
->setLowerBoundDays($lowerBoundDays)
->setUpperBoundDays($upperBoundDays);
if ($contextFieldName && $keyName && $wrappedKey) {
$contextField = (new FieldId())
->setName($contextFieldName);
// Create the wrapped crypto key configuration object
$kmsWrappedCryptoKey = (new KmsWrappedCryptoKey())
->setWrappedKey(base64_decode($wrappedKey))
->setCryptoKeyName($keyName);
$cryptoKey = (new CryptoKey())
->setKmsWrapped($kmsWrappedCryptoKey);
$dateShiftConfig
->setContext($contextField)
->setCryptoKey($cryptoKey);
} elseif ($contextFieldName || $keyName || $wrappedKey) {
throw new Exception('You must set either ALL or NONE of {$contextFieldName, $keyName, $wrappedKey}!');
}
// Create the information transform configuration objects
$primitiveTransformation = (new PrimitiveTransformation())
->setDateShiftConfig($dateShiftConfig);
$fieldTransformation = (new FieldTransformation())
->setPrimitiveTransformation($primitiveTransformation)
->setFields($dateFields);
$recordTransformations = (new RecordTransformations())
->setFieldTransformations([$fieldTransformation]);
// Create the deidentification configuration object
$deidentifyConfig = (new DeidentifyConfig())
->setRecordTransformations($recordTransformations);
$parent = "projects/$callingProjectId/locations/global";
// Run request
$deidentifyContentRequest = (new DeidentifyContentRequest())
->setParent($parent)
->setDeidentifyConfig($deidentifyConfig)
->setItem($item);
$response = $dlp->deidentifyContent($deidentifyContentRequest);
// Check for errors
foreach ($response->getOverview()->getTransformationSummaries() as $summary) {
foreach ($summary->getResults() as $result) {
if ($details = $result->getDetails()) {
printf('Error: %s' . PHP_EOL, $details);
return;
}
}
}
// Save the results to a file
$csvRef = fopen($outputCsvFile, 'w');
fputcsv($csvRef, $csvHeaders);
foreach ($response->getItem()->getTable()->getRows() as $tableRow) {
$values = array_map(function ($tableValue) {
if ($tableValue->getStringValue()) {
return $tableValue->getStringValue();
}
$protoDate = $tableValue->getDateValue();
$date = mktime(0, 0, 0, $protoDate->getMonth(), $protoDate->getDay(), $protoDate->getYear());
return strftime('%D', $date);
}, iterator_to_array($tableRow->getValues()));
fputcsv($csvRef, $values);
};
fclose($csvRef);
printf('Deidentified dates written to %s' . PHP_EOL, $outputCsvFile);
}C#
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
using System;
using System.IO;
using System.Linq;
using Google.Api.Gax.ResourceNames;
using Google.Cloud.Dlp.V2;
using Google.Protobuf;
public class DeidentifyWithDateShift
{
public static DeidentifyContentResponse Deidentify(
string projectId,
string inputCsvFilePath,
int lowerBoundDays,
int upperBoundDays,
string dateFields,
string contextField,
string keyName,
string wrappedKey)
{
var hasKeyName = !string.IsNullOrEmpty(keyName);
var hasWrappedKey = !string.IsNullOrEmpty(wrappedKey);
var hasContext = !string.IsNullOrEmpty(contextField);
bool allFieldsSet = hasKeyName && hasWrappedKey && hasContext;
bool noFieldsSet = !hasKeyName && !hasWrappedKey && !hasContext;
if (!(allFieldsSet || noFieldsSet))
{
throw new ArgumentException("Must specify ALL or NONE of: {contextFieldId, keyName, wrappedKey}!");
}
var dlp = DlpServiceClient.Create();
// Read file
var csvLines = File.ReadAllLines(inputCsvFilePath);
var csvHeaders = csvLines[0].Split(',');
var csvRows = csvLines.Skip(1).ToArray();
// Convert dates to protobuf format, and everything else to a string
var protoHeaders = csvHeaders.Select(header => new FieldId { Name = header });
var protoRows = csvRows.Select(csvRow =>
{
var rowValues = csvRow.Split(',');
var protoValues = rowValues.Select(rowValue =>
System.DateTime.TryParse(rowValue, out var parsedDate)
? new Value { DateValue = Google.Type.Date.FromDateTime(parsedDate) }
: new Value { StringValue = rowValue });
var rowObject = new Table.Types.Row();
rowObject.Values.Add(protoValues);
return rowObject;
});
var dateFieldList = dateFields
.Split(',')
.Select(field => new FieldId { Name = field });
// Construct + execute the request
var dateShiftConfig = new DateShiftConfig
{
LowerBoundDays = lowerBoundDays,
UpperBoundDays = upperBoundDays
};
dateShiftConfig.Context = new FieldId { Name = contextField };
dateShiftConfig.CryptoKey = new CryptoKey
{
KmsWrapped = new KmsWrappedCryptoKey
{
WrappedKey = ByteString.FromBase64(wrappedKey),
CryptoKeyName = keyName
}
};
var deidConfig = new DeidentifyConfig
{
RecordTransformations = new RecordTransformations
{
FieldTransformations =
{
new FieldTransformation
{
PrimitiveTransformation = new PrimitiveTransformation
{
DateShiftConfig = dateShiftConfig
},
Fields = { dateFieldList }
}
}
}
};
var response = dlp.DeidentifyContent(
new DeidentifyContentRequest
{
Parent = new LocationName(projectId, "global").ToString(),
DeidentifyConfig = deidConfig,
Item = new ContentItem
{
Table = new Table
{
Headers = { protoHeaders },
Rows = { protoRows }
}
}
});
return response;
}
}시간 추출
시간 추출(DLP API의 TimePartConfig) 객체를 설정하면 날짜, 시간 또는 타임스탬프에 일치 값의 일부를 보존합니다. TimePart 객체에 열거되는 연도, 월, 월 등을 비롯하여 추출할 시간 값 종류를 Sensitive Data Protection에 지정하세요.
예를 들어 추출할 시간 부분을 YEAR로 설정하여 timePartConfig 변환을 구성했다고 가정해보겠습니다. 아래의 첫 번째 열 데이터를 Sensitive Data Protection으로 보내면 두 번째 열의 변환된 값이 됩니다.
| 원래 값 | 변환된 값 |
|---|---|
9/21/1976 |
1976 |
6/7/1945 |
1945 |
1/20/2009 |
2009 |
7/4/1776 |
1776 |
8/1/1984 |
1984 |
4/21/1982 |
1982 |
C#
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
using System;
using Google.Api.Gax.ResourceNames;
using Google.Cloud.Dlp.V2;
public class DeidentifyWithTimeExtraction
{
public static Table Deidentify(
string projectId,
Table tableToInspect = null)
{
// Instantiate the dlp client.
var dlp = DlpServiceClient.Create();
// Construct the table if null.
if (tableToInspect == null)
{
var row1 = new Value[]
{
new Value
{
DateValue = new Google.Type.Date { Day = 10, Month = 6, Year = 2020 }
}
};
var row2 = new Value[]
{
new Value
{
DateValue = new Google.Type.Date { Day = 23, Month = 12, Year = 2022 }
}
};
var row3 = new Value[]
{
new Value
{
DateValue = new Google.Type.Date { Day = 1, Month = 1, Year = 2023 }
}
};
tableToInspect = new Table
{
Headers = { new FieldId { Name = "Date" } },
Rows =
{
new Table.Types.Row { Values = { row1 } },
new Table.Types.Row { Values = { row2 } },
new Table.Types.Row { Values = { row3 } }
}
};
}
// Construct the table content item.
var contentItem = new ContentItem { Table = tableToInspect };
// Construct the time part config to deidentify specific value from the date.
var timePartConfig = new TimePartConfig
{
PartToExtract = TimePartConfig.Types.TimePart.Year
};
// Construct the deidentify config using time part config created above.
var deidentifyConfig = new DeidentifyConfig
{
RecordTransformations = new RecordTransformations
{
FieldTransformations =
{
new FieldTransformation
{
PrimitiveTransformation = new PrimitiveTransformation
{
TimePartConfig = timePartConfig
}
}
}
}
};
// Construct the request.
var request = new DeidentifyContentRequest
{
ParentAsLocationName = new LocationName(projectId, "global"),
DeidentifyConfig = deidentifyConfig,
Item = contentItem
};
// Call the API.
var response = dlp.DeidentifyContent(request);
// Inspect the response.
Console.Write(response.Item.Table);
return response.Item.Table;
}
}Go
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import (
"context"
"fmt"
"io"
dlp "cloud.google.com/go/dlp/apiv2"
"cloud.google.com/go/dlp/apiv2/dlppb"
)
// deIdentifyTimeExtract De-identifies a table by extracting specific parts
// of the time (year in this case) from designated fields.
func deIdentifyTimeExtract(w io.Writer, projectID string) error {
row1 := &dlppb.Table_Row{
Values: []*dlppb.Value{
{Type: &dlppb.Value_StringValue{StringValue: "Ann"}},
{Type: &dlppb.Value_StringValue{StringValue: "01/01/1970"}},
{Type: &dlppb.Value_StringValue{StringValue: "4532908762519852"}},
{Type: &dlppb.Value_StringValue{StringValue: "07/21/1996"}},
},
}
row2 := &dlppb.Table_Row{
Values: []*dlppb.Value{
{Type: &dlppb.Value_StringValue{StringValue: "James"}},
{Type: &dlppb.Value_StringValue{StringValue: "03/06/1988"}},
{Type: &dlppb.Value_StringValue{StringValue: "4301261899725540"}},
{Type: &dlppb.Value_StringValue{StringValue: "04/09/2001"}},
},
}
// Specify the table to de-identify.
tableToDeidentify := &dlppb.Table{
Headers: []*dlppb.FieldId{
{Name: "Name"},
{Name: "Birth Date"},
{Name: "Credit Card"},
{Name: "Register Date"},
},
Rows: []*dlppb.Table_Row{
{Values: row1.Values},
{Values: row2.Values},
},
}
ctx := context.Background()
// Initialize a client once and reuse it to send multiple requests. Clients
// are safe to use across goroutines. When the client is no longer needed,
// call the Close method to cleanup its resources.
client, err := dlp.NewClient(ctx)
if err != nil {
return err
}
// Closing the client safely cleans up background resources.
defer client.Close()
// Specify what content you want the service to de-identify.
contentItem := &dlppb.ContentItem{
DataItem: &dlppb.ContentItem_Table{
Table: tableToDeidentify,
},
}
// Specify the time part to extract.
timePartConfig := &dlppb.PrimitiveTransformation_TimePartConfig{
TimePartConfig: &dlppb.TimePartConfig{
PartToExtract: dlppb.TimePartConfig_YEAR,
},
}
transformation := &dlppb.PrimitiveTransformation{
Transformation: timePartConfig,
}
// Specify which fields the TimePart should apply too.
dateFields := []*dlppb.FieldId{
{Name: "Birth Date"},
{Name: "Register Date"},
}
fieldTransformation := &dlppb.FieldTransformation{
Fields: dateFields,
Transformation: &dlppb.FieldTransformation_PrimitiveTransformation{
PrimitiveTransformation: transformation,
},
}
recordTransformations := []*dlppb.RecordTransformations{
{
FieldTransformations: []*dlppb.FieldTransformation{
fieldTransformation,
},
},
}
// Specify the config for the de-identify request.
deidentifyConfig := &dlppb.DeidentifyConfig{
Transformation: &dlppb.DeidentifyConfig_RecordTransformations{
RecordTransformations: recordTransformations[0],
},
}
// Construct the de-identification request to be sent by the client.
req := &dlppb.DeidentifyContentRequest{
Parent: fmt.Sprintf("projects/%s/locations/global", projectID),
DeidentifyConfig: deidentifyConfig,
Item: contentItem,
}
// Send the request.
resp, err := client.DeidentifyContent(ctx, req)
if err != nil {
return err
}
// Print the results.
fmt.Fprintf(w, "Table after de-identification : %v", resp.GetItem().GetTable())
return nil
}
Java
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import com.google.cloud.dlp.v2.DlpServiceClient;
import com.google.privacy.dlp.v2.ContentItem;
import com.google.privacy.dlp.v2.DeidentifyConfig;
import com.google.privacy.dlp.v2.DeidentifyContentRequest;
import com.google.privacy.dlp.v2.DeidentifyContentResponse;
import com.google.privacy.dlp.v2.FieldId;
import com.google.privacy.dlp.v2.FieldTransformation;
import com.google.privacy.dlp.v2.LocationName;
import com.google.privacy.dlp.v2.PrimitiveTransformation;
import com.google.privacy.dlp.v2.RecordTransformations;
import com.google.privacy.dlp.v2.Table;
import com.google.privacy.dlp.v2.TimePartConfig;
import com.google.privacy.dlp.v2.Value;
import java.io.IOException;
import java.util.Arrays;
import java.util.List;
public class DeIdentifyWithTimeExtraction {
public static void main(String[] args) throws Exception {
// TODO(developer): Replace these variables before running the sample.
// The Google Cloud project id to use as a parent resource.
String projectId = "your-project-id";
Table tableToDeIdentify =
Table.newBuilder()
.addHeaders(FieldId.newBuilder().setName("Name").build())
.addHeaders(FieldId.newBuilder().setName("Birth Date").build())
.addHeaders(FieldId.newBuilder().setName("Credit Card").build())
.addHeaders(FieldId.newBuilder().setName("Register Date").build())
.addRows(
Table.Row.newBuilder()
.addValues(Value.newBuilder().setStringValue("Alex").build())
.addValues(Value.newBuilder().setStringValue("01/01/1970").build())
.addValues(Value.newBuilder().setStringValue("4532908762519852").build())
.addValues(Value.newBuilder().setStringValue("07/21/1996").build())
.build())
.addRows(
Table.Row.newBuilder()
.addValues(Value.newBuilder().setStringValue("Charlie").build())
.addValues(Value.newBuilder().setStringValue("03/06/1988").build())
.addValues(Value.newBuilder().setStringValue("4301261899725540").build())
.addValues(Value.newBuilder().setStringValue("04/09/2001").build())
.build())
.build();
deIdentifyWithTimeExtraction(projectId, tableToDeIdentify);
}
// De-identifies a table by extracting specific parts of the time (year in this case) from
// designated fields.
public static Table deIdentifyWithTimeExtraction(String projectId, Table tableToDeIdentify)
throws IOException {
// Initialize client that will be used to send requests. This client only needs to be created
// once, and can be reused for multiple requests. After completing all of your requests, call
// the "close" method on the client to safely clean up any remaining background resources.
try (DlpServiceClient dlp = DlpServiceClient.create()) {
// Specify what content you want the service to de-identify.
ContentItem item = ContentItem.newBuilder().setTable(tableToDeIdentify).build();
// Specify the time part to extract.
TimePartConfig timePartConfig =
TimePartConfig.newBuilder().setPartToExtract(TimePartConfig.TimePart.YEAR).build();
PrimitiveTransformation transformation =
PrimitiveTransformation.newBuilder().setTimePartConfig(timePartConfig).build();
// Specify which fields the TimePart should apply too.
List<FieldId> dateFields =
Arrays.asList(
FieldId.newBuilder().setName("Birth Date").build(),
FieldId.newBuilder().setName("Register Date").build());
FieldTransformation fieldTransformation =
FieldTransformation.newBuilder()
.addAllFields(dateFields)
.setPrimitiveTransformation(transformation)
.build();
RecordTransformations recordTransformations =
RecordTransformations.newBuilder().addFieldTransformations(fieldTransformation).build();
// Construct the configuration for the de-id request and list all desired transformations.
DeidentifyConfig deidentifyConfig =
DeidentifyConfig.newBuilder().setRecordTransformations(recordTransformations).build();
// Combine configurations into a request for the service.
DeidentifyContentRequest request =
DeidentifyContentRequest.newBuilder()
.setParent(LocationName.of(projectId, "global").toString())
.setItem(item)
.setDeidentifyConfig(deidentifyConfig)
.build();
// Send the request and receive response from the service.
DeidentifyContentResponse response = dlp.deidentifyContent(request);
System.out.println("Table after de-identification: " + response.getItem().getTable());
return response.getItem().getTable();
}
}
}
Node.js
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
// Imports the Google Cloud Data Loss Prevention library
const DLP = require('@google-cloud/dlp');
// Instantiates a client
const dlp = new DLP.DlpServiceClient();
// The project ID to run the API call under
// const projectId = 'my-project';
// The string to de-identify
// const string = 'My BirthDay is on 9/21/1976';
// Table to de-identify
const tablularData = {
headers: [
{name: 'Name'},
{name: 'Birth Date'},
{name: 'Credit Card'},
{name: 'Register Date'},
],
rows: [
{
values: [
{stringValue: 'Ann'},
{stringValue: '01/01/1970'},
{stringValue: '4532908762519852'},
{stringValue: '07/21/1996'},
],
},
{
values: [
{stringValue: 'James'},
{stringValue: '03/06/1988'},
{stringValue: '4301261899725540'},
{stringValue: '04/09/2001'},
],
},
],
};
async function deidentifyWithTimeExtraction() {
// Specify transformation to extract a portion of date.
const primitiveTransformation = {
timePartConfig: {
partToExtract: 'YEAR',
},
};
// Specify which fields the TimePart should apply too
const dateFields = [{name: 'Birth Date'}, {name: 'Register Date'}];
// Construct de-identification request to be sent by client.
const request = {
parent: `projects/${projectId}/locations/global`,
deidentifyConfig: {
recordTransformations: {
fieldTransformations: [
{
fields: dateFields,
primitiveTransformation,
},
],
},
},
item: {
table: tablularData,
},
};
// Use the client to send the API request.
const [response] = await dlp.deidentifyContent(request);
// Print results.
console.log(
`Table after de-identification: ${JSON.stringify(response.item.table)}`
);
}
deidentifyWithTimeExtraction();PHP
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
use Google\Cloud\Dlp\V2\Client\DlpServiceClient;
use Google\Cloud\Dlp\V2\ContentItem;
use Google\Cloud\Dlp\V2\DeidentifyConfig;
use Google\Cloud\Dlp\V2\DeidentifyContentRequest;
use Google\Cloud\Dlp\V2\FieldId;
use Google\Cloud\Dlp\V2\FieldTransformation;
use Google\Cloud\Dlp\V2\PrimitiveTransformation;
use Google\Cloud\Dlp\V2\RecordTransformations;
use Google\Cloud\Dlp\V2\Table;
use Google\Cloud\Dlp\V2\Table\Row;
use Google\Cloud\Dlp\V2\TimePartConfig;
use Google\Cloud\Dlp\V2\TimePartConfig\TimePart;
use Google\Cloud\Dlp\V2\Value;
/**
* De-identify data using time extraction.
* Performing time extraction object preserves a portion of a matched value that on a date, a time,
* or a timestamp preserves a portion of a matched value. You specify to Cloud DLP what kind of
* time value you want to extract, including year, month, day of the month, and so on.
*
* https://cloud.google.com/dlp/docs/concepts-bucketing#bucketing_scenario_1
*
* @param string $callingProjectId The Google Cloud project id to use as a parent resource.
* @param string $inputCsvFile The input file(csv) path to deidentify.
* @param string $outputCsvFile The oupt file path to save deidentify content.
*
*/
function deidentify_time_extract(
// TODO(developer): Replace sample parameters before running the code.
string $callingProjectId,
string $inputCsvFile = './test/data/table3.csv',
string $outputCsvFile = './test/data/deidentify_time_extract_output.csv'
): void {
// Instantiate a client.
$dlp = new DlpServiceClient();
// Read a CSV file.
$csvLines = file($inputCsvFile, FILE_IGNORE_NEW_LINES);
$csvHeaders = explode(',', $csvLines[0]);
$csvRows = array_slice($csvLines, 1);
// Convert CSV file into protobuf objects.
$tableHeaders = array_map(function ($csvHeader) {
return (new FieldId)
->setName($csvHeader);
}, $csvHeaders);
$tableRows = array_map(function ($csvRow) {
$rowValues = array_map(function ($csvValue) {
return (new Value())
->setStringValue($csvValue);
}, explode(',', $csvRow));
return (new Row())
->setValues($rowValues);
}, $csvRows);
// Construct the table object.
$tableToDeIdentify = (new Table())
->setHeaders($tableHeaders)
->setRows($tableRows);
// Specify what content you want the service to de-identify.
$contentItem = (new ContentItem())
->setTable($tableToDeIdentify);
// Specify the time part to extract.
$timePartConfig = (new TimePartConfig())
->setPartToExtract(TimePart::YEAR);
$primitiveTransformation = (new PrimitiveTransformation())
->setTimePartConfig($timePartConfig);
// Specify which fields the TimePart should apply too.
$fieldIds = [
(new FieldId())
->setName('Birth_Date'),
(new FieldId())
->setName('Register_Date')
];
$fieldTransformation = (new FieldTransformation())
->setPrimitiveTransformation($primitiveTransformation)
->setFields($fieldIds);
$recordTransformations = (new RecordTransformations())
->setFieldTransformations([$fieldTransformation]);
// Construct the configuration for the de-id request and list all desired transformations.
$deidentifyConfig = (new DeidentifyConfig())
->setRecordTransformations($recordTransformations);
$parent = "projects/$callingProjectId/locations/global";
// Send the request and receive response from the service.
$deidentifyContentRequest = (new DeidentifyContentRequest())
->setParent($parent)
->setDeidentifyConfig($deidentifyConfig)
->setItem($contentItem);
$response = $dlp->deidentifyContent($deidentifyContentRequest);
// Print the results.
$csvRef = fopen($outputCsvFile, 'w');
fputcsv($csvRef, $csvHeaders);
foreach ($response->getItem()->getTable()->getRows() as $tableRow) {
$values = array_map(function ($tableValue) {
return $tableValue->getStringValue();
}, iterator_to_array($tableRow->getValues()));
fputcsv($csvRef, $values);
};
printf('Table after deidentify (File Location): %s', $outputCsvFile);
}Python
Sensitive Data Protection의 클라이언트 라이브러리를 설치하고 사용하는 방법은 Sensitive Data Protection 클라이언트 라이브러리를 참조하세요.
Sensitive Data Protection에 인증하려면 애플리케이션 기본 사용자 인증 정보를 설정합니다. 자세한 내용은 로컬 개발 환경의 인증 설정을 참조하세요.
import csv
from datetime import datetime
from typing import List
import google.cloud.dlp
def deidentify_with_time_extract(
project: str,
date_fields: List[str],
input_csv_file: str,
output_csv_file: str,
) -> None:
"""Uses the Data Loss Prevention API to deidentify dates in a CSV file through
time part extraction.
Args:
project: The Google Cloud project id to use as a parent resource.
date_fields: A list of (date) fields in CSV file to de-identify
through time extraction. Example: ['birth_date', 'register_date'].
Date values in format: mm/DD/YYYY are considered as part of this
sample.
input_csv_file: The path to the CSV file to deidentify. The first row
of the file must specify column names, and all other rows must
contain valid values.
output_csv_file: The output file path to save the time extracted data.
"""
# Instantiate a client.
dlp = google.cloud.dlp_v2.DlpServiceClient()
# Convert date field list to Protobuf type.
def map_fields(field):
return {"name": field}
if date_fields:
date_fields = map(map_fields, date_fields)
else:
date_fields = []
csv_lines = []
with open(input_csv_file) as csvfile:
reader = csv.reader(csvfile)
for row in reader:
csv_lines.append(row)
# Helper function for converting CSV rows to Protobuf types
def map_headers(header):
return {"name": header}
def map_data(value):
try:
date = datetime.strptime(value, "%m/%d/%Y")
return {
"date_value": {"year": date.year, "month": date.month, "day": date.day}
}
except ValueError:
return {"string_value": value}
def map_rows(row):
return {"values": map(map_data, row)}
# Using the helper functions, convert CSV rows to protobuf-compatible
# dictionaries.
csv_headers = map(map_headers, csv_lines[0])
csv_rows = map(map_rows, csv_lines[1:])
# Construct the table dictionary.
table = {"headers": csv_headers, "rows": csv_rows}
# Construct the `item` for table to de-identify.
item = {"table": table}
# Construct deidentify configuration dictionary.
deidentify_config = {
"record_transformations": {
"field_transformations": [
{
"primitive_transformation": {
"time_part_config": {"part_to_extract": "YEAR"}
},
"fields": date_fields,
}
]
}
}
# Write to CSV helper methods.
def write_header(header):
return header.name
def write_data(data):
return data.string_value or "{}/{}/{}".format(
data.date_value.month,
data.date_value.day,
data.date_value.year,
)
# Convert the project id into a full resource id.
parent = f"projects/{project}/locations/global"
# Call the API
response = dlp.deidentify_content(
request={
"parent": parent,
"deidentify_config": deidentify_config,
"item": item,
}
)
# Print the result.
print(f"Table after de-identification: {response.item.table}")
# Write results to CSV file.
with open(output_csv_file, "w") as csvfile:
write_file = csv.writer(csvfile, delimiter=",")
write_file.writerow(map(write_header, response.item.table.headers))
for row in response.item.table.rows:
write_file.writerow(map(write_data, row.values))
# Print status.
print(f"Successfully saved date-extracted output to {output_csv_file}")