Skip to content

Commit fd02f16

Browse files
bhavika-dhanwaniaverikitschSita04Shabirmean
authored
[DLP] Implemented Reidentify With Deterministic Encryption (GoogleCloudPlatform#7849)
* implemented ReidentifyWithDeterministicEncryption.java * resolved review comments * resolved test error * resolved review comments --------- Co-authored-by: Averi Kitsch <akitsch@google.com> Co-authored-by: Sita Lakshmi Sangameswaran <sita1996@gmail.com> Co-authored-by: Shabir Mohamed Abdul Samadh <7249208+Shabirmean@users.noreply.github.com>
1 parent 1c38937 commit fd02f16

File tree

3 files changed

+156
-1
lines changed

3 files changed

+156
-1
lines changed

‎dlp/snippets/src/main/java/dlp/snippets/DeIdenitfyWithDeterministicEncryption.java

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@ public static void main(String[] args) throws Exception {
5858
deIdentifyWithDeterministicEncryption(projectId, textToDeIdentify, wrappedKey, kmsKeyName);
5959
}
6060

61-
public static void deIdentifyWithDeterministicEncryption(
61+
public static String deIdentifyWithDeterministicEncryption(
6262
String projectId, String textToDeIdentify, String wrappedKey, String key) throws IOException {
6363
// Initialize client that will be used to send requests. This client only needs to be created
6464
// once, and can be reused for multiple requests. After completing all of your requests, call
@@ -131,6 +131,9 @@ public static void deIdentifyWithDeterministicEncryption(
131131
// Print the results.
132132
System.out.println(
133133
"Text after de-identification: " + response.getItem().getValue());
134+
135+
return response.getItem().getValue();
136+
134137
}
135138
}
136139
}

‎dlp/snippets/src/main/java/dlp/snippets/ReidentifyWithDeterministicEncryption.java

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
/*
2+
* Copyright 2023 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package dlp.snippets;
18+
19+
// [START dlp_reidentify_deterministic]
20+
21+
import com.google.cloud.dlp.v2.DlpServiceClient;
22+
import com.google.privacy.dlp.v2.ContentItem;
23+
import com.google.privacy.dlp.v2.CryptoDeterministicConfig;
24+
import com.google.privacy.dlp.v2.CryptoKey;
25+
import com.google.privacy.dlp.v2.CustomInfoType;
26+
import com.google.privacy.dlp.v2.DeidentifyConfig;
27+
import com.google.privacy.dlp.v2.InfoType;
28+
import com.google.privacy.dlp.v2.InfoTypeTransformations;
29+
import com.google.privacy.dlp.v2.InspectConfig;
30+
import com.google.privacy.dlp.v2.KmsWrappedCryptoKey;
31+
import com.google.privacy.dlp.v2.LocationName;
32+
import com.google.privacy.dlp.v2.PrimitiveTransformation;
33+
import com.google.privacy.dlp.v2.ReidentifyContentRequest;
34+
import com.google.privacy.dlp.v2.ReidentifyContentResponse;
35+
import com.google.protobuf.ByteString;
36+
import java.io.IOException;
37+
import java.nio.charset.StandardCharsets;
38+
import org.apache.commons.codec.binary.Base64;
39+
40+
public class ReidentifyWithDeterministicEncryption {
41+
42+
public static void main(String[] args) throws Exception {
43+
// TODO(developer): Replace these variables before running the sample.
44+
45+
// The Google Cloud project id to use as a parent resource.
46+
String projectId = "your-project-id";
47+
// The string to de-identify.
48+
String textToIdentify = "My SSN is 372819127";
49+
// The encrypted ('wrapped') AES-256 key to use.
50+
// This key should be encrypted using the Cloud KMS key specified by key_name.
51+
String wrappedKey = "YOUR_ENCRYPTED_AES_256_KEY";
52+
// The name of the Cloud KMS key used to encrypt ('wrap') the AES-256 key.
53+
String kmsKeyName =
54+
"projects/YOUR_PROJECT/"
55+
+ "locations/YOUR_KEYRING_REGION/"
56+
+ "keyRings/YOUR_KEYRING_NAME/"
57+
+ "cryptoKeys/YOUR_KEY_NAME";
58+
// The string to re-identify.
59+
String textToReIdentify =
60+
DeIdenitfyWithDeterministicEncryption.deIdentifyWithDeterministicEncryption(
61+
projectId, textToIdentify, wrappedKey, kmsKeyName);
62+
reIdentifyWithDeterminsiticEncryption(projectId, textToReIdentify, wrappedKey, kmsKeyName);
63+
}
64+
65+
public static void reIdentifyWithDeterminsiticEncryption(
66+
String projectId, String textToReIdentify, String wrappedKey, String key) throws IOException {
67+
// Initialize client that will be used to send requests. This client only needs to be created
68+
// once, and can be reused for multiple requests. After completing all of your requests, call
69+
// the "close" method on the client to safely clean up any remaining background resources.
70+
try (DlpServiceClient dlp = DlpServiceClient.create()) {
71+
// Specify what content you want the service to ReIdentify
72+
ContentItem contentItem = ContentItem.newBuilder().setValue(textToReIdentify).build();
73+
74+
CustomInfoType.SurrogateType surrogateType =
75+
CustomInfoType.SurrogateType.newBuilder().build();
76+
77+
// Specify the surrogate type used at time of de-identification.
78+
InfoType surrogateInfoType = InfoType.newBuilder()
79+
.setName("SSN_TOKEN")
80+
.build();
81+
82+
CustomInfoType customInfoType = CustomInfoType.newBuilder()
83+
.setInfoType(surrogateInfoType)
84+
.setSurrogateType(surrogateType)
85+
.build();
86+
87+
InspectConfig inspectConfig = InspectConfig.newBuilder()
88+
.addCustomInfoTypes(customInfoType)
89+
.build();
90+
91+
// Specify an encrypted AES-256 key and the name of the Cloud KMS key that encrypted it.
92+
KmsWrappedCryptoKey unwrappedCryptoKey = KmsWrappedCryptoKey.newBuilder()
93+
.setWrappedKey(
94+
ByteString.copyFrom(
95+
Base64.decodeBase64(wrappedKey.getBytes(StandardCharsets.UTF_8))))
96+
.setCryptoKeyName(key)
97+
.build();
98+
CryptoKey cryptoKey = CryptoKey.newBuilder()
99+
.setKmsWrapped(unwrappedCryptoKey)
100+
.build();
101+
102+
CryptoDeterministicConfig cryptoDeterministicConfig = CryptoDeterministicConfig.newBuilder()
103+
.setSurrogateInfoType(surrogateInfoType)
104+
.setCryptoKey(cryptoKey)
105+
.build();
106+
107+
PrimitiveTransformation primitiveTransformation = PrimitiveTransformation.newBuilder()
108+
.setCryptoDeterministicConfig(cryptoDeterministicConfig)
109+
.build();
110+
111+
InfoTypeTransformations.InfoTypeTransformation infoTypeTransformation =
112+
InfoTypeTransformations.InfoTypeTransformation.newBuilder()
113+
.setPrimitiveTransformation(primitiveTransformation)
114+
.build();
115+
116+
InfoTypeTransformations transformations = InfoTypeTransformations.newBuilder()
117+
.addTransformations(infoTypeTransformation)
118+
.build();
119+
120+
DeidentifyConfig deidentifyConfig = DeidentifyConfig.newBuilder()
121+
.setInfoTypeTransformations(transformations)
122+
.build();
123+
124+
// Combine configurations into a request for the service.
125+
ReidentifyContentRequest request = ReidentifyContentRequest.newBuilder()
126+
.setParent(LocationName.of(projectId, "global").toString())
127+
.setItem(contentItem)
128+
.setInspectConfig(inspectConfig)
129+
.setReidentifyConfig(deidentifyConfig)
130+
.build();
131+
132+
// Send the request and receive response from the service.
133+
ReidentifyContentResponse response = dlp.reidentifyContent(request);
134+
135+
// Print the results.
136+
System.out.println("Text after re-identification: " + response.getItem().getValue());
137+
}
138+
}
139+
}
140+
141+
// [END dlp_reidentify_deterministic]

‎dlp/snippets/src/test/java/dlp/snippets/DeIdentificationTests.java

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -555,6 +555,17 @@ public void testDeIdentifyWithDeterministicEncryption() throws IOException {
555555
assertThat(output).contains("Text after de-identification:");
556556
}
557557

558+
@Test
559+
public void testReIdentifyWithDeterministicEncryption() throws IOException {
560+
String textToReIdentify =
561+
DeIdenitfyWithDeterministicEncryption.deIdentifyWithDeterministicEncryption(
562+
PROJECT_ID, "My SSN is 372819127", WRAPPED_KEY, KMS_KEY_NAME);
563+
ReidentifyWithDeterministicEncryption.reIdentifyWithDeterminsiticEncryption(
564+
PROJECT_ID, textToReIdentify, WRAPPED_KEY, KMS_KEY_NAME);
565+
String output = bout.toString();
566+
assertThat(output).contains("Text after re-identification: My SSN is 372819127");
567+
}
568+
558569
@Test
559570
public void testDeIdentifyWithFpeSurrogate() throws IOException, NoSuchAlgorithmException {
560571

0 commit comments

Comments
 (0)