# Configure Data Masking ## What is data masking? Data masking is the process of obfuscating data in client systems, so it is no longer recognizable as PII (personally identifiable information). For example, if a customer requests that you remove all information associated with their email, `test@example.com`, you might choose to "mask" that email with a random string, `xgoi4301nkyi79fjfdopvyjc5lnbr9`, and their associated address with another random string `2ab6jghdg37uhkaz3hpyavpss1dvg2`. In Fides, your options to mask data are captured in "masking strategies". Fides supports a wide variety of masking strategies for different purposes when used directly as an API including HMAC, Hash, AES encryption, string rewrite, random string rewrite, and null rewrite. ### Why mask instead of delete? Deleting customer data may involve entirely deleting a whole record (all attributes of the entity) or permanent and irreversible anonymization of the record by updating specific fields within a record with masked values. Using a masking strategy instead of straight deletion to obscure PII helps ensure referential integrity in your database. For example, you might have an `orders` table with a foreign key to `user` without cascade delete. Say you first deleted a user with email `test@example.com` without addressing their orders, you could potentially have lingering orphans in the `orders` table. Using masking as a "soft delete" might be a safer strategy depending on how your tables are defined. In order to ensure referential integrity is retained, any values that represent foreign keys must be consistently updated with the same masked values across all sources. Other reasons to mask instead of delete include legal requirements that have you retain certain data for a certain length of time. ## Using Fides as a masking service To use Fides as a masking service, send a `PUT` request to the masking endpoint with the value(s) you'd like pseudonymized. This endpoint is also useful for viewing how different masking strategies work. ### Masking example PUT /masking/mask ``` { "values": ["test@example.com"], "masking_strategy": { "strategy": "random_string_rewrite", "configuration": { "length": 20, "format_preservation": { "suffix": "@masked.com" } } } } ``` Response 200 OK ``` { "plain": ["test@example.com"], "masked_value": ["idkeaotbrub346ycbmpo@masked.com"] } ``` The email has been replaced with a random string of 20 characters, while still preserving that the value is an email. ## Configuration Erasure requests will mask data with the chosen masking strategy. To configure a specific masking strategy to be used for a Policy, you will create an `erasure` rule that captures that strategy for the Policy. PATCH /policy/policy_key/rule ``` [{ "name": "Global erasure rule", "action_type": "erasure", "key": "string_rewrite_rule", "masking_strategy": { "strategy": "random_string_rewrite", "configuration": { "length": 20, "format_preservation": { "suffix": "@masked.com" } } } }] ``` ## Supported masking strategies For improved security some masking strategies will generate a random value to be used as a secret key. ### Null rewrite Masks the input value with a null value. `strategy`: `null_rewrite` No config needed. ### String rewrite Masks the input value with a default string value. `strategy`: `string_rewrite` `configuration`: - `rewrite_value`: `str` that will replace input values - `format_preservation` (optional): `Dict` with the following key/vals: - `suffix`: `str` that specifies suffix to append to masked value ### Hash Masks the data by hashing the input before returning it. The hash is deterministic such that the same input will return the same output within the context of the same privacy request. `strategy`: `hash` `configuration`: - `algorithm` (optional): `str` that specifies Hash masking algorithm. Options include `SHA-512` or `SHA_256`. Default = `SHA_256` - `format_preservation` (optional): `Dict` with the following key/vals: - `suffix`: `str` that specifies suffix to append to masked value Requires secrets. ### Random string rewrite Masks the input value with a random string of a specified length. `strategy`: `random_string_rewrite` `configuration`: - `length` (optional): `int` that specifies length of randomly generated string. Default = `30` - `format_preservation` (optional): `Dict` with the following key/vals: - `suffix`: `str` that specifies suffix to append to masked value ### AES encrypt Masks the data using AES encryption before returning it. `strategy`: `aes_encrypt` `configuration`: - `mode` (optional): `str` that specifies AES encryption mode. Only supported option is `GCM`. Default = `GCM` - `format_preservation` (optional): `Dict` with the following key/vals: - `suffix`: `str` that specifies suffix to append to masked value Requires secrets. ### HMAC Masks the data using HMAC before returning it. `strategy`: `hmac` `configuration`: - `algorithm` (optional): `str` that specifies HMAC masking algorithm. Options include `SHA-512` or `SHA_256`. Default = `SHA_256` - `format_preservation` (optional): `Dict` with the following key/vals: - `suffix`: `str` that specifies suffix to append to masked value Requires secrets. ## Getting masking options Issue a GET request to `/api/v1/masking/strategy` to preview the different masking strategies available, along with their configuration options. ## Extensibility Fides masking strategies are built on top of an abstract `MaskingStrategy` base class. `MaskingStrategy` has five methods: `mask`, `secrets_required`, `get_configuration_model`, `get_description`, and `data_type_supported`. For more detail on these methods, visit the class in the Fides repository. ### Integrate the masking strategy factory In order to leverage an implemented masking strategy, the `MaskingStrategy` subclass must be registered with the `MaskingStrategyFactory`.