IRI data masking tools<\/span><\/a> like FieldShield and DarkShield use lookup values that may or may not be reversible. For the pseudonyms to be consistent and\/or reversible, however, the original values must be paired with a list of replacement values in a two-column set file called a pseudonym replacement set (or pseudo set) file.<\/span><\/p>\n The pseudo set file is used to consistently replace a source value with a replacement value whenever the source value is the same as a value in the lookup column of the pseudonym replacement set file. This is how consistent pseudonymization replacement occurs.<\/span><\/p>\n As stated previously, consistent replacement requires a lookup list. The reliance on a lookup list to find matches places limitations and restraints on pseudonymization. This is because for any number of unique names present in your source\u2019s table or file they must also be present among the lookup list, lest the event of no match found occurs.\u00a0<\/span><\/p>\n In the case where no match is found, a default or empty string will be returned for the replacement value. The problem with this is that you have several values matched to a single default replacement value.\u00a0<\/span><\/p>\n It is, for this reason, it is suggested to frequently update the pseudonym replacement set file if you have a column of names that frequently receive new entries.<\/span><\/p>\n Failure to update lookup sets when LAST_NAME column receives new entries.<\/span><\/i><\/p>\n Aware of the shortcomings of normal pseudonym replacement, <\/span>IRI FieldShield<\/span><\/a> now supports a new more flexible, and secure form of pseudonym replacement, in the form of a Pseudonym <\/span>Hash <\/span><\/i>Replacement Rule. This rule also uses a lookup list to find exact matches and replace a value when a match occurs from a list of replacement values.\u00a0<\/span><\/p>\n However, unlike normal pseudo replacement, the new rule uses <\/span>hashed <\/span><\/i>values as the lookup values. These lookup values are used to either find exact matches or the next closest match.<\/span><\/p>\n The Pseudonym Hash Replacement Rule is considered flexible because it can consistently map multiple values to a single replacement value. This many-to-one relationship releases users from the tethers of having to continuously update and maintain their pseudonym replacement set files whenever more unique entries are added to their source\u2019s columns in tables or files.<\/span><\/p>\n Another point to note is the increase in security this new rule brings. Normally, a pseudonym replacement set file contains a column with a lookup list that matches against values in a table or flat files. This means that the values in the lookup list may have real names.<\/span><\/p>\n In certain situations, it may be necessary to secure the set file containing the lookup list to prevent the leak of PII from the lookup list. A pseudonym replacement set file with hashed values for the lookup is secure because any potential PII has already been hashed.<\/span><\/p>\n Also, unlike encryption which supports decryption (reversal of encryption), hashing is typically irreversible. Only under certain circumstances <\/span>could it be possible<\/span><\/a> to determine the original value, such as if the input length is small enough and by comparing hashed values to known hashed values of strings.<\/span><\/p>\n Before the original source value of a table or flat file is matched against the hashed lookup values in the lookup list of a pseudonym replacement set file, the original source value must first be preprocessed.\u00a0<\/span><\/p>\n Using the same type of hashing function applied to the lookup values of the pseudonym replacement set file, the original source value is hashed. Then, the new hashed value is used to search for a match in the lookup list.\u00a0<\/span><\/p>\n By providing the SEARCH parameter of LE (less than or equal) or GE (greater than or equal) in the IRI data masking program, occurrences, where exact matches do not occur in the lookup list, can be handled (pseudonymized).<\/span><\/p>\n Example One<\/span><\/i><\/p>\n Example Two<\/span><\/i><\/p>\n To create a Pseudonym Hash Replacement Rule we can use the new wizard in IRI Workbench.<\/span><\/p>\n Steps:<\/b><\/p>\n \u00a01. In the IRI Workbench click the down arrow next to the blue icon designated as the<\/span> IRI Menu<\/b>. After the dropdown menu expands click <\/span>New Rule<\/b>.<\/span><\/p>\n 3. Select Automatic Replacement for New Original Values<\/i> from the displayed tree view inside the Pseudonym Replacement<\/i> directory. Then provide the project\u2019s location and desired name for the new rule.<\/p>\n Once finished, click <\/span>Next<\/b> to open a wizard that will be used to generate the new rule.<\/span><\/p>\n 4. In the newly opened wizard. The user can now start selecting options that will be used in the new rule. The user will need to select a hash function, the search type, and a two-column pseudonym replacement set file that has hashed values for the lookup list.<\/span><\/p>\n IRI currently supports three different hash functions, MD5, SHA1, and SHA2. It is important that the hash function chosen for the Pseudonym Hash Replacement Rule is the same hash function<\/span> used on the lookup values in the hashed pseudonym replacement set file.<\/p>\n A search type must also be specified. Depending on the selection the replacement value results will vary when an exact match to the lookup column does not exist.<\/span><\/p>\n 5. Like a normal Pseudonym Replacement Rule, the Pseudonym Hash Replacement Rule relies on a two-column set file for the lookup values list (this list needs to be in a hashed format for the Pseudo Hash Replacement Rule) and the replacement values list. <\/span> In this case, the Pseudonym Hash Set File Creation Wizard will open and allow you to create the necessary set file. At completion, a path to the set file will be provided.<\/span><\/p>\n For a walkthrough on how to use the Pseudonym Hash Set File Creation Wizard, follow steps #3-13 in <\/span>this article<\/span><\/a>.<\/span><\/p>\n 6. If the user is satisfied with their selections they can then click <\/span>Finish<\/b> to generate the\u00a0 Pseudonym Hash Replacement Rule in a Data Class Rule Library of their selected project.<\/span><\/p>\n A Pseudonym Hash Replacement Rule is actually a special type of rule called a <\/span>Linked Chain Rule<\/span><\/i>. This is a rule that actually has two or more rules linked together. The individual links of a <\/span>Linked Chain Rule<\/span><\/i> can be located in separate sections of a job script.<\/span><\/p>\n In the case of the Pseudonym Hash Replacement Rule we have a link in the chain applying a hashing function in the <\/span>\/INREC<\/b> section of a script and a Pseudonym Replacement Rule is applied in the<\/span> \/OUTFILE<\/b> section of the script.<\/span><\/p>\n The Pseudonym Hash Replacement Rule creates a two-part rule that is chained together.<\/span><\/i><\/p>\n Once the rule is created, it can then be applied like any other rule via the SortCL job script editor in IRI Workbench or through a Fieldshield masking job.<\/span><\/p>\n A FieldShield job script has been generated.<\/span><\/i><\/p>\n In the image above, there is a FieldShield job script that has been generated with the Pseudonym Hash Replacement Rule applied to a field called <\/span>FIRST_NAME<\/span><\/i>. Because the Pseudonym Hash Replacement Rule consists of multiple rules linked together, they modify fields in both the <\/span>\/INREC<\/b> and the <\/span>\/OUTFILE <\/b>sections.\u00a0<\/span><\/p>\n It is easy to determine which rules are links in a <\/span>Linked Chain Rule <\/span><\/i>by looking for the keyword <\/span>LINK_{NUMBER}<\/span><\/i> in the field names. If you have any questions about this, please email <\/span>fieldshield@iri.com<\/span><\/a>.<\/span><\/p>\n With this new process of producing pseudonym replacements, users are no longer burdened with the continual maintenance and expansion of their pseudonym replacement set files.\u00a0<\/span><\/p>\n Furthermore, unlike in normal a pseudonym replacement file where the lookup list could possibly display sensitive values, a lookup list with hashed values prevents gleaning any meaningful data from the lookup list.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":" What is Pseudonymization? Pseudonymization is a data masking method involving the replacement of one or more original source values in a column in a table, file, or in free-floating text with another, usually consistent \u201csynthetic\u201d value. Pseudonymization is used most often for anonymizing sensitive values like names and complies with the GDPR when the pseudonyms<\/p>\n![\"\"](\"\/blog\/wp-content\/uploads\/2022\/08\/Two-column-pseudonym-file-300x157.png\")
<\/p>\nLimitations of Normal Pseudonymization<\/b><\/h5>\n
![\"\"](\"\/blog\/wp-content\/uploads\/2022\/08\/look-up-value-300x212.jpg\")
<\/p>\nPseudonym Hash Replacement Rule<\/b><\/h5>\n
How Hash Lookup and Replacements Occur<\/b><\/h5>\n
![\"\"](\"\/blog\/wp-content\/uploads\/2022\/08\/pseudonym-replacement-300x98.jpg\")
<\/p>\n![\"\"](\"\/blog\/wp-content\/uploads\/2022\/08\/pseudonym-replacement-example-2-300x102.jpg\")
<\/p>\nHow to Create a Pseudonym Hash Replacement Rule<\/b><\/h5>\n
![\"\"](\"\/blog\/wp-content\/uploads\/2022\/08\/hash_rule1-300x75.png\")
\n2. From the new window select Field Rules<\/i> and click Next<\/b>.<\/p>\n![\"\"](\"\/blog\/wp-content\/uploads\/2022\/08\/hash_rule2-300x261.png\")
<\/p>\n![\"\"](\"\/blog\/wp-content\/uploads\/2022\/08\/FieldAutomaticRule-236x300.jpg\")
<\/p>\n![\"\"](\"\/blog\/wp-content\/uploads\/2022\/08\/hash_rule4-283x300.png\")
<\/p>\n
\n<\/span>
\n<\/span>If the set file has already been created, click the <\/span>Browse<\/b> button to select the file. If a file has not been created yet, click <\/span>Create<\/b>. <\/span><\/p>\n![\"\"](\"\/blog\/wp-content\/uploads\/2022\/08\/pseudo_rule_6-282x300.png\")
<\/p>\nResults<\/b><\/h5>\n
![\"\"](\"\/blog\/wp-content\/uploads\/2022\/08\/lib_rule_1.png\")
<\/p>\n![\"\"](\"\/blog\/wp-content\/uploads\/2022\/08\/result_hash_rule-300x123.png\")
<\/p>\nIn Closing<\/b><\/h5>\n