Data masking

Method, device, and storage medium to receive test data including multiple test strings, wherein the test data is a data set that includes all possible values of input strings to be data masked; encrypt each of the test strings; select a portion of the encrypted test string; compare each portion to the corresponding test string; determine, for each portion, whether the portion of is equal to the corresponding test string; assign the portion as a replacement string when the portion is not equal to the corresponding test string; determine whether each replacement string is unique; store each replacement string that is not unique; generate, for each replacement string that is not unique, an alternate replacement string; and output an alternate replacement string, as a masked string in response to a determination that art input string matches one of the stored test strings associated with one of the alternate replacement strings.

BACKGROUND

Data masking is a process that obscures data. There are various techniques used in the industry, such as encryption, substitution, shuffling, and number and data variance.

DETAILED DESCRIPTION

According to an exemplary embodiment, a data masking process includes a preprocessing stage and a processing stage. According to an exemplary embodiment, the preprocessing stage identifies data that yield collisions. According to an exemplary embodiment, the preprocessing stage uses test data that includes all possible values of input data to be masked. By way of example, assume that the input data to be masked are social security numbers, which are represented by a nine-digit number (e.g., 011-55-3223). The test data may have any pre-defined maximum length and the length of the test data is independent of the length of the input data. For example, test data may have a length from one through eight and values ranging from 0-99999999. The test data includes values ranging from the lowest possible value of a social security number to a highest possible value for a social security number so as to accommodate any possible value of input data. In this way, the preprocessing stage may be performed once to ensure the identification of collisions.

According to an exemplary embodiment, the preprocessing stage calculates replacement data for test data that yield collisions and stores the collided test data and the replacement data.

According to an exemplary embodiment, the processing stage generates masked data for input data. According to an exemplary embodiment, the processing stage identifies input data that match the stored test data that yield collisions and uses their corresponding replacement data as the masked data. According to an exemplary embodiment, the processing stage generates masked data for the input data that do not match the stored test data. In this way, the data masking process provides, among other things, use of a limited amount of storage and avoids the cost, the security measures, and the complexities associated with storing and retrieving all masked data. In other words, a data masking process includes generating masked data (e.g., on-the-fly, during run-time, etc.) for input values that do not result in collision and uses replacement data as masked data for input values that do result in collision, as identified during the preprocessing stage.

The data masking process described herein provides, among other things, a maintenance of referential integrity (e.g., parent-child table relationships), a maintenance of input characteristics (e.g., length of the input data, data type of the input data, special characters are retained), and security (e.g., based on industry standard encryption used during the data masking process).

An embodiment of data masking, as described herein, may be implemented by a network device, by a user device, or a combination thereof.

FIG. 1is a diagram illustrating an exemplary environment in which an exemplary embodiment of data masking may be implemented. As illustrated inFIG. 1, environment100includes user devices105-1through105-X, in which X>1 (also referred to generally as user device105or user devices105) and a network110. Network110includes a data masking device115.

The number of devices and networks, and the configuration in environment100are exemplary. According to other embodiments, environment100may include additional devices, fewer devices, different devices, and/or differently arranged devices, than those illustrated inFIG. 1. Additionally, or alternatively, environment100may include an additional network or may be implemented without a network.

According to other embodiments, a single device inFIG. 1may be implemented as multiple devices and/or multiple devices may be implemented as a single device. By way of example, data masking device115may be implemented as multiple devices. Alternatively, for example, user device105may be combined with data masking device115into a single device.

A device may be implemented according to a centralized computing architecture or a distributed computing architecture. For example, data masking device115may be implemented according to a centralized or a distributed computing architecture. Additionally, a device may be implemented according to one or multiple network architectures (e.g., a client device, a server device, a peer device, or a combination thereof). For example, user device105may be implemented as a client device and data masking device115may be implemented as a server device. Additionally, for example, a device may be implemented as a stand-alone device. For example, data masking device115may be implemented as a stand-alone device. Furthermore, given the security issues related to data masking, a device that performs data masking may be secure to avoid intrusion by unwanted parties, data breaches, data compromises, etc.

Also, according to other embodiments, one or more functions and/or processes described as being performed by a particular device or logic may be performed by a different device or logic, or some combination of devices or logic, which may or may not include the particular device or logic.

Environment100may be implemented to include wired and/or wireless connections among the devices and network illustrated. A connection may be direct or indirect and may involve intermediary device(s) and/or network(s) not illustrated inFIG. 1.

User device105includes a device having the capability to communicate with another device, a network, a system, and/or the like. For example, user device105may be implemented as a computational device (e.g., a computer, etc.) or a terminal device.

Network110includes one or multiple networks. For example, network110may include a wireless network and/or a wired network. Network110allows user device105to communicate, directly or indirectly, with data masking network device115.

Data masking device115includes a device having the capability to communicate with another device, a network, a system, and/or the like. For example, data masking device115may be implemented as a computational device (e.g., a computer, etc.). Data masking device115is capable of performing data masking according to an exemplary embodiment described herein.

FIGS. 2A-2Dare diagrams illustrating an exemplary process according to an exemplary embodiment of data masking. The process is performed by data masking device115. For example, data masking device115includes preprocessing logic220and processing logic275.

Referring toFIG. 2A, test data205is provided to preprocessing logic220. Test data205may include, for example, numerical data, alphabetic data, or alphanumeric data. According to an exemplary embodiment, test data205includes every possible value or range of input data. For example, test data205may include a range of values for possible birth dates (e.g., for persons under 150 years old), driver's license, account numbers, etc. According to such an embodiment, preprocessing logic220may perform the preprocessing process only one time. According to other embodiments, test data205may include data that does not encompass all possible values.

Preprocessing logic220identifies collisions with respect to test data205. According to an exemplary embodiment, test data205is of the same length and data type as the input data. According to another embodiment, test data205may be of a parsed length of the input data. By way of example, assume that the input data is 100 characters in length. During the masking process described below, the input data may be parsed (e.g., into strings having a length of ten). According to this example, test data205may be a length often and have a data type corresponding to the parsed input data.

As illustrated inFIG. 2A, preprocessing logic220receives test data205. Preprocessing logic220encrypts test data205using an encryption algorithm. For example, any well-known encryption algorithm may be used, such as an Advanced Encryption Standard (AES)-based algorithm (e.g., AES-256, etc.), or a proprietary encryption algorithm.

Referring toFIG. 2B, preprocessing logic220generates replacement data for the encrypted data. According to an exemplary embodiment, preprocessing logic220includes length reduction logic (not illustrated). The length reduction logic tokenizes the encrypted data, which is assumed to have a length greater than the test data205, into a length equal to that of the test data205. Preprocessing logic220compares the tokenized encrypted data to the test data205. If the tokenized encrypted data and test data205are different, preprocessing logic selects the tokenized encrypted data, as replacement data, for test data205. If the tokenized encrypted data and test data205are the same, length reduction logic tokenizes a different set of characters from the encrypted data. Preprocessing logic220compares the other tokenized encrypted data to test data205. This process is repeated until the tokenized encrypted data and test data205are not the same.

According to an exemplary implementation, length reduction logic selects the set of characters that are serially positioned. For example, assume that the encrypted data is ten characters in length and the test data205has a length of eight characters. Length reduction logic tokenizes characters one through eight of the encrypted data. If the tokenized encrypted data and test data205are the same, length reduction logic may tokenize characters two through nine of the encrypted data, and so forth. According to another implementation, length reduction logic selects the set of characters from the encrypted data, which are not serially positioned. For example, according to the example described above, length reduction logic may select characters from the encrypted data having positions at one, three, four, five, seven, eight, nine, and ten, or some other positions.

As further illustrated inFIG. 2B, preprocessing logic220determines whether a collision exists. For example, preprocessing logic220compares the replacement data correlated to test data205to previously stored replacement data stemming from previous iterations of the preprocessing process, as applied to other test data205. For example, during a first iteration, preprocessing logic220stores a first test data205and a first replacement data225in a non-collided test data and replacement data storage250. For subsequent iterations, as applied to an “nth” test data205, preprocessing logic220compares an “nth” replacement data225associated with the “nth” test data205to replacement data225stored in non-collided parsed input data and replacement data storage250. If the “nth” replacement data225is not already stored, preprocessing logic220determines that a collision does not exist, and stores the “nth” test data205and the “nth” replacement data in non-collided test data and replacement data storage250. If the “nth” replacement data225is already stored, then preprocessing logic220determines that a collision does exist, and stores the “nth” test data205and the “nth” replacement data225in a collided test data and replacement data storage255.

Referring toFIG. 2C, preprocessing logic220generates an alternate replacement data for each of the collided replacement data225stored in collided test data and replacement storage255. According to an exemplary embodiment, preprocessing logic220determines whether the selected alternate replacement data results in a collision based on a comparison with replacement data225stored in non-collided test data and replacement data storage250. If a collision does exist, preprocessing logic220generates another alternate replacement data, and so forth. If a collision does not exist, preprocessing logic220stores test data205and alternate replacement data235in collided test data and alternate replacement data storage260. Preprocessing logic220may generate alternate replacement data based on various methods, which are described further below.

According to an exemplary implementation, preprocessing logic220deletes test data205and replacement data225stored in storage250and storage255. As described further below, processing logic275generates masked data (e.g., on-the-fly) for input data that does not match the test data205stored in storage260. In this regard, as previously described, a limited amount of storage is used (e.g., for a data masking process) and the cost, the security measures, and the complexities associated with storing and retrieving all masked data may be avoided, while maintaining referential integrity.

Referring toFIG. 2D, assume processing logic275receives a request for input data265that is to be masked. According to this example, it may be assumed that input data265is of a length that matches alternate replacement data235. Additionally, according to this example, it may be assumed that input data265does not include any special characters. According to other examples, processing logic275may parse input data265to sub-strings having a length equal to that of alternate replacement data235. Additionally, or alternatively, according to other examples, processing logic275may remove special characters from input data265. For example, a special character may correspond to a punctuation mark (e.g., a hyphen, a period, etc.) a special symbol (e.g., an “@” sign, etc.), or another type of character that is not a number or a letter.

Processing logic275compares the input data265to the stored test data205correlated to alternate replacement data235stored in storage260. If there is a match between input data265and one of the stored test data205, processing logic275selects the alternate replacement data235, which correlates to the test data205, as a masked data270for input data265. If there is not a match between input data265and any of the stored test data205, processing logic275generates masked data270for input data265. For example, according to an exemplary embodiment, processing logic275encrypts input data265and performs length reduction, as previously described. Processing logic275outputs the tokenized encrypted data as masked data270. According to another embodiment, if there is not a match between input data265and one of the test data205stored in storage260, processing logic275passes input data265to preprocessing logic220to generate masked data270(e.g., encrypts input data265and performs length reduction). Preprocessing logic220may pass the tokenized encrypted data to processing logic275. Processing logic275outputs the tokenized encrypted data as masked data270.

As previously described, according to other examples, input data265may need to be parsed. By way of example, assume that each instance of test data205includes a string having a length of eight characters. Additionally, assume that each instance of input data265includes a string having a length of sixteen characters. In other words, the length of test data205is configured to match the length of a parsed input data265. According to an exemplary implementation, processing logic275may parse input data265in two strings, each having a length of eight characters. In this way, each parsed input data265has a length equal to each instance of test data205. The process described above may then continue, as previously described, in which processing logic275determines whether a parsed input data265matches one of the test data205stored in storage260. If there is a match, processing logic275uses alternate replacement data235as masked data270. If there is not a match, processing logic275generates masked data270. Since input data265is parsed, processing logic275performs a concatenation process so that masked data270is output as a string having a length of sixteen characters.

Additionally, as previously described, according to other examples, input data265may include special characters. By way of example, assume that test data205includes nine-digit length strings corresponding to all possible values of a social security number. Also assume, that when processing logic275receives input data265, input data265includes hyphens (e.g., 011-45-2345). That is, processing logic275does not receive a pure numerical string having a length of nine. According to an exemplar, embodiment, processing logic275identifies the special characters (e.g., hyphens) included in input data265and removes the special characters from input data265. Processing logic275stores position information pertaining to the removed special characters and stores the special characters. Processing logic275then uses input data265, which no longer includes the special characters, to determine whether input data265matches one of the test data205stored in storage260, etc. Processing logic275inserts the special characters back into masked data270.

FIG. 3is a diagram illustrating exemplary components of a device300that may correspond to one or more of the devices depicted in the previous figures. As illustrated, according to an exemplary embodiment, device300includes a processor305, memory/storage310, software315, a communication interface320, an input325, and an output330. According to other embodiments, device300may include fewer components, additional components, different components, and/or a different arrangement of components than those illustrated inFIG. 3and described herein.

Processor305may control the overall operation or a portion of operation(s) performed by device300. Processor305may perform one or multiple operations based on an operating system and/or various applications or programs (e.g., software315). Processor305may access instructions from memory/storage310, from other components of device300, and/or from a source external to device300(e.g., a network, another device, etc.).

Memory/storage310may include one or multiple memories and/or one or multiple other types of storage mediums. For example, memory/storage310may include one or multiple types of memories, such as, random access memory (RAM), dynamic random access memory (DRAM), cache, read only memory (ROM), a programmable read only memory (PROM), a static random access memory (SRAM), a single in-line memory module (SIMM), a phase-change memory (PCM), a dual in-line memory module (DIMM), a flash memory, and/or some other type of memory. Memory/storage310may include a hard disk (e.g., a magnetic disk, an optical disk, a magneto-optic disk, a solid state disk, etc.), a Micro-Electromechanical System (MEMS)-based storage medium, and/or a nanotechnology-based storage medium. Memory/storage310may include drives for reading from and writing to the storage medium.

Memory/storage310may be external to and/or removable from device300, such as, for example, a Universal Serial Bus (USB) memory stick, a dongle, a hard disk, mass storage, off-line storage, or some other type of storing medium (e.g., a compact disk (CD), a digital versatile disk (DVD), a Blu-Ray® disk (BD), etc.). Memory/storage310may store data, software, and/or instructions related to the operation of device300.

Software315may include an application or a program that provides a function and/or a process. Software315may include firmware. For example, software315may include a data masking algorithm, as described herein. Additionally, for example, software315may include an encryption algorithm.

Communication interface320may permit device300to communicate with other devices, networks, systems, etc. Communication interface320may include one or multiple wireless interfaces and/or wired interfaces. Communication interface320may include one or multiple transmitters, receivers, and/or transceivers. Communication interface320may operate according to one or multiple protocols, standards, and/or the like.

Input325may permit an input into device300. For example, input325may include a keyboard, a mouse, a display, a touchscreen, a touchless screen, a button, a switch, an input port, speech recognition logic, and/or some other type of visual, auditory, tactile, etc., input component. Output330may permit an output from device300. For example, output330may include a speaker, a display, a touchscreen, a touchless screen, a light, an output port, and/or some other type of visual, auditory, tactile, etc., output component.

Device300may perform processes and/or functions, as described herein, in response to processor305executing software315stored by memory/storage310. By way of example, instructions may be read into memory/storage310from another memory/storage310or from another device via communication interface320. The instructions stored by memory/storage310may cause processor305to perform one or more processes described herein. Alternatively, for example, according to other implementations, device300may perform one or more processes described herein based on the execution of hardware (processor305, etc.), the execution of firmware with hardware, or the execution of software and firmware with hardware.

FIG. 4is a flow diagram illustrating an exemplary process400pertaining to an exemplary embodiment of detecting collisions between test data. According to an exemplary embodiment, data masking device115performs process400. For example, processor305may execute software315to perform the steps described.

Process400is described in relation to test data that includes numerical data. According to other scenarios, process400may be applied to other types of input data (e.g., alphabetic data, alphanumeric data, etc.), as previously described. For clarity sake, test value is synonymous with test data, enhanced value is synonymous with encrypted data, and replacement value is synonymous with replacement data.

Referring toFIG. 4, block405, a test value is received. Preprocessing logic220of data masking device115receives a test value (TV). For example, assume that test data includes test values between 0 and 99999999.

In block410, an enhanced value is computed based on the test value and an encryption algorithm. For example, preprocessing logic220encrypts the test value according to an encryption algorithm (e.g., an AES-256 encryption algorithm, etc.) to generate an enhanced value (EV). According to an exemplary embodiment, depending on the encryption algorithm used, the enhanced value may not only be different in length from the test value (e.g., the encrypted data may have a length greater than the test value, after encryption), but the enhanced value may also be converted into a different format. For example, if a numerical string is encrypted using the AES-256 encryption algorithm, the enhanced value may be converted into a hexadecimal value. According to an exemplary implementation, preprocessing logic220converts the hexadecimal value to a numerical format (e.g., a format that matches the test value).

In block415, a replacement value using length reduction is computed. It is assumed that the length of the enhanced value is greater than the test value based on the encryption performed in block410. Length reduction logic of preprocessing logic220is applied to the enhanced value. According to an exemplary embodiment, the enhanced value is tokenized (or parsed) into the number of digits equivalent to the test value. As previously described, length reduction logic may select a consecutive series of digits of the enhanced value or non-consecutive digits of the enhanced value to tokenize. Preprocessing logic220compares the tokenized enhanced value to the test value. If the tokenized enhanced value is different from the test value, preprocessing logic220selects the tokenized enhanced value as the replacement value. If the tokenized encrypted value is equivalent to the test value, the tokenize-and-compare process continues until a tokenized enhanced value that is different from the test value is obtained.

In block420, it is determined whether the replacement value is a duplicate. For example, as previously described, preprocessing logic220compares the replacement value computed in block415to replacement value(s) stored in storage250(e.g., from previous iterations of process400) that has/have not resulted in a collision. For example, test value and replacement values that do not result in a collision are stored in a non-collision buffer, as described in block425.

If it is determined that the replacement value is not a duplicate (block420—NO), then the test value, replacement value pair is stored in a non-collision buffer (block425). For example, if preprocessing logic220determines that the replacement value is not already stored in the non-collision buffer (e.g., a buffer that stores non-collided test value, replacement value pairs), then preprocessing logic220stores the test value, replacement value pair in the non-collision buffer (e.g., storage250).

If it is determined that the replacement value is a duplicate (block420—YES), then the test value, replacement value pair is stored in a collision buffer (block430). For example, if preprocessing logic220determines that the replacement value is already stored in the non-collision buffer (e.g., storage250), then preprocessing logic220stores the test value, replacement value pair in the collision buffer (e.g., a buffer that stores collided test value, replacement value pairs), such as in storage255.

In block435, it is determined whether there is test value. For example, preprocessing logic220determines whether there is another test value to be preprocessed. If preprocessing logic220determines that there is another test value (block435—YES), then process400continues to block405. If preprocessing logic220determines that there is not another test value (block435—NO), then process400ends.

AlthoughFIG. 4illustrates an exemplary process400to detect collisions between replacement values correlated to test values, process400may include additional operations, fewer operations, and/or different operations than those illustrated inFIG. 4and described herein.

FIGS. 5A-5Care flow diagrams illustrating an exemplary process500pertaining to an exemplary embodiment of generating alternate replacement values for collided test value, replacement value pairs. According to an exemplary embodiment, data masking device115performs process500. For example, processor305may execute software315to perform the steps described.

Process500is performed in continuation to process400. Accordingly, process500is described in relation to a test value that includes numerical data. According to other scenarios, process500may be applied to other types of input data (e.g., alphabetic data, alphanumeric data, numerical data including special characters, etc.), as previously described.

Referring toFIG. 5A, in block505, a replacement value that is stored in the collision buffer is received. For example, preprocessing logic220obtains a replacement value of a test value, replacement value pair stored in the collision buffer (e.g., stored in storage255).

In block510, the length of the replacement value is computed. For example, preprocessing logic220computes the number of digits of the replacement value. Preprocessing logic220also identifies the data type. According to this example, preprocessing logic220computes the length of the replacement value to be eight and the data type to be numerical.

In block515, a highest value is selected based on the length of the replacement value. For example, preprocessing logic220selects an alternate replacement value having a highest value represented by the computed length and data type. For example, if the length of the replacement value is eight digits and the data type is numerical (e.g., in which each character has a value between 0-9) preprocessing logic220calculates that the highest value for a string of a length of eight digits is 99999999.

In block520, it is determined whether the highest value is already stored in the non-collision buffer. For example, preprocessing logic220compares the highest value to the replacement values stored in the non-collision buffer (e.g., storage250).

If it is determined that the highest value is already stored (block520—YES), then the highest value is decremented by one (block535). For example, if preprocessing logic220determines that the highest value is already stored in the non-collision buffer, preprocessing logic220decrements the highest value. For example, if the non-collision buffer already stores a replacement value equal to 99999999, preprocessing logic220decrements the highest value by one (e.g., 99999998). Process500continues toFIG. 5B, block540, as described further below.

If it is determined that the highest value is not already stored (block530—NO), then the highest value is assigned as an alternate replacement value (ARV) (block525). For example, if preprocessing logic220determines that the highest value is not already stored in the non-collision buffer, preprocessing logic220assigns the highest value as an alternate replacement value for the correlated parsed input value.

In block530, the test value, alternate replacement value pair is stored. For example, preprocessing logic220stores the test value, alternate replacement value pair in an alternate collision data structure or database (e.g., storage235). Process500continues toFIG. 5B, block560.

Referring toFIG. 5B, block540, it is determined whether the decremented value is already stored. Preprocessing logic220determines whether the decremented value is already stored in the non-collision buffer (e.g., storage255). For example, preprocessing logic220compares the decremented value (e.g., 99999998) to the replacement values stored in the non-collision buffer.

If it is determined that the decremented value is already stored (block540—YES), then the decremented value is decremented (block545). For example, if preprocessing logic220determines that the decremented value is already stored, preprocessing logic220decrements the decremented value. For example, preprocessing logic220decrements the value of 99999998 by one (e.g., 99999997) and process500continues to block540, in this loop, until preprocessing logic220determines that a decremented value is not already stored in the non-collision buffer.

If it is determined that the decremented value is not already stored (block545—NO), then the decremented value is assigned as the alternate replacement value (block550). For example, preprocessing logic220assigns the decremented value as the alternate replacement value for the correlated test value.

In block555, the test value, alternate replacement value pair is stored. For example, preprocessing logic220stores the test value, alternate replacement value pair in an alternate collision data structure or database (e.g., storage260).

In block560, it is determined whether another replacement value exists. For example, preprocessing logic220determines whether another replacement value exists in the collision buffer. If there is not another replacement value (block560—NO), then process500ends. For example, preprocessing logic220deletes the data in the non-collision buffer and the collision buffer.

If there is another replacement value (block560—YES), then the next replacement value is received (block565). For example, preprocessing logic220selects a replacement value of a test value, replacement value pair stored in the collision buffer (e.g., storage255).

Referring toFIG. 5C, block570, the alternate replacement value of block550is decremented (FIG. 5C, block570). For the example, preprocessing logic220decrements (e.g., by one) the decremented value assigned as an alternate replacement value in block570. Process500continues to block540ofFIG. 5B.

AlthoughFIGS. 5A-5Cillustrate an exemplary process500pertaining to generating alternate replacement values, process500may include additional operations, fewer operations, and/or different operations than those illustrated inFIGS. 5A-5Cand described herein. For example, according to other implementations, alternate replacement values may be identified based on different operations. For example, replacement values stored in the non-collision buffer may be sorted and unused values or a unique series of characters may be identified (e.g., based on the range or possible values of test values) and assigned as alternate replacement values for replacement values stored in the collision buffer.

FIG. 6is a flow diagram illustrating an exemplary process600pertaining to an exemplary embodiment of data masking based on the alternate replacement values. According to an exemplary embodiment, data masking device115performs process600. For example, processor305may execute software315to perform the steps described. Process600may be performed when a data masking value is requested.

Referring toFIG. 6, block605, input data is parsed. For example, processing logic275parses the input data into a particular length. According to this example, assume the input data is parsed into strings having a length of eight digits.

In block610, the parsed input value is compared to test values associated with the alternate replacement values. For example, processing logic275compares the parsed input value to the test values stored in the alternate collision data structure or database (e.g., storage260). Various search and detection methods may be implemented to improve speed and detection of whether a match exists. For example, the test values stored in the alternate collision data structure or database may be sorted to provide efficiency in detecting whether a match exists.

In block615, it is determined whether the parsed input value matches any of the test values of the stored test value, alternate replacement value pairs. For example, processing logic275determines whether the parsed input value matches any of the test value(s) stored in the alternate collision data structure or database based on the comparison in block610.

If it is determined that the parsed input value matches one of the test values of the stored test value, alternate replacement value pairs (block615—YES), then the alternate replacement value is selected as a data masked value for that parsed input value (block620). For example, processing logic275selects the alternate replacement value as the data masked value for that parsed input value. Process600continues to block630, as further described below.

If it is determined that the parsed input value does not match one of the test values of the stored test value, alternate replacement value pairs (block615—NO), then a data mask is generated for that parsed input value (block625). For example, processing logic275encrypts the parsed input value using an encryption algorithm (e.g., AES-256, etc.). The encrypted value is then reduced by length reduction logic, etc., as previously described.

In block630, it is determined whether there is another parsed input value. For example, if it is determined that there is another input data, then process600continues to block605. If it is determined that there is not another input value, then the masked data is concatenated. For example, processing logic275concatenates the corresponding masked data to so as to generate masked data having a length of the input data before parsing. Process600ends.

AlthoughFIG. 6illustrates an exemplary process600for data masking, process600may include additional operations, fewer operations, and/or different operations than those illustrated inFIG. 6and described herein. For example, special characters may be removed and inserted into masked data based on position information and special character information.

The foregoing description of embodiments provides illustration, but is not intended to be exhaustive or to limit the embodiments to the precise form disclosed. Accordingly, modifications to the embodiments described herein may be possible.

The terms “a,” “an,” and “the” are intended to be interpreted to include one or more items. Further, the phrase “based on” is intended to be interpreted as “based, at least in part, on,” unless explicitly stated otherwise. The term “and/or” is intended to be interpreted to include any and all combinations of one or more of the associated items.

In addition, while series of blocks have been described with regard to the processes illustrated inFIGS. 4,5A-5C, and6, the order of the blocks may be modified according to other embodiments. For example, depending on the original length of the input data, the step of parsing the data may be omitted. Further, non-dependent blocks may be performed in parallel. Additionally, other processes described in this description may be modified and/or non-dependent operations may be performed in parallel.

The embodiments described herein may be implemented in many different forms of software, firmware, and/or hardware. For example, a process or a function may be implemented as “logic” or as a “component.” This logic or this component may include hardware (e.g., processor305, etc.), a combination of hardware and software (e.g., software315), a combination of hardware and firmware, or a combination of hardware, firmware, and software. The embodiments have been described without reference to the specific software code since software can be designed to implement the embodiments based on the description herein.

No element, act, or instruction described in the present application should be construed as critical or essential to the embodiments described herein unless explicitly described as such.