Data masking
Data masking is provided by, for at least one predetermined data item in data to be sent, applying a one-way function to that data item to produce a first value, producing a masked data item by encrypting the first value via a deterministic encryption scheme using a current encryption key for a current epoch, and replacing that data item by the masked data item. A data-provider computer sends the masked data to the data-user computer. On expiry of the current epoch, the data-provider computer generates a new encryption key for the encryption scheme in a new epoch, produces mask-update data, dependent on the current and new encryption keys, and sends the mask-update data to the data-user computer. The mask-update data permits updating, at the data-user computer, of masked data items produced with the current encryption key into masked data items produced with the new encryption key.
1. A computer-implemented method for managing masked data at a data-user computer, the method comprising:
receiving, using a processor system, masked data from a data-provider computer, the masked data containing at least one masked data item produced by applying a one-way function to a data item to produce a first value and encrypting the first value via a deterministic encryption scheme using a current encryption key for a current epoch;
storing, using a memory, the masked data;
on expiry of said current epoch, receiving from the data-provider computer mask-update data which is dependent on said current encryption key and a new encryption key for said encryption scheme in a new epoch; and
using the mask-update data to update each masked data item, produced with the current encryption key, in the stored masked data into a masked data item produced with the new encryption key,
wherein said mask-update data comprises a predetermined function δ of the current and new encryption keys, and said encryption scheme comprises an algorithm Enc(k, X) for encrypting a value X under an encryption key k such that Enc(δ, (Enc(s e , X))=Enc(s e+1 , X), where s e is the current encryption key and s e+1 is the new encryption key, the method including:
using the mask-update data to update each masked data item in the stored masked data by encrypting that masked data item via said algorithm Enc(k, X) using the encryption key k=δ, and
wherein said algorithm Enc(k, X)=X k and δ=s e+1 /s e .
2. The computer-implemented method as claimed in claim 1 including, on expiry of each of said new epoch and subsequent new epochs:
receiving from the data-provider computer mask-update data which is dependent on the encryption key for that epoch and a new encryption key for said encryption scheme in the next epoch; and
using that mask-update data to update each masked data item in the stored masked data into a masked data item produced with the new encryption key.
3. The computer-implemented method as claimed in claim 2 including, during each of at least some of said new epochs:
receiving from the data-provider computer further masked data containing at least one masked data item produced by applying said one-way function to a data item to produce a first value and encrypting the first value via said encryption scheme using the encryption key for that epoch; and
storing the further masked data.
4. The computer-implemented method as claimed in claim 1 wherein said encryption scheme comprises a symmetric encryption scheme and said mask-update data comprises the current encryption key and the new encryption key, the method including:
using the mask-update data to update each masked data item in the stored masked data by decrypting that masked data item, using the current encryption key, via a decryption algorithm of said encryption scheme to obtain said first value, and re-encrypting the first value via said encryption scheme using the new encryption key.