Tutorial: How to de-identify and tokenize sensitive data
Cloud DLP supports both reversible and non-reversible cryptographic methods. In order to re-identify content, you need to choose a reversible method. The cryptographic method described here is called deterministic encryption using Advanced Encryption Standard in Synthetic Initialization Vector mode (AES-SIV). We recommend this among all the reversible cryptographic methods that Cloud DLP supports because it provides the highest level of security.
In this tutorial, we’re going to see how to generate a key to de-identify sensitive text into a cryptographic token. In order to restore (re-identify) that text, you need the cryptographic key that you used during de-identification and the token.
Before you begin, make sure you have the following roles in your Google Cloud project:
- Service account admin, to be able to create service accounts
- Service usage admin, to be able to enable services
- Security admin...
