Masking Complex Payloads Using Graphs

Abstract

An example system includes a processor that receives a graph-based masking policy and a compound payload that includes a data object to be masked. The processor instantiates a masking engine based on the graph-based masking policy. The processor executes the masking engine on the compound payload to generate a masked payload that includes the masked data object. The data object to be masked is masked in-place such that the resulting compound payload type is maintained. The processor outputs the masked payload.

Claims

1. 1. A system including a processor, the processor comprising: Receiving a graph-based masking policy and a compound payload including a data object to be masked; instantiating a masking engine based on the graph-based masking policy; executing the masking engine on the compound payload to generate a masked payload including a masked data object, wherein the masked data object is masked in-place such that the resulting compound payload type is maintained; and outputting the masked payload.

2. The system of claim 1 , wherein after masking the data object, validity of the compound payload type is maintained in the masked payload.

3. The system of claim 1 , wherein the composite payload comprises a plurality of different data types.

4. The system of claim 1 , wherein the composite payload comprises multiple nested payload types.

5. 2. The system of claim 1, wherein the masking engine includes a plurality of data processors coupled to a plurality of selectors, each of the data processors configured to process a particular type of data in a predetermined manner, and each of the selectors configured to cause an associated data processor to identify a relative location of a portion of the composite payload to be extracted at the associated data processor.

6. 10. The system of claim 1, wherein the identification of the masked data objects in the compound payload is based on a set of context-discriminating selectors, content-discriminating selectors, or a combination of both.

7. 2. The system of claim 1, wherein each node in the graph-based masking policy handles a different data layer of the compound payload and corresponds to a data processor in the masking engine.

8. 2. The system of claim 1, wherein a first data processor of the masking engine is connected to a second data processor that processes lower layers of the composite payload through a selector that provides the first data processor with a specified relative path of the payload portion to be extracted.

9. 2. The system of claim 1, wherein each edge in the graph-based masking policy corresponds to a selector of the masking engine that receives a payload portion of the composite payload from a previous node, sends a portion of the received payload portion to a subsequent node, receives a corresponding masked portion of the payload portion from the subsequent node in return, replaces the masked portion in place to create a masked payload portion and sends it back to the previous node.

10. 2. The system of claim 1, wherein the masking engine includes a masking processor coupled to a data processor, the masking processor configured to receive the data object from the data processor, mask the data object, and return the data object to the data processor for in-place masking in data segments processed by the data processor.

11. 2. The system of claim 1, wherein the executed masking engine is adapted to perform multiple masking actions on the data object.

12. 2. The system of claim 1, wherein the executed masking engine is adapted to perform masking actions on a plurality of data objects.

13. The system of claim 1 , wherein an order of processing, selection, and masking is determined based on the graph-based masking policy.

14. The system of claim 1 , wherein the process flow of the masking engine is controlled based on received external parameters.

15. The system of claim 1 , wherein the masking engine processing flow is controlled based on received payload-specific parameters.

16. The system of claim 1 , wherein the masking engine processing flow is controlled based on a combination of received payload-specific parameters and received external parameters.

17. 1. A computer-implemented method comprising: receiving, by a processor, a graph-based masking policy and a compound payload including a data object to be masked; instantiating, by a processor, a masking engine based on the graph-based masking policy; executing, by a processor, the masking engine on the compound payload to generate a masked payload including a masked data object, wherein the masked data object is masked in-place such that the resulting compound payload type is maintained; and outputting, by a processor, the masked payload.

18. A program for causing a processor to execute the computer-implemented method described in claim 17.

19. A storage medium for storing the program described in claim 18.

Images