Sensitive Data Protection Fpe Bucketing Kms

What Format-Preserving Encryption and Bucketing Are

Format-Preserving Encryption (FPE) in FFX mode (CryptoReplaceFfxFpeConfig) and Bucketed Generalization (FixedSizeBucketingConfig) are primitive de-identification transformations provided by Cloud Sensitive Data Protection (Cloud DLP API). FPE performs two-way pseudonymization by encrypting values while strictly preserving the original character length and alphabet, whereas fixed-size bucketing generalizes continuous numerical values into bounded intervals.

How It Meets the Requirements

• Identifier Tokenization (Format and Length Preservation): Setting cryptoReplaceFfxFpeConfig with a common_alphabet set to NUMERIC guarantees that the 10-digit account ID is transformed into a 10-digit numeric token, preventing validation failures in downstream legacy systems.
• Two-Way Reversibility & Referential Integrity: FPE is deterministic and reversible. Identical inputs yield identical tokens across batch or streaming pipelines, allowing SQL joins in BigQuery while enabling authorized pipelines to de-tokenize the values using the decryption key.
• Quasi-Identifier Generalization: The fixedSizeBucketingConfig with a bucket size of 10 replaces specific integer ages with 10-year ranges (e.g., 20:30, 30:40), minimizing re-identification risk while maintaining statistical utility.
• Key Security via Cloud KMS: Specifying kmsWrapped under cryptoKey embeds an AES encryption key that is wrapped (encrypted) by a Cloud KMS key encryption key (KEK), ensuring plaintext secrets are never stored in templates or logs.

Key Advantages and Capabilities

• Strict Schema Compliance: Prevents application crashes in downstream consumers that enforce strict regex or length validations.
• Referential Integrity: Guarantees consistent surrogate tokens across disparate datasets for analytics.
• Centralized Security Governance: Enables IAM-governed de-identification and re-identification workflows without exposing raw cryptographic keys.
• Flexible Risk Mitigation: Combines cryptographic pseudonymization with $k$-anonymity generalization in a single execution step.

Why This Is Optimal

This configuration fulfills all legacy format constraints, security mandates, and analytical generalization goals without requiring custom code or secondary token mapping databases.