使用 Skyflow 和 AWS 上增強的檔案安全性安全地管理 PII

Organizations face challenges in protecting PII and ensuring compliance. Skyflow Data Privacy Vault isolates and secures sensitive data, transforming it into tokens for downstream storage, reducing compliance scope. Cloud Storage Security complements this by automatically scanning uploaded files for viruses and malware, mitigating potential threats. This partnership simplifies file management, ensures data security, and eases compliance burdens.

Securely Managing Personally Identifiable Information (PII) with Skyflow and Cloud Storage Security on AWS

使用 AWS 上的 Skyflow 和雲端儲存安全性安全性管理個人識別資訊 (PII)

Introduction

介紹

Organizations entrusted with the management of personally identifiable information (PII) face significant challenges in maintaining the security and compliance of this sensitive data. Despite best efforts, PII often resides in a fragmented fashion across diverse repositories, including databases, data warehouses, log files, and backups, making comprehensive security and compliance measures difficult to implement.

負責管理個人識別資訊 (PII) 的組織在維護這些敏感資料的安全性和合規性方面面臨重大挑戰。儘管盡了最大努力，PII 通常以分散的方式駐留在不同的儲存庫中，包括資料庫、資料倉儲、日誌檔案和備份，使得全面的安全性和合規性措施難以實施。

Furthermore, file management introduces additional complexities, necessitating stringent security measures, robust access controls, and compliance-aligned storage practices. The risk of data breaches and malware threats escalates when organizations receive files from external sources, such as customers. To mitigate these risks, organizations must meticulously scan external files for viruses and malware prior to processing.

此外，文件管理帶來了額外的複雜性，需要嚴格的安全措施、強大的存取控制和合規性儲存實踐。當組織從外部來源（例如客戶）接收文件時，資料外洩和惡意軟體威脅的風險就會升級。為了減輕這些風險，組織必須在處理之前仔細掃描外部文件是否有病毒和惡意軟體。

Addressing Challenges with Skyflow and Cloud Storage Security

利用 Skyflow 和雲端儲存安全應對挑戰

To minimize risk and alleviate the burdens associated with existing upstream and downstream systems, organizations leverage Skyflow, available within AWS Marketplace. Skyflow Data Privacy Vault delivers comprehensive security, compliance, and data residency for Amazon Web Services (AWS) workloads.

為了最大限度地降低風險並減輕與現有上游和下游系統相關的負擔，組織利用 AWS Marketplace 中提供的 Skyflow。 Skyflow Data Privacy Vault 為 Amazon Web Services (AWS) 工作負載提供全面的安全性、合規性和資料駐留。

In conjunction with Skyflow, Cloud Storage Security (CSS) plays a crucial role in further safeguarding infrastructure and alleviating the complexities associated with sensitive file management. CSS, an AWS Specialization Partner with the Security Competency, automates the scanning of uploaded files for malicious code and malware.

與 Skyflow 結合，雲端儲存安全 (CSS) 在進一步保護基礎架構和減輕與敏感文件管理相關的複雜性方面發揮著至關重要的作用。 CSS 是具有安全能力的 AWS 專業化合作夥伴，可自動掃描上傳的檔案中是否有惡意程式碼和惡意軟體。

Securing PII with Skyflow Data Privacy Vault

使用 Skyflow Data Privacy Vault 保護 PII

Skyflow, a software-as-a-service (SaaS) offering, supports both multi-tenant and single-tenant deployment models. Its Data Privacy Vault isolates, protects, and governs access to sensitive customer data, transforming it into opaque tokens that serve as references to the original data. These non-sensitive tokens can be securely stored in any application storage system or utilized in data warehouses.

Skyflow 是一種軟體即服務 (SaaS) 產品，支援多租戶和單一租戶部署模型。其資料隱私保險庫隔離、保護和管理對敏感客戶資料的訪問​​，將其轉換為不透明的令牌，用作原始資料的引用。這些非敏感令牌可以安全地儲存在任何應用程式儲存系統中或在資料倉儲中使用。

A Skyflow vault enables the confinement of sensitive data within a specific geographic location and tightly controls access to this data. Other systems interact only with the non-sensitive tokenized data, effectively removing them from the scope of compliance. The tokenization process preserves formatting when necessary and maintains consistency for analytics and machine learning (ML) workflows.

Skyflow 保管庫可將敏感資料限制在特定地理位置內，並嚴格控制對此資料的存取。其他系統僅與非敏感標記化資料交互，從而有效地將它們從合規範圍中刪除。標記化過程會在必要時保留格式，並保持分析和機器學習 (ML) 工作流程的一致性。

Skyflow Data Privacy Vault serves as the core infrastructure for PII, providing compute, storage, and network resources as a service. Its architectural simplicity is achieved through an API call, and Skyflow employs polymorphic encryption to secure PII and preserve its usability. This enables the execution of operations on fully encrypted data.

Skyflow Data Privacy Vault 充當 PII 的核心基礎設施，以服務形式提供運算、儲存和網路資源。其架構簡單性是透過 API 呼叫實現的，Skyflow 採用多態加密來保護 PII 並保持其可用性。這使得能夠對完全加密的資料執行操作。

Organizations can seamlessly build PII-specific workloads on a Skyflow vault for tasks such as data sharing, analytics, and encrypted operations. This capability empowers businesses to identify records with specific attributes, such as area code, without decrypting the data or calculate customer income averages, all without exposing PII to unauthorized parties.

組織可以在 Skyflow 保管庫上無縫建立特定於 PII 的工作負載，以執行資料共享、分析和加密操作等任務。此功能使企業能夠識別具有特定屬性（例如區號）的記錄，而無需解密資料或計算客戶平均收入，並且不會將 PII 暴露給未經授權的各方。

Working with a Skyflow Vault

使用 Skyflow Vault

While a data privacy vault differs from a traditional database, Skyflow Data Privacy Vault emulates certain database properties. Notably, a Skyflow vault supports a customizable schema consisting of tables, columns, and rows.

雖然資料隱私保管庫與傳統資料庫不同，但 Skyflow Data Privacy Vault 模擬某些資料庫屬性。值得注意的是，SkyflowVault 支援由表、列和行組成的可自訂架構。

Skyflow's vault is specifically designed to manage the entire lifecycle of sensitive data, comprehensively understanding the structure and applications of PII. For instance, a Skyflow vault recognizes a social security number as a distinct data type, not merely a string. This deep understanding allows the vault to natively support use cases such as revealing only the last four digits of a social security number based on defined roles and policies or securely sharing the complete social security number with third-party vendors for identity verification purposes.

Skyflow 的保管庫專門用於管理敏感資料的整個生命週期，全面了解 PII 的結構和應用。例如，Skyflow 金庫將社會安全號碼識別為獨特的資料類型，而不僅僅是字串。這種深入的理解使保險庫能夠原生支援用例，例如根據定義的角色和策略僅顯示社會安全號碼的最後四位數字，或與第三方供應商安全地共享完整的社會安全號碼以進行身份驗證。

Beyond transforming sensitive data into non-sensitive forms, the vault strictly controls access to sensitive data through a zero-trust model. This model ensures that no user account or process can access data without explicit authorization via access control policies. These policies are meticulously constructed from the ground up, granting access to specific columns and rows of PII. This granular control enables organizations to meticulously define who can access what data, when, where, for how long, and in what format.

除了將敏感資料轉換為非敏感形式外，保險庫還透過零信任模型嚴格控制對敏感資料的存取。此模型確保沒有透過存取控制策略明確授權的情況下，任何使用者帳戶或進程都無法存取資料。這些策略是從頭開始精心建構的，允許存取 PII 的特定列和行。這種精細的控制使組織能夠細緻地定義誰可以存取哪些資料、何時、何地、多長時間以及以何種格式。

For data storage, management, and retrieval, Skyflow offers both APIs and software development kits (SDKs). Skyflow supports both frontend and backend SDKs, providing flexibility based on integration requirements.

對於資料儲存、管理和檢索，Skyflow 提供 API 和軟體開發套件 (SDK)。 Skyflow 支援前端和後端 SDK，根據整合要求提供靈活性。

Managing Secure File Storage with Skyflow and CSS

使用 Skyflow 和 CSS 管理安全文件存儲

To demonstrate the secure storage and handling of files through Skyflow, we will examine how this solution effectively removes exposure to sensitive documents for both frontend and backend applications.

為了演示透過 Skyflow 安全儲存和處理文件，我們將研究該解決方案如何有效地消除前端和後端應用程式對敏感文件的暴露。

In addition to Skyflow Vault, the solution leverages Amazon API Gateway as the backend API entry point for passing non-sensitive data downstream, AWS Lambda to receive and securely store non-sensitive data in Amazon DynamoDB, AWS Secrets Manager for secure storage and management of the Skyflow vault service account key, Amazon DynamoDB to save the skyflow_id shared by the vault after secure file storage, and Cloud Storage Security to automatically ensure that files are free from viruses and other potential threats.

除了Skyflow Vault 之外，該解決方案還利用Amazon API Gateway 作為後端API 入口點來向下游傳遞非敏感資料、AWS Lambda 來接收非敏感資料並將其安全地儲存在Amazon DynamoDB 中、AWS Secrets Manager 來安全儲存和管理非敏感資料。

The accompanying architecture diagram illustrates the file upload flow involving Skyflow, the aforementioned AWS services, and CSS.

隨附的架構圖說明了涉及 Skyflow、上述 AWS 服務和 CSS 的檔案上傳流程。

Access Control Mechanisms

存取控制機制

To govern access to the customer's vault, Skyflow employs policies that permit programmatic writes into the vault table for client records.

為了管理對客戶保管庫的訪問，Skyflow 採用允許以程式設計方式寫入客戶記錄保管庫表的策略。

To ensure read and update access is restricted to the single record owned by the currently logged-in user, Skyflow customers can leverage authentication services like Auth0. The customer application can then identify the user based on the Auth0 token.

為了確保讀取和更新存取權限僅限於目前登入使用者擁有的單一記錄，Skyflow 客戶可以利用 Auth0 等身份驗證服務。然後，客戶應用程式可以根據 Auth0 令牌識別用戶。

Skyflow's vault respects the user's identity and restricts access accordingly. To fulfill this requirement, customers utilize Skyflow's context-aware authorization.

Skyflow 的保管庫尊重使用者的身分並相應地限制存取。為了滿足此要求，客戶利用 Skyflow 的上下文感知授權。

Context-Aware Authorization

上下文感知授權

Programmatic access to Skyflow APIs is controlled through a service account established within the Skyflow account. The roles assigned to the service account and the policies associated with those roles determine the level of access to a vault. The creation of Skyflow roles, policies, and service accounts can be managed programmatically via Skyflow's management APIs or through Skyflow Studio, Skyflow's web-based vault administration portal.

對 Skyflow API 的程式存取透過 Skyflow 帳戶內建立的服務帳戶進行控制。指派給服務帳戶的角色以及與這些角色關聯的策略決定對保管庫的存取等級。 Skyflow 角色、策略和服務帳戶的建立可以透過 Skyflow 的管理 API 或透過 Skyflow Studio（Skyflow 基於 Web 的保管庫管理入口網站）以程式設計方式進行管理。

Context-aware authorization empowers the backend to insert an additional claim for end-user context into the JWT token during insertion. This claim can be any string that uniquely identifies the end user, such as the token provided by Auth0 upon successful client login.

上下文感知授權使後端能夠在插入期間將最終使用者上下文的附加聲明插入到 JWT 令牌中。此聲明可以是唯一標識最終使用者的任何字串，例如客戶端成功登入時 Auth0 提供的令牌。

After the additional claim is incorporated, the vault verifies the request and returns a bearer token containing the context identifier. The context-aware authorization flow diagram illustrates authentication with contextual information for the Skyflow customer and data retrieval.

合併附加聲明後，保管庫驗證該請求並傳回包含上下文識別碼的承載令牌。上下文感知授權流程圖說明了使用 Skyflow 客戶的上下文資訊進行身份驗證和資料檢索。

Leveraging the returned bearer token with the context restriction, the frontend customer application can retrieve the PII and files owned by only the currently logged-in user.

利用傳回的不記名令牌和上下文限制，前端客戶應用程式可以檢索僅目前登入使用者擁有的 PII 和檔案。

Furthermore, the time-to-live (TTL) of the bearer token can be controlled to ensure its validity only for the duration required to retrieve the record for the client.

此外，可以控制不記名令牌的生存時間 (TTL)，以確保其僅在為客戶端檢索記錄所需的持續時間內有效。

Securing PII and Files from the Application Frontend

保護應用程式前端的 PII 和文件

When collecting and managing sensitive data, such as files containing PII, it is prudent to exclude the entire application infrastructure from the security and compliance scope, including the frontend.

在收集和管理敏感資料（例如包含 PII 的文件）時，明智的做法是將整個應用程式基礎架構（包括前端）排除在安全性和合規性範圍之外。

Skyflow Elements offers a secure platform for collecting and revealing sensitive data, including files. It provides numerous advantages, including complete programmatic isolation from frontend applications, end-to-end encryption, tokenization, and customizable data collection forms.

Skyflow Elements 提供了一個用於收集和洩漏敏感資料（包括檔案）的安全平台。它提供了許多優勢，包括與前端應用程式的完全程式隔離、端對端加密、標記化和可自訂的資料收集表單。

When users interact with Skyflow Elements, various components orchestrate to collect and reveal sensitive data. The process unfolds as follows:

當使用者與 Skyflow Elements 互動時，各種元件會協調收集和洩漏敏感資料。過程展開如下：

1. When a user enters sensitive data into collect elements, the client-side SDK transmits the data to the vault and receives tokens representing the data.
2. When the data needs to be revealed to a user, the client-side SDK sends the tokens to the vault, receives the data, and displays the data in reveal elements.

Following file upload, Skyflow automatically scans the file for viruses through the integrated CSS within the vault. The status of a scan can be retrieved using the Get Status Scan API.

當使用者將敏感資料輸入到收集元素時，客戶端 SDK 會將資料傳輸到保管庫並接收代表該資料的令牌。接收數據，並在reve元素中顯示數據。可以使用取得狀態掃描 API 檢索掃描的狀態。

If the file is virus-free, a SCAN_CLEAN status is returned, and the file becomes available for retrieval or in-page display. In the event of a virus detection, a SCAN_INFECTED status is returned, and the file is moved into quarantine.

如果檔案沒有病毒，則會傳回 SCAN_CLEAN 狀態，且該檔案可供檢索或頁內顯示。如果偵測到病毒，則會傳回 SCAN_INFECTED 狀態，並將檔案移至隔離區。

To reveal an uploaded file, it is embedded into the web frontend as an iframe, ensuring that the file never resides on the customer's servers.

為了顯示上傳的文件，它將作為 iframe 嵌入到 Web 前端，確保該文件永遠不會駐留在客戶的伺服器上。

Skyflow empowers organizations to delegate the security, privacy, and compliance responsibilities associated with sensitive file and PII handling, allowing them to focus on their core business objectives.

Skyflow 使組織能夠委派與敏感文件和 PII 處理相關的安全、隱私和合規責任，使他們能夠專注於核心業務目標。

Conclusion

結論

In this comprehensive overview, we have explored the challenges organizations face in managing sensitive customer data. We have examined how to secure personally identifiable information (PII) using Skyflow Data Privacy Vault and further enhance protection against malware using Cloud Storage Security (CSS) on AWS.

In this comprehensive overview, we have explored the challenges organizations face in managing sensitive customer data. We have examined how to secure personally identifiable information (PII) using Skyflow Data Privacy Vault and further enhance protection against malware using Cloud Storage Security (CSS) on AWS.

We have also demonstrated how Skyflow Data Privacy Vault can securely collect, manage, and utilize sensitive data. Skyflow seamlessly integrates with CSS to provide automatic virus and malware detection and protection for files.

我們也示範了 Skyflow Data Privacy Vault 如何安全地收集、管理和利用敏感資料。 Skyflow 與 CSS 無縫集成，為檔案提供自動病毒和惡意軟體偵測和保護。

Organizations寻求更多信息，请联系 Skyflow 或在 AWS Marketplace 中试用 Skyflow。关于 Cloud Storage Security 的更多信息，请访问 AWS Marketplace 中的 CSS。

Organizations尋求更多信息，請聯繫 Skyflow 或在 AWS Marketplace 中試用 Skyflow。關於 Cloud Storage Security 的更多信息，請訪問 AWS Marketplace 中的 CSS。