{"id":13851,"date":"2020-07-01T15:16:56","date_gmt":"2020-07-01T19:16:56","guid":{"rendered":"http:\/\/www.iri.com\/blog\/?p=13851"},"modified":"2026-10-05T17:20:40","modified_gmt":"2026-10-05T21:20:40","slug":"darkshield-introduction","status":"publish","type":"post","link":"https:\/\/www.iri.com\/blog\/data-protection\/darkshield-introduction\/","title":{"rendered":"Introduction to IRI DarkShield"},"content":{"rendered":"

What is DarkShield?<\/span><\/span><\/b><\/h2>\n

IRI DarkShield<\/span><\/span><\/span><\/i><\/a> is a data masking tool for classifying, searching, and de-identifying Personally Identifiable Information (PII) and other sensitive data in structured, semi-structured, and unstructured sources. You can define and run <\/span><\/span><\/span>DarkShield jobs through a GUI, CLI, or API.<\/p>\n

DarkShield supports data on-premises or in the cloud. <\/span>Supported sources include <\/span><\/span><\/span>free-floating text<\/span><\/span><\/span><\/a>, <\/span><\/span><\/span>files<\/span><\/span><\/span><\/a>, and <\/span><\/span><\/span>documents<\/span><\/span><\/span><\/a>, <\/span><\/span><\/span>various NoSQL DBs<\/span><\/span><\/span><\/a> , and any <\/span><\/span><\/span>relational database<\/span><\/span><\/span><\/a> connected through a JDBC driver.\u00a0<\/span><\/span><\/span><\/p>\n

As one of several data masking tools in the <\/span><\/span><\/span>IRI Voracity<\/span><\/span><\/span><\/a> platform and <\/span><\/span><\/span>IRI Data Protector Suite<\/span><\/span><\/span><\/a> , DarkShield supports a wide range of data formats <\/span><\/span><\/span>and silos.<\/span>1<\/sup><\/a><\/span><\/p>\n

In addition, the data classes and masking functions defined for DarkShield jobs are also used in IRI FieldShield and IRI CellShield EE. This helps secure sensitive data consistently across different data silos and formats.<\/p>\n

How Does It Work?<\/span><\/span><\/b><\/b><\/h2>\n

You can configure, run, and share most DarkShield jobs through the Eclipse-based IRI Workbench GUI. For more information about the DarkShield front end, see:<\/p>\n

https:\/\/www.iri.com\/products\/workbench\/darkshield-gui<\/span><\/span><\/span><\/a><\/p>\n

Under the hood, DarkShield runs one or more Remote Procedure Call (RPC) API engines, depending on the data source or sources involved. These engines perform the searching and masking operations through a server in your infrastructure called the Plankton Server<\/strong>. The server accepts HTTP(S) requests containing instructions for finding and masking PII.<\/p>\n

In practice, you host the DarkShield API server either on-premises or on a cloud server that you manage. IRI does not maintain or manage these services, and PII does not leave your environment.<\/p>\n

DarkShield sends its PII search methods to the applicable API in instructional JSON payloads called Search Contexts<\/em>. In contrast, Mask Contexts<\/em> provide instructions for masking the PII identified during a search.<\/p>\n

Within IRI Workbench, Data Classes<\/span><\/a> containing Data Matchers<\/span><\/a> and Location Matchers<\/span><\/a> define the Search Contexts.\u00a0In turn, Masking Rules paired with Data Classes create the Mask Contexts. The consistent application of deterministic <\/span>data masking functions<\/span><\/a> helps preserve data and referential integrity across all target silos.<\/span><\/p>\n

Additionally, provided alongside the Search and Mask Contexts are additional contexts that provide instructions on where to read data from (FileSearchContext, NoSqlSearchContext, RdbSearchContext) and where to write masked data to (FileMaskContext, NoSqlMaskContext, RdbMaskContext).<\/p>\n

Pairing search methods with masking functions provides more granular control over how sensitive data is protected. For example, you can configure a DarkShield job to redact detected credit card numbers while applying a consistent pseudonym replacement to names wherever they are found.<\/p>\n

\"IRI<\/h2>\n

Getting Started<\/b><\/h2>\n

You can license DarkShield as a standalone product, or as part of a bundle with IRI FieldShield or IRI CellShield EE in the <\/span>IRI Voracity<\/span><\/i><\/a> data management platform. Licensing and pricing options are on <\/span>this<\/span><\/a> page. <\/span>
\n<\/span><\/p>\n

After licensing or evaluation begins, IRI will send you download and installation instructions.\u00a0At installation time, you will need to register a provided version of the IRI CoSort engine, <\/span>sortcl<\/span><\/i>, to enable masking jobs. \"DarkShield<\/span><\/p>\n

At runtime, the DarkShield API runs on a web server called Plankton<\/strong>, which listens for requests. These HTTP(S) payloads can contain instructions for finding and masking PII in the form of Search Contexts and Mask Contexts. Additionally, they can also contain instructions specifying where to access and read data from and where to write the masked results.<\/p>\n

You can install DarkShield either as the backend engine (API) only or together with IRI Workbench (GUI). Before running any jobs, you must first start the DarkShield server. <\/span>2<\/sup><\/a><\/span> <\/span><\/p>\n

You can start the DarkShield server through the:<\/p>\n

    \n
  1. Shell or batch startup script in the DarkShield API distribution bin<\/em> directory;<\/li>\n
  2. Workbench Window > Preferences > IRI > DarkShield<\/em> properties dialog; or<\/strong><\/li>\n
  3. DarkShield API Status view in your workspace<\/li>\n<\/ol>\n

    Connecting to Different Sources<\/b><\/h2>\n

    Whether called directly or used through IRI Workbench, DarkShield uses different API plugins to access and manipulate different source types. These include streaming text (strings), standalone or embedded files, documents and images, NoSQL databases, and relational databases.<\/p>\n

    For file sources, DarkShield supports several formats, including:<\/p>\n