{"id":13851,"date":"2020-07-01T15:16:56","date_gmt":"2020-07-01T19:16:56","guid":{"rendered":"http:\/\/www.iri.com\/blog\/?p=13851"},"modified":"2026-02-23T18:03:18","modified_gmt":"2026-02-23T23:03:18","slug":"darkshield-introduction","status":"publish","type":"post","link":"https:\/\/www.iri.com\/blog\/data-protection\/darkshield-introduction\/","title":{"rendered":"Introduction to IRI DarkShield"},"content":{"rendered":"
What is DarkShield?<\/span><\/span><\/b><\/h5>\n

IRI DarkShield<\/span><\/span><\/span><\/i><\/a> is a data masking tool for classifying, searching, and de-identifying Personally Identifiable Information (PII) and other sensitive data in structured, semi-structured and unstructured sources. <\/span>You can define and run DarkShield jobs via a GUI, CLI or API.\u00a0<\/span><\/span><\/span><\/p>\n

DarkShield supports data on-premise or in the cloud. <\/span>Sources include <\/span><\/span><\/span>free-floating text<\/span><\/span><\/span><\/a> , <\/span><\/span><\/span>files and documents<\/span><\/span><\/span><\/a> , <\/span><\/span><\/span>various NoSQL DBs<\/span><\/span><\/span><\/a> , and any <\/span><\/span><\/span>relational database<\/span><\/span><\/span><\/a> connected through a JDBC driver.\u00a0<\/span><\/span><\/span><\/p>\n

One of several data masking tools in the <\/span><\/span><\/span>IRI Voracity<\/span><\/span><\/span><\/a> platform and <\/span><\/span><\/span>IRI Data Protector Suite<\/span><\/span><\/span><\/a> , DarkShield supports most data formats and silos.<\/span>1<\/sup><\/a><\/span><\/span><\/span><\/span><\/p>\n

The data classes and masking functions you define for DarkShield jobs are the same ones used in IRI FieldShield and IRI CellShield EE. <\/span>This allows you to secure data consistently across disparate silos and formats.<\/span><\/span><\/span><\/p>\n

How Does It Work?<\/span><\/span><\/b><\/b><\/h5>\n

Most DarkShield jobs can be configured, run, and shared through the IRI Workbench GUI, built on Eclipse. <\/span>See this section for more information on the front end:<\/span><\/span><\/span><\/p>\n

https:\/\/www.iri.com\/products\/workbench\/darkshield-gui<\/span><\/span><\/span><\/a><\/p>\n

Under the hood, DarkShield runs one or more Remote Procedure Call (RPC) API engines \u2013 depending on your data source(s) \u2013 that perform the searching and masking work. <\/span>These engines run through a server in your infrastructure (called Plankton Server) which accepts HTTP(S) requests containing your PII searching and masking instructions.<\/span><\/span><\/span><\/p>\n

You host the DarkShield API server either on-premise or in a cloud server you manage. IRI does not maintain or manage these services, and at no time would PII leave your environment.<\/span><\/p>\n

The methods DarkShield uses to search for PII are provided in instructional JSON payloads to the applicable DarkShield API as<\/span> Search Contexts<\/span><\/i>. These are instructions for masking PII found during a search or contained in instructions called <\/span>Mask Contexts<\/span><\/i>.\u00a0<\/span><\/p>\n

Inside IRI Workbench, Search Contexts are derived from <\/span>Data Classes<\/span><\/a> that contain <\/span>Data Matchers<\/span><\/a> and <\/span>Location Matchers<\/span><\/a>. Mask Contexts, in turn, are created from Masking Rules that are paired to Data Classes. Again, the consistent application of deterministic <\/span>data masking function<\/span><\/a> rules will preserve data or referential integrity across all your target silos.<\/span><\/p>\n

Provided alongside the search and mask contexts are some additional contexts that provide instructions on where to read data from (FileSearchContext, NoSqlSearchContext, RdbSearchContext) and where to write masked data to (FileMaskContext, NoSqlMaskContext, RdbMaskContext).<\/span><\/p>\n

By pairing search methods with masking functions you get more granular control for masking. For example, you can configure a DarkShield job to redact any credit card numbers that are found, but use a (consistent) pseudonym replacement for names wherever those are found.<\/span><\/p>\n

\"\"<\/p>\n

Getting Started<\/b><\/h5>\n

You can license DarkShield as a standalone product, or in a bundle with IRI FieldShield or IRI CellShield EE in the <\/span>IRI Voracity<\/span><\/i><\/a> data management platform. Licensing and pricing options are on <\/span>this<\/span><\/a> page. <\/span>
\n<\/span>
\n<\/span>IRI will send you download and installation instructions under your evaluation or licensing agreement. At installation time, you will need to register a provided version of the IRI CoSort engine, <\/span>sortcl<\/span><\/i>, to enable masking jobs. \"\"<\/span><\/p>\n

The DarkShield API is run on a web server called Plankton, listening for requests. These HTTP(S) payloads can contain either instructions on how to find PII and mask it in the form of Search Contexts and Mask Contexts, or instructions on where to access and read data from and where to write the masked result.<\/span><\/p>\n

DarkShield can be installed either as the backend engine (API) only, or with an installation of the IRI Workbench (GUI). To run any jobs, you must first start your DarkShield server <\/span>2<\/sup><\/a><\/span> <\/span>via the:<\/span><\/p>\n

    \n
  1. shell or batch startup script in the DarkShield API distribution <\/span>bin <\/span><\/i>directory;<\/span><\/li>\n
  2. Workbench <\/span>Window > Preferences > IRI > DarkShield<\/span><\/i> properties dialog; <\/span>or<\/b>,\u00a0\u00a0<\/span><\/li>\n
  3. DarkShield API Status view in your workspace.\u00a0\u00a0<\/span><\/li>\n<\/ol>\n

    \n<\/span>Connecting to Different Sources<\/b><\/h5>\n

    Whether calling them directly or using them from Workbench, DarkShield uses different API plugins to access and manipulate different source types, including (streaming) text (strings), standalone or embedded files\/documents\/images, NoSQL databases, and relational databases.\u00a0<\/span><\/p>\n

    For file sources, DarkShield supports several different formats, including:<\/span><\/p>\n