DLP encryption functions

GoogleSQL for BigQuery supports the following DLP functions that allow interoperable encryption and decryption between BigQuery and Cloud Data Loss Prevention (Cloud DLP), using AES-SIV.

Function list

Name Summary
DLP_DETERMINISTIC_ENCRYPT Encrypts data with a DLP compatible algorithm.
DLP_DETERMINISTIC_DECRYPT Decrypts DLP-encrypted data.
DLP_KEY_CHAIN Gets a data encryption key that is wrapped by Cloud Key Management Service.

DLP_DETERMINISTIC_ENCRYPT

DLP_DETERMINISTIC_ENCRYPT(key, plaintext, context)
DLP_DETERMINISTIC_ENCRYPT(key, plaintext, context, surrogate)

Description

This function derives a data encryption key from key and context, and then encrypts plaintext. Optionally, you can use surrogate to prepend the encryption result.

Definitions

Return data type

STRING

Example

SELECT
  DLP_DETERMINISTIC_ENCRYPT(
    DLP_KEY_CHAIN(
      'gcp-kms://projects/my_project/locations/us-central1/keyRings/keyringtest/cryptoKeys/testkey',
      b'\123\044\290\876....'),
    plaintext,
    '',
    'test') AS results

/*--------------------------------------*
 | results                              |
 +--------------------------------------+
 | AXDEwUnZsTf/NzxoHaC8AZXcawWuma7L39A= |
 *--------------------------------------*/

DLP_DETERMINISTIC_DECRYPT

DLP_DETERMINISTIC_DECRYPT(key, ciphertext, context)
DLP_DETERMINISTIC_DECRYPT(key, ciphertext, context, surrogate)

Description

This function decrypts ciphertext using an encryption key derived from key and context. Optionally, you can use surrogate to prepend the decryption result.

Definitions

Return data type

STRING

Example

SELECT
  DLP_DETERMINISTIC_DECRYPT(
    DLP_KEY_CHAIN(
      'gcp-kms://projects/myproject/locations/us-central1/keyRings/keyringtest/cryptoKeys/testkey',
      b'\123\044\290\876....'),
    'your_surrogate(36)AdFnA6r5doSDWxPwW/W4vBaa4iOvDagC8z8=',
    '',
    'your_surrogate') AS results

/*-----------*
 | results   |
 +-----------+
 | plaintext |
 *-----------*/

DLP_KEY_CHAIN

DLP_KEY_CHAIN(kms_resource_name, wrapped_key)

Description

You can use this function instead of the key argument for DLP deterministic encryption functions. This function lets you use the AES-SIV encryption functions without including plaintext keys in a query.

Definitions

Return data type

STRUCT

Example

SELECT
  DLP_DETERMINISTIC_ENCRYPT(
    DLP_KEY_CHAIN(
      'gcp-kms://projects/my_project/locations/us-central1/keyRings/keyringtest/cryptoKeys/testkey',
      b'\123\044\290\876....'),
    plaintext,
    '',
    'test') AS results

/*--------------------------------------*
 | results                              |
 +--------------------------------------+
 | AXDEwUnZsTf/NzxoHaC8AZXcawWuma7L39A= |
 *--------------------------------------*/