Overview

Solution Overview

Athena Protector on AWS is a cloud native, serverless product for fine-grained data protection with Amazon Athena. It enables invocation of Protegrity data protection operations from Amazon Athena SQL.

The product provides data protection services invoked by External User Defined Functions (UDFs) within Amazon Athena. The UDFs act as a client transmitting micro-batches of data to a remote Protegrity Athena Protector. The protector runs inside a serverless AWS Lambda function. User queries from Amazon Athena may generate hundreds or thousands of parallel requests to perform security operations. Protegrity’s serverless solution is designed to scale and yield reliable query performance under such load.

The Amazon Athena Protector utilizes a data security policy from an Enterprise Security Administrator (ESA), similar to other Protegrity products.

Analytics on Protected Data

Protegrity’s format and length preserving tokenization scheme make it possible to perform analytics directly on protected data. Tokens are join-preserving so protected data can be joined across datasets. Often statistical analytics and machine learning training can be performed without the need to re-identify protected data. However, a user or service account with authorized security policy privileges may re-identify subsets of data using the Athena Protector on AWS service.

Features

Athena Protector on AWS incorporates Protegrity’s patent-pending vaultless tokenization capabilities into cloud-native serverless technology. Combined with an ESA security policy, the protector provides the following features:

• Role-based access control (RBAC) to protect and unprotect (re-identify) data depending on the user privileges.
• Policy enforcement features of other Protegrity application protectors.

For more information about the available protection options, such as, data types, Tokenization or Encryption types, or length preserving and non-preserving tokens, refer to Protection Methods Reference.