Skip to main content

Step 1: Encrypt Credit Card Data

This step selects the synthetic card number for encryption while retaining authored display fields such as the last four digits and brand. Review those retained values independently before adapting the pattern.

The Goal​

You will transform the payment object by:

  1. Encrypting the card_number into a new card_number_encrypted field.
  2. Extracting the card_last_four and card_brand for analytics.
  3. Deleting the original, plaintext card_number.

Input Snippet:

{
  "payment": {
    "card_number": "4532-1234-5678-9010",
    "expiration": "12/27"
  }
}

Desired Output Snippet:

{
  "payment": {
    "expiration": "12/27",
    "card_number_encrypted": "AES256GCM:v1:...",
    "card_last_four": "9010",
    "card_brand": "visa"
  }
}

Implementation​

  1. Start with the Foundation: Copy encryption-foundation.yaml to a new file, encrypt-card.yaml.

    cp examples/data-security/encryption-foundation.yaml encrypt-card.yaml

  2. Inspect the maintained mapping: Review the selected fields, key lookup, and plaintext removal in the linked reference before adapting the processor.

    See the complete configuration for the maintained encryption mapping and its ciphertext fields.

    Note: Use the key variable names from the configuration you are adapting.

  3. Deploy and Test:

    # Send the sample payment data from the setup step
    curl -X POST http://localhost:8080/events/payment \
      -H "Content-Type: application/json" \
      -d @/tmp/encryption-test/sample-payment.json

  4. Verify: Check your logs. You will see that the card_number field is gone, replaced by card_number_encrypted, card_last_four, and card_brand.

The reference now shows the payment-field selection pattern. It has not been executed or assessed against a deployed threat model.