Algorithms

Algorithms define how sensitive data is detected, transformed, or tokenized. Each algorithm includes metadata such as its framework, plugin, and whether it supports tokenization. Tokenization support determines whether the algorithm can be used as a default tokenization algorithm when creating or editing a data class. They provide the logic that ensures values remain format-consistent, realistic, and secure after de-identification. In DCT, algorithms are centrally managed and can be reused across custom Data Classes, Rule Sets, and Compliance Jobs.

DCT includes a rich library of built-in algorithms for common data types and also allows you to create custom algorithms by configuring extensible algorithm frameworks.

Algorithm types

DCT supports three categories:

Out of the box algorithms

These are ready-to-use algorithm instances provided out-of-the-box. They cover a wide range of masking scenarios. Out of the box algorithms cannot be modified or deleted.

For a complete list of available Out of the box algorithms, see Out-of-the-Box algorithms.

Custom algorithms

You can create custom algorithms using configurable frameworks. These algorithms allow teams to tailor masking behavior to data formats, business rules, and internal compliance guidelines. Custom algorithms are fully managed within DCT and can be edited or deleted as long as they are not referenced by custom Data Classes or Rule Sets.

When creating a custom algorithm, selecting the appropriate framework is essential. The framework determines how values are transformed, preserved, or substituted.

Algorithm frameworks

Frameworks define the behavior and configuration pattern for an algorithm. When you create a new algorithm, you select a framework and provide the configuration values applicable to that framework. Each framework provides specific capabilities. For example, preserving formatting, shifting dates, masking multi-column dependencies, or generating synthetic values. Refer to the Algorithm Frameworks section for full details on each framework and how it applies to different data types.

Algorithm keys

Many algorithms use an internal key to generate deterministic masked values. The key ensures that:

  • the same input always produces the same masked output

  • values remain consistent across tables, environments, and repeated jobs

If a key is rotated, the output values will change.

Multi-Column algorithms

Multi-column algorithms are a special kind of algorithm that allows a single algorithm assignment to be made spanning multiple columns or fields. This allows coordinated masking of multiple fields. For example, masking two date-time values while preserving the interval between them.

Each multi-column algorithm defines a set of logical fields; these logical fields are assigned to the actual fields or columns, defining how each value will be treated by the algorithm. A particular logical field may be read-only, indicating that it is considered as input but not masked by the multi-column algorithm, and/or optional, meaning the logical field is not required in order for the masking assignment to be complete. Furthermore, the Algorithm Group number allows a multi-column algorithm to be assigned multiple times in the same table or file-format, with the group number indicating which set(s) of logical fields should be processed together as a single assignment.

Incomplete multi-column masking assignments may not be detected until such time as a masking job is executed. It is important to review each multi-column assignment carefully to ensure that for each Algorithm Group, each non-optional Logical Field is assigned to a column or field in the table or file-format.

Limitations

Multi-column algorithms may only be applied for data connectors where entire rows or records are processed as a unit.

Specific limitations:

  • Multi-column algorithm assignments must not cross redefines in VSAM copybooks.

  • Multi-column algorithms may not be called by other algorithms through the algorithm chaining feature.