Protegrity & Couchbase
overview
Couchbase stores customer, account, transaction, and application data as flexible JSON documents that may be accessed through SDKs, key-value operations, and SQL++ queries. Applying protection independently across every application can create inconsistent logic and make access policies harder to manage.
Protegrity routes approved Couchbase traffic through the Data Security Gateway. DSG evaluates centrally managed rules and applies tokenization, masking, encryption, or controlled unprotection to selected fields as documents move between applications and the Couchbase cluster.
Key Integration Feature
The Data Security Gateway creates a consistent policy enforcement point in front of Couchbase. Applications connect to the gateway endpoint, which validates the caller, inspects applicable document fields, and applies the required protection before forwarding the request or returning the response.
Restricted and privileged users can access the same Couchbase documents while receiving different representations of sensitive fields. Production deployments can also restrict direct database access so approved application traffic passes through DSG rather than bypassing the protection path.
Features & Capabilities
Apply centralized tokenization, masking, and policy-based access to selected Couchbase document fields as applications read and write data.
01
Field-Level Protection for JSON Documents
Why It Matters
Sensitive data such as PII, PHI, and financial information remains protected across all Denodo-connected sources, while policies are managed from a single control point.
How It Works
DSG inspects document traffic and applies tokenization, masking, or encryption only to fields identified in the applicable ruleset. Other fields remain available for normal application and analytical processing.
02
Protection Across Couchbase Access Methods
Why It Matters
Applications may interact with Couchbase through SDKs, key-value operations, or SQL++ queries. Protection should remain consistent across approved access methods rather than depend on logic implemented separately in each client.
How It Works
Applications point their Couchbase connection configuration to the DSG endpoint. The gateway intercepts supported traffic, applies the configured field-level rules, and forwards the request to the Couchbase cluster.
03
Role-Based Protect and Unprotect
Why It Matters
A shared Couchbase bucket may serve applications, analysts, customer-service teams, and privileged users with different access requirements. Separate copies of the same dataset can add complexity and create governance gaps.
How It Works
DSG evaluates the authenticated caller against Protegrity policy. A privileged user may receive an approved clear-text value, while a restricted user making the same request receives a tokenized or masked version of the field.
04
Centralized Ruleset Management
Why It Matters
Embedding protection logic across every service that connects to Couchbase can lead to inconsistent policies and repeated maintenance. Security teams need one place to manage how sensitive fields are handled.
How It Works
Protection rules are defined through Protegrity Enterprise Security Administrator and distributed to the DSG nodes. Each gateway node uses the approved ruleset when processing Couchbase requests.
05
Extensible Gateway Processing
Why It Matters
Some Couchbase environments may require additional document inspection, transformation, or routing logic beyond standard protect and unprotect operations.
How It Works
Configured gateway processing functions can be invoked as JSON documents pass between applications and Couchbase. These functions extend the DSG processing flow while protection and access rules remain governed through the gateway configuration.
Architecture &
Sample Data Flow
The Data Security Gateway is deployed between Couchbase clients and the database cluster. Approved SDK, key-value, and SQL++ traffic is directed to the DSG endpoint, where the gateway validates the caller and evaluates the ruleset associated with the request.
For write operations, DSG can protect selected fields before forwarding the document to Couchbase. For read operations, it can return clear text, masked values, or tokens according to the caller’s policy. Network controls should restrict direct cluster access so production application traffic follows the protected gateway path.
The data journey
Visualizing the data journey
The data journey
The data journey explained
-
01
Route Couchbase traffic through DSG
Applications and services connect to the Data Security Gateway endpoint instead of connecting directly to the Couchbase cluster. DSG receives supported SDK, key-value, and SQL++ requests.
-
02
Validate identity and evaluate policy
The gateway validates the caller using the configured authentication method and determines which rules apply to the requested document fields.
-
03
Protect selected fields before storage
For write operations, DSG tokenizes, masks, or encrypts the fields identified by policy before forwarding the document to Couchbase.
-
04
Control sensitive values returned after access
For read operations, DSG evaluates the caller’s privileges and returns the permitted representation of each protected field before sending the response to the application or user.
DEPLOYMENT
The Protegrity Data Security Gateway is deployed independently as a cluster between Couchbase clients and the database environment. Applications route approved Couchbase traffic through DSG, where centrally managed rules determine how selected document fields are protected or returned.
Deploy the DSG Cluster
Connect Centralized Policy Management
Route Couchbase Connections Through DSG
Restrict Direct Cluster Access
Configure Caller Authentication and Access
Validate Distributed Couchbase Environments
RESOURCES
Guidance for implementing and managing gateway-based data protection for Couchbase environments.
Protegrity Data Security Gateway Documentation
Review technical guidance for deploying DSG, configuring gateway rulesets, managing authentication, and applying field-level protection to supported application traffic.
READ MOREProtegrity Policy and Administration Documentation
Learn how to configure data elements, access policies, protection methods, and centrally distributed rules through Protegrity administration tools.
READ MORE