Encrypting user data in sessions
In conversations with bots, users are often in a position of giving out personal information. Keeping track of what personal data may be captured by the bot is therefore part of the normal development of bots. The Pre-logging script event can be used to anonymize personal data in a way where the functionality of the bot is not compromised. With the Pre-logging script we can:
- Remove data before it leaves Teneo Engine
- Redact, remove, or encrypt sensitive data
The following approach documents how you can use the Pre-logging event to encrypt all user data for use cases where your bot handles sensitive data. We are using asymmetric (or public/private key) encryption, as this enables the bot to encrypt using the public key and allows you - as the developer - to keep the private key safe for decryption. This means that the user data stored is never visible in Teneo.
The Teneo SaaS offering already has built-in best practice encryption for data in rest and transit.
- All traffic to and from Teneo is encrypted via standard techniques like TLS over HTTPS.
- Data Stores are encrypted using AES256.
- Static config is encrypted with other techniques.
- Find a full list of security features in Annex 2 of Data Processing Addendum.
Bring Your Own Key is an encryption key management system that allows enterprises to encrypt their data and retain control and management of their encryption keys. The data, in this case, are located in sessions inside your solution.
Below is a list of some example use case on where it is fitting to use the 'Bring your own key' approach:
- A company that is concerned about legal jurisdictions and data leaving their own economic zones when user data enters the cloud
- A company with extreme data residency concerns
- Companies that are used to using SaaS or cloud services but expect to be able to do their own encryption of the data
Below you will wind the setup structure for this method:
This setup follows the current best practice by using RSA, OAEP with SHA-256 and MGF-1 padding. This is a standard approach and can be used from modern environments. We've supplied a groovy script for convenience that can be found below.
As the first step, we need to generate both a private and a public key that will be used to decrypt the logs. This will be done with the help of OpenSSL.
- Use OpenSSL and generate your private key with the following line:
openssl genpkey -out privatekey.pem -algorithm RSA -pkeyopt rsa_keygen_bits:2048
- Make sure you store the generated file somewhere safe.
- Now it is time to generate a public key by using the following command:
openssl rsa -in privatekey.pem -outform PEM -pubout -out publickey.pem
We will now proceed with uploading the
publickey.pem to your solution as a file resource with the path
- Return to the Teneo solution you were in and click on 'Solution' in the upper left corner.
- Select 'Resources' on the left.
- Select 'File' at the top.
- Use 'Add' on the upper right to add the publickey.pem file. (Alternatively, you can drag and drop it.)
- Set the 'Published Location' for this file from / to
/script_lib. This ensures the file can be accessed using a Groovy script later.
- Hit 'Save'.
Lastly, repeat the same steps and download the StringEncryptor class from StringEncryptor, and upload it into Teneo Studio as a file resource, with the path
Finally, we will add a Pre-logging script to access the files created above and redact the logs.
- Select the 'Scripts' tab at the top.
- While inside the 'Scripts' tab, create a new script, selecting 'Pre-logging' from the dropdown. Give the script a name like
- Add the following code into the editing window:
1def encryptor = new StringEncryptor() 2 3_.getDialogHistoryUtilities().replaceLogVariables(encryptor.variableReplacer()) 4_.getDialogHistoryUtilities().replaceMetadata(encryptor.variableReplacer()) 5_.getDialogHistoryUtilities().replaceResponseVariables(encryptor.variableReplacer()) 6 7_.getDialogHistoryUtilities().replaceRequestParameters(encryptor.parameterReplacer()) 8_.getDialogHistoryUtilities().replaceResponseVariables(encryptor.parameterReplacer()) 9 10_.getDialogHistoryUtilities().replaceUserInputText(encryptor.valueReplacer()) 11_.getDialogHistoryUtilities().replaceResponseText(encryptor.valueReplacer()) 12_.getDialogHistoryUtilities().replaceResponseURL(encryptor.valueReplacer()) 13 14_.getDialogHistoryUtilities().replaceVariables(encryptor.objectVariableReplacer()) 15
- Hit 'Save'.
Make sure there are no errors in your solution before continuing to the next step. This can be done by chatting with the bot in Tryout and verifying that you don’t have any compilations errors:
- Return back to the main solution view. If the Tryout panel is not visible, make it appear by clicking the 'Tryout' button on the right side of the window.
- Make sure to click on 'Reload Tryout' if shown.
- Try to write a couple inputs like,
How are you?
- If you see a warning box appear, please go back and redo the steps above.
Once you have verified that there are no errors, proceed with publishing your bot:
- Click the ‘Solution’ button in the upper left corner.
- Select the 'Publish' button. This will take you to the publish page for your bot.
- Click the 'Manage' button and, in the drop-down, choose 'Publish' under 'Latest'.
- You might see the warning Publish to 'Default env' stopped with warnings appear.
This is nothing to worry about; the warning is shown when you publish your solution for the first time or when you have made certain global changes. To proceed, just check the checkbox 'Perform full application deployment on try again' and click the 'Try again' button.
- Once published, click on the blue 'Open' icon. This will open the published solution in a new browser tab.
It is important to acknowledge that conversations from here will be logged in your Log Data Source that can be accessed from your solution.
- Go ahead and try some small talk, like:
How are you?
My name is John
What is my name?
I like you
- Close the chat window to end the session.
You can find the logged sessions inside your solution by checking out the session using the Session Viewer tab in Studio.
- Return back to the solution.
- Navigate to Optimization and select the tab 'Log Data'.
- Open the 'LDS' window (select the option Open under Manage Source).
- Click the button 'New Session Viewer Tab'.
- Under Order By select the options End Date and Descending.
- Click the Run Query button.
- Open the topmost session in the query results to view the details of the session.
All user data should now be encrypted, looking something like this:
As mentioned earlier in the text, using this method will not allow you to read the logs from Teneo itself. Instead you need to extract them and decrypt it from your computer. Lets proceed with retrieving the sessions from Inquire.
- Go ahead and download the following zip file: teneo-retrieve-inquire-sessions.zip.
- Unzip the package and setup an .env file using the .env_sample.
- Open up your command line and navigate to the relevant folder.
yarn install, or
bun installto download the dependencies.
- Finally, run
node index.jsto retrieve the sessions. The code will create one .json file per session retrieved.
As the final step, we need to decrypt the session logs. This can be done by using the decrypt.groovy file on the created .json files.
- Download the decrypt.groovy file and place it under the same folder your keys are in.
- Run the following script to decrypt the sessions.
groovy decrypt.groovy [path with sessions] [output directory].
Congratulations, you have now decrypted your session logs!