| name | transparent-encrypted-storage-pattern |
| description | Security pattern for full-disk or database-level encryption at rest. Use when implementing Transparent Data Encryption (TDE), full-disk encryption, or when storage infrastructure should handle encryption without application changes. Addresses "Leak data at rest" problem. |
Transparent Encrypted Storage Security Pattern
Storage infrastructure automatically encrypts all data before writing to disk and decrypts when reading. Application is unaware of encryption—it happens transparently at the storage layer.
Problem Addressed
Leak data at rest: All stored data could be exposed through physical theft, backup compromise, or unauthorized storage access.
Core Components
| Role | Type | Responsibility |
|---|
| Application | Entity | Reads/writes data normally |
| Storage Manager | Entity | Intercepts I/O, manages encryption |
| Cryptographer | Cryptographic Primitive | Performs encryption/decryption |
| Physical Storage | Storage | Stores encrypted data |
| Key Manager | Entity | Manages encryption keys |
Data Elements
- data: Plaintext data from application
- {data}_k: Encrypted data on disk
- key: Encryption key (managed by infrastructure)
Pattern Flow
Write Operation
Application → [write(data)] → Storage Manager
Storage Manager → [encrypt(data)] → Cryptographer
Cryptographer → [{data}_k] → Storage Manager
Storage Manager → [write({data}_k)] → Physical Storage
