selective-encrypted-storage-pattern

name	selective-encrypted-storage-pattern
description	Security pattern for field-level encryption at rest. Use when encrypting specific sensitive data fields before storage, implementing application-level encryption for databases, or when only certain data elements need encryption at rest. Addresses "Leak data at rest" problem.

Selective Encrypted Storage Security Pattern

Application explicitly encrypts specific sensitive data elements before persisting them to storage. Application controls which data is encrypted and manages encryption operations.

Problem Addressed

Leak data at rest: Sensitive data stored in databases, files, or other storage could be accessed by unauthorized parties (database breach, stolen backups, etc.).

Core Components

Role	Type	Responsibility
Application	Entity	Decides what to encrypt, invokes encryption
Cryptographer	Cryptographic Primitive	Performs encryption/decryption
Storage	Storage	Persists data (encrypted and plaintext)

Data Elements

• d: Plaintext sensitive data
• {d}_k: Ciphertext
• keyInfo: Key identification/material
• config: Cipher configuration

Pattern Flow

Storage

Application → [encrypt(d, keyInfo, config)] → Cryptographer
Cryptographer → [{d}_k] → Application
Application → [store({d}_k)] → Storage

Retrieval

Application → [retrieve] → Storage
Storage → [{d}_k] → Application
Application → [decrypt({d}_k, keyInfo, config)] → Cryptographer
Cryptographer → [d] → Application