| name | selective-encrypted-storage-pattern |
| description | Security pattern for field-level encryption at rest. Use when encrypting specific sensitive data fields before storage, implementing application-level encryption for databases, or when only certain data elements need encryption at rest. Addresses "Leak data at rest" problem. |
Selective Encrypted Storage Security Pattern
Application explicitly encrypts specific sensitive data elements before persisting them to storage. Application controls which data is encrypted and manages encryption operations.
Problem Addressed
Leak data at rest: Sensitive data stored in databases, files, or other storage could be accessed by unauthorized parties (database breach, stolen backups, etc.).
Core Components
| Role | Type | Responsibility |
|---|
| Application | Entity | Decides what to encrypt, invokes encryption |
| Cryptographer | Cryptographic Primitive | Performs encryption/decryption |
| Storage | Storage | Persists data (encrypted and plaintext) |
Data Elements
- d: Plaintext sensitive data
- {d}_k: Ciphertext
- keyInfo: Key identification/material
- config: Cipher configuration
Pattern Flow
Storage
Application → [encrypt(d, keyInfo, config)] → Cryptographer
Cryptographer → [{d}_k] → Application
Application → [store({d}_k)] → Storage
Retrieval
Application → [retrieve] → Storage
Storage → [{d}_k] → Application
Application → [decrypt({d}_k, keyInfo, config)] → Cryptographer
Cryptographer → [d] → Application
