Encryption at rest
The idea behind encryption at rest is to protect data once it has been saved into storage or a database or has been accessed by an untrusted third party. Encryption at rest has layers. For example, you may encrypt the database files at rest to protect them from being copied out or accessed from the storage directly. However, there are encryption methods also for authenticated users. For example, passwords are not saved on a database in a plaintext format. Even if the database is encrypted, the passwords are kept encrypted.
Encryption/decryption process
The following workflow explains the process of extracting an encrypted object from object storage:
- The DEK is stored near the object itself and the object metadata specifies which encryption key version to use.
- The entire DEK is wrapped with a KEK, as explained later in this chapter.
- The KEK is stored inside a key-managed service.
- When a request to access an object is made, the authorized...
