MongoDB Field-Level Encryption
Starting with v4.2, MongoDB provides a field level encryption ("FLE") framework, both server-side and client-side. Applications can encrypt fields in documents prior to transmitting data over the wire to the server. Only applications with access to the correct encryption keys can decrypt and read the protected data. Deleting an encryption key renders all data encrypted using that key as permanently unreadable.
Starting with v5.4.9 of Hackolade Studio, we support MongoDB FLE functionality, which is also known as In-Use Encryption.
Note: using Client-Side FLE alongside in-flight and at-rest encryption gives an end-to-end, complementary approach in building applications that provide a defense-in-depth security posture to address different threat models.
- In-flight encryption protects all data traversing the network, but does not encrypt data in-memory or at-rest.
- At-rest encryption protects all stored data, but does not encrypt data in-memory or in-flight.
- With client-side encryption, the most sensitive data never leaves applications in plain text. Fields that are encrypted client-side remain encrypted over the network, as they are being processed in database server memory, and at-rest in storage, backups, and logs.
As explained in this MongoDB page, consider the following document:
{
"name" : "John Doe",
"address" : {
"street" : "1234 Main Street",
"city" : "MongoDBVille",
"zip" : 99999
},
"phone" : "949-555-1212",
"ssn" : "123-45-6789"
}
With field-level encryption, sensitive information like the ssn and phone can be encrypted. Encrypted fields are stored as binary data with subtype 6
{
"name" : "John Doe",
"address" : {
"street" : "1234 Main Street",
"city" : "MongoDBVille",