Best practice for encryption?

[hpvd]

Just a question: when thinking about having some nodes whose data needs encryption -> is there a proven practice on how to do that best?
Is there a possibility on database level, or needs this be done purely on application level?

Background:
there are some security standards where encryption on disk-level or partition-level encryption isn't sufficient anymore (e.g. PCI DSS 4.0, future-dated requirements)

PS: couldn't find anything about this topic in doc via google
site:https://terminusdb.com/docs/ encryption

[GavinMendelGleason]

Good question. We've had on our road-map for quite a while to have signed commits, but this requires content addressable hashing to make work properly.

For encryption we generally just use encryption at rest on disk. One could also theoretically have commits which were stored with layers encrypted so that they could be pushed and pulled around but only queried when access to a key was presented by the one doing the query.

None of this really exists as yet unfortunately and everything basically has to be done in either application code or FS at the minute.

[hpvd]

many thanks for your fast and detailed answer!
I stumbled across this topic because an immutable database with history looks to me like the perfect place to store really high value data - and high value data may often need to be protected not only for being deleted by accident, but also

• for being disclosed (also by accident) or
• for being stolen and being used or disclosed (from out- or even insiders)

-> so to make protection complete, you imho absolutely need the combination of terminusdb + encryption :-)
(not only because some certification demand this...)

[hpvd]

in the meantime I've looked around and this approach seems to look promising (and matches the approach you described)
a Client-Side Field Level Encryption, like described in this video from mongodb https://www.youtube.com/watch?v=gNkydtIfcKs

[hpvd]

Another different approach, when using the db in the cloud would be, to rely on the full encryption of a kubernetes cluster running on specialized hardware (AMD SEV-SNP or Intel TDX) which keeps the kubernetes instance -and with it the data inside it- always encrypted by design

• in rest,
• in move and also
• during processing

-> "confidential computing" e.g. via https://www.edgeless.systems/

[hpvd]

just notice I didn't mention the typical very wide spread use case for having the need for this combination of requirements

• encrypted,
• immutable data
• in graph structure
• being accessible for insights

=> All personal data needing, full or partly regulated companies, who need to care for KYC (Know your customers) and AML (Anti Money laundry) processes:

• financial industry (conventional bank, fintechs..)
• service provider for KYC and AML, but also
• marketplaces etc or even
• all companies who deal with paying process data in house and with this need to meet PCI DSS certification and
• of course, there are also other use cases for this combination of data requirements,
  -> generally spoken, every company caring seriously for their data