KMIP is an open OASIS standard protocol for managing and securely exchanging cryptographic keys, certificates, and related data between key-management servers and applications. section 20.5.4
KMIP supports an application-security architecture by:
- Connecting applications to KMIP-compliant key managers alongside AWS KMS, Azure Key Vault, GCP KMS, or HashiCorp Vault. section 20.5.4
- Enabling interoperable exchange of keys, certificates, and other cryptographic objects across diverse systems and devices. section 20.5.4
- Supporting client-side encryption designs in which applications obtain keys without exposing plaintext to the database. section 20.5.4
KMIP in client-side field-level encryption
An authenticated client submits a query containing a sensitive field such as a Social Security number. The driver requests encryption keys from a customer-provisioned key provider, encrypts the query before transmission, and decrypts encrypted results for the client. The database never receives the plaintext. section 20.5.4
Figure 20.3 An authenticated client (1) submits a query containing sensitive information, such as a Social Security number (SSN). The MongoDB driver (2) analyzes the query and identifies that it targets an encrypted field, prompting a request for encryption keys from a customer-provisioned key provider. Using these keys (3), the driver encrypts the query and sends it to MongoDB Server (4), where it is processed without decryption, ensuring that sensitive data remains secure and hidden. The server returns encrypted results (5) to the driver, which decrypts them and provides the plain-text data to the client (6), maintaining end-to-end security throughout the process. (Image © MongoDB 2024 CC BY-NC-SA 3.0)
Follow the end-to-end flow from authenticated client query through key retrieval, encryption, database processing, and result decryption. section 20.5.4
