Queryable Encryption

As explained in MongoDB 8.0 in Action, Third Edition

Queryable Encryption is a MongoDB encryption feature that permits supported queries over encrypted fields while keeping their plaintext values hidden from the database service.

Queryable Encryption lets a MongoDB application search sensitive encrypted fields without revealing their plaintext to the database service. An equality match on a Social Security number is one example. The application encrypts data before it reaches Atlas and decrypts returned data on the client. section 20.5.4 section 20.8

An encrypted query follows this path:

• An authenticated client submits a query targeting an encrypted field. The MongoDB driver identifies the field and obtains keys from a customer-provisioned key provider. section 20.5.4
• The driver encrypts the query; MongoDB processes it without decrypting it and returns encrypted results. section 20.5.4
• The driver decrypts the results for the client. Keep decryption keys accessible to the application, not Atlas. section 20.5.4

Figure 20.3 An authenticated client (1) submits a query containing sensitive information, such as a Social Security number (SSN). The MongoDB driver (2) analyzes the query and identifies that it targets an encrypted field, prompting a request for encryption keys from a customer-provisioned key provider. Using these keys (3), the driver encrypts the query and sends it to MongoDB Server (4), where it is processed without decryption, ensuring that sensitive data remains secure and hidden. The server returns encrypted results (5) to the driver, which decrypts them and provides the plain-text data to the client (6), maintaining end-to-end security throughout the process. (Image © MongoDB 2024 CC BY-NC-SA 3.0)

The diagram traces the query from the authenticated client through driver-side encryption, server-side processing, and client-side decryption. section 20.5.4

Use Queryable Encryption when fields must remain hidden from Atlas but still need to be searched. It complements other defenses rather than replacing them: use authentication and role-based access control to restrict access, and auditing to monitor operations. Client-side field-level encryption also protects sensitive fields before storage; Queryable Encryption addresses the additional need to query encrypted fields. section 20.7 section 20.8

How MongoDB 8.0 in Action, Third Edition covers it

How deep it goes

Traces driver encryption, server processing, and client decryption, but does not provide configuration commands or code.

Examples

Uses a Social Security number query and equality matches; also identifies credit card information as sensitive data to protect.

What you can do after

Evaluate/understand when searchable encrypted fields fit an Atlas security plan and how an encrypted query passes through the driver and server.

How it connects

Connects client-side field-level encryption, key management services, authentication, role-based access control, and auditing.

liveBookmanning.com

Read MongoDB 8.0 in Action, Third Edition on liveBook Get the book at manning.com

Related concepts

• client-side field-level encryptioncontrasts with · Client-side field-level encryption (CSFLE) is a MongoDB technique that encrypts selected document fields in the client application before they are sent to the database.
• exact-match accuracyuses · Exact-match accuracy evaluates outputs by whether they exactly equal their references under specified comparison rules.
• Atlas In-Use Encryptionpart of · Atlas In-Use Encryption is a MongoDB security feature that keeps sensitive data encrypted on the client while it is processed and stored by the database.
• encryptionkind of · Encryption is the cryptographic transformation of readable data into ciphertext to conceal its contents, reversible through decryption with appropriate information.

This explainer was generated by Manning's knowledge graph from the text of MongoDB 8.0 in Action, Third Edition. The section links point to the parts of the book it draws on.