Matomo

Application level encryption solutions

🇺🇦 We stand with Ukraine, and we stand for Ukraine. We offer free assessment and mitigation services to improve Ukrainian companies security resilience.

Cossack Labs
search
Solution

Application level encryption solutions

Many security risks cannot be mitigated with encryption at-rest or TLS, and require encrypting the data inside the applications. Application level encryption (ALE) is relevant for software products that store or process sensitive data. ALE makes implementing regulatory compliance requirements easier, as sensitive data is processed as an encrypted blob until used.

Application level encryption can come in different forms, depending on the use case: client-side encryption, server-side encryption, end-to-end encryption (no secrets and keys are available for the intermediate servers), field level encryption (only certain fields are encrypted), and their combinations. The main concept is that data is encrypted inside the application, independent of data-in-motion and data-at-rest encryption.

Challenges that require
application level encryption

//

Zero trust infrastructures

Application level encryption protects data through all underlying layers, including databases, analytics engines, caches, logs, and transit. It significantly reduces potential attack vectors on sensitive data, as neither misconfigured databases nor expired TLS certificates lead to data leaks.

//

Insiders risks

Sensitive information stored in databases should be protected from internal developers, DBAs, BI teams, cloud provider employees and adversaries with elevated privileges. Using application level encryption of sensitive fields wins over anonymization, as the data stays in plaintext for a minimum amount of time.

//

Defence in depth

Application level encryption adds another layer of security if other data-related controls (access control, DLP, disk encryption, OS sandbox) fail somewhere. Some applications benefit from end-to-end encryption, while others from a combination of client-side and server-side encryption.

//

Developer satisfaction and compliance

Application level encryption allows protecting selected fields strictly enumerated in the application, like PII and PHI. It simplifies compliance and makes implementing regulatory requirements actually understandable to developers.

Modern application level encryption solutions

Data encryption proxy

Deploying encryption proxy between applications and datastores. The proxy will detect sensitive fields, encrypt/decrypt the data and have access to the keys. The proxy can be transparent for the apps, like Acra, or DAO-like service that provides encryption and decryption API.

See AcraModern application level encryption solutions

Client-side encryption SDK

Adding encryption to the client app as close to the data generation as possible allows creating point-to-point and end-to-end encryption flows. A client app should have access to encryption keys and should protect them with additional authentication (password, pin code, biometry, etc).

See AcraModern application level encryption solutions

Encryption-as-a-service

Encryption-as-a-service is best for stateless architectures, but requires certain code changes. Application performs API calls to the service and receives processed data – encrypted, decrypted, masked, tokenized, etc. Encryption service could be deployed in a separate, extra protected environment.

See AcraModern application level encryption solutions

Our offerings

// Relevant products

Acra

A DATABASE SECURITY SUITE
Acra offers a field level and searchable database encryption which is easy-to-integrate in already-built infrastructures. Acra works with SQL and NoSQL databases. Acra gives transparent field level encryption proxy and encryption-as-an-API service.
Read moreOur offerings

Themis

A CROSS PLATFORM CRYPTO LIBRARY
As a high-level cross-platform cryptographic library for mobile, web, and server platforms, Themis helps to integrate application level encryption fast and easy. It solves 90% of typical data protection use cases that are common for most apps.
Read moreOur offerings

// Custom design and implementation

Searchable encrypted fields

Searching over encrypted text is possible but limited, and it puts pressure on security (inference attacks), performance, storage, etc. While different searchable encryption schemes exist, only few of them are industrial-proven, like blind index based search in Acra and deterministic encryption search in MongoDB.
Read moreOur offerings

Custom application encryption schemes

Application level encryption often works in combination with other data security controls: data masking, tokenisation, anonymisation, and segmentation – we suggest the most suitable data security methods and their combinations to achieve best security / performance results.
Read moreOur offerings

Custom data security engines

Data security is not just encryption: masking, tokenisation, anonymisation, compartmentalisation and segmentation – we suggest the most suitable security engineering techniques aimed at protecting different types of data.
Read moreOur offerings

// Consulting

Security engineering

Encryption never comes alone. We will advise you on data migration, key management, designing application level encryption flow, implementing certain security features, assessing your product, verifying its security properties, and providing actionable advisory on improvements.
Read moreOur offerings

Security advisory

We offer security advisory to ensure your high level security goals are transformed into a clear roadmap. Our security managers and auditors assist with maintaining and formulating security procedures that bring pragmatic and compliance benefits.
Read moreOur offerings

SSDLC

We help teams set up and improve the SSDLC for application development. We assist in prioritising and implementing security features, suggest automated tools and follow the latest security guidelines and regulations.
Read moreOur offerings

Relevant customer story

Building a secure data vault for PII protection
Building a secure data vault for PII protection Mass consumer service

Telco & Adtech

Building a secure data vault for PII protection

Building a cryptographically secure vault for storing and processing PII that prevents developers from getting access to the plaintext data fields, shares anonymised data with BI teams, and provides sufficient performance for OLAP queries.

Read story

Application level encryption
in use #

Application level encryption becomes a security boundary for data, shifting from "protect the data where it's stored" to "protect the data whenever it exists". Sensitive data fields are encrypted before stored in the database, and decrypted on read. Let's look at the example of the user model with and without field level encryption.

  • {
  "created_at": "2022-07-01T13:37:31.415926+00:00",
  "id": "a6fd0d25-3a7f-43df-b6d1-405994fd203a",
  "wallet_id": "db0f0466-d481-465b-9b9c-167c17be6ed4",
  "name_first": "Emmanuel",
  "name_last": "Goldstein",
  "name_middle": "Lillard",
  "name_prefix": "Mr",
  "ssn": "9246725420",
  "passport_number": "KI133771RE",
  "country_code": "UK",
  "email": "c3r34l_k1ll3r@cossacklabs.com"
}

  • {
  "created_at": "2022-07-01T13:37:31.415926+00:00",
  "id": "a6fd0d25-3a7f-43df-b6d1-405994fd203a",
  "wallet_id": "db0f0466-d481-465b-9b9c-167c17be6ed4",
  "name_first": "<encrypted>",
  "name_last": "<encrypted>",
  "name_middle": "<encrypted>",
  "name_prefix": "<encrypted>",
  "ssn": "<encrypted>",
  "passport_number": "<encrypted>",
  "country_code": "UK",
  "email": "c3r34l_k1ll3r@cossacklabs.com"
}

Additional relevant materials

These conference slides explain more business and engineering details about application level encryption.

Have a question? Get a human to answer it!

How we make a difference

Reduce business risks with consulting

We advise and assist in building a security solution for your unique use case with application level encryption design and flow, key management schemes, integration in your existing infrastructure and security controls. See our security engineering and strategic advisory services.

Fast time to solution

During the last 8 years we have created and maintained developer-friendly security tools that are easy to integrate, easy to deploy, easy to configure and use. Ready-made tools allow to integrate the application level encryption quickly without spending years on development of home-brewed solutions.

Support of regulations and procedures

Every company has different technical, security and compliance needs. We design and implement security solutions with the suitable features adhering to the internal and external procedures and specific regulations.

Flexible key management

“Encryption is easy, key management is hard,” – key management flow affects the system’s security, usability and maintainability. We suggest key management schemes based on pragmatic risks and threats – some systems benefit from lightweight procedures, while others should follow NIST SP 800-57.

Frequently Asked Questions

What’s the difference between application level encryption and network encryption?

Application level encryption vs database encryption?

What regulations require application level encryption?

For innovators, by innovators

We've started Cossack Labs to develop new tools and methods for protecting the data and enabling novel solutions to emerging problems — so that at the edge of your innovation, you’ve already got fitting tools handy.

Contact us

There are many ways we can help: with our products, bespoke solutions, and engineering services. Leave your contact information to connect with our team:

Relevant blogposts

PII Encryption Requirements. Cheatsheet

PII Encryption Requirements. Cheatsheet

What data is sensitive and needs to be encrypted according to data privacy regulations like CCPA, GDPR, HIPAA, etc.? Our cheatsheet addresses this question

Cryptographic failures in RF encryption allow stealing robotic devices

Cryptographic failures in RF encryption allow stealing robotic devices

Stunned by losing their robotic devices, [REDACTED] learnt that they were hijacked by attackers even with communication being encrypted. Having researched its firmware and found numerous cryptographic failures, we've crafted a few demos on how cryptography goes wrong in real life.

Implementing End-to-End encryption in Bear App

Implementing End-to-End encryption in Bear App

Helping Bear app implement note encryption for their vast existing user base. Balancing usability, security, and mobile platforms' restrictions.

Contact us

Get whitepaper

Apply for the position

Our team will review your resume and provide feedback
within 5 business days

Thank you!
We’ve received your request and will respond soon.
Your resume has been sent!
Our team will review your resume and provide feedback
within 5 business days