Skip to main content

Step 4: Advanced Encryption Patterns

These variants illustrate key-version, selective-decryption, and audit-metadata ideas. They are not executed by a current machine gate.

Pattern 1: Key Versioning & Rotation​

For security, encryption keys must be rotated periodically. Your encryption logic needs to record which key version was used so that you can still decrypt old data after a key rotation.

See the complete configuration for the maintained encryption mapping and its ciphertext fields.

When decrypting, read the recorded key version, retrieve that key through your access controls, and base64-decode the matching ciphertext and nonce fields before decryption.

Pattern 2: Selective Decryption for Authorized Services​

Authorize the calling service before selecting fields for decryption. A caller-supplied identity header alone does not establish authorization.

Use Case: A fraud detection service needs to see the email domain and SSN area, but a marketing service should see neither.

See the complete configuration for the maintained encryption mapping and its ciphertext fields.

Pattern 3: Transformation audit metadata​

This example records when and why a configured transformation was selected. A real audit design needs an independently protected event destination, access model, retention policy, and failure handling.

Partial snippet
HIPAA/GDPR Audit Logging
- mapping: |
    root = this
    # Create an audit log entry
    let audit_log = {
      "event_id": uuid_v4(),
      "action": "ENCRYPT",
      "timestamp": now(),
      "fields_encrypted": [
        "customer.ssn_encrypted",
        "customer.email_encrypted"
      ],
      "compliance_standards": ["HIPAA", "GDPR"],
      "justification": "Protecting patient/customer PII at rest.",
      "pipeline_id": "encrypt-pii-v2",
      "node_id": env("NODE_ID")
    }

    root.transformation_audit = $audit_log

These advanced patterns provide a path toward a more complete and manageable encryption strategy.