Best practices for using encryption at rest

The idea behind encryption at rest is to protect data once it has been saved into storage or a database or has been accessed by an untrusted third party.

Object storage encryption

When you're encrypting object storage, each file (or object) is encrypted separately.

Encryption/decryption process

The following workflow explains the process of extracting an encrypted object from object storage:

• The DEK is stored near the object itself, and the object metadata specifies which encryption key version to use.
• The entire DEK is wrapped with a KEK.
• The KEK is stored inside a key-managed service.
• When a request for accessing an object is made, the authorized service (or application) sends a request to the key managed service to locate the KEK and to decrypt the specific DEK.
• The decrypted DEK is sent via a TLS/SSL channel from the KMS to the object storage. The object itself is decrypted using the decrypted...