Basic Data Protection Scenarios

The two most common data protection scenarios in enterprise computing are:

• Protecting information in a relational database
• Protecting information contained in files

Protecting information in a relational database

In this scenario we suggest using a kS to perform all cryptographic functionality, including key generation, key retrieval, key encryption, link encryption and data encryption.

Multiple kS may be used to assure fault tolerance (see Scaling and high availability). The Key Database will store encrypted keys and Key IDs, as well as user information and trusted component information. In addition, an application server will contain various client applications and an Agent, which will submit cryptographic transaction requests from the application server to a kS. Finally, a client-side database server will house a target database, which stores all unencrypted data, encrypted data and T-tags.

Protecting information contained in files

In this scenario we suggest using a kS to perform all cryptographic key management functions, including key generation, key retrieval, key encryption and link encryption. The Key Database will store encrypted keys, while encrypted files and T-tags will be stored on client machines. A Remote Engine can be installed on each client machine. The Remote Engine transmits cryptographic key requests from the client machine to the kS, and will use the keys to encrypt and decrypt data stored on the client machine. This approach off-loads data encryption and decryption from the kS and also reduces network traffic.