Encryption at rest and in transit in HLD - System Design Guide

Problem Statement

Data stored on disks or traveling over networks can be intercepted or accessed by unauthorized parties. Without protection, sensitive information like user credentials, payment details, or personal data can be stolen or tampered with, leading to data breaches and loss of trust.

Solution

Encryption transforms readable data into an unreadable format using keys, making it accessible only to authorized users. Encryption at rest protects data stored on disks or databases by encrypting it before saving. Encryption in transit secures data as it moves between clients, servers, or services by encrypting communication channels.

Architecture

Client App

(Data in use)

→Network TLS

↓

Encrypted Disk

Encrypted Disk

This diagram shows data encrypted during network transfer using TLS and encrypted when stored on disk, protecting data both in transit and at rest.

Trade-offs

✓ Pros

→

Protects sensitive data from unauthorized access during storage and transmission.

→

Meets compliance requirements for data security and privacy regulations.

→

Reduces risk of data breaches and associated financial and reputational damage.

→

Encryption keys can be rotated to enhance security without downtime.

✗ Cons

→

Adds computational overhead, potentially increasing latency and resource usage.

→

Key management complexity can lead to security risks if mishandled.

→

Requires careful integration to avoid exposing data before encryption or after decryption.

Use when handling sensitive or regulated data, especially at scale above thousands of users or transactions per second, or when compliance standards like GDPR, HIPAA, or PCI-DSS apply.

Avoid in low-risk systems with non-sensitive data and very low traffic (under 100 requests per second) where encryption overhead outweighs benefits.

Real World Examples

Netflix

Encrypts user data stored in cloud storage to prevent unauthorized access even if storage is compromised.

Stripe

Uses TLS encryption for all payment data in transit to protect cardholder information during transactions.

Google

Encrypts data at rest in its data centers and uses HTTPS for all client-server communication to secure user data.

Alternatives

Tokenization

Replaces sensitive data with non-sensitive tokens instead of encrypting the original data.

Use when: Use when you want to minimize encryption overhead and simplify compliance by avoiding storing actual sensitive data.

Hashing

Transforms data into fixed-size hash values, typically one-way and not reversible, unlike encryption.

Use when: Use for verifying data integrity or storing passwords securely rather than protecting data confidentiality.

Summary

Encryption at rest protects stored data by making it unreadable without keys.

Encryption in transit secures data moving between systems to prevent interception.

Both are essential for protecting sensitive data and meeting security compliance.