Encryption at rest concept in MongoDB - Step-by-Step Execution

Concept Flow - Encryption at rest concept

Data Stored on Disk

↓

Encrypt Data Before Writing

↓

Encrypted Data Saved

↓

Read Request

↓

Decrypt Data After Reading

↓

Data Returned to User

Data is encrypted before saving to disk and decrypted after reading, keeping stored data safe.

Execution Sample

MongoDB

db.collection.insertOne({name: "Alice", creditCard: "1234-5678-9012-3456"})
// Data encrypted before saving
// Data saved encrypted on disk
// Data decrypted when read

Inserts a document with sensitive data that MongoDB encrypts before storing on disk.

Execution Table

Step	Action	Data State	Storage State	Output
1	Insert document	Plaintext: {name: 'Alice', creditCard: '1234-5678-9012-3456'}	N/A	Document ready to encrypt
2	Encrypt data	Encrypted data	N/A	Data encrypted before saving
3	Save to disk	Encrypted data	Encrypted data on disk	Data stored securely
4	Read document	N/A	Encrypted data on disk	Encrypted data read
5	Decrypt data	Encrypted data	N/A	Plaintext data returned to user
6	Return data	Plaintext data	N/A	{name: 'Alice', creditCard: '1234-5678-9012-3456'}

💡 Data is stored encrypted on disk and decrypted only when accessed.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 5	Final
Document	{name: 'Alice', creditCard: '1234-5678-9012-3456'}	Encrypted blob	Encrypted blob on disk	Decrypted document	Decrypted document

Key Moments - 3 Insights

Why is the data encrypted before saving to disk?

Encrypting before saving ensures that if someone accesses the disk directly, they cannot read the sensitive data. See execution_table step 2 and 3.

When is the data decrypted?

Data is decrypted only after reading from disk, just before returning to the user. See execution_table step 5 and 6.

Is the data stored in plaintext on disk at any time?

No, data is always stored encrypted on disk to protect it. Plaintext exists only in memory during processing. See execution_table steps 3 and 5.

Visual Quiz - 3 Questions

Look at the execution_table, what is the state of data at step 3?

A Plaintext data saved on disk

B Encrypted data saved on disk

C Data decrypted after reading

D Data ready to encrypt

💡 Hint

Check the 'Storage State' column at step 3 in execution_table.

At which step is the data decrypted?

A Step 2

B Step 3

C Step 5

D Step 1

💡 Hint

Look at the 'Action' column for decryption in execution_table.

If encryption was skipped, what would change in the execution_table?

A Data would be stored in plaintext on disk

B Data would be stored encrypted on disk

C Data would be decrypted twice

D Data would never be saved

💡 Hint

Consider the 'Storage State' column at step 3 in execution_table.

Concept Snapshot

Encryption at rest means data is encrypted before saving to disk.
Data stays encrypted on disk to protect it.
When data is read, it is decrypted before use.
This keeps sensitive info safe even if disk is accessed.
MongoDB handles this automatically if enabled.

Full Transcript

Encryption at rest means that data is protected by encrypting it before it is saved to disk. When you insert data into MongoDB, the data is first encrypted, then saved in encrypted form on the disk. When you read the data, MongoDB reads the encrypted data from disk and decrypts it before returning it to you. This process ensures that sensitive information is never stored in plain text on the disk, protecting it from unauthorized access. The execution table shows each step from inserting, encrypting, saving, reading, decrypting, and returning the data. Variables track the document state changing from plaintext to encrypted and back. Key moments clarify why encryption happens before saving and decryption after reading. The visual quiz tests understanding of these steps. This concept helps keep your data safe even if someone accesses the physical storage.