Client-Side Field Level Encryption is now on Azure and Google Cloud

Mat Keep and Kenneth White
November 9, 2020 | Updated: August 1, 2023

We’re excited to announce expanded key management support for Client-Side Field Level Encryption (FLE).

Initially released last year with Amazon’s Key Management Service (KMS), native support for Azure Key Vault and Google Cloud KMS is now available in preview with support for our C#/.Net, Java, and Python drivers. More drivers will be added in the coming months.

Client-Side FLE provides amongst the strongest levels of data privacy available today. By expanding our native KMS support, it is even easier for organizations to further enhance the privacy and security of sensitive and regulated workloads with multi-cloud support across ~80 geographic regions.

My databases are already encrypted. What can I do with Client-Side Field Level Encryption?

What makes Client-Side FLE different from other database encryption approaches is that the process is totally separated from the database server. Encryption and decryption is instead handled exclusively within the MongoDB drivers in the client, before sensitive data leaves the application and hits the network.

As a result, all encrypted fields sent to the MongoDB server – whether they are resident in memory, in system logs, at-rest in storage, and in backups – are rendered as ciphertext. Neither the server nor any administrators managing the database or cloud infrastructure staff have access to the encryption keys. Unless the attacker has a compromised DBA password, privileged network access, AND a stolen client encryption key, the data remains protected, securing it against sophisticated exploits.

MongoDB’s Client-Side FLE complements existing network and storage encryption to protect the most highly classified, sensitive fields of your records without:

  • Developers needing to write additional, highly complex encryption logic application-side
  • Compromising your ability to query encrypted data
  • Significantly impacting database performance

By securing data with Client-Side FLE you can move to managed services in the cloud with greater confidence. This is because the database only works with encrypted fields, and you control the encryption keys, rather than having the database provider manage the keys for you. This additional layer of security enforces an even finer-grained separation of duties between those who use the database and those who administer and manage the database.

You can also more easily comply with “right to erasure” mandates in modern privacy legislation such as the GDPR and the CCPA. When a user invokes their right to erasure, you simply destroy the associated field encryption key and the user’s Personally Identifiable Information (PII) is rendered unreadable and irrecoverable to anyone.

Client-Side FLE Implementation

Client-Side FLE is highly flexible. You can selectively encrypt individual fields within a document, multiple fields within the document, or the entire document. Each field can be optionally secured with its own key and decrypted seamlessly on the client.

To check-out how Client-Side FLE works, take a look at this handy animation.

The flow of a query submitted by an authenticated client using FLE

Client-Side FLE uses standard NIST FIPS-certified encryption primitives including AES at the 256-bit security level, in authenticated CBC mode: AEAD AES-256-CBC encryption algorithm with HMAC-SHA-512 MAC.

Data encryption keys are protected by strong symmetric encryption with standard wrapping Key Encryption Keys, which can be natively integrated with external key management services backed by FIPS 140-2 validated Hardware Security Modules (HSMs). Initially this was with Amazon’s KMS, and now with Azure Key Vault and Google Cloud KMS in preview. Alternatively, you can use remote secure web services to consume an external key or a secrets manager such as Hashicorp Vault.

Getting Started

  • To learn more, download our Guide to Client-Side FLE. The Guide will provide you an overview of how Client-Side FLE is implemented, use-cases for it, and how it complements existing encryption mechanisms to protect your most sensitive data.
  • Review the Client-Side FLE key management documentation for more details on how to configure your chosen KMS.

Safe Harbor

The development, release, and timing of any features or functionality described for our products remains at our sole discretion. This information is merely intended to outline our general product direction and it should not be relied on in making a purchasing decision nor is this a commitment, promise or legal obligation to deliver any material, code, or functionality.

← Previous

Join Us for MongoDB.live: 10 Reasons to Attend

Digital transformation has accelerated during the COVID-19 pandemic, as organizations implement new capabilities to support employees and customers and keep things running. The need to build and deploy modern applications has never been greater. For developers, it’s both a challenge and an opportunity. What more can and should they be doing? MongoDB is hosting a series of virtual events around the world to help developers take a deep breath (including exercise breaks!), connect with their peers and our experts, build skills, and brainstorm over projects and new capabilities. Our MongoDB.live events begin Nov. 10 in Northern Europe, with stops in other regions over the next two months. The agenda is tailored to local audiences, so it will feel close to home even as you join remotely. Each agenda is packed with great speakers and content. You can see what it’s all about — and register — here . There will be something for everyone at MongoDB.live. Here are 10 of my favorite reasons to participate. It only makes sense that we begin our day-long event with an eye-opening cup of coffee. Learn about the chemistry of a strong ‘cup of Joe’ from a professional coffee educator in a session titled, “The Science of the Perfect Cup of Coffee.” Dig into performance tuning with a talk on “system thinking” — a way of thinking about complex systems that is both common sense and counterintuitive. This “tales from the field” session is targeted at developers, architects, DevOps engineers, and DBAs. Get even more value from mobile application data in a session focused on how to use MongoDB Atlas to build a MongoDB Realm-based application. Schema design is fundamental to building and managing databases, so we’re bringing together experts to tackle your questions in an Ask Me Anything panel on schema design. Meet the author (and maybe get a free copy) of the book titled, “Soonish: The Emerging Technologies That’ll Improve and/or Ruin Everything.” With a provocative premise like that, how can we not attend? Take a deep dive into the MERN/MEAN stack in a hands-on tutorial. By the end of this 90-minute session, you’ll have a fully managed, auto-scaling application hosted free on MongoDB Atlas. Customer spotlight with Sainsbury, the 150-year-old British retailer that is giving its developers the time and freedom to innovate and push boundaries. Not everyone is an expert MongoDB developer — yet! This “jumpstart” tutorial will help beginners get started with MongoDB’s most indispensable tools, including Atlas, Realm, and Compass. Learn about using MongoDB and Kubernetes together in a session that provides an overview of the architecture, key features, and future outlook of our Kubernetes products. Ask MongoDB! MongoDB VPs of Product Management, Andrew Davidson and Chirag Shah, will field questions from attendees. This is your chance to go straight to our experts with any questions you have. And there will be much more, including community networking, virtual pub trivia, and live Q&A panels. It’s all designed to help you learn, network, and prepare for what’s next — and it’s free. Please join us be registering here .

November 9, 2020
Next →

Hanabi Technologies Uses MongoDB to Power AI Assistant, Hana

For all the hype surrounding generative AI, cynics tend to view the few real-world implementations as little more than “fancy chatbots.” But for Abhinav Aggarwal, CEO of Hanabi Technologies, the idea of a generative AI-powered bot that is more than just an assistant was intriguing. “I’d been using ChatGPT since it launched,” said Aggarwal. “That got me thinking: How could we make a chatbot that was like a team member?” And with that concept, Hana was born. The problem with bots “Most generative AI chatbots do not act like people; they wait for a command and give a response,” said Aggarwal. “We wanted to create a human-like chatbot that would proactively help people based on what they wanted—automating reminders, for example, or fetching time zones from your calendar to correctly schedule meetings.” Hanabi’s flagship product, Hana, is an AI assistant designed to enhance team collaboration within Google Chat, working in concert with Google Workspace and its suite of products. “Our target customers are smaller companies of between 10 and 50 people. At this size you’re not going to build your own agent from scratch,” he said. Hana integrates with Google APIs to deliver a human-like assistant that chimes in with helpful interventions, such as automatically setting reminders and making sure meetings are booked in the right time zone for each participant. “Hana is designed to bring AI to smaller companies and help them collaborate in a space where they are already working—Google Workspace,” Aggarwal explained. The MongoDB Atlas solution For Hana to act like a member of the team, Hanabi needed to process massive amounts of data to support advanced features like retrieval-augmented generation (RAG) for better information retrieval across Google Docs and many other sources. And with a rapidly growing user base of over 600 organizations and 17,000+ installs, Hanabi also required a secure, scalable, and high-performing data storage solution. MongoDB Atlas provided a flexible document model, built-in vector database, and scalable cloud-based infrastructure, freeing Hanabi engineers to build new features for Hana rather than focusing on rote tasks like data extract, transform, and load processes or manual scaling and provisioning. Now, MongoDB Atlas handles a variety of responsibilities: Scalability and security: MongoDB Atlas’s auto-scaling and automatic backup features have enabled Hanabi to seamlessly grow its user base without the need for manual database management. RAG: MongoDB Atlas plays a critical role in Hana’s RAG functionality. The platform enables Hanabi to split Google Docs into small sections, create embeddings, and store these sections in Atlas’s vector database. Development Processes: According to Aggarwal, MongoDB’s flexibility in managing changing schemas has been essential to the company’s fast-paced development cycle. Data Visualization: Using MongoDB Atlas Charts has enabled Hanabi to create comprehensive dashboards for real-time data visualization. This has helped the team track usage, set reminders, and optimize performance without needing to build a manual dashboard. Impact and results With MongoDB Atlas, Hanabi can successfully scale Hana to meet the demands of its rapidly expanding user base. The integration is also enabling Hana to offer powerful features like automatic interactions with customers, advanced information retrieval from Google Docs, and manually added memory snippets, making it an essential tool for teams around the world. Next steps Hanabi plans to continue integrating more tools into Hana while expanding its reach to personal Gmail users. The company is also rolling out a new automatic-interaction feature, further enhancing Hana’s ability to proactively assist users without direct commands. MongoDB Atlas remains a key component of Hanabi’s stack, alongside Google Kubernetes Engine, NestJS, and LangChain, enabling Hanabi to focus on innovating to improve the customer experience. Tech Stack MongoDB Atlas Google Kubernetes Engine NestJS LangChain Are you building AI apps? Join the MongoDB AI Innovators Program today! Successful participants gain access to free MongoDB Atlas credits, technical enablement, and invaluable connections within the broader AI ecosystem. If your company is interested in being featured, we’d love to hear from you. Connect with us at ai_adopters@mongodb.com.

November 21, 2024