What You Will Learn

• What field-level encryption is.
• Which fields should be encrypted.
• Where encryption logic belongs.
• How key management affects security.
• Common mistakes to avoid.

Introduction

Field-level encryption protects selected sensitive fields before storing them.

Examples:

• Social security number.
• Bank account number.
• Medical identifier.
• Tax ID.
• Sensitive notes.

Encryption Flow

flowchart LR
    A["API request"] --> B["Validate input"]
    B --> C["Encrypt sensitive field"]
    C --> D["Store encrypted value"]
    E["Read request"] --> F["Load encrypted value"]
    F --> G["Decrypt if authorized"]
    G --> H["Return masked or plain value"]

What to Encrypt

Encrypt fields that would create risk if the database is exposed.

Do not encrypt fields that must be frequently searched unless you have a planned search strategy.

Service-Layer Example

public Customer saveCustomer(CreateCustomerRequest request) {
    Customer customer = new Customer();
    customer.setName(request.name());
    customer.setSsn(encryptionService.encrypt(request.ssn()));
    return customerRepository.save(customer);
}

Key Management

Good encryption depends on key protection.

Use:

• AWS KMS.
• Azure Key Vault.
• HashiCorp Vault.
• Hardware security modules.
• Managed secrets platforms.

Avoid hardcoded keys in source code.

Common Mistakes

• Logging decrypted values.
• Reusing one static hardcoded key forever.
• Encrypting everything without search requirements.
• Decrypting data for users who should only see masked values.

Summary

Field-level encryption reduces impact when sensitive database fields are exposed. Use it with strong key management, authorization, masking, and audit logging.

Learning Path Navigation

• Series home: Spring Security Learning Path
• Previous: mTLS Authentication between Java Services
• Next: Database Encryption and JPA Attribute Converter