数据加密与隐私

Welcome to this lesson on Data Encryption & Privacy! In modern systems, protecting sensitive information is paramount.

We'll explore how to keep data safe, whether it's stored or moving across networks, and why privacy principles are essential.

Data breaches can lead to financial loss, reputational damage, and legal penalties. Encryption is your primary defense.

• Protection: Guards against unauthorized access.
• Compliance: Helps meet regulations like GDPR, HIPAA, CCPA.
• Trust: Builds user confidence in your system's security.

Encryption is the process of transforming readable data (plaintext) into an unreadable format (ciphertext). This scrambled data can only be converted back to plaintext with a secret key.

Think of it like a secret code only those with the key can decipher.

Symmetric encryption uses a single, shared key for both encrypting and decrypting data.

• Speed: It's generally faster, making it suitable for encrypting large amounts of data.
• Key Management: The challenge is securely sharing the secret key between parties.

A common example is AES (Advanced Encryption Standard).

Asymmetric encryption, also known as public-key cryptography, uses a pair of keys: a public key and a private key.

• Public Key: Can be shared freely; used to encrypt data or verify signatures.
• Private Key: Kept secret; used to decrypt data or create signatures.

This method is slower but solves the secure key exchange problem. RSA is a popular algorithm.

Encryption At Rest (EaR) refers to encrypting data when it is stored on a persistent medium, such as a database, hard drive, or backup tape.

This protects your data even if the storage device is physically stolen or accessed without authorization.

Here are common ways to implement Encryption At Rest:

• Full Disk Encryption: Encrypts an entire storage device (e.g., BitLocker, LUKS).
• Database Encryption: Specific columns or entire databases can be encrypted (e.g., Transparent Data Encryption - TDE).
• Cloud Storage Encryption: Cloud providers often offer built-in encryption for data stored in buckets or volumes.

Encryption In Transit (EiT) secures data as it travels across networks, like the internet or internal company networks.

This prevents eavesdropping or tampering by malicious actors who might intercept the data stream.

Common technologies used for Encryption In Transit:

• TLS/SSL (HTTPS): Secures web traffic between browsers and servers. It uses asymmetric encryption to establish a secure channel, then switches to faster symmetric encryption for data transfer.
• VPNs (Virtual Private Networks): Create an encrypted 'tunnel' over a public network, securing all traffic flowing through it.

Beyond encryption, data privacy involves principles for handling personal information responsibly:

• Data Minimization: Collect only the data truly needed.
• Purpose Limitation: Use data only for the specified purpose it was collected for.
• User Consent: Obtain clear permission from users before collecting and processing their data.
• Right to be Forgotten: Allow users to request deletion of their data.

Which of the following are benefits or characteristics of data encryption in system design?

We've covered the critical aspects of Data Encryption & Privacy. You now understand:

• The importance of encryption for security and compliance.
• The differences between symmetric and asymmetric encryption.
• How to secure data at rest (EaR) and in transit (EiT).
• Key principles of data privacy for responsible data handling.

Keep these in mind to build robust and trustworthy systems!