I'm actually creating an automated security scan application, meaning that every user will be able to scan their own website (the property verificationpart is done) and get flaws found in reports.
The problem is that I really want to secure the datas stored, meaning that I want my datas to be read-able only by the user and the server (Because it's exposed using a RESTful API, to server an angularjs application).
Data is stored in a graphdb called neo4j
Storing an encryption key in each user node
- Problem is that if someone steals my database, they just have to find the algorithm used to encrypt and they can get every flaw of every website.
Encrypt data sent by user with it's password (clear) on client side, so the server doesn't know the key since he is only storing the hashed password.
- Problem is that the server will not be able to store encrypted data if he doesn't know the encryption key.
How can I achieve that? I really need to secure my data at this point, meaning that even if you steal the database, it's impossible to get data out of it, unless you are... me or the developper who created the encryption system.