I am trying to protect the data by using AES to encrypt all PII data before it is saved to database, and I think the general mechanism is something like below.
(This is what I think, not necessary correct)
User input data -> html sends data to web service via https -> web service encrypts the data using private key that is distinct to each user -> web service saves data to database
and on the other way:
User request data -> web service gets data from database -> web service decrypt the data -> web service sends back the data to user via https
For example, email is a PII field that is encryption protected. Say when user is registering, they provide an email and a password. Web service calculates a random private key and use that key to encrypt email, (Question I here.) and saves the encrypted email to database. When user wants to log in using the email and password combination, they again sends the email to web service (Question II here).
However the two questions arise:
- Should I store the private key in database? Should this be encrypted? If so, how can it be retrieved and decrypted? Otherwise what should we do about the private key?
- Assuming in question 1, we save the private key somewhere with user ID as PK. At the moment when user tries to login with email and password, the web app receives clear-text email without knowing the user ID. How should it decrypt the email without the user ID that is used to locate the private key? Without the private key, how can the system confirm the email is a valid email?
These may be basic questions but I just can't figure out... Wondering what the industry is using to solve the problems, or am I even on the right track?