Encryption in use is a new subject to many within the IT ecosystem. Many people confuse this concept (also called searchable encryption, queryable encryption, and data-in-use encryption) with other applications of encryption technologies and believe that their data is already encrypted while being processed or used to support critical operations. The most common response to the implementation of encryption in use question is to confuse it with encryption in transit as being one in the same, but encryption in use is in no way the same as encryption of data in transit.
Encryption in use is a data security best practice. This blog post addresses the uniqueness of, and necessity for, greater adoption of this type of encryption. At the time this blog post is published, adoption of encryption of data in use technology is less than 1% globally.
What is Encryption in Use?
In simple terms, this refers to the practice of encrypting data while it is actively being processed, analyzed, or utilized by an application. The technical definition of encryption in use is the ability to perform calculations on data while it remains encrypted. This is fundamentally different from encrypting data at rest (stored statically on disk) or in transit (being sent over a network). Encryption in use aims to protect sensitive data-in-use from being exposed during computation (active operations) or when residing temporarily in memory or stored within a database.
The Benefit of In Use Encryption: Protection for Your Most Sensitive Data
Data-in-use is often referred to as production data. This is the most critical information to operational success and is most at risk for theft, ransom attack, and harmful manipulation. Every business vertical from not-for-profit to banking to healthcare to retail, manufacturing, research, and payroll operates upon a backbone of data-in-use. Today our most valuable production data sits inside an antiquated, complex cyber-secured perimeter attempting to protect structured SQL databases as vulnerable, exposed plaintext, simply because that’s what our applications required to create, read, update, and delete (CRUD) data efficiently. At the end of everybody’s keyboard is plaintext production data. This is the attack surface bad actors successfully manipulate, exfiltrate and/or ransom. This is fuel to the 10.5 trillion dollar cyber-crime engine.
Exploring Technologies for Encrypting Data in Use
There are different technologies that span both software and hardware solutions. Some of these solutions include new cryptography solutions yet to be adopted or certified and others use existing NIST (National Institute of Standards and Technology) certified encryption algorithms (e.g., AES, SHA, CRYSTALS). The software approach is divided into two disciplines, Homomorphic Encryption (HE) and Searchable Symmetrical Encryption (SSE). Both approaches accomplish the primary goal of operations on encrypted data while it remains encrypted.
Homomorphic Encryption (HE): Computing on Encrypted Data
Homomorphic Encryption (HE) allows computations to be performed directly on encrypted data without decrypting it first. The results of the computation remain encrypted and can only be decrypted with the proper key. Partially Homomorphic Encryption (PHE) supports either addition or multiplication (but not both) on encrypted entities. Somewhat Homomorphic Encryption (SHE) supports both addition and multiplication, but only for a limited number of operations due to noise accumulation during computation. Fully Homomorphic Encryption (FHE) supports an unlimited number of additions and multiplications on encrypted data, enabling any arbitrary computation.
Homomorphic Encryption is working within the fundamentals of lattice cryptography, the evolution of cryptography to combat the threat from quantum computing. HE computations on encrypted data are significantly slower than on plain text. FHE in particular requires large computational resources. Implementing HE schemes and integrating them into applications can be challenging due to their mathematical complexity. Encrypted data accumulates “noise” during computations, and excessive noise can corrupt the results. FHE schemes include mechanisms to manage noise but at the cost of additional computation. HE is practical for specific use cases, but its performance overhead and complexity limits its widespread adoption. Homomorphic Encryption is still a nascent technology, and many organizations are either piloting its use or working in collaboration with vendors like IBM, Microsoft, or smaller startups (e.g., Duality, Enveil). Moreover, the specifics of such implementations are often not disclosed publicly due to the sensitive nature of the data involved.
Searchable Symmetric Encryption (SSE): Securely Querying Encrypted Data
Searchable Symmetric Encryption (SSE) is a cryptographic technique that allows users to perform keyword searches over encrypted data without decrypting it. It enables secure and efficient querying of sensitive information stored in a fully encrypted form, ensuring privacy even when hosted on untrusted platforms like public clouds. SSE data remains encrypted, so unauthorized parties cannot view its contents. Users can search for specific keywords or phrases within the encrypted data without revealing the search query or the content of the dataset to the server. Designed to perform searches efficiently without needing to decrypt the entire dataset. SSE also allows for updates to the encrypted dataset (e.g., adding, editing or deleting records) without decrypting the data and exposing it as plaintext.
SSE provides secure searching encrypted files stored on cloud platforms without revealing sensitive (private, critical, controlled) data. Searching encrypted data can be slower compared to plaintext search (~50 milliseconds). Some SSE schemes may reveal limited information, such as access patterns (e.g., which document contains a keyword). SSE bridges the gap between strong data privacy and usability, making it essential for applications where both security and searchability are critical.
Alternative Approaches to Data-in-Use Protection
There are other technological approaches to addressing the security challenges faced by data-in-use. Some employ the principals of HE and SSE, but not all. Here are some of the technologies currently available:
Format-Preserving Encryption: Maintaining Data Format Integrity
Format-Preserving Encryption (FPE) is a cryptographic standard, as specified in NIST SP 800-38G. It is widely adopted in industries that require encryption while maintaining data format compatibility and encrypts information while preserving its original format. As an example, a 16-digit credit card number remains a 16-digit number after encryption; a date or Social Security Number (SSN) remains in its original format, the main goal is to enable encrypted information to work seamlessly with legacy systems that expect specific formats.
FPE is based on a block cipher (e.g., AES) and uses specific algorithms like FF1 or FF3-1 (standardized by NIST in SP 800-38G). No relation to searchable encryption concepts. Provides semantic security like other encryption schemes but does not inherently support searchability.
Secure Multi-Party Computation: Collaborative Data Processing with Privacy
Secure Multi-Party Computation (MPC) is a cryptographic approach where multiple parties jointly compute a function without revealing their private inputs. This is particularly useful in collaborative scenarios requiring privacy. The core technology for MPC is based in lattice cryptography, such as what is the underpinning of HE.
Secure Cloud Computing protecting sensitive data being processed in third-party cloud environments. Data Privacy enabling analytics on encrypted datasets while ensuring privacy. Regulatory Compliance meeting stringent data protection requirements (e.g., GDPR, DORA, HIPAA) during data use. Financial Services perform secure computations on sensitive customer data like transactions or credit scores. This form of encryption adds a crucial layer of security in scenarios where sensitive information is at risk during active use.
Trusted Execution Environments (TEE): Hardware-Based Data Protection
Secure Enclaves/Trusted Execution Environments (TEE) as part of confidential computing configurations, are hardware-based solutions (e.g., Intel SGX or AMD SEV) that create isolated environments for secure processing. Computations inside the enclave are encrypted and inaccessible to unauthorized processes, even on compromised systems. TEE encrypt the data in the CPU, specifically in the CPU’s memory, to protect it during processing. While it is actively being processed in the CPU’s registers, it is not encrypted because the CPU needs plain text data to perform computations. However, access to the registers is restricted to code running inside the TEE. TEE uses hardware-based memory encryption to protect data in RAM only.
TEE protects confidentiality even if an attacker gains access to the physical memory (e.g., via a cold boot attack), the data remains encrypted and is useless without access to the TEE. Isolation is achieved because data processed inside the enclave is isolated from other processes and the operating system, protecting it from malicious insiders or compromised systems. Limitations of TEE Encryption is data in the CPU registers and cache is not encrypted, but strict access controls ensure only enclave code can access it. TEEs typically will have size constraints, making them less suitable for large datasets or memory-intensive applications. TEEs encrypt data when it resides inside memory outside the CPU (e.g., in RAM only) and ensure its confidentiality during processing by controlling access. However, data is not encrypted while actively being used or processed within CPU registers or cache, as this would make computation impractical. TEE provides no safeguards or encryption for databases.
Data Tokenization with Secure Compute (DT): Replacing Sensitive Data with Tokens
Data Tokenization with Secure Compute (DT) is a method of replacing sensitive data with tokens and performing computations on these tokens within secure environments. Sensitive data is tokenized (e.g., replacing a credit card number with a random value) and moved through secure environments (e.g., TEEs) to process the original data when absolutely required.
Tokenization replaces sensitive data (e.g., credit card numbers, Social Security numbers) with a surrogate value, called a token, replace a credit card number “4111 1111 1111 1111” with the token value “Tk9fdzMj4r32”. The token retains the same format or length as the original data to ensure compatibility with existing systems. The actual sensitive data is stored securely in a token vault or a secure mapping system. Sensitive data is never directly exposed to applications or systems. Tokens are meaningless without access to the token vault.
Tokenization vaults are encrypted, typically using strong encryption standards such as AES-256 for data at rest and TLS for data in transit. Encryption is a key part of a multi-layered security approach to ensure that the sensitive data within the vault remains protected, even in the event of unauthorized access.
The limitation to tokenization is the method used to search for tokens, a deterministic tokenization algorithm ensuring that the same input value always generates the same token (Ex. Every instance of “Alice” will always generate the same token “Tk1234”). Deterministic tokenization leaks information if an attacker observes repeated patterns (e.g., the same token appears multiple times for common values like “John”).
Paperclip SAFE: The New Standard in Data Protection
Paperclip’s SAFE technology provides advanced Searchable Symmetrical Encryption (SSE) of shredded data. SAFE is non-deterministic and under-determined encryption system using non-linear functions. The goal is to introduce additional complexity that hinders attackers from finding relationships among variables. Combining non-deterministic and under-determined systems as one creates randomness which become more challenging to solve predictably.
SAFE is non-deterministic because it uses Searchable Symmetrical Encryption (SSE) cryptographic methods that produce different encrypted outputs due to the use of randomized encryption techniques (e.g., adding randomness or unique initialization vectors). Non-deterministic encryption enhances security by preventing patterns from being easily observed.
SAFE is under-determined because it shreds whole words into fragments. By breaking down text into shreds (smaller, non-whole components of words) and storing only unique instances, you’ve effectively reduced the amount of information from which an attacker could attempt to reconstruct the original message. The uniqueness and loss of duplicate shreds create an under-determined situation, as there are now fewer “equations” (shreds) relative to the “variables” (keywords) creating more ambiguity and entropy.
The system uses multiple secret keys (held by the data owner and data holder) for both encryption and search operations. This dual symmetric approach means that both keys are available and sequenced before you can perform search queries on the data. Attackers would have to make many guesses and assumptions to reconstruct possible messages from the unique shreds. The fewer clues (e.g., contextual or grammatical information) they have, the harder it becomes to determine a single, correct reconstruction, especially if each shred is a small, non-unique part of the word.
SAFE has fast searching adding only milliseconds to normal SQL operations. SAFE provides the capability to search both whole words and partial words. This capability is unique to the SAFE technology, not found in other encryption in use solutions. Additionally, SAFE can be utilized as a tokenization solution going beyond traditional solutions that cannot search for the original content. Beyond encryption, SAFE provides return data masking to include whole value, masked value, pseudonym value or anonymized value. Artificial Intelligence content can be anonymized by SAFE before creating its data set securing analytics with the option to reveal actual data. SAFE can provide secure multiparty collaboration where no one’s data is ever revealed to the other parties.
As a privacy enhancing technology (PET) or privacy enhancing cryptography (PEC), SAFE was wholistically developed to support on-demand critical data usage, GenAI and AI demands, Secure Multi-party Computation (MPC) & Zero Knowledge Proofs (ZKP), fluid data archiving demands, and foundational structured data encryption requirements. A unique byproduct of the SAFE technology approach to encryption in use is the inherent cryptographic agility (crypto-agile), and post-quantum readiness, positioning SAFE adopters for threat landscape and technology evolution.
Evaluating Data Encryption Technologies
As we conclude, we have reviewed six technologies, each with their own strengths and weaknesses, which should be evaluated based on their specific use cases.
If the ultimate goal is to protect critical data or create data sovereignty, plaintext SQL databases cannot be encrypted and still utilized in support of production applications. The relevant technologies to consider here include Homomorphic Encryption (HE), Searchable Symmetric Encryption (SSE), Format-Preserving Encryption (FPE), Data Tokenization (DT), and SAFE.
To secure company intellectual property, such as business logic code, Trusted Execution Environments (TEE) should be considered. For securely sharing data while maintaining privacy, options include Multiparty Computation (MPC) and SAFE. MPC is not detailed in the capability’s comparison below, as it is fundamentally built on HE.
Key Technology Insights
Homomorphic Encryption (HE):
HE faces significant challenges that hinder widespread adoption. The primary obstacle is performance— HE computations are measured in minutes compared to milliseconds in today’s systems. Additionally, issues with output accuracy, along with the complexity of HE development and deployment, remain major barriers.
Searchable Symmetric Encryption (SSE):
SSE is an emerging technology currently in research and development by database vendors (e.g., MongoDB) and cloud service providers (e.g., Amazon).
Format-Preserving Encryption (FPE):
FPE is a mature solution ideal for legacy systems that require data encryption while preserving its original format. Numerous vendors and cloud providers already offer FPE solutions and services.
Trusted Execution Environments (TEE):
TEE operates on the application layer, where business logic is applied to data to generate meaningful results. TEE secures the hardware running the programs but does not inherently protect the source data. A growing trend combines TEE with Data Tokenization (DT) to address storage-level encryption.
SAFE:
SAFE offers a distinctive approach to data security that extends beyond encryption. Even if encryption keys are compromised, SAFE ensures that no breach occurs (referred to as Safe Harbor). It mitigates common attack vectors, such as brute-force, dictionary, and rainbow table attacks, by employing nondeterministic methods. SAFE supports data privacy with multiple key vaults and continuous threat monitoring. Combining SAFE with TEE significantly enhances both application and data security. SAFE has already demonstrated its efficacy in cases involving multiparty collaboration.
Conclusion: What is Encryption in Use?
“Encryption in Use” refers to the continuous encryption of data, whether it is at rest, in transit, or being actively used. The ultimate goal is to prevent data theft, manipulation, and ransom. Today, attackers who penetrate the perimeter often gain access to operational databases containing massive amounts of unsecured data, making this a critical area to address. Multiple technologies and approaches are available to secure in use data depending on the specific use case. Foundationally, strong encryption is the most effective way to secure privacy and business operations from evolving cyber-crime. No, your encryption in transit technology is not protecting your in-use data.