New Encryption/Decryption Flow

When sensitive data is fed into AppViewX after enabling AppViewX MEK encryption via the HSM, to ensure data security, AppViewX executes the following steps:
Note: The AppViewX Master Encryption Key (MEK) is required to encrypt/decrypt the sensitive data, but it is not readily available. The process of retrieving the AppViewX MEK involves two steps, with the HSM initially in control.
  1. Retrieve the encrypted AppViewX MEK from the tenant's database.
  2. Send a request to the HSM, which decrypts the encrypted MEK and sends back a response. This response is a ciphertext encrypted using the KMS MEK.
  3. Retrieve the decrypted value (KMS encrypted).
  4. Send a request to the AWS KMS to decrypt the KMS-encrypted AppViewX MEK using the KMS's MEK.
  5. Retrieve the plaintext AppViewX MEK.
  6. Encrypt/Decrypt sensitive data using the plaintext AppViewX MEK.
  7. Persist the encrypted sensitive data in the tenant database.
Warning:
  • After enabling AppViewX Master Key encryption, if the User’s Master Key is removed from the HSM, all data becomes inaccessible and irrecoverable. There is no way for the recovery of this data.
  • Once AppViewX Master Key encryption is enabled, there is no option to roll back to the default approach of using AWS-KMS.