A Pattern for a Searchable, Encrypted JSON Document Service
summary
A searchable, encrypted JSON document service is built on Postgres using Tink AEAD encryption and KMS-rooted keyrings, storing only a plaintext UUID plus an encrypted entity blob and a compact JSONB lookup index. It implements JSON Schema validation, supports key rotation (requires re-encryption of old rows), and performs secondary-key search by hashing indexed JSON paths with HMACs and truncated four‑byte keys. Demos show working create, patch, rotate, and lookup flows. Tink AEAD + KMS-rooted keyring hashed lookup JSONB with truncated HMAC keys
AI-written summary · about
chapters (24)
- 0:00Intro
- 0:40TEAM PRINCIPLES
- 1:25CENTRALIZED DOCUMENT MANAGEMENT
- 2:16AN INTUITIVE CRUD INTERFACE
- 6:47ENCRYPTION PATTERN
- 7:53TINK
- 14:47JSON SCHEMA BASICS
- 15:43USER TABLE
- 16:58USER SCHEMA
- 18:05PROFILE SCHEMA
- 19:36ENTITY SCHEMA
- 24:06FOSTER CONTINUITY
- 24:52EXTENSION SCHEMA
- 29:38EXTENSION LOOKUP
- 30:11TO THE DATABASE!
- 30:31WHAT TO DO?
- 37:36PATH CONFIG
- 38:42SECONDARY KEY API
- 39:30API LOGIC
- 40:37RESULTING QUERY
- 41:00SQL/JSON PATH PORT
- 42:48NODE HASHER
- 46:07DOWNSIDES
- 47:49FUTURE WORK
related talks
14mJSON data structure – the hidden gem inside your database engine
40mRapid Data Modeling Using ActiveRecord and the JSON Data Type
25mJSON in PostgreSQL - evil data type or just needs to be tamed?
36mTwisting PostgreSQL into a Document Db and Event Store
33mSchemaless SQL The Best of Both Worlds
49mShould I use JSON in PostgreSQL?
31mFast, highly effective database security using searchable encryption (without the yak shave)
59mPostgreSQL's secret NoSQL superpowers