Dotnet

Protecting Sensitive Data in Event-Sourced Systems with Crypto Shredding

This sample is showing an example of using the Crypto Shredding pattern with EventStoreDB. This can be a solution for handling e.g. European General Data Protection Regulation.

Read more in the Diego Martin article "Protecting Sensitive Data in Event-Sourced Systems with Crypto Shredding";

Prerequisities

• .NET 5.0 - https://dotnet.microsoft.com/download/dotnet/6.0.
• Visual Studio 2022, Jetbrains Rider or VSCode.
• Docker - https://docs.docker.com/docker-for-windows/install/.

Running

1. Run: docker-compose up.
2. Wait until all Docker containers are up and running.
3. Check that you can access each started component the following URL:
   • EventStoreDB UI: http://localhost:2113/
4. Open, build and run tests in CryptoShredding.sln solution.

Overview

The general flow for using Crypto Shredding patern:

1. Identify sensitive data in an event. See:
   • PersonalDataAttribute.
2. Associate sensitive data to a subject. See:
   • DataSubjectIdAttribute ,
   • and the usage in ContactAdded event.
3. Store private encryption keys. See:
   • EncryptionKey,
   • CryptoRepository.
4. Get rid of the private encryption key when desired. See:
   • DeleteEncryptionKey method in CryptoRepository.
5. Cryptographic algorithm to use when encrypting and decrypting. See:
   • EncryptorDecryptor.
6. Encrypt text and other data types. See:
   • FieldEncryptionDecryption.
7. Upstream serialization with encryption mechanism. See:
   • SerializationContractResolver,
   • EncryptionJsonConverter,
   • JsonSerializerSettingsFactory,
   • SerializedEvent.
8. Decrypt text and masking mechanism when it cannot be decrypted. See:
   • FieldEncryptionDecryption.
9. Downstream deserialization with decryption mechanism. See:
   • DeserializationContractResolver,
   • DecryptionJsonConverter.
10. Wire up together with an EventStoreDB gRPC client. See:
    • EventConverter,
    • EventStore.
11. Test everything with an EventStoreDB. See:
    • GetEventsTests.