A method for encrypted communication following a Representational State Transfer, REST, scheme, between a client and a server, wherein the communication comprises first and second request messages each including one or more request elements, and first and second response messages each including one or more response elements, wherein each request message and each response message is associated with a resource, and wherein the request element and the response element corresponds to an attribute of a resource, comprising the following steps: receiving a first request message from the client; decomposing the first request message into request elements; for at least one request element of the first request message , determining whether the request element should be encrypted based on a predetermined configuration ; for each request element to be encrypted, determining key information for encryption based on the predetermined configuration , encrypting the request element into an encrypted request element based on the key information for encryption, updating and storing the encryption information in a key manifest; assembling a second request message from the request elements of the first request message, wherein each request element to be encrypted is replaced by the corresponding encrypted request element; sending the second request message to the server; receiving a first response message from the server; decomposing the first response message into response elements; for each response element of the first response message, determining whether the response element needs to be decrypted based on the predetermined configuration ; for each response element that needs to be decrypted, determining key information for decrypting from the key manifest, and decrypting the response element based on the key information for decrypting; assembling a second response message from the response elements of the first response message, wherein each response element that needs to be decrypted is replaced by the corresponding decrypted response element; and sending the second response message to the client; characterized in that the client is allowed to decrypt the second response message by sending the decrypted response element to the client. receiving a first request message from the client; decomposing the first request message into request elements; for at least one request element of the first request message , determining whether the request element should be encrypted based on a predetermined configuration ; for each request element to be encrypted, determining key information for encryption based on the predetermined configuration , encrypting the request element into an encrypted request element based on the key information for encryption, updating and storing the encryption information in a key manifest; assembling a second request message from the request elements of the first request message, wherein each request element to be encrypted is replaced by the corresponding encrypted request element; sending the second request message to the server; receiving a first response message from the server; decomposing the first response message into response elements; for each response element of the first response message, determining whether the response element needs to be decrypted based on the predetermined configuration ; for each response element that needs to be decrypted, determining key information for decrypting from the key manifest, and decrypting the response element based on the key information for decrypting; assembling a second response message from the response elements of the first response message, wherein each response element that needs to be decrypted is replaced by the corresponding decrypted response element; and sending the second response message to the client; characterized in that the client is allowed to decrypt the second response message by sending the decrypted response element to the client. <EOS>