Acra. Features: Application-level encryption
Tags: cryptography, security, encryption, database
Published: 2021-12-02 17:58:38

Ultramodern industries that operate on sensitive data, like fintech and neobanking, require sharp and accurate data security solutions that can be easily maintained and controlled. 

Keeping this in mind we [updated Acra database security suite] (https://www.cossacklabs.com/blog/acra-0-90-0/), our flagship software security solution, to a new release full of the most required and advanced cryptographic protection. 

> *[Use Acra Community Edition for free] (https://github.com/cossacklabs/acra). Check out [Acra Enterprise Edition] (https://www.cossacklabs.com/acra/#pricing) tailored for solutions with high security requirements.*

##1️⃣ Application-level encryption

Application-level encryption means that **data is encrypted on the application side before sending it to the database for storage, and stays encrypted during the maximum of its lifecycle**. Application-level encryption works together with data at rest encryption (database-level) and data in transit encryption (TLS).

> Acra supports easy-to-use and hard-to-misuse encryption. Acra is the easiest way to integrate encryption into your applications without significantly altering the data flow.

💡 **Deploy Acra SQL proxy transparently:** [AcraServer] (https://docs.cossacklabs.com/acra/acra-in-depth/architecture/acraserver/) sits between an app and a database as a cryptographic proxy, transparently encrypting and decrypting chosen data fields that run through it. Just deploy AcraServer and direct your application to talk to it instead of the database.

![Deploy Acra SQL proxy transparently](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8svan6mc3fwz7g9glqn6.png)

💡 **Deploy Acra as an API server:**  [AcraTranslator] (https://docs.cossacklabs.com/acra/acra-in-depth/architecture/acratranslator/) works as Encryption-as-a-Service using HTTP or gRPC API, and encrypts/decrypts data that the application sends it. Application controls which data fields to encrypt. This layout is useful for encrypting only a chosen subset of larger data structures to attain optimal performance/security balance.

![Deploy Acra by Cossack Labs as an API server](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vcd2594doqccerhjievh.png)

💡 **Use client-side encryption and decryption:** in some cases, client-side encryption/decryption is required. Use the Acra [client-side SDKs] (https://docs.cossacklabs.com/acra/acra-in-depth/architecture/sdks/) to encrypt/decrypt data on the application side, and combine with AcraServer or AcraTranslator.
 
>**This approach gives architectural flexibility**: build end-to-end encrypted data flows, or encrypt data before sending it via untrusted networks and control the decryption point inside the trusted perimeter.

💡 **Acra uses [multi-layered encryption] (https://docs.cossacklabs.com/acra/acra-in-depth/cryptography-and-key-management/):** each data field is encrypted with data keys, then data keys are encrypted with access keys, which are encrypted with client keys. 

>This approach allows to perform key rotation easily and guarantees that the brute force decryption will take ages. Acra uses [two different cryptographic containers:] (https://docs.cossacklabs.com/acra/acra-in-depth/data-structures/) blazing fast AcraBlock (AES-256-GCM) and flexible AcraStruct (AES-256-GCM + ECDH).

🔥 But Acra possibilities [are not limited to encryption alone.] (https://docs.cossacklabs.com/acra/acra-in-depth/security-features/) We designed it to be a robust data protection software at your fingertips. Follow the series to read about some other prominent Acra features.

> Check out 👉 [Acra Community Edition] (https://github.com/cossacklabs/acra) (open-source, available for free) or learn about 👉 [Acra Enterprise Edition] (https://www.cossacklabs.com/acra/#pricing).