关于采用单文档唯一密钥对称加密实现敏感数据远程存储保护的问询

My team is currently building a remote storage solution for sensitive data, and here's the encryption-focused approach I'm advocating for:

• Symmetric encryption for data protection: We'll use symmetric encryption algorithms to secure all sensitive data before it's sent to remote storage.
• Unique per-document encryption keys: Every individual document will get its own distinct encryption key. This way, if one key is ever exposed, only that single document is at risk—no domino effect across our entire dataset.
• Separate key storage from encrypted data: The encryption keys will be stored locally on the data usage end (the systems that need to access/process the data), not alongside the encrypted data in remote storage.
• End-to-end workflow:
  • Write operation: Generate the unique key locally, encrypt the document, push only the encrypted blob to remote storage, retain the key locally.
  • Read operation: Pull the encrypted blob from remote storage, use the local key to decrypt it on the usage side.

Even though this setup adds a bit of operational redundancy (like having to manage local key storage securely), it directly addresses several key concerns that were blocking our solution's deployment:

• It eliminates the risk of remote storage breaches leading to exposed plaintext—attackers would need access to both the remote encrypted data AND the local keys to get anything usable.
• It meets compliance standards that require strict separation of keys and the data they protect.
• It reassures stakeholders that third-party remote storage providers never have access to our sensitive plaintext data.

内容的提问来源于stack exchange，提问作者JimmyJames