Encryption Overview
| Document status | 35 - Reviewed |
|---|
This document describes encryption implementations used in EnergyConnect to protect data at rest and in transit.
Encryption at Rest
All data stored in EnergyConnect is encrypted using AES-256 with Microsoft platform-managed keys.
| Component | Encryption Method | Key Management |
|---|---|---|
| Virtual Machines + Disks | Encryption at Host (SSE) | Microsoft-managed |
| PostgreSQL Database | Inherited from VM Encryption at Host | Microsoft-managed |
| Azure Storage Accounts | Azure Storage Service Encryption (SSE) | Microsoft-managed |
| Azure Service Bus | Service Bus encryption | Microsoft-managed |
| Azure Key Vault | AES-256 (Standard tier - software-protected) | Microsoft-managed |
| Azure Container Registry | Registry encryption (Standard tier) | Microsoft-managed |
| Azure App Configuration | App Configuration encryption (Standard tier) | Microsoft-managed |
Virtual Machine Encryption Details
EnergyConnect uses Encryption at Host for all Virtual Machines:
- Data is encrypted end-to-end from VM host to Azure Storage
- Covers: OS disk, data disks, temporary disk, and disk caches
- No performance impact (encryption occurs at host level, not VM CPU)
- Reference: Microsoft Encryption at Host Documentation
Encryption in Transit
All network communication uses TLS 1.2 or higher.
| Communication Path | Encryption |
|---|---|
| Client → Azure Front Door | HTTPS/TLS 1.2+ (automated certificate management) |
| Azure Front Door → Container Apps | HTTPS/TLS 1.2+ |
| Container Apps → Container Apps (via Dapr) | mTLS (automatic, managed by Azure) |
| Container Apps → PostgreSQL | SSL/TLS enforced |
| Container Apps → Azure Services | HTTPS/TLS 1.2+ |
| PostgreSQL Backups → Storage | HTTPS/TLS 1.2+ |
Dapr Service-to-Service mTLS
All inter-service communication between container apps uses Dapr service invocation, which provides automatic mTLS authentication and encryption:
- Certificate provisioning and rotation is managed automatically by Azure
- Applies to: client → dmc, client → ecc, client → nts, and inter-backend calls
Cryptographic Standards
| Purpose | Standard |
|---|---|
| Transport Security | TLS 1.2, TLS 1.3 |
| Data at Rest | AES-256 |
| Hashing | SHA-256 or higher |
| Key Exchange | RSA 2048-bit or higher |
Key Management
EnergyConnect uses Microsoft platform-managed keys for all encryption. No customer-managed keys are used.
Benefits:
- Automatic key rotation managed by Microsoft
- No operational overhead for key management
Compliance References
- NIS2 § 6, stk. 8 - Policies and procedures for the use of cryptography
- ISO 27001 - Information security management