Client Side Aead Envelope Encryption Dataflow

What the Tink and BigQuery AEAD Envelope Encryption Architecture Is

This architecture leverages the Tink cryptographic library on-premises alongside Cloud Key Management Service (Cloud KMS) or Cloud HSM to implement client-side envelope encryption and column-level access controls. Tink generates localized Data Encryption Keys (DEKs) to encrypt specific sensitive fields (such as credit card numbers or account identifiers) before data leaves the corporate perimeter, while the DEKs themselves are securely wrapped (encrypted) by a centralized Key Encryption Key (KEK) managed in Cloud KMS/Cloud HSM.

How it Meets the Stated Requirements

• Client-Side Field-Level Encryption: By applying Tink locally on-premises, sensitive data attributes are converted into ciphertext prior to transit over Dedicated Interconnect, providing end-to-end payload security.
• Envelope Encryption for DEKs: DEKs are generated per dataset/session and immediately wrapped by the Cloud KMS/Cloud HSM symmetric KEK. Plaintext DEKs are never written to disk or sent across the network.
• Ingestion via Dataflow to BigQuery: Dataflow processes the streaming records containing the ciphertext and wrapped DEKs, loading both into BigQuery storage tables.
• On-Demand SQL Decryption with IAM: BigQuery natively supports AEAD (Authenticated Encryption with Associated Data) decryption functions (such as AEAD.DECRYPT_STRING or keyset functions). Analysts running queries unwrap the DEK and decrypt values dynamically at runtime only if their identity has IAM roles/cloudkms.cryptoKeyDecrypter permissions on the wrapping KEK.

Key Advantages

• Dual-Access Control: Decryption requires access permissions on both the BigQuery table and the Cloud KMS cryptographic key.
• Cryptographic Independence: Google Cloud infrastructure never sees plaintext data in transit or in the ingestion buffer unless authorized by IAM during query execution.
• Standardized Cryptography: Tink provides cross-platform, deterministic, and non-deterministic AEAD primitives that integrate directly with BigQuery standard SQL functions.
• Granular Key Rotation: KEKs can be rotated automatically in Cloud KMS every 30 days without needing to re-encrypt all historical stored data chunks.

Why This Is Optimal

This pattern provides defense-in-depth by combining transport encryption, customer-managed envelope encryption, and granular column-level access control without requiring custom decryption microservices in front of BigQuery.