@@ -365,12 +365,14 @@ locally-managed master key.
365
365
C. Define a JSON Schema
366
366
~~~~~~~~~~~~~~~~~~~~~~~
367
367
368
- `JSON Schema <http://json-schema.org/>`_ is a vocabulary that allows you
369
- to annotate and validate JSON documents. MongoDB drivers use an extended
370
- version of the JSON Schema standard to configure automatic client-side
371
- encryption and decryption of specific fields of the documents in a
372
- collection. The extended MongoDB CSFLE standard requires the following
373
- information:
368
+ In this section, MedcoMD engineers configure the fields that the client
369
+ automatically encrypts and decrypts using JSON Schema.
370
+ `JSON Schema <http://json-schema.org/>`_ is a vocabulary
371
+ that allows you to annotate and validate JSON documents.
372
+ MongoDB drivers use an extended version of the JSON Schema standard to
373
+ configure automatic client-side encryption and decryption of specific fields
374
+ of the documents in a collection. The MongoDB CSFLE extended JSON Schema
375
+ standard requires the following information:
374
376
375
377
- The encryption algorithm to use when encrypting each field
376
378
(:manual:`Deterministic Encryption
@@ -383,16 +385,26 @@ information:
383
385
- The BSON Type of each field (only required for deterministically
384
386
encrypted fields)
385
387
386
- .. admonition::Automatic Client-Side Field Level Encryption JSON Schema Does Not Support Document Validation
387
- :important:
388
+ .. admonition:: CSFLE JSON Schema Does Not Support Document Validation
389
+ :class: important:
388
390
389
- MongoDB drivers only use JSON Schema syntax to configure automatic
390
- client-side field level encryption and support *only* field-level
391
- encryption-specific keywords documented in :manual:`Automatic Encryption
392
- JSON Schema Syntax </reference/security-client-side-automatic-json-schema/>`.
391
+ MongoDB drivers use JSON Schema syntax to specify encrypted fields
392
+ and *only* support field-level encryption-specific keywords documented
393
+ in :manual:`Automatic Encryption JSON Schema Syntax
394
+ </reference/security-client-side-automatic-json-schema/>`.
393
395
Any other document validation instances will cause the client to throw
394
396
an error.
395
397
398
+ .. admonition:: Server-side JSON Schema
399
+
400
+ You can prevent clients that are not configured with the appropriate
401
+ client-side JSON Schema from writing unencrypted data to a field by
402
+ using server-side JSON Schema. The server-side JSON Schema provides
403
+ only supplemental enforcement of the client-side JSON Schema. For
404
+ more details on server-side document validation implementation,
405
+ see :manual:`Enforce Field Level Encryption Schema
406
+ </core/security-client-side-encryption/#enforce-field-level-encryption-schema>`.
407
+
396
408
The MedcoMD engineers receive specific requirements for the fields of
397
409
data and their encryption strategies. The following table illustrates
398
410
the data model of the Medco Management System.
@@ -473,8 +485,6 @@ upon deterministic encryption based on the following properties:
473
485
}
474
486
}
475
487
476
-
477
-
478
488
Blood Type
479
489
++++++++++
480
490
@@ -494,7 +504,6 @@ random encryption based on the following properties:
494
504
}
495
505
}
496
506
497
-
498
507
Medical Records
499
508
+++++++++++++++
500
509
@@ -542,7 +551,6 @@ decide upon deterministic encryption based on the following properties:
542
551
}
543
552
}
544
553
545
-
546
554
Recap
547
555
+++++
548
556
@@ -551,7 +559,6 @@ requirements of making sensitive data queryable and secure. View the
551
559
full `JSON Schema for the Medco Medical Management System
552
560
<https://raw.githubusercontent.com/mongodb/docs-assets/DOCSP-json-schema-helper-and-json/MedcoMDSchema.json>`_.
553
561
554
-
555
562
.. tabs-drivers::
556
563
557
564
.. tab::
@@ -714,7 +721,6 @@ unencrypted:
714
721
}
715
722
}
716
723
717
-
718
724
.. note::
719
725
720
726
For queries using a client that is not configured to use CSFLE, such
0 commit comments