Cryptography · Study deck
The Layered Encryption Model
Picture a health sensor sending a private reading through a home bridge to a care service.
Shield Shelly is your guide for this deck.
After studying this chapter
Learning objectives
You will be able to:
- Explain: Handing an open letter to a trusted assistant who reads it, acts on it, then forwards it is a different model: useful when you trust the assistant, but the assistant has seen everything.
- Explain: A design that cannot rotate or revoke eventually becomes a design that trusts old secrets forever, so E5 decisions about storage, ownership, and clocks must be made at the start.
- Explain: The deeper layer explains the mechanism that ties the whole model together: every level terminates somewhere, and the component where a protected channel terminates can read the data.
Major section
Start by Asking Who May Read the Plaintext
A locked radio link helps, but the reading may become plain text again at each stop.
- The design must name every reader and every point where protection ends.
- A payload means the useful data inside one message.
- A gateway means the bridge between local devices and a wider network.
Major section
Start by Asking Who May Read the Plaintext (continued)
A message broker means a service that passes messages between senders and receivers.
- Transport layer security means protection for a network stream; it is called TLS.
- Datagram Transport Layer Security (DTLS) protects separate network messages.
- Urgent safe action must still work locally.
- This runway does not prove a cipher, device, or service secure.
Major section
Start by Asking Who May Read the Plaintext (continued)
Five labels that all end at one box protect one box.
- Encryption architecture is the discipline of deciding, for each of those hops, which component is actually allowed to read the data in the clear.
- E1 protects the local link hop.
- Every joined node on a shared key can still read the hop.
Major section
Start by Asking Who May Read the Plaintext (continued)
E3 keeps a payload opaque all the way to the cloud or application, so gateways and brokers only forward ciphertext.
- E5 keeps the keys behind all of this provisioned, rotated, revoked, and recoverable.
- The goal is not "more encryption everywhere"; it is encryption matched to trust boundaries.
- If you only need the intuition, this layer is enough: pick encryption levels by trust boundary, not by habit.
Major section
Start by Asking Who May Read the Plaintext (continued)
A third-party gateway that should only route gets object protection (E3) instead. "We use TLS to the cloud" (E4) protects the internet leg.
- Adding more layers that all terminate at the same component adds cost without adding protection.
- Encryption architecture is choosing, deliberately, which couriers are sealed out and which are trusted readers.
- At each termination point, ask who receives plaintext and which keys make that possible.
Major section
Start by Asking Who May Read the Plaintext (continued)
Handing an open letter to a trusted assistant who reads it, acts on it, then forwards it is a different model: useful when you trust the assistant, but the assistant has seen everything.
- That guided route connects the opening plaintext-owner question to the chapter's later selection workflow.
- The One-Minute View Start from plaintext ownership For every hop, decide which component may decrypt and which must only forward ciphertext.
- Levels are boundaries, not a count E1 link, E2 device-gateway, E3 device-cloud, E4 transport, E5 lifecycle each protect a different boundary.
Major section
Start by Asking Who May Read the Plaintext (continued)
Transport is not end-to-end TLS or DTLS (E4) protects a session between two endpoints.
- If a gateway terminates it, the gateway still sees plaintext unless E3 keeps the payload opaque.
- Beginner Examples These examples connect protection levels to what each part of the system can read.
- A local radio link with a join-controlled key (E1) keeps nearby strangers from reading or joining.
Major section
Map the Path and Name the Plaintext Owners
The practical job is to turn a stack diagram into a set of boundary decisions, each with evidence.
- You walk the path, name who may decrypt at each step, choose the level that enforces that, then prove the wrong party is rejected.
- At the destination, require the negative test appropriate to the selected claim.
Major section
Map the Path and Name the Plaintext Owners (continued)
E1 answers a local wireless-hop risk, E2 gives a trusted gateway per-device protection, and E3 keeps the payload opaque to that gateway.
- This ordered choice connects the chapter's boundary map to the later layer-fit ledger.
- Layer Fit Matrix The right level is the one that matches the threat boundary.
- The local link members after a frame is accepted by the radio or network stack.
Major section
Map the Path and Name the Plaintext Owners (continued)
Commissioning and join control, link-key policy, and capture showing non-members cannot read.
- Gateway cannot decrypt a test payload; cloud rejects a tampered object; intermediaries hold no keys.
- TLS or DTLS version policy, peer identity validation, trust anchors, and negative certificate tests.
- Provisioning records, a rotation owner, a revocation path, a recovery test, and a decommission process.
Major section
Termination Points Decide Who Can Read
The deeper layer explains the mechanism that ties the whole model together: every level terminates somewhere, and the component where a protected channel terminates can read the data.
- Understanding termination is what separates real end-to-end protection from a chain of hop-by-hop sessions that merely looks end-to-end.
Major section
Termination Points Decide Who Can Read (continued)
A shared link key gives no per-device accountability or targeted revocation.
- A gateway-to-cloud TLS session (E4) is decrypted by the gateway on one side and the cloud on the other, so the gateway holds plaintext.
- Evidence beside every stage makes the transition reviewable.
- Omitting it lets any terminating intermediary read sensitive data.
Major section
Termination Points Decide Who Can Read (continued)
Rotation adds a management exchange and storage for old and new credentials during overlap.
- A sound architecture might use E1 plus E2 plus E4 for operational telemetry, and add E3 only for the sensitive fields that must never appear at the gateway.
- The test for whether a level earns its place is simple: it must protect a boundary no other selected level already covers.
- The local hop is unreadable to non-members of the link.
Major section
Termination Points Decide Who Can Read (continued)
The release decision should rest on measurements from representative hardware, packet sizes, sleep schedules, and network loss.
- E5 Is Part of the Architecture, Not an Afterthought Every level above depends on keys, and keys age.
- The device and the gateway, which becomes a plaintext reader.
- Trusting an untrusted gateway exposes payloads it should never read.
Major section
Termination Points Decide Who Can Read (continued)
This lifecycle is E5's connection to every earlier layer: E1 through E4 remain trustworthy only while their keys have a valid, observable state.
- A design that cannot rotate or revoke eventually becomes a design that trusts old secrets forever, so E5 decisions about storage, ownership, and clocks must be made at the start.
- Keys can be provisioned, rotated, revoked, and recovered over time.
- Retrofitting it late leaves a fleet trusting stale or unrevocable keys.
Deck summary
Key takeaways
A locked radio link helps, but the reading may become plain text again at each stop.
- A message broker means a service that passes messages between senders and receivers.
- Five labels that all end at one box protect one box.
- E3 keeps a payload opaque all the way to the cloud or application, so gateways and brokers only forward ciphertext.
- A third-party gateway that should only route gets object protection (E3) instead. "We use TLS to the cloud" (E4) protects the internet leg.
Retrieval practice
Recall check 1 of 3
Shield Shelly says: answer from memory, then check your reasoning.
Q1What is the first question an encryption architecture should answer, before choosing any algorithm?
Show answer
Answer: A Plaintext ownership is the decision that selects the right level.
Retrieval practice
Recall check 2 of 3
Shield Shelly says: answer from memory, then check your reasoning.
Q2A sensor sends health telemetry through a third-party gateway that should only route messages and must not see payload values. Beyond local link protection and gateway-to-cloud TLS, which level is the key addition?
Show answer
Answer: A E3 is the level for payloads that must stay protected through a gateway, broker, queue, or proxy that is not allowed to read them.
Retrieval practice
Recall check 3 of 3
Shield Shelly says: answer from memory, then check your reasoning.
Q3A design protects device-to-gateway traffic with E2, has the gateway decrypt it, then opens a separate gateway-to-cloud TLS session (E4), and claims the data is encrypted end-to-end from device to cloud. Why is that claim wrong?
Show answer
Answer: B A chain of hop-by-hop sessions is not end-to-end.
Print reference
Answers
Answer key.
- A · Plaintext ownership is the decision that selects the right level.
- A · E3 is the level for payloads that must stay protected through a gateway, broker, queue, or proxy that is not allowed to read them.
- B · A chain of hop-by-hop sessions is not end-to-end.