托管在客户端上的数据库安全性

Question

I have a database along with REST API for clients to access the data. For performance and other reasons, I need to move the application along with the data to the client's physical server. Is there a way for me to encrypt the data in the database, so the only way the client can get access to it is through API that I expose, and not by cracking MySql and getting at raw data. I do not want the client to see the data stored on my DB, as I feel they will steal it or share it. What can I do to accomplish that?

One idea: Is it possible to implement some form of one-way encryption, where its based on the lookup value provided in api.

eg api lookup by email, that is then gets one-way encrypted compared in the DB for match, and returns a record. This way if they happen to look at my database, the can not see list of emails, all they see is data that is something similar /etc/passwd file.

Answer 1

No.

From the 10 Immutable Laws of Security

Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore

What you want is fundamentally impossible, without caveats. Always and everywhere.