MongoDB provides two approaches to In-Use Encryption: Queryable Encryption and Client-Side Field Level Encryption (CSFLE). When using either approach, you can also choose between automatic and explicit encryption.MongoDB提供了两种使用中加密的方法：可查询加密和客户端字段级加密（CSFLE）。使用这两种方法时，您还可以在自动加密和显式加密之间进行选择。
About Queryable Encryption and CSFLE关于可查询加密和CSFLE
Both Queryable Encryption and Client-Side Field Level Encryption (CSFLE) enable a client application to encrypt data before transporting it over the network. Sensitive data is transparently encrypted and decrypted by the client and only communicated to and from the server in encrypted form.可查询加密和客户端字段级加密（CSFLE）都使客户端应用程序能够在通过网络传输数据之前对其进行加密。敏感数据由客户端透明地加密和解密，并且仅以加密形式与服务器通信。
To compare features in detail, see Queryable Encryption Features and CSFLE Features.要详细比较功能，请参阅可查询加密功能和CSFLE功能。
Considerations注意事项
When implementing an application that uses Queryable Encryption or CSFLE, review the security considerations in this section.在实现使用可查询加密或CSFLE的应用程序时，请查看本节中的安全考虑因素。
For the limitations of each approach, see Queryable Encryption limitations or CSFLE limitations.有关每种方法的限制，请参阅可查询加密限制或CSFLE限制。
For MongoDB server and driver version compatibility, see Compatibility.有关MongoDB服务器和驱动程序版本兼容性，请参阅兼容性。
Security Considerations安全考虑
CSFLE and Queryable Encryption do not provide any guarantees against adversaries with access to your Customer Master Key and Data Encryption Keys.CSFLE和可查询加密不提供任何保证，防止对手访问客户主键和数据加密键。CSFLE and Queryable Encryption do not provide any guarantees against adversaries with arbitrary write access to collections containing encrypted data.CSFLE和可查询加密不提供任何保证，防止对手对包含加密数据的集合进行任意写入访问。MongoDB uses schema validation to enforce encryption of specific fields in a collection. Without a client-side schema, the client downloads the server-side schema for the collection to determine which fields to encrypt.MongoDB使用模式验证来强制加密集合中的特定字段。如果没有客户端模式，客户端会下载集合的服务器端模式，以确定要加密哪些字段。To avoid this issue, use client-side schema validation.要避免此问题，请使用客户端模式验证。Because CSFLE and Queryable Encryption do not provide a mechanism to verify the integrity of a schema, relying on a server-side schema means trusting that the server's schema has not been tampered with. If an adversary compromises the server, they can modify the schema so that a previously encrypted field is no longer labeled for encryption. This causes the client to send plaintext values for that field.由于CSFLE和可查询加密不提供验证模式完整性的机制，因此依赖服务器端模式意味着相信服务器的模式没有被篡改。如果对手破坏了服务器，他们可以修改模式，使之前加密的字段不再标记为加密。这会导致客户端发送该字段的明文值。For an example of CSFLE configuration for client and server-side schemas, see CSFLE Server-Side Field Level Encryption Enforcement.有关客户端和服务器端模式的CSFLE配置示例，请参阅CSFLE服务器端字段级加密实施。
Using Queryable Encryption and CSFLE使用可查询加密和CSFLE
You can use Queryable Encryption, Client-Side Field Level Encryption, or both in your application. However, you can't use both approaches in the same collection.您可以在应用程序中使用可查询加密、客户端字段级加密或两者兼而有之。但是，不能在同一集合中同时使用这两种方法。
Consider using Queryable Encryption in the following scenarios:在以下场景中考虑使用可查询加密：
You are developing a new application and want to use the latest cryptographic advancements from MongoDB.您正在开发一个新的应用程序，并希望使用MongoDB的最新加密技术。You expect users to run ranged, prefix, suffix, or substring queries against encrypted data.您希望用户对加密数据运行范围、前缀、后缀或子字符串查询。Your application can use a single key for a given field, rather than requiring separate keys on a per-user or per-tenant basis.应用程序可以为给定字段使用单个键，而不需要为每个用户或每个租户提供单独的键。
There are situations where CSFLE may be a preferable solution:在某些情况下，CSFLE可能是更好的解决方案：
Your application already uses CSFLE.应用程序已使用CSFLE。You need to use different keys for the same field. This is commonly encountered when separating tenants or using user-specific keys.您需要对同一字段使用不同的键。这在分离租户或使用用户特定键时很常见。You need to be flexible with your data schema and potentially add more encrypted fields. Adding encrypted fields for Queryable Encryption requires rebuilding metadata collections and indexes.您需要灵活地使用数据模式，并可能添加更多加密字段。为可查询加密添加加密字段需要重建元数据集合和索引。
Querying Encrypted Fields查询加密字段
Queryable Encryption supports equality and range queries on encrypted numeric or date fields.可查询加密支持对加密的数字或日期字段进行相等和范围查询。
Support for prefix, suffix, and substring queries on encrypted string fields is in Public Preview. You can configure these queries for diacritic folding or case insensitivity to ensure different representations of the same string match.Public Preview中支持对加密字符串字段进行前缀、后缀和子字符串查询。您可以将这些查询配置为变音符号折叠或不区分大小写，以确保同一字符串的不同表示匹配。
Client-Side Field Level Encryption supports equality queries on deterministically encrypted fields.客户端字段级加密支持对确定性加密字段进行相等查询。
For more information about supported query operators, see Supported Query Operators for Queryable Encryption and Supported Query Operators for CSFLE. 有关支持的查询运算符的更多信息，请参阅可查询加密的支持查询运算符和CSFLE的支持查询运算符。For the full list of MongoDB query operators, see Query Predicates.有关MongoDB查询运算符的完整列表，请参阅查询谓词。
Encryption Algorithms加密算法
Both Queryable Encryption and Client-Side Field Level Encryption use the AEAD AES-256-CBC encryption algorithm in authenticated mode to perform encryption. See Cryptographic Primitives for more information.可查询加密和客户端字段级加密都在身份验证模式下使用AEAD AES-256-CBC加密算法来执行加密。有关更多信息，请参阅加密基元。
The encryption algorithm for Queryable Encryption uses randomized encryption based on structured encryption, which produces different encrypted output values from the same input.可查询加密的加密算法使用基于结构化加密的随机加密，它从同一输入中产生不同的加密输出值。
For detailed information on MongoDB's approach to Queryable Encryption, see the Overview of Queryable Encryption and Design and Analysis of a Stateless Document Database Encryption Scheme whitepapers.有关MongoDB可查询加密方法的详细信息，请参阅可查询加密概述和无状态文档数据库加密方案的设计和分析白皮书。
The CSFLE encryption algorithm supports both randomized encryption and deterministic encryption. However, it only supports querying fields that are encrypted deterministically. With deterministic encryption, a given input value always encrypts to the same output value.CSFLE加密算法支持随机加密和确定性加密。但是，它只支持查询确定性加密的字段。使用确定性加密，给定的输入值总是加密为相同的输出值。
Private Querying私有查询
MongoDB encrypts queries for both Queryable Encryption and Client-Side Field Level Encryption so that the server has no information on cleartext document or query values. With Queryable Encryption, private querying goes a step further and redacts logs and metadata to scrub information around the query's existence. This ensures stronger privacy and confidentiality.MongoDB对可查询加密和客户端字段级加密的查询进行加密，这样服务器就没有明文文档或查询值的信息。使用可查询加密，私有查询更进一步，对日志和元数据进行编辑，以清除查询存在的信息。这确保了更强的隐私和保密性。
Choosing Between Automatic and Explicit Encryption在自动加密和显式加密之间进行选择
Using Automatic Encryption使用自动加密
We recommend automatic encryption in most situations, as it streamlines the process of writing your client application. With automatic encryption, MongoDB automatically encrypts and decrypts fields in read and write operations.我们建议在大多数情况下使用自动加密，因为它简化了编写客户端应用程序的过程。通过自动加密，MongoDB在读写操作中自动加密和解密字段。
Using Explicit Encryption使用显式加密
Explicit encryption provides fine-grained control over security, at the cost of increased complexity when configuring collections and writing code for MongoDB Drivers. With explicit encryption, you specify how to encrypt fields in your document for each operation you perform on the database, and you include this logic throughout your application.显式加密提供了对安全性的细粒度控制，但代价是在配置集合和为MongoDB驱动程序编写代码时增加了复杂性。使用显式加密，您可以指定如何为在数据库上执行的每个操作加密文档中的字段，并在整个应用程序中包含此逻辑。
For details, see Explicit Encryption with Queryable Encryption or Explicit Encryption with CSFLE.有关详细信息，请参阅使用可查询加密的显式加密或使用CSFLE的显式编码。