Key Management Service:データベースの機密データの暗号化

エンティティクラスを定義します。

@Entity
public class User {
    @Id
    @GeneratedValue
    private Long id;

    private String name;
    private String email;

    // getters and setters ...
}

UserRepositoryクラスを定義します。

public interface UserRepository extends CrudRepository<User, Long> {
 }

Spring Data JPAのAttributeConverterインターフェイスを実装します。

@Converter
 public class EncryptionConverter implements AttributeConverter<String, String> {
     private static String ACCESS_KEY_ID = System.getenv("ALIBABA_CLOUD_ACCESS_KEY_ID");
     private static String ACCESS_KEY_SECRET = System.getenv("ALIBABA_CLOUD_ACCESS_KEY_SECRET");
     private static String CMK_ARN = "acs:kms:RegionId:UserId:key/CmkId";
     private static AliyunConfig config;
     static {
         config = new AliyunConfig();
         config.withAccessKey(ACCESS_KEY_ID, ACCESS_KEY_SECRET);
     }
 
     @Override
     public String convertToDatabaseColumn(String plainText) {
         BaseDataKeyProvider dataKeyProvider = new DefaultDataKeyProvider(CMK_ARN);
         AliyunCrypto crypto = new AliyunCrypto(config);
 
         try {
             CryptoResult<byte[]> encryptResult = crypto.encrypt(dataKeyProvider, plainText.getBytes(StandardCharsets.UTF_8), Collections.singletonMap("sample", "context"));
             return Base64.getEncoder().encodeToString(encryptResult.getResult());
         } catch (InvalidAlgorithmException e) {
             System.out.println("Failed.");
             System.out.println("Error message: " + e.getMessage());
         }
         return null;
     }
 
     @Override
     public String convertToEntityAttribute(String cipherText) {
         BaseDataKeyProvider dataKeyProvider = new DefaultDataKeyProvider(CMK_ARN);
         AliyunCrypto crypto = new AliyunCrypto(config);
         // *** Cache a customer master key (CMK) ***
         CryptoKeyManager ckm = new CachingCryptoKeyManager(new LocalDataKeyMaterialCache());
         crypto.setCryptoKeyManager(ckm);
         try {
             CryptoResult<byte[]> decryptResult = crypto.decrypt(dataKeyProvider, Base64.getDecoder().decode(cipherText));
             return new String(decryptResult.getResult(), StandardCharsets.UTF_8);
         } catch (InvalidAlgorithmException | UnFoundDataKeyException e) {
             e.printStackTrace();
         }
         return null;
     }
 }

@ Convertアノテーションを追加します。

@Entity
 public class User {
     @Id
     @GeneratedValue
     private Long id;
 
     private String name;
     @Convert(converter = EncryptionConverter.class)
     private String email;
     
     // getters and setters ...
 }

オブジェクトを定義します。

class User(object):
     def get_name(self):
         return self.name
 
     def set_name(self, value):
         self.name = value
 
     def get_email(self):
         return self.email
 
     def set_email(self, value):
         self.email = value

データベース内のデータを管理するための関数を実装します。

def user_add(user):
     # Connect to the database. 
     conn = db_connection()
     # Obtain a cursor object that can be used to execute an SQL statement and return the result as a dictionary. 
     cursor = conn.cursor(cursor=pymysql.cursors.DictCursor)
     # Specify the SQL statement that you want to execute. 
     sql = 'insert into user(name, email) values(%s,%s);'
     # Execute the SQL statement. 
     cursor.execute(sql, [user.name, user.email])
     print("insert name: " + user.name)
     print("insert email: " + user.email)
     # Commit the write operation. 
     conn.commit()
     last_id = cursor.lastrowid
     # Close the cursor object. 
     cursor.close()
     # Close the database connection. 
     conn.close()
     return last_id
 
 
 def user_select_by_id(id):
     # Connect to the database. 
     conn = db_connection()
     # Obtain a cursor object that can be used to execute an SQL statement and return the result as a dictionary. 
     cursor = conn.cursor(cursor=pymysql.cursors.DictCursor)
     # Specify the SQL statement that you want to execute. 
     sql = 'select * from user where id = %s;'
     # Execute the SQL statement. 
     cursor.execute(sql, [id])
     result = cursor.fetchone()
     print("select result: " + str(result))
     user = User()
     user.__dict__ = result
     # Close the cursor object. 
     cursor.close()
     # Close the database connection. 
     conn.close()
     return user

データの暗号化と復号化のデコレータを実装します。

def enc_convert():
     def enc_(func):
         def wrapper(self, plain_text):
             provider = DefaultDataKeyProvider(AES_KEY_ARN)
             client = build_aliyun_crypto(False)
             cipher_text, enc_material = client.encrypt(provider, plain_text.encode("utf-8"), ENCRYPTION_CONTEXT)
             cipher_text_str = base64.standard_b64encode(cipher_text).decode("utf-8")
             f = func(self, cipher_text_str)
             return f
 
         return wrapper
 
     return enc_
 
 
 def dec_convert(column_name):
     def dec_(func):
         def wrapper(self):
             user = self.__dict__
             cipher_text = user.get(column_name)
             cipher_text_bytes = base64.standard_b64decode(cipher_text.encode("utf-8"))
             provider = DefaultDataKeyProvider(AES_KEY_ARN)
             client = build_aliyun_crypto(False)
             plain_text, dec_material = client.decrypt(provider, cipher_text_bytes)
             user[column_name] = bytes.decode(plain_text)
             result = User()
             result.__dict__ = user
             f = func(result)
             return f
 
         return wrapper
 
     return dec_

暗号化する電子メールフィールドにデコレータを追加します。

class User(object):
     def get_name(self):
         return self.name
 
     def set_name(self, value):
         self.name = value
 
     @dec_convert(column_name="email")
     def get_email(self):
         return self.email
 
     @enc_convert()
     def set_email(self, value):
         self.email = value