Java - Client Side Field Level Encryption

1
git clone git@github.com:mongodb-developer/java-quick-start.git

1
<dependency>
2
  <groupId>org.mongodb</groupId>
3
  <artifactId>mongodb-crypt</artifactId>
4
  <version>1.8.0</version>
5
</dependency>

1
mvn compile exec:java -Dexec.mainClass="com.mongodb.quickstart.csfle.ClientSideFieldLevelEncryption" -Dmongodb.uri="mongodb+srv://USERNAME:PASSWORD@cluster0-abcde.mongodb.net/test?w=majority" -Dexec.cleanupDaemonThreads=false

1
**************
2
* MASTER KEY *
3
**************
4
A new Master Key has been generated and saved to file "master_key.txt".
5
Master Key: [100, 82, 127, -61, -92, -93, 0, -11, 41, -96, 89, -39, -26, -25, -33, 37, 85, -50, 64, 70, -91, 99, -44, -57, 18, 105, -101, -111, -67, -81, -19, 56, -112, 62, 11, 106, -6, 85, -125, 49, -7, -49, 38, 81, 24, -48, -6, -15, 21, -120, -37, -5, 65, 82, 74, -84, -74, -65, -43, -15, 40, 80, -23, -52, -114, -18, -78, -64, -37, -3, -23, -33, 102, -44, 32, 65, 70, -123, -97, -49, -13, 126, 33, -63, -75, -52, 78, -5, -107, 91, 126, 103, 118, 104, 86, -79]
6
7
******************
8
* INITIALIZATION *
9
******************
10
=> Creating local Key Management System using the master key.
11
=> Creating encryption client.
12
=> Creating MongoDB client with automatic decryption.
13
=> Cleaning entire cluster.
14
15
*************************************
16
* CREATE KEY ALT NAMES UNIQUE INDEX *
17
*************************************
18
19
*******************************
20
* CREATE DATA ENCRYPTION KEYS *
21
*******************************
22
Created Bobby's data key ID: 668a35af-df8f-4c41-9493-8d09d3d46d3b
23
Created Alice's data key ID: 003024b3-a3b6-490a-9f31-7abb7bcc334d
24
25
************************************************
26
* INSERT ENCRYPTED DOCUMENTS FOR BOBBY & ALICE *
27
************************************************
28
2 docs have been inserted.
29
30
**********************************
31
* FIND BOBBY'S DOCUMENT BY PHONE *
32
**********************************
33
Bobby document found by phone number:
34
{
35
  "_id": {
36
    "$oid": "60551bc8dd8b737958e3733f"
37
  },
38
  "name": "Bobby",
39
  "age": 33,
40
  "phone": "01 23 45 67 89",
41
  "blood_type": "A+",
42
  "medical_record": [
43
    {
44
      "test": "heart",
45
      "result": "bad"
46
    }
47
  ]
48
}
49
50
****************************
51
* READING ALICE'S DOCUMENT *
52
****************************
53
Before we remove Alice's key, we can read her document.
54
{
55
  "_id": {
56
    "$oid": "60551bc8dd8b737958e37340"
57
  },
58
  "name": "Alice",
59
  "age": 28,
60
  "phone": "09 87 65 43 21",
61
  "blood_type": "O+"
62
}
63
64
***************************************************************
65
* REMOVE ALICE's KEY + RESET THE CONNECTION (reset DEK cache) *
66
***************************************************************
67
Alice key is now removed: 1 key removed.
68
=> Creating MongoDB client with automatic decryption.
69
70
****************************************
71
* TRY TO READ ALICE DOC AGAIN BUT FAIL *
72
****************************************
73
We get a MongoException because 'libmongocrypt' can't decrypt these fields anymore.

1
final byte[] masterKey = new byte[96];
2
new SecureRandom().nextBytes(masterKey);

1
import java.io.FileInputStream;
2
import java.io.FileOutputStream;
3
import java.io.IOException;
4
import java.security.SecureRandom;
5
import java.util.Arrays;
6
7
public class MasterKey {
8
9
    private static final int SIZE_MASTER_KEY = 96;
10
    private static final String MASTER_KEY_FILENAME = "master_key.txt";
11
12
    public static void main(String[] args) {
13
        new MasterKey().tutorial();
14
    }
15
16
    private void tutorial() {
17
        final byte[] masterKey = generateNewOrRetrieveMasterKeyFromFile(MASTER_KEY_FILENAME);
18
        System.out.println("Master Key: " + Arrays.toString(masterKey));
19
    }
20
21
    private byte[] generateNewOrRetrieveMasterKeyFromFile(String filename) {
22
        byte[] masterKey = new byte[SIZE_MASTER_KEY];
23
        try {
24
            retrieveMasterKeyFromFile(filename, masterKey);
25
            System.out.println("An existing Master Key was found in file \"" + filename + "\".");
26
        } catch (IOException e) {
27
            masterKey = generateMasterKey();
28
            saveMasterKeyToFile(filename, masterKey);
29
            System.out.println("A new Master Key has been generated and saved to file \"" + filename + "\".");
30
        }
31
        return masterKey;
32
    }
33
34
    private void retrieveMasterKeyFromFile(String filename, byte[] masterKey) throws IOException {
35
        try (FileInputStream fis = new FileInputStream(filename)) {
36
            fis.read(masterKey, 0, SIZE_MASTER_KEY);
37
        }
38
    }
39
40
    private byte[] generateMasterKey() {
41
        byte[] masterKey = new byte[SIZE_MASTER_KEY];
42
        new SecureRandom().nextBytes(masterKey);
43
        return masterKey;
44
    }
45
46
    private void saveMasterKeyToFile(String filename, byte[] masterKey) {
47
        try (FileOutputStream fos = new FileOutputStream(filename)) {
48
            fos.write(masterKey);
49
        } catch (IOException e) {
50
            e.printStackTrace();
51
        }
52
    }
53
}

1
Map<String, Map<String, Object>> kmsProviders = new HashMap<String, Map<String, Object>>() {{
2
    put("local", new HashMap<String, Object>() {{
3
        put("key", localMasterKey);
4
    }});
5
}};

1
ConnectionString connection_string = new ConnectionString("mongodb://localhost");
2
MongoClientSettings kvmcs = MongoClientSettings.builder().applyConnectionString(connection_string).build();
3
4
ClientEncryptionSettings ces = ClientEncryptionSettings.builder()
5
                                                       .keyVaultMongoClientSettings(kvmcs)
6
                                                       .keyVaultNamespace("csfle.vault")
7
                                                       .kmsProviders(kmsProviders)
8
                                                       .build();
9
10
ClientEncryption encryption = ClientEncryptions.create(ces);

1
AutoEncryptionSettings aes = AutoEncryptionSettings.builder()
2
                                                   .keyVaultNamespace("csfle.vault")
3
                                                   .kmsProviders(kmsProviders)
4
                                                   .bypassAutoEncryption(true)
5
                                                   .build();
6
7
MongoClientSettings mcs = MongoClientSettings.builder()
8
                                             .applyConnectionString(connection_string)
9
                                             .autoEncryptionSettings(aes)
10
                                             .build();
11
12
MongoClient client = MongoClients.create(mcs);

1
MongoCollection<Document> vaultColl = client.getDatabase("csfle").getCollection("vault");
2
vaultColl.createIndex(ascending("keyAltNames"),
3
                      new IndexOptions().unique(true).partialFilterExpression(exists("keyAltNames")));

1
BsonBinary bobbyKeyId = encryption.createDataKey("local", keyAltName("Bobby"));
2
BsonBinary aliceKeyId = encryption.createDataKey("local", keyAltName("Alice"));

1
private DataKeyOptions keyAltName(String altName) {
2
    return new DataKeyOptions().keyAltNames(List.of(altName));
3
}

1
{
2
  "_id" : UUID("aaa2e53d-875e-49d8-9ce0-dec9a9658571"),
3
  "keyAltNames" : [ "Bobby" ],
4
  "keyMaterial" : BinData(0,"/ozPZBMNUJU9udZyTYe1hX/KHqJJPrjdPads8UNjHX+cZVkIXnweZe5pGPpzcVcGmYctTAdxB3b+lmY5ONTzEZkqMg8JIWenIWQVY5fogIpfHDJQylQoEjXV3+e3ZY1WmWJR8mOp7pMoTyoGlZU2TwyqT9fcN7E5pNRh0uL3kCPk0sOOxLT/ejQISoY/wxq2uvyIK/C6/LrD1ymIC9w6YA=="),
5
  "creationDate" : ISODate("2021-03-19T16:16:09.800Z"),
6
  "updateDate" : ISODate("2021-03-19T16:16:09.800Z"),
7
  "status" : 0,
8
  "masterKey" : {
9
    "provider" : "local"
10
  }
11
}

1
private static final String DETERMINISTIC = "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic";
2
private static final String RANDOM = "AEAD_AES_256_CBC_HMAC_SHA_512-Random";
3
4
private Document createBobbyDoc(ClientEncryption encryption) {
5
    BsonBinary phone = encryption.encrypt(new BsonString("01 23 45 67 89"), deterministic(BOBBY));
6
    BsonBinary bloodType = encryption.encrypt(new BsonString("A+"), random(BOBBY));
7
    BsonDocument medicalEntry = new BsonDocument("test", new BsonString("heart")).append("result", new BsonString("bad"));
8
    BsonBinary medicalRecord = encryption.encrypt(new BsonArray(List.of(medicalEntry)), random(BOBBY));
9
    return new Document("name", BOBBY).append("age", 33)
10
                                      .append("phone", phone)
11
                                      .append("blood_type", bloodType)
12
                                      .append("medical_record", medicalRecord);
13
}
14
15
private Document createAliceDoc(ClientEncryption encryption) {
16
    BsonBinary phone = encryption.encrypt(new BsonString("09 87 65 43 21"), deterministic(ALICE));
17
    BsonBinary bloodType = encryption.encrypt(new BsonString("O+"), random(ALICE));
18
    return new Document("name", ALICE).append("age", 28).append("phone", phone).append("blood_type", bloodType);
19
}
20
21
private EncryptOptions deterministic(String keyAltName) {
22
    return new EncryptOptions(DETERMINISTIC).keyAltName(keyAltName);
23
}
24
25
private EncryptOptions random(String keyAltName) {
26
    return new EncryptOptions(RANDOM).keyAltName(keyAltName);
27
}
28
29
private void createAndInsertBobbyAndAlice(ClientEncryption encryption, MongoCollection<Document> usersColl) {
30
    Document bobby = createBobbyDoc(encryption);
31
    Document alice = createAliceDoc(encryption);
32
    int nbInsertedDocs = usersColl.insertMany(List.of(bobby, alice)).getInsertedIds().size();
33
    System.out.println(nbInsertedDocs + " docs have been inserted.");
34
}

1
{
2
  "_id" : ObjectId("6054d91c26a275034fe53300"),
3
  "name" : "Bobby",
4
  "age" : 33,
5
  "phone" : BinData(6,"ATKkRdZWR0+HpqNyYA7zgIUCgeBE4SvLRwaXz/rFl8NPZsirWdHRE51pPa/2W9xgZ13lnHd56J1PLu9uv/hSkBgajE+MJLwQvJUkXatOJGbZd56BizxyKKTH+iy+8vV7CmY="),
6
  "blood_type" : BinData(6,"AjKkRdZWR0+HpqNyYA7zgIUCUdc30A8lTi2i1pWn7CRpz60yrDps7A8gUJhJdj+BEqIIx9xSUQ7xpnc/6ri2/+ostFtxIq/b6IQArGi+8ZBISw=="),
7
  "medical_record" : BinData(6,"AjKkRdZWR0+HpqNyYA7zgIUESl5s4tPPvzqwe788XF8o91+JNqOUgo5kiZDKZ8qudloPutr6S5cE8iHAJ0AsbZDYq7XCqbqiXvjQobObvslR90xJvVMQidHzWtqWMlzig6ejdZQswz2/WT78RrON8awO")
8
}

1
{
2
  "_id" : ObjectId("6054d91c26a275034fe53301"),
3
  "name" : "Alice",
4
  "age" : 28,
5
  "phone" : BinData(6,"AX7Xd65LHUcWgYj+KbUT++sCC6xaCZ1zaMtzabawAgB79quwKvld8fpA+0m+CtGevGyIgVRjtj2jAHAOvREsoy3oq9p5mbJvnBqi8NttHUJpqooUn22Wx7o+nlo633QO8+c="),
6
  "blood_type" : BinData(6,"An7Xd65LHUcWgYj+KbUT++sCTyp+PJXudAKM5HcdX21vB0VBHqEXYSplHdZR0sCOxzBMPanVsTRrOSdAK5yHThP3Vitsu9jlbNo+lz5f3L7KYQ==")
7
}

1
BsonBinary phone = encryption.encrypt(new BsonString("01 23 45 67 89"), deterministic(BOBBY));
2
String doc = usersColl.find(eq("phone", phone)).first().toJson();

1
{
2
  "_id": {
3
    "$oid": "6054d91c26a275034fe53300"
4
  },
5
  "name": "Bobby",
6
  "age": 33,
7
  "phone": "01 23 45 67 89",
8
  "blood_type": "A+",
9
  "medical_record": [
10
    {
11
      "test": "heart",
12
      "result": "bad"
13
    }
14
  ]
15
}

1
private void readAliceIfPossible(MongoCollection<Document> usersColl) {
2
    try {
3
        String aliceDoc = usersColl.find(eq("name", ALICE)).first().toJson();
4
        System.out.println("Before we remove Alice's key, we can read her document.");
5
        System.out.println(aliceDoc);
6
    } catch (MongoException e) {
7
        System.err.println("We get a MongoException because 'libmongocrypt' can't decrypt these fields anymore.");
8
    }
9
}

1
{
2
  "_id": {
3
    "$oid": "6054d91c26a275034fe53301"
4
  },
5
  "name": "Alice",
6
  "age": 28,
7
  "phone": "09 87 65 43 21",
8
  "blood_type": "O+"
9
}

1
vaultColl.deleteOne(eq("keyAltNames", ALICE));

1
com.mongodb.MongoException: not all keys requested were satisfied
2
  at com.mongodb.MongoException.fromThrowableNonNull(MongoException.java:83)
3
  at com.mongodb.client.internal.Crypt.fetchKeys(Crypt.java:286)
4
  at com.mongodb.client.internal.Crypt.executeStateMachine(Crypt.java:244)
5
  at com.mongodb.client.internal.Crypt.decrypt(Crypt.java:128)
6
  at com.mongodb.client.internal.CryptConnection.command(CryptConnection.java:121)
7
  at com.mongodb.client.internal.CryptConnection.command(CryptConnection.java:131)
8
  at com.mongodb.internal.operation.CommandOperationHelper.executeCommand(CommandOperationHelper.java:345)
9
  at com.mongodb.internal.operation.CommandOperationHelper.executeCommand(CommandOperationHelper.java:336)
10
  at com.mongodb.internal.operation.CommandOperationHelper.executeCommandWithConnection(CommandOperationHelper.java:222)
11
  at com.mongodb.internal.operation.FindOperation$1.call(FindOperation.java:658)
12
  at com.mongodb.internal.operation.FindOperation$1.call(FindOperation.java:652)
13
  at com.mongodb.internal.operation.OperationHelper.withReadConnectionSource(OperationHelper.java:583)
14
  at com.mongodb.internal.operation.FindOperation.execute(FindOperation.java:652)
15
  at com.mongodb.internal.operation.FindOperation.execute(FindOperation.java:80)
16
  at com.mongodb.client.internal.MongoClientDelegate$DelegateOperationExecutor.execute(MongoClientDelegate.java:170)
17
  at com.mongodb.client.internal.FindIterableImpl.first(FindIterableImpl.java:200)
18
  at com.mongodb.quickstart.csfle.ClientSideFieldLevelEncryption.readAliceIfPossible(ClientSideFieldLevelEncryption.java:91)
19
  at com.mongodb.quickstart.csfle.ClientSideFieldLevelEncryption.demo(ClientSideFieldLevelEncryption.java:79)
20
  at com.mongodb.quickstart.csfle.ClientSideFieldLevelEncryption.main(ClientSideFieldLevelEncryption.java:41)
21
Caused by: com.mongodb.crypt.capi.MongoCryptException: not all keys requested were satisfied
22
  at com.mongodb.crypt.capi.MongoCryptContextImpl.throwExceptionFromStatus(MongoCryptContextImpl.java:145)
23
  at com.mongodb.crypt.capi.MongoCryptContextImpl.throwExceptionFromStatus(MongoCryptContextImpl.java:151)
24
  at com.mongodb.crypt.capi.MongoCryptContextImpl.completeMongoOperation(MongoCryptContextImpl.java:93)
25
  at com.mongodb.client.internal.Crypt.fetchKeys(Crypt.java:284)
26
  ... 17 more