Java Meets Queryable Encryption: Developing a Secure Bank Account Application

1
    <dependency>
2
       <groupId>org.projectlombok</groupId>
3
       <artifactId>lombok</artifactId>
4
       <optional>true</optional>
5
    </dependency>
6
    <dependency>
7
       <groupId>org.mongodb</groupId>
8
       <artifactId>mongodb-driver-sync</artifactId>
9
       <version>5.1.3</version>
10
    </dependency>
11
    <dependency>
12
       <groupId>org.mongodb</groupId>
13
       <artifactId>mongodb-crypt</artifactId>
14
       <version>1.11.0</version>
15
    </dependency>

1
    app.mongodb.uri=mongodb+srv://user:password@cluster0.cluster.mongodb.net/
2
    app.mongodb.kmsProviderName=local
3
    app.mongodb.keyVaultNamespace=encryption.__keyVault
4
    app.mongodb.encryptedDatabaseName=digitalBank
5
    app.mongodb.encryptedCollectionName=accounts
6
    app.mongodb.cryptSharedLibPath=/<path-to-lib>/mongo_crypt_v1.dylib

1
    package com.mongodb.bankaccount.resources.config;
2
    
3
    import com.mongodb.AutoEncryptionSettings;
4
    import com.mongodb.ClientEncryptionSettings;
5
    import com.mongodb.ConnectionString;
6
    import com.mongodb.MongoClientSettings;
7
    import com.mongodb.client.MongoDatabase;
8
    import lombok.Data;
9
    import org.springframework.boot.ApplicationRunner;
10
    import org.springframework.boot.context.properties.ConfigurationProperties;
11
    import org.springframework.context.annotation.Bean;
12
    import org.springframework.context.annotation.Configuration;
13
    import java.io.File;
14
    import java.io.FileInputStream;
15
    import java.io.FileOutputStream;
16
    import java.io.IOException;
17
    import java.security.SecureRandom;
18
    import java.util.HashMap;
19
    import java.util.Map;
20
    
21
    @Data
22
    @Configuration
23
    @ConfigurationProperties(prefix = "app.mongodb")
24
    public class EncryptionConfig {
25
    
26
       private String uri;
27
       private String kmsProviderName;
28
       private String keyVaultNamespace;
29
       private String encryptedDatabaseName;
30
       private String encryptedCollectionName;
31
       private String cryptSharedLibPath;
32
    
33
       private static final String CUSTOMER_KEY_PATH = "src/main/resources/customer-key.txt";
34
       private static final int KEY_SIZE = 96;
35
       private final Map<String, Map<String, Object>> kmsProviderCredentials = new HashMap<>();
36
    
37
       @Bean
38
       public ApplicationRunner createEncryptedCollectionRunner(MongoDatabase db, EncryptionFieldConfig encryptionFieldConfig) {
39
           return args -> {
40
               if (!encryptionFieldConfig.collectionExists(db, encryptedCollectionName)) {
41
                   encryptionFieldConfig.createEncryptedCollection(db, clientEncryptionSettings());
42
               }
43
           };
44
       }
45
    
46
       private ClientEncryptionSettings clientEncryptionSettings() throws Exception {
47
           return ClientEncryptionSettings.builder()
48
                   .keyVaultMongoClientSettings(getMongoClientSettings())
49
                   .keyVaultNamespace(keyVaultNamespace)
50
                   .kmsProviders(kmsProviderCredentials)
51
                   .build();
52
       }
53
    
54
       protected MongoClientSettings getMongoClientSettings() throws Exception {
55
           kmsProviderCredentials.put("local", createLocalKmsProvider());
56
    
57
           AutoEncryptionSettings autoEncryptionSettings = AutoEncryptionSettings.builder()
58
                   .keyVaultNamespace(keyVaultNamespace)
59
                   .kmsProviders(kmsProviderCredentials)
60
                   .extraOptions(createExtraOptions())
61
                   .build();
62
    
63
           return MongoClientSettings.builder()
64
                   .applyConnectionString(new ConnectionString(uri))
65
                   .autoEncryptionSettings(autoEncryptionSettings)
66
                   .build();
67
       }
68
    
69
       private Map<String, Object> createLocalKmsProvider() throws IOException {
70
           if (!isCustomerMasterKeyFileExists()) {
71
               generateCustomerMasterKey();
72
           }
73
    
74
           byte[] localCustomerMasterKey = readCustomerMasterKey();
75
           Map<String, Object> keyMap = new HashMap<>();
76
           keyMap.put("key", localCustomerMasterKey);
77
           return keyMap;
78
       }
79
    
80
       private boolean isCustomerMasterKeyFileExists() {
81
           return new File(CUSTOMER_KEY_PATH).isFile();
82
       }
83
    
84
       private void generateCustomerMasterKey() throws IOException {
85
           byte[] localCustomerMasterKey = new byte[KEY_SIZE];
86
           new SecureRandom().nextBytes(localCustomerMasterKey);
87
           try (FileOutputStream stream = new FileOutputStream(CUSTOMER_KEY_PATH)) {
88
               stream.write(localCustomerMasterKey);
89
           } catch (IOException e) {
90
               throw new IOException("Unable to write Customer Master Key file: " + e.getMessage(), e);
91
           }
92
       }
93
    
94
       private byte[] readCustomerMasterKey() throws IOException {
95
           byte[] localCustomerMasterKey = new byte[KEY_SIZE];
96
    
97
           try (FileInputStream fis = new FileInputStream(CUSTOMER_KEY_PATH)) {
98
               int bytesRead = fis.read(localCustomerMasterKey);
99
               if (bytesRead != KEY_SIZE) {
100
                   throw new IOException("Expected the customer master key file to be " + KEY_SIZE + " bytes, but read " + bytesRead + " bytes.");
101
               }
102
           } catch (IOException e) {
103
               throw new IOException("Unable to read the Customer Master Key: " + e.getMessage(), e);
104
           }
105
    
106
           return localCustomerMasterKey;
107
       }
108
    
109
       private Map<String, Object> createExtraOptions() {
110
           Map<String, Object> extraOptions = new HashMap<>();
111
           extraOptions.put("cryptSharedLibPath", cryptSharedLibPath);
112
           return extraOptions;
113
       }
114
    }

1
    package com.mongodb.bankaccount.resources.config;
2
3
    import com.mongodb.ClientEncryptionSettings;
4
    import com.mongodb.client.MongoDatabase;
5
    import com.mongodb.client.model.CreateCollectionOptions;
6
    import com.mongodb.client.model.CreateEncryptedCollectionParams;
7
    import com.mongodb.client.vault.ClientEncryptions;
8
    import org.bson.*;
9
    import org.springframework.context.annotation.Configuration;
10
    import java.util.ArrayList;
11
    import java.util.Arrays;
12
    
13
    @Configuration
14
    public class EncryptionFieldConfig {
15
    
16
       protected boolean collectionExists(MongoDatabase db, String collectionName) {
17
           return db.listCollectionNames().into(new ArrayList<>()).contains(collectionName);
18
       }
19
    
20
       protected void createEncryptedCollection(MongoDatabase db, ClientEncryptionSettings clientEncryptionSettings) {
21
           var clientEncryption = ClientEncryptions.create(clientEncryptionSettings);
22
           var encryptedCollectionParams = new CreateEncryptedCollectionParams("local")
23
                   .masterKey(new BsonDocument());
24
    
25
           var createCollectionOptions = new CreateCollectionOptions().encryptedFields(encryptFields());
26
           clientEncryption.createEncryptedCollection(db, "accounts", createCollectionOptions, encryptedCollectionParams);
27
       }
28
    
29
       private BsonDocument encryptFields() {
30
           return new BsonDocument().append("fields",
31
                   new BsonArray(Arrays.asList(
32
                           createEncryptedField("accountNumber", "string", equalityQueryType()),
33
                           createEncryptedField("cardVerificationCode", "int", equalityQueryType()),
34
                           createEncryptedField("accountBalance", "double", rangeQueryType()
35
                           ))));
36
       }
37
    
38
       private BsonDocument createEncryptedField(String path, String bsonType, BsonDocument query) {
39
           return new BsonDocument()
40
                   .append("keyId", new BsonNull())
41
                   .append("path", new BsonString(path))
42
                   .append("bsonType", new BsonString(bsonType))
43
                   .append("queries", query);
44
       }
45
    
46
       private BsonDocument rangeQueryType() {
47
           return new BsonDocument()
48
                   .append("queryType", new BsonString("range"))
49
                   .append("min", new BsonDouble(0))
50
                   .append("max", new BsonDouble(999999999))
51
                   .append("precision", new BsonInt32(2));
52
       }
53
    
54
       private BsonDocument equalityQueryType() {
55
           return new BsonDocument().append("queryType", new BsonString("equality"));
56
       }
57
    }

1
    package com.mongodb.bankaccount.resources.config;
2
    
3
    import com.mongodb.MongoClientSettings;
4
    import com.mongodb.client.MongoClient;
5
    import com.mongodb.client.MongoClients;
6
    import com.mongodb.client.MongoDatabase;
7
    import org.bson.codecs.configuration.CodecProvider;
8
    import org.bson.codecs.configuration.CodecRegistry;
9
    import org.bson.codecs.pojo.PojoCodecProvider;
10
    import org.springframework.context.annotation.Bean;
11
    import org.springframework.context.annotation.Configuration;
12
    import static com.mongodb.MongoClientSettings.getDefaultCodecRegistry;
13
    import static org.bson.codecs.configuration.CodecRegistries.fromProviders;
14
    import static org.bson.codecs.configuration.CodecRegistries.fromRegistries;
15
        
16
    @Configuration
17
    public class MongoConfig {
18
    
19
       private final EncryptionConfig encryptionConfig;
20
    
21
       public MongoConfig(EncryptionConfig encryptionConfig) {
22
           this.encryptionConfig = encryptionConfig;
23
       }
24
    
25
       @Bean
26
       public MongoClient mongoClient() throws Exception {
27
           MongoClientSettings mongoClientSettings = encryptionConfig.getMongoClientSettings();
28
           return MongoClients.create(mongoClientSettings);
29
       }
30
    
31
       @Bean
32
       public MongoDatabase mongoDatabase(MongoClient mongoClient) {
33
           CodecProvider pojoCodecProvider = PojoCodecProvider.builder().automatic(true).build();
34
           CodecRegistry pojoCodecRegistry = fromRegistries(getDefaultCodecRegistry(), fromProviders(pojoCodecProvider));
35
    
36
           return mongoClient.getDatabase(encryptionConfig.getEncryptedDatabaseName()).withCodecRegistry(pojoCodecRegistry);
37
       }
38
    }

1
    package com.mongodb.bankaccount;
2
    
3
    import com.mongodb.bankaccount.resources.config.EncryptionConfig;
4
    import org.springframework.boot.SpringApplication;
5
    import org.springframework.boot.autoconfigure.SpringBootApplication;
6
    import org.springframework.boot.context.properties.EnableConfigurationProperties;
7
    
8
    @SpringBootApplication
9
    @EnableConfigurationProperties(EncryptionConfig.class)
10
    public class BankaccountApplication {
11
    
12
       public static void main(String[] args) {
13
          SpringApplication.run(BankaccountApplication.class, args);
14
       }
15
    }

1
    package com.mongodb.bankaccount.resources;
2
    
3
    import com.mongodb.bankaccount.domain.BankAccount;
4
    
5
    public record BankAccountEntity(
6
           String accountHolderName,
7
           String accountNumber,
8
           int cardVerificationCode,
9
           Double accountBalance) {
10
       public BankAccount toDomain() {
11
           return new BankAccount(accountHolderName, accountNumber, cardVerificationCode, accountBalance);
12
       }
13
    }

1
    package com.mongodb.bankaccount.resources;
2
    
3
    import com.mongodb.bankaccount.domain.BankAccount;
4
    import com.mongodb.bankaccount.domain.BankAccountPort;
5
    import com.mongodb.client.MongoCollection;
6
    import com.mongodb.client.MongoDatabase;
7
    import com.mongodb.client.result.InsertOneResult;
8
    import org.bson.types.ObjectId;
9
    import org.slf4j.Logger;
10
    import org.slf4j.LoggerFactory;
11
    import org.springframework.stereotype.Repository;
12
    import java.util.ArrayList;
13
    import java.util.List;
14
    import java.util.Objects;
15
    import java.util.stream.Collectors;
16
    import static com.mongodb.client.model.Filters.eq;
17
    import static com.mongodb.client.model.Filters.gt;
18
    
19
    @Repository
20
    public class BankAccountRepository implements BankAccountPort {
21
       private static final Logger logger = LoggerFactory.getLogger(BankAccountRepository.class);
22
       private static final String COLLECTION_NAME = "accounts";
23
       private final MongoCollection<BankAccountEntity> collection;
24
    
25
       BankAccountRepository(MongoDatabase mongoDatabase) {
26
           this.collection = mongoDatabase.getCollection(COLLECTION_NAME, BankAccountEntity.class);
27
       }
28
    
29
       @Override
30
       public String insert(BankAccount bankAccount) {
31
           try {
32
               InsertOneResult insertOneResult = collection.insertOne(bankAccount.toEntity());
33
               ObjectId result = Objects.requireNonNull(insertOneResult.getInsertedId()).asObjectId().getValue();
34
    
35
               logger.info("{} was created", result);
36
    
37
               return result.toHexString();
38
           } catch (Exception e) {
39
               logger.error(e.getMessage(), e);
40
               throw new RuntimeException("Error inserting bank account", e);
41
           }
42
       }
43
    
44
       @Override
45
       public List<BankAccount> find() {
46
           try {
47
               ArrayList<BankAccountEntity> bankAccounts = new ArrayList<>();
48
               collection.find().into(bankAccounts);
49
    
50
               return bankAccounts.stream()
51
                       .map(BankAccountEntity::toDomain)
52
                       .collect(Collectors.toList());
53
    
54
           } catch (Exception e) {
55
               logger.error(e.getMessage(), e);
56
               throw new RuntimeException("Error finding bank account", e);
57
           }
58
       }
59
    
60
       @Override
61
       public List<BankAccount> findByBalanceGreaterThan(double value) {
62
           try {
63
               ArrayList<BankAccountEntity> bankAccounts = new ArrayList<>();
64
               collection.find(gt("accountBalance", value)).into(bankAccounts);
65
    
66
               return bankAccounts.stream()
67
                       .map(BankAccountEntity::toDomain)
68
                       .collect(Collectors.toList());
69
    
70
           } catch (Exception e) {
71
               logger.error(e.getMessage(), e);
72
               throw new RuntimeException("Error finding bank account", e);
73
           }
74
       }
75
    
76
       @Override
77
       public BankAccount findByAccountNumber(String accountNumber) {
78
           try {
79
               BankAccountEntity result = collection.find(eq("accountNumber", accountNumber)).first();
80
    
81
               if (result == null) {
82
                   return null;
83
               }
84
    
85
               return result.toDomain();
86
    
87
           } catch (Exception e) {
88
               logger.error(e.getMessage(), e);
89
               throw new RuntimeException("Error finding bank account", e);
90
           }
91
    
92
       }
93
    }

1
    package com.mongodb.bankaccount.domain;
2
    
3
    import com.mongodb.bankaccount.application.web.BankResponse;
4
    import com.mongodb.bankaccount.resources.BankAccountEntity;
5
    
6
    public record BankAccount(
7
       String accountHolderName,
8
       String accountNumber,
9
       int cardVerificationCode,
10
       Double accountBalance) {
11
       public BankResponse toResponse() {
12
           return new BankResponse(accountHolderName, accountNumber, cardVerificationCode, accountBalance);
13
       }
14
    
15
       public BankAccountEntity toEntity() {
16
           return new BankAccountEntity(accountHolderName, accountNumber, cardVerificationCode, accountBalance);
17
       }
18
    }

1
    package com.mongodb.bankaccount.domain;
2
3
    import java.util.List;
4
5
    public interface BankAccountPort {
6
       String insert(BankAccount bankAccount);
7
       List<BankAccount> find();
8
       List<BankAccount> findByBalanceGreaterThan(double value);
9
       BankAccount findByAccountNumber(String accountNumber);
10
    }

1
    package com.mongodb.bankaccount.domain;
2
    
3
    import org.springframework.stereotype.Service;
4
    import java.util.List;
5
    import java.util.Objects;
6
    
7
    @Service
8
    public class BankAccountService {
9
10
       BankAccountPort bankAccountPort;
11
12
       BankAccountService(BankAccountPort bankAccountPort) {
13
           this.bankAccountPort = bankAccountPort;
14
       }
15
16
       public String insert(BankAccount bankAccount) {
17
           Objects.requireNonNull(bankAccount, "Bank account must not be null");    
18
           return bankAccountPort.insert(bankAccount);
19
        }
20
21
       public List<BankAccount> find() {
22
           return bankAccountPort.find();
23
       }
24
25
       public List<BankAccount> findByBalanceGreaterThan(double value) {
26
           return bankAccountPort.findByBalanceGreaterThan(value);
27
       }
28
29
       public BankAccount findByAccountNumber(String accountNumber) { 
30
           return bankAccountPort.findByAccountNumber(accountNumber);
31
       }
32
33
    }

1
    package com.mongodb.bankaccount.application.web;
2
    
3
    import com.mongodb.bankaccount.domain.BankAccount;
4
    import com.mongodb.bankaccount.domain.BankAccountService;
5
    import org.springframework.http.ResponseEntity;
6
    import org.springframework.web.bind.annotation.*;
7
    import java.util.List;
8
    
9
    @RestController
10
    @RequestMapping("/bank")
11
    public class BankController {
12
    
13
       BankAccountService bankAccountService;
14
    
15
       BankController(BankAccountService bankAccountService) {
16
           this.bankAccountService = bankAccountService;
17
       }
18
    
19
       @PostMapping
20
       ResponseEntity<String> create(@RequestBody BankRequest bankRequest) {
21
           return ResponseEntity.ok(bankAccountService.insert(bankRequest.toDomain()));
22
       }
23
    
24
       @GetMapping
25
       ResponseEntity<List<BankResponse>> getAllAccounts() {
26
           return ResponseEntity.ok(bankAccountService.find().stream().map(BankAccount::toResponse).toList());
27
       }
28
    
29
       @GetMapping("/balance/greaterThan/{value}")
30
       ResponseEntity<List<BankResponse>> findByBalanceGreaterThan(@PathVariable Double value) {
31
           return ResponseEntity.ok(bankAccountService.findByBalanceGreaterThan(value).stream().map(BankAccount::toResponse).toList());
32
       }
33
    
34
       @GetMapping("/accountNumber/{accountNumber}")
35
       ResponseEntity<BankResponse> getAccountByNumber(@PathVariable String accountNumber) {
36
           BankAccount bankAccount = bankAccountService.findByAccountNumber(accountNumber);
37
           if (bankAccount != null) {
38
               return ResponseEntity.ok(bankAccount.toResponse());
39
           } else {
40
               return ResponseEntity.notFound().build();
41
           }
42
       }
43
    }

1
    package com.mongodb.bankaccount.application.web;
2
    
3
    import com.mongodb.bankaccount.domain.BankAccount;
4
    
5
    record BankRequest(
6
           String accountHolderName,
7
           String accountNumber,
8
           int cardVerificationCode,
9
           Double accountBalance) {
10
       public BankAccount toDomain() {
11
           return new BankAccount(accountHolderName, accountNumber, cardVerificationCode, accountBalance);
12
       }
13
    }

1
    package com.mongodb.bankaccount.application.web;
2
    
3
    public record BankResponse(String accountHolderName,
4
                              String accountNumber,
5
                              int cardVerificationCode,
6
                              Double accountBalance) {
7
    }

1
./mvnw spring-boot:run

1
curl --location 'http://localhost:8080/bank' \
2
      --header 'Content-Type: application/json' \
3
      --data '{
4
      "accountHolderName": "Ricardo Mello",
5
      "accountNumber": "4527876391233218",
6
      "cardVerificationCode": "761",
7
      "accountBalance": 5000.2
8
      }'

1
curl --location 'http://localhost:8080/bank/accountNumber/{accountNumber}

1
curl --location 'http://localhost:8080/bank/balance/greaterThan/{value}'