자동 클라이언트 사이드 필드 레벨 암호화

require 'securerandom'
SecureRandom.hex(48) # => "f54ab...."

development:
  clients:
    default:
      uri: mongodb+srv://user:pass@yourcluster.mongodb.net/blog_development?retryWrites=true&w=majority
      options:
        auto_encryption_options: # This key enables automatic encryption
          key_vault_namespace: 'encryption.__keyVault' # Database and collection to store data keys
          kms_providers: # Tells the driver where to obtain master keys
            local: # We use the local key in this tutorial
              key: "<%= ENV['CUSTOMER_MASTER_KEY'] %>" # Key that we generated earlier
          extra_options:
            crypt_shared_lib_path: '/path/to/mongo_crypt_v1.so' # Only if you use the library

% rake db:mongoid:encryption:create_data_key
Created data key with id: 'KImyywsTQWi1+cFYIHdtlA==' for kms provider: 'local' in key vault: 'encryption.__keyVault'.

% rake db:mongoid:encryption:create_data_key
Created data key with id: 'Vxr5m+5cQISjDOruzZgE0w==' for kms provider: 'local' in key vault: 'encryption.__keyVault'.

% rake db:mongoid:encryption:create_data_key -- --key-alt-name=my_data_key
Created data key with id: 'yjF8hKmKQsqGeFGXlB9Sow==' with key alt name: 'my_data_key' for kms provider: 'local' in key vault: 'encryption.__keyVault'.

class Patient
  include Mongoid::Document
  include Mongoid::Timestamps
  # Tells Mongoid what DEK should be used to encrypt fields of the document
  # and its embedded documents.
  encrypt_with key_id: 'KImyywsTQWi1+cFYIHdtlA=='
  # This field is not encrypted.
  field :category, type: String
  # This field is encrypted using AEAD_AES_256_CBC_HMAC_SHA_512-Random
  # algorithm.
  field :passport_id, type: String, encrypt: {
      deterministic: false
  }
  # This field is encrypted using AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic
  # algorithm.
  field :blood_type, type: String, encrypt: {
      deterministic: true
  }
  # This field is encrypted using AEAD_AES_256_CBC_HMAC_SHA_512-Random
  # algorithm and using  a different data key.
  field :ssn, type: Integer, encrypt: {
      deterministic: false, key_id: 'Vxr5m+5cQISjDOruzZgE0w=='
  }
  embeds_one :insurance
end
class Insurance
  include Mongoid::Document
  include Mongoid::Timestamps
  field :insurer, type: String
  # This field is encrypted using AEAD_AES_256_CBC_HMAC_SHA_512-Random
  # algorithm using the key which alternate name is stored in the
  # policy_number_key field.
  field :policy_number, type: Integer, encrypt: {
      deterministic: false,
      key_name_field: :policy_number_key
  }
  embedded_in :patient
end

Patient.create!(
  category: 'ER',
  passport_id: '123456',
  blood_type: 'AB+',
  ssn: 98765,
  insurance: Insurance.new(insurer: 'TK', policy_number: 123456, policy_number_key: 'my_data_key')
)
# Fields are encrypted in the database
unencrypted_client['patients'].find.first
# =>
# {"_id"=>BSON::ObjectId('6446a1d046ebfd701f9f4292'),
# "category"=>"ER",
# "passport_id"=><BSON::Binary:0x404080 type=ciphertext data=0x012889b2cb0b1341...>,
# "blood_type"=><BSON::Binary:0x404560 type=ciphertext data=0x022889b2cb0b1341...>,
# "ssn"=><BSON::Binary:0x405040 type=ciphertext data=0x012889b2cb0b1341...>,
# "insurance"=>{"_id"=>BSON::ObjectId('6446a1d046ebfd701f9f4293'), "insurer"=>"TK", "policy_number"=><BSON::Binary:0x405920 type=ciphertext data=0x012889b2cb0b1341...>}, "policy_number_key"=>"my_data_key"}

# We can find documents by deterministically encrypted fields.
Patient.where(blood_type: "AB+").to_a
# => [#<Patient _id: 6447e34d46ebfd3debdd9c39, category: "ER", passport_id: "123456", blood_type: "AB+", ssn: 98765>]