快速入门

分配应用程序变量

本教程中的代码示例使用以下变量来执行 Queryable Encryption 工作流：

// KMS provider name should be one of the following: "aws", "gcp", "azure", "kmip" or "local"
const kmsProviderName = "<Your KMS Provider Name>";
const uri = process.env.MONGODB_URI; // Your connection URI
const keyVaultDatabaseName = "encryption";
const keyVaultCollectionName = "__keyVault";
const keyVaultNamespace = `${keyVaultDatabaseName}.${keyVaultCollectionName}`;
const encryptedDatabaseName = "medicalRecords";
const encryptedCollectionName = "patients";

// KMS provider name should be one of the following: "aws", "gcp", "azure", "kmip" or "local"
const string kmsProviderName = "<your KMS provider name>";
const string keyVaultDatabaseName = "encryption";
const string keyVaultCollectionName = "__keyVault";
var keyVaultNamespace =
    CollectionNamespace.FromFullName($"{keyVaultDatabaseName}.{keyVaultCollectionName}");
const string encryptedDatabaseName = "medicalRecords";
const string encryptedCollectionName = "patients";
var appSettings = new ConfigurationBuilder().AddJsonFile("appsettings.json").Build();
var uri = appSettings["MongoDbUri"];

// KMS provider name should be one of the following: "aws", "gcp", "azure", "kmip" or "local"
kmsProviderName := "<KMS provider name>"
uri := os.Getenv("MONGODB_URI") // Your connection URI
keyVaultDatabaseName := "encryption"
keyVaultCollectionName := "__keyVault"
keyVaultNamespace := keyVaultDatabaseName + "." + keyVaultCollectionName
encryptedDatabaseName := "medicalRecords"
encryptedCollectionName := "patients"

// KMS provider name should be one of the following: "aws", "gcp", "azure", "kmip" or "local"
String kmsProviderName = "<KMS provider name>";
String uri = QueryableEncryptionHelpers.getEnv("MONGODB_URI"); // Your connection URI
String keyVaultDatabaseName = "encryption";
String keyVaultCollectionName = "__keyVault";
String keyVaultNamespace = keyVaultDatabaseName + "." + keyVaultCollectionName;
String encryptedDatabaseName = "medicalRecords";
String encryptedCollectionName = "patients";

// KMS provider name should be one of the following: "aws", "gcp", "azure", "kmip" or "local"
const kmsProviderName = "<Your KMS Provider Name>";
const uri = process.env.MONGODB_URI; // Your connection URI
const keyVaultDatabaseName = "encryption";
const keyVaultCollectionName = "__keyVault";
const keyVaultNamespace = `${keyVaultDatabaseName}.${keyVaultCollectionName}`;
const encryptedDatabaseName = "medicalRecords";
const encryptedCollectionName = "patients";

# KMS provider name should be one of the following: "aws", "gcp", "azure", "kmip" or "local"
kms_provider_name = "<KMS provider name>"
uri = os.environ['MONGODB_URI']  # Your connection URI
key_vault_database_name = "encryption"
key_vault_collection_name = "__keyVault"
key_vault_namespace = f"{key_vault_database_name}.{key_vault_collection_name}"
encrypted_database_name = "medicalRecords"
encrypted_collection_name = "patients"

创建加密集合

1. 创建客户主密钥

   您必须创建客户主密钥 （CMK） 才能执行 Queryable Encryption。

   创建一个 96 字节的客户主密钥，并将其保存到您的文件系统中，作为文件 customer-master-key.txt：

   MongoDB Shell

   C#

   Go

   Java (Sync)

   Node.js

   Python

   customerMasterKeyPath = "customer-master-key.txt";
   if (!fs.existsSync(customerMasterKeyPath)) {
     fs.writeFileSync(customerMasterKeyPath, crypto.randomBytes(96));
   }

   using var randomNumberGenerator = RandomNumberGenerator.Create();
   try
   {
       var bytes = new byte[96];
       randomNumberGenerator.GetBytes(bytes);
       var localCustomerMasterKeyBase64 = Convert.ToBase64String(bytes);
       File.WriteAllText("customer-master-key.txt", localCustomerMasterKeyBase64);
   }
   catch (Exception e)
   {
       throw new Exception("Unable to write Customer Master Key file due to the following error: " + e.Message);
   }

   key := make([]byte, 96)
   if _, err := rand.Read(key); err != nil {
   	panic(fmt.Sprintf("Unable to create a random 96 byte data key: %v\n", err))
   }
   if err := os.WriteFile("customer-master-key.txt", key, 0644); err != nil {
   	panic(fmt.Sprintf("Unable to write key to file: %v\n", err))
   }

   byte[] localCustomerMasterKey = new byte[96];
   new SecureRandom().nextBytes(localCustomerMasterKey);
   try (FileOutputStream stream = new FileOutputStream("customer-master-key.txt")) {
       stream.write(localCustomerMasterKey);
       // ...

   if (!existsSync("./customer-master-key.txt")) {
     try {
       writeFileSync("customer-master-key.txt", randomBytes(96));
     } catch (err) {
       throw new Error(
         `Unable to write Customer Master Key to file due to the following error: ${err}`
       );
     }
   }

   path = "customer-master-key.txt"
   file_bytes = os.urandom(96)
   with open(path, "wb") as f:
       f.write(file_bytes)

   警告

   保护生产环境中的本地密钥文件

   我们建议将客户数主密钥存储在远程 密钥管理系统 中( KMS )。要学习；了解如何在Queryable Encryption实施中使用远程KMS ，请参阅教程指南。

   如果选择在生产中使用本地密钥提供商，请格外小心，不要将其存储在文件系统中。 请考虑使用 sidecar进程将密钥注入到客户端应用程序中，或使用其他确保密钥安全的方法。

   提示

   从命令行生成 CMK

   使用以下命令从 Unix Shell 或 PowerShell 生成 CMK ：

   • Unix shell：

     echo $(head -c 96 /dev/urandom | base64 | tr -d '\n')

   • PowerShell：

     $r=[byte[]]::new(64);$g=[System.Security.Cryptography.RandomNumberGenerator]::Create();$g.GetBytes($r);[Convert]::ToBase64String($r)

   将上述命令的输出保存到名为 customer-master-key.txt 的文件中。

2. 检索客户主密钥并指定 KMS 提供商设置

   检索您在本指南的创建客户主密钥步骤中生成的客户主密钥文件的内容。

   使用KMS提供商设置中的集合扫描值。客户端使用这些设置来发现集合扫描 。将提供商名称设置为local ，以表明您正在使用本地密钥提供程序。

   MongoDB Shell

   C#

   Go

   Java (Sync)

   Node.js

   Python

   // WARNING: Do not use a local key file in a production application
   const localMasterKey = fs.readFileSync("./customer-master-key.txt");
   if (localMasterKey.length !== 96) {
     throw new Error(
       "Expected the customer master key file to be 96 bytes."
     );
   }
   kmsProviderCredentials = {
     local: {
       key: localMasterKey,
     },
   };

   // WARNING: Do not use a local key file in a production application
   var kmsProviderCredentials = new Dictionary<string, IReadOnlyDictionary<string, object>>();
   try
   {
       var localCustomerMasterKeyBase64 = File.ReadAllText("customer-master-key.txt");
       var localCustomerMasterKeyBytes = Convert.FromBase64String(localCustomerMasterKeyBase64);
       if (localCustomerMasterKeyBytes.Length != 96)
       {
           throw new Exception("Expected the customer master key file to be 96 bytes.");
       }
       var localOptions = new Dictionary<string, object>
       {
           { "key", localCustomerMasterKeyBytes }
       };
       kmsProviderCredentials.Add("local", localOptions);
   }

   key, err := os.ReadFile("customer-master-key.txt")
   if err != nil {
   	panic(fmt.Sprintf("Could not read the Customer Master Key: %v", err))
   }
   if len(key) != 96 {
   	panic(fmt.Sprintf("Expected the customer master key file to be 96 bytes."))
   }
   kmsProviderCredentials := map[string]map[string]interface{}{"local": {"key": key}}

   byte[] localCustomerMasterKey = new byte[96];
   try (FileInputStream fis = new FileInputStream("customer-master-key.txt")) {
       if (fis.read(localCustomerMasterKey) != 96)
           throw new Exception("Expected the customer master key file to be 96 bytes.");
   } catch (Exception e) {
       throw new Exception("Unable to read the Customer Master Key due to the following error: " + e.getMessage());
   }
   Map<String, Object> keyMap = new HashMap<String, Object>();
   keyMap.put("key", localCustomerMasterKey);
   Map<String, Map<String, Object>> kmsProviderCredentials = new HashMap<String, Map<String, Object>>();
   kmsProviderCredentials.put("local", keyMap);

   // WARNING: Do not use a local key file in a production application
   const localMasterKey = readFileSync("./customer-master-key.txt");
   if (localMasterKey.length !== 96) {
     throw new Error(
       "Expected the customer master key file to be 96 bytes."
     );
   }
   kmsProviders = {
     local: {
       key: localMasterKey,
     },
   };

   path = "./customer-master-key.txt"
   with open(path, "rb") as f:
       local_master_key = f.read()
       if len(local_master_key) != 96:
           raise Exception("Expected the customer master key file to be 96 bytes.")
       kms_provider_credentials = {
           "local": {
               "key": local_master_key
           },
       }

3. 设置自动加密选项

   MongoDB Shell

   C#

   Go

   Java (Sync)

   Node.js

   Python

   创建一个包含以下选项的autoEncryptionOptions对象：

   • 密钥保管库集合的命名空间

   • 上一步中定义的kmsProviderCredentials对象

   const autoEncryptionOptions = {
     keyVaultNamespace: keyVaultNamespace,
     kmsProviders: kmsProviderCredentials,
   };

   创建一个包含以下选项的AutoEncryptionOptions对象：

   • 密钥保管库集合的命名空间

   • 上一步中定义的kmsProviderCredentials对象

   • extraOptions对象，包含以下内容的路径：

     您的自动加密共享库

   var extraOptions = new Dictionary<string, object>
   {
       { "cryptSharedLibPath", _appSettings["CryptSharedLibPath"] } // Path to your Automatic Encryption Shared Library
   };
   var autoEncryptionOptions = new AutoEncryptionOptions(
       keyVaultNamespace,
       kmsProviderCredentials,
       extraOptions: extraOptions);

   创建一个包含以下选项的AutoEncryption对象：

   • 密钥保管库集合的命名空间

   • 上一步中定义的kmsProviderCredentials对象

   • cryptSharedLibraryPath对象，包含以下内容的路径：

     您的自动加密共享库

   cryptSharedLibraryPath := map[string]interface{}{
   	"cryptSharedLibPath": os.Getenv("SHARED_LIB_PATH"), // Path to your Automatic Encryption Shared Library
   }
   autoEncryptionOptions := options.AutoEncryption().
   	SetKeyVaultNamespace(keyVaultNamespace).
   	SetKmsProviders(kmsProviderCredentials).
   	SetExtraOptions(cryptSharedLibraryPath)

   创建一个包含以下选项的AutoEncryptionSettings对象：

   • 密钥保管库集合的命名空间

   • 上一步中定义的kmsProviderCredentials对象

   • extraOptions对象，包含以下内容的路径：

     您的自动加密共享库

   Map<String, Object> extraOptions = new HashMap<String, Object>();
   extraOptions.put("cryptSharedLibPath", getEnv("SHARED_LIB_PATH")); // Path to your Automatic Encryption Shared Library
   AutoEncryptionSettings autoEncryptionSettings = AutoEncryptionSettings.builder()
           .keyVaultNamespace(keyVaultNamespace)
           .kmsProviders(kmsProviderCredentials)
           .extraOptions(extraOptions)
           .build();

   创建一个包含以下选项的autoEncryptionOptions对象：

   • 密钥保管库集合的命名空间

   • 上一步中定义的kmsProviders对象

   • sharedLibraryPathOptions对象，包含以下内容的路径：

     您的自动加密共享库

   const extraOptions = {
     cryptSharedLibPath: process.env.SHARED_LIB_PATH, // Path to your Automatic Encryption Shared Library
   };
   const autoEncryptionOptions = {
     keyVaultNamespace,
     kmsProviders,
     extraOptions,
   };

   创建一个包含以下选项的AutoEncryptionOpts对象：

   • 上一步中定义的kms_provider_credentials对象

   • 密钥保管库集合的命名空间

   • 自动加密共享库的路径

   auto_encryption_options = AutoEncryptionOpts(
       kms_provider_credentials,
       key_vault_namespace,
       crypt_shared_lib_path=os.environ['SHARED_LIB_PATH'] # Path to your Automatic Encryption Shared Library>
   )

   注意

   自动加密选项

   自动加密选项向自动加密共享库提供配置信息，这将修改应用程序在访问加密字段时的行为。

   要学习；了解有关自动加密共享库的更多信息，请参阅自动加密共享库页面。

4. 创建客户端以设置加密集合

   要创建用于对集合中的数据进行加密和解密的客户端，请使用您的连接 URI 和自动加密选项实例化一个新的 MongoClient。

   MongoDB Shell

   C#

   Go

   Java (Sync)

   Node.js

   Python

   const encryptedClient = Mongo(uri, autoEncryptionOptions);

   重要提示：如果使用的是.NET/ C#驱动程序版本3.0或更高版本，则必须在实例化新的MongoClient之前将以下代码添加到应用程序中：

   MongoClientSettings.Extensions.AddAutoEncryption(); // .NET/C# Driver v3.0 or later only

   使用连接 URI 和自动加密选项实例化新的MongoClient ：

   var clientSettings = MongoClientSettings.FromConnectionString(uri);
   clientSettings.AutoEncryptionOptions = qeHelpers.GetAutoEncryptionOptions(
       keyVaultNamespace,
       kmsProviderCredentials);
   var encryptedClient = new MongoClient(clientSettings);

   encryptedClient, err := mongo.Connect(
   	context.TODO(),
   	options.Client().ApplyURI(uri).SetAutoEncryptionOptions(autoEncryptionOptions),
   )
   if err != nil {
   	panic(fmt.Sprintf("Unable to connect to MongoDB: %v\n", err))
   }
   defer func() {
   	_ = encryptedClient.Disconnect(context.TODO())
   }()

   MongoClientSettings clientSettings = MongoClientSettings.builder()
           .applyConnectionString(new ConnectionString(uri))
           .autoEncryptionSettings(autoEncryptionSettings)
           .build();
   try (MongoClient encryptedClient = MongoClients.create(clientSettings)) {

   const encryptedClient = new MongoClient(uri, {
     autoEncryption: autoEncryptionOptions,
   });

   encrypted_client = MongoClient(
       uri, auto_encryption_opts=auto_encryption_options)

5. 指定要加密的字段

   如要加密字段，请将其添加到加密模式中。要启用对字段的查询，请添加“queries”属性。创建加密模式，如下所示：

   MongoDB Shell

   C#

   Go

   Java (Sync)

   Node.js

   Python

   const encryptedFieldsMap = {
     encryptedFields: {
       fields: [
         {
           path: "patientRecord.ssn",
           bsonType: "string",
           queries: { queryType: "equality" },
         },
         {
           path: "patientRecord.billing",
           bsonType: "object",
         },
       ],
     },
   };

   var encryptedFields = new BsonDocument
   {
       {
           "fields", new BsonArray
           {
               new BsonDocument
               {
                   { "keyId", BsonNull.Value },
                   { "path", "patientRecord.ssn" },
                   { "bsonType", "string" },
                   { "queries", new BsonDocument("queryType", "equality") }
               },
               new BsonDocument
               {
                   { "keyId", BsonNull.Value },
                   { "path", "patientRecord.billing" },
                   { "bsonType", "object" }
               }
           }
       }
   };

   encryptedFieldsMap := bson.M{
   	"fields": []bson.M{
   		bson.M{
   			"keyId":    nil,
   			"path":     "patientRecord.ssn",
   			"bsonType": "string",
   			"queries": []bson.M{
   				{
   					"queryType": "equality",
   				},
   			},
   		},
   		bson.M{
   			"keyId":    nil,
   			"path":     "patientRecord.billing",
   			"bsonType": "object",
   		},
   	},
   }

   BsonDocument encryptedFieldsMap = new BsonDocument().append("fields",
           new BsonArray(Arrays.asList(
                   new BsonDocument()
                           .append("keyId", new BsonNull())
                           .append("path", new BsonString("patientRecord.ssn"))
                           .append("bsonType", new BsonString("string"))
                           .append("queries", new BsonDocument()
                                   .append("queryType", new BsonString("equality"))),
                   new BsonDocument()
                           .append("keyId", new BsonNull())
                           .append("path", new BsonString("patientRecord.billing"))
                           .append("bsonType", new BsonString("object")))));

   const encryptedFieldsMap = {
     encryptedFields: {
       fields: [
         {
           path: "patientRecord.ssn",
           bsonType: "string",
           queries: { queryType: "equality" },
         },
         {
           path: "patientRecord.billing",
           bsonType: "object",
         },
       ],
     },
   };

   encrypted_fields_map = {
       "fields": [
           {
               "path": "patientRecord.ssn",
               "bsonType": "string",
               "queries": [{"queryType": "equality"}]
           },
           {
               "path": "patientRecord.billing",
               "bsonType": "object",
           }
       ]
   }

   注意

   在前面的代码示例中，“ssn”和“billing”字段都经过加密，但只能查询“ssn”字段。

6. 创建集合

   实例化 ClientEncryption 以访问加密辅助方法的 API。

   MongoDB Shell

   C#

   Go

   Java (Sync)

   Node.js

   Python

   const clientEncryption = encryptedClient.getClientEncryption();

   var clientEncryptionOptions = new ClientEncryptionOptions(
       keyVaultClient: keyVaultClient,
       keyVaultNamespace: keyVaultNamespace,
       kmsProviders: kmsProviderCredentials
   );
   var clientEncryption = new ClientEncryption(clientEncryptionOptions);

   opts := options.ClientEncryption().
   	SetKeyVaultNamespace(keyVaultNamespace).
   	SetKmsProviders(kmsProviderCredentials)
   clientEncryption, err := mongo.NewClientEncryption(encryptedClient, opts)
   if err != nil {
   	panic(fmt.Sprintf("Unable to create a ClientEncryption instance due to the following error: %s\n", err))
   }

   ClientEncryptionSettings clientEncryptionSettings = ClientEncryptionSettings.builder()
           .keyVaultMongoClientSettings(MongoClientSettings.builder()
                   .applyConnectionString(new ConnectionString(uri))
                   .build())
           .keyVaultNamespace(keyVaultNamespace)
           .kmsProviders(kmsProviderCredentials)
           .build();
   ClientEncryption clientEncryption = ClientEncryptions.create(clientEncryptionSettings);

   const clientEncryption = new ClientEncryption(
     encryptedClient,
     autoEncryptionOptions
   );

   client_encryption = ClientEncryption(
       kms_providers=kms_provider_credentials,
       key_vault_namespace=key_vault_namespace,
       key_vault_client=encrypted_client,
       codec_options=CodecOptions(uuid_representation=STANDARD)
   )

   由于您使用的是本地客户主密钥，因此您无需提供客户主密钥凭证。创建一个变量，其中包含一个空对象，用于在您创建加密集合时代替凭证。

   MongoDB Shell

   C#

   Go

   Java (Sync)

   Node.js

   Python

   customerMasterKeyCredentials = {};

   var customerMasterKeyCredentials = new BsonDocument();

   cmkCredentials := map[string]string{}

   BsonDocument customerMasterKeyCredentials = new BsonDocument();

   customerMasterKeyCredentials = {};

   customer_master_key_credentials = {}
   MongoDB Shell

   C#

   Go

   Java (Sync)

   Node.js

   Python

   使用可通过ClientEncryption类访问的加密助手方法创建加密集合。 此方法自动为加密字段生成数据加密密钥并创建加密集合：

   await clientEncryption.createEncryptedCollection(
     encryptedDatabaseName,
     encryptedCollectionName,
     {
       provider: kmsProviderName,
       createCollectionOptions: encryptedFieldsMap,
       masterKey: customerMasterKeyCredentials,
     }
   );

   本教程的 C# 版本使用单独的类作为 Realm 数据模型来表示文档结构。将以下Patient 、 PatientRecord和PatientBilling类添加到您的项目中：

   using MongoDB.Bson;
   using MongoDB.Bson.Serialization.Attributes;
   [BsonIgnoreExtraElements]
   public class Patient
   {
       public ObjectId Id { get; set; }
       public string PatientName { get; set; }
       public PatientRecord PatientRecord { get; set; }
   }

   public class PatientRecord
   {
       public string Ssn { get; set; }
       public PatientBilling Billing { get; set; }
       public int BillAmount { get; set; }
   }

   public class PatientBilling
   {
       public string CardType { get; set; }
       public long CardNumber { get; set; }
   }

   添加这些类后，使用可通过ClientEncryption类访问的加密助手方法创建加密collection。此方法自动为字段生成数据加密密钥并创建加密collection：

   var createCollectionOptions = new CreateCollectionOptions<Patient>
   {
       EncryptedFields = encryptedFields
   };
   clientEncryption.CreateEncryptedCollection(patientDatabase,
       encryptedCollectionName,
       createCollectionOptions,
       kmsProviderName,
       customerMasterKeyCredentials);

   创建加密集合的方法需要引用数据库对象，而不是数据库名称。可以通过在客户端对象上使用方法来获取此引用。

   本教程的Go版本使用数据模型来表示文档结构。 将以下结构体添加到项目中以表示集合中的数据：

   type PatientDocument struct {
   	PatientName   string        `bson:"patientName"`
   	PatientID     int32         `bson:"patientId"`
   	PatientRecord PatientRecord `bson:"patientRecord"`
   }

   type PatientRecord struct {
   	SSN        string      `bson:"ssn"`
   	Billing    PaymentInfo `bson:"billing"`
   	BillAmount int         `bson:"billAmount"`
   }

   type PaymentInfo struct {
   	Type   string `bson:"type"`
   	Number string `bson:"number"`
   }

   添加这些类后，使用可通过ClientEncryption类访问的加密助手方法创建加密collection。此方法自动为字段生成数据加密密钥并创建加密collection：

   createCollectionOptions := options.CreateCollection().SetEncryptedFields(encryptedFieldsMap)
   _, _, err =
   	clientEncryption.CreateEncryptedCollection(
   		context.TODO(),
   		encryptedClient.Database(encryptedDatabaseName),
   		encryptedCollectionName,
   		createCollectionOptions,
   		kmsProviderName,
   		customerMasterKey,
   	)

   创建加密集合的方法需要引用数据库对象，而不是数据库名称。可以通过在客户端对象上使用方法来获取此引用。

   使用可通过ClientEncryption类访问的加密助手方法创建加密集合。 此方法自动为加密字段生成数据加密密钥并创建加密集合：

   CreateCollectionOptions createCollectionOptions = new CreateCollectionOptions().encryptedFields(encryptedFieldsMap);
   CreateEncryptedCollectionParams encryptedCollectionParams = new CreateEncryptedCollectionParams(kmsProviderName);
   encryptedCollectionParams.masterKey(customerMasterKeyCredentials);
   try {
       clientEncryption.createEncryptedCollection(
               encryptedClient.getDatabase(encryptedDatabaseName),
               encryptedCollectionName,
               createCollectionOptions,
               encryptedCollectionParams);
   } 

   创建加密集合的方法需要引用数据库对象，而不是数据库名称。可以通过在客户端对象上使用方法来获取此引用。

   使用可通过ClientEncryption类访问的加密助手方法创建加密集合。 此方法自动为加密字段生成数据加密密钥并创建加密集合：

   注意

   导入 ClientEncryption

   使用 Node.js 驱动程序 v6.0 及更高版本时，必须从 mongodb 导入 ClientEncryption。

   对于较早的驱动程序版本，请从 mongodb-client-encryption 导入 ClientEncryption。

   await clientEncryption.createEncryptedCollection(
     encryptedDatabase,
     encryptedCollectionName,
     {
       provider: kmsProviderName,
       createCollectionOptions: encryptedFieldsMap,
       masterKey: customerMasterKeyCredentials,
     }
   );

   创建加密集合的方法需要引用数据库对象，而不是数据库名称。可以通过在客户端对象上使用方法来获取此引用。

   使用可通过ClientEncryption类访问的加密助手方法创建加密集合。 此方法自动为加密字段生成数据加密密钥并创建加密集合：

   client_encryption.create_encrypted_collection(
       encrypted_client[encrypted_database_name],
       encrypted_collection_name,
       encrypted_fields_map,
       kms_provider_name,
       customer_master_key_credentials,
   )

   创建加密集合的方法需要引用数据库对象，而不是数据库名称。可以通过在客户端对象上使用方法来获取此引用。

插入具有加密字段的文档

const patientDocument = {
  patientName: "Jon Doe",
  patientId: 12345678,
  patientRecord: {
    ssn: "987-65-4320",
    billing: {
      type: "Visa",
      number: "4111111111111111",
    },
    billAmount: 1500,
  },
};
const encryptedCollection = encryptedClient
  .getDB(encryptedDatabaseName)
  .getCollection(encryptedCollectionName);
const insertResult = await encryptedCollection.insertOne(patientDocument);

var patient = new Patient
{
    PatientName = "Jon Doe",
    Id = new ObjectId(),
    PatientRecord = new PatientRecord
    {
        Ssn = "987-65-4320",
        Billing = new PatientBilling
        {
            CardType = "Visa",
            CardNumber = 4111111111111111,
        },
        BillAmount = 1500
    }
};
var encryptedCollection = encryptedClient.GetDatabase(encryptedDatabaseName).
    GetCollection<Patient>(encryptedCollectionName);
encryptedCollection.InsertOne(patient);

patientDocument := &PatientDocument{
	PatientName: "Jon Doe",
	PatientID:   12345678,
	PatientRecord: PatientRecord{
		SSN: "987-65-4320",
		Billing: PaymentInfo{
			Type:   "Visa",
			Number: "4111111111111111",
		},
		BillAmount: 1500,
	},
}
coll := encryptedClient.Database(encryptedDatabaseName).Collection(encryptedCollectionName)
_, err = coll.InsertOne(context.TODO(), patientDocument)
if err != nil {
	panic(fmt.Sprintf("Unable to insert the patientDocument: %s", err))
}

CodecProvider pojoCodecProvider = PojoCodecProvider.builder().automatic(true).build();
CodecRegistry pojoCodecRegistry = fromRegistries(getDefaultCodecRegistry(), fromProviders(pojoCodecProvider));

MongoDatabase encryptedDb = encryptedClient.getDatabase(encryptedDatabaseName).withCodecRegistry(pojoCodecRegistry);
MongoCollection<Patient> collection = encryptedDb.getCollection(encryptedCollectionName, Patient.class);
PatientBilling patientBilling = new PatientBilling("Visa", "4111111111111111");
PatientRecord patientRecord = new PatientRecord("987-65-4320", patientBilling, 1500);
Patient patientDocument = new Patient("Jon Doe", patientRecord);
InsertOneResult result = collection.insertOne(patientDocument);

const patientDocument = {
  patientName: "Jon Doe",
  patientId: 12345678,
  patientRecord: {
    ssn: "987-65-4320",
    billing: {
      type: "Visa",
      number: "4111111111111111",
    },
    billAmount: 1500,
  },
};
const encryptedCollection = encryptedClient
  .db(encryptedDatabaseName)
  .collection(encryptedCollectionName);
const result = await encryptedCollection.insertOne(patientDocument);

patient_document = {
    "patientName": "Jon Doe",
    "patientId": 12345678,
    "patientRecord": {
        "ssn": "987-65-4320",
        "billing": {
            "type": "Visa",
            "number": "4111111111111111",
        },
        "billAmount": 1500,
    },
}
encrypted_collection = encrypted_client[encrypted_database_name][encrypted_collection_name]
result = encrypted_collection.insert_one(patient_document)

加密字段查询

下面的代码示例对加密字段执行查找查询，并打印解密后的数据：

const findResult = await encryptedCollection.findOne({
  "patientRecord.ssn": "987-65-4320",
});
console.log(findResult);

var ssnFilter = Builders<Patient>.Filter.Eq("patientRecord.ssn", patient.PatientRecord.Ssn);
var findResult = await encryptedCollection.Find(ssnFilter).ToCursorAsync();
Console.WriteLine(findResult.FirstOrDefault().ToJson());

var findResult PatientDocument
err = coll.FindOne(
	context.TODO(),
	bson.M{"patientRecord.ssn": "987-65-4320"},
).Decode(&findResult)

Patient findResult = collection.find(
    new BsonDocument()
            .append("patientRecord.ssn", new BsonString("987-65-4320")))
            .first();
 
System.out.println(findResult);

const findResult = await encryptedCollection.findOne({
  "patientRecord.ssn": "987-65-4320",
});
console.log(findResult);

find_result = encrypted_collection.find_one({
    "patientRecord.ssn": "987-65-4320"
})
print(find_result)

上述代码示例的输出应类似于以下内容：

{
  "_id": {
    "$oid": "648b384a722cb9b8392df76a"
  },
  "name": "Jon Doe",
  "record": {
    "ssn": "987-65-4320",
    "billing": {
      "type": "Visa",
      "number": "4111111111111111"
    },
    "billAmount": 1500
  },
  "__safeContent__": [
    {
      "$binary": {
        "base64": "L1NsYItk0Sg+oL66DBj6IYHbX7tveANQyrU2cvMzD9Y=",
        "subType": "00"
      }
    }
  ]
}