database::security::encryption_manager Class Reference

Data encryption and key management. More...

#include <secure_connection.h>

Collaboration diagram for database::security::encryption_manager:

Public Member Functions
	encryption_manager ()=default
	Default constructor - used by database_context.
std::string	encrypt_field_data (const std::string &data, const std::string &field_name) const
std::string	decrypt_field_data (const std::string &encrypted_data, const std::string &field_name) const
bool	generate_field_key (const std::string &field_name)
bool	rotate_field_key (const std::string &field_name)
void	set_master_encryption_key (const std::string &key)
bool	configure_encrypted_column (const std::string &table, const std::string &column, encryption_type type)
bool	is_column_encrypted (const std::string &table, const std::string &column) const

Private Member Functions
std::string	derive_key (const std::string &field_name) const

Private Attributes
std::mutex	encryption_mutex_
std::string	master_key_
std::unordered_map< std::string, std::string >	field_keys_
std::unordered_map< std::string, encryption_type >	encrypted_columns_

Detailed Description

Data encryption and key management.

Note

This class uses dependency injection pattern. Access via database_context::get_encryption_manager() (Sprint 3, Task 3.3).

Example:

auto context = std::make_shared<database_context>();
auto enc_mgr = context->get_encryption_manager();

Definition at line 395 of file secure_connection.h.

Constructor & Destructor Documentation

encryption_manager()

database::security::encryption_manager::encryption_manager ( )

default

Default constructor - used by database_context.

Member Function Documentation

configure_encrypted_column()

bool database::security::encryption_manager::configure_encrypted_column	(	const std::string &	table,
		const std::string &	column,
		encryption_type	type )

Definition at line 642 of file secure_connection.cpp.

    {
        std::lock_guard<std::mutex> lock(encryption_mutex_);
        std::string key = table + "." + column;
        encrypted_columns_[key] = type;
 
        // Auto-generate field key if not present
        if (field_keys_.find(key) == field_keys_.end())
        {
            // Temporarily release lock to call generate_field_key
            // Instead, inline the key generation
            std::random_device rd;
            std::mt19937 gen(rd());
            std::uniform_int_distribution<> dis(0, 255);
 
            std::string field_key(32, '\0');
            for (auto& c : field_key)
            {
                c = static_cast<char>(dis(gen));
            }
 
            std::ostringstream oss;
            for (unsigned char ch : field_key)
            {
                oss << std::hex << std::setfill('0') << std::setw(2)
                    << static_cast<int>(ch);
            }
            field_keys_[key] = oss.str();
        }
 
        return true;
    }

References encrypted_columns_, encryption_mutex_, and field_keys_.

decrypt_field_data()

std::string database::security::encryption_manager::decrypt_field_data	(	const std::string &	encrypted_data,
		const std::string &	field_name ) const

Definition at line 499 of file secure_connection.cpp.

    {
        std::lock_guard<std::mutex> lock(encryption_mutex_);
 
        if (encrypted_data.empty())
        {
            return {};
        }
 
        std::string key = derive_key(field_name);
        if (key.empty())
        {
            return {};
        }
 
#ifdef DATABASE_HAS_OPENSSL
        // AES-256-GCM decryption
        if (encrypted_data.substr(0, 4) == "aes:")
        {
            key.resize(32, '\0');
 
            auto first = encrypted_data.find(':', 4);
            auto second = encrypted_data.find(':', first + 1);
            if (first == std::string::npos || second == std::string::npos) return {};
 
            auto iv = hex_to_bytes(encrypted_data.substr(4, first - 4));
            auto ciphertext = hex_to_bytes(encrypted_data.substr(first + 1, second - first - 1));
            auto tag = hex_to_bytes(encrypted_data.substr(second + 1));
 
            EVP_CIPHER_CTX* ctx = EVP_CIPHER_CTX_new();
            if (!ctx) return {};
 
            std::vector<uint8_t> plaintext(ciphertext.size() + EVP_MAX_BLOCK_LENGTH);
            int len = 0, pt_len = 0;
 
            EVP_DecryptInit_ex(ctx, EVP_aes_256_gcm(), nullptr, nullptr, nullptr);
            EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, static_cast<int>(iv.size()), nullptr);
            EVP_DecryptInit_ex(ctx, nullptr, nullptr,
                               reinterpret_cast<const unsigned char*>(key.data()), iv.data());
            EVP_DecryptUpdate(ctx, plaintext.data(), &len,
                              ciphertext.data(), static_cast<int>(ciphertext.size()));
            pt_len = len;
            EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_TAG, static_cast<int>(tag.size()),
                                const_cast<uint8_t*>(tag.data()));
 
            int ret = EVP_DecryptFinal_ex(ctx, plaintext.data() + len, &len);
            EVP_CIPHER_CTX_free(ctx);
 
            if (ret <= 0) return {};
            pt_len += len;
            return std::string(plaintext.begin(), plaintext.begin() + pt_len);
        }
#endif
 
        // Legacy XOR format
        std::string hex_data = encrypted_data;
        if (hex_data.substr(0, 4) == "xor:")
        {
            hex_data = hex_data.substr(4);
        }
 
        std::string decoded;
        decoded.reserve(hex_data.size() / 2);
        for (size_t i = 0; i + 1 < hex_data.size(); i += 2)
        {
            unsigned int byte = 0;
            std::istringstream iss(hex_data.substr(i, 2));
            iss >> std::hex >> byte;
            decoded.push_back(static_cast<char>(byte));
        }
 
        for (size_t i = 0; i < decoded.size(); ++i)
        {
            decoded[i] ^= key[i % key.size()];
        }
 
        return decoded;
    }

References derive_key(), and encryption_mutex_.

Here is the call graph for this function:

derive_key()

std::string database::security::encryption_manager::derive_key ( const std::string & field_name ) const

private

Definition at line 685 of file secure_connection.cpp.

    {
        // Check for field-specific key first
        auto it = field_keys_.find(field_name);
        if (it != field_keys_.end())
        {
            return it->second;
        }
 
        // Fall back to master key
        if (!master_key_.empty())
        {
            return master_key_;
        }
 
        return {};
    }

References field_keys_, and master_key_.

Referenced by decrypt_field_data(), and encrypt_field_data().

Here is the caller graph for this function:

encrypt_field_data()

std::string database::security::encryption_manager::encrypt_field_data	(	const std::string &	data,
		const std::string &	field_name ) const

Definition at line 433 of file secure_connection.cpp.

    {
        std::lock_guard<std::mutex> lock(encryption_mutex_);
 
        if (data.empty())
        {
            return {};
        }
 
        std::string key = derive_key(field_name);
        if (key.empty())
        {
            return {};
        }
 
#ifdef DATABASE_HAS_OPENSSL
        // AES-256-GCM field encryption with derived key
        key.resize(32, '\0');  // Ensure 256-bit key
 
        constexpr int iv_len = 12;
        constexpr int tag_len = 16;
 
        std::vector<uint8_t> iv(iv_len);
        RAND_bytes(iv.data(), iv_len);
 
        EVP_CIPHER_CTX* ctx = EVP_CIPHER_CTX_new();
        if (!ctx) return {};
 
        std::vector<uint8_t> ciphertext(data.size() + EVP_MAX_BLOCK_LENGTH);
        std::vector<uint8_t> tag(tag_len);
        int len = 0, ct_len = 0;
 
        EVP_EncryptInit_ex(ctx, EVP_aes_256_gcm(), nullptr, nullptr, nullptr);
        EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_SET_IVLEN, iv_len, nullptr);
        EVP_EncryptInit_ex(ctx, nullptr, nullptr,
                           reinterpret_cast<const unsigned char*>(key.data()), iv.data());
        EVP_EncryptUpdate(ctx, ciphertext.data(), &len,
                          reinterpret_cast<const unsigned char*>(data.data()),
                          static_cast<int>(data.size()));
        ct_len = len;
        EVP_EncryptFinal_ex(ctx, ciphertext.data() + len, &len);
        ct_len += len;
        EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_GCM_GET_TAG, tag_len, tag.data());
        EVP_CIPHER_CTX_free(ctx);
 
        ciphertext.resize(ct_len);
        return "aes:" + bytes_to_hex(iv) + ":" + bytes_to_hex(ciphertext) + ":" + bytes_to_hex(tag);
#else
        // XOR-based field encryption (placeholder)
        std::string result = data;
        for (size_t i = 0; i < result.size(); ++i)
        {
            result[i] ^= key[i % key.size()];
        }
 
        std::ostringstream oss;
        for (unsigned char c : result)
        {
            oss << std::hex << std::setfill('0') << std::setw(2)
                << static_cast<int>(c);
        }
        return "xor:" + oss.str();
#endif
    }

References derive_key(), and encryption_mutex_.

Here is the call graph for this function:

generate_field_key()

bool database::security::encryption_manager::generate_field_key

(

const std::string &

field_name

)

Definition at line 579 of file secure_connection.cpp.

    {
        std::lock_guard<std::mutex> lock(encryption_mutex_);
 
        // Generate a random key for the field
        std::random_device rd;
        std::mt19937 gen(rd());
        std::uniform_int_distribution<> dis(0, 255);
 
        std::string key(32, '\0');
        for (auto& c : key)
        {
            c = static_cast<char>(dis(gen));
        }
 
        // Hex-encode the key for storage
        std::ostringstream oss;
        for (unsigned char c : key)
        {
            oss << std::hex << std::setfill('0') << std::setw(2)
                << static_cast<int>(c);
        }
        field_keys_[field_name] = oss.str();
        return true;
    }

References encryption_mutex_, and field_keys_.

is_column_encrypted()

bool database::security::encryption_manager::is_column_encrypted	(	const std::string &	table,
		const std::string &	column ) const

Definition at line 677 of file secure_connection.cpp.

    {
        std::lock_guard<std::mutex> lock(encryption_mutex_);
        std::string key = table + "." + column;
        return encrypted_columns_.find(key) != encrypted_columns_.end();
    }

References encrypted_columns_, and encryption_mutex_.

rotate_field_key()

bool database::security::encryption_manager::rotate_field_key

(

const std::string &

field_name

)

Definition at line 605 of file secure_connection.cpp.

    {
        std::lock_guard<std::mutex> lock(encryption_mutex_);
 
        auto it = field_keys_.find(field_name);
        if (it == field_keys_.end())
        {
            return false;
        }
 
        // Generate new key (in production, would re-encrypt existing data)
        std::random_device rd;
        std::mt19937 gen(rd());
        std::uniform_int_distribution<> dis(0, 255);
 
        std::string key(32, '\0');
        for (auto& c : key)
        {
            c = static_cast<char>(dis(gen));
        }
 
        std::ostringstream oss;
        for (unsigned char c : key)
        {
            oss << std::hex << std::setfill('0') << std::setw(2)
                << static_cast<int>(c);
        }
        it->second = oss.str();
        return true;
    }

References encryption_mutex_, and field_keys_.

set_master_encryption_key()

void database::security::encryption_manager::set_master_encryption_key

(

const std::string &

key

)

Definition at line 636 of file secure_connection.cpp.

    {
        std::lock_guard<std::mutex> lock(encryption_mutex_);
        master_key_ = key;
    }

References encryption_mutex_, and master_key_.

Member Data Documentation

encrypted_columns_

std::unordered_map<std::string, encryption_type> database::security::encryption_manager::encrypted_columns_

private

Definition at line 423 of file secure_connection.h.

Referenced by configure_encrypted_column(), and is_column_encrypted().

encryption_mutex_

std::mutex database::security::encryption_manager::encryption_mutex_

mutableprivate

Definition at line 420 of file secure_connection.h.

Referenced by configure_encrypted_column(), decrypt_field_data(), encrypt_field_data(), generate_field_key(), is_column_encrypted(), rotate_field_key(), and set_master_encryption_key().

field_keys_

std::unordered_map<std::string, std::string> database::security::encryption_manager::field_keys_

private

Definition at line 422 of file secure_connection.h.

Referenced by configure_encrypted_column(), derive_key(), generate_field_key(), and rotate_field_key().

master_key_

std::string database::security::encryption_manager::master_key_

private

Definition at line 421 of file secure_connection.h.

Referenced by derive_key(), and set_master_encryption_key().

---

The documentation for this class was generated from the following files:

• database/security/secure_connection.h
• database/security/secure_connection.cpp