在Spring中如何加密文档或限制其对具有特定角色的用户的访问

Question

I am working on a business platform which allows users of different roles to interact with each other based on their roles. the application is built using Spring + WebSecurityConfig based RBAC.

I need to allow users, when uploading documents to the system, to control who is able to open those documents, even if they were downloaded by some one who has access, only people with specific credentials should be able to open those document. Knowing that the documents are Physically saved in the files system.

Is there for example scripts that I can use to encrypt documents with a password, that I can save in my DB and show only to the privileged users? or there are better approaches.

Answer 1

A solution would be create a service to get a shared secret from DB and allow only privileged users to invoke this service. It would be a good idea encrypt the DB field where you store the secret.

With that you could encrypt and decrypt files using any symmetric key algorithm. For example here is a example using AES that only requires javax.crypto API: https://www.mkyong.com/java/java-symmetric-key-cryptography-example/