Backend Encryption — Data Encryption Strategies for Backend Systems

const crypto = require('crypto');

const ALGORITHM = 'aes-256-gcm';
const KEY = Buffer.from(process.env.ENCRYPTION_KEY, 'hex');

function encrypt(text) {
  const iv = crypto.randomBytes(16);
  const cipher = crypto.createCipheriv(ALGORITHM, KEY, iv);
  const encrypted = Buffer.concat([cipher.update(text, 'utf8'), cipher.final()]);
  const tag = cipher.getAuthTag();

  return {
    encrypted: encrypted.toString('base64'),
    iv: iv.toString('base64'),
    tag: tag.toString('base64')
  };
}

function decrypt(encrypted, iv, tag) {
  const decipher = crypto.createDecipheriv(
    ALGORITHM, KEY, Buffer.from(iv, 'base64')
  );
  decipher.setAuthTag(Buffer.from(tag, 'base64'));
  const decrypted = Buffer.concat([
    decipher.update(Buffer.from(encrypted, 'base64')),
    decipher.final()
  ]);
  return decrypted.toString('utf8');
}

// Field-level encryption decorator
function encryptedField(target, propertyKey) {
  const privateKey = Symbol(propertyKey);
  Object.defineProperty(target, propertyKey, {
    get() { return this[privateKey] ? decrypt(this[privateKey], this[`${propertyKey}Iv`], this[`${propertyKey}Tag`]) : null; },
    set(value) {
      if (value) {
        const result = encrypt(value);
        this[privateKey] = result.encrypted;
        this[`${propertyKey}Iv`] = result.iv;
        this[`${propertyKey}Tag`] = result.tag;
      }
    }
  });
}

// TLS configuration
const https = require('https');
const server = https.createServer({
  key: fs.readFileSync('/etc/ssl/private/server.key'),
  cert: fs.readFileSync('/etc/ssl/certs/server.crt'),
  minVersion: 'TLSv1.3',
  ciphers: ['TLS_AES_256_GCM_SHA384', 'TLS_CHACHA20_POLY1305_SHA256'],
  honorCipherOrder: true
}, app);