19. Encryption

db4o provides built-in encryption functionality.
In order to use it, the following two methods have to be called, before a database file is created:
Db4o.configure().encrypt(true); Db4o.configure().password("yourEncryptionPasswordHere");

The security standard of the built-in encryption functionality is not very high, not much more advanced than "substract 5 from every byte".
There are 2 reasons for not providing more advanced encryption functionality:
(1) The db4o library is designed to stay small and portable.
(2) The db4o team is determined to avoid problems with U.S. security regulations and export restrictions.
db4o still provides a solution for high-security encryption by allowing any user to choose his own encryption mechanism that he thinks he needs:
The db4o file IO mechanism is pluggable and any fixed-length encryption mechanism can be added. All that needs to be done is to write an IoAdapter plugin for db4o file IO.
This is a lot easier than it sounds. Simply:
- take the sources of com.db4o.io.RandomAccessFileAdapter as an example
- write your own IoAdapter implementation that delegates raw file access to another adapter using the GoF decorator pattern.
- Implement the #read() and #write() methods to encrypt and decrypt when bytes are being exchanged with the file
- plug your adapter into db4o with the following method:
Db4o.configure().io(new MyEncryptionAdapter());

However, you'll have to keep in mind that db4o will write partial udates. For example, it may write a full object and then only modify one field entry later one. Therefore it is not sufficient to en-/decrypt each access in isolation. You'll rather have to make up a tiling structure that defines the data chunks that have to be en-/decrypted together.
Another method to inject encryption capabilities into db4o for instances of specific classes only is to implement and configure an en-/decrypting translator.


--
generated by
Doctor courtesy of db4objects Inc.