Secure Drupal User Profile Information

Question

I need to secure the user profile information, which contains predefined & custom fields such as username, profile picture & phone number.

I do need to encrypt & store it in DB. And then decrypt to display output.

Do anyone know, does encryption for fields is possible?

Answer 1

Yes it's possible only if you do it programatically for this. You can use hook_entity_presave() and update encrypted values while saving user. And while retrieving data/fields you can decrypt with the key that you used for encryption and show in profile view page. Example:

/**
 *
 * @param array $edit
 * @param type $account
 * @param type $category
 */
function example_user_presave(&$edit, $account, $category) {
  $name = $edit['name']; // Get value of field.
  $edit['name'] = encrypt($name); // Encrypt and save.
}

/**
 * Returns encrypted string
 */
function encrypt($pure_string) {
  $encryption_key = 'SECRET';
  $encrypted_string = openssl_encrypt($pure_string, "AES-128-ECB", $encryption_key);
  return $encrypted_string;
}

/**
 * Returns decrypted original string
 */
function decrypt($encrypted_string) {
  $encryption_key = 'SECRET';
  $decrypted_string = openssl_decrypt($encrypted_string, "AES-128-ECB", $encryption_key);
  return $decrypted_string;
}

Answer 2

Have a look at this https://www.drupal.org/project/field_encrypt

This module adds options to encrypt field values.

The goal of this module is to create a method for encrypting field values when stored in the database.

This module depends on the Encrypt module (http://drupal.org/project/encrypt) for encrypting and decrypting strings.

Install this module like any other module. Field encryption settings are made on the field edit page.