Microservices Integration: End-to-End Encryption

@Service
public class PaymentService {
  @Autowired
  private AnkaSecureClient crypto;

  @Autowired
  private RestTemplate restTemplate;

  public void processPayment(PaymentRequest payment) {
    // Encrypt sensitive payment data
    byte[] encrypted = crypto.encrypt(EncryptRequest.builder()
      .algorithm("ML_KEM_1024")
      .plaintext(payment.toJson().getBytes())
      .build()).getCiphertext();

    // Send encrypted data to Notification Service
    restTemplate.postForObject(
      "https://notification-service/notify",
      new EncryptedPayload(encrypted),
      Void.class
    );
  }
}

@Service
public class NotificationService {
  @Autowired
  private AnkaSecureClient crypto;

  @PostMapping("/notify")
  public void sendNotification(@RequestBody EncryptedPayload payload) {
    // Decrypt payment data
    byte[] plaintext = crypto.decrypt(DecryptRequest.builder()
      .ciphertext(payload.getCiphertext())
      .build()).getPlaintext();

    PaymentRequest payment = PaymentRequest.fromJson(new String(plaintext));

    // Send notification (email, SMS, etc.)
    emailService.send(payment.getCustomerEmail(), "Payment processed");
  }
}

// Payment Service
@Configuration
public class PaymentCryptoConfig {
  @Bean
  public AnkaSecureClient paymentCrypto() {
    return new AnkaSecureClient(apiKey, "payment-service-key");
  }
}

// User Service
@Configuration
public class UserCryptoConfig {
  @Bean
  public AnkaSecureClient userCrypto() {
    return new AnkaSecureClient(apiKey, "user-service-key");
  }
}

// Payment API (encrypts sensitive data)
@PostMapping("/payments")
public ResponseEntity<String> createPayment(@RequestBody PaymentRequest req) {
  // Encrypt PAN (Primary Account Number)
  byte[] encryptedPAN = crypto.encrypt(EncryptRequest.builder()
    .algorithm("ML_KEM_1024")
    .plaintext(req.getPan().getBytes())
    .build()).getCiphertext();

  // Send to Fraud Detection (encrypted)
  fraudService.analyze(new EncryptedPayment(encryptedPAN, req.getAmount()));

  return ResponseEntity.ok("Payment processing");
}

// Fraud Detection Service (analyzes WITHOUT decrypting PAN)
@Service
public class FraudDetectionService {
  public FraudScore analyze(EncryptedPayment payment) {
    // Analyze based on amount, patterns (PAN stays encrypted!)
    if (payment.getAmount() > 10000) {
      return FraudScore.HIGH_RISK;
    }
    // PAN never decrypted (fraud detection doesn't need it)
  }
}

// Transaction DB Service (stores encrypted only)
@Service
public class TransactionRepository {
  public void save(EncryptedPayment payment) {
    // Store ciphertext in database
    db.insert("INSERT INTO payments (pan_encrypted) VALUES (?)",
      payment.getEncryptedPAN());
    // PAN never in plaintext in database!
  }
}

// User Service (encrypts PII)
public void createUser(User user) {
  UserRecord record = new UserRecord();
  record.setId(user.getId());

  // Encrypt PII
  record.setEncryptedPII(crypto.encrypt(user.getPII()));

  // Plaintext metadata (for analytics)
  record.setCountry(user.getCountry());
  record.setSignupDate(user.getSignupDate());

  database.save(record);
}

// Analytics Service (analyzes metadata only)
public UserStats getStats() {
  // Queries COUNT, country, signupDate (NOT PII)
  return db.query("SELECT country, COUNT(*) FROM users GROUP BY country");
  // PII stays encrypted (Analytics never decrypts)
}

@Configuration
public class AnkaSecureCon fig {
  @Bean
  public AnkaSecureClient client() {
    return AnkaSecureClient.builder()
      .apiKey(token)
      .connectionPoolSize(50)  // Reuse up to 50 connections
      .keepAliveTimeout(Duration.ofMinutes(5))
      .build();
  }
}

@Service
public class CachingEncryptionService {
  @Cacheable(value = "ciphertexts", key = "#plaintext")
  public byte[] encrypt(String plaintext) {
    return crypto.encrypt(EncryptRequest.builder()
      .algorithm("ML_KEM_1024")
      .plaintext(plaintext.getBytes())
      .build()).getCiphertext();
  }
}