Overloading a Native PHP Function to Encrypt Data for HIPAA Compliance

Question

Background Information:

I'm part of a team of developers that runs a web application that stores and retrieves HIPAA (medical) data. Recently, the HIPAA guidelines were updated to include a policy that requires that all identifying client information be encrypted when it is "at rest" (stored in the database and not being accessed).

The Initial Problem

The first problem we had to tackle was determining the best way to two-way encrypt the data in a manner that makes the data secure in the event of a breach.

The initial Solution

The quickest solution we came up with was to use mcrypt to encrypt the data before we inserted it into the database.

The New Problem

The application we're developing is quite old (as web applications go) and uses a lot of procedural programming as well as heavy reliance on the mysql_query function to insert, update, retrieve, and delete data. We do not have the time or luxury of translating our code to a database-abstraction-layer. So, the only way to implement this encryption/decryption system is to manually edit all of the CRUD queries to use data that's been encrypted via mcrypt. This is very inefficient and extremely error-prone.

Our Proposed Solution

We decided that the fastest and most effective way to solve our problem is to overwrite the native mysql_query function with one of our own devising. In our new function, we would encrypt/decrypt the data values before sending the query to the server/ returning the resultset.

Where You Folks Come In

1. Is this the best solution to solving our initial problem?
2. How do you go about overwriting an existing, core PHP function?

Answer 1

Although you've previously stated you can't/won't translate your code into a database abstraction layer, I believe that would be the ideal solution. Sure, it's a lot more work right now, but it pays off. What you've proposed is a hack, that can (and probably will) lead to errors and headaches in the future.

The next best thing would be to encrypt the whole database, as proposed in the comments. There are solutions out there for transparent encryption in different levels, ie: this or this

Another thing you might want to look into is MySQL's native encryption and decryption functions, which could be used to implement column-level encryption if you're concerned about performance.

Answer 2

While the best solution would be the abstraction layer that the other answers have suggested, you can override existing PHP functions with your own versions with the PECL Runkit extension

Something like:

runkit_function_rename ( 'mysql_query', 'mysql_query_old' );
function mysql_query ( $query , $link_identifier=null ) {
   // modify $query here for UPDATE/DELETE statement and any WHERE clause, etc
   $newQuery = modifyQuery($query);

   if (is_null($link_identifier)) {
      $result = mysql_query_old ( $newQuery);
   } else {
      $result = mysql_query_old ( $newQuery, $link_identifier);
   }
   // modify $result here for returned data from any SELECT statement
   return modifyResult($result);
}

Note: By default, only userspace functions may be removed, renamed, or modified. In order to override internal functions, you must enable the runkit.internal_override setting in php.ini.

It's not a solution I'd really recommend. I had to do something similar some years back in java, where it was far easier to extend jdbc; but while parsing the syntax of SQL queries is hard enough, it gets harder still if your queries are using bind variables. Watch out for escaped strings! Watch out for any use of related function like mysql_db_query, just in case they're used alongside mysql_query within the application!

Apologies for shaky typing. My wife has been bouncing our router a few times while I'be been writing this suggestion

Answer 3

I think one way of handling this automatically would be to look into MySQL proxy

and implement encryption through that. I played around with it 2 or so years ago when it was in a very early stages, and from what I remember it could basically intercept requests and do 'stuff' with them :) No code change required essentially. Hopefully this helps.