Add pluggable page-level AEAD encryption support

java/common/src/main/resources/org/apache/tsfile/i18n/messages.properties

@@ -636,6 +636,7 @@ log.read.block_reader_fill_measurements_error = Cannot fill measurements
 
 # TableResultSet — failed to close tsBlockReader
 log.read.table_result_set_close_error = Failed to close tsBlockReader
+log.read.tree_result_set_close_error = Failed to close tree query dataset
 
 # DeviceMetaIterator — failed to load device meta data
 log.read.device_meta_iterator_error = Failed to load device meta data
@@ -1117,6 +1118,44 @@ error.encrypt.encrypt_no_constructor = Get constructor for encryptor failed: %1$
 # EncryptUtils.getEncrypt — instantiation failed (encryptType arg)
 error.encrypt.encrypt_instantiation_failed = New encryptor instance failed: %1$s
 
+# EncryptionProviderRegistry — provider registration and lookup
+error.encrypt.invalid_provider_id = Encryption provider id must not be null or empty
+error.encrypt.duplicate_provider = Encryption provider id is already registered: %1$s
+error.encrypt.provider_not_found = Encryption provider is not registered: %1$s
+error.encrypt.provider_returned_null = Encryption provider returned null: %1$s
+
+# EncryptParameter — use after sensitive state was destroyed
+error.encrypt.parameter_destroyed = Encryption parameters have been destroyed
+error.encrypt.invalid_page_body_overhead = Invalid page body overhead %1$s for encryption profile %2$s
+error.encrypt.page_body_too_short = Encrypted page body size %1$s is smaller than AEAD overhead %2$s
+error.encrypt.page_context_invalid_parameter = Page crypto context requires page AEAD parameters
+error.encrypt.page_aead_encrypt_unsupported = Encryptor %1$s does not implement authenticated page encryption
+error.encrypt.page_aead_decrypt_unsupported = Decryptor %1$s does not implement authenticated page decryption
+error.encrypt.page_context_invalid_file_id = Page crypto context requires a 16-byte file crypto id
+error.encrypt.page_context_invalid_chunk_ordinal = Page crypto context requires a nonnegative chunk ordinal
+error.encrypt.page_read_requires_chunk_ordinal = Page-AEAD files require readPage(header, type, pageIndex, chunkOrdinal)
+error.encrypt.chunk_ordinal_exhausted = File chunk ordinal space is exhausted
+error.write.invalid_chunk_ordinal = Encrypted chunks require a file-unique chunk ordinal
+error.write.unencrypted_chunk_has_ordinal = Unencrypted chunks must not have a chunk ordinal
+error.write.aead_append_requires_file_header = Cannot append encrypted data to a file without an encryption header
+error.write.encrypted_chunk_copy_unsupported = Encrypted chunks must be decrypted and re-encrypted before copying
+error.encrypt.page_context_invalid_sizes = Invalid page crypto context values, uncompressed size: %1$s, compressed plaintext size: %2$s, page index: %3$s
+error.encrypt.page_output_size_mismatch = AEAD page output size mismatch, expected %1$s bytes but got %2$s
+error.encrypt.page_plaintext_size_mismatch = AEAD page plaintext size mismatch, expected %1$s bytes but got %2$s
+error.chunk.merge_page_aead_unsupported = Page-AEAD encrypted chunks must be decrypted and rewritten before merging
+
+# FileEncryptionHeader — malformed or unsupported file encryption metadata
+error.file.encryption_header_invalid_size = Invalid file encryption header size: %1$s
+error.file.encryption_header_unsupported_version = Unsupported file encryption header version: %1$s
+error.file.encryption_header_malformed = Malformed file encryption header
+error.file.encryption_header_trailing_bytes = File encryption header contains trailing bytes
+error.file.encryption_header_invalid_component_size = Invalid file encryption header component size: %1$s
+error.file.encryption_header_truncated = File encryption header is truncated, expected %1$s bytes but read %2$s
+error.file.encryption_header_invalid_field = Invalid file encryption header field: %1$s
+error.write.encryption_header_must_precede_data = File encryption header must be written before TsFile data
+error.write.encrypted_chunk_context_mismatch = Encrypted chunks must use the destination file encryption context
+error.write.encryption_context_immutable = The file encryption context cannot change after its header is written
+
 # === compress ===
 
 # ICompressor.getCompressor / IUnCompressor.getUnCompressor — null type
@@ -1573,3 +1612,14 @@ error.utils.table_point_count_tool_file_not_found = TsFile does not exist: %1$s
 error.utils.table_point_count_tool_incomplete_file = TsFile is incomplete: %1$s
 error.utils.table_point_count_tool_copy_failed = Failed to copy the TsFile data and metadata prefix
 info.utils.table_point_count_tool_result = Processed %1$s: %2$s
+error.write.aead_raw_page_copy_unsupported = Raw page copying is not supported for page AEAD; decrypt and re-encrypt with the target file context
+error.encrypt.file_context_already_used = Encryption context already belongs to a new file; generate a new DEK and file identity
+error.encrypt.provider_discovery_failed = Encryption provider discovery failed
+error.encrypt.page_aead_operations_missing = Page AEAD provider must supply an encryptor and a decryptor
+error.encrypt.page_aead_requires_page_context = Page AEAD requires the page-aware encryption or decryption API
+error.encrypt.page_aead_decryption_failed = Page AEAD decryption failed
+error.encrypt.chunk_context_invalid = Chunk position authentication requires a file identity, a nonnegative marker offset and a chunk ordinal
+error.encrypt.chunk_authentication_unsupported = Provider %1$s does not support Chunk position authentication
+error.encrypt.invalid_chunk_authentication = The encrypted Chunk position authentication proof is missing or has an invalid size
+error.encrypt.invalid_chunk_authentication_size = Invalid chunk authentication size: %1$d
+error.encrypt.chunk_authentication_failed = Chunk position authentication failed

java/common/src/main/resources/org/apache/tsfile/i18n/messages_zh.properties

@@ -636,6 +636,7 @@ log.read.block_reader_fill_measurements_error = 无法填充 measurements
 
 # TableResultSet — failed to close tsBlockReader
 log.read.table_result_set_close_error = 关闭 tsBlockReader 失败
+log.read.tree_result_set_close_error = 关闭树模型查询结果集失败
 
 # DeviceMetaIterator — failed to load device meta data
 log.read.device_meta_iterator_error = 加载设备 meta data 失败
@@ -1117,6 +1118,44 @@ error.encrypt.encrypt_no_constructor = 获取 encryptor 构造函数失败: %1$s
 # EncryptUtils.getEncrypt — instantiation failed (encryptType arg)
 error.encrypt.encrypt_instantiation_failed = 实例化 encryptor 失败: %1$s
 
+# EncryptionProviderRegistry — provider registration and lookup
+error.encrypt.invalid_provider_id = encryption provider id 不能为空
+error.encrypt.duplicate_provider = encryption provider id 已注册: %1$s
+error.encrypt.provider_not_found = encryption provider 未注册: %1$s
+error.encrypt.provider_returned_null = encryption provider 返回 null: %1$s
+
+# EncryptParameter — use after sensitive state was destroyed
+error.encrypt.parameter_destroyed = encryption parameters 已销毁
+error.encrypt.invalid_page_body_overhead = encryption profile %2$s 的 page body 额外开销 %1$s 无效
+error.encrypt.page_body_too_short = encrypted page body 大小 %1$s 小于 AEAD 额外开销 %2$s
+error.encrypt.page_context_invalid_parameter = page crypto context 需要 page AEAD 参数
+error.encrypt.page_aead_encrypt_unsupported = 加密器 %1$s 未实现经过认证的 Page 加密
+error.encrypt.page_aead_decrypt_unsupported = 解密器 %1$s 未实现经过认证的 Page 解密
+error.encrypt.page_context_invalid_file_id = page crypto context 需要 16 字节的 file crypto id
+error.encrypt.page_context_invalid_chunk_ordinal = page crypto context 需要非负的 chunk ordinal
+error.encrypt.page_read_requires_chunk_ordinal = Page-AEAD 文件需要调用 readPage(header, type, pageIndex, chunkOrdinal)
+error.encrypt.chunk_ordinal_exhausted = 文件 Chunk 序号已耗尽
+error.write.invalid_chunk_ordinal = 加密 Chunk 必须具有文件内唯一的 Chunk 序号
+error.write.unencrypted_chunk_has_ordinal = 未加密 Chunk 不得携带 Chunk 序号
+error.write.aead_append_requires_file_header = 无加密头的文件不能追加加密数据
+error.write.encrypted_chunk_copy_unsupported = 复制加密 Chunk 前必须先解密并重新加密
+error.encrypt.page_context_invalid_sizes = page crypto context 值无效，uncompressed size: %1$s，compressed plaintext size: %2$s，page index: %3$s
+error.encrypt.page_output_size_mismatch = AEAD page 输出大小不匹配，预期 %1$s 字节，实际 %2$s 字节
+error.encrypt.page_plaintext_size_mismatch = AEAD page plaintext 大小不匹配，预期 %1$s 字节，实际 %2$s 字节
+error.chunk.merge_page_aead_unsupported = Page-AEAD encrypted chunk 合并前必须先解密并重写
+
+# FileEncryptionHeader — malformed or unsupported file encryption metadata
+error.file.encryption_header_invalid_size = file encryption header 大小无效: %1$s
+error.file.encryption_header_unsupported_version = 不支持的 file encryption header 版本: %1$s
+error.file.encryption_header_malformed = file encryption header 格式错误
+error.file.encryption_header_trailing_bytes = file encryption header 包含多余字节
+error.file.encryption_header_invalid_component_size = file encryption header 组件大小无效: %1$s
+error.file.encryption_header_truncated = file encryption header 已截断，预期 %1$s 字节，实际读取 %2$s 字节
+error.file.encryption_header_invalid_field = file encryption header 字段无效: %1$s
+error.write.encryption_header_must_precede_data = file encryption header 必须写在 TsFile data 之前
+error.write.encrypted_chunk_context_mismatch = encrypted Chunk 必须使用目标文件的加密上下文
+error.write.encryption_context_immutable = 文件加密头写入后不能更改文件加密上下文
+
 # === compress ===
 
 # ICompressor.getCompressor / IUnCompressor.getUnCompressor — null type
@@ -1573,3 +1612,14 @@ error.utils.table_point_count_tool_file_not_found = TsFile 不存在：%1$s
 error.utils.table_point_count_tool_incomplete_file = TsFile 不完整：%1$s
 error.utils.table_point_count_tool_copy_failed = 复制 TsFile 数据和元数据前缀失败
 info.utils.table_point_count_tool_result = 已处理 %1$s：%2$s
+error.write.aead_raw_page_copy_unsupported = Page AEAD 不支持原样复制页面；必须解密后使用目标文件上下文重新加密
+error.encrypt.file_context_already_used = 加密上下文已用于创建新文件；请生成新的 DEK 和文件身份
+error.encrypt.provider_discovery_failed = 加密 Provider 发现失败
+error.encrypt.page_aead_operations_missing = Page AEAD Provider 必须提供加密器和解密器
+error.encrypt.page_aead_requires_page_context = Page AEAD 必须使用带页面上下文的加解密接口
+error.encrypt.page_aead_decryption_failed = Page AEAD 解密失败
+error.encrypt.chunk_context_invalid = Chunk 位置认证需要文件身份、非负的 marker 偏移和 Chunk 序号
+error.encrypt.chunk_authentication_unsupported = Provider %1$s 不支持 Chunk 位置认证
+error.encrypt.invalid_chunk_authentication = 加密 Chunk 的位置认证凭据缺失或长度无效
+error.encrypt.invalid_chunk_authentication_size = 无效的 Chunk 认证长度：%1$d
+error.encrypt.chunk_authentication_failed = Chunk 位置认证失败

java/tsfile/src/main/java/org/apache/tsfile/encrypt/ChunkCryptoContext.java

@@ -0,0 +1,66 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.tsfile.encrypt;
+
+import org.apache.tsfile.common.conf.TSFileConfig;
+import org.apache.tsfile.exception.encrypt.EncryptException;
+import org.apache.tsfile.i18n.Messages;
+
+import java.nio.ByteBuffer;
+import java.util.Arrays;
+
+/** Binds a chunk's page identity to the absolute position of its on-disk marker. */
+public final class ChunkCryptoContext {
+  /** Format bound for opaque proofs; the immutable provider profile defines their exact size. */
+  public static final int MAX_AUTHENTICATION_SIZE = 1024;
+
+  private static final int ASSOCIATED_DATA_VERSION = 1;
+  private static final byte[] DOMAIN = "TsFile/ChunkPosition".getBytes(TSFileConfig.STRING_CHARSET);
+  private final byte[] associatedData;
+
+  private ChunkCryptoContext(byte[] fileCryptoId, long chunkOffset, long chunkOrdinal) {
+    associatedData =
+        ByteBuffer.allocate(
+                Integer.BYTES * 2 + DOMAIN.length + fileCryptoId.length + Long.BYTES * 2)
+            .putInt(DOMAIN.length)
+            .put(DOMAIN)
+            .putInt(ASSOCIATED_DATA_VERSION)
+            .put(fileCryptoId)
+            .putLong(chunkOffset)
+            .putLong(chunkOrdinal)
+            .array();
+  }
+
+  public static ChunkCryptoContext forChunk(
+      EncryptParameter parameter, long chunkOffset, long chunkOrdinal) {
+    if (parameter == null || !parameter.isTdePageAead() || chunkOffset < 0 || chunkOrdinal < 0) {
+      throw new EncryptException(Messages.get("error.encrypt.chunk_context_invalid"));
+    }
+    byte[] fileId = parameter.getFileCryptoId();
+    if (fileId == null || fileId.length != EncryptParameter.FILE_CRYPTO_ID_LENGTH) {
+      throw new EncryptException(Messages.get("error.encrypt.chunk_context_invalid"));
+    }
+    return new ChunkCryptoContext(fileId, chunkOffset, chunkOrdinal);
+  }
+
+  public byte[] getAssociatedData() {
+    return Arrays.copyOf(associatedData, associatedData.length);
+  }
+}