【架构实战】数据加密架构：传输加密+存储加密

一、数据加密概述

数据加密是保护数据安全的重要手段：

加密场景：

• 传输加密（HTTPS）
• 存储加密（敏感数据）
• 密钥管理

二、传输加密

1. HTTPS配置

@Configuration
public class SSLConfig {
    
    @Bean
    public TomcatServletWebServerFactory servletContainer() {
        TomcatServletWebServerFactory tomcat = new TomcatServletWebServerFactory();
        tomcat.setProtocol("org.apache.coyote.http11.Http11NioProtocol");
        
        SSL ssl = new SSL();
        ssl.setKeyStore("classpath:keystore.p12");
        ssl.setKeyStorePassword("password");
        ssl.setKeyStoreType("PKCS12");
        
        Connector connector = new Connector("org.apache.coyote.http11.Http11NioProtocol");
        connector.setScheme("https");
        connector.setSecure(true);
        connector.setPort(8443);
        connector.setProperty("sslProtocol", "TLS");
        
        tomcat.addAdditionalTomcatConnectors(connector);
        
        return tomcat;
    }
}

2. 证书配置

# application.yml
server:
  ssl:
    enabled: true
    key-store: classpath:keystore.p12
    key-store-password: password
    key-store-type: PKCS12
    key-alias: mycert

三、对称加密

1. AES加密

@Service
public class AESEncryptionService {
    
    private static final String ALGORITHM = "AES";
    private static final String TRANSFORMATION = "AES/ECB/PKCS5Padding";
    
    @Value("${encryption.aes.key}")
    private String secretKey;
    
    public String encrypt(String plaintext) {
        try {
            SecretKeySpec keySpec = new SecretKeySpec(
                secretKey.getBytes(), ALGORITHM);
            
            Cipher cipher = Cipher.getInstance(TRANSFORMATION);
            cipher.init(Cipher.ENCRYPT_MODE, keySpec);
            
            byte[] encrypted = cipher.doFinal(plaintext.getBytes());
            return Base64.getEncoder().encodeToString(encrypted);
            
        } catch (Exception e) {
            throw new RuntimeException("加密失败", e);
        }
    }
    
    public String decrypt(String ciphertext) {
        try {
            SecretKeySpec keySpec = new SecretKeySpec(
                secretKey.getBytes(), ALGORITHM);
            
            Cipher cipher = Cipher.getInstance(TRANSFORMATION);
            cipher.init(Cipher.DECRYPT_MODE, keySpec);
            
            byte[] decrypted = cipher.doFinal(
                Base64.getDecoder().decode(ciphertext));
            return new String(decrypted);
            
        } catch (Exception e) {
            throw new RuntimeException("解密失败", e);
        }
    }
}

2. 字段加密

@Component
public class FieldEncryptionConverter implements AttributeConverter<String, String> {
    
    @Autowired
    private AESEncryptionService encryptionService;
    
    @Override
    public String convertToDatabaseColumn(String attribute) {
        return StringUtils.isEmpty(attribute) ? 
            attribute : encryptionService.encrypt(attribute);
    }
    
    @Override
    public String convertToEntityAttribute(String dbData) {
        return StringUtils.isEmpty(dbData) ? 
            dbData : encryptionService.decrypt(dbData);
    }
}

四、非对称加密

1. RSA加密

@Service
public class RSAEncryptionService {
    
    public KeyPair generateKeyPair() throws NoSuchAlgorithmException {
        KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");
        generator.initialize(2048);
        return generator.generateKeyPair();
    }
    
    public String encrypt(String plaintext, PublicKey publicKey) 
            throws Exception {
        Cipher cipher = Cipher.getInstance("RSA");
        cipher.init(Cipher.ENCRYPT_MODE, publicKey);
        
        byte[] encrypted = cipher.doFinal(plaintext.getBytes());
        return Base64.getEncoder().encodeToString(encrypted);
    }
    
    public String decrypt(String ciphertext, PrivateKey privateKey) 
            throws Exception {
        Cipher cipher = Cipher.getInstance("RSA");
        cipher.init(Cipher.DECRYPT_MODE, privateKey);
        
        byte[] decrypted = cipher.doFinal(
            Base64.getDecoder().decode(ciphertext));
        return new String(decrypted);
    }
}

2. 数字签名

@Service
public class SignatureService {
    
    public String sign(String data, PrivateKey privateKey) 
            throws Exception {
        Signature signature = Signature.getInstance("SHA256withRSA");
        signature.initSign(privateKey);
        signature.update(data.getBytes());
        
        return Base64.getEncoder().encodeToString(signature.sign());
    }
    
    public boolean verify(String data, String signatureStr, PublicKey publicKey) 
            throws Exception {
        Signature signature = Signature.getInstance("SHA256withRSA");
        signature.initVerify(publicKey);
        signature.update(data.getBytes());
        
        return signature.verify(Base64.getDecoder().decode(signatureStr));
    }
}

五、哈希加密

1. 密码哈希

@Service
public class PasswordHashService {
    
    public String hashPassword(String password) {
        return BCryptPasswordEncoder.encode(password);
    }
    
    public boolean verifyPassword(String password, String hashedPassword) {
        return new BCryptPasswordEncoder().matches(password, hashedPassword);
    }
}

2. 数据完整性

@Service
public class HashService {
    
    public String md5(String data) {
        return DigestUtils.md5Hex(data);
    }
    
    public String sha256(String data) {
        return DigestUtils.sha256Hex(data);
    }
    
    public String hmacSha256(String data, String key) {
        try {
            SecretKeySpec secretKey = new SecretKeySpec(
                key.getBytes(), "HmacSHA256");
            
            Mac mac = Mac.getInstance("HmacSHA256");
            mac.init(secretKey);
            
            byte[] hmac = mac.doFinal(data.getBytes());
            return Base64.getEncoder().encodeToString(hmac);
            
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }
}

六、密钥管理

1. 密钥轮换

@Service
public class KeyRotationService {
    
    @Value("${encryption.key.version}")
    private int currentVersion;
    
    public void rotateKey() throws Exception {
        // 1. 生成新密钥
        KeyPair newKeyPair = rsaService.generateKeyPair();
        
        // 2. 加密旧密钥的数据
        Map<Integer, String> encryptedKeys = new HashMap<>();
        // ... 使用新密钥加密旧密钥
        
        // 3. 存储新密钥
        keyStore.store(newKeyPair, currentVersion + 1);
        
        // 4. 更新版本号
        currentVersion++;
    }
}

2. 密钥托管

@Configuration
public class KMSConfig {
    
    @Bean
    public AWSSimpleSystemsManagement awsSSM() {
        return AWSSimpleSystemsManagementClientBuilder.defaultClient();
    }
}

@Service
public class KMSKeyService {
    
    @Autowired
    private AWSSimpleSystemsManagement awsSSM;
    
    public String getKey(String keyId) {
        GetParameterRequest request = new GetParameterRequest()
            .withName(keyId)
            .withWithDecryption(true);
        
        return awsSSM.getParameter(request).getParameter().getValue();
    }
}

七、敏感数据保护

1. 字段脱敏

@Component
public class SensitiveDataFilter {
    
    @SensitiveField(type = MaskingType.PHONE)
    public String maskPhone(String phone) {
        if (phone == null) return null;
        return phone.substring(0, 3) + "****" + phone.substring(7);
    }
    
    @SensitiveField(type = MaskingType.ID_CARD)
    public String maskIdCard(String idCard) {
        if (idCard == null) return null;
        return idCard.substring(0, 6) + "********" + idCard.substring(14);
    }
}

2. 全链路加密

@Component
public class EndToEndEncryptionService {
    
    // 端到端加密示例
    public String encryptForRecipient(String plaintext, String recipientPublicKey) 
            throws Exception {
        // 1. 生成随机对称密钥
        KeyGenerator keyGen = KeyGenerator.getInstance("AES");
        keyGen.init(256);
        SecretKey symmetricKey = keyGen.generateKey();
        
        // 2. 用对称密钥加密数据
        Cipher aesCipher = Cipher.getInstance("AES");
        aesCipher.init(Cipher.ENCRYPT_MODE, symmetricKey);
        byte[] encryptedData = aesCipher.doFinal(plaintext.getBytes());
        
        // 3. 用接收者公钥加密对称密钥
        Cipher rsaCipher = Cipher.getInstance("RSA");
        rsaCipher.init(Cipher.ENCRYPT_MODE, getPublicKey(recipientPublicKey));
        byte[] encryptedKey = rsaCipher.doFinal(symmetricKey.getEncoded());
        
        // 4. 返回加密后的数据和密钥
        return Base64.getEncoder().encodeToString(encryptedData) + ":" + 
               Base64.getEncoder().encodeToString(encryptedKey);
    }
}

八、总结

数据加密是保护数据安全的基础：

• 传输加密：HTTPS/TLS
• 存储加密：AES/RSA
• 密钥管理：轮换/托管
• 敏感保护：脱敏/全链路加密

---

个人观点，仅供参考