数据安全传输中的非对称加密、信息摘要、HMAC

---

场景描述

最近对接了很多第三方支付产品，由于涉及到敏感信息及金钱等非常重要的数据，数据传输安全就显得尤为重要。那么实际是怎样处理的呢？

几个概念：数据信息、信息摘要、数字签名、密钥

加密算法：RSA、MD5、SHA、HMAC

一般的数据传输流程大概如下：

1.商户调用支付等接口时，将数据信息做信息摘要(md5、sha、Hmac)，再用商户自己的私钥对摘要信息进行加密得到数字签名，最后将数据信息和签名一同发给支付机构

2.支付机构收到数据时，用商户公钥解密数字签名得到信息摘要，同时对收到的数据做信息摘要，验证得到的两个信息摘要是否一致，从而数据的身份和一致性就得到了验证

3.支付机构处理完会发异步通知到商户，支付机构将数据信息做上述1相同的操作，不同的是签名加密信息摘要所用的私钥是支付机构自己的私钥，最后将数据信息和签名一同发给商户

4.商户收到数据时，会用支付机构公钥做上述2相同的操作，从而数据的身份和一致性就得到了验证

 

---

代码实现

下面自己写了一个demo，希望能对各位同学有所帮助：

1.工具类

package com.cyq.util;

import javax.crypto.Mac;
import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
import java.security.MessageDigest;

/**
 * @author cyq
 */
public class HmacDigestUtil {
    static char[] hexDigits ={'0','1','2','3','4','5','6','7','8','9','A','B','C','D','E','F'};
    private static final String DEFAULT_ALGO = "HmacSHA1";
    private static final String ENCODING = "UTF-8";

    public static String toHex(byte[] data) {
        // 把密文转换成十六进制的字符串形式
        int j = data.length;
        char str[] = new char[j * 2];
        int k = 0;
        for (int i = 0; i < j; i++) {
            byte byte0 = data[i];
            str[k++] = hexDigits[byte0 >>> 4 & 0xf];
            str[k++] = hexDigits[byte0 & 0xf];
        }
        return new String(str);
    }

    public static byte[] hmacEncrypt(String encryptText, String encryptKey, String algorithm) throws Exception {
        if (algorithm == null || "".equals(algorithm)) {
            algorithm = DEFAULT_ALGO;
        }
        byte[] data = encryptKey.getBytes(ENCODING);
        //根据给定的字节数组构造一个密钥,第二参数指定一个密钥算法的名称
        SecretKey secretKey = new SecretKeySpec(data, algorithm);
        //生成一个指定 Mac 算法 的 Mac 对象
        Mac mac = Mac.getInstance(algorithm);
        //用给定密钥初始化 Mac 对象
        mac.init(secretKey);

        byte[] text = encryptText.getBytes(ENCODING);
        //完成 Mac 操作
        return mac.doFinal(text);
    }

    public static String hmacEncryptString(String encryptText, String encryptKey, String algorithm) throws Exception {
        return toHex(hmacEncrypt(encryptText, encryptKey, algorithm));
    }

    public final static byte[] md5(String s) {
        try {
            byte[] btInput = s.getBytes();
            // 获得MD5摘要算法的 MessageDigest 对象
            MessageDigest mdInst = MessageDigest.getInstance("MD5");
            // 使用指定的字节更新摘要
            mdInst.update(btInput);
            // 获得密文
            byte[] md = mdInst.digest();
            return md;
        } catch (Exception e) {
            e.printStackTrace();
            return null;
        }
    }

    public final static String md5String(String s) {
        return toHex(md5(s));
    }
}

2.数据传输类（含测试）

 

package com.cyq.secusign;

import com.cyq.util.HmacDigestUtil;
import org.apache.commons.codec.binary.Base64;

import javax.crypto.Cipher;
import java.security.KeyFactory;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.SecureRandom;
import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;
import java.security.spec.PKCS8EncodedKeySpec;
import java.security.spec.X509EncodedKeySpec;
import java.util.HashMap;
import java.util.Map;

/**
 * @author cyq
 */
public class SecureDataTrans {
    private static Map<Integer, String> keyMap = new HashMap<Integer, String>();
    private static final String ALGO = "HmacSHA256";
    private static String APPKEY = "app:326215423";

    public static void main(String[] args) throws Exception {
        // 获取密钥对
        genPairs();
        String publicKey = keyMap.get(0);
        String privateKey = keyMap.get(1);
        System.out.println("publicKey:" + keyMap.get(0));
        System.out.println("privateKey:" + keyMap.get(1));

        /发送数据
        // 需要发送的数据
        Map<String, String> data = new HashMap<>();
        data.put("name", "chinoukin");
        data.put("age", "22");
        data.put("address", "Beijing haidian");
        System.out.println(data);

        // 发送的数据里加上签名
        String signature = sign(data, privateKey);
        System.out.println("signature:" + signature);
        data.put("signature", signature);

        /接收数据
        // 验证签名
        if (verify(data, publicKey)) {
            System.out.println("验签通过！");
            System.out.println(data);
        }
    }

    public static void genPairs() {
        try {
            // KeyPairGenerator类用于生成公钥和私钥对，基于RSA算法生成对象
            KeyPairGenerator keyPairGen = KeyPairGenerator.getInstance("RSA");
            // 初始化密钥对生成器，密钥大小为96-1024位
            keyPairGen.initialize(1024, new SecureRandom());
            // 生成一个密钥对，保存在keyPair中
            KeyPair keyPair = keyPairGen.generateKeyPair();
            RSAPrivateKey privateKey = (RSAPrivateKey) keyPair.getPrivate();   // 得到私钥
            RSAPublicKey publicKey = (RSAPublicKey) keyPair.getPublic();  // 得到公钥
            String publicKeyString = new String(Base64.encodeBase64(publicKey.getEncoded()));
            // 得到私钥字符串
            String privateKeyString = new String(Base64.encodeBase64((privateKey.getEncoded())));
            // 将公钥和私钥保存到Map
            keyMap.put(0, publicKeyString);  //0表示公钥
            keyMap.put(1, privateKeyString);  //1表示私钥
        } catch (Throwable e) {
        }

    }

    /**
     * RSA公钥加密
     *
     * @param str       加密字符串
     * @param publicKey 公钥
     * @return 密文
     * @throws Exception 加密过程中的异常信息
     */
    public static String encrypt(String str, String publicKey) throws Exception {
        //base64编码的公钥
        byte[] decoded = Base64.decodeBase64(publicKey);
        RSAPublicKey pubKey = (RSAPublicKey) KeyFactory.getInstance("RSA").generatePublic(new X509EncodedKeySpec(decoded));
        //RSA加密
        Cipher cipher = Cipher.getInstance("RSA");
        cipher.init(Cipher.ENCRYPT_MODE, pubKey);
        String outStr = Base64.encodeBase64String(cipher.doFinal(str.getBytes("UTF-8")));
        return outStr;
    }

    /**
     * RSA私钥加密
     *
     * @param str       加密字符串
     * @param privateKey 私钥
     * @return 密文
     * @throws Exception 加密过程中的异常信息
     */
    public static String encrypt2(String str, String privateKey) throws Exception {
        //base64编码的公钥
        byte[] decoded = Base64.decodeBase64(privateKey);
        RSAPrivateKey priKey = (RSAPrivateKey) KeyFactory.getInstance("RSA").generatePrivate(new PKCS8EncodedKeySpec(decoded));
        //RSA加密
        Cipher cipher = Cipher.getInstance("RSA");
        cipher.init(Cipher.ENCRYPT_MODE, priKey);
        String outStr = Base64.encodeBase64String(cipher.doFinal(str.getBytes("UTF-8")));
        return outStr;
    }

    /**
     * RSA私钥解密
     *
     * @param str        加密字符串
     * @param privateKey 私钥
     * @return 铭文
     * @throws Exception 解密过程中的异常信息
     */
    public static String decrypt(String str, String privateKey) throws Exception {
        //64位解码加密后的字符串
        byte[] inputByte = Base64.decodeBase64(str.getBytes("UTF-8"));
        //base64编码的私钥
        byte[] decoded = Base64.decodeBase64(privateKey);
        RSAPrivateKey priKey = (RSAPrivateKey) KeyFactory.getInstance("RSA").generatePrivate(new PKCS8EncodedKeySpec(decoded));
        //RSA解密
        Cipher cipher = Cipher.getInstance("RSA");
        cipher.init(Cipher.DECRYPT_MODE, priKey);
        String outStr = new String(cipher.doFinal(inputByte));
        return outStr;
    }

    /**
     * RSA公钥解密
     *
     * @param str        加密字符串
     * @param publicKey 公钥
     * @return 铭文
     * @throws Exception 解密过程中的异常信息
     */
    public static String decrypt2(String str, String publicKey) throws Exception {
        //64位解码加密后的字符串
        byte[] inputByte = Base64.decodeBase64(str.getBytes("UTF-8"));
        //base64编码的私钥
        byte[] decoded = Base64.decodeBase64(publicKey);
        RSAPublicKey pubKey = (RSAPublicKey) KeyFactory.getInstance("RSA").generatePublic(new X509EncodedKeySpec(decoded));
        //RSA解密
        Cipher cipher = Cipher.getInstance("RSA");
        cipher.init(Cipher.DECRYPT_MODE, pubKey);
        String outStr = new String(cipher.doFinal(inputByte));
        return outStr;
    }

    /**
     * 签名数据
     *
     * @param data
     * @param privateKey
     * @return
     * @throws Exception
     */
    public static String sign(Map<String, String> data, String privateKey) throws Exception {
        // 对数据进行信息摘要
        String dataStr = "";
        for (String key : data.keySet()) {
            dataStr += key + "=" + data.get(key) + "&";
        }
        // 此处用Md5做信息摘要，也可以是HMAC
        //String digest = HmacDigestUtil.md5String(dataStr);
        String digest = HmacDigestUtil.hmacEncryptString(dataStr, APPKEY, ALGO);
        System.out.println("digest:" + digest);

        return encrypt2(digest, privateKey);
    }

    /**
     * 验证签名
     *
     * @param data
     * @param publicKey
     * @return
     * @throws Exception
     */
    public static boolean verify(Map<String, String> data, String publicKey) throws Exception {
        String signature = data.get("signature");
        String sourceDigest = decrypt2(signature, publicKey);
        String dataStr = "";
        for (String key : data.keySet()) {
            if ("signature".endsWith(key)) {
                continue;
            }
            dataStr += key + "=" + data.get(key) + "&";
        }
        // 此处用Md5做信息摘要，也可以是HMAC
        //String digest = HmacDigestUtil.md5String(dataStr);
        //    return true;
        //}
        if (HmacDigestUtil.hmacEncryptString(dataStr, APPKEY, ALGO).equals(sourceDigest)) {
            return true;
        }
        return false;
    }

}

 

3.运行结果

 

publicKey:MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCwnghZNZFHIcLynO3Sh9mAz52E6uOK8JOAtt943gabrJkk12LLveaVXy4nH9YNOKXlgsIhbiRa8JFEbmFTUOT6yg3hH7Psl8fRxLkAqgvcFLanhkz4dxcogMnbiqEctoCatMMQwgatJUV/h0Ot9m2goFtEmxphmtinqD+263JT1QIDAQAB
privateKey:MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBALCeCFk1kUchwvKc7dKH2YDPnYTq44rwk4C233jeBpusmSTXYsu95pVfLicf1g04peWCwiFuJFrwkURuYVNQ5PrKDeEfs+yXx9HEuQCqC9wUtqeGTPh3FyiAyduKoRy2gJq0wxDCBq0lRX+HQ632baCgW0SbGmGa2KeoP7brclPVAgMBAAECgYEAkeG2m5j3an2kfKjKd37mVNMoFMW/NOAJteNXKoqZgrRJunh9jjRI5VA82uwc7cbAoJYkq2BCfyr9kjxp/1tuBai18XDVs4clqhN8MNZMynmUv2ULGH+0KRZzTm7c/zYSmnI6jTIUwCJM6TPAJdsbVDFjbi8utok2Q9hFogUFUoECQQDbay4HLDvZWexD1x/hY7/akV8QVelMP5UrNevllXwAM20Kl66QR31yHZ8NQXwFVWvmD9ogCofwg0kK4JhZJ+X9AkEAzhAVtuenOYieuwWI2NxRFpEkPufXyO0PqVuxSPFOCBHkEyI2MOfAkY4CtnXExuLAKNOn/Ev1n+gVKwNTHAuguQJAYhAy0A3a6bcguukoXGliU2LpI7nhvKwmFNvShBcdBlH1h+hmoiDxVdEbRqdfsFqPEJFBIVTTkJB8UpoyPJZyWQJAD92hLmILuBxSzGeSr8/W1nv6ZHWJYckO6aVLsygRMAHgo7CAp6dQZmSexNmweve+f+Y8Cur2UIeYCaXJ4mDq0QJBALZpatXhcFr6oSzoaIrz+OvHHqTVTYocaDJ16wVTO22DaiV16aCLLCEVe91sYrNUSB0kEl0VY+ue0nh5KCkimXk=
{address=Beijing haidian, name=chinoukin, age=22}
digest:6C9674BBC050314363BB9DD37CE80DC6970218F43F9F15F886A4A0B31E3BE523
signature:YiRDQ+8p6gIpuXarG57BXlX6x1vjzxGTfE+bOcocHYpYQB3n46CYmpZLCILGgmbQg46e+6AFDu+wC6rUzyl12dEg3bO+1l+MTPdp+zvBv+c49YwOCuPR2P4Q6JHciz90YbjZSAsEbDWRhdFGDH76W2nvegVO0uJMM/5Ms7SBKYU=
验签通过！
{address=Beijing haidian, signature=YiRDQ+8p6gIpuXarG57BXlX6x1vjzxGTfE+bOcocHYpYQB3n46CYmpZLCILGgmbQg46e+6AFDu+wC6rUzyl12dEg3bO+1l+MTPdp+zvBv+c49YwOCuPR2P4Q6JHciz90YbjZSAsEbDWRhdFGDH76W2nvegVO0uJMM/5Ms7SBKYU=, name=chinoukin, age=22}