Jasypt加解密、信息脱敏

一、介绍

Jasypt is a java library which allows the developer to add basic encryption capabilities to his/her projects with minimum effort, and without the need of having deep knowledge on how cryptography works.
Jasypt是一个Java库，它允许开发人员以最小的努力为他/她的项目添加基本的加密功能，而无需深入了解密码学的工作原理。

• High-security, standards-based encryption techniques, both for unidirectional and bidirectional encryption. Encrypt passwords, texts, numbers, binaries…
  基于标准的高安全性加密技术，适用于单向和双向加密。加密密码，文本，数字，二进制文件…
• Transparent integration with Hibernate.
  完美地与 Hibernate 集成。
• Suitable for integration into Spring-based applications and also transparently integrable with Spring Security.
  适合集成到 Spring项目中，也可以完美地与 Spring Security集成。
• Integrated capabilities for encrypting the configuration of applications (i.e. datasources).
  用于加密应用程序（即数据源）配置的集成功能。
• Specific features for high-performance encryption in multi-processor/multi-core systems.
  多处理器/多核系统中高性能加密的特定功能。
• Open API for use with any JCE provider.
  开放 API 以与任何 JCE 提供程序一起使用。
• …and much more
  …等等

二、Spring集成

1、 Maven依赖

<dependency>
    <groupId>org.jasypt</groupId>
    <artifactId>jasypt-spring31</artifactId>
    <version>1.9.3</version>
</dependency>
<dependency>
    <groupId>org.jasypt</groupId>
    <artifactId>jasypt</artifactId>
    <version>1.9.3</version>
</dependency>

2、application.xml的配置

<bean id="environmentVariablesConfiguration"
	  class="org.jasypt.encryption.pbe.config.EnvironmentStringPBEConfig">
	<!--加密方法-->
	<property name="algorithm" value="PBEWithMD5AndDES" />
	<!--密码-->
	<property name="password" value="mysqlPwd" />
	<!-- 如果想获得系统环境变量 -->
	<!-- <property name="password" value="#{systemEnvironment['ENV_VARIABLE_NAME']}"/> -->
</bean>
<!-- 配置加密器，将用于解密 -->
<bean id="configurationEncryptor" class="org.jasypt.encryption.pbe.StandardPBEStringEncryptor">
	<property name="config" ref="environmentVariablesConfiguration" />
</bean>
<!--jasypt扫描配置文件，对配置文件里加密数据进行解密-->
<bean id="propertyConfigurer" class="org.jasypt.spring31.properties.EncryptablePropertyPlaceholderConfigurer">
	<constructor-arg ref="configurationEncryptor" />
	<property name="locations">
		<list>
			<value>classpath:myconfig.properties</value>
			<value>classpath:application.properties</value>
		</list>
	</property>
</bean>
<!--给bean的属性解密并赋值-->
<bean id="myBean" class="com.example.MyBean">
	<property name="pwd" value="${datasource.username}"/>
	<property name="user" value="${datasource.password}"/>
</bean>

3、配置文件使用

使用 ENC(密文)

datasource.driver_class=com.mysql.jdbc.Driver
datasource.url=jdbc:mysql://localhost:3306/mydatabase
datasource.username=ENC(aXZJTKwF6Vt147qUJOrMuT3NDV4y0NzG)
datasource.password=ENC(LWzlg7fvAhO8RMIDDxifEORimjA91ibn)

4、方法加密

BasicTextEncryptor encryptor = new BasicTextEncryptor();
encryptor.setPassword("myPassword");
String encrypted = encryptor.encrypt("敏感信息");//密码加密
System.out.println(encrypted);

---

二、SpringBoot集成

1、 Maven依赖

<!-- https://mvnrepository.com/artifact/com.github.ulisesbocchio/jasypt-spring-boot-starter -->
<dependency>
    <groupId>com.github.ulisesbocchio</groupId>
    <artifactId>jasypt-spring-boot-starter</artifactId>
    <version>3.0.5</version>
</dependency>

2、 Java Bean配置jasyptStringEncryptor

@Bean("jasyptStringEncryptor")
public StringEncryptor stringEncryptor() {
  PooledPBEStringEncryptor encryptor = new PooledPBEStringEncryptor();
  SimpleStringPBEConfig config = new SimpleStringPBEConfig();
  config.setPassword("mypassword");
  config.setAlgorithm("PBEWITHHMACSHA512ANDAES_256");
  config.setKeyObtentionIterations("1000");
  config.setPoolSize("1");
  config.setProviderName("SunJCE");
  config.setSaltGeneratorClassName("org.jasypt.salt.RandomSaltGenerator");
  config.setIvGeneratorClassName("org.jasypt.iv.RandomIvGenerator");
  config.setStringOutputType("base64");
  encryptor.setConfig(config);
  return encryptor;
}

3、配置文件使用

使用 ENC(密文)

datasource.driver_class=com.mysql.jdbc.Driver
datasource.url=jdbc:mysql://localhost:3306/mydatabase
datasource.username=ENC(aXZJTKwF6Vt147qUJOrMuT3NDV4y0NzG)
datasource.password=ENC(LWzlg7fvAhO8RMIDDxifEORimjA91ibn)

4、Bean使用加密字段自动解密

直接用@Value(“${配置文件的Key}”)

@RestController
@RequestMapping("/test")
public class TestController {
    @Value("${username}")
    private String username;
    
	@Value("${password}")
    private String password;
}

---

参考：https://blog.csdn.net/weixin_42962634/article/details/122455123