【数据自动脱敏】SpringBoot 实现数据加密脱敏（注解 + 反射 + AOP）

王大全

于 2024-06-25 23:51:52 发布

阅读量588

点赞数 10

分类专栏： # Java 处理各种情况文章标签： spring boot 加密脱敏 aop 加解密字段 java

本文链接：https://blog.csdn.net/qq_36599530/article/details/139973138

版权

Java 处理各种情况专栏收录该内容

10 篇文章 1 订阅

订阅专栏

根据各种规定实现数据脱敏

不被泄露说明用户信息应被加密储存；
不能直接展示说明用户信息应脱敏展示；

解决方案

傻瓜式编程：将项目中关于用户信息实体类的字段，比如姓名，手机号，身份证，地址等，在新增进数据库之前，对数据进行加密处理；在列表中展示用户信息时，对数据库中的数据进行解密脱敏，然后返回给前端；
切入式编程：将项目中关于用户信息实体类的字段用注解给标记，新增用户信息实体类（这里我们用UserBO来表示，给UserBO里面的name，phone字段添加@EncryptField），返回用户信息实体类（这里我们用UserDO来表示，给UserDO里面的name，phone字段添加@DecryptField）；然后利用@EncryptField，@DecryptField做为切入点，以切面的形式实现加密，解密脱敏；

傻瓜式编程不是说傻，而是相当于切入式编程，傻瓜式编程需要对用户信息相关的所有接口进行加密，解密脱敏的逻辑处理，这里改动的地方就比较多，风险高，重复操作相同的逻辑，工作量大，后期不好维护；切入式编程只需要对用户信息字段添加注解，对有注解的字段统一进行加密，解密脱敏逻辑处理，操作方便，高聚合，易维护；

方案实现

1.创建注解

1.1 创建一个只能标记在方法的注解：加密方法注解（方法作切入点）：

package com.weige.javaskillpoint.annotation;

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

@Target(ElementType.METHOD)         //METHOD 说明该注解只能用在方法上
@Retention(RetentionPolicy.RUNTIME) //RUNTIME 说明该注解在运行时生效
public @interface Encryption {

}

1.2 创建一个只能标记在字段上的注解：加密字段注解（字段）：

package com.weige.javaskillpoint.annotation;

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

@Target(ElementType.FIELD)           //FIELD 说明该注解只能用在字段上
@Retention(RetentionPolicy.RUNTIME)  //RUNTIME 说明该注解在运行时生效
public @interface EncryptField {

}

1.3 创建一个标记在字段上，且有值的注解：解密字段注解（字段）：

package com.weige.javaskillpoint.annotation;

import com.weige.javaskillpoint.enums.DesensitizationEnum;

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

@Target(ElementType.FIELD)
@Retention(RetentionPolicy.RUNTIME)
public @interface DecryptField {
 // 注解是可以有值的,这里可以为数组,String,枚举等类型
 // DesensitizationEnum desensitizationEnum = field.getAnnotation(DecryptField.class).value(); 这里的field是指当前标记的字段
    DesensitizationEnum value(); 
}

1.4 解密方法注解（方法作切入点）：

package com.weige.javaskillpoint.annotation;

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface Decryption {

}

2.注解使用

2.1 创建枚举

package com.weige.javaskillpoint.enums;

public enum DesensitizationEnum {
    name,     // 用户信息姓名脱敏
    address,  // 用户信息地址脱敏
    phone;    // 用户信息手机号脱敏
}

2.2 创建UserDO类

package com.weige.javaskillpoint.entity;

import com.weige.javaskillpoint.annotation.DecryptField;
import com.weige.javaskillpoint.enums.DesensitizationEnum;

// 实体类
public class UserDO {

    @DecryptField(DesensitizationEnum.name)
    private String name;

    @DecryptField(DesensitizationEnum.address)
    private String address;

    public String getName() {
        return name;
    }

    public void setName(String name) {
        this.name = name;
    }

    public String getAddress() {
        return address;
    }

    public void setAddress(String address) {
        this.address = address;
    }

    public UserDO(String name, String address) {
        this.name = name;
        this.address = address;
    }
}

2.3 创建UserBO类

package com.weige.javaskillpoint.entity;

import com.weige.javaskillpoint.annotation.EncryptField;

// 实体类
public class UserBO {
    @EncryptField
    private String name;

    @EncryptField
    private String address;

    public String getName() {
        return name;
    }

    public void setName(String name) {
        this.name = name;
    }

    public String getAddress() {
        return address;
    }

    public void setAddress(String address) {
        this.address = address;
    }

    public UserBO(String name, String address) {
        this.name = name;
        this.address = address;
    }

    @Override
    public String toString() {
        return "UserBO{" +
                "name='" + name + '\'' +
                ", address='" + address + '\'' +
                '}';
    }
}

3.实战

3.1 解密 Controller：

package com.weige.javaskillpoint.controller;

import com.weige.javaskillpoint.annotation.Decryption;
import com.weige.javaskillpoint.entity.UserDO;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
@RequestMapping("/decrypt")
public class DecryptController {

    @GetMapping("/v1")
    @Decryption
    public UserDO decrypt() {
        return new UserDO("7c29e296e92893476db5f9477480ba7f", "b5c7ff86ac36c01dda45d9ffb0bf73194b083937349c3901f571d42acdaa7bae");
    }

}

加密 Controller：

package com.weige.javaskillpoint.controller;

import com.weige.javaskillpoint.annotation.Encryption;
import com.weige.javaskillpoint.entity.UserBO;
import lombok.extern.slf4j.Slf4j;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
@RequestMapping("/encrypt")
@Slf4j
public class EncryptController {

    @PostMapping("/v1")
    @Encryption
    public UserBO insert(@RequestBody UserBO user) {
        log.info("加密后对象：{}", user);
        return user;
    }
}

解密脱敏切面：

package com.weige.javaskillpoint.aop;

import com.weige.javaskillpoint.annotation.DecryptField;
import com.weige.javaskillpoint.enums.DesensitizationEnum;
import com.weige.javaskillpoint.utils.AesUtil;
import lombok.extern.slf4j.Slf4j;
import org.aspectj.lang.ProceedingJoinPoint;
import org.aspectj.lang.annotation.Around;
import org.aspectj.lang.annotation.Aspect;
import org.aspectj.lang.annotation.Pointcut;
import org.springframework.stereotype.Component;

import java.lang.reflect.Field;
import java.util.ArrayList;
import java.util.Collection;
import java.util.List;
import java.util.Objects;

@Slf4j
@Aspect
@Component
public class DecryptAspect {
    //拦截需解密注解
    @Pointcut("@annotation(com.weige.javaskillpoint.annotation.Decryption)")
    public void point() {

    }

    @Around("point()")
    public Object around(ProceedingJoinPoint joinPoint) throws Throwable {
        //解密
        return decrypt(joinPoint);
    }

    public Object decrypt(ProceedingJoinPoint joinPoint) {
        Object result = null;
        try {
            Object obj = joinPoint.proceed();
            if (obj != null) {
                //抛砖引玉 ，可自行扩展其他类型字段的判断
                if (obj instanceof String) {
                    decryptValue();
                } else {
                    result = decryptData(obj);
                }
            }
        } catch (Throwable e) {
            e.printStackTrace();
        }
        return result;
    }

    private Object decryptData(Object obj) throws IllegalAccessException {

        if (Objects.isNull(obj)) {
            return null;
        }
        if (obj instanceof ArrayList) {
            decryptList(obj);
        } else {
            decryptObj(obj);
        }
        return obj;
    }

    private void decryptObj(Object obj) throws IllegalAccessException {
        Field[] fields = obj.getClass().getDeclaredFields();
        for (Field field : fields) {
            boolean hasSecureField = field.isAnnotationPresent(DecryptField.class);
            if (hasSecureField) {
                field.setAccessible(true);
                if (field.get(obj) != null) {
                    String realValue = (String) field.get(obj);
                    DesensitizationEnum desensitizationEnum = field.getAnnotation(DecryptField.class).value();
                    String value = (String) AesUtil.decrypt(realValue,desensitizationEnum);
                    field.set(obj, value);
                }
            }
        }
    }

    private void decryptList(Object obj) throws IllegalAccessException {
        List<Object> result = new ArrayList<>();
        if (obj instanceof ArrayList) {
            result.addAll((Collection<?>) obj);
        }
        for (Object object : result) {
            decryptObj(object);
        }
    }

    private void decryptValue() {
        log.info("根据对象进行解密脱敏，单个字段不做处理！");
    }
}

加密切面：

package com.weige.javaskillpoint.aop;

import com.weige.javaskillpoint.annotation.EncryptField;
import com.weige.javaskillpoint.entity.UserBO;
import com.weige.javaskillpoint.utils.AesUtil;
import lombok.extern.slf4j.Slf4j;
import org.aspectj.lang.ProceedingJoinPoint;
import org.aspectj.lang.annotation.Around;
import org.aspectj.lang.annotation.Aspect;
import org.aspectj.lang.annotation.Pointcut;
import org.springframework.stereotype.Component;

import java.lang.reflect.Field;

@Slf4j
@Aspect
@Component
public class EncryptAspect {

    //拦截需加密注解
    @Pointcut("@annotation(com.weige.javaskillpoint.annotation.Encryption)")
    public void point() {

    }

    @Around("point()")
    public Object around(ProceedingJoinPoint joinPoint) throws Throwable {
        //加密
        encrypt(joinPoint);
        return joinPoint.proceed();
    }

    public void encrypt(ProceedingJoinPoint joinPoint) {
        Object[] objects;
        try {
            objects = joinPoint.getArgs();
            if (objects.length != 0) {
                for (Object object : objects) {
                    if (object instanceof UserBO) {
                        Field[] fields = object.getClass().getDeclaredFields();
                        for (Field field : fields) {
                            if (field.isAnnotationPresent(EncryptField.class)) {
                                field.setAccessible(true);
                                if (field.get(object) != null) {
                                    // 进行加密
                                    Object o = field.get(object);
                                    Object encrypt = AesUtil.encrypt(field.get(object));
                                    field.set(object, encrypt);
                                }
                            }
                        }
                    }
                }
            }
        } catch (Exception e) {
            log.error(e.getMessage());
        }
    }
}

加密工具类：AesUtil

package com.weige.javaskillpoint.utils;

import cn.hutool.core.util.CharsetUtil;
import cn.hutool.crypto.SecureUtil;
import cn.hutool.crypto.symmetric.AES;
import com.weige.javaskillpoint.enums.DesensitizationEnum;

public class AesUtil {

    // 默认16位 或 128 256位
    public static String AES_KEY = "Wk#qerdfdshbd910";

    public static AES aes = SecureUtil.aes(AES_KEY.getBytes());

    public static Object encrypt(Object obj) {
        return aes.encryptHex((String) obj);
    }

    public static Object decrypt(Object obj, DesensitizationEnum desensitizationEnum) {
        // 解密
        Object decrypt = decrypt(obj);
        // 脱敏
        return DesensitizationUtil.desensitization(decrypt, desensitizationEnum);
    }

    public static Object decrypt(Object obj) {
        return aes.decryptStr((String) obj, CharsetUtil.CHARSET_UTF_8);
    }

}

脱敏工具类：DesensitizationUtil

package com.weige.javaskillpoint.utils;

import cn.hutool.core.util.StrUtil;
import com.weige.javaskillpoint.enums.DesensitizationEnum;

public class DesensitizationUtil {


    public static Object desensitization(Object obj, DesensitizationEnum desensitizationEnum) {
        Object result;
        switch (desensitizationEnum) {
            case name:
                result = strUtilHide(obj, 1);
                break;
            case address:
                result = strUtilHide(obj, 3);
                break;
            default:
                result = "";
        }
        return result;
    }

    /**
     * start从0开始
     */
    public static Object strUtilHide(String obj, int start, int end) {
        return StrUtil.hide(obj, start, end);
    }

    public static Object strUtilHide(Object obj, int start) {
        return strUtilHide(((String) obj), start, ((String) obj).length());
    }

}

王大全

关注

10
点赞
踩
13

收藏

觉得还不错? 一键收藏
0
评论
【数据自动脱敏】SpringBoot 实现数据加密脱敏（注解 + 反射 + AOP）

切入式编程：将项目中关于用户信息实体类的字段用注解给标记，新增用户信息实体类（这里我们用UserBO来表示，给UserBO里面的name，phone字段添加@EncryptField），返回用户信息实体类（这里我们用UserDO来表示，给UserDO里面的name，phone字段添加@DecryptField）；傻瓜式编程不是说傻，而是相当于切入式编程，傻瓜式编程需要对用户信息相关的所有接口进行加密，解密脱敏的逻辑处理，这里改动的地方就比较多，风险高，重复操作相同的逻辑，工作量大，后期不好维护；
复制链接

扫一扫

专栏目录