MyBatis-Plus数据安全保护(加密解密)

1. 项目创建
2. POM依赖

   <dependency><!--MyBatis-Plus 企业级模块-->
       <groupId>com.baomidou</groupId>
       <artifactId>mybatis-mate-starter</artifactId>
       <version>1.2.8</version>
   </dependency>
   <!-- https://mvnrepository.com/artifact/org.bouncycastle/bctls-jdk15on -->
   <dependency><!--SM2 SM3 SM4 加密算法依赖-->
       <groupId>org.bouncycastle</groupId>
       <artifactId>bctls-jdk15on</artifactId>
       <version>1.70</version>
   </dependency>
   <!-- https://mvnrepository.com/artifact/org.jasypt/jasypt -->
   <dependency><!--混合加密算法依赖-->
       <groupId>org.jasypt</groupId>
       <artifactId>jasypt</artifactId>
       <version>1.9.3</version>
   </dependency>

3. YML配置

   spring:
     datasource:
       # 配置安全:https://blog.csdn.net/tongxin_tongmeng/article/details/128664932
       url: mpw:IlcV2VrLIr+z3ruf0oHP1sV3JuEvntw9QZDEYhQWDNHJ9Xkm7qZokxkEeTCPNqma
       username: mpw:aoVz0lDJNymnmrhw6LkQow==
       password: mpw:StRVtLG7vB6iKVt83du7fw==
       driver-class-name: com.mysql.cj.jdbc.Driver
   
   # Mybatis Mate 配置
   mybatis-mate:
     cert:
       # 请添加微信wx153666购买授权，不白嫖从我做起！ 测试证书会失效，请勿正式环境使用
       grant: thisIsTestLicense
       license: TtY9GC88CzSkEmUhzIyvM2MJKvsgPyxoNCExH4/GhaBwuTQ93aeLaR6/dM49wMSk+oQdmqUibCM8b5H74s1Nx+2C5V3U1gKiLtddVc8Eg8oC1F2nLxOiDKDvPpdxWFGsPW6mQE2LDr+tK8GXpFS3N8xwmYy/gHCwQ4Avqp9JqBbke7pZzL2adIlxYHmCYpfNTN+NRHIEFaGFTBlzZHDb3UfJaeqLaAtWBol0QOPEM69Kz3JSemxBHnEO1ID75bwwmkgqC7Ps4z9iYAK9GLzzaPwSiFELNCmIvwa5YSJLxP9NMQUWbVGIRqehxnVqfgx/68+yIfpByqGTMxLR33yeEQ==
     # 全局配置加密算法密钥
     encryptor:
       # MD5_32 MD5_16 BASE64 AES SM2 SM3 SM4 需要 password，其他加密算法需要 password publicKey privateKey
       password: mybatis-mate-encryptor-password-666
       publicKey: MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCEOCMScPeNaJ0DP9N9vd/fXwPGUVnuxeGPpRePXfWuX/X/Yk5IMhwEfYLXictxQk/oAqGnqtDuS/PCL/7mqL+8wFSYnWWErCSkDdT6LjyD07l9dWv+Xj1UTEjP24sEgYA92f4AZyvhsw8I/Bj6a9a30r+kVOGoEZgGMf2c2xK4CQIDAQAB
       privateKey: MIICdwIBADANBgkqhkiG9w0BAQEFAASCAmEwggJdAgEAAoGBAIQ4IxJw941onQM/0329399fA8ZRWe7F4Y+lF49d9a5f9f9iTkgyHAR9gteJy3FCT+gCoaeq0O5L88Iv/uaov7zAVJidZYSsJKQN1PouPIPTuX11a/5ePVRMSM/biwSBgD3Z/gBnK+GzDwj8GPpr1rfSv6RU4agRmAYx/ZzbErgJAgMBAAECgYBAlFK9DSQ8k14tWh1oizcvmO71DIMKluhHCvHo+pGnLAOxS0jFBoScxNkFga42kZcJ0U8337zQx5Q1ws+TxdRwHxQO889ZGQH3kOFB0ErUMTgFrTOakZhV0dMWzebkYitNcduSKZ1yfgM5ekF9k3owPIQhUNy8eXjagiLLb9/woQJBALwofOx+fuanQLC1yotFqYAx0XED9EpVPhS/G8mc4dZSNWZ548bIyq3ozP0CoHqriQo/X3NVzIJOU3rhn92fwj0CQQCz5FaeHzSqe1H4bTxzwgR5BUHttxrAPtktwfgCRgaSrZByjFldtP/dGaJmjR2Vzp848WcusJZlSlaLTfndm6W9AkEAoSxlZgctGNKn3Ta7mvU/Lmp+J7rlZU8DcK4LVXYnFXkx+OfsLvkMdE/4V7oKUUnih36lepxCJFSHubjPQf55WQJBAIUa8yxUkreCQAi9avmMGZsiVMH7tgOBfVjqKQQlpD9rxXG8f3Nitd93VD7lM3rhQ9byaBKX/vA7rQWuUK+0t1ECQDTGhLRJFZK4J7UGklTX94pknM/5rO3N/JPkFJcGilbgzkqy0s13D1K+8cR0qTn2DPW8vPoLQpVGuaATTTmMdvg=
   

   @SpringBootTest
   class MybatisPlusApplicationTests {
   
       @Test
       void contextLoads() throws Exception {
           Map<String, Key> keyMap = RSA.genKeyPair();
           String publicKey = RSA.getPublicKey(keyMap);
           String privateKey = RSA.getPrivateKey(keyMap);
           System.out.println("publicKey========="+publicKey);
           System.out.println("privateKey========="+privateKey);
       }
   
   }
   
   注意：password为任意字符串，publicKey和privateKey通过如上方法生成

4. SQL脚本

   CREATE TABLE `encrypt` (
     `id` bigint NOT NULL COMMENT '主键ID',
     `MD5_32` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci DEFAULT NULL COMMENT 'MD5_32',
     `MD5_16` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci DEFAULT NULL COMMENT 'MD5_16',
     `BASE64` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci DEFAULT NULL COMMENT 'BASE64',
     `AES` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci DEFAULT NULL COMMENT 'AES',
     `RSA` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci DEFAULT NULL COMMENT 'RSA',
     `SM2` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci DEFAULT NULL COMMENT 'SM2',
     `SM3` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci DEFAULT NULL COMMENT 'SM3',
     `SM4` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci DEFAULT NULL COMMENT 'SM4',
     `PBEWithMD5AndDES` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci DEFAULT NULL COMMENT 'PBEWithMD5AndDES',
     `PBEWithMD5AndTripleDES` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci DEFAULT NULL COMMENT 'PBEWithMD5AndTripleDES',
     `PBEWithHMACSHA512AndAES_256` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci DEFAULT NULL COMMENT 'PBEWithHMACSHA512AndAES_256',
     `PBEWithSHA1AndDESede` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci DEFAULT NULL COMMENT 'PBEWithSHA1AndDESede',
     `PBEWithSHA1AndRC2_40` varchar(255) CHARACTER SET utf8mb4 COLLATE utf8mb4_0900_ai_ci DEFAULT NULL COMMENT 'PBEWithSHA1AndRC2_40',
     PRIMARY KEY (`id`)
   ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci;

5. 代码生成(MybatisX)

   @RestController
   @RequestMapping("/encrypt")
   public class EncryptController {
   
       @Autowired
       private EncryptService encrtptService;
   
       @PostMapping("/create")
       public Boolean create(@RequestBody Encrypt encrypt) {
           return encrtptService.save(encrypt);
       }
   
       @GetMapping("/get")
       public Encrypt get(@RequestBody Encrypt encrypt) {
           return encrtptService.getById(encrypt.getId());
       }
   
       @GetMapping("/getAll")
       public List<Encrypt> getAll() {
           return encrtptService.list();
       }
   
       @PutMapping("/update")
       public Boolean update(@RequestBody Encrypt encrypt) {
           return encrtptService.updateById(encrypt);
       }
   
       @DeleteMapping("/delete")
       public Boolean delete(@RequestBody Encrypt encrypt) {
           return encrtptService.removeById(encrypt);
       }
   
       @DeleteMapping("/deleteAll")
       public Boolean deleteAll() {
           return encrtptService.remove(new QueryWrapper<>());
       }
   
   }

   
6. 加密算法
   
7. 字段加密(@FieldEncrypt)

   /**
    *
    * @TableName encrypt
    */
   @TableName(value ="encrypt")
   @Data
   public class Encrypt implements Serializable {
       /**
        * 主键ID
        */
       @TableId(value = "id")
       private Long id;
   
       /**
        * MD5_32
        */
       @FieldEncrypt(algorithm = Algorithm.MD5_32)
       @TableField(value = "MD5_32")
       private String md532;
   
       /**
        * MD5_16
        */
       @FieldEncrypt(algorithm = Algorithm.MD5_16)
       @TableField(value = "MD5_16")
       private String md516;
   
       /**
        * BASE64
        */
       @FieldEncrypt(algorithm = Algorithm.BASE64)
       @TableField(value = "BASE64")
       private String base64;
   
       /**
        * AES
        */
       @FieldEncrypt(algorithm = Algorithm.AES)
       @TableField(value = "AES")
       private String aes;
   
       /**
        * RSA
        */
       @FieldEncrypt(algorithm = Algorithm.RSA)
       @TableField(value = "RSA")
       private String rsa;
   
       /**
        * SM2
        */
       @FieldEncrypt(algorithm = Algorithm.SM2)
       @TableField(value = "SM2")
       private String sm2;
   
       /**
        * SM3
        */
       @FieldEncrypt(algorithm = Algorithm.SM3)
       @TableField(value = "SM3")
       private String sm3;
   
       /**
        * SM4
        */
       @FieldEncrypt(algorithm = Algorithm.SM4)
       @TableField(value = "SM4")
       private String sm4;
   
       /**
        * PBEWithMD5AndDES
        */
       @FieldEncrypt(algorithm = Algorithm.PBEWithMD5AndDES)
       @TableField(value = "PBEWithMD5AndDES")
       private String pbewithmd5anddes;
   
       /**
        * PBEWithMD5AndTripleDES
        */
       @FieldEncrypt(algorithm = Algorithm.PBEWithMD5AndTripleDES)
       @TableField(value = "PBEWithMD5AndTripleDES")
       private String pbewithmd5andtripledes;
   
       /**
        * PBEWithHMACSHA512AndAES_256
        */
       @FieldEncrypt(algorithm = Algorithm.PBEWithHMACSHA512AndAES_256)
       @TableField(value = "PBEWithHMACSHA512AndAES_256")
       private String pbewithhmacsha512andaes256;
   
       /**
        * PBEWithSHA1AndDESede
        */
       @FieldEncrypt(algorithm = Algorithm.PBEWithSHA1AndDESede)
       @TableField(value = "PBEWithSHA1AndDESede")
       private String pbewithsha1anddesede;
   
       /**
        * PBEWithSHA1AndRC2_40
        */
       @FieldEncrypt(algorithm = Algorithm.PBEWithSHA1AndRC2_40)
       @TableField(value = "PBEWithSHA1AndRC2_40")
       private String pbewithsha1andrc240;
   
       @TableField(exist = false)
       private static final long serialVersionUID = 1L;
   
       @Override
       public boolean equals(Object that) {
           if (this == that) {
               return true;
           }
           if (that == null) {
               return false;
           }
           if (getClass() != that.getClass()) {
               return false;
           }
           Encrypt other = (Encrypt) that;
           return (this.getId() == null ? other.getId() == null : this.getId().equals(other.getId()))
               && (this.getMd532() == null ? other.getMd532() == null : this.getMd532().equals(other.getMd532()))
               && (this.getMd516() == null ? other.getMd516() == null : this.getMd516().equals(other.getMd516()))
               && (this.getBase64() == null ? other.getBase64() == null : this.getBase64().equals(other.getBase64()))
               && (this.getAes() == null ? other.getAes() == null : this.getAes().equals(other.getAes()))
               && (this.getRsa() == null ? other.getRsa() == null : this.getRsa().equals(other.getRsa()))
               && (this.getSm2() == null ? other.getSm2() == null : this.getSm2().equals(other.getSm2()))
               && (this.getSm3() == null ? other.getSm3() == null : this.getSm3().equals(other.getSm3()))
               && (this.getSm4() == null ? other.getSm4() == null : this.getSm4().equals(other.getSm4()))
               && (this.getPbewithmd5anddes() == null ? other.getPbewithmd5anddes() == null : this.getPbewithmd5anddes().equals(other.getPbewithmd5anddes()))
               && (this.getPbewithmd5andtripledes() == null ? other.getPbewithmd5andtripledes() == null : this.getPbewithmd5andtripledes().equals(other.getPbewithmd5andtripledes()))
               && (this.getPbewithhmacsha512andaes256() == null ? other.getPbewithhmacsha512andaes256() == null : this.getPbewithhmacsha512andaes256().equals(other.getPbewithhmacsha512andaes256()))
               && (this.getPbewithsha1anddesede() == null ? other.getPbewithsha1anddesede() == null : this.getPbewithsha1anddesede().equals(other.getPbewithsha1anddesede()))
               && (this.getPbewithsha1andrc240() == null ? other.getPbewithsha1andrc240() == null : this.getPbewithsha1andrc240().equals(other.getPbewithsha1andrc240()));
       }
   
       @Override
       public int hashCode() {
           final int prime = 31;
           int result = 1;
           result = prime * result + ((getId() == null) ? 0 : getId().hashCode());
           result = prime * result + ((getMd532() == null) ? 0 : getMd532().hashCode());
           result = prime * result + ((getMd516() == null) ? 0 : getMd516().hashCode());
           result = prime * result + ((getBase64() == null) ? 0 : getBase64().hashCode());
           result = prime * result + ((getAes() == null) ? 0 : getAes().hashCode());
           result = prime * result + ((getRsa() == null) ? 0 : getRsa().hashCode());
           result = prime * result + ((getSm2() == null) ? 0 : getSm2().hashCode());
           result = prime * result + ((getSm3() == null) ? 0 : getSm3().hashCode());
           result = prime * result + ((getSm4() == null) ? 0 : getSm4().hashCode());
           result = prime * result + ((getPbewithmd5anddes() == null) ? 0 : getPbewithmd5anddes().hashCode());
           result = prime * result + ((getPbewithmd5andtripledes() == null) ? 0 : getPbewithmd5andtripledes().hashCode());
           result = prime * result + ((getPbewithhmacsha512andaes256() == null) ? 0 : getPbewithhmacsha512andaes256().hashCode());
           result = prime * result + ((getPbewithsha1anddesede() == null) ? 0 : getPbewithsha1anddesede().hashCode());
           result = prime * result + ((getPbewithsha1andrc240() == null) ? 0 : getPbewithsha1andrc240().hashCode());
           return result;
       }
   
       @Override
       public String toString() {
           StringBuilder sb = new StringBuilder();
           sb.append(getClass().getSimpleName());
           sb.append(" [");
           sb.append("Hash = ").append(hashCode());
           sb.append(", id=").append(id);
           sb.append(", md532=").append(md532);
           sb.append(", md516=").append(md516);
           sb.append(", base64=").append(base64);
           sb.append(", aes=").append(aes);
           sb.append(", rsa=").append(rsa);
           sb.append(", sm2=").append(sm2);
           sb.append(", sm3=").append(sm3);
           sb.append(", sm4=").append(sm4);
           sb.append(", pbewithmd5anddes=").append(pbewithmd5anddes);
           sb.append(", pbewithmd5andtripledes=").append(pbewithmd5andtripledes);
           sb.append(", pbewithhmacsha512andaes256=").append(pbewithhmacsha512andaes256);
           sb.append(", pbewithsha1anddesede=").append(pbewithsha1anddesede);
           sb.append(", pbewithsha1andrc240=").append(pbewithsha1andrc240);
           sb.append(", serialVersionUID=").append(serialVersionUID);
           sb.append("]");
           return sb.toString();
       }
   }

8. 加密测试

   加密前：
   {
   	"md532": "md532",
   	"md516": "md516",
   	"base64": "base64",
   	"aes": "aes",
   	"rsa": "rsa",
   	"sm2": "sm2",
   	"sm3": "sm3",
   	"sm4": "sm4",
   	"pbewithmd5anddes": "pbewithmd5anddes",
   	"pbewithmd5andtripledes": "pbewithmd5andtripledes",
   	"pbewithhmacsha512andaes256": "pbewithhmacsha512andaes256",
   	"pbewithsha1anddesede": "pbewithsha1anddesede",
   	"pbewithsha1andrc240": "pbewithsha1andrc240"
   }
   
   注意：调用控制器接口向数据库插入数据

   

   加密后：
   {
       "id": "1614832069533679617",
   	"md532": "0ed5449e148dfaac16d1247667d62554",
   	"md516": "838026c17d7ac626",
   	"base64": "YmFzZTY0",
   	"aes": "3420e2d91b8f913bb035258e5013cc6f",
   	"rsa": "FqVQIe05Q/usNmZZWA9omCf63WYbhT7z4Qsrpvr+RsWv70vV3hVK5sV1/HZvQL6uI9pU0dkdPDEwIzn0DCJIoVKCW3l7fubdOkjOgaqxv5tIdcLmZFl9XivzA6sDhSIzitFLAj4OJu2HgbF1fNDoVEdYqAD7BEMeNeCyQYyjNQk=",
   	"sm2": "sm2",
   	"sm3": "d0c7f21dc640a69786764d688920d4d968a103a437a6159b9e7cc7c4b826b8ac",
   	"sm4": "sm4",
   	"pbewithmd5anddes": "q30eLvs6615ATdqtscdIpSdZLgC+vg1/+8mLzeD2INo=",
   	"pbewithmd5andtripledes": "PjjKX2OkRE2D/mz3UZLTXXAsLkjuAk6rF8l4WVz/CaE=",
   	"pbewithhmacsha512andaes256": "N5GESK0bGjLsJGO4DadbUMNzPo6ov/svzNHCZg0S4gmrsMLSDMLHDO/6ZrPNsYhpBTR53Xmksi9fxwSU5ScshQ==",
   	"pbewithsha1anddesede": "1kGvVHNUKDbwYG1ZnLhaK2QPre3jFddM3tB6MQETzwE=",
   	"pbewithsha1andrc240": "my9MZrkBSRtwgV6/MjAjwug7HB/lKHTMzmZJeUOrCQY="
   }
   
   注意：数据库存储内容为密文，其中SM2与SM4加密失败，其他算法加密成功

   

   解密后：
   {
       "id": 1614832069533679617,
       "md532": "0ed5449e148dfaac16d1247667d62554",
       "md516": "838026c17d7ac626",
       "base64": "base64",
       "aes": "aes",
       "rsa": "rsa",
       "sm2": "sm2",
       "sm3": "d0c7f21dc640a69786764d688920d4d968a103a437a6159b9e7cc7c4b826b8ac",
       "sm4": "sm4",
       "pbewithmd5anddes": "pbewithmd5anddes",
       "pbewithmd5andtripledes": "pbewithmd5andtripledes",
       "pbewithhmacsha512andaes256": "pbewithhmacsha512andaes256",
       "pbewithsha1anddesede": "pbewithsha1anddesede",
       "pbewithsha1andrc240": "pbewithsha1andrc240"
   }
   
   注意：调用控制器接口查询数据，查询结果为加密前数据，其中MD5_32 MD5_16 SM3仍是密文，说明这三种算法不可逆

   

9. 自定义算法

   注意：自定义加密算法需实现IEncryptor接口，IEncryptor接口可有多个实现类，但只能有一个实现类添加@Component注解，添加
   @Component注解便启用自定义加密算法，一旦启用自定义加密算法，那么项目中所有@FieldEncrypt加密的字段都将使用自定义加密
   算法进行加密，其他算法均不再生效，如下CustomEncryptor自定义加密算法，加密时"##$$##=="+plaintext+"--&&$$&&"实现加密，
   解密时encrypt.replace("##$$##==", "").replace("--&&$$&&", "")实现解密

   // 自定义加密算法，这里为开启使用默认加密库
   @Component
   public class CustomEncryptor implements IEncryptor {
       /**
        * 加密
        *
        * @param algorithm  算法
        * @param password   密码（对称加密算法密钥）
        * @param plaintext  明文
        * @param publicKey  非对称加密算法（公钥）
        * @param metaObject {@link MetaObject}
        * @return
        */
       @Override
       public String encrypt(Algorithm algorithm, String password, String publicKey, String plaintext, Object metaObject) {
           if (metaObject instanceof MetaObject) {
               // _metaObject为加密字段所属对象,可通过已知属性名获取属性值，_metaObject.getValue("属性名")
               MetaObject _metaObject = ((MetaObject) metaObject);
           }
           return "##$$##=="+plaintext+"--&&$$&&";
       }
   
   
       /**
        * 解密
        *
        * @param algorithm  算法
        * @param password   密码（对称加密算法密钥）
        * @param encrypt    密文
        * @param privateKey 非对称加密算法（私钥）
        * @param metaObject {@link MetaObject}
        * @return
        */
       @Override
       public String decrypt(Algorithm algorithm, String password, String privateKey, String encrypt, Object metaObject) {
           if (metaObject instanceof MetaObject) {
               // _metaObject为加密字段所属对象,可通过已知属性名获取属性值，_metaObject.getValue("属性名")
               MetaObject _metaObject = ((MetaObject) metaObject);
           }
           return encrypt.replace("##$$##==", "").replace("--&&$$&&", "");
       }
   }