前后端敏感数据加密方案及实现_01

系统管理员 2023-01-21 04:27 29阅读 0赞

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MDgxNjczOA_size_16_color_FFFFFF_t_70]

### 文章目录 ###

*   *   *   *   *  一、组成部分
                 *   *  1. html
                     *  2. js
                     *  3. 拦截器
                     *  4. 认证授权
                     *  5. 控制层
                     *  6. 工具类

##### 一、组成部分 #####

###### 1. html ######

###### 2. js ######

jsencrypt.min.js
    <script type="text/javascript" src="${ctxPath}/assets/modular/frame/jsencrypt.min.js"></script>

###### 3. 拦截器 ######

package com.gblfy.controller;
    
    import cn.stylefeng.roses.core.reqres.response.ResponseData;
    import com.gblfy.utils.RSAUtils;
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    import org.springframework.stereotype.Controller;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RequestMethod;
    import org.springframework.web.bind.annotation.ResponseBody;
    
    import javax.servlet.http.HttpServletRequest;
    import javax.servlet.http.HttpServletResponse;
    import java.util.HashMap;
    import java.util.Map;
    
    /**
     * 登陆前校验
     *
     * @author guobin
     * @date 2021-01-27
     */
    @Controller
    public class CheckLogInController { 
        private final static Logger logger = LoggerFactory.getLogger(CheckLogInController.class);
    
    
        @RequestMapping(value = "/checkLogin", method = RequestMethod.POST)
        @ResponseBody
        public ResponseData CheckLogin(HttpServletRequest request, HttpServletResponse httpServletResponse) { 
    //        Boolean flag = false;//true-已经登陆 false-未登陆或登陆session一样
            String ip = "";//返回空-未登录。非空-已登录
            Map<String,String> map=new HashMap<>();
            Map<String, Object> mmap = new HashMap<>();
            try { 
                map = RSAUtils.createRSAKeys();
                String aPublic = map.get("public");
                //获取当前用户的sessionId
                String sessionId = request.getSession().getId();//当前sessionid
                String privateKey=sessionId+"privateKey";
                request.getServletContext().setAttribute(privateKey,map.get("private"));
                mmap.put("publicKey",aPublic);
    
                String username = request.getParameter("username").trim();//用户名
                String sessionIdOld = (String) request.getServletContext().getAttribute(username);//老sessionId
                //如果老sessionId不为null 且新老sessionId不一致,则当前账号已有人登陆
                mmap.put("ip",ip);
                if (null != sessionIdOld && !"".equals(sessionId) && !sessionId.equals(sessionIdOld)) { 
                    ip = (String) request.getServletContext().getAttribute(username + "IP");
                    mmap.put("ip",ip);
                }
            } catch (Exception e) { 
                logger.error("从session中获取用户登陆ip失败:", e);
                ip = "";
            }
    
            return ResponseData.success(mmap);
        }
    }

###### 4. 认证授权 ######

/**
         * 不需要权限验证的资源表达式
         */
        List<String> NONE_PERMISSION_RES = CollectionUtil.newLinkedList("/assets/**","/checkLogin","/login", "/global/sessionError", "/kaptcha", "/error", "/global/error");

###### 5. 控制层 ######

/**
         * 点击登录执行的动作
         *
         * @author gblfy
         * @Date 2019/11/23 5:42 PM
         */
        @RequestMapping(value = "/login", method = RequestMethod.POST)
        public String loginVali(HttpServletRequest request) { 
    
            String sessionId = request.getSession().getId();
            String username = super.getPara("username").trim();
            String password = super.getPara("password").trim();
            //如果开启了记住我功能
            String remember = super.getPara("remember");
    
            String privateKey = sessionId + "privateKey";
    
            String privateKey1 = request.getServletContext().getAttribute(privateKey).toString();
            password = RSAUtils.decode(password, privateKey1);
    
            Subject currentUser = ShiroKit.getSubject();
            UsernamePasswordToken token = new UsernamePasswordToken(username, password.toCharArray());
    
            //如果开启了记住我功能
            if ("on".equals(remember)) { 
                token.setRememberMe(true);
            } else { 
                token.setRememberMe(false);
            }
    
            //执行shiro登录操作
            currentUser.login(token);
    
            //登录成功，记录登录日志
            ShiroUser shiroUser = ShiroKit.getUserNotNull();
            super.getSession().setAttribute("shiroUser", shiroUser);
            super.getSession().setAttribute("username", shiroUser.getAccount());
    
            try { 
                //获取老sessionId
                String sessionIdOld = (String) request.getServletContext().getAttribute(username);
                if (null != sessionIdOld && !sessionId.equals(sessionIdOld)) { 
                    //注销老session
                    HttpSession session = (HttpSession) request.getServletContext().getAttribute(sessionIdOld);
                    session.invalidate();
                }
                //获取老sessionId
            } catch (Exception e) { 
                e.printStackTrace();
                //非正常清空session
            }
    
            //重新赋值
    request.getSession().getServletContext().setAttribute(username, sessionId);
            request.getSession().getServletContext().setAttribute(sessionId, request.getSession());
            request.getSession().getServletContext().setAttribute(username + "IP", Inet4AddresslUtils.getReqIp(request));
    
    
            LogManager.me().executeLog(LogTaskFactory.loginLog(shiroUser.getId(), getIp()));
    
            ShiroKit.getSession().setAttribute("sessionFlag", true);
            return REDIRECT + "/";
        }

###### 6. 工具类 ######

package com.gblfy.utils;
    
    import org.apache.commons.logging.Log;
    import org.apache.commons.logging.LogFactory;
    import org.apache.tomcat.util.codec.binary.Base64;
    
    import javax.crypto.Cipher;
    import java.security.*;
    import java.security.spec.PKCS8EncodedKeySpec;
    import java.security.spec.X509EncodedKeySpec;
    import java.util.HashMap;
    import java.util.LinkedList;
    import java.util.List;
    import java.util.Map;
    
    /**
     * @author gblfy
     * @createDate 创建时间：2021-05-15
     */
    public class RSAUtils { 
        protected static final Log log = LogFactory.getLog(RSAUtils.class);
        private static String KEY_RSA_TYPE = "RSA";
        private static int KEY_SIZE = 1024;//JDK方式RSA加密最大只有1024位
        private static int ENCODE_PART_SIZE = KEY_SIZE/8;
        public static final String PUBLIC_KEY_NAME = "public";
        public static final String PRIVATE_KEY_NAME = "private";
    
        /**
         * 创建公钥秘钥
         * @return
         */
        public static Map<String,String> createRSAKeys(){ 
            Map<String,String> keyPairMap = new HashMap<>();//里面存放公私秘钥的Base64位加密
            try { 
                KeyPairGenerator keyPairGenerator = KeyPairGenerator.getInstance(KEY_RSA_TYPE);
                keyPairGenerator.initialize(KEY_SIZE,new SecureRandom());
                KeyPair keyPair = keyPairGenerator.generateKeyPair();
    
                //获取公钥秘钥
                String publicKeyValue = Base64.encodeBase64String(keyPair.getPublic().getEncoded());
                String privateKeyValue = Base64.encodeBase64String(keyPair.getPrivate().getEncoded());
    
                //存入公钥秘钥，以便以后获取
                keyPairMap.put(PUBLIC_KEY_NAME,publicKeyValue);
                keyPairMap.put(PRIVATE_KEY_NAME,privateKeyValue);
            } catch (NoSuchAlgorithmException e) { 
                log.error("当前JDK版本没找到RSA加密算法！");
                e.printStackTrace();
            }
            return keyPairMap;
        }
    
        /**
         * 公钥加密
         * 描述：
         *     1字节 = 8位；
         *     最大加密长度如 1024位私钥时，最大加密长度为 128-11 = 117字节，不管多长数据，加密出来都是 128 字节长度。
         * @param sourceStr
         * @param publicKeyBase64Str
         * @return
         */
        public static String encode(String sourceStr,String publicKeyBase64Str){ 
            byte [] publicBytes = Base64.decodeBase64(publicKeyBase64Str);
            //公钥加密
            X509EncodedKeySpec x509EncodedKeySpec = new X509EncodedKeySpec(publicBytes);
            List<byte[]> alreadyEncodeListData = new LinkedList<>();
    
            int maxEncodeSize = ENCODE_PART_SIZE - 11;
            String encodeBase64Result = null;
            try { 
                KeyFactory keyFactory = KeyFactory.getInstance(KEY_RSA_TYPE);
                PublicKey publicKey = keyFactory.generatePublic(x509EncodedKeySpec);
                Cipher cipher = Cipher.getInstance(KEY_RSA_TYPE);
                cipher.init(Cipher.ENCRYPT_MODE,publicKey);
                byte[] sourceBytes = sourceStr.getBytes("utf-8");
                int sourceLen = sourceBytes.length;
                for(int i=0;i<sourceLen;i+=maxEncodeSize){ 
                    int curPosition = sourceLen - i;
                    int tempLen = curPosition;
                    if(curPosition > maxEncodeSize){ 
                        tempLen = maxEncodeSize;
                    }
                    byte[] tempBytes = new byte[tempLen];//待加密分段数据
                    System.arraycopy(sourceBytes,i,tempBytes,0,tempLen);
                    byte[] tempAlreadyEncodeData = cipher.doFinal(tempBytes);
                    alreadyEncodeListData.add(tempAlreadyEncodeData);
                }
                int partLen = alreadyEncodeListData.size();//加密次数
    
                int allEncodeLen = partLen * ENCODE_PART_SIZE;
                byte[] encodeData = new byte[allEncodeLen];//存放所有RSA分段加密数据
                for (int i = 0; i < partLen; i++) { 
                    byte[] tempByteList = alreadyEncodeListData.get(i);
                    System.arraycopy(tempByteList,0,encodeData,i*ENCODE_PART_SIZE,ENCODE_PART_SIZE);
                }
                encodeBase64Result = Base64.encodeBase64String(encodeData);
            } catch (Exception e) { 
                e.printStackTrace();
            }
            return encodeBase64Result;
        }
    
        /**
         * 私钥解密
         * @param sourceBase64RSA
         * @param privateKeyBase64Str
         */
        public static String decode(String sourceBase64RSA,String privateKeyBase64Str){ 
            byte[] privateBytes = Base64.decodeBase64(privateKeyBase64Str);
            byte[] encodeSource = Base64.decodeBase64(sourceBase64RSA);
            int encodePartLen = encodeSource.length/ENCODE_PART_SIZE;
            List<byte[]> decodeListData = new LinkedList<>();//所有解密数据
            String decodeStrResult = null;
            //私钥解密
            PKCS8EncodedKeySpec pkcs8EncodedKeySpec = new PKCS8EncodedKeySpec(privateBytes);
            try { 
                KeyFactory keyFactory = KeyFactory.getInstance(KEY_RSA_TYPE);
                PrivateKey privateKey = keyFactory.generatePrivate(pkcs8EncodedKeySpec);
                Cipher cipher = Cipher.getInstance(KEY_RSA_TYPE);
                cipher.init(Cipher.DECRYPT_MODE,privateKey);
                int allDecodeByteLen = 0;//初始化所有被解密数据长度
                for (int i = 0; i < encodePartLen; i++) { 
                    byte[] tempEncodedData = new byte[ENCODE_PART_SIZE];
                    System.arraycopy(encodeSource,i*ENCODE_PART_SIZE,tempEncodedData,0,ENCODE_PART_SIZE);
                    byte[] decodePartData = cipher.doFinal(tempEncodedData);
                    decodeListData.add(decodePartData);
                    allDecodeByteLen += decodePartData.length;
                }
                byte [] decodeResultBytes = new byte[allDecodeByteLen];
                for (int i = 0,curPosition = 0; i < encodePartLen; i++) { 
                    byte[] tempSorceBytes = decodeListData.get(i);
                    int tempSourceBytesLen = tempSorceBytes.length;
                    System.arraycopy(tempSorceBytes,0,decodeResultBytes,curPosition,tempSourceBytesLen);
                    curPosition += tempSourceBytesLen;
                }
                decodeStrResult = new String(decodeResultBytes,"UTF-8");
            }catch (Exception e){ 
                e.printStackTrace();
            }
            return decodeStrResult;
        }
    }

package com.gblfy.controller;
    
    import org.slf4j.Logger;
    import org.slf4j.LoggerFactory;
    
    import javax.servlet.http.HttpServletRequest;
    import java.net.Inet4Address;
    import java.net.InetAddress;
    import java.net.NetworkInterface;
    import java.net.SocketException;
    import java.util.Enumeration;
    
    public class Inet4AddresslUtils { 
    
        private final static Logger logger = LoggerFactory.getLogger(Inet4AddresslUtils.class);
    
        /**
         * 获取请求主机的ip地址
         *
         * @param request
         * @return
         */
        public static String getReqIp(HttpServletRequest request) { 
    
            String ip = request.getHeader("x-forwarded-for");
            if ((ip == null) || (ip.length() == 0) || ("unknown".equalsIgnoreCase(ip))) { 
                ip = request.getHeader("Proxy-Client-IP");
            }
            if ((ip == null) || (ip.length() == 0) || ("unknown".equalsIgnoreCase(ip))) { 
                ip = request.getHeader("WL-Proxy-Client-IP");
            }
            if ((ip == null) || (ip.length() == 0) || ("unknown".equalsIgnoreCase(ip))) { 
                ip = request.getRemoteAddr();
            }
            return ip;
        }
    
        /**
         * 获取服务器本机的ip地址
         *
         * @return
         */
        public static String getInet4Address() { 
            Enumeration<NetworkInterface> nis;
            String ip = null;
            try { 
                nis = NetworkInterface.getNetworkInterfaces();
                for (; nis.hasMoreElements(); ) { 
                    NetworkInterface ni = nis.nextElement();
                    Enumeration<InetAddress> ias = ni.getInetAddresses();
                    for (; ias.hasMoreElements(); ) { 
                        InetAddress ia = ias.nextElement();
                        if (ia instanceof Inet4Address && !ia.getHostAddress().equals("127.0.0.1")) { 
                            ip = ia.getHostAddress();
                        }
                    }
                }
            } catch (SocketException e) { 
                logger.error("获取ip地址异常", e);
            }
            return ip;
        }
    }

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3dlaXhpbl80MDgxNjczOA_size_16_color_FFFFFF_t_70]: /images/20221021/896df094e25d4f88afdc8033598e8571.png