MD5加时间戳加密验证签名

项目中App与系统进行数据交互（数据的存储，短信验证的发送）时需要对交互的数据进行签名校验，防止数据被篡改。

自己单独写了个小例子

第一步：pom.xml

  4.0.0
  springboot_valid
  sign_valid
  0.0.1-SNAPSHOT
  
    
        org.springframework.boot  
        spring-boot-starter-parent  
        1.5.2.RELEASE
    
   
   
	  
		org.springframework.boot  
		spring-boot-starter-web   
	
	  
        org.springframework  
         spring-webmvc   
    
        
    
		org.springframework.boot
		spring-boot-starter-redis
		1.4.7.RELEASE
		
        
     
           
          org.springframework.boot  
            spring-boot-devtools  
            true  
            true   
           
      
  
   
        
          
            
                  org.springframework.boot  
                  spring-boot-maven-plugin  
                  
                     true  
                   
             
          
         

第二步：Springboot启动类

package com;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class ApplicationController {

	public static void main(String[] args) {
		SpringApplication.run(ApplicationController.class, args);
	}
}

第三步：验证参数实体（这里暂只有主要的时间戳和签名，一般会连带交互的数据一起）

package com.sign.param;

import com.fasterxml.jackson.annotation.JsonProperty;

public class VerificationCodeParam {

	//签名
	@JsonProperty(value = "Sign")
	private String sign;
	
	//时间戳
	@JsonProperty(value = "TimeStamp")
	private long TimeStamp;

	public String getSign() {
		return sign;
	}

	public void setSign(String sign) {
		this.sign = sign;
	}

	public long getTimeStamp() {
		return TimeStamp;
	}

	public void setTimeStamp(long timeStamp) {
		TimeStamp = timeStamp;
	}

}

第四步：控制层，接口

package com.sign.controller;


import org.springframework.beans.factory.annotation.Value;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

import com.sign.param.VerificationCodeParam;
import com.sign.util.SignUtil;
import com.sign.util.TimestampUtil;

@RestController
@RequestMapping(value = "/sign" , produces = "application/json")
public class signValidateController {

	@Value("${ticketSecret}")
	private String ticketSecret;
	
	//签名校验
	@RequestMapping(value = "/valid")
	public boolean signValid(@RequestBody VerificationCodeParam param) {
		
		// 验证信息是否被篡改
		if(!SignUtil.validateMessage(param, ticketSecret)) {
			return false;
		}
		// 验证时间戳,防止重复提交
		Boolean validateResult = TimestampUtil.validateTimestamp("verificationCode", param.getTimeStamp());
		if(!validateResult) {
			return false;
		}
		return true;
	}
}

第五步：工具类

SignUtil签名验证工具类，其中调用了CheckUtil类（计算新的签名，拼接数据等操作）MD5Util类（加密），MapKeyComparator(使用treeMap进行排序时传入自定义比较器【可省略】)

TimestampUtil时间戳验证类 ，其中调用了RedisUtil工具类(将时间戳存入redis)，其中RedisUtil中使用SpringContextUtil类获取redis实例

package com.sign.util;

import com.sign.param.VerificationCodeParam;

public class SignUtil {

	
	public static boolean validateMessage(VerificationCodeParam param,String secretKey) {
		CheckUtil check = new CheckUtil(secretKey);
		check.setValue("timeStamp", param.getTimeStamp());
		boolean result = check.checkSign(param.getSign());
		return result;
	}
}

 

package com.sign.util;

import java.util.HashMap;
import java.util.Iterator;
import java.util.Map;
import java.util.TreeMap;

public class CheckUtil {

	private String secret;
	
	private Map map = new HashMap();
	
	public CheckUtil(String secret) {
		this.secret = secret;
	}
	
	/**
	 * 添加参数
	 * @param key
	 * @param value
	 */
	public void setValue(String key,Object value) {
		map.put(key, value);
	}
	
	/**
	 * 检验签名是否正确
	 * @param sign
	 * @return
	 */
	public boolean checkSign(String sign) {
		if(sign == null || sign == "") {
			return false;
		}
		//本地计算新的签名
		String cal_sign = makeSign();
		if(cal_sign.equals(sign)) {
			return true;
		}else {
			return false;
		}
	}
	
	/**
	 * 生成签名
	 * @return
	 */
	public String makeSign() {
		//拼接数据
		String str = buildData();
		//在拼接的数据后拼入API KEY
		str += "&key=" + secret;
		//MD5加密
		String re = MD5Util.encrypt(str);
		//所有字符串转成大写
		return re.toUpperCase();
		
	}
	
	/**
	 * 拼接数据
	 * @return
	 */
	private String buildData() {
		String str = "";
		Map resultMap = sortMapByKey(map);
		Iterator it = resultMap.keySet().iterator();
		while(it.hasNext()) {
			String key = it.next();
			Object value = resultMap.get(key);
			str += key + "=" + value +"&"; 
		}
		str = str.substring(0,str.length() - 1);
		return str;
	}
	
	/**
	 * 使用 Map按key进行排序(这里重写了比较器的compare方法按升序排序)
	 * @param map
	 * @return
	 */
	public static Map sortMapByKey(Map map){
		if(map == null || map.isEmpty()) {
			return null;
		}
		Map sortMap = new TreeMap(new MapKeyComparator());
		sortMap.putAll(map);
		return sortMap ;
	}
}

 

package com.sign.util;

import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;

public class MD5Util {

	public final static String encrypt(String s) {
		char hexDigits[] = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'A', 'B', 'C', 'D', 'E', 'F' };
		
		byte [] byteInput = s.getBytes();
		//获取MD5摘要算法的MessageDigest对象
		try {
			MessageDigest mdInst = MessageDigest.getInstance("MD5");
			//使用指定的字节更新摘要
			mdInst.update(byteInput);
			//获得密文
			byte[] md = mdInst.digest();
			// 把密文转换成十六进制的字符串形式
			int j = md.length;
			char str[] = new char[j *2];  //char占两个字节
			 int k = 0;
	            for (int i = 0; i < j; i++) {
	                byte byte0 = md[i];
	                str[k++] = hexDigits[byte0 >>> 4 & 0xf];
	                str[k++] = hexDigits[byte0 & 0xf];  //右移四位，高四位清空 取低四位的值
	            }
	            return new String(str);
		} catch (NoSuchAlgorithmException e) {
			e.printStackTrace();
		}
		
		
		return null;
	}
}

 

package com.sign.util;

import java.util.Comparator;

public class MapKeyComparator implements Comparator {

	public int compare(String str1, String str2) {
		return str1.compareTo(str2);   //升序排序
		//return str2.compareTo(str1);   降序排序	
	}

}

 

时间戳验证

package com.sign.util;

import java.util.Date;
import java.util.concurrent.TimeUnit;

public class TimestampUtil {

	/**
	 * 验证时间戳是否合法
	 * @param cacheKey
	 * @param currentTimestamp
	 * @return
	 */
	public static Boolean validateTimestamp(String cacheKey,long currentTimestamp) {
		long beforeTimeStamp = 0;
		String timestamp = RedisUtil.Instance().getCacheAccessToken(cacheKey);
		if(timestamp != null && timestamp != "") {
			beforeTimeStamp = Long.parseLong(timestamp);
		}
		// //当前时间戳小于或等于之前的时间戳。说明是重复的
		if(currentTimestamp < beforeTimeStamp && beforeTimeStamp > 0) {
			return false;
		}
		 //session可能会超时
		long nowTimeStamp = getSecondTimestampTwo(new Date());
		if(nowTimeStamp - currentTimestamp > 3000000) {
			return false;
		}
		//redis存储的key,value,失效时间，时间单位
		RedisUtil.Instance().setCacheAccessToken(cacheKey, String.valueOf(currentTimestamp), 3, TimeUnit.DAYS);
		
		return true;
		
	}

	/**
	 * 精确到秒的时间戳
	 * @param date
	 * @return
	 */
	private static long getSecondTimestampTwo(Date date) {
		if(null == date) {
			return 0;
		}
		String timestamp = String.valueOf(date.getTime()/1000);
		return Long.parseLong(timestamp);
	}
	
}

 

package com.sign.util;

import java.util.concurrent.TimeUnit;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.data.redis.core.RedisTemplate;
import org.springframework.data.redis.core.ValueOperations;
import org.springframework.stereotype.Component;

@Component
public class RedisUtil {

	@Autowired
	private RedisTemplate redisTemplate;
	
	private static RedisUtil _instance;
	
	public static RedisUtil Instance() {
		if(_instance == null) {
			_instance = SpringContextUtil.getBean(RedisUtil.class);
		}
		return _instance;
	}
	
	/**
	 * 缓存AccessToken
	 * @param redisKey
	 * @param token
	 * @param expireTime
	 * @param timeUnit
	 */
	public void setCacheAccessToken(String redisKey,String token,long expireTime,TimeUnit timeUnit) {
		ValueOperations ho = redisTemplate.opsForValue();
		//存储用户资源权限到redis，3天失效
		ho.set(redisKey, token, expireTime, timeUnit);
	}
	
	/**
	 * 缓存中读取AccessToken
	 * @param redisKey
	 * @return
	 */
	public String getCacheAccessToken(String redisKey) {
		ValueOperations ho = redisTemplate.opsForValue();
		return ho.get(redisKey);
	}
	
	
	
}

 

package com.sign.util;

import org.springframework.beans.BeansException;
import org.springframework.context.ApplicationContext;
import org.springframework.context.ApplicationContextAware;
import org.springframework.stereotype.Component;

@Component
public class SpringContextUtil implements ApplicationContextAware{

	private static ApplicationContext applicationContext;
	
	public void setApplicationContext(ApplicationContext arg0) throws BeansException {
		if(SpringContextUtil.applicationContext == null) {
			SpringContextUtil.applicationContext = arg0;
		}
		System.out.println("********ApplicationContext配置成功,在普通类可以通过调用SpringUtils.getAppContext()获取applicationContext对象,applicationContext=\"+SpringContextUtil.applicationContext+\"**********");
	}

	 //获取applicationContext
	public static ApplicationContext getApplicationContext() {
		return applicationContext;
	}
	
	//通过name获取 Bean.
	public static Object getBean(String name) {
		return getApplicationContext().getBean(name);	
	}
	

    //通过class获取Bean.
    public static  T getBean(Class clazz){
        return getApplicationContext().getBean(clazz);
    }

    //通过name,以及Clazz返回指定的Bean
    public static  T getBean(String name,Class clazz){
        return getApplicationContext().getBean(name, clazz);
    }
	
}