MyBatis数据库脱敏

一、国密SM4加密

<dependency>
     <groupId>org.bouncycastlegroupId>
     <artifactId>bcprov-jdk15onartifactId>
     <version>1.70version>
dependency>

1.1 工具类

import org.bouncycastle.jce.provider.BouncyCastleProvider;

import javax.crypto.Cipher;
import javax.crypto.Mac;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.security.Security;
import java.util.Arrays;

public class Sm4Util {

    private static final String ALGORITHM = "SM4";
    private static final String TRANSFORMATION_ECB = ALGORITHM + "/ECB/PKCS7Padding";
    private static final String TRANSFORMATION_CBC = ALGORITHM + "/CBC/PKCS7Padding";
    private static final String TRANSFORMATION_ECB_NoPADDING = ALGORITHM + "/ECB/NoPadding";
    private static final String TRANSFORMATION_CBC_NoPADDING = ALGORITHM + "/CBC/NoPadding";


    private static final String ALGORITHM_HMAC_SM4 = "HmacSHA256";
    private static final String PROVIDER_NAME = "BC";


    static {
        Security.addProvider(new BouncyCastleProvider());
    }

    /**
     * 签名
     */
    public static byte[] sign(byte[] key, byte[] data) throws Exception {
        Mac mac = Mac.getInstance(ALGORITHM_HMAC_SM4, PROVIDER_NAME);
        SecretKeySpec secretKeySpec = new SecretKeySpec(key, ALGORITHM_HMAC_SM4);
        mac.init(secretKeySpec);
        return mac.doFinal(data);
    }

    /**
     * 验证签名
     */
    public static boolean verify(byte[] key, byte[] data, byte[] signature) throws Exception {
        Mac mac = Mac.getInstance(ALGORITHM_HMAC_SM4, PROVIDER_NAME);
        SecretKeySpec secretKeySpec = new SecretKeySpec(key, ALGORITHM_HMAC_SM4);
        mac.init(secretKeySpec);
        byte[] computedSignature = mac.doFinal(data);
        return Arrays.equals(computedSignature, signature);
    }

    /**
     * /CBC/PKCS7Padding 加密
     */
    public static byte[] encryptByCbcPkcs7Padding(byte[] key, byte[] data) throws Exception{
        Cipher cipher = Cipher.getInstance(TRANSFORMATION_CBC , "BC");
        SecretKeySpec secretKeySpec = new SecretKeySpec(key, ALGORITHM);
        // CBC模式需要一个初始化向量
        byte[] iv = new byte[16]; // 随机生成或指定
        Arrays.fill(iv, (byte) 0x00); // 示例中填充为0
        IvParameterSpec ivParameterSpec = new IvParameterSpec(iv);
        cipher.init(Cipher.ENCRYPT_MODE, secretKeySpec, ivParameterSpec);
        return cipher.doFinal(data);
    }

    /**
     * /CBC/PKCS7Padding 解密
     */
    public static byte[] decryptByCbcPkcs7Padding(byte[] key, byte[] data) throws Exception{
        Cipher cipher = Cipher.getInstance(TRANSFORMATION_CBC , "BC");
        SecretKeySpec secretKeySpec = new SecretKeySpec(key, ALGORITHM);
        byte[] iv = new byte[16]; // 随机生成或指定
        Arrays.fill(iv, (byte) 0x00); // 示例中填充为0
        IvParameterSpec ivParameterSpec = new IvParameterSpec(iv);
        cipher.init(Cipher.DECRYPT_MODE, secretKeySpec, ivParameterSpec);
        return cipher.doFinal(data);
    }

    /**
     * /ECB/PKCS7Padding 加密
     */
    public static byte[] encryptByEcbPkcs7Padding(byte[] key, byte[] data) throws Exception{
        Cipher cipher = Cipher.getInstance(TRANSFORMATION_ECB , "BC");
        SecretKeySpec secretKeySpec = new SecretKeySpec(key, ALGORITHM);
        cipher.init(Cipher.ENCRYPT_MODE, secretKeySpec);
        return cipher.doFinal(data);
    }

    /**
     * /ECB/PKCS7Padding 解密
     */
    public static byte[] decryptByEcbPkcs7Padding(byte[] key, byte[] data) throws Exception{
        Cipher cipher = Cipher.getInstance(TRANSFORMATION_ECB , "BC");
        SecretKeySpec secretKeySpec = new SecretKeySpec(key, ALGORITHM);
        cipher.init(Cipher.DECRYPT_MODE, secretKeySpec);
        return cipher.doFinal(data);
    }

    /**
     * /ECB/NoPadding 加密
     */
    public static byte[] encryptByEcbPkcs7PaddingNoPadding(byte[] key, byte[] data) throws Exception{
        Cipher cipher = Cipher.getInstance(TRANSFORMATION_ECB_NoPADDING , "BC");
        SecretKeySpec secretKeySpec = new SecretKeySpec(key, ALGORITHM);
        cipher.init(Cipher.ENCRYPT_MODE, secretKeySpec);
        return cipher.doFinal(data);
    }

    /**
     * /ECB/NoPadding 解密
     */
    public static byte[] decryptByEcbPkcs7PaddingNoPadding(byte[] key, byte[] data) throws Exception{
        Cipher cipher = Cipher.getInstance(TRANSFORMATION_ECB_NoPADDING , "BC");
        SecretKeySpec secretKeySpec = new SecretKeySpec(key, ALGORITHM);
        cipher.init(Cipher.DECRYPT_MODE, secretKeySpec);
        return cipher.doFinal(data);
    }

    /**
     * /CBC/NoPadding 加密
     */
    public static byte[] encryptByCbcPkcs7PaddingNoPadding(byte[] key, byte[] data) throws Exception{
        Cipher cipher = Cipher.getInstance(TRANSFORMATION_CBC_NoPADDING , "BC");
        SecretKeySpec secretKeySpec = new SecretKeySpec(key, ALGORITHM);
        byte[] iv = new byte[16];
        Arrays.fill(iv, (byte) 0x00);
        IvParameterSpec ivParameterSpec = new IvParameterSpec(iv);
        cipher.init(Cipher.ENCRYPT_MODE, secretKeySpec, ivParameterSpec);
        return cipher.doFinal(data);
    }

    /**
     * /CBC/NoPadding 解密
     */
    public static byte[] decryptByCbcPkcs7PaddingNoPadding(byte[] key, byte[] data) throws Exception{
        Cipher cipher = Cipher.getInstance(TRANSFORMATION_CBC_NoPADDING , "BC");
        SecretKeySpec secretKeySpec = new SecretKeySpec(key, ALGORITHM);
        byte[] iv = new byte[16];
        Arrays.fill(iv, (byte) 0x00);
        IvParameterSpec ivParameterSpec = new IvParameterSpec(iv);
        cipher.init(Cipher.DECRYPT_MODE, secretKeySpec, ivParameterSpec);
        return cipher.doFinal(data);
    }


}

1.2 SM4Util使用测试

@SpringBootTest(classes = ServerApplication.class)
public class Sm4UtilTest {

    private static final byte[] KEY = KeyGenUtil.generate128BitKey(); // 16字节128位的密钥
    private static final String DATA = "This is a test message for SM4 encryption.";
    //16字节或16字节的整数倍字符串,无填充模式NoPadding要求
    private static final String DATA16 = "HelloWorldYesYes";

    @Test
    public void testEncryptDecryptEcbPkcs7Padding() throws Exception {
        byte[] encrypted = Sm4Util.encryptByEcbPkcs7Padding(KEY, DATA.getBytes());
        //签名
        byte[] signatureData = Sm4Util.sign(KEY, encrypted);
        //验证
        boolean isValid = Sm4Util.verify(KEY, encrypted, signatureData);
        System.out.println("签名验证结果：" + isValid);
        byte[] decrypted = Sm4Util.decryptByEcbPkcs7Padding(KEY, encrypted);
        System.out.println("解密后数据" + new String(decrypted));
    }

    @Test
    public void testEncryptDecryptCbcPkcs7Padding() throws Exception {
        byte[] encrypted = Sm4Util.encryptByCbcPkcs7Padding(KEY, DATA.getBytes());
        //签名
        byte[] signatureData = Sm4Util.sign(KEY, encrypted);
        //验证
        boolean isValid = Sm4Util.verify(KEY, encrypted, signatureData);
        System.out.println("签名验证结果：" + isValid);
        byte[] decrypted = Sm4Util.decryptByCbcPkcs7Padding(KEY, encrypted);
        System.out.println("解密后数据" + new String(decrypted));
    }


    @Test
    public void testEncryptDecryptEcbPkcs7PaddingNoPadding() throws Exception {
        byte[] encrypted = Sm4Util.encryptByEcbPkcs7PaddingNoPadding(KEY, DATA16.getBytes());
        byte[] signatureData = Sm4Util.sign(KEY, encrypted);
        boolean isValid = Sm4Util.verify(KEY, encrypted, signatureData);
        System.out.println("签名验证结果：" + isValid);
        byte[] decrypted = Sm4Util.decryptByEcbPkcs7PaddingNoPadding(KEY, encrypted);
        System.out.println("解密后数据" + new String(decrypted));
    }

    @Test
    public void testEncryptDecryptCbcPkcs7PaddingNoPadding() throws Exception {
        byte[] encrypted = Sm4Util.encryptByCbcPkcs7PaddingNoPadding(KEY, DATA16.getBytes());
        byte[] signatureData = Sm4Util.sign(KEY, encrypted);
        boolean isValid = Sm4Util.verify(KEY, encrypted, signatureData);
        System.out.println("签名验证结果：" + isValid);
        byte[] decrypted = Sm4Util.decryptByCbcPkcs7PaddingNoPadding(KEY, encrypted);
        System.out.println("解密后数据" + new String(decrypted));
    }
}

二、MyBatis使用SM4加解密

2.1 创建表结构

DROP TABLE IF EXISTS user_info;
CREATE TABLE user_info (
	id BIGINT(20) PRIMARY KEY AUTO_INCREMENT COMMENT '自增主键',
	name VARCHAR(128) NOT NULL DEFAULT '' COMMENT '姓名'
);

SELECT * FROM user_info;
INSERT INTO user_info (name) VALUES ('c4f6371b67fac0f224c5b44456d3c71f');

2.2 pom

<dependency>
	<groupId>com.baomidougroupId>
	<artifactId>mybatis-plus-boot-starterartifactId>
	<version>3.5.2version>
dependency>

2.3 配置连接地址

spring:
  datasource:
    username: root
    password: root
    url: jdbc:mysql:///test?useUnicode=true&characterEncoding=utf-8&useSSL=true&serverTimezone=UTC&nullCatalogMeansCurrent=true
    driver-class-name: com.mysql.cj.jdbc.Driver

2.4 编写mapper和xml

public interface UserInfoMapper {

    UserInfo getUserInfoById(@Param("id") Long id);

    List<UserInfo> list();
}

DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
        "http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="com.zn.opit.demo.mapper.UserInfoMapper">

    <select id="getUserInfoById" resultType="com.zn.opit.demo.entity.UserInfo">
        SELECT id, name FROM user_info WHERE id = #{id}
    select>

    <select id="list" resultType="com.zn.opit.demo.entity.UserInfo">
        SELECT id, name FROM user_info
    select>
mapper>

2.5 编写SQL拦截器对查询字段解密

@Intercepts(
        {
                @Signature(type = Executor.class, method = "query", args = {MappedStatement.class, Object.class, RowBounds.class, ResultHandler.class}),
                @Signature(type = Executor.class, method = "update", args = {MappedStatement.class, Object.class})
        }
)
public class EncryptInterceptor implements Interceptor {

    private static final byte[] KEY = Sm4Util.decodeHex("6c376375e8e3979f91f805faa860dd43");// KeyGenUtil.generate128BitKey(); // 16字节128位的密钥

    @SuppressWarnings(value = "unchecked")
    @Override
    public Object intercept(Invocation invocation) throws Throwable {
        Object resultObj = invocation.proceed();
        ArrayList<UserInfo> list = (ArrayList<UserInfo>) resultObj;
        for (UserInfo userInfo : list) {
            byte[] decrypted = Sm4Util.decryptByEcbPkcs7Padding(KEY, Hex.decodeHex(userInfo.getName()));
            userInfo.setName(new String(decrypted));
        }
        return list;
    }

    @Override
    public Object plugin(Object target) {
        return Plugin.wrap(target, this);
    }
}

2.6 配置解密拦截器

@Configuration
public class MyBatisConfig {

    @Bean
    public ConfigurationCustomizer mybatisConfigurationCustomizer() {
        return configuration -> {
            // 在这里可以修改MyBatis的全局配置
            configuration.setMapUnderscoreToCamelCase(true);
            // 添加自定义的插件等
            // 加解密插件
            EncryptInterceptor encryptInterceptor = new EncryptInterceptor();

            //添加插件-configuration.addInterceptor(...);
            configuration.addInterceptor(encryptInterceptor);
        };
    }
}

2.7 测试执行

@SpringBootTest(classes = ServerApplication.class)
public class MyBatisInterceptorTest {

    @Resource
    private UserInfoMapper userInfoMapper;

    @Test
    public void test() {
        UserInfo userInfoById = userInfoMapper.getUserInfoById(1L);
        System.out.println(userInfoById.getName());
        System.out.println("====================");
        List<UserInfo> list = userInfoMapper.list();
        list.forEach(item -> System.out.println(item.getName()));
    }
}