前后端分离数据传输加解密方案(建议方案二)

方案一 请求响应参数全部加密

1.优缺点

  a.优点：实现简单，比明文传输安全

  b.缺点：1)由于加密所有参数，效率低下 2)信息全加密，不利于前后端联调  3)密钥传输不安全，容易被拦截

   优化点：前端生成AES对称加密密钥，用rsa私钥非对称加密将AES密钥加密，传给到后端，后端用rsa公钥解密后获取到AES密钥，这样前后端就有了公共的AES密钥了

2.开发步骤（AES对称加密)

加密流程:

  a.前端调用接口/web/security/v1/getAesKey 并将其保存在sesssionStrage中

  b.后端在前端调用/web/security/v1/getAesKey时，生成AES密钥并保存在session中，并返回给前端

  c.前端访问其他接口传入的参数都用此AES密钥加密，接收到的响应数据都用此AES密钥解密，可以拦截器，对所有请求和响应加解密

  d.后端和前端一样用此AES密钥进行加解密

前端加解密

<script src="https://cdn.bootcss.com/crypto-js/3.1.9-1/crypto-js.min.js"></script>

/**
* 加密
**/
function encrypt(value,key) {
    var tempValue = JSON.stringify(value);
 var tempKey = CryptoJS.enc.Utf8.parse(key);
 var srcs = CryptoJS.enc.Utf8.parse(tempValue); 
 var encrypted = CryptoJS.AES.encrypt(srcs, key, { mode: CryptoJS.mode.ECB, 
  padding:CryptoJS.pad.Pkcs7 });
  var encryptedValue = encrypted.toString();
   return encryptedValue;
}


/**
*解密
**/
 function decrypt(value,key) {
    var keyStr = CryptoJS.enc.Utf8.parse(key)
    var decrypt = CryptoJS.AES.decrypt(value, keyStr, { mode: CryptoJS.mode.ECB, padding: CryptoJS.pad.Pkcs7 })
    return CryptoJS.enc.Utf8.stringify(decrypt).toString()
 }
 

b.后端加解密

  public class AesEncrypt {

 /**
     * 加密
     *
     * @param value数据
     * @param key  密钥
     * @return 加密后内容
     */
    public static byte[] encrypt(byte[] value, String key) throw Exception{
            Cipher cipher = Cipher.getInstance(DEFAULT_CIPHER_ALGORITHM);
            cipher.init(Cipher.ENCRYPT_MODE, new SecretKeySpec(key.getBytes("UTF-8"), "AES"));
            return cipher.doFinal(value);
       
    }

 /**
     * 解密
     *
     * @param value数据
     * @param key  密钥
     * @return 解密后内容
     */
    public static  byte[] decrypt(byte[] value, String key) throw Exception {
  
            Cipher cipher = Cipher.getInstance(DEFAULT_CIPHER_ALGORITHM);
            SecretKeySpec secretKeySpec = new SecretKeySpec(key.getBytes("UTF-8"), "AES");
            //使用密钥初始化，设置为解密模式
            cipher.init(Cipher.DECRYPT_MODE, secretKeySpec);
            //执行操作
            return cipher.doFinal(value);

        
    }
}

c.后端拦截代码实现

/**
* 请求过滤器，记得注册
**/
public EncryptFilter implements Filter {

 @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain)
        throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) servletRequest;
        String uri = request.getRequestURI();
        LOGGER.debug("进入加解密过滤器，URI:{}", uri);
        HttpServletResponse response = (HttpServletResponse) servletResponse;
       AesHttpServletRequestWrapper aesHttpServletRequestWrapper = new AesHttpServletRequestWrapper(request);
        filterChain.doFilter(aesHttpServletRequestWrapper, response);
       
    }

}

/**
* (1)请求拦截，解密
**/
public class AesHttpServletRequestWrapper extends HttpServletRequestWrapper {

     private String bodyContent;
     private Parameters parameters = new Parameters();
     private HttpServletRequest request;

     public AesHttpServletRequestWrapper (HttpServletRequest request) {
    request = request;
    initWrapper();
  }

private void initWrapper() {
      this.parameters.setCharset(charset);
      readBodyBytes();
      this.parseParameterMap();
  }  

 private void readBodyBytes() {
    if (this.bodyContent == null) {
      try {
        byte[] bodyBytes = readInputBody(request.getInputStream());
        this.bodyContent = new String(AesEncrypt.decrypt(bodyBytes), charset);
      } catch (IOException e) {
        throw new RuntimeException(e);
      }
    }
  }  

 private byte[] readInputBody(InputStream inputStream) throws IOException {
    ByteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
    byte[] buffer = new byte[1024];
    int len;
    while ((len = inputStream.read(buffer)) > -1) {
      byteArrayOutputStream.write(buffer, 0, len);
    }
    byteArrayOutputStream.flush();
    return byteArrayOutputStream.toByteArray();
  }  
  
  @Override
  public String getQueryString() {
    return queryString;
  }

  @Override
  public String getParameter(String name) {
    String[] values = getParameterValues(name);
    return values == null || values.length == 0 ? null : values[0];
  }
  @Override
  public int getContentLength() {
    return bodyContent.getBytes(charset).length;
  }

  @Override
  public long getContentLengthLong() {
    return bodyContent.getBytes(charset).length;
  }

     @Override
  public Map<String, String[]> getParameterMap() {
    if (paramsMap == null) {
      paramsMap = new HashMap<>();
      Enumeration<String> nameEnum = this.parameters.getParameterNames();
      while (nameEnum.hasMoreElements()) {
        String name = nameEnum.nextElement();
        paramsMap.put(name, getParameterValues(name));
      }
    }
    return paramsMap;
  }

  @Override
  public Enumeration<String> getParameterNames() {
    return this.parameters.getParameterNames();
  }

  @Override
  public String[] getParameterValues(String name) {
    return parameters.getParameterValues(name);
  }
}

/**
* (2) 响应拦截 加密
**/

@ControllerAdvice
public class AesResponseAdvice implements ResponseBodyAdvice<Object> {
        
    private static final String AES_KEY= "AES_KEY";
  

      @Override
    public Object beforeBodyWrite(Object body, MethodParameter methodParameter,
                                  MediaType mediaType,
                                  Class<? extends HttpMessageConverter<?>> converterClass,
                                  ServerHttpRequest serverHttpRequest,
                                  ServerHttpResponse serverHttpResponse) {
        ServletServerHttpRequest request = (ServletServerHttpRequest) serverHttpRequest;
        if (body != null) {
            ServletServerHttpResponse response = (ServletServerHttpResponse) serverHttpResponse;
            try {
                byte[] contentBytes = null;
                    contentBytes = String.valueOf(body).getBytes(Charset.forName("UTF-8"));
                 Object aesKey = request.getServletRequest().getSession().getAttribute(AES_KEY);
               body = AesEncrypt.encrypt(contentBytes,String.value(aesKey));
                
            } catch (IOException e) {
                LOGGER.error("加密数据失败", e);
            }
        }
        return body;
    }

}

方案一 请求响应参数自定义加密字段(比如id)

1.优缺点

 a.优点：效率高，只加密某些重要字段

 b.缺点：实现复杂

2.开发步骤

a.自定义注解 @Encrypt，放属性上或者参数上

@JacksonAnnotation
@Retention(RetentionPolicy.RUNTIME)
@Target({ElementType.FIELD, ElementType.PARAMETER})
public @interface Encrypt {
    String value() default "";
    String fieldName() default "";
    String[] ignoreValue() default {};
}

b.springmvc中增加请求参数解析器，响应参数解析器

public class EncryptRequestParamMethodArgumentResolver extends RequestParamMethodArgumentResolver {
    IEncryptionService encryptionService;

    @Override
    @Nullable
    protected Object resolveName(String name, MethodParameter parameter, NativeWebRequest request) throws Exception {
        Object result = super.resolveName(name, parameter, request);
        if (EncryptContext.isEncrypt() && result != null && parameter.hasParameterAnnotation(Encrypt.class)) {
            Encrypt encrypt = parameter.getParameterAnnotation(Encrypt.class);
            if (result instanceof String && !EncryptUtils.ignoreValue(encrypt, (String) result)) {
                if (isArray(parameter)) {
                    result = ((String) result).split(",");
                } else {
                    result = encryptionService.decrypt(((String) result), encrypt.value());
                    return result;
                }
            }
            if (result instanceof String[]) {
                String[] oldResult = (String[]) result;
                String[] newResult = new String[oldResult.length];
                for (int i = 0; i < oldResult.length; i++) {
                    if (EncryptUtils.ignoreValue(encrypt, oldResult[i])) {
                        newResult[i] = oldResult[i];
                    } else {
                        newResult[i] = encryptionService.decrypt(oldResult[i], encrypt.value());
                    }
                }
                return newResult;
            }
        }
        return result;
    }

public class EncryptRequestResponseBodyMethodProcessor extends RequestResponseBodyMethodProcessor {

    @Override
    public Object resolveArgument(MethodParameter parameter, @Nullable ModelAndViewContainer mavContainer,
                                  NativeWebRequest webRequest, @Nullable WebDataBinderFactory binderFactory) throws Exception {
        if (!EncryptContext.isEncrypt()) {
            return super.resolveArgument(parameter, mavContainer, webRequest, binderFactory);
        }
        Encrypt encrypt = parameter.getParameterAnnotation(Encrypt.class);
        if (encrypt == null) {
            return super.resolveArgument(parameter, mavContainer, webRequest, binderFactory);
        }
        // 如果是集合类，且范型类型是基础类型的包装类型
        if (Collection.class.isAssignableFrom(parameter.getParameterType())) {
            return resolveCollectionArgument(parameter, mavContainer, webRequest, binderFactory, encrypt);
        }
        // 如果是集合类，且范型类型是基础类型的包装类型
        if (parameter.getParameterType().isArray()) {
            return resolveArrayArgument(parameter, mavContainer, webRequest, binderFactory, encrypt);
        }
        // 如果是 Map 类，且泛型类型是基础类型顶的包装类型
        if (Map.class.isAssignableFrom(parameter.getParameterType())) {
            return resolveMapArgument(parameter, mavContainer, webRequest, binderFactory, encrypt);
        }
        return super.resolveArgument(parameter, mavContainer, webRequest, binderFactory);
    }
    
}

c.将请求，响应参数解析器，加入到springmvc解析器列表中HandlerMethodArgumentResolver

public class WebBeanPostProcessor implements BeanPostProcessor, PriorityOrdered {
    @Nullable
    @Override
    public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
        if (bean instanceof RequestMappingHandlerAdapter) {
            RequestMappingHandlerAdapter adapter = (RequestMappingHandlerAdapter) bean;
            List<HandlerMethodArgumentResolver> currentResolvers = adapter.getArgumentResolvers();
            if (currentResolvers == null) {
                throw new IllegalStateException(
                        String.format("No HandlerMethodArgumentResolvers found in RequestMappingHandlerAdapter %s!", beanName));
            }
            //IEncryptionService encryptionService = new EncryptionService();
            //替换PathVariableMethodArgumentResolver 和 RequestParamMethodArgumentResolver
            PathVariableMethodArgumentResolver pathVariableMethodArgumentResolver = new EncryptPathVariableMethodArgumentResolver(encryptionService);
            RequestParamMethodArgumentResolver requestParamMethodArgumentResolverFalse = new EncryptRequestParamMethodArgumentResolver(encryptionService, beanFactory, false);
            RequestParamMethodArgumentResolver requestParamMethodArgumentResolverTrue = new EncryptRequestParamMethodArgumentResolver(encryptionService, beanFactory, true);
            EncryptRequestResponseBodyMethodProcessor encryptRequestResponseBodyMethodProcessor;
            try {
                encryptRequestResponseBodyMethodProcessor = new EncryptRequestResponseBodyMethodProcessor(adapter.getMessageConverters(),
                        (List<Object>) FieldUtils.readDeclaredField(adapter, "requestResponseBodyAdvice", true));
            } catch (IllegalAccessException e) {
                throw new CommonException(e);
            }
            encryptRequestResponseBodyMethodProcessor.setEncryptionService(encryptionService);
            List<HandlerMethodArgumentResolver> resolvers = new ArrayList<>(adapter.getArgumentResolvers().size());
            //spring 默认注册了2个requestParamMethodArgumentResolver
            boolean isFirst = true;
            for (HandlerMethodArgumentResolver resolver : adapter.getArgumentResolvers()) {
                if (resolver instanceof PathVariableMethodArgumentResolver) {
                    resolvers.add(pathVariableMethodArgumentResolver);
                    continue;
                }
                if (resolver instanceof RequestParamMethodArgumentResolver) {
                    if (isFirst) {
                        resolvers.add(requestParamMethodArgumentResolverFalse);
                        isFirst = false;
                        continue;
                    }
                    resolvers.add(requestParamMethodArgumentResolverTrue);
                    continue;
                }
                if (resolver instanceof RequestResponseBodyMethodProcessor) {
                    resolvers.add(encryptRequestResponseBodyMethodProcessor);
                    continue;
                }
                resolvers.add(resolver);
            }
            adapter.setArgumentResolvers(resolvers);
            
}

3.实现效果