客户數據泄露事件頻發，公司高層要求對敏感數據進行全面加密，但你卻發現加密並不是簡單的"加個密"那麼簡單...今天就來聊聊數據庫加密的那些事兒，讓你的數據真正固若金湯！

一、為什麼需要數據庫加密？

在開始介紹具體的加密方案之前，我們先來理解為什麼數據庫加密如此重要。

1.1 數據泄露的代價

// 數據泄露可能造成的損失
public class DataBreachCost {
    
    public void calculateBreachCost() {
        System.out.println("=== 數據泄露的潛在損失 ===");
        System.out.println("1. 直接經濟損失：罰款、賠償");
        System.out.println("2. 品牌聲譽損害：用户信任度下降");
        System.out.println("3. 法律風險：違反GDPR、網絡安全法等");
        System.out.println("4. 運營成本：應急響應、系統修復");
        System.out.println("5. 競爭劣勢：市場份額流失");
    }
}

1.2 合規要求

現代企業面臨着越來越多的合規要求：

• GDPR：歐盟通用數據保護條例
• 網絡安全法：中國網絡安全法
• PCI DSS：支付卡行業數據安全標準
• HIPAA：健康保險便攜性和責任法案

二、數據庫加密的基本概念

2.1 加密類型分類

數據庫加密主要分為以下幾種類型：

-- 透明數據加密 (TDE)
-- 應用層加密
-- 字段級加密
-- 傳輸加密 (TLS/SSL)

2.2 加密算法選擇

常用的加密算法及其特點：

算法	類型	特點	適用場景
AES	對稱加密	性能好，安全性高	大量數據加密
RSA	非對稱加密	安全性極高，性能較差	密鑰交換
SHA-256	哈希算法	不可逆，固定長度輸出	密碼存儲

三、主流數據庫加密方案

3.1 MySQL加密方案

3.1.1 透明數據加密 (TDE)

-- 啓用TDE（MySQL Enterprise Edition）
-- 1. 配置my.cnf
[mysqld]
early-plugin-load=keyring_file.so
keyring_file_data=/var/lib/mysql-keyring/keyring

-- 2. 創建加密表空間
CREATE TABLESPACE ts1 ADD DATAFILE 'ts1.ibd' 
ENCRYPTION='Y';

-- 3. 創建加密表
CREATE TABLE user_sensitive (
    id BIGINT PRIMARY KEY,
    username VARCHAR(50),
    password_hash VARCHAR(255),
    id_card VARCHAR(20),
    phone VARCHAR(20)
) ENCRYPTION='Y';

3.1.2 字段級加密

@Service
@Slf4j
public class MySqlEncryptionService {
    
    @Autowired
    private JdbcTemplate jdbcTemplate;
    
    @Autowired
    private EncryptionUtil encryptionUtil;
    
    /**
     * 插入加密數據
     */
    public void insertEncryptedUser(UserSensitive user) {
        String sql = "INSERT INTO user_sensitive (username, password_hash, id_card, phone) VALUES (?, ?, ?, ?)";
        
        // 對敏感字段進行加密
        String encryptedIdCard = encryptionUtil.encrypt(user.getIdCard());
        String encryptedPhone = encryptionUtil.encrypt(user.getPhone());
        
        jdbcTemplate.update(sql, 
            user.getUsername(),
            user.getPasswordHash(),
            encryptedIdCard,
            encryptedPhone);
    }
    
    /**
     * 查詢並解密數據
     */
    public UserSensitive getDecryptedUser(Long id) {
        String sql = "SELECT * FROM user_sensitive WHERE id = ?";
        
        return jdbcTemplate.queryForObject(sql, (rs, rowNum) -> {
            UserSensitive user = new UserSensitive();
            user.setId(rs.getLong("id"));
            user.setUsername(rs.getString("username"));
            user.setPasswordHash(rs.getString("password_hash"));
            
            // 解密敏感字段
            user.setIdCard(encryptionUtil.decrypt(rs.getString("id_card")));
            user.setPhone(encryptionUtil.decrypt(rs.getString("phone")));
            
            return user;
        }, id);
    }
}

3.1.3 加密工具類實現

@Component
public class EncryptionUtil {
    
    // AES密鑰（實際應用中應從配置中心獲取）
    private static final String SECRET_KEY = "your-secret-key-here-make-it-long-enough";
    
    // 初始化向量
    private static final String IV = "your-initialization-vector";
    
    /**
     * AES加密
     */
    public String encrypt(String plainText) {
        try {
            Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
            SecretKeySpec keySpec = new SecretKeySpec(SECRET_KEY.getBytes(), "AES");
            IvParameterSpec ivSpec = new IvParameterSpec(IV.getBytes());
            
            cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec);
            byte[] encrypted = cipher.doFinal(plainText.getBytes(StandardCharsets.UTF_8));
            
            return Base64.getEncoder().encodeToString(encrypted);
        } catch (Exception e) {
            throw new RuntimeException("加密失敗", e);
        }
    }
    
    /**
     * AES解密
     */
    public String decrypt(String encryptedText) {
        try {
            Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
            SecretKeySpec keySpec = new SecretKeySpec(SECRET_KEY.getBytes(), "AES");
            IvParameterSpec ivSpec = new IvParameterSpec(IV.getBytes());
            
            cipher.init(Cipher.DECRYPT_MODE, keySpec, ivSpec);
            byte[] decrypted = cipher.doFinal(Base64.getDecoder().decode(encryptedText));
            
            return new String(decrypted, StandardCharsets.UTF_8);
        } catch (Exception e) {
            throw new RuntimeException("解密失敗", e);
        }
    }
    
    /**
     * 密碼哈希（使用BCrypt）
     */
    public String hashPassword(String password) {
        return BCrypt.hashpw(password, BCrypt.gensalt());
    }
    
    /**
     * 驗證密碼
     */
    public boolean verifyPassword(String password, String hashedPassword) {
        return BCrypt.checkpw(password, hashedPassword);
    }
}

3.2 PostgreSQL加密方案

3.2.1 pgcrypto擴展

-- 啓用pgcrypto擴展
CREATE EXTENSION IF NOT EXISTS pgcrypto;

-- 創建加密表
CREATE TABLE user_sensitive (
    id SERIAL PRIMARY KEY,
    username VARCHAR(50),
    password_hash VARCHAR(255),
    id_card BYTEA,  -- 存儲加密後的身份證號
    phone BYTEA     -- 存儲加密後的手機號
);

-- 插入加密數據
INSERT INTO user_sensitive (username, password_hash, id_card, phone)
VALUES (
    'john_doe',
    crypt('user_password', gen_salt('bf')),
    pgp_sym_encrypt('110101199001011234', 'encryption_key'),
    pgp_sym_encrypt('13800138000', 'encryption_key')
);

-- 查詢並解密數據
SELECT 
    username,
    pgp_sym_decrypt(id_card, 'encryption_key') as decrypted_id_card,
    pgp_sym_decrypt(phone, 'encryption_key') as decrypted_phone
FROM user_sensitive 
WHERE id = 1;

3.2.2 應用層加密實現

@Service
@Slf4j
public class PostgreSqlEncryptionService {
    
    @Autowired
    private NamedParameterJdbcTemplate namedParameterJdbcTemplate;
    
    @Value("${app.db.encryption.key}")
    private String encryptionKey;
    
    /**
     * 插入加密數據
     */
    public void insertEncryptedUser(UserSensitive user) {
        String sql = "INSERT INTO user_sensitive (username, password_hash, id_card, phone) " +
                    "VALUES (:username, :password_hash, :id_card, :phone)";
        
        MapSqlParameterSource params = new MapSqlParameterSource();
        params.addValue("username", user.getUsername());
        params.addValue("password_hash", encryptPassword(user.getPassword()));
        params.addValue("id_card", encryptField(user.getIdCard()));
        params.addValue("phone", encryptField(user.getPhone()));
        
        namedParameterJdbcTemplate.update(sql, params);
    }
    
    /**
     * 查詢並解密數據
     */
    public UserSensitive getDecryptedUser(Long id) {
        String sql = "SELECT * FROM user_sensitive WHERE id = :id";
        
        MapSqlParameterSource params = new MapSqlParameterSource();
        params.addValue("id", id);
        
        return namedParameterJdbcTemplate.queryForObject(sql, params, (rs, rowNum) -> {
            UserSensitive user = new UserSensitive();
            user.setId(rs.getLong("id"));
            user.setUsername(rs.getString("username"));
            user.setPassword(rs.getString("password_hash")); // 密碼通常是哈希存儲
            
            // 解密敏感字段
            user.setIdCard(decryptField(rs.getBytes("id_card")));
            user.setPhone(decryptField(rs.getBytes("phone")));
            
            return user;
        });
    }
    
    private String encryptPassword(String password) {
        return BCrypt.hashpw(password, BCrypt.gensalt());
    }
    
    private byte[] encryptField(String fieldValue) {
        try {
            return PGPPublicKeyRing.encrypt(fieldValue.getBytes(StandardCharsets.UTF_8), 
                                          encryptionKey.toCharArray());
        } catch (Exception e) {
            throw new RuntimeException("字段加密失敗", e);
        }
    }
    
    private String decryptField(byte[] encryptedField) {
        try {
            return new String(PGPSecretKeyRing.decrypt(encryptedField, 
                                                     encryptionKey.toCharArray()), 
                             StandardCharsets.UTF_8);
        } catch (Exception e) {
            throw new RuntimeException("字段解密失敗", e);
        }
    }
}

四、加密方案設計原則

4.1 安全性與性能平衡

@Configuration
@EnableConfigurationProperties(EncryptionProperties.class)
public class EncryptionConfiguration {
    
    @Bean
    @ConditionalOnProperty(name = "app.encryption.enabled", havingValue = "true")
    public EncryptionService encryptionService(EncryptionProperties properties) {
        return new AdvancedEncryptionService(properties);
    }
    
    @Bean
    @ConditionalOnProperty(name = "app.encryption.enabled", havingValue = "false", matchIfMissing = true)
    public EncryptionService mockEncryptionService() {
        return new MockEncryptionService(); // 開發環境使用mock實現
    }
}

@Data
@ConfigurationProperties(prefix = "app.encryption")
public class EncryptionProperties {
    private boolean enabled = true;
    private String algorithm = "AES";
    private String mode = "GCM";
    private int keySize = 256;
    private String keyStorePath;
    private String keyStorePassword;
}

4.2 密鑰管理策略

@Service
@Slf4j
public class KeyManagementService {
    
    private final Map<String, SecretKey> keyCache = new ConcurrentHashMap<>();
    private final ScheduledExecutorService scheduler = Executors.newScheduledThreadPool(1);
    
    @PostConstruct
    public void init() {
        // 定期輪換密鑰
        scheduler.scheduleAtFixedRate(this::rotateKeys, 0, 24, TimeUnit.HOURS);
    }
    
    /**
     * 獲取當前使用的密鑰
     */
    public SecretKey getCurrentKey(String keyAlias) {
        return keyCache.computeIfAbsent(keyAlias, this::loadKeyFromStore);
    }
    
    /**
     * 獲取指定時間的密鑰（用於解密歷史數據）
     */
    public SecretKey getKeyForTimestamp(String keyAlias, LocalDateTime timestamp) {
        // 實現密鑰版本管理邏輯
        return loadKeyByVersion(keyAlias, getVersionForTimestamp(timestamp));
    }
    
    /**
     * 輪換密鑰
     */
    private void rotateKeys() {
        try {
            log.info("開始輪換加密密鑰");
            // 生成新密鑰
            SecretKey newKey = generateNewKey();
            
            // 更新密鑰存儲
            storeNewKey(newKey);
            
            // 清理舊密鑰緩存
            keyCache.clear();
            
            log.info("密鑰輪換完成");
        } catch (Exception e) {
            log.error("密鑰輪換失敗", e);
        }
    }
    
    private SecretKey loadKeyFromStore(String keyAlias) {
        // 從密鑰存儲中加載密鑰
        // 實際實現可能涉及硬件安全模塊(HSM)或雲密鑰管理服務
        return null;
    }
    
    private SecretKey generateNewKey() {
        try {
            KeyGenerator keyGenerator = KeyGenerator.getInstance("AES");
            keyGenerator.init(256);
            return keyGenerator.generateKey();
        } catch (NoSuchAlgorithmException e) {
            throw new RuntimeException("生成密鑰失敗", e);
        }
    }
}

4.3 加密數據的搜索優化

@Service
@Slf4j
public class SearchableEncryptionService {
    
    @Autowired
    private EncryptionUtil encryptionUtil;
    
    /**
     * 可搜索加密 - 確定性加密用於精確匹配
     */
    public String deterministicEncrypt(String plaintext) {
        // 使用固定的IV進行加密，確保相同明文產生相同密文
        return encryptionUtil.encryptWithFixedIV(plaintext);
    }
    
    /**
     * 可搜索加密 - 模糊搜索支持
     */
    public List<String> tokenizeAndEncrypt(String text) {
        // 對文本進行分詞並加密每個token
        List<String> tokens = tokenize(text);
        return tokens.stream()
                .map(this::deterministicEncrypt)
                .collect(Collectors.toList());
    }
    
    /**
     * 創建搜索索引
     */
    public void createSearchIndex(String tableName, String fieldName) {
        String sql = String.format(
            "CREATE INDEX idx_%s_%s_encrypted ON %s (%s_encrypted)",
            tableName, fieldName, tableName, fieldName
        );
        
        // 執行SQL創建索引
    }
    
    private List<String> tokenize(String text) {
        // 簡單的分詞實現，實際應用中可能使用專業的分詞庫
        return Arrays.asList(text.split("\\s+"));
    }
}

五、實戰案例：用户敏感信息保護系統

5.1 系統架構設計

graph TB
    A[應用層] --> B[加密服務層]
    B --> C[密鑰管理系統]
    B --> D[數據庫訪問層]
    D --> E[(MySQL/PostgreSQL)]
    C --> F[硬件安全模塊]
    
    style A fill:#ffe4c4,stroke:#333
    style B fill:#98fb98,stroke:#333
    style C fill:#87ceeb,stroke:#333
    style D fill:#dda0dd,stroke:#333
    style E fill:#ffb6c1,stroke:#333
    style F fill:#f0e68c,stroke:#333

5.2 核心代碼實現

@RestController
@RequestMapping("/api/users")
@Slf4j
public class UserController {
    
    @Autowired
    private UserService userService;
    
    @PostMapping
    public ResponseEntity<UserDto> createUser(@RequestBody CreateUserRequest request) {
        try {
            UserDto user = userService.createUser(request);
            return ResponseEntity.ok(user);
        } catch (EncryptionException e) {
            log.error("用户創建失敗：加密錯誤", e);
            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
                    .body(null);
        }
    }
    
    @GetMapping("/{id}")
    public ResponseEntity<UserDto> getUser(@PathVariable Long id) {
        try {
            UserDto user = userService.getUserById(id);
            return ResponseEntity.ok(user);
        } catch (DecryptionException e) {
            log.error("用户查詢失敗：解密錯誤", e);
            return ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR)
                    .body(null);
        }
    }
}

@Service
@Transactional
@Slf4j
public class UserServiceImpl implements UserService {
    
    @Autowired
    private UserRepository userRepository;
    
    @Autowired
    private EncryptionService encryptionService;
    
    @Override
    public UserDto createUser(CreateUserRequest request) {
        // 驗證輸入
        validateUserRequest(request);
        
        // 創建用户實體
        User user = new User();
        user.setUsername(request.getUsername());
        
        // 加密敏感信息
        UserSensitive sensitive = new UserSensitive();
        sensitive.setRealName(encryptionService.encrypt(request.getRealName()));
        sensitive.setIdCard(encryptionService.encrypt(request.getIdCard()));
        sensitive.setPhone(encryptionService.encrypt(request.getPhone()));
        sensitive.setEmail(encryptionService.encrypt(request.getEmail()));
        
        // 密碼哈希處理
        sensitive.setPasswordHash(encryptionService.hashPassword(request.getPassword()));
        
        // 保存到數據庫
        User savedUser = userRepository.save(user);
        UserSensitive savedSensitive = userRepository.saveSensitive(savedUser.getId(), sensitive);
        
        // 轉換為DTO
        return convertToDto(savedUser, savedSensitive);
    }
    
    @Override
    public UserDto getUserById(Long id) {
        User user = userRepository.findById(id)
                .orElseThrow(() -> new UserNotFoundException("用户不存在"));
        
        UserSensitive sensitive = userRepository.findSensitiveByUserId(id);
        
        // 解密敏感信息
        UserSensitive decryptedSensitive = new UserSensitive();
        decryptedSensitive.setRealName(encryptionService.decrypt(sensitive.getRealName()));
        decryptedSensitive.setIdCard(encryptionService.decrypt(sensitive.getIdCard()));
        decryptedSensitive.setPhone(encryptionService.decrypt(sensitive.getPhone()));
        decryptedSensitive.setEmail(encryptionService.decrypt(sensitive.getEmail()));
        
        return convertToDto(user, decryptedSensitive);
    }
    
    private void validateUserRequest(CreateUserRequest request) {
        // 實現輸入驗證邏輯
        if (StringUtils.isBlank(request.getUsername())) {
            throw new IllegalArgumentException("用户名不能為空");
        }
        
        if (!isValidIdCard(request.getIdCard())) {
            throw new IllegalArgumentException("身份證號碼格式不正確");
        }
        
        if (!isValidPhone(request.getPhone())) {
            throw new IllegalArgumentException("手機號格式不正確");
        }
    }
    
    private boolean isValidIdCard(String idCard) {
        // 身份證號碼驗證邏輯
        return idCard != null && idCard.matches("^\\d{17}[\\dXx]$");
    }
    
    private boolean isValidPhone(String phone) {
        // 手機號驗證邏輯
        return phone != null && phone.matches("^1[3-9]\\d{9}$");
    }
}

5.3 加密服務接口設計

public interface EncryptionService {
    
    /**
     * 加密字符串
     */
    String encrypt(String plaintext) throws EncryptionException;
    
    /**
     * 解密字符串
     */
    String decrypt(String ciphertext) throws DecryptionException;
    
    /**
     * 哈希密碼
     */
    String hashPassword(String password) throws EncryptionException;
    
    /**
     * 驗證密碼
     */
    boolean verifyPassword(String password, String hashedPassword) throws EncryptionException;
    
    /**
     * 生成數字簽名
     */
    String sign(String data) throws SignatureException;
    
    /**
     * 驗證數字簽名
     */
    boolean verifySignature(String data, String signature) throws SignatureException;
}

@Service
@Slf4j
public class AdvancedEncryptionServiceImpl implements EncryptionService {
    
    private final SecretKey secretKey;
    private final KeyPair keyPair;
    
    public AdvancedEncryptionServiceImpl(EncryptionProperties properties) {
        this.secretKey = loadSecretKey(properties);
        this.keyPair = generateKeyPair();
    }
    
    @Override
    public String encrypt(String plaintext) throws EncryptionException {
        try {
            Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
            // 生成隨機IV
            byte[] iv = new byte[12];
            new SecureRandom().nextBytes(iv);
            GCMParameterSpec spec = new GCMParameterSpec(128, iv);
            
            cipher.init(Cipher.ENCRYPT_MODE, secretKey, spec);
            byte[] ciphertext = cipher.doFinal(plaintext.getBytes(StandardCharsets.UTF_8));
            
            // 將IV和密文組合
            ByteBuffer byteBuffer = ByteBuffer.allocate(4 + iv.length + ciphertext.length);
            byteBuffer.putInt(iv.length);
            byteBuffer.put(iv);
            byteBuffer.put(ciphertext);
            
            return Base64.getEncoder().encodeToString(byteBuffer.array());
        } catch (Exception e) {
            throw new EncryptionException("加密失敗", e);
        }
    }
    
    @Override
    public String decrypt(String ciphertext) throws DecryptionException {
        try {
            byte[] decoded = Base64.getDecoder().decode(ciphertext);
            ByteBuffer byteBuffer = ByteBuffer.wrap(decoded);
            
            int ivLength = byteBuffer.getInt();
            if (ivLength != 12) { // GCM標準IV長度
                throw new IllegalArgumentException("Invalid IV length");
            }
            
            byte[] iv = new byte[ivLength];
            byteBuffer.get(iv);
            byte[] encrypted = new byte[byteBuffer.remaining()];
            byteBuffer.get(encrypted);
            
            Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
            GCMParameterSpec spec = new GCMParameterSpec(128, iv);
            cipher.init(Cipher.DECRYPT_MODE, secretKey, spec);
            
            byte[] plaintext = cipher.doFinal(encrypted);
            return new String(plaintext, StandardCharsets.UTF_8);
        } catch (Exception e) {
            throw new DecryptionException("解密失敗", e);
        }
    }
    
    @Override
    public String hashPassword(String password) throws EncryptionException {
        return BCrypt.hashpw(password, BCrypt.gensalt(12));
    }
    
    @Override
    public boolean verifyPassword(String password, String hashedPassword) throws EncryptionException {
        return BCrypt.checkpw(password, hashedPassword);
    }
    
    @Override
    public String sign(String data) throws SignatureException {
        try {
            Signature signature = Signature.getInstance("SHA256withRSA");
            signature.initSign(keyPair.getPrivate());
            signature.update(data.getBytes(StandardCharsets.UTF_8));
            byte[] signed = signature.sign();
            return Base64.getEncoder().encodeToString(signed);
        } catch (Exception e) {
            throw new SignatureException("簽名失敗", e);
        }
    }
    
    @Override
    public boolean verifySignature(String data, String signature) throws SignatureException {
        try {
            Signature sig = Signature.getInstance("SHA256withRSA");
            sig.initVerify(keyPair.getPublic());
            sig.update(data.getBytes(StandardCharsets.UTF_8));
            byte[] signatureBytes = Base64.getDecoder().decode(signature);
            return sig.verify(signatureBytes);
        } catch (Exception e) {
            throw new SignatureException("驗證簽名失敗", e);
        }
    }
    
    private SecretKey loadSecretKey(EncryptionProperties properties) {
        // 從配置或密鑰管理系統加載密鑰
        return null;
    }
    
    private KeyPair generateKeyPair() {
        try {
            KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
            keyGen.initialize(2048);
            return keyGen.generateKeyPair();
        } catch (NoSuchAlgorithmException e) {
            throw new RuntimeException("生成密鑰對失敗", e);
        }
    }
}

六、性能優化與監控

6.1 加密性能優化

@Component
@Slf4j
public class EncryptionPerformanceOptimizer {
    
    private final LoadingCache<String, String> encryptionCache;
    private final MeterRegistry meterRegistry;
    private final Timer encryptionTimer;
    private final Counter encryptionErrorCounter;
    
    public EncryptionPerformanceOptimizer(MeterRegistry meterRegistry) {
        this.meterRegistry = meterRegistry;
        this.encryptionTimer = Timer.builder("encryption.duration")
                .description("加密操作耗時")
                .register(meterRegistry);
        this.encryptionErrorCounter = Counter.builder("encryption.errors")
                .description("加密錯誤次數")
                .register(meterRegistry);
        
        // 創建LRU緩存，緩存熱點數據
        this.encryptionCache = Caffeine.newBuilder()
                .maximumSize(10000)
                .expireAfterWrite(10, TimeUnit.MINUTES)
                .recordStats()
                .build();
    }
    
    /**
     * 帶緩存的加密操作
     */
    public String encryptWithCache(String plaintext) {
        return Timer.Sample.start(meterRegistry)
                .stop(encryptionTimer, Timer.Sample::stop)
                .recordCallable(() -> {
                    try {
                        return encryptionCache.get(plaintext, this::doEncrypt);
                    } catch (Exception e) {
                        encryptionErrorCounter.increment();
                        throw e;
                    }
                });
    }
    
    private String doEncrypt(String plaintext) {
        // 實際的加密邏輯
        return "encrypted_" + plaintext; // 簡化示例
    }
    
    /**
     * 批量加密優化
     */
    public List<String> batchEncrypt(List<String> plaintexts) {
        return plaintexts.parallelStream()
                .map(this::encryptWithCache)
                .collect(Collectors.toList());
    }
}

6.2 監控指標配置

# application.yml
management:
  endpoints:
    web:
      exposure:
        include: health,info,metrics,prometheus
  metrics:
    tags:
      application: ${spring.application.name}
      
# prometheus監控配置
spring:
  datasource:
    hikari:
      metric-registry: true
      
# 自定義監控指標
monitoring:
  encryption:
    enabled: true
    sample-rate: 0.1  # 採樣率，避免過多監控數據

@Component
public class EncryptionMetrics {
    
    private final MeterRegistry meterRegistry;
    private final Timer encryptionTimer;
    private final Counter encryptionCounter;
    private final DistributionSummary dataSizeSummary;
    
    public EncryptionMetrics(MeterRegistry meterRegistry) {
        this.meterRegistry = meterRegistry;
        this.encryptionTimer = Timer.builder("database.encryption.time")
                .description("數據庫加密操作耗時")
                .tag("type", "aes")
                .register(meterRegistry);
        this.encryptionCounter = Counter.builder("database.encryption.count")
                .description("數據庫加密操作次數")
                .register(meterRegistry);
        this.dataSizeSummary = DistributionSummary.builder("database.encryption.data.size")
                .description("加密數據大小分佈")
                .register(meterRegistry);
    }
    
    public Sample startTimer() {
        encryptionCounter.increment();
        return Timer.start(meterRegistry);
    }
    
    public void recordTimer(Sample sample, long dataSize) {
        sample.stop(encryptionTimer);
        dataSizeSummary.record(dataSize);
    }
}

七、安全最佳實踐

7.1 開發環境與生產環境分離

@Configuration
@Profile("dev")
public class DevEncryptionConfiguration {
    
    @Bean
    public EncryptionService devEncryptionService() {
        // 開發環境使用模擬加密服務
        return new MockEncryptionService();
    }
}

@Configuration
@Profile("prod")
public class ProdEncryptionConfiguration {
    
    @Bean
    public EncryptionService prodEncryptionService(EncryptionProperties properties) {
        // 生產環境使用真實加密服務
        return new AdvancedEncryptionServiceImpl(properties);
    }
}

public class MockEncryptionService implements EncryptionService {
    
    @Override
    public String encrypt(String plaintext) {
        // 開發環境不真正加密，僅添加標記
        return "[ENCRYPTED]" + plaintext + "[/ENCRYPTED]";
    }
    
    @Override
    public String decrypt(String ciphertext) {
        // 移除標記返回原始數據
        return ciphertext.replace("[ENCRYPTED]", "").replace("[/ENCRYPTED]", "");
    }
    
    // 其他方法類似實現
}

7.2 安全日誌記錄

@Aspect
@Component
@Slf4j
public class EncryptionAuditAspect {
    
    @Around("@annotation(RequireEncryptionAudit)")
    public Object auditEncryptionOperation(ProceedingJoinPoint joinPoint) throws Throwable {
        long startTime = System.currentTimeMillis();
        String methodName = joinPoint.getSignature().getName();
        Object[] args = joinPoint.getArgs();
        
        log.info("開始加密操作: method={}, args={}", methodName, maskSensitiveArgs(args));
        
        try {
            Object result = joinPoint.proceed();
            long duration = System.currentTimeMillis() - startTime;
            log.info("加密操作完成: method={}, duration={}ms", methodName, duration);
            return result;
        } catch (Exception e) {
            log.error("加密操作失敗: method={}, error={}", methodName, e.getMessage(), e);
            throw e;
        }
    }
    
    private Object[] maskSensitiveArgs(Object[] args) {
        // 對敏感參數進行脱敏處理
        Object[] maskedArgs = new Object[args.length];
        for (int i = 0; i < args.length; i++) {
            if (args[i] instanceof String && isSensitiveData((String) args[i])) {
                maskedArgs[i] = maskString((String) args[i]);
            } else {
                maskedArgs[i] = args[i];
            }
        }
        return maskedArgs;
    }
    
    private boolean isSensitiveData(String data) {
        // 簡單的敏感數據識別邏輯
        return data != null && (data.contains("password") || data.contains("id_card"));
    }
    
    private String maskString(String data) {
        if (data == null || data.length() <= 4) {
            return "***";
        }
        return data.substring(0, 2) + "***" + data.substring(data.length() - 2);
    }
}

@Retention(RetentionPolicy.RUNTIME)
@Target(ElementType.METHOD)
public @interface RequireEncryptionAudit {
}

八、常見問題與解決方案

8.1 性能問題

@Service
@Slf4j
public class PerformanceOptimizationService {
    
    /**
     * 異步加密處理
     */
    @Async
    public CompletableFuture<String> asyncEncrypt(String plaintext) {
        return CompletableFuture.supplyAsync(() -> {
            try {
                return encryptionService.encrypt(plaintext);
            } catch (EncryptionException e) {
                log.error("異步加密失敗", e);
                throw new CompletionException(e);
            }
        });
    }
    
    /**
     * 流式加密處理大文件
     */
    public void encryptLargeFile(InputStream inputStream, OutputStream outputStream) 
            throws IOException, EncryptionException {
        Cipher cipher = Cipher.getInstance("AES/GCM/NoPadding");
        // 初始化cipher...
        
        CipherOutputStream cipherOutputStream = new CipherOutputStream(outputStream, cipher);
        byte[] buffer = new byte[8192];
        int bytesRead;
        
        while ((bytesRead = inputStream.read(buffer)) != -1) {
            cipherOutputStream.write(buffer, 0, bytesRead);
        }
        
        cipherOutputStream.close();
    }
}

8.2 密鑰泄露應急響應

@Component
@Slf4j
public class KeyLeakEmergencyHandler {
    
    @EventListener
    public void handleKeyLeakEvent(KeyLeakEvent event) {
        log.warn("檢測到密鑰泄露事件: {}", event.getDescription());
        
        // 1. 立即禁用當前密鑰
        keyManagementService.disableCompromisedKey(event.getKeyId());
        
        // 2. 啓動緊急密鑰輪換
        keyManagementService.emergencyRotateKeys();
        
        // 3. 通知相關人員
        notificationService.sendAlert("密鑰泄露", 
                "密鑰 " + event.getKeyId() + " 可能已泄露，請立即處理");
        
        // 4. 啓動數據重新加密流程
        dataReEncryptionService.startReEncryptionProcess();
    }
    
    /**
     * 數據重新加密流程
     */
    public void reEncryptAllData() {
        // 分批處理，避免影響業務
        List<Long> userIds = userRepository.findAllUserIds();
        int batchSize = 100;
        
        for (int i = 0; i < userIds.size(); i += batchSize) {
            List<Long> batch = userIds.subList(i, Math.min(i + batchSize, userIds.size()));
            reEncryptUserBatch(batch);
            
            // 控制處理速度
            try {
                Thread.sleep(1000);
            } catch (InterruptedException e) {
                Thread.currentThread().interrupt();
                break;
            }
        }
    }
}

結語

數據庫加密是一項複雜但至關重要的安全措施。通過本文的介紹，相信你對數據庫加密有了更深入的理解。記住，安全不是一次性的工作，而是需要持續關注和改進的過程。

關鍵要點總結：

1. 選擇合適的加密方案：根據業務需求和安全等級選擇TDE、字段級加密或應用層加密
2. 合理的密鑰管理：定期輪換密鑰，使用安全的密鑰存儲方案
3. 性能與安全的平衡：通過緩存、異步處理等方式優化加密性能
4. 完善的監控體系：建立加密操作的監控和審計機制
5. 應急預案准備：制定密鑰泄露等安全事件的應急響應計劃

如果你覺得這篇文章對你有幫助，歡迎分享給更多的朋友。在數據安全的路上，我們一起守護用户隱私！

---

關注「服務端技術精選」，獲取更多幹貨技術文章！