代码之家  ›  专栏  ›  技术社区  ›  Burt

.NET加密数据库表

  •  4
  • Burt  · 技术社区  · 15 年前

    我正在为一个网站提供一个模块,该模块将从用户那里收集信息并进行适当的计算。客户机希望对从用户收集的任何数据进行加密。我们使用SQL Express 2005作为数据库。

    事先谢谢。

    4 回复  |  直到 15 年前
        1
  •  6
  •   Alex K.    15 年前

    SQL Server已支持 strong encryption 对于列,为什么不直接使用它呢?

        2
  •  1
  •   Remus Rusanu    15 年前

    使用 Transparent Database Encryption 因为,顾名思义,对于应用程序是透明的,需要绝对0的更改。您只需使用一个键打开加密: ALTER DATABASE ... SET ENCRYPTION ON; . 密钥管理是您可以得到的最简单的密钥管理,数据库可以防止意外丢失介质。加密会传递到所有备份,因此意外丢失备份文件也会保护内容。

        3
  •  1
  •   Cade Roux    15 年前

    虽然数据库中的加密很好(并且是保护备份和硬盘免受物理攻击或操作系统攻击所必需的),但由于您的应用程序必须收集数据并将其发送到数据库,因此您至少需要考虑应用程序的几个方面:

    使用SSL保护从Web浏览器到您的网站的数据(几乎可以肯定是必要的)

    Encrypt your connections from the application to the database (如果您在同一个设备上运行或服务器的通信相对受控,则可能不需要)

    确保您的应用程序不易暴露数据—无论是通过设计或实现缺陷还是注入攻击。

    记住,如果您的应用程序需要向客户机显示数据,那么数据库会在某个时刻将数据返回给应用程序,然后返回给用户。如果应用程序坏了,数据就会泄露,不管数据是在存储中加密的,还是在从浏览器到应用程序和应用程序到数据库的通道中加密的。

    在数据库列中自己加密数据几乎总是毫无意义的,因为应用程序必须先解密数据,然后才能使用它——数据库几乎不能使用它。然后你的应用需要有某种密钥管理。

        4
  •  0
  •   Chase Florell    15 年前

    有一些 RijndaelManaged 善良。我的是VB,但底部的参考链接是C#

    Imports System
    Imports System.IO
    Imports System.Security.Cryptography
    
    Namespace Security
        Public Class Encryption
            Public Shared Function Encrypt(ByVal plainText As String, _
                                              ByVal passPhrase As String, _
                                              ByVal saltValue As String, _
                                              ByVal hashAlgorithm As String, _
                                              ByVal passwordIterations As Integer, _
                                              ByVal initVector As String, _
                                              ByVal keySize As Integer) _
                                      As String
    
                ' Convert strings into byte arrays.
                ' Let us assume that strings only contain ASCII codes.
                ' If strings include Unicode characters, use Unicode, UTF7, or UTF8 
                ' encoding.
                Dim initVectorBytes As Byte()
                initVectorBytes = Encoding.ASCII.GetBytes(initVector)
    
                Dim saltValueBytes As Byte()
                saltValueBytes = Encoding.ASCII.GetBytes(saltValue)
    
                ' Convert our plaintext into a byte array.
                ' Let us assume that plaintext contains UTF8-encoded characters.
                Dim plainTextBytes As Byte()
                plainTextBytes = Encoding.UTF8.GetBytes(plainText)
    
                ' First, we must create a password, from which the key will be derived.
                ' This password will be generated from the specified passphrase and 
                ' salt value. The password will be created using the specified hash 
                ' algorithm. Password creation can be done in several iterations.
                Dim password As PasswordDeriveBytes
                password = New PasswordDeriveBytes(passPhrase, _
                                                   saltValueBytes, _
                                                   hashAlgorithm, _
                                                   passwordIterations)
    
                ' Use the password to generate pseudo-random bytes for the encryption
                ' key. Specify the size of the key in bytes (instead of bits).
                Dim keyBytes As Byte()
                keyBytes = password.GetBytes(keySize / 8)
    
                ' Create uninitialized Rijndael encryption object.
                Dim symmetricKey As RijndaelManaged
                symmetricKey = New RijndaelManaged()
    
                ' It is reasonable to set encryption mode to Cipher Block Chaining
                ' (CBC). Use default options for other symmetric key parameters.
                symmetricKey.Mode = CipherMode.CBC
    
                ' Generate encryptor from the existing key bytes and initialization 
                ' vector. Key size will be defined based on the number of the key 
                ' bytes.
                Dim encryptor As ICryptoTransform
                encryptor = symmetricKey.CreateEncryptor(keyBytes, initVectorBytes)
    
                ' Define memory stream which will be used to hold encrypted data.
                Dim memoryStream As MemoryStream
                memoryStream = New MemoryStream()
    
                ' Define cryptographic stream (always use Write mode for encryption).
                Dim cryptoStream As CryptoStream
                cryptoStream = New CryptoStream(memoryStream, _
                                                encryptor, _
                                                CryptoStreamMode.Write)
                ' Start encrypting.
                cryptoStream.Write(plainTextBytes, 0, plainTextBytes.Length)
    
                ' Finish encrypting.
                cryptoStream.FlushFinalBlock()
    
                ' Convert our encrypted data from a memory stream into a byte array.
                Dim cipherTextBytes As Byte()
                cipherTextBytes = memoryStream.ToArray()
    
                ' Close both streams.
                memoryStream.Close()
                cryptoStream.Close()
    
                ' Convert encrypted data into a base64-encoded string.
                Dim cipherText As String
                cipherText = Convert.ToBase64String(cipherTextBytes)
    
                ' Return encrypted string.
                Encrypt = cipherText
            End Function
    
            ' <summary>
            ' Decrypts specified ciphertext using Rijndael symmetric key algorithm.
            ' </summary>
            ' <param name="cipherText">
            ' Base64-formatted ciphertext value.
            ' </param>
            ' <param name="passPhrase">
            ' Passphrase from which a pseudo-random password will be derived. The 
            ' derived password will be used to generate the encryption key. 
            ' Passphrase can be any string. In this example we assume that this 
            ' passphrase is an ASCII string.
            ' </param>
            ' <param name="saltValue">
            ' Salt value used along with passphrase to generate password. Salt can 
            ' be any string. In this example we assume that salt is an ASCII string.
            ' </param>
            ' <param name="hashAlgorithm">
            ' Hash algorithm used to generate password. Allowed values are: "MD5" and
            ' "SHA1". SHA1 hashes are a bit slower, but more secure than MD5 hashes.
            ' </param>
            ' <param name="passwordIterations">
            ' Number of iterations used to generate password. One or two iterations
            ' should be enough.
            ' </param>
            ' <param name="initVector">
            ' Initialization vector (or IV). This value is required to encrypt the 
            ' first block of plaintext data. For RijndaelManaged class IV must be 
            ' exactly 16 ASCII characters long.
            ' </param>
            ' <param name="keySize">
            ' Size of encryption key in bits. Allowed values are: 128, 192, and 256. 
            ' Longer keys are more secure than shorter keys.
            ' </param>
            ' <returns>
            ' Decrypted string value.
            ' </returns>
            ' <remarks>
            ' Most of the logic in this function is similar to the Encrypt 
            ' logic. In order for decryption to work, all parameters of this function
            ' - except cipherText value - must match the corresponding parameters of 
            ' the Encrypt function which was called to generate the 
            ' ciphertext.
            ' </remarks>
            Public Shared Function Decrypt(ByVal cipherText As String, _
                                           ByVal passPhrase As String, _
                                           ByVal saltValue As String, _
                                           ByVal hashAlgorithm As String, _
                                           ByVal passwordIterations As Integer, _
                                           ByVal initVector As String, _
                                           ByVal keySize As Integer) _
                                   As String
    
                ' Convert strings defining encryption key characteristics into byte
                ' arrays. Let us assume that strings only contain ASCII codes.
                ' If strings include Unicode characters, use Unicode, UTF7, or UTF8
                ' encoding.
                Dim initVectorBytes As Byte()
                initVectorBytes = Encoding.ASCII.GetBytes(initVector)
    
                Dim saltValueBytes As Byte()
                saltValueBytes = Encoding.ASCII.GetBytes(saltValue)
    
                ' Convert our ciphertext into a byte array.
                Dim cipherTextBytes As Byte()
                cipherTextBytes = Convert.FromBase64String(cipherText)
    
                ' First, we must create a password, from which the key will be 
                ' derived. This password will be generated from the specified 
                ' passphrase and salt value. The password will be created using
                ' the specified hash algorithm. Password creation can be done in
                ' several iterations.
                Dim password As PasswordDeriveBytes
                password = New PasswordDeriveBytes(passPhrase, _
                                                   saltValueBytes, _
                                                   hashAlgorithm, _
                                                   passwordIterations)
    
                ' Use the password to generate pseudo-random bytes for the encryption
                ' key. Specify the size of the key in bytes (instead of bits).
                Dim keyBytes As Byte()
                keyBytes = password.GetBytes(keySize / 8)
    
                ' Create uninitialized Rijndael encryption object.
                Dim symmetricKey As RijndaelManaged
                symmetricKey = New RijndaelManaged()
    
                ' It is reasonable to set encryption mode to Cipher Block Chaining
                ' (CBC). Use default options for other symmetric key parameters.
                symmetricKey.Mode = CipherMode.CBC
    
                ' Generate decryptor from the existing key bytes and initialization 
                ' vector. Key size will be defined based on the number of the key 
                ' bytes.
                Dim decryptor As ICryptoTransform
                decryptor = symmetricKey.CreateDecryptor(keyBytes, initVectorBytes)
    
                ' Define memory stream which will be used to hold encrypted data.
                Dim memoryStream As MemoryStream
                memoryStream = New MemoryStream(cipherTextBytes)
    
                ' Define memory stream which will be used to hold encrypted data.
                Dim cryptoStream As CryptoStream
                cryptoStream = New CryptoStream(memoryStream, _
                                                decryptor, _
                                                CryptoStreamMode.Read)
    
                ' Since at this point we don't know what the size of decrypted data
                ' will be, allocate the buffer long enough to hold ciphertext;
                ' plaintext is never longer than ciphertext.
                Dim plainTextBytes As Byte()
                ReDim plainTextBytes(cipherTextBytes.Length)
    
                ' Start decrypting.
                Dim decryptedByteCount As Integer
                decryptedByteCount = cryptoStream.Read(plainTextBytes, _
                                                       0, _
                                                       plainTextBytes.Length)
    
                ' Close both streams.
                memoryStream.Close()
                cryptoStream.Close()
    
                ' Convert decrypted data into a string. 
                ' Let us assume that the original plaintext string was UTF8-encoded.
                Dim plainText As String
                plainText = Encoding.UTF8.GetString(plainTextBytes, _
                                                    0, _
                                                    decryptedByteCount)
    
                ' Return decrypted string.
                Decrypt = plainText
            End Function
        End Class
    
    End Namespace
    

    I didn't write it 但是我用它…工作得很好。

    推荐文章