数据脱敏

该章节主要介绍如何使用数据脱敏功能,如何进行相关配置。数据脱敏功能即可与数据分片功能共同使用,又可作为单独功能组件,独立使用。 与数据分片功能共同使用时,会创建ShardingDataSource;单独使用时,会创建EncryptDataSource来完成数据脱敏功能。

不使用Spring

引入Maven依赖

  1. <dependency>
  2. <groupId>org.apache.shardingsphere</groupId>
  3. <artifactId>sharding-jdbc-core</artifactId>
  4. <version>${sharding-sphere.version}</version>
  5. </dependency>

基于Java编码的规则配置

  1. // 配置数据源
  2. BasicDataSource dataSource = new BasicDataSource();
  3. dataSource.setDriverClassName("com.mysql.jdbc.Driver");
  4. dataSource.setUrl("jdbc:mysql://127.0.0.1:3306/encrypt");
  5. dataSource.setUsername("root");
  6. dataSource.setPassword("");
  7. // 配置脱敏规则
  8. Properties props = new Properties();
  9. props.setProperty("aes.key.value", "123456");
  10. EncryptorRuleConfiguration encryptorConfig = new EncryptorRuleConfiguration("AES", props);
  11. EncryptColumnRuleConfiguration columnConfig = new EncryptColumnRuleConfiguration("plain_pwd", "cipher_pwd", "", "aes");
  12. EncryptTableRuleConfiguration tableConfig = new EncryptTableRuleConfiguration(Collections.singletonMap("pwd", columnConfig));
  13. EncryptRuleConfiguration encryptRuleConfig = new EncryptRuleConfiguration();
  14. encryptRuleConfig.getEncryptors().put("aes", encryptorConfig);
  15. encryptRuleConfig.getTables().put("t_encrypt", tableConfig);
  16. // 获取数据源对象
  17. DataSource dataSource = EncryptDataSourceFactory.createDataSource(dataSource, encryptRuleConfig, new Properties());

基于Yaml的规则配置

或通过Yaml方式配置,与以上配置等价:

  1. dataSource: !!org.apache.commons.dbcp2.BasicDataSource
  2. driverClassName: com.mysql.jdbc.Driver
  3. url: jdbc:mysql://127.0.0.1:3306/encrypt?serverTimezone=UTC&useSSL=false
  4. username: root
  5. password:
  6. encryptRule:
  7. tables:
  8. t_order:
  9. columns:
  10. user_id:
  11. cipherColumn: user_cipher
  12. encryptor: order_encryptor
  13. encryptors:
  14. order_encryptor:
  15. type: aes
  16. props:
  17. aes.key.value: 123456
  18. props:
  19. query.with.cipher.column: true #是否使用密文列查询
  1. DataSource dataSource = YamlEncryptDataSourceFactory.createDataSource(yamlFile);

使用Spring

引入Maven依赖

  1. <!-- for spring boot -->
  2. <dependency>
  3. <groupId>org.apache.shardingsphere</groupId>
  4. <artifactId>sharding-jdbc-spring-boot-starter</artifactId>
  5. <version>${sharding-sphere.version}</version>
  6. </dependency>
  7. <!-- for spring namespace -->
  8. <dependency>
  9. <groupId>org.apache.shardingsphere</groupId>
  10. <artifactId>sharding-jdbc-spring-namespace</artifactId>
  11. <version>${sharding-sphere.version}</version>
  12. </dependency>

基于Spring boot的规则配置

  1. spring.shardingsphere.datasource.name=ds
  2. spring.shardingsphere.datasource.ds.type=org.apache.commons.dbcp2.BasicDataSource
  3. spring.shardingsphere.datasource.ds.driver-class-name=com.mysql.jdbc.Driver
  4. spring.shardingsphere.datasource.ds.url=jdbc:mysql://127.0.0.1:3306/encrypt?serverTimezone=UTC&useSSL=false
  5. spring.shardingsphere.datasource.ds.username=root
  6. spring.shardingsphere.datasource.ds.password=
  7. spring.shardingsphere.datasource.ds.max-total=100
  8. spring.shardingsphere.encrypt.encryptors.encryptor_aes.type=aes
  9. spring.shardingsphere.encrypt.encryptors.encryptor_aes.props.aes.key.value=123456
  10. spring.shardingsphere.encrypt.tables.t_order.columns.user_id.plainColumn=user_decrypt
  11. spring.shardingsphere.encrypt.tables.t_order.columns.user_id.cipherColumn=user_encrypt
  12. spring.shardingsphere.encrypt.tables.t_order.columns.user_id.assistedQueryColumn=user_assisted
  13. spring.shardingsphere.encrypt.tables.t_order.columns.user_id.encryptor=encryptor_aes
  14. spring.shardingsphere.props.sql.show=true
  15. spring.shardingsphere.props.query.with.cipher.column=true

基于Spring boot + JNDI的规则配置

如果您计划使用Spring boot + JNDI的方式,在应用容器(如Tomcat)中使用Sharding-JDBC时,可使用spring.shardingsphere.datasource.${datasourceName}.jndiName来代替数据源的一系列配置。 如:

  1. spring.shardingsphere.datasource.name=ds
  2. spring.shardingsphere.datasource.ds.jndi-name=java:comp/env/jdbc/ds
  3. spring.shardingsphere.encrypt.encryptors.encryptor_aes.type=aes
  4. spring.shardingsphere.encrypt.encryptors.encryptor_aes.props.aes.key.value=123456
  5. spring.shardingsphere.encrypt.tables.t_order.columns.user_id.plainColumn=user_decrypt
  6. spring.shardingsphere.encrypt.tables.t_order.columns.user_id.cipherColumn=user_encrypt
  7. spring.shardingsphere.encrypt.tables.t_order.columns.user_id.assistedQueryColumn=user_assisted
  8. spring.shardingsphere.encrypt.tables.t_order.columns.user_id.encryptor=encryptor_aes
  9. spring.shardingsphere.props.sql.show=true
  10. spring.shardingsphere.props.query.with.cipher.column=true

基于Spring命名空间的规则配置

  1. <beans xmlns="http://www.springframework.org/schema/beans"
  2. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  3. xmlns:encrypt="http://shardingsphere.apache.org/schema/shardingsphere/encrypt"
  4. xmlns:bean="http://www.springframework.org/schema/util"
  5. xsi:schemaLocation="http://www.springframework.org/schema/beans
  6. http://www.springframework.org/schema/beans/spring-beans.xsd
  7. http://shardingsphere.apache.org/schema/shardingsphere/encrypt
  8. http://shardingsphere.apache.org/schema/shardingsphere/encrypt/encrypt.xsd
  9. http://www.springframework.org/schema/util
  10. http://www.springframework.org/schema/util/spring-util.xsd">
  11. <import resource="datasource/dataSource.xml" />
  12. <bean id="db" class="org.apache.commons.dbcp2.BasicDataSource" destroy-method="close">
  13. <property name="driverClassName" value="com.mysql.jdbc.Driver" />
  14. <property name="url" value="jdbc:mysql://127.0.0.1:3306/encrypt?serverTimezone=UTC&useSSL=false" />
  15. <property name="username" value="root" />
  16. <property name="password" value="" />
  17. <property name="maxTotal" value="100" />
  18. </bean>
  19. <bean:properties id="props">
  20. <prop key="aes.key.value">123456</prop>
  21. </bean:properties>
  22. <encrypt:data-source id="encryptDataSource" data-source-name="db" >
  23. <encrypt:encrypt-rule>
  24. <encrypt:tables>
  25. <encrypt:table name="t_order">
  26. <encrypt:column logic-column="user_id" plain-column="user_decrypt" cipher-column="user_encrypt" assisted-query-column="user_assisted" encryptor-ref="encryptor_aes" />
  27. <encrypt:column logic-column="order_id" plain-column="order_decrypt" cipher-column="order_encrypt" assisted-query-column="order_assisted" encryptor-ref="encryptor_md5"/>
  28. </encrypt:table>
  29. </encrypt:tables>
  30. <encrypt:encryptors>
  31. <encrypt:encryptor id="encryptor_aes" type="AES" props-ref="props"/>
  32. <encrypt:encryptor id="encryptor_md5" type="MD5" />
  33. </encrypt:encryptors>
  34. </encrypt:encrypt-rule>
  35. <encrypt:props>
  36. <prop key="sql.show">true</prop>
  37. <prop key="query.with.cipher.column">true</prop>
  38. </encrypt:props>
  39. </encrypt:data-source>
  40. </beans>

在Spring中使用DataSource

直接通过注入的方式即可使用DataSource,或者将DataSource配置在JPA、Hibernate或MyBatis中使用。

  1. @Resource
  2. private DataSource dataSource;