1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

# 数据采集元数据规范
collection_metadata:
  data_id: "USR-2026-07-001234"
  classification: L3            # 敏感级别
  source: "user_registration"   # 数据来源
  collected_at: "2026-07-06T10:30:00+08:00"
  collector_id: "APP-v3.2.1"   # 采集系统标识
  legal_basis: "consent"        # 合法性基础: consent/contract/legal_obligation
  purpose: "account_service"    # 采集目的
  retention_days: 730           # 保留期限
  fields:
    - name: "phone"
      type: "pii"
      sensitivity: "high"
    - name: "nickname"
      type: "non_pii"
      sensitivity: "low"

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

# Nginx TLS 1.3 配置示例
ssl_protocols TLSv1.3;
ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256;
ssl_prefer_server_ciphers on;

# 启用0-RTT需要评估重放攻击风险
ssl_early_data off;

# HSTS强制HTTPS
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

# OCSP Stapling
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/ssl/certs/chain.pem;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

import hmac
import hashlib
import json

def sign_payload(payload: dict, secret_key: bytes) -> dict:
    """为传输数据生成HMAC签名"""
    data_bytes = json.dumps(payload, sort_keys=True).encode('utf-8')
    signature = hmac.new(secret_key, data_bytes, hashlib.sha256).hexdigest()
    return {
        "payload": payload,
        "signature": signature,
        "algorithm": "HMAC-SHA256",
        "timestamp": int(time.time())
    }

def verify_payload(message: dict, secret_key: bytes) -> bool:
    """接收端验证数据完整性"""
    data_bytes = json.dumps(message["payload"], sort_keys=True).encode('utf-8')
    expected = hmac.new(secret_key, data_bytes, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, message["signature"])

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

-- PostgreSQL 字段级加密示例（使用pgcrypto扩展）
-- 敏感字段使用应用层密钥加密后存储
INSERT INTO users (name, phone_encrypted, id_card_encrypted)
VALUES (
    '张三',
    pgp_sym_encrypt('13800138000', current_setting('app.encryption_key')),
    pgp_sym_encrypt('110101199001011234', current_setting('app.encryption_key'))
);

-- 查询时解密
SELECT name,
       pgp_sym_decrypt(phone_encrypted::bytea, current_setting('app.encryption_key')) AS phone
FROM users
WHERE id = 1001;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

┌─────────────────────────────────────────────────┐
│              密钥管理架构（三层模型）               │
├─────────────────────────────────────────────────┤
│                                                 │
│  ┌─────────────────────────────────────┐        │
│  │  Layer 0: 根密钥 (Root Key)          │        │
│  │  存储位置: HSM (硬件安全模块)         │        │
│  │  用途: 加密保护下层密钥               │        │
│  │  轮转周期: 每年 / 手动触发            │        │
│  └──────────────┬──────────────────────┘        │
│                 │ 加密封装                        │
│  ┌──────────────▼──────────────────────┐        │
│  │  Layer 1: 密钥加密密钥 (KEK)         │        │
│  │  存储位置: KMS (密钥管理服务)         │        │
│  │  用途: 加密封装数据加密密钥           │        │
│  │  轮转周期: 每季度                     │        │
│  └──────────────┬──────────────────────┘        │
│                 │ 加密封装                        │
│  ┌──────────────▼──────────────────────┐        │
│  │  Layer 2: 数据加密密钥 (DEK)         │        │
│  │  存储位置: 应用内存 / 加密配置文件    │        │
│  │  用途: 实际加密业务数据               │        │
│  │  轮转周期: 每月 / 数据量阈值触发      │        │
│  └─────────────────────────────────────┘        │
│                                                 │
│  密钥轮转流程:                                   │
│  1. KMS生成新DEK → 2. 用新DEK加密新写入数据      │
│  3. 后台批量重加密旧数据 → 4. 确认完成后销毁旧DEK │
└─────────────────────────────────────────────────┘

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

# 混合访问控制策略示例
access_policy:
  rule_id: "POL-2026-001"
  description: "客服人员查看用户订单"
  
  # RBAC部分：角色准入
  role_required: "customer_service"
  
  # ABAC部分：属性条件
  conditions:
    - attribute: "user.department"
      operator: "eq"
      value: "order_support"
    - attribute: "data.classification"
      operator: "in"
      value: ["L1", "L2", "L3"]
    - attribute: "request.time"
      operator: "within"
      value: "work_hours"        # 仅工作时间
    - attribute: "request.ip"
      operator: "in"
      value: "internal_network"  # 仅内网
      
  # 权限范围
  permissions: ["read"]
  max_records: 50                # 单次最多查询50条
  require_mfa: true              # 查看L3数据需要MFA

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

{
  "desensitization_rules": [
    {
      "field": "phone",
      "pattern": "(\\d{3})\\d{4}(\\d{4})",
      "replacement": "$1****$2",
      "example": "138****8000",
      "trigger_level": "L3"
    },
    {
      "field": "id_card",
      "pattern": "(\\d{4})\\d{10}(\\d{4})",
      "replacement": "$1**********$2",
      "example": "1101**********1234",
      "trigger_level": "L3"
    },
    {
      "field": "bank_card",
      "pattern": "(\\d{4})\\d+(\\d{4})",
      "replacement": "$1 **** **** $2",
      "example": "6225 **** **** 1234",
      "trigger_level": "L4"
    },
    {
      "field": "address",
      "strategy": "truncate",
      "keep_chars": 6,
      "suffix": "***",
      "trigger_level": "L3"
    }
  ]
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

# DLP策略配置
dlp_policies:
  - name: "阻止身份证号外发"
    severity: critical
    scan_targets:
      - email_outbound
      - cloud_upload
      - usb_transfer
      - print_spooler
    detection_rules:
      - type: "regex"
        pattern: "\\d{17}[\\dXx]"
        label: "身份证号"
      - type: "keyword_proximity"
        keywords: ["身份证", "证件号"]
        max_distance: 5
    actions:
      match_threshold: 1
      on_detect:
        - block              # 直接阻断
        - alert_security     # 通知安全团队
        - log_incident       # 记录事件
      exception_roles:
        - "compliance_officer"  # 合规人员可申请放行

  - name: "监控大批量数据导出"
    severity: high
    scan_targets:
      - database_export
      - api_response
    detection_rules:
      - type: "volume_anomaly"
        threshold: 1000       # 单次导出超过1000条记录
        baseline_window: "7d"
    actions:
      on_detect:
        - require_approval    # 需要主管审批
        - alert_security
        - watermark           # 对导出数据添加隐形水印

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

# API网关安全配置
api_security:
  authentication:
    method: "OAuth2 + JWT"
    token_ttl: 3600
    refresh_enabled: false      # 数据共享API禁用refresh token
  
  authorization:
    scope_enforcement: true
    scopes:
      - "user.read.basic"       # 只读基本信息
      - "user.read.sensitive"   # 读敏感信息（需额外审批）
  
  rate_limiting:
    requests_per_minute: 100
    burst: 20
    per_ip: true
    per_token: true
    
  data_controls:
    response_field_filter: true  # 只返回scope允许的字段
    max_page_size: 50
    watermark_inject: true       # 响应中注入追踪水印
    
  monitoring:
    anomaly_detection: true
    alert_on:
      - rate_limit_exceeded
      - scope_violation
      - unusual_volume

1
2
3
4
5
6
7

Pass 1: 写入全0（0x00）
Pass 2: 写入全1（0xFF）
Pass 3: 写入随机数据
Pass 4: 写入全0（0x00）
Pass 5: 写入全1（0xFF）
Pass 6: 写入随机数据
Pass 7: 写入随机数据 + 验证

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

{
  "destruction_certificate": {
    "cert_id": "DEST-2026-07-0089",
    "timestamp": "2026-07-06T15:30:00+08:00",
    "operator": "ops-automation-system",
    "approved_by": "security-officer-li",
    "target": {
      "data_id": "USR-2024-batch-expired",
      "classification": "L3",
      "volume": "2.3TB",
      "media_type": "cloud_storage",
      "description": "2024年过期用户数据（已超保留期限）"
    },
    "method": {
      "primary": "crypto_shredding",
      "key_destruction_event": "KMS-EVT-20260706-153022",
      "secondary": "storage_overwrite_3pass"
    },
    "verification": {
      "method": "sampling_read",
      "sample_rate": "5%",
      "result": "PASS",
      "verified_by": "auto-verification-agent"
    },
    "witness": "compliance-audit-system",
    "retention": "本证书保留10年"
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

{
  "version": "1.0",
  "event_id": "AUD-20260706-001234",
  "timestamp": "2026-07-06T14:22:33.456+08:00",
  "lifecycle_stage": "usage",
  "event_type": "data_access",
  "actor": {
    "user_id": "emp-10086",
    "role": "data_analyst",
    "ip": "10.0.1.55",
    "mfa_verified": true
  },
  "target": {
    "data_id": "ORD-2026-Q2-summary",
    "classification": "L3",
    "resource": "analytics_db.orders",
    "records_accessed": 15000
  },
  "action": {
    "type": "SELECT",
    "desensitization_applied": true,
    "fields_accessed": ["order_id", "amount", "region"],
    "fields_masked": ["buyer_phone", "buyer_address"]
  },
  "result": "success",
  "risk_score": 0.3,
  "policy_matched": "POL-2026-001",
  "anomaly_flags": []
}