主数据安全的特殊性：核心资产的多维防护

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

┌─────────────────────────────────────────────────────────┐
│                    审计层安全                             │
│  ┌──────────┐  ┌──────────┐  ┌──────────┐              │
│  │ 操作日志  │  │ 数据变更  │  │ 访问审计  │              │
│  └──────────┘  └──────────┘  └──────────┘              │
└─────────────────────────────────────────────────────────┘
                          ↓↑
┌─────────────────────────────────────────────────────────┐
│                    接口层安全                             │
│  ┌──────────┐  ┌──────────┐  ┌──────────┐              │
│  │ 接口鉴权  │  │ 流量控制  │  │ 防重放    │              │
│  └──────────┘  └──────────┘  └──────────┘              │
└─────────────────────────────────────────────────────────┘
                          ↓↑
┌─────────────────────────────────────────────────────────┐
│                    数据层安全                             │
│  ┌──────────┐  ┌──────────┐  ┌──────────┐              │
│  │ 数据脱敏  │  │ 权限隔离  │  │ 加密存储  │              │
│  └──────────┘  └──────────┘  └──────────┘              │
└─────────────────────────────────────────────────────────┘

1
2
3
4
5
6
7
8

-- 静态脱敏示例：客户手机号脱敏
UPDATE mdm_customer 
SET phone = CONCAT(
    SUBSTRING(phone, 1, 3),
    '****',
    SUBSTRING(phone, 8, 4)
)
WHERE export_target = 'TEST_ENV';

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

// 动态脱敏拦截器
@Component
public class DataMaskingInterceptor implements HandlerInterceptor {
    
    @Autowired
    private MaskingRuleEngine ruleEngine;
    
    @Override
    public void postProcess(HttpServletRequest request, 
                           HttpServletResponse response, 
                           Object handler, 
                           ModelAndView modelAndView) {
        
        if (modelAndView != null && modelAndView.getModel() != null) {
            Object data = modelAndView.getModel().get("data");
            UserContext user = SecurityContextHolder.getCurrentUser();
            
            // 根据用户角色和字段敏感级别动态脱敏
            ruleEngine.applyMasking(data, user);
        }
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

# 脱敏规则配置
masking_rules:
  - field: customer.phone
    algorithm: phone_mask
    apply_to:
      - role: SALES
        mask: false
      - role: FINANCE
        mask: true
        pattern: "***-****-{last4}"
      - role: SUPPORT
        mask: true
        pattern: "{first3}****"
    priority: 100
    
  - field: customer.id_card
    algorithm: id_card_mask
    apply_to:
      - role: "*"
        mask: true
        pattern: "{first6}********{last4}"
    priority: 200
    
  - field: supplier.bank_account
    algorithm: bank_mask
    apply_to:
      - role: FINANCE
        mask: false
      - role: "*"
        mask: true
        pattern: "****{last4}"
    priority: 150

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

// 自定义脱敏算法示例
public class CustomMaskingAlgorithm implements MaskingStrategy {
    
    @Override
    public String mask(String original, MaskingContext context) {
        if (original == null || original.length() < 4) {
            return "***";
        }
        
        // 根据上下文动态决定脱敏粒度
        String role = context.getUserRole();
        if ("ADMIN".equals(role)) {
            return original; // 管理员查看完整数据
        }
        
        int preserveLength = context.getConfig().getPreserveLength();
        int totalLength = original.length();
        
        StringBuilder masked = new StringBuilder();
        masked.append(original.substring(0, preserveLength));
        
        for (int i = preserveLength; i < totalLength - preserveLength; i++) {
            masked.append("*");
        }
        
        masked.append(original.substring(totalLength - preserveLength));
        return masked.toString();
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

┌─────────────────────────────────────────┐
│         RBAC 功能权限层                  │
│  用户 → 角色 → 权限（菜单、按钮、接口）   │
└─────────────────────────────────────────┘
                  ↓
┌─────────────────────────────────────────┐
│         ABAC 数据权限层                  │
│  用户属性 + 数据属性 + 环境属性 → 决策    │
│  (部门=销售) + (客户.所属区域=华东)       │
│  + (时间=工作日) → 允许访问              │
└─────────────────────────────────────────┘

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

-- 角色定义
CREATE TABLE sys_role (
    role_id VARCHAR(32) PRIMARY KEY,
    role_name VARCHAR(64) NOT NULL,
    role_code VARCHAR(32) UNIQUE NOT NULL,
    data_scope TINYINT COMMENT '1:全部 2:本部门 3:本部门及下级 4:自定义 5:仅本人'
);

-- 角色权限关联
CREATE TABLE sys_role_permission (
    role_id VARCHAR(32),
    permission_id VARCHAR(32),
    PRIMARY KEY (role_id, permission_id)
);

-- 用户角色关联
CREATE TABLE sys_user_role (
    user_id VARCHAR(32),
    role_id VARCHAR(32),
    PRIMARY KEY (user_id, role_id)
);

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

// ABAC策略引擎
@Service
public class DataAccessPolicyEngine {
    
    public boolean evaluate(UserContext user, DataRecord record, String action) {
        // 策略1：部门数据隔离
        if (user.getDepartment() != null && record.getOwnerDept() != null) {
            if (!isDeptAccessible(user.getDepartment(), record.getOwnerDept())) {
                return false;
            }
        }
        
        // 策略2：数据密级控制
        if (record.getSecurityLevel() != null) {
            if (user.getClearanceLevel() < record.getSecurityLevel()) {
                return false;
            }
        }
        
        // 策略3：时间窗口控制
        LocalTime now = LocalTime.now();
        if (!isWithinWorkHours(now) && user.getRole().equals("NORMAL_USER")) {
            return false;
        }
        
        return true;
    }
    
    private boolean isDeptAccessible(String userDept, String dataDept) {
        // 判断用户部门是否能访问数据所属部门的数据
        // 支持部门层级关系：本部门、本部门及下级部门、自定义部门列表
        DepartmentHierarchy hierarchy = departmentService.getHierarchy();
        return hierarchy.isAccessible(userDept, dataDept);
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

-- 数据权限过滤器（MyBatis拦截器实现）
<if test="dataScope == '2'">
    AND owner_dept_id = #{userDeptId}
</if>
<if test="dataScope == '3'">
    AND owner_dept_id IN (
        SELECT dept_id FROM sys_dept 
        WHERE dept_path LIKE CONCAT(#{userDeptPath}, '%')
    )
</if>
<if test="dataScope == '4'">
    AND owner_dept_id IN (
        SELECT dept_id FROM sys_role_dept 
        WHERE role_id = #{roleId}
    )
</if>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

# 多组织架构配置
organizations:
  - org_id: "ORG001"
    org_name: "东风汽车集团"
    org_type: "GROUP"
    children:
      - org_id: "ORG001-01"
        org_name: "东风乘用车"
        org_type: "SUBSIDIARY"
        data_isolation: true
      - org_id: "ORG001-02"
        org_name: "东风商用车"
        org_type: "SUBSIDIARY"
        data_isolation: true

# 数据隔离规则
isolation_rules:
  - rule_id: "R001"
    description: "子公司数据完全隔离"
    apply_to: ["ORG001-01", "ORG001-02"]
    policy: "STRICT"
    
  - rule_id: "R002"
    description: "集团可查看子公司汇总数据"
    apply_to: ["ORG001"]
    policy: "AGGREGATE_ONLY"
    visible_fields: ["org_id", "data_count", "summary_metrics"]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

// 操作日志切面
@Aspect
@Component
public class OperationLogAspect {
    
    @Around("@annotation(operationLog)")
    public Object around(ProceedingJoinPoint point, OperationLog operationLog) throws Throwable {
        long startTime = System.currentTimeMillis();
        
        // 记录操作前状态
        OperationRecord record = new OperationRecord();
        record.setUserId(SecurityContextHolder.getUserId());
        record.setOperation(operationLog.value());
        record.setModule(operationLog.module());
        record.setIp(getClientIp());
        record.setStartTime(new Date());
        
        Object result = null;
        boolean success = false;
        try {
            result = point.proceed();
            success = true;
            return result;
        } finally {
            // 记录操作后状态
            record.setDuration(System.currentTimeMillis() - startTime);
            record.setSuccess(success);
            record.setParams(getMethodParams(point));
            record.setResult(success ? "SUCCESS" : "FAILED");
            
            // 异步写入日志
            logService.asyncSave(record);
        }
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

-- 数据变更审计表
CREATE TABLE mdm_data_audit (
    audit_id BIGINT PRIMARY KEY AUTO_INCREMENT,
    entity_type VARCHAR(64) NOT NULL COMMENT '实体类型：customer/supplier/material',
    entity_id VARCHAR(64) NOT NULL COMMENT '实体ID',
    operation_type VARCHAR(16) NOT NULL COMMENT 'CREATE/UPDATE/DELETE',
    before_data JSON COMMENT '变更前数据快照',
    after_data JSON COMMENT '变更后数据快照',
    changed_fields JSON COMMENT '变更字段列表',
    operator_id VARCHAR(32) NOT NULL,
    operator_name VARCHAR(64),
    operate_time DATETIME NOT NULL,
    source_system VARCHAR(64) COMMENT '来源系统',
    INDEX idx_entity (entity_type, entity_id),
    INDEX idx_time (operate_time)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

// 数据变更监听器
@Component
public class DataChangeAuditor {
    
    @TransactionalEventListener(phase = TransactionPhase.BEFORE_COMMIT)
    public void handleDataChange(DataChangeEvent event) {
        DataAuditRecord record = new DataAuditRecord();
        record.setEntityType(event.getEntityType());
        record.setEntityId(event.getEntityId());
        record.setOperationType(event.getType());
        
        // 捕获变更前数据
        if (event.getType() != OperationType.CREATE) {
            record.setBeforeData(
                entityRepository.findSnapshot(event.getEntityId())
            );
        }
        
        // 捕获变更后数据
        if (event.getType() != OperationType.DELETE) {
            record.setAfterData(event.getNewData());
        }
        
        // 计算变更字段
        record.setChangedFields(
            calculateChangedFields(record.getBeforeData(), record.getAfterData())
        );
        
        // 记录操作人信息
        UserContext user = SecurityContextHolder.getCurrentUser();
        record.setOperatorId(user.getUserId());
        record.setOperatorName(user.getUserName());
        record.setOperateTime(new Date());
        
        auditRepository.save(record);
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

{
  "access_id": "ACC20260706001",
  "user_id": "user_12345",
  "user_name": "张三",
  "access_time": "2026-07-06T10:30:45.123+08:00",
  "entity_type": "customer",
  "query_condition": {
    "region": "华东",
    "status": "ACTIVE",
    "created_after": "2026-01-01"
  },
  "result_count": 1250,
  "accessed_fields": ["customer_id", "customer_name", "phone", "address"],
  "sensitive_fields_accessed": ["phone"],
  "duration_ms": 342,
  "source_ip": "192.168.1.100",
  "source_system": "CRM",
  "risk_level": "NORMAL"
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

// ❌ 错误示例：字符串拼接（存在SQL注入风险）
String sql = "SELECT * FROM mdm_customer WHERE customer_name = '" + name + "'";

// ✅ 正确示例：参数化查询
String sql = "SELECT * FROM mdm_customer WHERE customer_name = ?";
PreparedStatement pstmt = connection.prepareStatement(sql);
pstmt.setString(1, name);
ResultSet rs = pstmt.executeQuery();

// ✅ 正确示例：MyBatis参数绑定
<select id="selectCustomer">
    SELECT * FROM mdm_customer 
    WHERE customer_name = #{name}
    AND status = #{status}
</select>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

// 动态排序字段白名单
private static final Set<String> ALLOWED_SORT_FIELDS = Set.of(
    "customer_id", "customer_name", "created_time", "status"
);

public String buildOrderBy(String sortField, String sortOrder) {
    if (!ALLOWED_SORT_FIELDS.contains(sortField)) {
        throw new IllegalArgumentException("Invalid sort field: " + sortField);
    }
    
    String order = "ASC".equalsIgnoreCase(sortOrder) ? "ASC" : "DESC";
    return " ORDER BY " + sortField + " " + order;
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

// XSS过滤器
@Component
public class XssFilter implements Filter {
    
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, 
                        FilterChain chain) throws IOException, ServletException {
        
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        XssHttpServletRequestWrapper wrappedRequest = 
            new XssHttpServletRequestWrapper(httpRequest);
        
        chain.doFilter(wrappedRequest, response);
    }
}

// 请求包装器：对输入参数进行HTML转义
public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {
    
    @Override
    public String getParameter(String name) {
        String value = super.getParameter(name);
        return value != null ? HtmlUtils.htmlEscape(value) : null;
    }
    
    @Override
    public String[] getParameterValues(String name) {
        String[] values = super.getParameterValues(name);
        if (values == null) return null;
        
        String[] escapedValues = new String[values.length];
        for (int i = 0; i < values.length; i++) {
            escapedValues[i] = HtmlUtils.htmlEscape(values[i]);
        }
        return escapedValues;
    }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43

// API鉴权拦截器
@Component
public class ApiAuthInterceptor implements HandlerInterceptor {
    
    @Override
    public boolean preHandle(HttpServletRequest request, 
                            HttpServletResponse response, 
                            Object handler) {
        
        // 1. 验证API Key
        String apiKey = request.getHeader("X-API-Key");
        if (!apiKeyService.validate(apiKey)) {
            response.setStatus(HttpStatus.UNAUTHORIZED.value());
            return false;
        }
        
        // 2. 验证JWT Token
        String token = request.getHeader("Authorization");
        if (token == null || !token.startsWith("Bearer ")) {
            response.setStatus(HttpStatus.UNAUTHORIZED.value());
            return false;
        }
        
        try {
            Claims claims = jwtService.parse(token.substring(7));
            
            // 3. 验证权限
            String requiredPermission = getRequiredPermission(handler);
            if (!hasPermission(claims, requiredPermission)) {
                response.setStatus(HttpStatus.FORBIDDEN.value());
                return false;
            }
            
            // 4. 记录API调用
            apiCallLogService.record(request, claims);
            
            return true;
        } catch (JwtException e) {
            response.setStatus(HttpStatus.UNAUTHORIZED.value());
            return false;
        }
    }
}

1
2
3
4
5
6
7
8
9

# 渗透测试工具示例
# SQL注入检测
sqlmap -u "http://mdm.example.com/api/customer?id=1" --batch --level=3

# XSS漏洞扫描
xsser -u "http://mdm.example.com/search" -g "q=" --auto

# 目录遍历检测
dirb http://mdm.example.com/ /usr/share/dirb/wordlists/common.txt

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

# 数据库安全适配配置
database_security:
  mysql:
    version: "8.0.27+"
    encryption: "TDE (Transparent Data Encryption)"
    audit_plugin: "audit_log"
    password_policy: "validate_password"
    
  oracle:
    version: "12c+"
    encryption: "TDE + Data Redaction"
    audit: "Unified Auditing"
    privilege_management: "Database Vault"
    
  dameng:
    version: "7/8"
    encryption: "透明加密"
    audit: "审计日志"
    access_control: "三权分立"
    
  kingbase:
    version: "V8R3+"
    encryption: "存储加密"
    audit: "安全审计"
    label_security: "标记安全"