MongoDB如何字段级加密储存和查询

太过爱你忘了你带给我的痛 2023-02-21 09:07 309阅读 0赞

MongoDB4.2企业版引入了字段级别加密 [详情][Link 1]

MongoDB的手册说**字段级加密的自动功能仅在MongoDB 4.2 Enterprise和MongoDB Atlas 4.2集群中可用。**[详情][Link 2]

既然不能使用4.2的字段级别加密，那就换种方式，[引入插件][Link 3]！mongoose-field-encryption

环境要求：

*  Node `>=6` (Use `2.3.4` for Node `>=4.4.7 && <=6.x.x`)
 *  MongoDB `>=2.6.10`
 *  Mongoose `>=4.0.0`

以egg.js为例

## 一、安装插件 ##

npm install mongoose-field-encryption --save-exact

## 二、使用 ##

app/model/message.js

module.exports = app => {
      const mongoose = app.mongoose
      const Schema = mongoose.Schema;
      const mongooseFieldEncryption = require("mongoose-field-encryption").fieldEncryption;
      const messageSchema = new Schema({
        title: String,
        message: String,
        phone: String
      });
    
      messageSchema.plugin(mongooseFieldEncryption, {
        fields: ["message", "phone"],
        secret: "liubao",
        saltGenerator: function (secret) {
          return "1234567890123456"; //理想情况下，应使用该机密返回长度为16的字符串
        }
      });
      return mongoose.model('message', messageSchema)
    }

app/model/post.js

module.exports = app => {
      const mongoose = app.mongoose
      const mongooseFieldEncryption = require("mongoose-field-encryption").fieldEncryption;
      const Schema = mongoose.Schema;
      const PostSchema = new Schema({
        title: String,
        message: String,
        references: {
          author: String,
          date: Date
        }
      });
      PostSchema.plugin(mongooseFieldEncryption, {fields: ["message", "references"], secret: "liubao"})
      return mongoose.model('post', PostSchema)
    }

app/controller/test.js

模拟请求：

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmF0XzE1OTU1NDIz_size_16_color_FFFFFF_t_70][]

结果：

![20200629195225816.png][]

![20200629195243944.png][]

结果成功！

* 非egg.js框架的话可以参考如下自行修改，效果一样*

**mongoose-field-encryption加密子文档(嵌套文档)**

可以在定义加密字段时这样定义：

*上面这个例子更新时加密。但是查询时切记不能过滤字段，否则就返回的是加密的数据*

*也可以用下面的方法巧妙的使用子文档加解密*

await new xxModel(data).save() // 保存
    await xxModel.find({}) // 查询时结果就是解密的

[Link 1]: https://docs.mongodb.com/manual/core/security-client-side-encryption/#automatic-field-level-encryption
[Link 2]: https://docs.mongodb.com/manual/core/security-automatic-client-side-encryption/#field-level-encryption-automatic
[Link 3]: https://www.npmjs.com/package/mongoose-field-encryption
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmF0XzE1OTU1NDIz_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200629195133349.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3NpbmF0XzE1OTU1NDIz,size_16,color_FFFFFF,t_70
[20200629195225816.png]: https://img-blog.csdnimg.cn/20200629195225816.png
[20200629195243944.png]: https://img-blog.csdnimg.cn/20200629195243944.png