数据脱敏的3种常见方案，好用到爆！

---

1.SQL数据脱敏实现

MYSQL(电话号码,身份证)数据脱敏的实现

--CONCAT()、LEFT()和RIGHT()字符串函数组合使用，请看下面具体实现

-- CONCAT(str1,str2,…)：返回结果为连接参数产生的字符串
-- LEFT(str,len)：返回从字符串str 开始的len 最左字符
-- RIGHT(str,len)：从字符串str 开始，返回最右len 字符

--电话号码脱敏sql：

SELECTmobilePhoneAS脱敏前电话号码,CONCAT(LEFT(mobilePhone,3),'********')AS脱敏后电话号码FROMt_s_user

--身份证号码脱敏sql:

SELECTidcardAS未脱敏身份证,CONCAT(LEFT(idcard,3),'****',RIGHT(idcard,4))AS脱敏后身份证号FROMt_s_user

2.JAVA数据脱敏实现

可参考：海强 / sensitive-plus

https://gitee.com/strong_sea/sensitive-plus

数据脱敏插件，目前支持地址脱敏、银行卡号脱敏、中文姓名脱敏、固话脱敏、身份证号脱敏、手机号脱敏、密码脱敏 一个是正则脱敏、另外一个根据显示长度脱敏，默认是正则脱敏，可以根据自己的需要配置自己的规则。

3.mybatis-mate-sensitive-jackson

mybatisplus 的新作，可以测试使用，生产需要收费。

根据定义的策略类型，对数据进行脱敏，当然策略可以自定义。

#目前已有
packagemybatis.mate.strategy;

publicinterfaceSensitiveType{
StringchineseName="chineseName";
StringidCard="idCard";
Stringphone="phone";
Stringmobile="mobile";
Stringaddress="address";
Stringemail="email";
StringbankCard="bankCard";
Stringpassword="password";
StringcarNumber="carNumber";
}

Demo 代码目录

1、pom.xml

"1.0"encoding="UTF-8"?>
"http://maven.apache.org/POM/4.0.0"xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0http://maven.apache.org/xsd/maven-4.0.0.xsd">

com.baomidou
mybatis-mate-examples
0.0.1-SNAPSHOT

4.0.0
mybatis-mate-sensitive-jackson


mysql
mysql-connector-java

2、appliation.yml

#DataSourceConfig
spring:
datasource:
#driver-class-name:org.h2.Driver
#schema:classpath:db/schema-h2.sql
#data:classpath:db/data-h2.sql
#url:jdbcmem:test
#username:root
#password:test
driver-class-name:com.mysql.cj.jdbc.Driver
url:jdbc//localhost:3306/mybatis_mate?useSSL=false&useUnicode=true&characterEncoding=UTF-8&serverTimezone=UTC
username:root
password:123456
#MybatisMate配置
mybatis-mate:
cert:
#请添加微信wx153666购买授权，不白嫖从我做起！测试证书会失效，请勿正式环境使用
grant:thisIsTestLicense
license:as/bsBaSVrsA9FfjC/N77ruEt2/QZDrW+MHETNuEuZBra5mlaXZU+DE1ZvF8UjzlLCpH3TFVH3WPV+Ya7Ugiz1Rx4wSh/FK6Ug9lhos7rnsNaRB/+mR30aXqtlLt4dAmLAOCT56r9mikW+t1DDJY8TVhERWMjEipbqGO9oe1fqYCegCEX8tVCpToKr5J1g1V86mNsNnEGXujnLlEw9jBTrGxAyQroD7Ns1Dhwz1K4Y188mvmRQp9t7OYrpgsC7N9CXq1s1c2GtvfItHArkqHE4oDrhaPjpbMjFWLI5/XqZDtW3D+AVcH7pTcYZn6vzFfDZEmfDFV5fQlT3Rc+GENEg==

#LoggerConfig
logging:
level:
mybatis.mate:debug

3、Appliation启动类

packagemybatis.mate.sensitive.jackson;

importorg.springframework.boot.SpringApplication;
importorg.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
publicclassSensitiveJacksonApplication{

//测试访问http://localhost:8080/info，http://localhost:8080/list
publicstaticvoidmain(String[]args){
SpringApplication.run(SensitiveJacksonApplication.class,args);
}
}

4、配置类，自定义脱敏策略

packagemybatis.mate.sensitive.jackson.config;

importmybatis.mate.databind.ISensitiveStrategy;
importmybatis.mate.strategy.SensitiveStrategy;
importorg.springframework.context.annotation.Bean;
importorg.springframework.context.annotation.Configuration;

@Configuration
publicclassSensitiveStrategyConfig{

/**
*注入脱敏策略
*/
@Bean
publicISensitiveStrategysensitiveStrategy(){
//自定义testStrategy类型脱敏处理
returnnewSensitiveStrategy().addStrategy("testStrategy",t->t+"***test***");
}
}

5、业务类

User，注解标识脱敏字段，及选用脱敏策略

packagemybatis.mate.sensitive.jackson.entity;

importlombok.Getter;
importlombok.Setter;
importmybatis.mate.annotation.FieldSensitive;
importmybatis.mate.sensitive.jackson.config.SensitiveStrategyConfig;
importmybatis.mate.strategy.SensitiveType;

@Getter
@Setter
publicclassUser{
privateLongid;
/**
*这里是一个自定义的策略{@linkSensitiveStrategyConfig}初始化注入
*/
@FieldSensitive("testStrategy")
privateStringusername;
/**
*默认支持策略{@linkSensitiveType}
*/
@FieldSensitive(SensitiveType.mobile)
privateStringmobile;
@FieldSensitive(SensitiveType.email)
privateStringemail;

}

UserController

packagemybatis.mate.sensitive.jackson.controller;

importmybatis.mate.databind.ISensitiveStrategy;
importmybatis.mate.databind.RequestDataTransfer;
importmybatis.mate.sensitive.jackson.entity.User;
importmybatis.mate.sensitive.jackson.mapper.UserMapper;
importmybatis.mate.strategy.SensitiveType;
importorg.springframework.beans.factory.annotation.Autowired;
importorg.springframework.web.bind.annotation.GetMapping;
importorg.springframework.web.bind.annotation.RestController;

importjavax.servlet.http.HttpServletRequest;
importjava.util.HashMap;
importjava.util.List;
importjava.util.Map;

@RestController
publicclassUserController{
@Autowired
privateUserMapperuserMapper;
@Autowired
privateISensitiveStrategysensitiveStrategy;

//测试访问http://localhost:8080/info
@GetMapping("/info")
publicUserinfo(){
returnuserMapper.selectById(1L);
}

//测试返回map访问http://localhost:8080/map
@GetMapping("/map")
publicMapmap(){
//测试嵌套对象脱敏
MapuserMap=newHashMap<>();
userMap.put("user",userMapper.selectById(1L));
userMap.put("test",123);
userMap.put("userMap",newHashMap(){{
put("user2",userMapper.selectById(2L));
put("test2","hichina");
}});
//手动调用策略脱敏
userMap.put("mobile",sensitiveStrategy.getStrategyFunctionMap()
.get(SensitiveType.mobile).apply("15315388888"));
returnuserMap;
}

//测试访问http://localhost:8080/list
//不脱敏http://localhost:8080/list?skip=1
@GetMapping("/list")
publicListlist(HttpServletRequestrequest){
if("1".equals(request.getParameter("skip"))){
//跳过脱密处理
RequestDataTransfer.skipSensitive();
}
returnuserMapper.selectList(null);
}
}

UserMapper

packagemybatis.mate.sensitive.jackson.mapper;

importcom.baomidou.mybatisplus.core.mapper.BaseMapper;
importmybatis.mate.sensitive.jackson.entity.User;
importorg.apache.ibatis.annotations.Mapper;

@Mapper
publicinterfaceUserMapperextendsBaseMapper{

}

6、测试

GET http://localhost:8080/list

[
{
"id":1,
"username":"Jone***test***",
"mobile":"153******81",
"email":"t****@baomidou.com"
},
{
"id":2,
"username":"Jack***test***",
"mobile":"153******82",
"email":"t****@baomidou.com"
},
{
"id":3,
"username":"Tom***test***",
"mobile":"153******83",
"email":"t****@baomidou.com"
}
]

GET http://localhost:8080/list?skip=1

[
{
"id":1,
"username":"Jone",
"mobile":"15315388881",
"email":"[e-mail]"
},
{
"id":2,
"username":"Jack",
"mobile":"15315388882",
"email":"[e-mail]"
},
{
"id":3,
"username":"Tom",
"mobile":"15315388883",
"email":"[e-mail]"
}
]