安全合规与数据保护

// 基于规则的 PII 识别
public enum PiiType {
    EMAIL("[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}"),
    PHONE("1[3-9]\\d{9}"),
    ID_CARD("[1-9]\\d{5}(18|19|20)\\d{2}((0[1-9])|(1[0-2]))(([0-2][1-9])|10|20|30|31)\\d{3}[0-9Xx]"),
    BANK_CARD("[1-9]\\d{15,18}"),
    PASSPORT("[GE]\\d{8}");
    
    private final Pattern pattern;
    
    public List<String> findMatches(String text) {
        List<String> matches = new ArrayList<>();
        Matcher m = pattern.matcher(text);
        while (m.find()) {
            matches.add(m.group());
        }
        return matches;
    }
}

// 基于 ML 的 NLP 实体识别
// Presidio (Microsoft) / Cloud DLP API / 自研模型

// 数据库字段级加密（应用层）
@Entity
public class Customer {
    @Id
    private Long id;
    
    @Convert(converter = EncryptedStringConverter.class)
    @Column(name = "ssn")
    private String socialSecurityNumber;
    
    @Convert(converter = EncryptedStringConverter.class)
    private String creditCardNumber;
}

// 转换器
@Converter
public class EncryptedStringConverter implements AttributeConverter<String, String> {
    @Autowired
    private EncryptionService encryptionService;
    
    @Override
    public String convertToDatabaseColumn(String attribute) {
        return attribute == null ? null : encryptionService.encrypt(attribute);
    }
    
    @Override
    public String convertToEntityAttribute(String dbData) {
        return dbData == null ? null : encryptionService.decrypt(dbData);
    }
}

// Masking 脱敏工具
public class DataMasker {
    public static String maskPhone(String phone) {
        if (phone == null || phone.length() != 11) return phone;
        return phone.substring(0, 3) + "****" + phone.substring(7);
    }
    
    public static String maskEmail(String email) {
        if (email == null || !email.contains("@")) return email;
        String[] parts = email.split("@");
        String name = parts[0];
        if (name.length() <= 2) return "**@" + parts[1];
        return name.charAt(0) + "***" + name.charAt(name.length()-1) + "@" + parts[1];
    }
    
    public static String maskIdCard(String id) {
        if (id == null || id.length() != 18) return id;
        return id.substring(0, 6) + "********" + id.substring(14);
    }
}

# 基于网关的 DLP（拦截出站 HTTP）
class DLPGateway:
    SENSITIVE_PATTERNS = {
        'credit_card': r'\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})\b',
        'ssn': r'\b\d{3}-\d{2}-\d{4}\b',
        'api_key': r'(?:api[_-]?key|apikey)["\']?\s*[:=]\s*["\']?[a-zA-Z0-9]{32,}'
    }
    
    def inspect_request(self, request):
        content = request.body.decode('utf-8', errors='ignore')
        
        for pattern_name, pattern in self.SENSITIVE_PATTERNS.items():
            if re.search(pattern, content):
                self.block_and_alert(request, pattern_name)
                return False  # 阻止请求
        return True

{
  "timestamp": "2024-01-15T08:30:00Z",
  "trace_id": "abc123-def456",
  "event_type": "DATA_ACCESS",
  "severity": "INFO",
  "actor": {
    "type": "USER",
    "id": "user_12345",
    "name": "zhangsan",
    "ip": "10.0.0.100",
    "user_agent": "Mozilla/5.0..."
  },
  "resource": {
    "type": "DATABASE_TABLE",
    "name": "customers",
    "data_classification": "L4_SECRET",
    "records_accessed": 50
  },
  "action": {
    "type": "SELECT",
    "query": "SELECT * FROM customers WHERE region = 'east'",
    "result": "SUCCESS"
  },
  "data_fields_accessed": ["name", "phone", "email"]
}

# 使用只追加文件系统（Append-Only）
chattr +a /var/log/audit/audit.log

# 远程日志服务器（防本地篡改）
*.* @log-server:514

# 区块链/不可变存储
# AWS QLDB / Amazon Managed Blockchain

# Terraform 合规检查（Checkov）
# 确保所有 S3 bucket 加密
# 确保 RDS 启用审计日志
# 确保安全组不开放 0.0.0.0/0

# CI/CD 中集成合规门禁
compliance_check:
  stage: security
  script:
    - checkov -d terraform/ --framework terraform
    - prowler -c check31,check41  # AWS CIS 检查
    - scout-suite aws --ruleset default