本地网络服务器上的双向加密可能被盗
我有一台离线信息亭计算机，它将运行 LAMP Web 服务器并托管表格供人们填写。他们提交的数据将被加密并存储在 MySQL 数据库中（全部存储在该机器本地）。
令人担忧的是，如果整个盒子被盗，有人可能能够进入代码、查看加密密钥并解密数据。
有没有什么方法可以完成此设置，即使整台机器被盗，加密数据也毫无用处？ （即，加密密码保存在其他地方，但仍然允许在使用信息亭时对新输入的表单数据进行加密和存储）？
谢谢。
I have an offline kiosk computer that will be running a LAMP web server and hosting a form for people to walk up and fill out. The data they submit will be encrypted and stored in a MySQL database (all stored locally on that machine).
The concern is that if the entire box was stolen, someone would potentially be able to get into the code, see the encryption keys and decrypt the data.
Is there any way to accomplish this set up in a way renders the encrypted data useless even if the entire machine is stolen? (i.e. an encryption password that is kept elsewhere, but still allows the newly entered form data to be encrypted and stored while the kiosk is in use)?
Thanks.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
试试这个： http://andytson.com/blog /2009/07/php-public-key-cryptography-using-openssl/
Try this: http://andytson.com/blog/2009/07/php-public-key-cryptography-using-openssl/
你的“攻击者”有多聪明？
你可以，但钥匙在内存中，这样当机器断电时它就会（有点）消失。为此，您可以安装一些 ram 作为分区（ramdisk），并让代码从那里加载密钥。
但是，防止密钥永远接触磁盘可能很困难。例如，操作系统可以将其交换。
编辑：
聪明的攻击者可以通过以下任一方式规避此问题：
您还可以进行一些轻微的反逆向工程，并将代码拼凑在一起。这样，读出它就不会那么简单（但也不是那么困难）。
How smart are your "attackers"?
You could but the key in ram, that way it would (kind of) disappear when the machine looses power. To do this you can mount some ram as a partition (ramdisk) and let the code load the key from there.
But, keeping the key from ever touching the disk can be difficult. The OS can, for example, swap it out.
Edit:
Smart attackers could circumvent this by either:
You could also do some light anti reverse-engineering and piece the code together in the code. That way, it would not be trivial (but not that hard either) to read it out.
您可以使用非对称加密算法（例如 RSA）来实现此目的。有了这个，你将拥有一对密钥，一个私钥和一个公钥。顾名思义，公钥将对每个人都可用，因此可以使用该公钥对用户数据进行加密，而加密的数据只能使用相应的私钥进行解密，而私钥在旅游箱中机器所有者将保留。因此，即使有人窃取了您的机器，人们也很难解密数据。
You can use the Asymmetric encryption algorithms (Ex. RSA) to achieve this. With that you will be having a pair of keys, a private and a public. And as the name suggest , the public key will be available to everyone, so the user data can be encrypted with this public key, and the encrypted data is only decrypted using the corresponding private key, which in tour case machine owner will keep. Thus Even in case someone steal your machine, it will be very difficult for person to decrypt the data.