保护各个数据库字段的安全
我的应用程序需要将银行详细信息和信用卡号码存储在数据库中。我们支持多种数据库变体，并尽可能避免任何可能无法轻松移植到另一个数据库的特定功能。
因此，我正在寻找一种简单但相当安全的方法来加密某些字段，例如卡号和银行帐号。应用程序需要这些数据才能向外部支付系统提交请求，但随意选择 * 相关的数据库表应该返回“垃圾”，这样某人就无法带着数千个信用卡号逃跑。
只有我们的应用程序需要知道加密系统，该信息不需要以加密形式共享传输到任何其他系统。
有人对简单而安全的方法有什么建议吗？
我发现以下问题/答案看起来有用且全面，但我很难弄清楚是否我需要所有这些领域。
我还发现 这篇文章 这似乎暗示 IV 应该随机生成每次插入/更新记录并与加密值一起存储时。如果安全的话，这看起来比 SO 问题中建议的方法更简单，但我在协调如何与 Java API 协调方面遇到了困难。
任何建议表示赞赏。 （我使用的是Java 6）
My application needs to store bank details and credit card numbers in a database. We support several DB variants and we try to avoid wherever possible any DB specific features that may not port easily to another.
Therefore I'm looking for a simple yet reasonably secure way of encrypting certain fields such as the card number and bank account number. The application needs those in order to submit requests to external payment systems but a casual select * of the relevant DB tables should return "junk" so someone can't run off with several thousand credit card numbers.
Only our application need know the encryption system, this information does not need to be shared transmitted in (this) encrypted form to any other system.
Does anyone have any suggestions for a simple yet secure way of doing this?
I found the following question/answer which looked useful and comprehensive but I was struggling to figure out if I needed all those fields.
I also found this article which seemed to be implying the IV should be generated randomly each time a record is inserted/updated and stored alongside the encrypted value. If secure this seems more straightforward then the approach suggested in the SO question but I'm having trouble reconciling how to this with the Java APIs.
Any suggestions appreciated. (I'm using Java 6)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
可以参考PCI安全标准。卡行业对于敏感卡数据有很多规定。
PCI Security Standards could be referenced. There are many regulations about sensitive card data in card industry.
Java 附带了一些加密/解密库，您可以从 http://download.oracle.com/javase/6/docs/technotes/guides/security/index.html，特别看一下JCE（现在是JCA的扩展）信息。
这个问题也非常相似，包含很多有用的建议：https： //stackoverflow.com/questions/4319496/how-to-encrypt-and-decrypt-data-in-java
Java comes std with some encrypt/decrypt libs, you can investigate them starting at http://download.oracle.com/javase/6/docs/technotes/guides/security/index.html, in particular look at the JCE (now extension of JCA) information.
This SO question is also very similar and contains lots of useful advice: https://stackoverflow.com/questions/4319496/how-to-encrypt-and-decrypt-data-in-java