如何使用 PHP 管理服务器运行时的机密？
我可能需要保护基于 LAMP 的服务器免遭第三方窃取或劫持。
我的想法是使用硬加密，使用主密钥对所有数据记录进行加密，如果服务器关闭，则无法恢复。因此，主密钥不能存储在文件系统中。
如果服务器运行，我将使用安全通道提供主密钥。
只要服务器继续运行，就应该能够使用它。如果服务器出现故障，密钥应该无法恢复。
在这种情况下最好的解决方案是什么（共享内存？）。
I probably need to protect a LAMP based server against being stolen or hijacked by a third party.
My idea is to use hard encryption to encrypt all data records using a master key, which can't be recovered, if the server shuts down. Thus, the master key can't be stored in the file system.
I'd provide the master key using a secure channel if the server runs.
The server should be able to use it, as long as it continues to run. If the server fails, the key should not be recoverable.
What would be the best solution in this case (shared memory?).
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您的意思是您正在尝试保护物理服务器免遭盗窃吗？如果是这样，我建议除了操作系统的内置安全性之外，物理安全性的主要机制根本不是基于代码的，而是一个很好的老式锁和钥匙。靠不住的自制加密机制不是答案——通过模糊实现安全不是安全。
Do you mean you are trying to protect a physical server against theft? If so, I suggest that beyond the operating system's built-in security, the primary mechanism for physical security is not code-based at all, but rather a good old fashioned lock and key. Wonky home-brewed encryption mechanisms are not the answer - security through obscurity is not security.
请提供有关应用程序类型以及需要保护哪些数据的更多详细信息。
一种非常常见的方法是：
编辑的训练有素的技术人员来解决：
理论上是可能的 - 完全了解所有相关芯片和极高敏感设备，可物理劫持带电导体路径并捕获一些数据。 （我曾经看过 ata-33 PATA 电缆的演示。
为此，服务器必须安装移动电源并带入设备齐全的实验室。
但如果您有系统级加密层，则完全可以避免这种情况。地球上没有任何设备可以做到这一点。
Please provide more details on the kind of application and what data needs to be protected.
A pretty common way is:
edit:
it is theoretically possible - with perfect knowledge of all involved chips and extremly high sensitive equipment to physically hijack into live conductor paths and catch some data. (i once saw a demonstration on ata-33 PATA cables.
the server would have to be put on a mobile power supply and brought into a fully equipped lab for that.
but you can totally avoid that if you have a system level encryption layer. theres no equipment on earth that can do somthing then.