加密 App Engine 上的用户数据
我正在编写一个 Web 和 Android 应用程序，允许用户存储和访问一些潜在的私人数据。通过 RPC 传输的数据已受到 SSL 保护。我目前将这段数据存储在 Text 属性中，没有任何加密。我现在正在寻找更好地保护数据存储的方法。
问题 1：对于加密 App Engine 上存储的数据，是否有任何通用的最佳实践或技巧？
我的一个想法是将属性切换到 Blob 字段，仅通过线路传输加密数据，并在客户端中进行解密和加密（在 Javascript 和 Android 上）。
对于加密密钥，我考虑仅使用 UserService 提供的登录用户的电子邮件地址。用户电子邮件地址仅在用户登录时才可知，并且敏感实体不引用用户的电子邮件地址，仅引用用户 ID。
问题 2：用户电子邮件地址作为加密密钥是否有意义？如果没有，还有哪些其他众所周知的加密密钥选项？
I'm writing a web and Android app that allows users to store and access some potentially private data. The transmission of this data over RPC is already protected with SSL. I'm currently storing this piece of data in a Text property, without any encryption. I'm now looking at ways to better protect the storage of the data.
Question 1: Are there any general best practices or tips for encrypting data for storage on App Engine?
One idea I had was to switch the property to a Blob field, transmit only encrypted data over the wire, and do decryption and encryption in the clients (in Javascript and on Android).
For the encryption key, I'm looking at just using the logged-in user's email address provided by the UserService. The user email address is known only when the user is logged in, and the sensitive entity has no reference to the user's email address — only the user ID.
Question 2: Does the user email address make sense as an encryption key? If not, what are other well-known options for encryption keys?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我不确定你能从中得到很多好处。通过 SSL 传输数据当然是一个好主意。如果您未加密地存储用户数据，那么有人仍然必须获得对您的数据存储的访问权限，然后才能劫持任何内容。如果您根据用户对象的属性加密数据，则必须在客户端加密/解密代码中公开该关系，因此本质上是公开的。获得对您的数据存储区和 App Engine 源的访问权限的人仍然可以解密所有内容，只是比较棘手。
一种替代方法是将加密密钥存储在服务器端，但采取一些额外的步骤来保护它。 永久禁止代码下载。将加密密钥保存在源代码中，而不是数据存储中，但也不在源代码管理中。将其粘贴在 USB 密钥上，然后编写一个自定义部署包装器，该包装器在最后一刻将密钥注入到您的代码中，进行部署，然后清理代码。这样，获得应用程序管理员权限和源代码控制访问权限的人仍然无法解密用户数据。您的部署计算机仍然容易受到攻击，但您已经减少了攻击空间。
如果您想更进一步，请让用户生成自己的加密密钥，并将其存储在客户端。切勿将它们传输到服务器。攻击者仍然可以针对一名用户，但包括您在内的任何人都无法批量解密用户数据。如果用户丢失了自选密钥，他们的数据将永远丢失。
I'm not sure you get a ton of benefit from this. Transmitting the data over SSL is certainly a good idea. If you store the user data unencrypted, someone still has to obtain access to your datastore before they can hijack anything. If you encrypt the data based on properties of the user object, you have to expose that relationship in the client-side encryption/decryption code, so that's essentially public. Someone who obtains access to your datastore and your App Engine source can still decrypt everything, it's just trickier.
One alternative would be to store your encryption key server-side, but take some additional steps to protect it. Permanently prohibit code downloads. Keep your encryption key in source, not in the datastore, but not in source control. Stick it on a USB key, and write a custom deployment wrapper that injects the key into your code at the last minute, deploys, and then scrubs the code. This way, someone who obtains admin rights to your app and access to source control still can't decrypt user data. Your deployment machine is still vulnerable, but you've reduced the attack space.
If you want to go a step further, have users generate their own encryption keys, and store them client-side. Never transmit them to the server. An attacker could still target one user, but no one, including you, would be able to decrypt user data en masse. If users lose their self-selected key, their data is lost forever.
将属性改为Blob确实是个好主意，这样加密和解密就会很容易了。使用一些默认库来加密数据。谈到下一点，使用电子邮件作为加密密钥确实是一个坏主意，您应该使用用户对象中可用的 User_id，它确实是唯一的。
Changing the property to the Blob is really a good idea, in that case, encryption and decryption will be easy. Use some default library to encrypt the data. Coming to your next point, Using email as a encryption key is really a bad idea, You should use the User_id which is available in user object, which is really unique.