如何将数据存储在数据库中，以便任何有权访问它的人都无法理解它？
我们即将发布国内经济网站的内测版。
当然，该网站会从用户（仅通过电子邮件识别）的私人财务状况中收集信息：工资、租金、账单、抵押贷款等。所有这些都是非常敏感的信息，任何人都不应该访问 - 即使是我们技术人员也不能访问ppl。
以不可读的方式存储数据的最佳实践是什么？当然，成员密码已经在数据库中进行了哈希处理。
我正在考虑的是使用某种密钥加密所有数据。但话又说回来，应用程序需要访问该密钥。而且我不想将其存储在数据库中。如果由用户提供，我想我可以将其保留在会话中，以便解密每个检索到的数据库结果。但是开销呢？
请问有人有指导吗？
We are soon releasing a private beta of a domestic economy website.
The website of course gathers information from a user's (identified by email only) private financial situation: salary, rent, bills, mortages, etc. All of these are really sensitive information and should not be accessible by anyone - not even us, the tech ppl.
What are best practises for storing data in a non-readable fashion? Of course, member passwords are already hashed in the db.
What I'm thinking about is to encrypt all data using some kind of key. But then again, the application needs access to that key. And I don't want to store it in the db. If supplied by user, I guess I could keep it in the session in order to decrypt every retreived db result. But what about overhead?
Pls, anyone with guidelines?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
首先，将个人身份信息与统计数据分开。这使您可以在不将敏感数据置于危险之中的情况下执行计算。接下来，对个人身份信息进行严格加密，并将密钥存储在访问权限有限的强化系统中。不要对所有数据使用相同的密钥，但您使用的密钥数量是由您决定的设计决策。更多的密钥会更安全，但更难处理。
可能存在适用于您的数据的现有标准，具体取决于您位于世界上的哪个位置以及您所从事的行业。找出这些并遵循它们。
First, separate the personally-identifiable information from the statistics. This allows you to perform computations without putting sensitive data at risk. Next, strongly encrypt the personally-identifiable information, and store the keys in a hardened system with limited access. Don't use the same key for all data, but the number of keys you do use is a design decision that is up to you. More keys will be more secure, but harder to handle.
There may be existing standards that apply to your data, depending on where in the world you are and what industries you are working with. Seek these out and follow them.
具有管理员级别访问权限的任何人（例如您的技术人员）都可以访问计算机上存储的任何解密密钥。关于会话，任何管理员级别的人员都可以进行内存转储以从会话中提取密钥。
要点是，唯一的“解决方案”是很好的离线访问日志记录，并结合强有力的法律文件，承认他们正在被监视，并且您将起诉。此外，您还应该对技术人员进行年度背景调查。其次，具有此类访问权限的人数应该受到极大限制。作为积极参与我们开发过程的首席执行官，即使我也无法访问我们的生产系统。
无论如何，您仍然应该加密数据库，尤其是 PII 数据。根据您所在的行业，如果您不这样做，您可能会被起诉，并且如果有人确实提取了数据转储，也不必介意负面报道。
Anyone with admin level access (your tech people for example) can get access to any decryption keys stored on the machine. Regarding session, any admin level person can do memory dumps to pull keys out of session.
Point is, the only "solution" of sorts is great off machine access logging combined with a strong legal document acknowledging that they are being watched and you will prosecute. Also you should perform annual background checks of your tech people. Next, the number of people with that type of access should be extremely limited. As a CEO who takes an active part in our development process, even I don't have access to our production systems.
Regardless, you should still encrypt the database, especially the PII data. Depending on your industry you could be sued if you don't, and never mind the bad press if someone does pull a data dump.
由用户密钥短语保护的第二个密钥短语怎么样？当他登录时，他的第二个将被解密并存储。
What about a second keyphrase secured by the users keyphrase? When he logs in his second will be decrypted and stored.