数据脱敏与隐私保护

一、数据脱敏概述

数据脱敏是对敏感数据进行处理，使其在不影响业务使用的前提下失去敏感性的技术，在数据密集型应用中，数据脱敏是保障用户隐私和合规要求的关键。

二、数据脱敏技术

2.1 数据脱敏技术对比

2.2 数据脱敏架构图

三、数据脱敏实现

3.1 掩码脱敏

public class MaskingService
{
    public string MaskEmail(string email)
    {
        var atIndex = email.IndexOf('@');
        
        if (atIndex <= 1)
        {
            return email;
        }
        
        var prefix = email.Substring(0, 1);
        var domain = email.Substring(atIndex);
        
        return $"{prefix}****{domain}";
    }
    
    public string MaskPhone(string phone)
    {
        if (phone.Length <= 4)
        {
            return phone;
        }
        
        var prefix = phone.Substring(0, 3);
        var suffix = phone.Substring(phone.Length - 4);
        
        return $"{prefix}****{suffix}";
    }
    
    public string MaskIdCard(string idCard)
    {
        if (idCard.Length <= 8)
        {
            return idCard;
        }
        
        var prefix = idCard.Substring(0, 4);
        var suffix = idCard.Substring(idCard.Length - 4);
        
        return $"{prefix}**********{suffix}";
    }
    
    public string MaskName(string name)
    {
        if (string.IsNullOrEmpty(name) || name.Length == 1)
        {
            return name;
        }
        
        var firstChar = name[0];
        
        return $"{firstChar}*".PadRight(name.Length, '*');
    }
    
    public string MaskCreditCard(string creditCard)
    {
        if (creditCard.Length <= 4)
        {
            return creditCard;
        }
        
        var suffix = creditCard.Substring(creditCard.Length - 4);
        
        return $"**** **** **** {suffix}";
    }
    
    public string MaskCustom(string input, int keepStart, int keepEnd, char maskChar = '*')
    {
        if (input.Length <= keepStart + keepEnd)
        {
            return input;
        }
        
        var prefix = input.Substring(0, keepStart);
        var suffix = input.Substring(input.Length - keepEnd);
        var maskLength = input.Length - keepStart - keepEnd;
        
        return $"{prefix}{new string(maskChar, maskLength)}{suffix}";
    }
}

3.2 加密脱敏

public class EncryptionMaskingService
{
    public string EncryptData(string plainText, string key)
    {
        var keyBytes = Encoding.UTF8.GetBytes(key);
        var plainBytes = Encoding.UTF8.GetBytes(plainText);
        
        using var aes = Aes.Create();
        aes.Key = keyBytes;
        aes.GenerateIV();
        
        using var encryptor = aes.CreateEncryptor();
        using var memoryStream = new MemoryStream();
        using var cryptoStream = new CryptoStream(memoryStream, encryptor, CryptoStreamMode.Write);
        
        cryptoStream.Write(plainBytes, 0, plainBytes.Length);
        cryptoStream.FlushFinalBlock();
        
        var encrypted = memoryStream.ToArray();
        
        return Convert.ToBase64String(aes.IV.Concat(encrypted).ToArray());
    }
    
    public string DecryptData(string encryptedText, string key)
    {
        var keyBytes = Encoding.UTF8.GetBytes(key);
        var encryptedBytes = Convert.FromBase64String(encryptedText);
        
        var iv = encryptedBytes.Take(16).ToArray();
        var encrypted = encryptedBytes.Skip(16).ToArray();
        
        using var aes = Aes.Create();
        aes.Key = keyBytes;
        aes.IV = iv;
        
        using var decryptor = aes.CreateDecryptor();
        using var memoryStream = new MemoryStream(encrypted);
        using var cryptoStream = new CryptoStream(memoryStream, decryptor, CryptoStreamMode.Read);
        using var resultStream = new MemoryStream();
        
        cryptoStream.CopyTo(resultStream);
        
        return Encoding.UTF8.GetString(resultStream.ToArray());
    }
}

3.3 格式保留脱敏

public class FormatPreservingMaskingService
{
    public string FormatPreservingPhone(string phone)
    {
        var digits = phone.Where(char.IsDigit).ToArray();
        
        if (digits.Length != 11)
        {
            return phone;
        }
        
        var newDigits = (char[])digits.Clone();
        
        for (int i = 3; i < digits.Length - 4; i++)
        {
            newDigits[i] = (char)('0' + (new Random(i).Next(10)));
        }
        
        return new string(newDigits);
    }
    
    public string FormatPreservingEmail(string email)
    {
        var atIndex = email.IndexOf('@@');
        
        if (atIndex <= 1)
        {
            return email;
        }
        
        var prefix = email.Substring(0, atIndex);
        var domain = email.Substring(atIndex);
        
        var newPrefix = GenerateRandomString(prefix.Length);
        
        return $"{newPrefix}{domain}";
    }
    
    public string FormatPreservingIdCard(string idCard)
    {
        if (idCard.Length != 18)
        {
            return idCard;
        }
        
        var newIdCard = idCard.ToCharArray();
        
        for (int i = 4; i < 14; i++)
        {
            if (char.IsDigit(idCard[i]))
            {
                newIdCard[i] = (char)('0' + (new Random(i).Next(10)));
            }
        }
        
        return new string(newIdCard);
    }
    
    private string GenerateRandomString(int length)
    {
        var chars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
        var random = new Random();
        
        return new string(Enumerable.Repeat(chars, length)
            .Select(s => s[random.Next(s.Length)]).ToArray());
    }
}

四、动态数据脱敏

4.1 动态脱敏架构

4.2 动态脱敏实现

public class DynamicMaskingService
{
    public async Task