手札

WordPress数据加密全攻略：从基础到高级实现

一、WordPress核心加密机制

1. 内置哈希与加密函数

WordPress提供了一系列安全函数处理数据保护：

// 密码哈希
$hashed_password = wp_hash_password('plain_text_password');

// 密码验证
$is_valid = wp_check_password($user_input, $stored_hash);

// 非对称加密
$encrypted = wp_encrypt($data, $key);
$decrypted = wp_decrypt($encrypted, $key);

2. 安全盐值(Salt)系统

// wp-config.php中的安全密钥
define('AUTH_KEY',         'unique phrase');
define('SECURE_AUTH_KEY',  'unique phrase');
define('LOGGED_IN_KEY',    'unique phrase');
define('NONCE_KEY',       'unique phrase');

二、数据库字段加密方案

1. 元数据加密实现

add_filter('sanitize_post_meta', function($meta_value, $meta_key) {
    if (in_array($meta_key, ['credit_card', 'ssn'])) {
        return encrypt_data($meta_value);
    }
    return $meta_value;
}, 10, 2);

function encrypt_data($data) {
    $key = wp_salt('secure_auth');
    $iv = openssl_random_pseudo_bytes(openssl_cipher_iv_length('aes-256-cbc'));
    return base64_encode($iv . openssl_encrypt(
        $data, 
        'aes-256-cbc', 
        $key, 
        0, 
        $iv
    ));
}

2. 查询时解密处理

add_filter('get_post_metadata', function($value, $object_id, $meta_key) {
    if (in_array($meta_key, ['credit_card', 'ssn']) && is_serialized($value)) {
        return decrypt_data($value);
    }
    return $value;
}, 10, 3);

function decrypt_data($encrypted) {
    $key = wp_salt('secure_auth');
    $data = base64_decode($encrypted);
    $iv_length = openssl_cipher_iv_length('aes-256-cbc');
    $iv = substr($data, 0, $iv_length);
    return openssl_decrypt(
        substr($data, $iv_length), 
        'aes-256-cbc', 
        $key, 
        0, 
        $iv
    );
}

三、传输层安全方案

1. API数据传输加密

// JWT令牌生成
function generate_api_token($user_id) {
    $secret_key = wp_salt('auth');
    $issued_at = time();
    $expiration = $issued_at + (DAY_IN_SECONDS * 30);
    
    $payload = array(
        'iss' => get_bloginfo('url'),
        'iat' => $issued_at,
        'exp' => $expiration,
        'user_id' => $user_id
    );
    
    return JWT::encode($payload, $secret_key, 'HS256');
}

// 令牌验证
function validate_api_token($token) {
    try {
        $secret_key = wp_salt('auth');
        return JWT::decode($token, $secret_key, ['HS256']);
    } catch (Exception $e) {
        return false;
    }
}

2. 前端加密提交

// 使用CryptoJS加密表单数据
document.getElementById('secure-form').addEventListener('submit', function(e) {
    e.preventDefault();
    
    const formData = new FormData(this);
    const secret = wpApiSettings.nonce; // 使用WordPress nonce作为密钥
    
    // 加密敏感字段
    formData.set('credit_card', CryptoJS.AES.encrypt(
        formData.get('credit_card'), 
        secret
    ).toString());
    
    // 提交加密数据
    fetch('/wp-json/api/process', {
        method: 'POST',
        body: formData
    });
});

四、高级加密场景

1. 文件加密存储

// 加密上传的敏感文件
add_filter('wp_handle_upload', function($fileinfo) {
    if ($fileinfo['type'] === 'application/pdf') {
        $encrypted = file_encrypt(
            $fileinfo['file'],
            wp_salt('secure_auth')
        );
        file_put_contents($fileinfo['file'] . '.enc', $encrypted);
        unlink($fileinfo['file']);
        $fileinfo['file'] .= '.enc';
    }
    return $fileinfo;
});

function file_encrypt($filepath, $key) {
    $iv = openssl_random_pseudo_bytes(16);
    $source = fopen($filepath, 'rb');
    $dest = fopen('php://memory', 'wb');
    
    fwrite($dest, $iv);
    while (!feof($source)) {
        $chunk = fread($source, 8192);
        fwrite($dest, openssl_encrypt(
            $chunk, 
            'aes-256-cfb', 
            $key, 
            OPENSSL_RAW_DATA, 
            $iv
        ));
        $iv = substr($chunk, -16);
    }
    
    rewind($dest);
    return stream_get_contents($dest);
}

2. 数据库表字段级加密

// 使用dbdelta创建加密表
function create_secure_table() {
    global $wpdb;
    
    $table_name = $wpdb->prefix . 'secure_data';
    $charset_collate = $wpdb->get_charset_collate();
    
    $sql = "CREATE TABLE $table_name (
        id mediumint(9) NOT NULL AUTO_INCREMENT,
        encrypted_data text NOT NULL,
        iv varchar(32) NOT NULL,
        PRIMARY KEY (id)
    ) $charset_collate;";
    
    require_once(ABSPATH . 'wp-admin/includes/upgrade.php');
    dbDelta($sql);
    
    // 插入加密数据示例
    $data = '敏感信息';
    $key = wp_salt();
    $iv = bin2hex(openssl_random_pseudo_bytes(16));
    $encrypted = openssl_encrypt($data, 'aes-256-cbc', $key, 0, hex2bin($iv));
    
    $wpdb->insert($table_name, [
        'encrypted_data' => $encrypted,
        'iv' => $iv
    ]);
}

五、密钥管理系统

1. 多层级密钥架构

// 密钥轮换策略
class KeyManager {
    private static $current_version = 2;
    
    public static function get_key($purpose = 'default') {
        $keys = get_option('encryption_keys', []);
        
        if (!isset($keys[self::$current_version])) {
            $keys[self::$current_version] = [
                'key' => bin2hex(random_bytes(32)),
                'created' => time(),
                'active' => true
            ];
            update_option('encryption_keys', $keys);
        }
        
        return $keys[self::$current_version]['key'];
    }
    
    public static function rotate_keys() {
        $keys = get_option('encryption_keys', []);
        $new_version = self::$current_version + 1;
        
        $keys[$new_version] = [
            'key' => bin2hex(random_bytes(32)),
            'created' => time(),
            'active' => true
        ];
        
        // 标记旧密钥为不活跃
        foreach ($keys as $version => &$keydata) {
            if ($version < $new_version) {
                $keydata['active'] = false;
            }
        }
        
        update_option('encryption_keys', $keys);
        self::$current_version = $new_version;
    }
}

2. 硬件安全模块(HSM)集成

// 伪代码示例 - 实际需要HSM供应商SDK
class HSM_Integration {
    private $client;
    
    public function __construct() {
        $this->client = new HSM_Client([
            'endpoint' => 'https://hsm.example.com',
            'api_key' => get_option('hsm_api_key')
        ]);
    }
    
    public function encrypt($data) {
        return $this->client->request('encrypt', [
            'data' => base64_encode($data),
            'key_id' => 'wp_master_key'
        ]);
    }
    
    public function decrypt($ciphertext) {
        $response = $this->client->request('decrypt', [
            'ciphertext' => $ciphertext,
            'key_id' => 'wp_master_key'
        ]);
        return base64_decode($response['data']);
    }
}

六、合规性最佳实践

1. GDPR合规加密方案

// 匿名化个人数据
function anonymize_user_data($user_id) {
    $user = get_userdata($user_id);
    
    // 加密存储原始数据
    $encrypted = encrypt_data(serialize([
        'email' => $user->user_email,
        'name' => $user->display_name
    ]));
    
    // 更新为匿名数据
    wp_update_user([
        'ID' => $user_id,
        'user_email' => 'anon_' . wp_generate_password(8, false) . '@example.com',
        'display_name' => 'Anonymous User'
    ]);
    
    // 保存加密副本用于法律合规
    update_user_meta($user_id, 'gdpr_encrypted_data', $encrypted);
}

2. PCI DSS合规的支付处理

// 使用令牌化处理支付信息
function process_payment($payment_data) {
    $tokenization_service = new Payment_Processor();
    
    // 发送到PCI兼容服务
    $token = $tokenization_service->tokenize([
        'card_number' => $payment_data['card_number'],
        'expiry' => $payment_data['expiry'],
        'cvv' => $payment_data['cvv']
    ]);
    
    // 本地只存储令牌
    update_user_meta(
        get_current_user_id(),
        'payment_token',
        $token
    );
    
    return $token;
}