1123 lines
29 KiB
Markdown
1123 lines
29 KiB
Markdown
# 福建水务营收系统安全设计文档
|
||
|
||
## 文档信息
|
||
| 项目信息 | 详情 |
|
||
|---------|------|
|
||
| **项目名称** | 福建水务营收系统 |
|
||
| **文档类型** | 安全设计文档 |
|
||
| **技术框架** | RuoYi-Vue-Pro + OpenGauss |
|
||
| **文档版本** | v1.0 |
|
||
| **编写日期** | 2024-12-19 |
|
||
| **文档状态** | ✅ 已完成 |
|
||
|
||
## 目录
|
||
- [一、安全设计概述](#一安全设计概述)
|
||
- [二、等级保护三级安全设计](#二等级保护三级安全设计)
|
||
- [三、OpenGauss数据库安全](#三opengauss数据库安全)
|
||
- [四、应用系统安全](#四应用系统安全)
|
||
- [五、网络安全设计](#五网络安全设计)
|
||
- [六、数据安全设计](#六数据安全设计)
|
||
- [七、运维安全设计](#七运维安全设计)
|
||
- [八、安全管理制度](#八安全管理制度)
|
||
|
||
## 一、安全设计概述
|
||
|
||
福建水务营收系统安全设计严格按照《网络安全等级保护基本要求》第三级标准，结合水务行业特点和国产化要求，构建全方位、多层次的安全防护体系。
|
||
|
||
### 1.1 安全目标
|
||
- **机密性**：确保敏感数据不被未授权访问
|
||
- **完整性**：防止数据被恶意篡改或损坏
|
||
- **可用性**：保障系统7×24小时稳定运行
|
||
- **可审计性**：完整记录系统操作审计轨迹
|
||
- **合规性**：满足等保三级和行业监管要求
|
||
|
||
### 1.2 安全原则
|
||
- **纵深防御**：多层安全防护，避免单点故障
|
||
- **最小权限**：用户和应用仅具备必要的最小权限
|
||
- **默认安全**：系统默认采用最严格的安全配置
|
||
- **持续监控**：7×24小时安全监控和威胁检测
|
||
- **国产化优先**：优先采用国产安全产品和技术
|
||
|
||
### 1.3 总体安全架构
|
||
|
||
```mermaid
|
||
graph TB
|
||
subgraph "外部威胁"
|
||
THREAT1[网络攻击]
|
||
THREAT2[恶意软件]
|
||
THREAT3[数据泄露]
|
||
THREAT4[内部威胁]
|
||
end
|
||
|
||
subgraph "安全防护层"
|
||
subgraph "边界安全"
|
||
WAF[Web应用防火墙]
|
||
FW[网络防火墙]
|
||
IPS[入侵防护系统]
|
||
VPN[VPN网关]
|
||
end
|
||
|
||
subgraph "应用安全"
|
||
AUTH[身份认证]
|
||
AUTHZ[访问控制]
|
||
AUDIT[操作审计]
|
||
ENCRYPT[数据加密]
|
||
end
|
||
|
||
subgraph "数据安全"
|
||
TDE[透明数据加密]
|
||
RLS[行级安全]
|
||
MASK[数据脱敏]
|
||
BACKUP[安全备份]
|
||
end
|
||
|
||
subgraph "运维安全"
|
||
MONITOR[安全监控]
|
||
LOG[日志分析]
|
||
ALERT[告警响应]
|
||
PATCH[安全更新]
|
||
end
|
||
end
|
||
|
||
subgraph "核心资产"
|
||
APP[水务营收系统]
|
||
DB[OpenGauss数据库]
|
||
FILE[文件存储]
|
||
API[接口服务]
|
||
end
|
||
|
||
THREAT1 --> WAF
|
||
THREAT2 --> FW
|
||
THREAT3 --> IPS
|
||
THREAT4 --> VPN
|
||
|
||
WAF --> AUTH
|
||
FW --> AUTHZ
|
||
IPS --> AUDIT
|
||
VPN --> ENCRYPT
|
||
|
||
AUTH --> TDE
|
||
AUTHZ --> RLS
|
||
AUDIT --> MASK
|
||
ENCRYPT --> BACKUP
|
||
|
||
TDE --> MONITOR
|
||
RLS --> LOG
|
||
MASK --> ALERT
|
||
BACKUP --> PATCH
|
||
|
||
MONITOR --> APP
|
||
LOG --> DB
|
||
ALERT --> FILE
|
||
PATCH --> API
|
||
```
|
||
|
||
## 二、等级保护三级安全设计
|
||
|
||
### 2.1 技术安全要求
|
||
|
||
#### 2.1.1 安全通信网络
|
||
|
||
**网络架构安全**
|
||
```mermaid
|
||
graph TB
|
||
subgraph "安全区域划分"
|
||
DMZ[DMZ区<br/>Web服务器]
|
||
APP_ZONE[应用区<br/>应用服务器]
|
||
DB_ZONE[数据区<br/>数据库服务器]
|
||
MGT_ZONE[管理区<br/>运维管理]
|
||
end
|
||
|
||
subgraph "边界防护"
|
||
INTERNET[互联网]
|
||
FW1[边界防火墙]
|
||
FW2[内部防火墙]
|
||
IDS[入侵检测系统]
|
||
end
|
||
|
||
subgraph "访问控制"
|
||
VPN[VPN接入]
|
||
JUMP[跳板机]
|
||
BASTION[堡垒机]
|
||
end
|
||
|
||
INTERNET --> FW1
|
||
FW1 --> DMZ
|
||
DMZ --> FW2
|
||
FW2 --> APP_ZONE
|
||
APP_ZONE --> DB_ZONE
|
||
|
||
VPN --> JUMP
|
||
JUMP --> BASTION
|
||
BASTION --> MGT_ZONE
|
||
|
||
IDS --> DMZ
|
||
IDS --> APP_ZONE
|
||
```
|
||
|
||
**网络安全措施**
|
||
- 网络边界部署防火墙，实现网络访问控制
|
||
- 重要网络设备和服务器前端部署网络入侵检测设备
|
||
- 网络分段部署，DMZ区、应用区、数据区物理隔离
|
||
- 关键网络设备提供双机热备功能
|
||
- 网络设备登录实现身份标识和鉴别
|
||
|
||
#### 2.1.2 安全区域边界
|
||
|
||
**区域边界防护**
|
||
- 在网络边界部署防火墙设备，设置访问控制策略
|
||
- 在网络边界部署入侵检测设备，监控网络攻击行为
|
||
- 在应用层部署Web应用防火墙，防护Web应用攻击
|
||
- 对进出网络的数据流进行过滤和监控
|
||
- 建立网络访问控制策略，限制不必要的网络连接
|
||
|
||
#### 2.1.3 安全计算环境
|
||
|
||
**身份鉴别**
|
||
```mermaid
|
||
graph LR
|
||
subgraph "多因素认证"
|
||
USER[用户] --> AUTH1[用户名密码]
|
||
AUTH1 --> AUTH2[短信验证码]
|
||
AUTH2 --> AUTH3[邮箱验证]
|
||
AUTH3 --> TOKEN[JWT Token]
|
||
end
|
||
|
||
subgraph "认证集成"
|
||
LDAP[LDAP认证]
|
||
SSO[单点登录]
|
||
OAUTH[OAuth2.0]
|
||
SAML[SAML认证]
|
||
end
|
||
|
||
TOKEN --> LDAP
|
||
TOKEN --> SSO
|
||
TOKEN --> OAUTH
|
||
TOKEN --> SAML
|
||
```
|
||
|
||
**访问控制设计**
|
||
- 实现基于角色的访问控制(RBAC)
|
||
- 支持基于属性的访问控制(ABAC)
|
||
- 实现最小权限原则
|
||
- 支持权限的动态调整和审批流程
|
||
|
||
### 2.2 管理安全要求
|
||
|
||
#### 2.2.1 安全管理中心
|
||
- 建立安全管理中心，统一管理安全策略
|
||
- 配置安全管理员角色，负责安全策略制定
|
||
- 建立安全事件响应机制
|
||
- 定期进行安全评估和风险分析
|
||
|
||
#### 2.2.2 安全管理制度
|
||
- 制定信息安全管理制度和操作规程
|
||
- 建立人员安全管理制度
|
||
- 制定系统建设管理制度
|
||
- 建立系统运维管理制度
|
||
|
||
## 三、OpenGauss数据库安全
|
||
|
||
### 3.1 数据库安全架构
|
||
|
||
```mermaid
|
||
graph TB
|
||
subgraph "OpenGauss安全特性"
|
||
subgraph "身份认证"
|
||
PWD[密码认证]
|
||
CERT[证书认证]
|
||
LDAP_AUTH[LDAP认证]
|
||
KERBEROS[Kerberos认证]
|
||
end
|
||
|
||
subgraph "访问控制"
|
||
RBAC_DB[基于角色的访问控制]
|
||
RLS_DB[行级安全策略]
|
||
CLS_DB[列级访问控制]
|
||
SCHEMA[模式权限控制]
|
||
end
|
||
|
||
subgraph "数据加密"
|
||
TDE_SM4[TDE透明加密<br/>SM4国密算法]
|
||
SSL_SM[SSL传输加密<br/>SM2/SM3/SM4]
|
||
FIELD_ENC[字段级加密]
|
||
BACKUP_ENC[备份加密]
|
||
end
|
||
|
||
subgraph "审计监控"
|
||
AUDIT_LOG[操作审计日志]
|
||
LOGIN_LOG[登录审计]
|
||
DDL_LOG[DDL操作记录]
|
||
SECURITY_LOG[安全事件日志]
|
||
end
|
||
end
|
||
|
||
PWD --> RBAC_DB
|
||
CERT --> RLS_DB
|
||
LDAP_AUTH --> CLS_DB
|
||
KERBEROS --> SCHEMA
|
||
|
||
RBAC_DB --> TDE_SM4
|
||
RLS_DB --> SSL_SM
|
||
CLS_DB --> FIELD_ENC
|
||
SCHEMA --> BACKUP_ENC
|
||
|
||
TDE_SM4 --> AUDIT_LOG
|
||
SSL_SM --> LOGIN_LOG
|
||
FIELD_ENC --> DDL_LOG
|
||
BACKUP_ENC --> SECURITY_LOG
|
||
```
|
||
|
||
### 3.2 国产密码算法应用
|
||
|
||
#### 3.2.1 传输加密
|
||
```sql
|
||
-- 配置国密SSL连接
|
||
ALTER SYSTEM SET ssl = on;
|
||
ALTER SYSTEM SET ssl_ciphers = 'SM4-GCM-SM3:SM4-CCM-SM3';
|
||
ALTER SYSTEM SET ssl_cert_file = 'server-sm2.crt';
|
||
ALTER SYSTEM SET ssl_key_file = 'server-sm2.key';
|
||
```
|
||
|
||
#### 3.2.2 透明数据加密
|
||
```sql
|
||
-- 启用TDE透明数据加密，使用SM4算法
|
||
CREATE KEY ENCRYPTION KEY water_biz_kek
|
||
WITH ALGORITHM = 'SM4-CTR', KEY_STORE = 'localkms';
|
||
|
||
-- 为敏感表启用加密
|
||
CREATE TABLE water_customer (
|
||
id SERIAL PRIMARY KEY,
|
||
customer_name VARCHAR(100) ENCRYPTED WITH (
|
||
COLUMN_ENCRYPTION_KEY = water_biz_kek,
|
||
ENCRYPTION_TYPE = DETERMINISTIC,
|
||
ALGORITHM = 'SM4-CTR'
|
||
),
|
||
id_card VARCHAR(18) ENCRYPTED WITH (
|
||
COLUMN_ENCRYPTION_KEY = water_biz_kek,
|
||
ENCRYPTION_TYPE = RANDOMIZED,
|
||
ALGORITHM = 'SM4-CTR'
|
||
)
|
||
);
|
||
```
|
||
|
||
### 3.3 行级安全策略
|
||
|
||
```sql
|
||
-- 创建多租户行级安全策略
|
||
CREATE ROW LEVEL SECURITY POLICY tenant_isolation_policy
|
||
ON water_customer
|
||
USING (tenant_id = current_setting('app.current_tenant_id')::bigint);
|
||
|
||
-- 启用行级安全
|
||
ALTER TABLE water_customer ENABLE ROW LEVEL SECURITY;
|
||
|
||
-- 创建数据访问角色
|
||
CREATE ROLE water_data_reader;
|
||
CREATE ROLE water_data_writer;
|
||
|
||
-- 配置列级权限
|
||
GRANT SELECT (id, customer_name, phone) ON water_customer TO water_data_reader;
|
||
GRANT ALL ON water_customer TO water_data_writer;
|
||
```
|
||
|
||
### 3.4 数据脱敏策略
|
||
|
||
```sql
|
||
-- 创建数据脱敏函数
|
||
CREATE OR REPLACE FUNCTION mask_phone(phone_num TEXT)
|
||
RETURNS TEXT AS $$
|
||
BEGIN
|
||
RETURN SUBSTRING(phone_num, 1, 3) || '****' || SUBSTRING(phone_num, 8, 4);
|
||
END;
|
||
$$ LANGUAGE plpgsql;
|
||
|
||
-- 创建脱敏视图
|
||
CREATE VIEW water_customer_masked AS
|
||
SELECT
|
||
id,
|
||
customer_name,
|
||
mask_phone(phone) as phone,
|
||
LEFT(id_card, 6) || '********' || RIGHT(id_card, 4) as id_card_masked
|
||
FROM water_customer;
|
||
|
||
-- 授权普通用户只能访问脱敏视图
|
||
GRANT SELECT ON water_customer_masked TO water_normal_user;
|
||
```
|
||
|
||
## 四、应用系统安全
|
||
|
||
### 4.1 Spring Security安全配置
|
||
|
||
#### 4.1.1 认证配置
|
||
```java
|
||
@Configuration
|
||
@EnableWebSecurity
|
||
@EnableMethodSecurity(prePostEnabled = true)
|
||
public class SecurityConfig {
|
||
|
||
@Bean
|
||
public PasswordEncoder passwordEncoder() {
|
||
// 使用国密SM3哈希算法
|
||
return new SM3PasswordEncoder();
|
||
}
|
||
|
||
@Bean
|
||
public JwtAuthenticationTokenFilter jwtAuthenticationTokenFilter() {
|
||
return new JwtAuthenticationTokenFilter();
|
||
}
|
||
|
||
@Bean
|
||
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
|
||
return http
|
||
// CSRF防护
|
||
.csrf(csrf -> csrf.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()))
|
||
// 请求授权
|
||
.authorizeHttpRequests(auth -> auth
|
||
.requestMatchers("/api/login", "/api/register").permitAll()
|
||
.requestMatchers("/api/admin/**").hasRole("ADMIN")
|
||
.anyRequest().authenticated()
|
||
)
|
||
// JWT过滤器
|
||
.addFilterBefore(jwtAuthenticationTokenFilter(), UsernamePasswordAuthenticationFilter.class)
|
||
// 会话管理
|
||
.sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
|
||
.build();
|
||
}
|
||
}
|
||
```
|
||
|
||
#### 4.1.2 多因素认证
|
||
```java
|
||
@Service
|
||
public class MFAService {
|
||
|
||
@Autowired
|
||
private SmsService smsService;
|
||
|
||
@Autowired
|
||
private RedisTemplate<String, String> redisTemplate;
|
||
|
||
public boolean sendSmsCode(String phone) {
|
||
String code = generateRandomCode();
|
||
String key = "mfa:sms:" + phone;
|
||
|
||
// 存储验证码，5分钟过期
|
||
redisTemplate.opsForValue().set(key, code, Duration.ofMinutes(5));
|
||
|
||
// 发送短信
|
||
return smsService.send(phone, "您的验证码是：" + code + "，5分钟内有效。");
|
||
}
|
||
|
||
public boolean verifySmsCode(String phone, String code) {
|
||
String key = "mfa:sms:" + phone;
|
||
String storedCode = redisTemplate.opsForValue().get(key);
|
||
|
||
if (storedCode != null && storedCode.equals(code)) {
|
||
redisTemplate.delete(key);
|
||
return true;
|
||
}
|
||
return false;
|
||
}
|
||
}
|
||
```
|
||
|
||
### 4.2 数据传输安全
|
||
|
||
#### 4.2.1 HTTPS配置
|
||
```yaml
|
||
server:
|
||
port: 8443
|
||
ssl:
|
||
enabled: true
|
||
key-store: classpath:keystore/server.p12
|
||
key-store-password: ${SSL_KEYSTORE_PASSWORD}
|
||
key-store-type: PKCS12
|
||
# 支持国密算法
|
||
ciphers: SM4-GCM-SM3,SM4-CCM-SM3,ECDHE-SM2-WITH-SM4-SM3
|
||
protocols: TLSv1.2,TLSv1.3
|
||
```
|
||
|
||
#### 4.2.2 敏感数据加密
|
||
```java
|
||
@Component
|
||
public class DataEncryptionService {
|
||
|
||
private final SM4Cipher sm4Cipher = new SM4Cipher();
|
||
|
||
public String encryptSensitiveData(String plaintext) {
|
||
try {
|
||
return sm4Cipher.encrypt(plaintext);
|
||
} catch (Exception e) {
|
||
throw new SecurityException("数据加密失败", e);
|
||
}
|
||
}
|
||
|
||
public String decryptSensitiveData(String ciphertext) {
|
||
try {
|
||
return sm4Cipher.decrypt(ciphertext);
|
||
} catch (Exception e) {
|
||
throw new SecurityException("数据解密失败", e);
|
||
}
|
||
}
|
||
}
|
||
```
|
||
|
||
### 4.3 接口安全防护
|
||
|
||
#### 4.3.1 接口签名验证
|
||
```java
|
||
@Component
|
||
public class ApiSignatureValidator {
|
||
|
||
public boolean validateSignature(HttpServletRequest request) {
|
||
String timestamp = request.getHeader("X-Timestamp");
|
||
String nonce = request.getHeader("X-Nonce");
|
||
String signature = request.getHeader("X-Signature");
|
||
String body = getRequestBody(request);
|
||
|
||
// 检查时间戳，防止重放攻击
|
||
if (isTimestampExpired(timestamp)) {
|
||
return false;
|
||
}
|
||
|
||
// 生成签名
|
||
String expectedSignature = generateSignature(timestamp, nonce, body);
|
||
|
||
// 验证签名
|
||
return signature.equals(expectedSignature);
|
||
}
|
||
|
||
private String generateSignature(String timestamp, String nonce, String body) {
|
||
String message = timestamp + nonce + body;
|
||
return SM3Utils.hash(message);
|
||
}
|
||
}
|
||
```
|
||
|
||
#### 4.3.2 接口限流防护
|
||
```java
|
||
@Component
|
||
public class RateLimitService {
|
||
|
||
@Autowired
|
||
private RedisTemplate<String, String> redisTemplate;
|
||
|
||
public boolean isAllowed(String key, int limit, Duration window) {
|
||
String redisKey = "rate_limit:" + key;
|
||
String current = redisTemplate.opsForValue().get(redisKey);
|
||
|
||
if (current == null) {
|
||
redisTemplate.opsForValue().set(redisKey, "1", window);
|
||
return true;
|
||
}
|
||
|
||
int count = Integer.parseInt(current);
|
||
if (count < limit) {
|
||
redisTemplate.opsForValue().increment(redisKey);
|
||
return true;
|
||
}
|
||
|
||
return false;
|
||
}
|
||
}
|
||
```
|
||
|
||
## 五、网络安全设计
|
||
|
||
### 5.1 网络拓扑安全
|
||
|
||
```mermaid
|
||
graph TB
|
||
subgraph "外网区域"
|
||
INTERNET[互联网]
|
||
CDN[CDN加速]
|
||
DNS[DNS服务]
|
||
end
|
||
|
||
subgraph "边界防护"
|
||
WAF[Web应用防火墙<br/>国产WAF产品]
|
||
FW_BORDER[边界防火墙<br/>安全审计]
|
||
IPS[入侵防护系统<br/>威胁检测]
|
||
DPI[深度包检测<br/>流量分析]
|
||
end
|
||
|
||
subgraph "DMZ区域"
|
||
LB[负载均衡器<br/>SSL卸载]
|
||
WEB1[Web服务器1]
|
||
WEB2[Web服务器2]
|
||
PROXY[反向代理]
|
||
end
|
||
|
||
subgraph "内网安全"
|
||
FW_INTERNAL[内部防火墙]
|
||
VLAN_APP[应用VLAN]
|
||
VLAN_DB[数据库VLAN]
|
||
VLAN_MGT[管理VLAN]
|
||
end
|
||
|
||
subgraph "应用层"
|
||
APP1[应用服务器1]
|
||
APP2[应用服务器2]
|
||
APP3[应用服务器3]
|
||
end
|
||
|
||
subgraph "数据层"
|
||
DB_MASTER[OpenGauss主库]
|
||
DB_SLAVE[OpenGauss从库]
|
||
REDIS[Redis集群]
|
||
end
|
||
|
||
subgraph "管理层"
|
||
JUMP[跳板机]
|
||
MONITOR[监控服务器]
|
||
LOG[日志服务器]
|
||
end
|
||
|
||
INTERNET --> CDN
|
||
CDN --> DNS
|
||
DNS --> WAF
|
||
WAF --> FW_BORDER
|
||
FW_BORDER --> IPS
|
||
IPS --> DPI
|
||
DPI --> LB
|
||
|
||
LB --> WEB1
|
||
LB --> WEB2
|
||
WEB1 --> PROXY
|
||
WEB2 --> PROXY
|
||
|
||
PROXY --> FW_INTERNAL
|
||
FW_INTERNAL --> VLAN_APP
|
||
FW_INTERNAL --> VLAN_DB
|
||
FW_INTERNAL --> VLAN_MGT
|
||
|
||
VLAN_APP --> APP1
|
||
VLAN_APP --> APP2
|
||
VLAN_APP --> APP3
|
||
|
||
VLAN_DB --> DB_MASTER
|
||
VLAN_DB --> DB_SLAVE
|
||
VLAN_DB --> REDIS
|
||
|
||
VLAN_MGT --> JUMP
|
||
VLAN_MGT --> MONITOR
|
||
VLAN_MGT --> LOG
|
||
```
|
||
|
||
### 5.2 防火墙策略配置
|
||
|
||
#### 5.2.1 边界防火墙策略
|
||
```bash
|
||
# 允许HTTPS访问
|
||
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
|
||
|
||
# 允许HTTP重定向到HTTPS
|
||
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
|
||
|
||
# 禁止直接数据库访问
|
||
iptables -A INPUT -p tcp --dport 5432 -s ! 192.168.1.0/24 -j DROP
|
||
|
||
# 允许内网SSH管理
|
||
iptables -A INPUT -p tcp --dport 22 -s 192.168.100.0/24 -j ACCEPT
|
||
|
||
# 拒绝其他所有入站连接
|
||
iptables -A INPUT -j DROP
|
||
```
|
||
|
||
#### 5.2.2 应用层防火墙策略
|
||
```bash
|
||
# 只允许来自DMZ区的连接
|
||
iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT
|
||
|
||
# 允许访问数据库
|
||
iptables -A OUTPUT -d 192.168.2.0/24 -p tcp --dport 5432 -j ACCEPT
|
||
|
||
# 允许访问Redis
|
||
iptables -A OUTPUT -d 192.168.2.0/24 -p tcp --dport 6379 -j ACCEPT
|
||
|
||
# 允许DNS查询
|
||
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
|
||
|
||
# 拒绝其他出站连接
|
||
iptables -A OUTPUT -j DROP
|
||
```
|
||
|
||
### 5.3 入侵检测与防护
|
||
|
||
#### 5.3.1 IDS/IPS规则配置
|
||
```bash
|
||
# Suricata规则示例
|
||
alert tcp any any -> $HOME_NET 443 (msg:"Suspicious HTTPS traffic"; \
|
||
content:"POST"; http_method; content:"/api/admin"; http_uri; \
|
||
threshold:type limit, track by_src, count 10, seconds 60; \
|
||
sid:10001; rev:1;)
|
||
|
||
alert tcp any any -> $HOME_NET 5432 (msg:"Direct database access attempt"; \
|
||
content:"SELECT"; content:"FROM"; distance:0; \
|
||
sid:10002; rev:1;)
|
||
|
||
alert tcp any any -> $HOME_NET any (msg:"Brute force attack detected"; \
|
||
flags:S; threshold:type threshold, track by_src, count 100, seconds 60; \
|
||
sid:10003; rev:1;)
|
||
```
|
||
|
||
## 六、数据安全设计
|
||
|
||
### 6.1 数据分类分级
|
||
|
||
#### 6.1.1 数据分类标准
|
||
```mermaid
|
||
graph TB
|
||
subgraph "数据分类"
|
||
TOP_SECRET[绝密级<br/>核心商业机密]
|
||
SECRET[机密级<br/>重要业务数据]
|
||
INTERNAL[内部级<br/>一般业务数据]
|
||
PUBLIC[公开级<br/>公开业务数据]
|
||
end
|
||
|
||
subgraph "水务业务数据"
|
||
CUSTOMER[客户身份信息<br/>机密级]
|
||
METER[水表计量数据<br/>内部级]
|
||
BILLING[收费账务数据<br/>机密级]
|
||
REPORT[统计报表数据<br/>内部级]
|
||
CONFIG[系统配置数据<br/>内部级]
|
||
LOG[日志审计数据<br/>内部级]
|
||
end
|
||
|
||
subgraph "保护措施"
|
||
ENC_HIGH[强加密<br/>SM4+数字签名]
|
||
ENC_MID[加密存储<br/>SM4算法]
|
||
ENC_LOW[访问控制<br/>权限管理]
|
||
ENC_NONE[公开访问<br/>无特殊保护]
|
||
end
|
||
|
||
TOP_SECRET --> ENC_HIGH
|
||
SECRET --> ENC_MID
|
||
INTERNAL --> ENC_LOW
|
||
PUBLIC --> ENC_NONE
|
||
|
||
CUSTOMER --> SECRET
|
||
BILLING --> SECRET
|
||
METER --> INTERNAL
|
||
REPORT --> INTERNAL
|
||
CONFIG --> INTERNAL
|
||
LOG --> INTERNAL
|
||
```
|
||
|
||
#### 6.1.2 数据保护策略
|
||
```sql
|
||
-- 客户敏感信息表(机密级)
|
||
CREATE TABLE water_customer_sensitive (
|
||
id SERIAL PRIMARY KEY,
|
||
customer_id BIGINT NOT NULL,
|
||
-- 身份证号：强加密存储
|
||
id_card_encrypted VARCHAR(200) ENCRYPTED WITH (
|
||
COLUMN_ENCRYPTION_KEY = customer_sensitive_key,
|
||
ENCRYPTION_TYPE = RANDOMIZED,
|
||
ALGORITHM = 'SM4-CTR'
|
||
),
|
||
-- 银行卡号：强加密存储
|
||
bank_account_encrypted VARCHAR(200) ENCRYPTED WITH (
|
||
COLUMN_ENCRYPTION_KEY = customer_sensitive_key,
|
||
ENCRYPTION_TYPE = RANDOMIZED,
|
||
ALGORITHM = 'SM4-CTR'
|
||
),
|
||
-- 手机号：确定性加密，支持查询
|
||
phone_encrypted VARCHAR(200) ENCRYPTED WITH (
|
||
COLUMN_ENCRYPTION_KEY = customer_sensitive_key,
|
||
ENCRYPTION_TYPE = DETERMINISTIC,
|
||
ALGORITHM = 'SM4-CTR'
|
||
),
|
||
created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
|
||
updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
|
||
);
|
||
|
||
-- 创建行级安全策略
|
||
CREATE POLICY customer_sensitive_policy ON water_customer_sensitive
|
||
FOR ALL TO water_customer_service_role
|
||
USING (
|
||
customer_id IN (
|
||
SELECT customer_id FROM water_customer
|
||
WHERE tenant_id = current_setting('app.current_tenant_id')::bigint
|
||
)
|
||
);
|
||
```
|
||
|
||
### 6.2 数据备份与恢复安全
|
||
|
||
#### 6.2.1 备份加密策略
|
||
```bash
|
||
#!/bin/bash
|
||
# OpenGauss安全备份脚本
|
||
|
||
# 设置备份参数
|
||
BACKUP_DIR="/backup/opengauss"
|
||
DATE=$(date +%Y%m%d_%H%M%S)
|
||
BACKUP_FILE="water_biz_backup_${DATE}.tar.gz"
|
||
ENCRYPT_KEY="/etc/opengauss/backup_key.key"
|
||
|
||
# 创建加密备份
|
||
gs_backup -D $GAUSSDATA -U gaussdb \
|
||
--encrypt --encrypt-key-file=$ENCRYPT_KEY \
|
||
--backup-format=tar \
|
||
--backup-path=$BACKUP_DIR/$BACKUP_FILE
|
||
|
||
# 验证备份完整性
|
||
openssl dgst -sm3 $BACKUP_DIR/$BACKUP_FILE > $BACKUP_DIR/$BACKUP_FILE.sm3
|
||
|
||
# 安全传输到异地备份中心
|
||
rsync -avz --delete $BACKUP_DIR/ backup-server:/backup/remote/
|
||
```
|
||
|
||
#### 6.2.2 数据恢复流程
|
||
```sql
|
||
-- 恢复前验证备份完整性
|
||
-- 1. 验证SM3摘要
|
||
-- 2. 解密备份文件
|
||
-- 3. 验证数据库结构
|
||
-- 4. 执行恢复操作
|
||
|
||
-- 创建恢复测试环境
|
||
CREATE DATABASE water_biz_recovery_test;
|
||
|
||
-- 恢复数据到测试环境
|
||
\c water_biz_recovery_test;
|
||
-- 执行恢复SQL脚本
|
||
\i /backup/water_biz_recovery.sql;
|
||
|
||
-- 验证数据完整性
|
||
SELECT COUNT(*) FROM water_customer;
|
||
SELECT COUNT(*) FROM water_meter_reading;
|
||
SELECT COUNT(*) FROM water_billing;
|
||
|
||
-- 验证加密数据
|
||
SELECT id,
|
||
pgp_sym_decrypt(id_card_encrypted, 'encryption_key') as id_card
|
||
FROM water_customer_sensitive LIMIT 1;
|
||
```
|
||
|
||
### 6.3 数据销毁与清理
|
||
|
||
#### 6.3.1 安全数据销毁
|
||
```sql
|
||
-- 创建安全数据销毁函数
|
||
CREATE OR REPLACE FUNCTION secure_data_destroy(table_name TEXT, where_clause TEXT)
|
||
RETURNS BOOLEAN AS $$
|
||
DECLARE
|
||
sql_cmd TEXT;
|
||
affected_rows INTEGER;
|
||
BEGIN
|
||
-- 构建删除SQL
|
||
sql_cmd := 'DELETE FROM ' || table_name || ' WHERE ' || where_clause;
|
||
|
||
-- 执行删除
|
||
EXECUTE sql_cmd;
|
||
GET DIAGNOSTICS affected_rows = ROW_COUNT;
|
||
|
||
-- 记录审计日志
|
||
INSERT INTO data_destroy_audit (
|
||
table_name, where_clause, affected_rows,
|
||
operator, operation_time
|
||
) VALUES (
|
||
table_name, where_clause, affected_rows,
|
||
current_user, current_timestamp
|
||
);
|
||
|
||
-- 执行VACUUM清理物理空间
|
||
EXECUTE 'VACUUM FULL ' || table_name;
|
||
|
||
RETURN TRUE;
|
||
EXCEPTION
|
||
WHEN OTHERS THEN
|
||
RAISE EXCEPTION '数据销毁失败: %', SQLERRM;
|
||
RETURN FALSE;
|
||
END;
|
||
$$ LANGUAGE plpgsql;
|
||
|
||
-- 示例：销毁3年前的历史数据
|
||
SELECT secure_data_destroy(
|
||
'water_meter_reading_history',
|
||
'reading_date < CURRENT_DATE - INTERVAL ''3 years'''
|
||
);
|
||
```
|
||
|
||
## 七、运维安全设计
|
||
|
||
### 7.1 安全监控体系
|
||
|
||
#### 7.1.1 安全监控架构
|
||
```mermaid
|
||
graph TB
|
||
subgraph "数据采集层"
|
||
AGENT1[系统日志采集]
|
||
AGENT2[应用日志采集]
|
||
AGENT3[数据库日志采集]
|
||
AGENT4[网络流量采集]
|
||
end
|
||
|
||
subgraph "数据处理层"
|
||
KAFKA[消息队列<br/>Kafka集群]
|
||
STREAM[流处理<br/>Flink/Storm]
|
||
ETL[数据清洗<br/>Logstash]
|
||
end
|
||
|
||
subgraph "存储分析层"
|
||
ES[Elasticsearch<br/>日志存储]
|
||
SIEM[安全信息事件管理<br/>SIEM平台]
|
||
AI[智能分析<br/>机器学习]
|
||
end
|
||
|
||
subgraph "可视化层"
|
||
DASHBOARD[监控仪表盘<br/>Grafana]
|
||
ALERT[告警系统<br/>AlertManager]
|
||
REPORT[安全报告<br/>自动生成]
|
||
end
|
||
|
||
AGENT1 --> KAFKA
|
||
AGENT2 --> KAFKA
|
||
AGENT3 --> KAFKA
|
||
AGENT4 --> KAFKA
|
||
|
||
KAFKA --> STREAM
|
||
STREAM --> ETL
|
||
ETL --> ES
|
||
|
||
ES --> SIEM
|
||
SIEM --> AI
|
||
AI --> DASHBOARD
|
||
|
||
DASHBOARD --> ALERT
|
||
ALERT --> REPORT
|
||
```
|
||
|
||
#### 7.1.2 安全事件检测规则
|
||
```yaml
|
||
# 安全事件检测规则配置
|
||
security_rules:
|
||
- name: "暴力破解检测"
|
||
type: "authentication"
|
||
condition: "failed_login_count > 5 in 5 minutes"
|
||
severity: "high"
|
||
action: ["block_ip", "send_alert"]
|
||
|
||
- name: "异常数据访问"
|
||
type: "data_access"
|
||
condition: "query_count > 1000 in 1 minute"
|
||
severity: "medium"
|
||
action: ["rate_limit", "send_alert"]
|
||
|
||
- name: "权限提升检测"
|
||
type: "privilege_escalation"
|
||
condition: "role_change to admin"
|
||
severity: "critical"
|
||
action: ["block_user", "send_alert", "create_incident"]
|
||
|
||
- name: "异常时间访问"
|
||
type: "abnormal_access"
|
||
condition: "access_time between 22:00 and 06:00"
|
||
severity: "medium"
|
||
action: ["log_event", "send_alert"]
|
||
```
|
||
|
||
### 7.2 漏洞管理
|
||
|
||
#### 7.2.1 漏洞扫描策略
|
||
```bash
|
||
#!/bin/bash
|
||
# 系统漏洞扫描脚本
|
||
|
||
# 扫描操作系统漏洞
|
||
nmap -sV --script vulners localhost
|
||
|
||
# 扫描Web应用漏洞
|
||
nikto -h https://water.example.com -ssl
|
||
|
||
# 扫描数据库漏洞
|
||
nmap -p 5432 --script pgsql-brute,pgsql-databases localhost
|
||
|
||
# 生成漏洞报告
|
||
cat > vulnerability_report.html << EOF
|
||
<!DOCTYPE html>
|
||
<html>
|
||
<head>
|
||
<title>安全漏洞扫描报告</title>
|
||
</head>
|
||
<body>
|
||
<h1>福建水务营收系统漏洞扫描报告</h1>
|
||
<p>扫描时间：$(date)</p>
|
||
<h2>高危漏洞</h2>
|
||
<pre>$(grep -i "high\|critical" scan_results.txt)</pre>
|
||
<h2>中危漏洞</h2>
|
||
<pre>$(grep -i "medium" scan_results.txt)</pre>
|
||
</body>
|
||
</html>
|
||
EOF
|
||
```
|
||
|
||
#### 7.2.2 补丁管理流程
|
||
```mermaid
|
||
graph LR
|
||
DISCOVER[漏洞发现] --> ASSESS[风险评估]
|
||
ASSESS --> PLAN[补丁计划]
|
||
PLAN --> TEST[测试验证]
|
||
TEST --> DEPLOY[生产部署]
|
||
DEPLOY --> VERIFY[部署验证]
|
||
VERIFY --> DOCUMENT[文档记录]
|
||
|
||
subgraph "评估标准"
|
||
HIGH[高危<br/>24小时内]
|
||
MEDIUM[中危<br/>7天内]
|
||
LOW[低危<br/>30天内]
|
||
end
|
||
|
||
ASSESS --> HIGH
|
||
ASSESS --> MEDIUM
|
||
ASSESS --> LOW
|
||
```
|
||
|
||
### 7.3 应急响应预案
|
||
|
||
#### 7.3.1 安全事件分级
|
||
| 级别 | 描述 | 响应时间 | 处理措施 |
|
||
|------|------|----------|----------|
|
||
| P0 | 系统完全不可用，数据泄露 | 15分钟 | 立即启动应急预案，通知管理层 |
|
||
| P1 | 核心功能受影响，安全风险高 | 30分钟 | 启动应急预案，组建应急小组 |
|
||
| P2 | 部分功能受影响，安全风险中等 | 2小时 | 安排专人处理，定期汇报 |
|
||
| P3 | 轻微影响，安全风险较低 | 8小时 | 正常工作时间处理 |
|
||
|
||
#### 7.3.2 应急响应流程
|
||
```mermaid
|
||
graph TB
|
||
INCIDENT[安全事件发生] --> DETECT[事件检测]
|
||
DETECT --> REPORT[事件上报]
|
||
REPORT --> ASSESS[影响评估]
|
||
ASSESS --> RESPONSE[应急响应]
|
||
|
||
subgraph "应急响应措施"
|
||
ISOLATE[系统隔离]
|
||
PRESERVE[证据保全]
|
||
RECOVER[系统恢复]
|
||
INVESTIGATE[调查分析]
|
||
end
|
||
|
||
subgraph "后续处理"
|
||
LESSON[经验总结]
|
||
IMPROVE[流程改进]
|
||
TRAIN[培训加强]
|
||
DOC[文档更新]
|
||
end
|
||
|
||
RESPONSE --> ISOLATE
|
||
RESPONSE --> PRESERVE
|
||
RESPONSE --> RECOVER
|
||
RESPONSE --> INVESTIGATE
|
||
|
||
INVESTIGATE --> LESSON
|
||
LESSON --> IMPROVE
|
||
IMPROVE --> TRAIN
|
||
TRAIN --> DOC
|
||
```
|
||
|
||
## 八、安全管理制度
|
||
|
||
### 8.1 安全组织架构
|
||
|
||
#### 8.1.1 安全管理组织
|
||
```mermaid
|
||
graph TB
|
||
CEO[总经理<br/>安全最高责任人]
|
||
CISO[信息安全负责人<br/>CISO]
|
||
|
||
subgraph "安全管理委员会"
|
||
IT_DIR[IT总监]
|
||
SECURITY_DIR[安全总监]
|
||
COMPLIANCE[合规负责人]
|
||
LEGAL[法务负责人]
|
||
end
|
||
|
||
subgraph "安全执行团队"
|
||
SEC_ADMIN[安全管理员]
|
||
SYS_ADMIN[系统管理员]
|
||
DBA[数据库管理员]
|
||
NET_ADMIN[网络管理员]
|
||
end
|
||
|
||
subgraph "业务安全责任人"
|
||
BUS_OWNER[业务负责人]
|
||
DATA_OWNER[数据负责人]
|
||
USER_ADMIN[用户管理员]
|
||
end
|
||
|
||
CEO --> CISO
|
||
CISO --> IT_DIR
|
||
CISO --> SECURITY_DIR
|
||
CISO --> COMPLIANCE
|
||
CISO --> LEGAL
|
||
|
||
IT_DIR --> SEC_ADMIN
|
||
IT_DIR --> SYS_ADMIN
|
||
IT_DIR --> DBA
|
||
IT_DIR --> NET_ADMIN
|
||
|
||
SECURITY_DIR --> BUS_OWNER
|
||
SECURITY_DIR --> DATA_OWNER
|
||
SECURITY_DIR --> USER_ADMIN
|
||
```
|
||
|
||
### 8.2 安全管理制度
|
||
|
||
#### 8.2.1 人员安全管理
|
||
- **入职安全审查**：对关键岗位人员进行背景调查
|
||
- **安全培训**：定期进行信息安全意识培训
|
||
- **权限管理**：建立权限申请、审批、回收流程
|
||
- **离职管理**：离职人员权限及时回收，签署保密协议
|
||
|
||
#### 8.2.2 系统建设安全管理
|
||
- **安全需求分析**：项目立项阶段进行安全需求分析
|
||
- **安全设计评审**：设计阶段进行安全架构评审
|
||
- **安全测试**：上线前进行安全渗透测试
|
||
- **安全验收**：系统上线前进行安全验收
|
||
|
||
#### 8.2.3 系统运维安全管理
|
||
- **变更管理**：所有系统变更都需要安全评估
|
||
- **备份管理**：定期备份，异地存储，加密保护
|
||
- **监控管理**：7×24小时安全监控
|
||
- **应急管理**：建立应急响应机制
|
||
|
||
### 8.3 合规管理
|
||
|
||
#### 8.3.1 法律法规合规
|
||
- 《中华人民共和国网络安全法》
|
||
- 《中华人民共和国数据安全法》
|
||
- 《中华人民共和国个人信息保护法》
|
||
- 《关键信息基础设施安全保护条例》
|
||
|
||
#### 8.3.2 行业标准合规
|
||
- GB/T 22239-2019《信息安全技术 网络安全等级保护基本要求》
|
||
- GB/T 25070-2019《信息安全技术 网络安全等级保护安全设计技术要求》
|
||
- GB/T 32918《信息安全技术 SM2椭圆曲线公钥密码算法》
|
||
- GB/T 32905《信息安全技术 SM3密码杂凑算法》
|
||
|
||
#### 8.3.3 合规检查清单
|
||
- [ ] 等级保护三级备案完成
|
||
- [ ] 年度安全评估报告
|
||
- [ ] 安全管理制度建立
|
||
- [ ] 安全技术措施落实
|
||
- [ ] 安全培训记录完整
|
||
- [ ] 应急预案演练记录
|
||
- [ ] 安全事件处置记录
|
||
- [ ] 第三方安全服务合同
|
||
|
||
---
|
||
|
||
## 总结
|
||
|
||
福建水务营收系统安全设计严格按照等级保护三级要求，结合OpenGauss数据库的安全特性，建立了全方位、多层次的安全防护体系。通过技术防护、管理制度、人员培训等多重措施，确保系统安全稳定运行，满足水务行业的安全合规要求。
|
||
|
||
本安全设计方案的核心特点：
|
||
1. **国产化安全**：采用OpenGauss数据库和国密算法
|
||
2. **纵深防御**：网络、应用、数据多层安全防护
|
||
3. **合规导向**：严格按照等保三级标准设计
|
||
4. **持续改进**：建立安全监控和应急响应机制
|
||
5. **管理规范**：完善的安全管理制度和流程 |