鸿蒙多功能工具箱开发实战(二十七)-安全加固与数据保护前言安全是应用开发的重要考量。本文将讲解HarmonyOS应用的安全加固和数据保护措施。一、敏感数据保护1.1 数据加密importcryptoFrameworkfromohos.security.cryptoFrameworkexportclassCryptoUtil{/** * AES加密 */staticasyncaesEncrypt(plainText:string,key:string):Promisestring{try{// 创建加密器constciphercryptoFramework.createCipher(AES256|CBC|PKCS7)// 生成密钥constsymKeyawaitthis.generateAesKey(key)// 加密constinput{data:newUint8Array(Buffer.from(plainText).buffer)}awaitcipher.init(cryptoFramework.CryptoMode.ENCRYPT_MODE,symKey,null)constoutputawaitcipher.doFinal(input)// 转Base64returnthis.uint8ArrayToBase64(output.data)}catch(e){console.error(AES encrypt failed:,e)throwe}}/** * AES解密 */staticasyncaesDecrypt(cipherText:string,key:string):Promisestring{try{constciphercryptoFramework.createCipher(AES256|CBC|PKCS7)constsymKeyawaitthis.generateAesKey(key)// Base64转Uint8Arrayconstinput{data:this.base64ToUint8Array(cipherText)}awaitcipher.init(cryptoFramework.CryptoMode.DECRYPT_MODE,symKey,null)constoutputawaitcipher.doFinal(input)returnBuffer.from(output.data).toString()}catch(e){console.error(AES decrypt failed:,e)throwe}}privatestaticasyncgenerateAesKey(key:string):PromisecryptoFramework.SymKey{constkeyBlob:cryptoFramework.DataBlob{data:newUint8Array(Buffer.from(key.padEnd(32,0).slice(0,32)).buffer)}constgeneratorcryptoFramework.createSymKeyGenerator(AES256)returnawaitgenerator.convertKey(keyBlob)}privatestaticuint8ArrayToBase64(data:Uint8Array):string{returnBuffer.from(data).toString(base64)}privatestaticbase64ToUint8Array(base64:string):Uint8Array{returnnewUint8Array(Buffer.from(base64,base64).buffer)}}1.2 密码哈希exportclassPasswordUtil{/** * 生成密码哈希 */staticasynchash(password:string,salt?:string):Promise{hash:string,salt:string}{// 生成盐值constsaltValuesalt||this.generateSalt()// SHA256哈希constmdcryptoFramework.createMd(SHA256)awaitmd.update({data:newUint8Array(Buffer.from(passwordsaltValue).buffer)})constresultawaitmd.digest()return{hash:Buffer.from(result.data).toString(hex),salt:saltValue}}/** * 验证密码 */staticasyncverify(password:string,hash:string,salt:string):Promiseboolean{constresultawaitthis.hash(password,salt)returnresult.hashhash}privatestaticgenerateSalt():string{constrandomnewUint8Array(16)for(leti0;i16;i){random[i]Math.floor(Math.random()*256)}returnBuffer.from(random).toString(hex)}}二、安全存储2.1 安全偏好设置exportclassSecurePreferences{privatestaticinstance:SecurePreferencesprivatepreferences:PreferencesprivateencryptionKey:stringprivateconstructor(){}staticasyncgetInstance():PromiseSecurePreferences{if(!SecurePreferences.instance){constinstancenewSecurePreferences()instance.preferencesawaitpreferences.getPreferences(globalThis.context,secure_prefs)instance.encryptionKeyawaitinstance.getOrCreateKey()SecurePreferences.instanceinstance}returnSecurePreferences.instance}/** * 安全存储数据 */asyncputSecure(key:string,value:string):Promisevoid{constencryptedawaitCryptoUtil.aesEncrypt(value,this.encryptionKey)awaitthis.preferences.put(key,encrypted)awaitthis.preferences.flush()}/** * 安全读取数据 */asyncgetSecure(key:string):Promisestring|null{constencryptedawaitthis.preferences.get(key,)asstringif(!encrypted)returnnulltry{returnawaitCryptoUtil.aesDecrypt(encrypted,this.encryptionKey)}catch(e){console.error(Decrypt failed:,e)returnnull}}privateasyncgetOrCreateKey():Promisestring{letkeyawaitthis.preferences.get(master_key,)asstringif(!key){keyPasswordUtil.generateSalt()awaitthis.preferences.put(master_key,key)awaitthis.preferences.flush()}returnkey}}三、网络安全3.1 HTTPS证书校验importhttpfromohos.net.httpexportclassSecureHttpClient{privatehttpClient:http.HttpClientconstructor(){this.httpClienthttp.createHttp()}/** * 安全HTTP请求 */asyncsecureRequest(url:string,options:http.HttpRequestOptions):Promisehttp.HttpResponse{// 强制HTTPSif(!url.startsWith(https://)){thrownewError(Only HTTPS is allowed)}returnnewPromise((resolve,reject){this.httpClient.request(url,{...options,// 证书校验header:{...options.header,X-Content-Type-Options:nosniff,X-Frame-Options:DENY}},(err,data){if(err){reject(err)}else{resolve(data)}})})}}3.2 请求签名exportclassRequestSigner{privatestaticsecretKeyyour-secret-key/** * 生成请求签名 */staticsign(params:Recordstring,any):string{// 排序参数constsortedKeysObject.keys(params).sort()constsignStrsortedKeys.map(k${k}${params[k]}).join()// HMAC-SHA256签名constmaccryptoFramework.createMac(HMACSHA256)// ... 签名实现returnsignStr}/** * 验证签名 */staticverify(params:Recordstring,any,signature:string):boolean{constexpectedSignthis.sign(params)returnexpectedSignsignature}}四、权限控制4.1 敏感操作保护exportclassAuthGuard{privatestaticlastAuthTime:number0privatestaticauthTimeout:number5*60*1000// 5分钟/** * 检查是否需要认证 */staticneedAuth():boolean{constnowDate.now()returnnow-this.lastAuthTimethis.authTimeout}/** * 执行敏感操作 */staticasyncexecuteWithAuthT(operation:()PromiseT,authPrompt:()Promiseboolean):PromiseT|null{if(this.needAuth()){constauthenticatedawaitauthPrompt()if(!authenticated){returnnull}this.lastAuthTimeDate.now()}returnawaitoperation()}}五、高级安全功能5.1 安全流程图是否用户数据是否敏感?加密存储普通存储安全区域常规存储5.2 安全区域存储importsecurityfromohos.securityclassSecureStorage{staticasyncsave(key:string,value:string){// 使用安全区域存储敏感数据awaitsecurity.setSecureData({alias:key,data:value})}staticasyncget(key:string):Promisestring{constresultawaitsecurity.getSecureData({alias:key})returnresult.data}}5.3 输入验证classInputValidator{staticvalidateEmail(email:string):boolean{return/^[^\s][^\s]\.[^\s]$/.test(email)}staticvalidatePhone(phone:string):boolean{return/^1[3-9]\d{9}$/.test(phone)}staticsanitize(input:string):string{// 防止XSS攻击returninput.replace(/[]/g,)}}图 1 本地存储六、小结本文详细讲解了安全加固✅ 数据加密✅ 密码哈希✅ 安全存储✅ 网络安全✅ 权限控制✅ 安全区域存储✅ 输入验证系列文章导航下期预告鸿蒙多功能工具箱开发实战(二十八)-应用更新与版本管理