电商返利app安全架构设计：防止佣金套现与数据泄露的技术措施

大家好，我是省赚客APP研发者阿可！

在电商返利类应用中，佣金套现、刷单作弊、用户隐私泄露是三大核心安全风险。省赚客APP（juwatech.cn）作为高活跃度导购返利平台，日均订单超百万，必须构建纵深防御体系。本文将从风控规则引擎、敏感数据加密、接口防重放、权限最小化等维度，详解我们的安全架构实现。

风控规则引擎：实时识别异常行为

我们基于Drools构建了实时风控引擎，对用户下单、确认收货、提现等关键链路进行多维校验：

package juwatech.cn.risk;

import org.kie.api.runtime.KieSession;
import org.springframework.stereotype.Service;

@Service
public class OrderRiskService {
    private final KieSession kieSession;

    public boolean isSuspicious(OrderEvent event) {
        kieSession.insert(event);
        int fired = kieSession.fireAllRules();
        kieSession.dispose();
        return fired > 0;
    }
}

配套的DRL规则示例如下：

// rules/fraud.drl
rule "Same IP Multiple Accounts"
when
    $e: OrderEvent( userId != null, ip != null )
    exists OrderEvent( userId != $e.userId, ip == $e.ip, timestamp > ($e.timestamp - 3600000) )
then
    insert(new RiskAlert($e.orderId, "MULTI_ACCOUNT_SAME_IP"));
end

敏感数据加密：字段级AES+KMS托管密钥

用户手机号、银行卡号等PII信息采用AES-GCM加密存储，并通过阿里云KMS托管主密钥：

package juwatech.cn.security;

import javax.crypto.Cipher;
import javax.crypto.spec.GCMParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import com.aliyuncs.kms.model.v20160120.DecryptResponse;
import com.aliyuncs.kms.model.v20160120.EncryptRequest;
import org.springframework.beans.factory.annotation.Value;

public class KMSEncryptionService {
    @Value("${kms.key-id}")
    private String keyId;

    public String encrypt(String plaintext) throws Exception {
        byte[] data = plaintext.getBytes(StandardCharsets.UTF_8);
        EncryptRequest request = new EncryptRequest();
        request.setKeyId(keyId);
        request.setPlaintext(Base64.getEncoder().encodeToString(data));
        // 调用KMS API获取密文
        // ...
        return ciphertext;
    }

    public String decrypt(String ciphertext) throws Exception {
        // 调用KMS Decrypt API
        DecryptResponse response = kmsClient.getAcsResponse(decryptRequest);
        byte[] plainBytes = Base64.getDecoder().decode(response.getPlaintext());
        return new String(plainBytes, StandardCharsets.UTF_8);
    }
}

数据库实体层使用自定义JPA Converter自动加解密：

@Converter
public class EncryptedPhoneConverter implements AttributeConverter<String, String> {
    @Autowired
    private KMSEncryptionService encryptionService;

    @Override
    public String convertToDatabaseColumn(String phone) {
        try {
            return encryptionService.encrypt(phone);
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }

    @Override
    public String convertToEntityAttribute(String dbData) {
        try {
            return encryptionService.decrypt(dbData);
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }
}

防重放与签名验证：保障API调用合法性

所有客户端请求需携带时间戳、随机nonce和HMAC-SHA256签名，服务端校验防重放：

package juwatech.cn.security;

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import org.springframework.web.filter.OncePerRequestFilter;

public class ApiSignatureFilter extends OncePerRequestFilter {
    private static final Set<String> seenNonces = ConcurrentHashMap.newKeySet(100_000);

    @Override
    protected void doFilterInternal(HttpServletRequest req, HttpServletResponse res, FilterChain chain) {
        String timestamp = req.getHeader("X-Timestamp");
        String nonce = req.getHeader("X-Nonce");
        String signature = req.getHeader("X-Signature");

        if (System.currentTimeMillis() - Long.parseLong(timestamp) > 300_000) {
            throw new SecurityException("Request expired");
        }
        if (!seenNonces.add(nonce)) {
            throw new SecurityException("Replay attack detected");
        }

        String expected = calculateHmac(req, secretKey);
        if (!MessageDigest.isEqual(expected.getBytes(), signature.getBytes())) {
            throw new SecurityException("Invalid signature");
        }

        chain.doFilter(req, res);
    }

    private String calculateHmac(HttpServletRequest req, String secret) {
        // 构造待签字符串：method + url + body + timestamp + nonce
        // 使用HmacSHA256计算
    }
}

最小权限模型：RBAC+ABAC混合控制

后台管理采用基于角色（RBAC）与属性（ABAC）的混合访问控制。例如，运营人员仅能操作所属渠道的用户数据：

package juwatech.cn.auth;

import org.springframework.security.access.PermissionEvaluator;
import org.springframework.security.core.Authentication;

public class CommissionPermissionEvaluator implements PermissionEvaluator {
    @Override
    public boolean hasPermission(Authentication auth, Object targetDomainObject, Object permission) {
        if (targetDomainObject instanceof CommissionRecord record) {
            String operatorChannel = ((UserDetails) auth.getPrincipal()).getChannelId();
            return Objects.equals(operatorChannel, record.getChannelId());
        }
        return false;
    }
}

配合Spring Security注解使用：

@PreAuthorize("hasPermission(#record, 'edit')")
public void updateCommission(CommissionRecord record) {
    // 仅当操作人与记录所属渠道一致时允许修改
}

日志脱敏与审计追踪

所有包含敏感字段的日志在输出前自动脱敏：

package juwatech.cn.log;

import ch.qos.logback.classic.spi.ILoggingEvent;
import ch.qos.logback.core.filter.Filter;
import ch.qos.logback.core.spi.FilterReply;

public class SensitiveDataMaskingFilter extends Filter<ILoggingEvent> {
    private static final Pattern PHONE_PATTERN = Pattern.compile("(13[0-9]|14[01456879]|15[0-35-9]|16[2567]|17[0-8]|18[0-9]|19[0-35-9])\\d{8}");

    @Override
    public FilterReply decide(ILoggingEvent event) {
        String msg = event.getFormattedMessage();
        String masked = PHONE_PATTERN.matcher(msg).replaceAll("$1****${phoneSuffix}");
        // 修改event内容（需反射或自定义Appender）
        return FilterReply.NEUTRAL;
    }
}

同时，关键操作写入独立审计日志表，不可篡改：

CREATE TABLE audit_log (
    id BIGINT PRIMARY KEY,
    operator_id BIGINT NOT NULL,
    action VARCHAR(50) NOT NULL,
    resource_type VARCHAR(30),
    resource_id BIGINT,
    old_value TEXT,
    new_value TEXT,
    ip VARCHAR(45),
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
) ENGINE=InnoDB;

本文著作权归聚娃科技省赚客app开发者团队，转载请注明出处！