本文目录导读：
我来为你详细讲解PHP项目中的数据分类分级管理方案。
数据分类分级基础架构
1 分类分级定义
<?php
// 数据分类常量
class DataCategory {
const PERSONAL = 'personal'; // 个人信息
const FINANCIAL = 'financial'; // 财务信息
const BUSINESS = 'business'; // 业务信息
const SYSTEM = 'system'; // 系统信息
const OPERATION = 'operation'; // 运维信息
}
// 数据分级常量
class DataLevel {
const PUBLIC = 0; // 公开
const INTERNAL = 1; // 内部
const SENSITIVE = 2; // 敏感
const CONFIDENTIAL = 3; // 机密
const TOP_SECRET = 4; // 绝密
}
2 分类分级映射配置
<?php
return [
'fields' => [
'user_name' => [
'category' => 'personal',
'level' => 'internal',
'encrypt' => false,
'mask' => true
],
'id_card' => [
'category' => 'personal',
'level' => 'confidential',
'encrypt' => true,
'mask' => true,
'mask_pattern' => '***{last4}'
],
'phone' => [
'category' => 'personal',
'level' => 'sensitive',
'encrypt' => true,
'mask' => true
],
'email' => [
'category' => 'personal',
'level' => 'internal',
'encrypt' => false,
'mask' => false
],
'salary' => [
'category' => 'financial',
'level' => 'confidential',
'encrypt' => true,
'mask' => false
],
'bank_card' => [
'category' => 'financial',
'level' => 'confidential',
'encrypt' => true,
'mask' => true
]
],
'tables' => [
'users' => [
'level' => 'sensitive',
'audit' => true,
'backup_priority' => 'high'
],
'orders' => [
'level' => 'confidential',
'audit' => true,
'backup_priority' => 'high'
],
'logs' => [
'level' => 'internal',
'audit' => false,
'backup_priority' => 'low'
]
]
];
核心管理类实现
1 数据分类分级管理器
<?php
namespace App\DataClassify;
class DataClassifierManager
{
private $config;
private $encryption;
private $auditLogger;
public function __construct()
{
$this->config = require 'config/data_classify.php';
$this->encryption = new EncryptionService();
$this->auditLogger = new AuditLogger();
}
/**
* 获取字段级别
*/
public function getFieldLevel(string $field): string
{
return $this->config['fields'][$field]['level'] ?? 'public';
}
/**
* 检查字段是否需要加密
*/
public function needEncrypt(string $field): bool
{
return $this->config['fields'][$field]['encrypt'] ?? false;
}
/**
* 处理敏感数据
*/
public function processField(string $field, $value, string $action = 'read')
{
$config = $this->config['fields'][$field] ?? null;
if (!$config) {
return $value;
}
// 数据脱敏
if ($config['mask'] && $action === 'read') {
$value = $this->maskData($field, $value);
}
// 数据加密
if ($config['encrypt'] && $action === 'write') {
$value = $this->encryption->encrypt($value);
}
// 数据解密
if ($config['encrypt'] && $action === 'read') {
$value = $this->encryption->decrypt($value);
}
return $value;
}
/**
* 数据脱敏处理
*/
private function maskData(string $field, $value): string
{
if (empty($value)) return $value;
$pattern = $this->config['fields'][$field]['mask_pattern'] ?? null;
if ($pattern) {
return $this->applyMaskPattern($value, $pattern);
}
// 默认脱敏规则
switch ($field) {
case 'id_card':
return substr($value, 0, 6) . '****' . substr($value, -4);
case 'phone':
return substr($value, 0, 3) . '****' . substr($value, -4);
case 'bank_card':
return '**** **** **** ' . substr($value, -4);
case 'password':
return '********';
default:
return $value;
}
}
/**
* 应用脱敏模式
*/
private function applyMaskPattern(string $value, string $pattern): string
{
$replacements = [
'{first4}' => substr($value, 0, 4),
'{last4}' => substr($value, -4),
'{first3}' => substr($value, 0, 3),
'{last3}' => substr($value, -3),
'{length}' => strlen($value)
];
return str_replace(array_keys($replacements), array_values($replacements), $pattern);
}
}
2 权限验证服务
<?php
namespace App\DataClassify;
class AuthorizationService
{
private $roleLevels = [
'admin' => 4, // 可访问所有级别
'manager' => 3, // 可访问至机密
'staff' => 2, // 可访问至敏感
'guest' => 1 // 可访问至内部
];
/**
* 检查用户是否有权限访问数据
*/
public function checkAccess(string $userRole, string $dataLevel): bool
{
$userLevel = $this->roleLevels[$userRole] ?? 0;
$requiredLevel = $this->getLevelValue($dataLevel);
return $userLevel >= $requiredLevel;
}
/**
* 获取级别数值
*/
private function getLevelValue(string $level): int
{
$levels = [
'public' => 0,
'internal' => 1,
'sensitive' => 2,
'confidential' => 3,
'top_secret' => 4
];
return $levels[$level] ?? 0;
}
/**
* 验证数据访问权限
*/
public function validateDataAccess($user, string $table, array $fields)
{
$deniedFields = [];
foreach ($fields as $field) {
$fieldLevel = app(DataClassifierManager::class)->getFieldLevel($field);
if (!$this->checkAccess($user->role, $fieldLevel)) {
$deniedFields[] = $field;
}
}
return $deniedFields;
}
}
数据库层实现
1 数据分类分级模型
<?php
namespace App\Models;
use Illuminate\Database\Eloquent\Model;
use App\DataClassify\DataClassifierManager;
class BaseModel extends Model
{
protected $classifier;
protected $sensitiveFields = [];
protected $hiddenFields = [];
public function __construct(array $attributes = [])
{
parent::__construct($attributes);
$this->classifier = app(DataClassifierManager::class);
}
/**
* 获取脱敏后的数据
*/
public function toArray()
{
$data = parent::toArray();
foreach ($data as $field => $value) {
if (in_array($field, $this->sensitiveFields)) {
$data[$field] = $this->classifier->processField($field, $value, 'read');
}
}
return $data;
}
/**
* 保存时自动加密敏感字段
*/
public function setAttribute($key, $value)
{
if (in_array($key, $this->sensitiveFields) && $this->classifier->needEncrypt($key)) {
$value = $this->classifier->processField($key, $value, 'write');
}
return parent::setAttribute($key, $value);
}
}
2 用户模型示例
<?php
namespace App\Models;
class User extends BaseModel
{
protected $sensitiveFields = [
'id_card', 'phone', 'email', 'salary', 'bank_card'
];
protected $hiddenFields = [
'password', 'remember_token'
];
protected $fillable = [
'name', 'email', 'password',
'phone', 'id_card', 'salary'
];
}
查询拦截与审计
1 SQL查询拦截器
<?php
namespace App\DataClassify;
use Illuminate\Support\Facades\DB;
use Illuminate\Support\Facades\Log;
class QueryInterceptor
{
private $classifier;
private $authorization;
public function __construct()
{
$this->classifier = new DataClassifierManager();
$this->authorization = new AuthorizationService();
}
/**
* 拦截并处理查询
*/
public function interceptQuery(string $sql, array $bindings, $user)
{
// 解析SQL，获取表名和字段
$parsed = $this->parseSql($sql);
// 验证权限
$deniedFields = $this->authorization->validateDataAccess(
$user,
$parsed['table'],
$parsed['fields']
);
if (!empty($deniedFields)) {
throw new \Exception("Access denied to fields: " . implode(', ', $deniedFields));
}
// 记录审计日志
$this->auditLog($user, $sql, $parsed);
return true;
}
/**
* 解析SQL语句
*/
private function parseSql(string $sql): array
{
// 简单解析，实际应用需要更完整的SQL解析器
preg_match('/FROM\s+(\w+)/i', $sql, $tableMatch);
preg_match('/SELECT\s+(.*?)\s+FROM/i', $sql, $fieldsMatch);
$table = $tableMatch[1] ?? '';
$fields = $fieldsMatch[1] ?? '*';
if ($fields !== '*') {
$fields = array_map('trim', explode(',', $fields));
}
return [
'table' => $table,
'fields' => $fields
];
}
/**
* 审计日志
*/
private function auditLog($user, string $sql, array $parsed)
{
Log::channel('data_access')->info('Data query', [
'user_id' => $user->id,
'user_role' => $user->role,
'table' => $parsed['table'],
'sql' => $sql,
'ip' => request()->ip(),
'timestamp' => now()
]);
}
}
2 注册查询拦截器
<?php
namespace App\Providers;
use Illuminate\Support\ServiceProvider;
use App\DataClassify\QueryInterceptor;
use Illuminate\Support\Facades\DB;
class DataClassifyServiceProvider extends ServiceProvider
{
public function boot()
{
$interceptor = new QueryInterceptor();
DB::listen(function ($query) use ($interceptor) {
$user = auth()->user();
if ($user) {
$interceptor->interceptQuery(
$query->sql,
$query->bindings,
$user
);
}
});
}
}
API层处理
1 中间件实现
<?php
namespace App\Http\Middleware;
use Closure;
use App\DataClassify\AuthorizationService;
class DataClassifyMiddleware
{
public function handle($request, Closure $next)
{
$response = $next($request);
// 处理响应数据
if ($response->isSuccessful()) {
$data = $response->getData(true);
if (isset($data['data'])) {
$data['data'] = $this->processResponseData($data['data']);
$response->setData($data);
}
}
return $response;
}
/**
* 处理响应数据
*/
private function processResponseData($data)
{
if (is_array($data)) {
foreach ($data as $key => $value) {
if (is_array($value)) {
$data[$key] = $this->processResponseData($value);
}
}
}
return $data;
}
}
2 请求验证
<?php
namespace App\Http\Requests;
use Illuminate\Foundation\Http\FormRequest;
class DataQueryRequest extends FormRequest
{
public function rules()
{
return [
'fields' => 'array',
'fields.*' => 'string|in:' . implode(',', $this->getAllowedFields()),
'level' => 'nullable|in:public,internal,sensitive,confidential'
];
}
/**
* 获取允许的字段
*/
private function getAllowedFields()
{
$user = $this->user();
$classifier = app('data.classifier');
$authorization = app('data.authorization');
$allowedFields = [];
foreach (config('data_classify.fields') as $field => $config) {
if ($authorization->checkAccess($user->role, $config['level'])) {
$allowedFields[] = $field;
}
}
return $allowedFields;
}
}
监控与告警
1 异常访问监控
<?php
namespace App\DataClassify;
class DataAccessMonitor
{
private $alertThresholds = [
'failed_attempts' => 5, // 失败尝试次数
'sensitive_access' => 10, // 敏感数据访问次数
'time_window' => 300 // 时间窗口（秒）
];
/**
* 监控数据访问
*/
public function monitorAccess($userId, string $operation)
{
$cacheKey = "access_monitor:{$userId}:{$operation}";
$count = cache()->increment($cacheKey);
cache()->expire($cacheKey, $this->alertThresholds['time_window']);
if ($count > $this->alertThresholds['failed_attempts']) {
$this->triggerAlert($userId, 'failed_attempts_exceeded', [
'count' => $count,
'operation' => $operation
]);
}
}
/**
* 触发告警
*/
private function triggerAlert($userId, string $type, array $context)
{
Log::channel('security')->warning('Data access alert', [
'user_id' => $userId,
'alert_type' => $type,
'context' => $context,
'ip' => request()->ip(),
'timestamp' => now()
]);
// 发送通知
$this->notifySecurityTeam($type, $context);
}
}
使用示例
1 控制器中的使用
<?php
namespace App\Http\Controllers;
use App\Models\User;
use App\DataClassify\DataClassifierManager;
use App\DataClassify\AuthorizationService;
class UserController extends Controller
{
public function show($id)
{
$user = User::findOrFail($id);
// 自动进行数据脱敏
return response()->json([
'data' => $user->toArray()
]);
}
public function store(Request $request)
{
$user = User::create($request->all());
// 敏感字段自动加密存储
return response()->json($user, 201);
}
public function exportSensitiveData(Request $request)
{
$authorization = app(AuthorizationService::class);
if (!$authorization->checkAccess($request->user()->role, 'confidential')) {
abort(403, '无权导出机密数据');
}
// 导出处理
}
}
2 命令行工具
<?php
namespace App\Console\Commands;
use Illuminate\Console\Command;
use App\DataClassify\DataClassifierManager;
class ClassifyDataCommand extends Command
{
protected $signature = 'data:classify {table} {--check}';
public function handle()
{
$table = $this->argument('table');
$classifier = new DataClassifierManager();
// 扫描表结构
$columns = $this->getTableColumns($table);
foreach ($columns as $column) {
$level = $classifier->getFieldLevel($column);
if ($this->option('check')) {
$this->info("{$column}: {$level}");
}
}
// 生成报告
$this->generateReport($table, $columns);
}
}
最佳实践建议
1 配置管理
// config/data_classify.php 推荐配置
return [
// 加密配置
'encryption' => [
'algorithm' => 'AES-256-GCM',
'key_rotation' => 90, // 密钥轮换周期（天）
],
// 审计配置
'audit' => [
'enabled' => true,
'channels' => ['database', 'elasticsearch', 'log'],
'retention_days' => 365
],
// 脱敏配置
'masking' => [
'default' => true,
'exceptions' => [
'admin' => false // 管理员不脱敏
]
]
];
2 性能优化
<?php
namespace App\DataClassify;
class ClassifyCache
{
private $cache = [];
private $ttl = 3600; // 缓存1小时
/**
* 缓存分类结果
*/
public function getClassification(string $field)
{
if (!isset($this->cache[$field])) {
$config = config("data_classify.fields.{$field}");
$this->cache[$field] = $config;
}
return $this->cache[$field];
}
/**
* 批量处理
*/
public function batchProcess(array $data, string $action = 'read')
{
$classifier = app(DataClassifierManager::class);
foreach ($data as $field => $value) {
$data[$field] = $classifier->processField($field, $value, $action);
}
return $data;
}
}
这个完整的PHP数据分类分级管理系统提供了：
- 完整的数据分类分级模型
- 自动加密解密机制
- 数据脱敏处理
- 权限访问控制
- 审计日志记录
- 异常监控告警
- 性能优化方案
可以根据实际需求调整配置和扩展功能。
