密钥轮转策略#

@Service
@Slf4j
public class TimeBasedKeyRotationScheduler {
    
    @Autowired
    private KeyRotationService keyRotationService;
    
    /**
     * 定时任务：检查需要轮转的密钥
     */
    @Scheduled(cron = "0 0 2 * * *")  // 每天凌晨 2 点
    public void checkKeysForRotation() {
        
        List<Key> keysNeedingRotation = keyRepository
            .findKeysForRotation(
                Instant.now().minus(Duration.ofDays(90)), // 90 天轮转周期
                KeyState.ACTIVE
            );
        
        for (Key key : keysNeedingRotation) {
            try {
                // 检查是否满足轮转条件
                if (canRotate(key)) {
                    log.info("开始轮转密钥: {}", key.getKeyId());
                    keyRotationService.rotateKey(key.getKeyId());
                }
            } catch (Exception e) {
                log.error("密钥轮转失败: {}", key.getKeyId(), e);
                alertService.sendAlert("密钥轮转失败", key.getKeyId());
            }
        }
    }
    
    /**
     * 检查是否可以轮转
     */
    private boolean canRotate(Key key) {
        // 检查是否有正在进行的操作
        if (key.isRotationInProgress()) {
            return false;
        }
        
        // 检查是否有依赖的未完成操作
        if (hasPendingDependencies(key)) {
            return false;
        }
        
        return true;
    }
}

@Service
@Slf4j
public class UsageBasedKeyRotation {
    
    @Autowired
    private KeyUsageTracker usageTracker;
    
    /**
     * 使用量计数器（Redis 实现）
     */
    public void incrementUsageCount(String keyId) {
        String counterKey = "key:usage:" + keyId;
        long count = redisTemplate.opsForValue().increment(counterKey);
        
        // 检查是否达到阈值
        Key key = keyRepository.findByKeyId(keyId);
        if (count >= key.getRotationThreshold()) {
            log.info("密钥 {} 使用次数达到阈值 {}，触发轮转", 
                keyId, key.getRotationThreshold());
            triggerRotation(keyId);
        }
    }
    
    /**
     * 使用量配置示例
     */
    public Map<String, Object> getRotationThresholds() {
        return Map.of(
            "payment-keys", 100_000,     // 支付密钥：10 万次后轮转
            "session-keys", 1_000_000,  // 会话密钥：100 万次后轮转
            "archive-keys", 10_000       // 归档密钥：1 万次后轮转
        );
    }
}

@Service
@Slf4j
public class EventBasedKeyRotation {
    
    @Autowired
    private SecurityEventHandler securityEventHandler;
    
    @PostConstruct
    public void registerEventHandlers() {
        // 人员变动事件
        securityEventHandler.on(EmployeeOffboardingEvent.class, this::onEmployeeOffboarding);
        
        // 安全告警事件
        securityEventHandler.on(SecurityAlertEvent.class, this::onSecurityAlert);
        
        // 漏洞发现事件
        securityEventHandler.on(VulnerabilityDiscoveredEvent.class, this::onVulnerability);
    }
    
    /**
     * 员工离职时轮转相关密钥
     */
    public void onEmployeeOffboarding(EmployeeOffboardingEvent event) {
        log.info("员工离职，轮转相关密钥: {}", event.getEmployeeId());
        
        // 查找该员工有权限使用的密钥
        List<String> keyIds = keyPermissionRepository
            .findKeysWithAccess(event.getEmployeeId());
        
        for (String keyId : keyIds) {
            // 立即轮转这些密钥
            keyRotationService.emergencyRotate(keyId, 
                "员工离职: " + event.getEmployeeId());
        }
    }
    
    /**
     * 安全告警时轮转密钥
     */
    public void onSecurityAlert(SecurityAlertEvent event) {
        if (event.getSeverity() == Severity.CRITICAL) {
            log.warn("严重安全告警，轮转所有生产密钥");
            
            // 紧急轮转所有生产环境密钥
            List<String> prodKeyIds = keyRepository.findProductionKeyIds();
            for (String keyId : prodKeyIds) {
                keyRotationService.emergencyRotate(keyId, 
                    "安全告警: " + event.getAlertId());
            }
        }
    }
}

@Service
@Slf4j
public class SymmetricKeyRotation {
    
    private final Map<String, List<KeyVersion>> keyVersions = new ConcurrentHashMap<>();
    
    /**
     * 加密数据（使用当前版本密钥）
     */
    public EncryptedBlob encrypt(String keyId, byte[] plaintext) throws Exception {
        
        // 获取当前活动版本的密钥
        KeyVersion currentKey = getCurrentVersion(keyId);
        
        // 生成新的 DEK（数据加密密钥）
        byte[] dek = generateDek(256);
        
        // 用 KEK 加密 DEK
        EncryptedDek encryptedDek = encryptDekWithKek(dek, currentKey.getKeyMaterial());
        
        // 用 DEK 加密数据
        byte[] iv = generateIv(12);
        byte[] ciphertext = encryptAesGcm(plaintext, dek, iv);
        
        // 返回加密结果和加密的 DEK
        return EncryptedBlob.builder()
            .keyId(keyId)
            .keyVersion(currentKey.getVersion())
            .encryptedDek(encryptedDek.getEncryptedDek())
            .encryptedDekKeyId(encryptedDek.getKeyId())
            .iv(iv)
            .ciphertext(ciphertext)
            .build();
    }
    
    /**
     * 解密数据（尝试所有版本密钥）
     */
    public byte[] decrypt(EncryptedBlob encryptedBlob) throws Exception {
        
        String keyId = encryptedBlob.getKeyId();
        
        // 获取所有版本密钥（按版本号降序，优先尝试新版本）
        List<KeyVersion> versions = keyVersions.getOrDefault(keyId, Collections.emptyList())
            .stream()
            .sorted(Comparator.comparing(KeyVersion::getVersion).reversed())
            .collect(Collectors.toList());
        
        List<Exception> errors = new ArrayList<>();
        
        for (KeyVersion version : versions) {
            try {
                // 尝试用这个版本的密钥解密 DEK
                byte[] dek = decryptDek(
                    encryptedBlob.getEncryptedDek(),
                    version.getKeyMaterial()
                );
                
                // 用 DEK 解密数据
                return decryptAesGcm(
                    encryptedBlob.getCiphertext(),
                    dek,
                    encryptedBlob.getIv()
                );
                
            } catch (Exception e) {
                errors.add(e);
                log.debug("用密钥版本 {} 解密失败，尝试下一个版本", version.getVersion());
            }
        }
        
        // 所有版本都失败
        throw new DecryptionException(
            "无法解密数据，尝试了 " + versions.size() + " 个密钥版本", 
            errors
        );
    }
    
    /**
     * 执行密钥轮转
     */
    @Transactional
    public KeyRotationResult rotateKey(String keyId) {
        
        // 1. 生成新版本密钥
        byte[] newKeyMaterial = generateKey(256);
        int newVersion = getNextVersion(keyId);
        
        KeyVersion newKeyVersion = KeyVersion.builder()
            .keyId(keyId)
            .version(newVersion)
            .keyMaterial(newKeyMaterial)
            .createdAt(Instant.now())
            .createdBy(getCurrentPrincipal())
            .state(KeyVersionState.ACTIVE)
            .build();
        
        // 2. 将当前版本标记为轮转中
        KeyVersion currentVersion = getCurrentVersion(keyId);
        currentVersion.setState(KeyVersionState.ROTATED);
        currentVersion.setRotatedAt(Instant.now());
        
        // 3. 保存新版本
        keyVersions.computeIfAbsent(keyId, k -> new ArrayList<>()).add(newKeyVersion);
        
        // 4. 审计日志
        auditService.logKeyRotation(keyId, currentVersion.getVersion(), newVersion);
        
        log.info("密钥 {} 轮转完成: {} -> {}", keyId, 
            currentVersion.getVersion(), newVersion);
        
        return new KeyRotationResult(keyId, currentVersion.getVersion(), newVersion);
    }
}

@Service
@Slf4j
public class CertificateRotation {
    
    /**
     * 执行证书轮转（双证书模式）
     */
    @Transactional
    public CertificateRotationResult rotateCertificate(String serviceId) {
        
        // 1. 生成新的私钥和 CSR
        KeyPair newKeyPair = generateKeyPair("RSA", 2048);
        PKCS10CertificationRequest csr = generateCSR(newKeyPair, serviceId);
        
        // 2. 向 CA 申请新证书
        Certificate newCert = caClient.issueCertificate(csr);
        
        // 3. 部署新证书（同时保留旧证书）
        deploymentService.deployCertificate(
            serviceId,
            newCert,
            newKeyPair.getPrivate()
        );
        
        // 4. 记录轮转
        CertificateRecord record = CertificateRecord.builder()
            .serviceId(serviceId)
            .serialNumber(newCert.getSerialNumber().toString())
            .validFrom(newCert.getNotBefore().toInstant())
            .validTo(newCert.getNotAfter().toInstant())
            .publicKey(newCert.getPublicKey().getEncoded())
            .state(CertificateState.ACTIVE)
            .build();
        certificateRepository.save(record);
        
        // 5. 发送通知
        notificationService.notifyCertificateDeployed(serviceId, newCert);
        
        log.info("证书轮转完成: service={}, serial={}", 
            serviceId, newCert.getSerialNumber());
        
        return new CertificateRotationResult(record, newCert);
    }
    
    /**
     * 下线旧证书（过渡期结束后）
     */
    @Transactional
    public void retireOldCertificate(String serviceId, String serialNumber) {
        
        CertificateRecord oldCert = certificateRepository
            .findByServiceIdAndSerialNumber(serviceId, serialNumber)
            .orElseThrow(() -> new CertificateNotFoundException());
        
        // 检查是否满足下线条件
        if (!canRetire(oldCert)) {
            throw new IllegalStateException("证书尚未满足下线条件");
        }
        
        // 下线旧证书
        oldCert.setState(CertificateState.RETIRED);
        oldCert.setRetiredAt(Instant.now());
        certificateRepository.save(oldCert);
        
        // 从服务移除旧证书
        deploymentService.removeCertificate(serviceId, oldCert);
        
        auditService.logCertificateRetired(serviceId, serialNumber);
        
        log.info("旧证书已下线: service={}, serial={}", serviceId, serialNumber);
    }
}

/**
 * AWS KMS 自动轮转配置
 */
public class AwsKmsAutoRotation {
    
    private final AWSKMS kmsClient = AWSKMSClientBuilder.defaultClient();
    
    /**
     * 启用自动轮转（仅适用于对称密钥 CMK）
     */
    public void enableAutoRotation(String keyId) {
        
        EnableKeyRotationRequest request = EnableKeyRotationRequest.builder()
            .keyId(keyId)
            .build();
        
        kmsClient.enableKeyRotation(request);
        
        System.out.println("已启用自动轮转: " + keyId);
    }
    
    /**
     * 获取密钥轮转状态
     */
    public KeyRotationStatus getRotationStatus(String keyId) {
        
        GetKeyRotationStatusRequest request = GetKeyRotationStatusRequest.builder()
            .keyId(keyId)
            .build();
        
        GetKeyRotationStatusResponse response = 
            kmsClient.getKeyRotationStatus(request);
        
        return new KeyRotationStatus(
            keyId,
            response.keyRotationEnabled(),
            Instant.now()  // 上次轮转时间需要从 CloudTrail 获取
        );
    }
}

/**
 * 通过 CloudTrail 获取密钥轮转历史
 */
public class KmsRotationAudit {
    
    private final CloudTrailClient cloudTrail = CloudTrailClient.builder().build();
    
    /**
     * 查询密钥轮转事件
     */
    public List<KeyRotationEvent> getRotationHistory(String keyId, 
            Instant from, Instant to) {
        
        LookupAttributes filter = LookupAttributes.builder()
            .attributeKey("ResourceName")
            .attributeValue(keyId)
            .build();
        
        LookupEventsRequest request = LookupEventsRequest.builder()
            .lookupAttributes(filter)
            .startTime(from)
            .endTime(to)
            .build();
        
        LookupEventsIterable response = cloudTrail.lookupEventsPaginator(request);
        
        return response.stream()
            .flatMap(event -> event.events().stream())
            .filter(event -> event.eventName().contains("KeyRotation"))
            .map(this::parseRotationEvent)
            .collect(Collectors.toList());
    }
}

/**
 * 密钥版本模型
 */
@Entity
@Table(name = "key_versions")
public class KeyVersion {
    
    @Id
    private String versionId;  // 主键
    
    @Column(name = "key_id")
    private String keyId;     // 所属密钥 ID
    
    @Column(name = "version_number")
    private int versionNumber; // 版本号
    
    @Enumerated(EnumType.STRING)
    private KeyVersionState state;  // ACTIVE, ROTATED, DELETED
    
    @Column(name = "key_material_encrypted")
    private byte[] encryptedKeyMaterial;  // 加密的密钥材料
    
    @Column(name = "created_at")
    private Instant createdAt;
    
    @Column(name = "rotated_at")
    private Instant rotatedAt;
    
    @Column(name = "deleted_at")
    private Instant deletedAt;
    
    @Column(name = "created_by")
    private String createdBy;
    
    @Column(name = "deletion_scheduled_at")
    private Instant deletionScheduledAt;
    
    @Column(name = "deletion_reason")
    private String deletionReason;
}

public enum KeyVersionState {
    ACTIVE,      // 当前使用的版本
    ROTATED,     // 已被轮转，但仍可用于解密
    DELETED,     // 已删除
    PENDING_DELETION  // 待删除
}

@Service
@Slf4j
public class KeyVersionService {
    
    /**
     * 获取密钥的所有版本
     */
    public List<KeyVersionSummary> getKeyVersions(String keyId) {
        
        List<KeyVersion> versions = keyVersionRepository
            .findByKeyIdOrderByVersionNumberDesc(keyId);
        
        return versions.stream()
            .map(this::toSummary)
            .collect(Collectors.toList());
    }
    
    /**
     * 版本摘要
     */
    public record KeyVersionSummary(
        String versionId,
        int versionNumber,
        KeyVersionState state,
        Instant createdAt,
        Instant rotatedAt,
        String createdBy,
        long usedForDecryptionCount  // 解密使用次数
    ) {}
}

@Service
@Slf4j
public class KeyCompatibilityHandler {
    
    /**
     * 轮转时的兼容性检查
     */
    public CompatibilityCheckResult checkCompatibility(String keyId) {
        
        List<CompatibilityRequirement> requirements = 
            compatibilityRepository.findByKeyId(keyId);
        
        boolean compatible = true;
        List<String> issues = new ArrayList<>();
        
        for (CompatibilityRequirement req : requirements) {
            // 检查消费者是否支持轮转
            if (!req.getConsumer().supportsKeyRotation()) {
                issues.add(req.getConsumer().getName() + 
                    " 不支持密钥轮转，需要提前升级");
                compatible = false;
            }
            
            // 检查是否有未完成的请求
            if (req.hasPendingOperations()) {
                issues.add(req.getConsumer().getName() + 
                    " 有未完成的操作，需等待完成");
            }
        }
        
        return new CompatibilityCheckResult(compatible, issues);
    }
    
    /**
     * 消费者兼容性接口
     */
    public interface Consumer {
        String getName();
        boolean supportsKeyRotation();
        boolean hasPendingOperations();
        Duration getMaxTransitionPeriod();
    }
}

@Service
@Slf4j
public class RotationFailureHandler {
    
    @Autowired
    private AlertService alertService;
    
    /**
     * 处理轮转失败
     */
    public void handleRotationFailure(String keyId, Exception error) {
        
        log.error("密钥轮转失败: {}", keyId, error);
        
        // 1. 发送告警
        alertService.sendCriticalAlert(
            "密钥轮转失败",
            Map.of(
                "keyId", keyId,
                "error", error.getMessage(),
                "timestamp", Instant.now().toString()
            )
        );
        
        // 2. 记录失败事件
        rotationFailureRepository.save(RotationFailure.builder()
            .keyId(keyId)
            .failureTime(Instant.now())
            .errorType(error.getClass().getSimpleName())
            .errorMessage(error.getMessage())
            .retryCount(0)
            .build());
        
        // 3. 安排重试
        scheduleRetry(keyId, error);
    }
    
    /**
     * 指数退避重试
     */
    private void scheduleRetry(String keyId, Exception error) {
        int retryCount = getRetryCount(keyId);
        
        if (retryCount >= MAX_RETRIES) {
            log.error("密钥轮转重试次数超过上限: {}", keyId);
            escalateToSecurityTeam(keyId);
            return;
        }
        
        // 指数退避：1min, 5min, 15min, 1h, 4h...
        Duration delay = Duration.ofMinutes(
            (long) Math.pow(3, retryCount)
        );
        
        scheduler.schedule(
            () -> retryRotation(keyId),
            delay.toMillis(),
            TimeUnit.MILLISECONDS
        );
        
        log.info("安排重试: keyId={}, retryCount={}, delay={}", 
            keyId, retryCount + 1, delay);
    }
}