ProtectedConfigurationProvider 类
定义
重要
一些信息与预发行产品相关，相应产品在发行之前可能会进行重大修改。 对于此处提供的信息，Microsoft 不作任何明示或暗示的担保。
用于创建用于加密和解密受保护配置数据的提供程序的基类。
public ref class ProtectedConfigurationProvider abstract : System::Configuration::Provider::ProviderBasepublic abstract class ProtectedConfigurationProvider : System.Configuration.Provider.ProviderBasetype ProtectedConfigurationProvider = class
inherit ProviderBasePublic MustInherit Class ProtectedConfigurationProvider
Inherits ProviderBase- 继承
- 派生
示例
以下示例演示如何实现自定义 ProtectedConfigurationProvider。
若要能够配置此提供程序，如下一个配置摘录所示，必须在全局程序集缓存（GAC）中安装它。 有关详细信息，请参阅 实现受保护的配置提供程序。
using System;
using System.Xml;
using System.Security.Cryptography;
using System.IO;
using System.Text;
using System.Configuration.Provider;
using System.Collections.Specialized;
using System.Configuration;
namespace Samples.AspNet
{
// Shows how to create a custom protected configuration
// provider.
public class TripleDESProtectedConfigurationProvider :
ProtectedConfigurationProvider
{
private TripleDESCryptoServiceProvider des =
new TripleDESCryptoServiceProvider();
private string pKeyFilePath;
private string pName;
// Gets the path of the file
// containing the key used to
// encryption or decryption.
public string KeyFilePath
{
get { return pKeyFilePath; }
}
// Gets the provider name.
public override string Name
{
get { return pName; }
}
// Performs provider initialization.
public override void Initialize(string name,
NameValueCollection config)
{
pName = name;
pKeyFilePath = config["keyContainerName"];
ReadKey(KeyFilePath);
}
// Performs encryption.
public override XmlNode Encrypt(XmlNode node)
{
string encryptedData = EncryptString(node.OuterXml);
XmlDocument xmlDoc = new XmlDocument();
xmlDoc.PreserveWhitespace = true;
xmlDoc.LoadXml("<EncryptedData>" +
encryptedData + "</EncryptedData>");
return xmlDoc.DocumentElement;
}
// Performs decryption.
public override XmlNode Decrypt(XmlNode encryptedNode)
{
string decryptedData =
DecryptString(encryptedNode.InnerText);
XmlDocument xmlDoc = new XmlDocument();
xmlDoc.PreserveWhitespace = true;
xmlDoc.LoadXml(decryptedData);
return xmlDoc.DocumentElement;
}
// Encrypts a configuration section and returns
// the encrypted XML as a string.
private string EncryptString(string encryptValue)
{
byte[] valBytes =
Encoding.Unicode.GetBytes(encryptValue);
ICryptoTransform transform = des.CreateEncryptor();
MemoryStream ms = new MemoryStream();
CryptoStream cs = new CryptoStream(ms,
transform, CryptoStreamMode.Write);
cs.Write(valBytes, 0, valBytes.Length);
cs.FlushFinalBlock();
byte[] returnBytes = ms.ToArray();
cs.Close();
return Convert.ToBase64String(returnBytes);
}
// Decrypts an encrypted configuration section and
// returns the unencrypted XML as a string.
private string DecryptString(string encryptedValue)
{
byte[] valBytes =
Convert.FromBase64String(encryptedValue);
ICryptoTransform transform = des.CreateDecryptor();
MemoryStream ms = new MemoryStream();
CryptoStream cs = new CryptoStream(ms,
transform, CryptoStreamMode.Write);
cs.Write(valBytes, 0, valBytes.Length);
cs.FlushFinalBlock();
byte[] returnBytes = ms.ToArray();
cs.Close();
return Encoding.Unicode.GetString(returnBytes);
}
// Generates a new TripleDES key and vector and
// writes them to the supplied file path.
public void CreateKey(string filePath)
{
des.GenerateKey();
des.GenerateIV();
StreamWriter sw = new StreamWriter(filePath, false);
sw.WriteLine(ByteToHex(des.Key));
sw.WriteLine(ByteToHex(des.IV));
sw.Close();
}
// Reads in the TripleDES key and vector from
// the supplied file path and sets the Key
// and IV properties of the
// TripleDESCryptoServiceProvider.
private void ReadKey(string filePath)
{
StreamReader sr = new StreamReader(filePath);
string keyValue = sr.ReadLine();
string ivValue = sr.ReadLine();
des.Key = HexToByte(keyValue);
des.IV = HexToByte(ivValue);
}
// Converts a byte array to a hexadecimal string.
private string ByteToHex(byte[] byteArray)
{
string outString = "";
foreach (Byte b in byteArray)
outString += b.ToString("X2");
return outString;
}
// Converts a hexadecimal string to a byte array.
private byte[] HexToByte(string hexString)
{
byte[] returnBytes = new byte[hexString.Length / 2];
for (int i = 0; i < returnBytes.Length; i++)
returnBytes[i] =
Convert.ToByte(hexString.Substring(i * 2, 2), 16);
return returnBytes;
}
}
}
Imports System.Xml
Imports System.Security.Cryptography
Imports System.IO
Imports System.Text
Imports System.Configuration.Provider
Imports System.Collections.Specialized
Imports System.Configuration
' Shows how to create a custom protected configuration
' provider.
Namespace Samples.AspNet
Public Class TripleDESProtectedConfigurationProvider
Inherits ProtectedConfigurationProvider
Private des _
As New TripleDESCryptoServiceProvider()
Private pKeyFilePath As String
Private pName As String
' Gets the path of the file
' containing the key used to
' encrypt/decrypt.
Public ReadOnly Property KeyFilePath() As String
Get
Return pKeyFilePath
End Get
End Property
' Gets the provider name.
Public Overrides ReadOnly Property Name() As String
Get
Return pName
End Get
End Property
' Performs provider initialization.
Public Overrides Sub Initialize( _
ByVal name As String, _
ByVal config As NameValueCollection)
pName = name
pKeyFilePath = config("keyContainerName")
ReadKey(KeyFilePath)
End Sub
' Performs encryption.
Public Overrides Function Encrypt( _
ByVal node As XmlNode) As XmlNode
Dim encryptedData As String = _
EncryptString(node.OuterXml)
Dim xmlDoc As New XmlDocument()
xmlDoc.PreserveWhitespace = True
xmlDoc.LoadXml( _
("<EncryptedData>" + encryptedData + _
"</EncryptedData>"))
Return xmlDoc.DocumentElement
End Function 'Encrypt
' Performs decryption.
Public Overrides Function Decrypt( _
ByVal encryptedNode As XmlNode) As XmlNode
Dim decryptedData As String = _
DecryptString(encryptedNode.InnerText)
Dim xmlDoc As New XmlDocument()
xmlDoc.PreserveWhitespace = True
xmlDoc.LoadXml(decryptedData)
Return xmlDoc.DocumentElement
End Function 'Decrypt
' Encrypts a configuration section and returns
' the encrypted XML as a string.
Private Function EncryptString( _
ByVal encryptValue As String) As String
Dim valBytes As Byte() = _
Encoding.Unicode.GetBytes(encryptValue)
Dim transform As ICryptoTransform = _
des.CreateEncryptor()
Dim ms As New MemoryStream()
Dim cs As New CryptoStream(ms, _
transform, CryptoStreamMode.Write)
cs.Write(valBytes, 0, valBytes.Length)
cs.FlushFinalBlock()
Dim returnBytes As Byte() = ms.ToArray()
cs.Close()
Return Convert.ToBase64String(returnBytes)
End Function 'EncryptString
' Decrypts an encrypted configuration section and
' returns the unencrypted XML as a string.
Private Function DecryptString( _
ByVal encryptedValue As String) As String
Dim valBytes As Byte() = _
Convert.FromBase64String(encryptedValue)
Dim transform As ICryptoTransform = _
des.CreateDecryptor()
Dim ms As New MemoryStream()
Dim cs As New CryptoStream(ms, _
transform, CryptoStreamMode.Write)
cs.Write(valBytes, 0, valBytes.Length)
cs.FlushFinalBlock()
Dim returnBytes As Byte() = ms.ToArray()
cs.Close()
Return Encoding.Unicode.GetString(returnBytes)
End Function 'DecryptString
' Generates a new TripleDES key and vector and
' writes them to the supplied file path.
Public Sub CreateKey(ByVal filePath As String)
des.GenerateKey()
des.GenerateIV()
Dim sw As New StreamWriter(filePath, False)
sw.WriteLine(ByteToHex(des.Key))
sw.WriteLine(ByteToHex(des.IV))
sw.Close()
End Sub
' Reads in the TripleDES key and vector from
' the supplied file path and sets the Key
' and IV properties of the
' TripleDESCryptoServiceProvider.
Private Sub ReadKey(ByVal filePath As String)
Dim sr As New StreamReader(filePath)
Dim keyValue As String = sr.ReadLine()
Dim ivValue As String = sr.ReadLine()
des.Key = HexToByte(keyValue)
des.IV = HexToByte(ivValue)
End Sub
' Converts a byte array to a hexadecimal string.
Private Function ByteToHex( _
ByVal byteArray() As Byte) As String
Dim outString As String = ""
Dim b As [Byte]
For Each b In byteArray
outString += b.ToString("X2")
Next b
Return outString
End Function 'ByteToHex
' Converts a hexadecimal string to a byte array.
Private Function HexToByte(ByVal hexString As String) As Byte()
Dim returnBytes(hexString.Length / 2) As Byte
Dim i As Integer
For i = 0 To returnBytes.Length - 1
returnBytes(i) = _
Convert.ToByte(hexString.Substring(i * 2, 2), 16)
Next i
Return returnBytes
End Function 'HexToByte
End Class
End Namespace
以下示例演示如何使用以前的自定义 ProtectedConfigurationProvider。
using System;
using System.Configuration;
using Samples.AspNet.Configuration;
namespace Samples.AspNet.Configuration
{
// Show how to use a custom protected configuration
// provider.
public class TestingProtectedConfigurationProvider
{
// Protect the connectionStrings section.
private static void ProtectConfiguration()
{
// Get the application configuration file.
System.Configuration.Configuration config =
ConfigurationManager.OpenExeConfiguration(
ConfigurationUserLevel.None);
// Define the provider name.
string provider =
"TripleDESProtectedConfigurationProvider";
// Get the section to protect.
ConfigurationSection connStrings =
config.ConnectionStrings;
if (connStrings != null)
{
if (!connStrings.SectionInformation.IsProtected)
{
if (!connStrings.ElementInformation.IsLocked)
{
// Protect the section.
connStrings.SectionInformation.ProtectSection(provider);
connStrings.SectionInformation.ForceSave = true;
config.Save(ConfigurationSaveMode.Full);
Console.WriteLine("Section {0} is now protected by {1}",
connStrings.SectionInformation.Name,
connStrings.SectionInformation.ProtectionProvider.Name);
}
else
Console.WriteLine(
"Can't protect, section {0} is locked",
connStrings.SectionInformation.Name);
}
else
Console.WriteLine(
"Section {0} is already protected by {1}",
connStrings.SectionInformation.Name,
connStrings.SectionInformation.ProtectionProvider.Name);
}
else
Console.WriteLine("Can't get the section {0}",
connStrings.SectionInformation.Name);
}
// Unprotect the connectionStrings section.
private static void UnProtectConfiguration()
{
// Get the application configuration file.
System.Configuration.Configuration config =
ConfigurationManager.OpenExeConfiguration(
ConfigurationUserLevel.None);
// Get the section to unprotect.
ConfigurationSection connStrings =
config.ConnectionStrings;
if (connStrings != null)
{
if (connStrings.SectionInformation.IsProtected)
{
if (!connStrings.ElementInformation.IsLocked)
{
// Unprotect the section.
connStrings.SectionInformation.UnprotectSection();
connStrings.SectionInformation.ForceSave = true;
config.Save(ConfigurationSaveMode.Full);
Console.WriteLine("Section {0} is now unprotected.",
connStrings.SectionInformation.Name);
}
else
Console.WriteLine(
"Can't unprotect, section {0} is locked",
connStrings.SectionInformation.Name);
}
else
Console.WriteLine(
"Section {0} is already unprotected.",
connStrings.SectionInformation.Name);
}
else
Console.WriteLine("Can't get the section {0}",
connStrings.SectionInformation.Name);
}
public static void Main(string[] args)
{
string selection = string.Empty;
if (args.Length == 0)
{
Console.WriteLine(
"Select createkey, protect or unprotect");
return;
}
selection = args[0].ToLower();
switch (selection)
{
// Create the key to use during
// encryption/decryption.
case "createkey":
string keyContainer =
"pcKey.txt";
// Instantiate the custom provider.
TripleDESProtectedConfigurationProvider
provider =
new TripleDESProtectedConfigurationProvider();
// Create the encryption/decryption key.
provider.CreateKey(keyContainer);
Console.WriteLine(
"New TripleDES key created in {0}",
keyContainer);
break;
case "protect":
ProtectConfiguration();
break;
case "unprotect":
UnProtectConfiguration();
break;
default:
Console.WriteLine("Unknown selection");
break;
}
Console.Read();
}
}
}
Imports System.Configuration
Namespace Samples.AspNet
' Show how to use a custom protected configuration
' provider.
Public Class TestingProtectedConfigurationProvider
' Protect the connectionStrings section.
Private Shared Sub ProtectConfiguration()
' Get the application configuration file.
Dim config _
As System.Configuration.Configuration = _
ConfigurationManager.OpenExeConfiguration( _
ConfigurationUserLevel.None)
' Define the provider name.
Dim provider As String = _
"TripleDESProtectedConfigurationProvider"
' Get the section to protect.
Dim connStrings _
As ConfigurationSection = config.ConnectionStrings
If Not (connStrings Is Nothing) Then
If Not connStrings.SectionInformation.IsProtected Then
If Not connStrings.ElementInformation.IsLocked Then
' Protect the section.
connStrings.SectionInformation.ProtectSection( _
provider)
connStrings.SectionInformation.ForceSave = True
config.Save(ConfigurationSaveMode.Full)
Console.WriteLine( _
"Section {0} is now protected by {1}", _
connStrings.SectionInformation.Name, _
connStrings.SectionInformation.ProtectionProvider.Name)
Else
Console.WriteLine( _
"Can't protect, section {0} is locked", _
connStrings.SectionInformation.Name)
End If
Else
Console.WriteLine( _
"Section {0} is already protected by {1}", _
connStrings.SectionInformation.Name, _
connStrings.SectionInformation.ProtectionProvider.Name)
End If
Else
Console.WriteLine( _
"Can't get the section {0}", _
connStrings.SectionInformation.Name)
End If
End Sub
' Unprotect the connectionStrings section.
Private Shared Sub UnProtectConfiguration()
' Get the application configuration file.
Dim config _
As System.Configuration.Configuration = _
ConfigurationManager.OpenExeConfiguration( _
ConfigurationUserLevel.None)
' Get the section to unprotect.
Dim connStrings _
As ConfigurationSection = config.ConnectionStrings
If Not (connStrings Is Nothing) Then
If connStrings.SectionInformation.IsProtected Then
If Not connStrings.ElementInformation.IsLocked Then
' Unprotect the section.
connStrings.SectionInformation.UnprotectSection()
connStrings.SectionInformation.ForceSave = True
config.Save(ConfigurationSaveMode.Full)
Console.WriteLine( _
"Section {0} is now unprotected.", _
connStrings.SectionInformation.Name)
Else
Console.WriteLine( _
"Can't unprotect, section {0} is locked", _
connStrings.SectionInformation.Name)
End If
Else
Console.WriteLine( _
"Section {0} is already unprotected.", _
connStrings.SectionInformation.Name)
End If
Else
Console.WriteLine( _
"Can't get the section {0}", _
connStrings.SectionInformation.Name)
End If
End Sub
Public Shared Sub Main(ByVal args() As String)
Dim selection As String = String.Empty
If args.Length = 0 Then
Console.WriteLine( _
"Select createkey, protect or unprotect")
Return
End If
selection = args(0).ToLower()
Select Case selection
' Create the key to use during
' encryption/decryption.
Case "createkey"
Dim keyContainer As String = "pcKey.txt"
' Instantiate the custom provider.
Dim provider _
As New TripleDESProtectedConfigurationProvider()
' Create the encryption/decryption key.
provider.CreateKey(keyContainer)
Console.WriteLine( _
"New TripleDES key created in {0}", _
keyContainer)
Case "protect"
ProtectConfiguration()
Case "unprotect"
UnProtectConfiguration()
Case Else
Console.WriteLine("Unknown selection")
End Select
Console.Read()
End Sub
End Class
End Namespace
注解
可以加密配置文件的各个部分，以保护应用程序使用的敏感信息。 这样，即使攻击者获得配置文件的访问权限，也难以进行未经授权的访问，从而提高安全性。
.NET 包含两个受保护的配置提供程序，可用于加密配置文件的节。 RsaProtectedConfigurationProvider 类使用 RSACryptoServiceProvider 来加密配置节。 DpapiProtectedConfigurationProvider 类使用 Windows 数据保护 API （DPAPI） 加密配置部分。
你可能要求使用 RSA 或 DPAPI 提供程序以外的算法加密敏感信息。 在这种情况下，可以生成自己的自定义受保护配置提供程序。 ProtectedConfigurationProvider 是一个抽象基类，必须从中创建自己的受保护配置提供程序。
无论是使用标准提供程序还是自定义提供程序，都必须确保在 configProtectedData 配置节的 providers 节中使用 add 元素进行配置。 （请参阅下一个示例。
有关详细信息，请参阅 实现受保护的配置提供程序。
注意
ASP.NET 遇到加密的配置数据时，它会使用配置的提供程序以透明方式执行解密。 除了确保配置所需的提供程序之外，不需要在你的一边执行任何操作。
构造函数
| ProtectedConfigurationProvider() |
使用默认设置初始化 ProtectedConfigurationProvider 类的新实例。 |
属性
| Description |
获取适合在管理工具或其他用户界面（UI）中显示的简短友好说明。 (继承自 ProviderBase) |
| Name |
获取用于在配置期间引用提供程序的友好名称。 (继承自 ProviderBase) |
方法
| Decrypt(XmlNode) |
解密配置文件中传递的 XmlNode 对象。 |
| Encrypt(XmlNode) |
加密配置文件中传递的 XmlNode 对象。 |
| Equals(Object) |
确定指定的对象是否等于当前对象。 (继承自 Object) |
| GetHashCode() |
用作默认哈希函数。 (继承自 Object) |
| GetType() |
获取当前实例的 Type。 (继承自 Object) |
| Initialize(String, NameValueCollection) |
初始化配置生成器。 (继承自 ProviderBase) |
| MemberwiseClone() |
创建当前 Object的浅表副本。 (继承自 Object) |
| ToString() |
返回一个表示当前对象的字符串。 (继承自 Object) |
