ProtectedConfigurationProvider 類別
定義
重要
部分資訊涉及發行前產品，在發行之前可能會有大幅修改。 Microsoft 對此處提供的資訊，不做任何明確或隱含的瑕疵擔保。
用來建立提供者的基類，用於加密和解密受保護的組態數據。
public ref class ProtectedConfigurationProvider abstract : System::Configuration::Provider::ProviderBasepublic abstract class ProtectedConfigurationProvider : System.Configuration.Provider.ProviderBasetype ProtectedConfigurationProvider = class
inherit ProviderBasePublic MustInherit Class ProtectedConfigurationProvider
Inherits ProviderBase- 繼承
- 衍生
範例
下列範例示範如何實作自訂 ProtectedConfigurationProvider。
若要能夠設定此提供者，如下一個組態摘錄所示，您必須將其安裝在全域程式集緩存 （GAC） 中。 如需詳細資訊，請參閱 實作受保護的組態提供者。
using System;
using System.Xml;
using System.Security.Cryptography;
using System.IO;
using System.Text;
using System.Configuration.Provider;
using System.Collections.Specialized;
using System.Configuration;
namespace Samples.AspNet
{
// Shows how to create a custom protected configuration
// provider.
public class TripleDESProtectedConfigurationProvider :
ProtectedConfigurationProvider
{
private TripleDESCryptoServiceProvider des =
new TripleDESCryptoServiceProvider();
private string pKeyFilePath;
private string pName;
// Gets the path of the file
// containing the key used to
// encryption or decryption.
public string KeyFilePath
{
get { return pKeyFilePath; }
}
// Gets the provider name.
public override string Name
{
get { return pName; }
}
// Performs provider initialization.
public override void Initialize(string name,
NameValueCollection config)
{
pName = name;
pKeyFilePath = config["keyContainerName"];
ReadKey(KeyFilePath);
}
// Performs encryption.
public override XmlNode Encrypt(XmlNode node)
{
string encryptedData = EncryptString(node.OuterXml);
XmlDocument xmlDoc = new XmlDocument();
xmlDoc.PreserveWhitespace = true;
xmlDoc.LoadXml("<EncryptedData>" +
encryptedData + "</EncryptedData>");
return xmlDoc.DocumentElement;
}
// Performs decryption.
public override XmlNode Decrypt(XmlNode encryptedNode)
{
string decryptedData =
DecryptString(encryptedNode.InnerText);
XmlDocument xmlDoc = new XmlDocument();
xmlDoc.PreserveWhitespace = true;
xmlDoc.LoadXml(decryptedData);
return xmlDoc.DocumentElement;
}
// Encrypts a configuration section and returns
// the encrypted XML as a string.
private string EncryptString(string encryptValue)
{
byte[] valBytes =
Encoding.Unicode.GetBytes(encryptValue);
ICryptoTransform transform = des.CreateEncryptor();
MemoryStream ms = new MemoryStream();
CryptoStream cs = new CryptoStream(ms,
transform, CryptoStreamMode.Write);
cs.Write(valBytes, 0, valBytes.Length);
cs.FlushFinalBlock();
byte[] returnBytes = ms.ToArray();
cs.Close();
return Convert.ToBase64String(returnBytes);
}
// Decrypts an encrypted configuration section and
// returns the unencrypted XML as a string.
private string DecryptString(string encryptedValue)
{
byte[] valBytes =
Convert.FromBase64String(encryptedValue);
ICryptoTransform transform = des.CreateDecryptor();
MemoryStream ms = new MemoryStream();
CryptoStream cs = new CryptoStream(ms,
transform, CryptoStreamMode.Write);
cs.Write(valBytes, 0, valBytes.Length);
cs.FlushFinalBlock();
byte[] returnBytes = ms.ToArray();
cs.Close();
return Encoding.Unicode.GetString(returnBytes);
}
// Generates a new TripleDES key and vector and
// writes them to the supplied file path.
public void CreateKey(string filePath)
{
des.GenerateKey();
des.GenerateIV();
StreamWriter sw = new StreamWriter(filePath, false);
sw.WriteLine(ByteToHex(des.Key));
sw.WriteLine(ByteToHex(des.IV));
sw.Close();
}
// Reads in the TripleDES key and vector from
// the supplied file path and sets the Key
// and IV properties of the
// TripleDESCryptoServiceProvider.
private void ReadKey(string filePath)
{
StreamReader sr = new StreamReader(filePath);
string keyValue = sr.ReadLine();
string ivValue = sr.ReadLine();
des.Key = HexToByte(keyValue);
des.IV = HexToByte(ivValue);
}
// Converts a byte array to a hexadecimal string.
private string ByteToHex(byte[] byteArray)
{
string outString = "";
foreach (Byte b in byteArray)
outString += b.ToString("X2");
return outString;
}
// Converts a hexadecimal string to a byte array.
private byte[] HexToByte(string hexString)
{
byte[] returnBytes = new byte[hexString.Length / 2];
for (int i = 0; i < returnBytes.Length; i++)
returnBytes[i] =
Convert.ToByte(hexString.Substring(i * 2, 2), 16);
return returnBytes;
}
}
}
Imports System.Xml
Imports System.Security.Cryptography
Imports System.IO
Imports System.Text
Imports System.Configuration.Provider
Imports System.Collections.Specialized
Imports System.Configuration
' Shows how to create a custom protected configuration
' provider.
Namespace Samples.AspNet
Public Class TripleDESProtectedConfigurationProvider
Inherits ProtectedConfigurationProvider
Private des _
As New TripleDESCryptoServiceProvider()
Private pKeyFilePath As String
Private pName As String
' Gets the path of the file
' containing the key used to
' encrypt/decrypt.
Public ReadOnly Property KeyFilePath() As String
Get
Return pKeyFilePath
End Get
End Property
' Gets the provider name.
Public Overrides ReadOnly Property Name() As String
Get
Return pName
End Get
End Property
' Performs provider initialization.
Public Overrides Sub Initialize( _
ByVal name As String, _
ByVal config As NameValueCollection)
pName = name
pKeyFilePath = config("keyContainerName")
ReadKey(KeyFilePath)
End Sub
' Performs encryption.
Public Overrides Function Encrypt( _
ByVal node As XmlNode) As XmlNode
Dim encryptedData As String = _
EncryptString(node.OuterXml)
Dim xmlDoc As New XmlDocument()
xmlDoc.PreserveWhitespace = True
xmlDoc.LoadXml( _
("<EncryptedData>" + encryptedData + _
"</EncryptedData>"))
Return xmlDoc.DocumentElement
End Function 'Encrypt
' Performs decryption.
Public Overrides Function Decrypt( _
ByVal encryptedNode As XmlNode) As XmlNode
Dim decryptedData As String = _
DecryptString(encryptedNode.InnerText)
Dim xmlDoc As New XmlDocument()
xmlDoc.PreserveWhitespace = True
xmlDoc.LoadXml(decryptedData)
Return xmlDoc.DocumentElement
End Function 'Decrypt
' Encrypts a configuration section and returns
' the encrypted XML as a string.
Private Function EncryptString( _
ByVal encryptValue As String) As String
Dim valBytes As Byte() = _
Encoding.Unicode.GetBytes(encryptValue)
Dim transform As ICryptoTransform = _
des.CreateEncryptor()
Dim ms As New MemoryStream()
Dim cs As New CryptoStream(ms, _
transform, CryptoStreamMode.Write)
cs.Write(valBytes, 0, valBytes.Length)
cs.FlushFinalBlock()
Dim returnBytes As Byte() = ms.ToArray()
cs.Close()
Return Convert.ToBase64String(returnBytes)
End Function 'EncryptString
' Decrypts an encrypted configuration section and
' returns the unencrypted XML as a string.
Private Function DecryptString( _
ByVal encryptedValue As String) As String
Dim valBytes As Byte() = _
Convert.FromBase64String(encryptedValue)
Dim transform As ICryptoTransform = _
des.CreateDecryptor()
Dim ms As New MemoryStream()
Dim cs As New CryptoStream(ms, _
transform, CryptoStreamMode.Write)
cs.Write(valBytes, 0, valBytes.Length)
cs.FlushFinalBlock()
Dim returnBytes As Byte() = ms.ToArray()
cs.Close()
Return Encoding.Unicode.GetString(returnBytes)
End Function 'DecryptString
' Generates a new TripleDES key and vector and
' writes them to the supplied file path.
Public Sub CreateKey(ByVal filePath As String)
des.GenerateKey()
des.GenerateIV()
Dim sw As New StreamWriter(filePath, False)
sw.WriteLine(ByteToHex(des.Key))
sw.WriteLine(ByteToHex(des.IV))
sw.Close()
End Sub
' Reads in the TripleDES key and vector from
' the supplied file path and sets the Key
' and IV properties of the
' TripleDESCryptoServiceProvider.
Private Sub ReadKey(ByVal filePath As String)
Dim sr As New StreamReader(filePath)
Dim keyValue As String = sr.ReadLine()
Dim ivValue As String = sr.ReadLine()
des.Key = HexToByte(keyValue)
des.IV = HexToByte(ivValue)
End Sub
' Converts a byte array to a hexadecimal string.
Private Function ByteToHex( _
ByVal byteArray() As Byte) As String
Dim outString As String = ""
Dim b As [Byte]
For Each b In byteArray
outString += b.ToString("X2")
Next b
Return outString
End Function 'ByteToHex
' Converts a hexadecimal string to a byte array.
Private Function HexToByte(ByVal hexString As String) As Byte()
Dim returnBytes(hexString.Length / 2) As Byte
Dim i As Integer
For i = 0 To returnBytes.Length - 1
returnBytes(i) = _
Convert.ToByte(hexString.Substring(i * 2, 2), 16)
Next i
Return returnBytes
End Function 'HexToByte
End Class
End Namespace
下列範例示範如何使用先前的自定義 ProtectedConfigurationProvider。
using System;
using System.Configuration;
using Samples.AspNet.Configuration;
namespace Samples.AspNet.Configuration
{
// Show how to use a custom protected configuration
// provider.
public class TestingProtectedConfigurationProvider
{
// Protect the connectionStrings section.
private static void ProtectConfiguration()
{
// Get the application configuration file.
System.Configuration.Configuration config =
ConfigurationManager.OpenExeConfiguration(
ConfigurationUserLevel.None);
// Define the provider name.
string provider =
"TripleDESProtectedConfigurationProvider";
// Get the section to protect.
ConfigurationSection connStrings =
config.ConnectionStrings;
if (connStrings != null)
{
if (!connStrings.SectionInformation.IsProtected)
{
if (!connStrings.ElementInformation.IsLocked)
{
// Protect the section.
connStrings.SectionInformation.ProtectSection(provider);
connStrings.SectionInformation.ForceSave = true;
config.Save(ConfigurationSaveMode.Full);
Console.WriteLine("Section {0} is now protected by {1}",
connStrings.SectionInformation.Name,
connStrings.SectionInformation.ProtectionProvider.Name);
}
else
Console.WriteLine(
"Can't protect, section {0} is locked",
connStrings.SectionInformation.Name);
}
else
Console.WriteLine(
"Section {0} is already protected by {1}",
connStrings.SectionInformation.Name,
connStrings.SectionInformation.ProtectionProvider.Name);
}
else
Console.WriteLine("Can't get the section {0}",
connStrings.SectionInformation.Name);
}
// Unprotect the connectionStrings section.
private static void UnProtectConfiguration()
{
// Get the application configuration file.
System.Configuration.Configuration config =
ConfigurationManager.OpenExeConfiguration(
ConfigurationUserLevel.None);
// Get the section to unprotect.
ConfigurationSection connStrings =
config.ConnectionStrings;
if (connStrings != null)
{
if (connStrings.SectionInformation.IsProtected)
{
if (!connStrings.ElementInformation.IsLocked)
{
// Unprotect the section.
connStrings.SectionInformation.UnprotectSection();
connStrings.SectionInformation.ForceSave = true;
config.Save(ConfigurationSaveMode.Full);
Console.WriteLine("Section {0} is now unprotected.",
connStrings.SectionInformation.Name);
}
else
Console.WriteLine(
"Can't unprotect, section {0} is locked",
connStrings.SectionInformation.Name);
}
else
Console.WriteLine(
"Section {0} is already unprotected.",
connStrings.SectionInformation.Name);
}
else
Console.WriteLine("Can't get the section {0}",
connStrings.SectionInformation.Name);
}
public static void Main(string[] args)
{
string selection = string.Empty;
if (args.Length == 0)
{
Console.WriteLine(
"Select createkey, protect or unprotect");
return;
}
selection = args[0].ToLower();
switch (selection)
{
// Create the key to use during
// encryption/decryption.
case "createkey":
string keyContainer =
"pcKey.txt";
// Instantiate the custom provider.
TripleDESProtectedConfigurationProvider
provider =
new TripleDESProtectedConfigurationProvider();
// Create the encryption/decryption key.
provider.CreateKey(keyContainer);
Console.WriteLine(
"New TripleDES key created in {0}",
keyContainer);
break;
case "protect":
ProtectConfiguration();
break;
case "unprotect":
UnProtectConfiguration();
break;
default:
Console.WriteLine("Unknown selection");
break;
}
Console.Read();
}
}
}
Imports System.Configuration
Namespace Samples.AspNet
' Show how to use a custom protected configuration
' provider.
Public Class TestingProtectedConfigurationProvider
' Protect the connectionStrings section.
Private Shared Sub ProtectConfiguration()
' Get the application configuration file.
Dim config _
As System.Configuration.Configuration = _
ConfigurationManager.OpenExeConfiguration( _
ConfigurationUserLevel.None)
' Define the provider name.
Dim provider As String = _
"TripleDESProtectedConfigurationProvider"
' Get the section to protect.
Dim connStrings _
As ConfigurationSection = config.ConnectionStrings
If Not (connStrings Is Nothing) Then
If Not connStrings.SectionInformation.IsProtected Then
If Not connStrings.ElementInformation.IsLocked Then
' Protect the section.
connStrings.SectionInformation.ProtectSection( _
provider)
connStrings.SectionInformation.ForceSave = True
config.Save(ConfigurationSaveMode.Full)
Console.WriteLine( _
"Section {0} is now protected by {1}", _
connStrings.SectionInformation.Name, _
connStrings.SectionInformation.ProtectionProvider.Name)
Else
Console.WriteLine( _
"Can't protect, section {0} is locked", _
connStrings.SectionInformation.Name)
End If
Else
Console.WriteLine( _
"Section {0} is already protected by {1}", _
connStrings.SectionInformation.Name, _
connStrings.SectionInformation.ProtectionProvider.Name)
End If
Else
Console.WriteLine( _
"Can't get the section {0}", _
connStrings.SectionInformation.Name)
End If
End Sub
' Unprotect the connectionStrings section.
Private Shared Sub UnProtectConfiguration()
' Get the application configuration file.
Dim config _
As System.Configuration.Configuration = _
ConfigurationManager.OpenExeConfiguration( _
ConfigurationUserLevel.None)
' Get the section to unprotect.
Dim connStrings _
As ConfigurationSection = config.ConnectionStrings
If Not (connStrings Is Nothing) Then
If connStrings.SectionInformation.IsProtected Then
If Not connStrings.ElementInformation.IsLocked Then
' Unprotect the section.
connStrings.SectionInformation.UnprotectSection()
connStrings.SectionInformation.ForceSave = True
config.Save(ConfigurationSaveMode.Full)
Console.WriteLine( _
"Section {0} is now unprotected.", _
connStrings.SectionInformation.Name)
Else
Console.WriteLine( _
"Can't unprotect, section {0} is locked", _
connStrings.SectionInformation.Name)
End If
Else
Console.WriteLine( _
"Section {0} is already unprotected.", _
connStrings.SectionInformation.Name)
End If
Else
Console.WriteLine( _
"Can't get the section {0}", _
connStrings.SectionInformation.Name)
End If
End Sub
Public Shared Sub Main(ByVal args() As String)
Dim selection As String = String.Empty
If args.Length = 0 Then
Console.WriteLine( _
"Select createkey, protect or unprotect")
Return
End If
selection = args(0).ToLower()
Select Case selection
' Create the key to use during
' encryption/decryption.
Case "createkey"
Dim keyContainer As String = "pcKey.txt"
' Instantiate the custom provider.
Dim provider _
As New TripleDESProtectedConfigurationProvider()
' Create the encryption/decryption key.
provider.CreateKey(keyContainer)
Console.WriteLine( _
"New TripleDES key created in {0}", _
keyContainer)
Case "protect"
ProtectConfiguration()
Case "unprotect"
UnProtectConfiguration()
Case Else
Console.WriteLine("Unknown selection")
End Select
Console.Read()
End Sub
End Class
End Namespace
備註
您可以加密組態檔的區段，以保護應用程式所使用的敏感性資訊。 即使攻擊者取得組態檔的存取權，這也能改善安全性。即使攻擊者取得組態檔的存取權，也難以進行未經授權的存取。
.NET 包含兩個受保護的組態提供者，可用來加密組態檔的區段。 RsaProtectedConfigurationProvider 類別會使用 RSACryptoServiceProvider 來加密組態區段。 DpapiProtectedConfigurationProvider 類別會使用 Windows 資料保護 API （DPAPI） 來加密組態區段。
您可能需要使用 RSA 或 DPAPI 提供者以外的演算法來加密敏感性資訊。 在此情況下，您可以建置自己的自定義受保護組態提供者。 ProtectedConfigurationProvider 是抽象基類，您必須繼承此類別，才能建立自己的受保護組態提供者。
無論您使用標準或自定義提供者，都必須確定已使用 configProtectedData 組態區段的 providers 區段中的 add 元素進行設定。 （請參閱下一個範例。
如需詳細資訊，請參閱 實作受保護的設定提供者。
注意
當 ASP.NET 遇到加密的組態數據時，它會使用已設定的提供者以透明方式執行解密。 除了確定您設定必要的提供者之外，您不需要採取任何動作。
建構函式
| ProtectedConfigurationProvider() |
使用預設設定，初始化 ProtectedConfigurationProvider 類別的新實例。 |
屬性
| Description |
取得簡短且易記的描述，適合顯示在系統管理工具或其他使用者介面中。 (繼承來源 ProviderBase) |
| Name |
取得組態期間用來參考提供者的易記名稱。 (繼承來源 ProviderBase) |
方法
| Decrypt(XmlNode) |
從組態檔解密傳遞 XmlNode 物件。 |
| Encrypt(XmlNode) |
從組態檔加密傳遞 XmlNode 物件。 |
| Equals(Object) |
判斷指定的物件是否等於目前的物件。 (繼承來源 Object) |
| GetHashCode() |
做為預設哈希函式。 (繼承來源 Object) |
| GetType() |
取得目前實例的 Type。 (繼承來源 Object) |
| Initialize(String, NameValueCollection) |
初始化組態產生器。 (繼承來源 ProviderBase) |
| MemberwiseClone() |
建立目前 Object的淺層複本。 (繼承來源 Object) |
| ToString() |
傳回表示目前 物件的字串。 (繼承來源 Object) |
