PHP企业级应用安全架构设计

PHP企业级应用安全架构设计

企业应用的安需要从整体架构上考虑。从网络层到应用层，从认证授权到数据加密，每个层次都需要安全防护。今天说说PHP企业应用的安全架构设计。

安全架构的分层模型。每个层次都有对应的安全措施。

```php
class SecurityArchitecture
{
public static function getLayers(): array
{
return [
'网络层' => [
'WAF防火墙',
'DDoS防护',
'HTTPS/TLS',
'IP黑白名单',
],
'应用层' => [
'身份认证',
'授权控制',
'输入验证',
'输出转义',
'CSRF防护',
'SQL注入防护',
'XSS防护',
],
'数据层' => [
'数据加密',
'访问控制',
'审计日志',
'备份恢复',
],
'运维层' => [
'漏洞扫描',
'入侵检测',
'日志监控',
'权限管理',
],
];
}
}
?>
```

多因素认证实现：

```php
interface AuthProvider
{
public function authenticate(string $username, string $password): bool;
}

class DatabaseAuthProvider implements AuthProvider
{
private PDO $pdo;

public function __construct(PDO $pdo)
{
$this->pdo = $pdo;
}

public function authenticate(string $username, string $password): bool
{
$stmt = $this->pdo->prepare("SELECT password FROM users WHERE username = ?");
$stmt->execute([$username]);
$hash = $stmt->fetchColumn();

if ($hash === false) return false;
return password_verify($password, $hash);
}
}

class TotpAuthProvider
{
public function generateSecret(): string
{
return base32_encode(random_bytes(10));
}

public function generateCode(string $secret, int $timeSlice = null): string
{
$timeSlice = $timeSlice ?? floor(time() / 30);
$key = base32_decode($secret);
$time = pack('N*', 0) . pack('N*', $timeSlice);
$hash = hash_hmac('sha1', $time, $key, true);
$offset = ord($hash[19]) & 0x0F;
$code = (
((ord($hash[$offset]) & 0x7F) << 24) |
((ord($hash[$offset + 1]) & 0xFF) << 16) |
((ord($hash[$offset + 2]) & 0xFF) << 8) |
(ord($hash[$offset + 3]) & 0xFF)
) % pow(10, 6);

return str_pad((string)$code, 6, '0', STR_PAD_LEFT);
}

public function verify(string $secret, string $code): bool
{
$timeSlice = floor(time() / 30);

// 检查前后各一个时间窗口
for ($i = -1; $i <= 1; $i++) {
if (hash_equals($this->generateCode($secret, $timeSlice + $i), $code)) {
return true;
}
}

return false;
}

public function getProvisioningUri(string $username, string $secret, string $issuer = 'MyApp'): string
{
$params = http_build_query([
'secret' => $secret,
'issuer' => $issuer,
'algorithm' => 'SHA1',
'digits' => 6,
'period' => 30,
]);

return "otpauth://totp/{$issuer}:{$username}?{$params}";
}
}

function base32_encode(string $data): string
{
$alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
$binary = '';
foreach (str_split($data) as $char) {
$binary .= str_pad(decbin(ord($char)), 8, '0', STR_PAD_LEFT);
}

$encoded = '';
for ($i = 0; $i < strlen($binary); $i += 5) {
$chunk = substr($binary, $i, 5);
$encoded .= $alphabet[bindec($chunk)];
}

return $encoded;
}

function base32_decode(string $data): string
{
$alphabet = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
$binary = '';
foreach (str_split(strtoupper($data)) as $char) {
$pos = strpos($alphabet, $char);
if ($pos !== false) {
$binary .= str_pad(decbin($pos), 5, '0', STR_PAD_LEFT);
}
}

$decoded = '';
for ($i = 0; $i < strlen($binary); $i += 8) {
$chunk = substr($binary, $i, 8);
if (strlen($chunk) >= 8) {
$decoded .= chr(bindec($chunk));
}
}

return $decoded;
}

class MultiFactorAuth
{
private AuthProvider $firstFactor;
private TotpAuthProvider $secondFactor;
private Redis $redis;

public function __construct(AuthProvider $firstFactor, TotpAuthProvider $secondFactor, Redis $redis)
{
$this->firstFactor = $firstFactor;
$this->secondFactor = $secondFactor;
$this->redis = $redis;
}

public function login(string $username, string $password): array
{
if (!$this->firstFactor->authenticate($username, $password)) {
$this->logAttempt($username, false);
return ['success' => false, 'message' => '用户名或密码错误'];
}

// 第一因子通过，生成临时token
$sessionToken = bin2hex(random_bytes(32));
$this->redis->setex("mfa_pending:{$sessionToken}", 300, $username);

$this->logAttempt($username, true);

return [
'success' => true,
'requires_2fa' => true,
'session_token' => $sessionToken,
];
}

public function verify2fa(string $sessionToken, string $code): array
{
$username = $this->redis->get("mfa_pending:{$sessionToken}");
if ($username === false) {
return ['success' => false, 'message' => '会话已过期'];
}

$secret = $this->getUserSecret($username);
if ($this->secondFactor->verify($secret, $code)) {
$this->redis->del("mfa_pending:{$sessionToken}");
$authToken = bin2hex(random_bytes(32));
$this->redis->setex("auth:{$authToken}", 86400, $username);

return ['success' => true, 'token' => $authToken];
}

return ['success' => false, 'message' => '验证码错误'];
}

private function getUserSecret(string $username): string
{
$secret = $this->redis->get("totp_secret:{$username}");
if ($secret === false) {
$secret = $this->secondFactor->generateSecret();
$this->redis->set("totp_secret:{$username}", $secret);
}
return $secret;
}

private function logAttempt(string $username, bool $success): void
{
$log = sprintf(
"[%s] %s 登录%s (IP: %s)\n",
date('Y-m-d H:i:s'),
$username,
$success ? '成功' : '失败',
$_SERVER['REMOTE_ADDR'] ?? 'unknown'
);
file_put_contents('/var/log/auth.log', $log, FILE_APPEND);
}
}
?>
```

API的访问控制和速率限制：

```php
class AccessControl
{
private Redis $redis;
private array $permissions = [];

public function __construct(Redis $redis)
{
$this->redis = $redis;
}

public function checkPermission(string $userId, string $resource, string $action): bool
{
$key = "permissions:{$userId}";
$permissions = $this->redis->sMembers($key);

if (in_array('admin', $permissions)) return true;

return in_array("{$resource}:{$action}", $permissions)
|| in_array("{$resource}:*", $permissions);
}

public function rateLimit(string $key, int $maxRequests, int $window): bool
{
$current = $this->redis->get($key);
if ($current !== false && $current >= $maxRequests) {
return false;
}

if ($current === false) {
$this->redis->setex($key, $window, 1);
} else {
$this->redis->incr($key);
}

return true;
}
}
?>
```

企业级安全架构需要在多个层次设置防护。认证、授权、加密、审计、监控缺一不可。安全不是一次性的工作，需要持续关注和更新。保持依赖包的更新，定期做安全审计，及时修复已知漏洞，才能保障应用的安全运行。