c#之在 Web Api 后端加密 Json 结果

我用数据加密完成了我的 web api，但现在，我必须加密 Json 结果。当我将查询字符串放在浏览器上时，现在我有了答案(示例):

[{"SUSPID":"111","IVNOME":"teste","IVMAE":"teste","IVPAI":"teste","IVDATANASC":"02/07/1970","IVRG":"0000 (IFP)","ICPF":"Não Cadastrado"}]

我无法展示这个……我必须展示(加密):[{"SUSPID":"AUAUAUA","IVNOME":"UAUAU","IVMAE":"UAUAU", ..... .]

我看到了一些例子，但我没有找到我需要的例子

我的服务(客户端)的部分代码:

var response = await client.GetAsync(urllink); 
var JsonResult = response.Content.ReadAsStringAsync().Result; 
if (typeof(T) == typeof(string)) 
    return null; 
var rootobject = JsonConvert.DeserializeObject<T>(JsonResult); 
return rootobject; 

在我的 Controller (web api BackEnd)，我返回这个数据集:

return lretorno.Tables[0].AsEnumerable().Select(row => new Envolvido 
                { 
                    SUSPID = Convert.ToString(row["SUSPID"]), 
                    IVNOME = Convert.ToString(row["SUSPNOME"]), 
                    IVMAE = Convert.ToString(row["SUSPMAE"]), 
                    IVPAI = Convert.ToString(row["SUSPPAI"]), 
                    IVDATANASC = Convert.ToString(row["SUSPDATANASC"]).Replace(" 00:00:00", ""), 
                    IVRG = Convert.ToString(row["RG"]), 
                    ICPF = Convert.ToString(row["CPF"]), 
                    MANDADO = Convert.ToInt16(row["TEMMANDADO"]), 
                    OCORRENCIA = Convert.ToInt16(row["TEMOCORRENCIA"]), 
 
                }); 

我不明白我必须在哪里加密以及我必须在代码上解密什么地方。

请您参考如下方法:

如果你真的必须在 https 之上做一些额外的加密，例如，如果你想帮助停止自动 man-in-the-middle您可以执行以下操作...这将需要中间人(政府、ISP、电信公司、端点网络管理员)通过具体弄清楚您如何传递额外的公钥来进行中间人攻击。除此之外，您还可以在加密之前在 JSON 中包含“pk”参数......然后当您解密 json 时，您可以将它与您发送的公钥进行比较，如果它们不匹配则肯定有一个中间人。我使用了内置的 RSACryptoServiceProvider .

客户端

// Generate private and public keys (use any asymmetric crypto/key size you want) 
RSACryptoServiceProvider rsaKeys = new RSACryptoServiceProvider(); 
var privateXmlKeys = rsaKeys.ToXmlString(true); 
var publicXmlKeys = rsaKeys.ToXmlString(false); 
 
// Make the request for the json data from the server, and also pass along the public xml keys encoded as base64  
var response = await http.GetAsync(new Uri(String.Format("https://example.com/data?id=777&pk=\"{0}\"", Convert.ToBase64String(Encoding.ASCII.GetBytes(publicXmlKeys))))); 
var encryptedJsonBytes = await response.Content.ReadAsByteArrayAsync(); 
 
// Decrypt the bytes using the private key generated earlier 
RSACryptoServiceProvider rsaDecrypt = new RSACryptoServiceProvider(); 
rsaDecrypt.FromXmlString(privateXmlKeys); 
byte[] decryptedBytes = rsaDecrypt.Decrypt(encryptedJsonBytes, false); 
 
// Now change from bytes to string 
string jsonString = Encoding.ASCII.GetString(decryptedBytes); 
// TODO: For extra validation, parse json, get the public key out that the server 
//       had used to encrypt, and compare with the "pk" you sent "publicXmlKeys", 
//       if these values do not match there was an attack. 

服务器端

// Assuming you have your JSON string already 
string json = "{\"key\":\"secret_value\"}"; 
 
 
// Get the "pk" request parameter from the http request however you need to 
string base64PublicKey = request.getParameter("pk"); 
string publicXmlKey = Encoding.ASCII.GetString(Convert.FromBase64String(base64PublicKey)); 
 
// TODO: If you want the extra validation, insert "publicXmlKey" into the json value before  
//       converting it to bytes 
// var jo = parse(json); jo.pk = publicXmlKey; json = jo.ToString(); 
 
// Convert the string to bytes 
byte[] jsonBytes = Encoding.ASCII.GetBytes(json); 
 
// Encrypt the json using the public key provided by the client 
RSACryptoServiceProvider rsaEncrypt = new RSACryptoServiceProvider(); 
rsaEncrypt.FromXmlString(publicXmlKey); 
byte[] encryptedJsonBytes = rsaEncrypt.Encrypt(jsonBytes, false); 
 
// Send the encrypted json back to the client 
return encryptedJsonBytes; 

如果您需要防止中间人攻击，那么我建议您关闭计算机或通过其他方法预共享 key ，而不是通过互联网、电话或邮件，然后不要将其嵌入到您的应用程序中:P 查看Off-the-record , End-to-end-encryption和 Diffie–Hellman key exchange