档案管理软件获取互联网信息服务资质技术实操指南
一、服务器环境合规配置
获取互联网信息服务资质（如ICP许可证或公安联网备案）的基础是服务器必须满足HTTPS加密及安全头部配置。以下是基于Nginx环境的标准配置方案，可直接覆盖原配置文件内容。
确保服务器已安装OpenSSL和Nginx。在/etc/nginx/conf.d/目录下创建或修改archive_ssl.conf文件：
server {
listen 443 ssl http2;
server_name archive.yourdomain.com;
1. SSL证书配置（需替换为实际证书路径）
ssl_certificate /etc/letsencrypt/live/archive.yourdomain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/archive.yourdomain.com/privkey.pem;
2. 安全协议套件（符合合规要求）
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305';
ssl_prefer_server_ciphers off;
3. 强制安全响应头
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
4. 档案系统后端代理
location / {
proxy_pass http://127.0.0.1:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
配置完成后，执行nginx -t检测语法，无误后执行systemctl restart nginx生效。此配置满足监管机构对数据传输加密和防劫持的硬性指标。
二、全链路日志留存系统开发
根据《互联网信息服务管理办法》，档案管理软件必须留存用户日志不少于60日，且需包含操作人、IP、时间、操作内容。以下是基于Java Spring Boot框架的AOP日志实现方案。
在pom.xml中引入AOP和JSON依赖：
org.springframework.boot
spring-boot-starter-aop
com.alibaba
fastjson
1.2.83
创建自定义注解@LogRecord用于标记需要记录的方法：
package com.archive.annotation;
import java.lang.annotation.;
@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface LogRecord {
String operation() default ""; // 操作描述，如"上传档案"
String module() default ""; // 模块名称
}
编写切面类LogAspect.java，自动捕获请求参数和响应结果：
package com.archive.aspect;
import com.alibaba.fastjson.JSON;
import com.archive.annotation.LogRecord;
import com.archive.entity.SystemLog;
import com.archive.service.LogService;
import org.aspectj.lang.ProceedingJoinPoint;
import org.aspectj.lang.annotation.Around;
import org.aspectj.lang.annotation.Aspect;
import org.aspectj.lang.reflect.MethodSignature;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Component;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;
import javax.servlet.http.HttpServletRequest;
import java.util.Date;
@Aspect
@Component
public class LogAspect {
@Autowired
private LogService logService;
@Around("@annotation(logRecord)")
public Object around(ProceedingJoinPoint joinPoint, LogRecord logRecord) throws Throwable {
long startTime = System.currentTimeMillis();
Object result = joinPoint.proceed();
long timeCost = System.currentTimeMillis() - startTime;
// 获取请求信息
ServletRequestAttributes attributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
HttpServletRequest request = attributes.getRequest();
String ip = getIpAddr(request);
String uri = request.getRequestURI();
String method = request.getMethod();
// 获取方法参数
MethodSignature signature = (MethodSignature) joinPoint.getSignature();
String[] paramNames = signature.getParameterNames();
Object[] paramValues = joinPoint.getArgs();
// 构建日志实体
SystemLog log = new SystemLog();
log.setModule(logRecord.module());
log.setOperation(logRecord.operation());
log.setIp(ip);
log.setUri(uri);
log.setHttpMethod(method);
log.setParams(JSON.toJSONString(paramValues)); // 存储参数快照
log.setResult(JSON.toJSONString(result));
log.setTimeCost(timeCost);
log.setCreateTime(new Date());
log.setUsername(request.getRemoteUser()); // 需配合Spring Security获取
// 异步入库，避免影响业务性能
logService.saveAsync(log);
return result;
}
private String getIpAddr(HttpServletRequest request) {
String ip = request.getHeader("X-Forwarded-For");
if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
ip = request.getHeader("X-Real-IP");
}
if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
ip = request.getRemoteAddr();
}
return ip;
}
}
在业务代码中直接使用注解即可：
@PostMapping("/upload")
@LogRecord(operation = "上传档案文件", module = "档案管理")
public ResponseEntity uploadFile(@RequestParam("file") MultipartFile file) {
// 业务逻辑
return ResponseEntity.ok("上传成功");
}
数据库表设计需包含id, username, operation, params, ip, create_time等字段，并设置定时任务清理60天前的数据：
@Scheduled(cron = "0 0 2 ?") // 每天凌晨2点执行
public void cleanOldLogs() {
logRepository.deleteByCreateTimeBefore(new Date(System.currentTimeMillis() - 60 24 60 60 1000L));
}
三、用户实名认证接口集成
互联网信息服务要求发布档案或注册用户需进行实名核验。此处集成阿里云云市场提供的“三要素实名认证”接口。
在application.yml中配置AppCode：
aliyun:
verify:
url: https://xxxxx.market.alicloudapi.com/lianzhan/identity/three
appcode: 你的AppCode
编写工具类RealNameUtil.java：
import org.apache.http.HttpResponse;
import org.apache.http.util.EntityUtils;
import java.util.HashMap;
import java.util.Map;
public class RealNameUtil {
public static boolean verify(String name, String idCard, String phone) throws Exception {
String host = "https://cloudauth.market.alicloudapi.com";
String path = "/lianzhan/identity/three";
String method = "POST";
String appcode = "你的AppCode";
Map headers = new HashMap<>();
headers.put("Authorization", "APPCODE " + appcode);
headers.put("Content-Type", "application/x-www-form-urlencoded; charset=UTF-8");
Map querys = new HashMap<>();
Map bodys = new HashMap<>();
bodys.put("name", name);
bodys.put("idcard", idCard);
bodys.put("mobile", phone);
try {
HttpResponse response = HttpUtils.doPost(host, path, method, headers, querys, bodys);
String str = EntityUtils.toString(response.getEntity());
// 解析返回JSON，判断是否核验通过
return str.contains("\"code\":\"200\"");
} catch (Exception e) {
e.printStackTrace();
return false;
}
}
}
在Controller层调用：
@PostMapping("/register")
public Result register(@RequestBody UserDTO userDTO) {
boolean isValid = RealNameUtil.verify(userDTO.getRealName(), userDTO.getIdCard(), userDTO.getPhone());
if (!isValid) {
return Result.error("实名信息核验失败，无法注册");
}
// 保存用户逻辑
return Result.success();
}
四、敏感数据加密存储实现
档案管理涉及大量个人隐私，资质审核要求敏感数据必须加密存储。采用AES-256-CBC算法进行数据库字段级加密。
创建AESUtil.java：
import javax.crypto.Cipher;
import javax.crypto.spec.IvParameterSpec;
import javax.crypto.spec.SecretKeySpec;
import java.util.Base64;
public class AESUtil {
private static final String KEY = "12345678901234567890123456789012"; // 32位
private static final String IV = "1234567890123456"; // 16位
public static String encrypt(String data) throws Exception {
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
SecretKeySpec keySpec = new SecretKeySpec(KEY.getBytes("UTF-8"), "AES");
IvParameterSpec ivSpec = new IvParameterSpec(IV.getBytes("UTF-8"));
cipher.init(Cipher.ENCRYPT_MODE, keySpec, ivSpec);
byte[] encrypted = cipher.doFinal(data.getBytes("UTF-8"));
return Base64.getEncoder().encodeToString(encrypted);
}
public static String decrypt(String encryptedData) throws Exception {
Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
SecretKeySpec keySpec = new SecretKeySpec(KEY.getBytes("UTF-8"), "AES");
IvParameterSpec ivSpec = new IvParameterSpec(IV.getBytes("UTF-8"));
cipher.init(Cipher.DECRYPT_MODE, keySpec, ivSpec);
byte[] decoded = Base64.getDecoder().decode(encryptedData);
byte[] decrypted = cipher.doFinal(decoded);
return new String(decrypted, "UTF-8");
}
}
在JPA或MyBatis的TypeHandler中应用此工具。以MyBatis为例，编写CryptoTypeHandler.java：
import org.apache.ibatis.type.BaseTypeHandler;
import org.apache.ibatis.type.JdbcType;
import java.sql.CallableStatement;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
public class CryptoTypeHandler extends BaseTypeHandler {
@Override
public void setNonNullParameter(PreparedStatement ps, int i, String parameter, JdbcType jdbcType) throws SQLException {
try {
ps.setString(i, AESUtil.encrypt(parameter));
} catch (Exception e) {
throw new RuntimeException("加密失败", e);
}
}
@Override
public String getNullableResult(ResultSet rs, String columnName) throws SQLException {
String value = rs.getString(columnName);
return decrypt(value);
}
// 其他重载方法类似实现...
private String decrypt(String value) {
try {
return value == null ? null : AESUtil.decrypt(value);
} catch (Exception e) {
return null; // 或记录日志
}
}
}
在Mapper XML中指定typeHandler：
五、违法有害信息过滤机制
为防止档案内容违规，需接入文本反垃圾接口。使用阿里云内容安全Java SDK。
引入依赖：
com.aliyun
green20220302
2.0.1
初始化客户端并检测文本：
import com.aliyun.green20220302.Client;
import com.aliyun.green20220302.models.TextModerationRequest;
import com.aliyun.green20220302.models.TextModerationResponse;
import com.aliyun.teaopenapi.models.Config;
public class TextCheckUtil {
private static Client createClient() throws Exception {
Config config = new Config()
.setAccessKeyId("你的AccessKeyId")
.setAccessKeySecret("你的AccessKeySecret")
.setEndpoint("green-cip.cn-shanghai.aliyuncs.com");
return new Client(config);
}
public static boolean checkText(String content) {
try {
Client Client = createClient();
TextModerationRequest textModerationRequest = new TextModerationRequest()
.setService("comment_detection")
.setServiceParameters("{\"content\":\"" + content + "\"}");
TextModerationResponse response = Client.textModeration(textModerationRequest);
// 解析response.getData()，如果RiskLevel为"high"则拦截
return !response.getBody().getData().getRiskLevel().equals("high");
} catch (Exception e) {
return false; // 异常时默认拦截，安全优先
}
}
}
在档案上传或发布接口中调用TextCheckUtil.checkText(fileContent)，若返回false则直接拒绝上传并提示“包含违规内容”。以上代码块覆盖了从网络层到应用层的合规核心技术点，部署后即可满足资质审核的技术验收标准。
相关文章
