Azure斑点的动态加密

Question

我不知道还有什么其他的选择：1。将blob下载到云服务的文件系统（或者azure文件存储帐户）并加密它。2.将加密文件上传到目的blob存储帐户。3.从共享中删除加密文件。

在这种情况下，是否有其他方法可以奏效？

Answer 1

在这种情况下，是否有其他方法可以奏效？

据我所知，azure存储有两种加密。

一种是服务器端加密，Azure Storage在保存到存储之前自动加密数据，在检索之前自动解密数据。加密、解密和密钥管理对用户是完全透明的。

我们可以创建一个本地rsa密钥来加密它，然后您可以将这个rsa密钥存储在本地。

如果要从blob中解密加密的内容，可以使用rsa密钥。

更多详细信息，您可以参考下面的示例：

 public class LocalResolver : IKeyResolver
    {
        private Dictionary<string, IKey> keys = new Dictionary<string, IKey>();

        public void Add(IKey key)
        {
            keys[key.Kid] = key;
        }

        public async Task<IKey> ResolveKeyAsync(string kid, CancellationToken token)
        {
            IKey result;

            keys.TryGetValue(kid, out result);

            return await Task.FromResult(result);
        }
    }

  static void Main(string[] args)
        {
            Console.WriteLine("Blob encryption sample");

            // Retrieve storage account information from connection string
            // How to create a storage connection string - https://azure.microsoft.com/en-us/documentation/articles/storage-configure-connection-string/
            CloudStorageAccount storageAccount = CloudStorageAccount.Parse(
            "DefaultEndpointsProtocol=https;AccountName=brandofirststorage;AccountKey=4j8EjQzNtkzQ22Xp3NZcxvJz/+PUOOOQRTSZ9TieQg1lYM6eBCDpKoJgMcNWoG6p1GjMQhkYrxPKRBralzQoZA==;EndpointSuffix=core.windows.net");

            CloudBlobClient client = storageAccount.CreateCloudBlobClient();
            CloudBlobContainer container = client.GetContainerReference("example");


                container.CreateIfNotExists();
                int size = 5 * 1024 * 1024;
                byte[] buffer = new byte[size];

                Random rand = new Random();
                rand.NextBytes(buffer);

                CloudBlockBlob blob = container.GetBlockBlobReference("test");

                // Create the IKey used for encryption.
                RsaKey key = new RsaKey("private:key1");

                // Create the encryption policy to be used for upload.
                BlobEncryptionPolicy uploadPolicy = new BlobEncryptionPolicy(key, null);

                // Set the encryption policy on the request options.
                BlobRequestOptions uploadOptions = new BlobRequestOptions() { EncryptionPolicy = uploadPolicy };

                Console.WriteLine("Uploading the encrypted blob.");

                // Upload the encrypted contents to the blob.
                using (MemoryStream stream = new MemoryStream(buffer))
                {
                    blob.UploadFromStream(stream, size, null, uploadOptions, null);
                }





                // Download the encrypted blob.
                // For downloads, a resolver can be set up that will help pick the key based on the key id.
                LocalResolver resolver = new LocalResolver();
                resolver.Add(key);

                BlobEncryptionPolicy downloadPolicy = new BlobEncryptionPolicy(null, resolver);

                // Set the decryption policy on the request options.
                BlobRequestOptions downloadOptions = new BlobRequestOptions() { EncryptionPolicy = downloadPolicy };

                Console.WriteLine("Downloading the encrypted blob.");

                // Download and decrypt the encrypted contents from the blob.
                using (MemoryStream outputStream = new MemoryStream())
                {
                    blob.DownloadToStream(outputStream, null, downloadOptions, null);
                }

                Console.WriteLine("Press enter key to exit");
                Console.ReadLine();


        }