#!/usr/bin/env python3
"""
零信任架构分析器
评估和设计零信任安全架构
"""

import json
import logging
from typing import Dict, List, Any, Optional
from dataclasses import dataclass, asdict
from enum import Enum
import hashlib
import time
from datetime import datetime, timedelta

# 配置日志
logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(__name__)

class TrustLevel(Enum):
    """信任级别枚举"""
    UNTRUSTED = 0
    LOW = 1
    MEDIUM = 2
    HIGH = 3
    VERIFIED = 4

class RiskLevel(Enum):
    """风险级别枚举"""
    LOW = 1
    MEDIUM = 2
    HIGH = 3
    CRITICAL = 4

@dataclass
class User:
    """用户实体"""
    user_id: str
    username: str
    email: str
    roles: List[str]
    department: str
    trust_score: float
    last_login: datetime
    failed_attempts: int
    mfa_enabled: bool
    device_registered: bool

@dataclass
class Device:
    """设备实体"""
    device_id: str
    device_type: str
    os_version: str
    security_patch_level: str
    compliance_status: bool
    trust_score: float
    last_seen: datetime
    location: str
    owner: str

@dataclass
class AccessRequest:
    """访问请求"""
    request_id: str
    user_id: str
    device_id: str
    resource: str
    action: str
    timestamp: datetime
    source_ip: str
    location: str
    user_agent: str

@dataclass
class PolicyRule:
    """策略规则"""
    rule_id: str
    name: str
    description: str
    conditions: Dict[str, Any]
    actions: List[str]
    priority: int
    enabled: bool

class ZeroTrustArchitectureAnalyzer:
    """零信任架构分析器"""
    
    def __init__(self):
        self.users: Dict[str, User] = {}
        self.devices: Dict[str, Device] = {}
        self.policies: Dict[str, PolicyRule] = {}
        self.access_logs: List[AccessRequest] = []
        self.risk_scores: Dict[str, float] = {}
        
    def register_user(self, user: User) -> bool:
        """注册用户"""
        try:
            # 验证用户信息
            if not user.user_id or not user.email:
                logger.error("用户ID和邮箱不能为空")
                return False
            
            # 计算初始信任分数
            trust_score = self._calculate_user_trust_score(user)
            user.trust_score = trust_score
            
            self.users[user.user_id] = user
            logger.info(f"用户 {user.username} 注册成功，信任分数: {trust_score}")
            return True
            
        except Exception as e:
            logger.error(f"用户注册失败: {e}")
            return False
    
    def register_device(self, device: Device) -> bool:
        """注册设备"""
        try:
            # 验证设备信息
            if not device.device_id or not device.device_type:
                logger.error("设备ID和类型不能为空")
                return False
            
            # 计算设备信任分数
            trust_score = self._calculate_device_trust_score(device)
            device.trust_score = trust_score
            
            self.devices[device.device_id] = device
            logger.info(f"设备 {device.device_id} 注册成功，信任分数: {trust_score}")
            return True
            
        except Exception as e:
            logger.error(f"设备注册失败: {e}")
            return False
    
    def create_policy(self, policy: PolicyRule) -> bool:
        """创建策略规则"""
        try:
            if not policy.rule_id or not policy.name:
                logger.error("策略ID和名称不能为空")
                return False
            
            self.policies[policy.rule_id] = policy
            logger.info(f"策略 {policy.name} 创建成功")
            return True
            
        except Exception as e:
            logger.error(f"策略创建失败: {e}")
            return False
    
    def evaluate_access_request(self, request: AccessRequest) -> Dict[str, Any]:
        """评估访问请求"""
        try:
            # 获取用户和设备信息
            user = self.users.get(request.user_id)
            device = self.devices.get(request.device_id)
            
            if not user:
                return {
                    'allowed': False,
                    'reason': '用户未注册',
                    'risk_level': RiskLevel.CRITICAL.name,
                    'trust_score': 0
                }
            
            if not device:
                return {
                    'allowed': False,
                    'reason': '设备未注册',
                    'risk_level': RiskLevel.HIGH.name,
                    'trust_score': 0
                }
            
            # 计算综合风险分数
            risk_score = self._calculate_risk_score(request, user, device)
            
            # 应用策略规则
            policy_result = self._apply_policies(request, user, device, risk_score)
            
            # 记录访问请求
            self.access_logs.append(request)
            
            # 更新用户和设备信任分数
            self._update_trust_scores(request, user, device, policy_result['allowed'])
            
            return {
                'allowed': policy_result['allowed'],
                'reason': policy_result['reason'],
                'risk_level': self._get_risk_level(risk_score).name,
                'trust_score': (user.trust_score + device.trust_score) / 2,
                'required_actions': policy_result.get('required_actions', []),
                'session_timeout': policy_result.get('session_timeout', 3600)
            }
            
        except Exception as e:
            logger.error(f"访问请求评估失败: {e}")
            return {
                'allowed': False,
                'reason': f'评估失败: {e}',
                'risk_level': RiskLevel.CRITICAL.name,
                'trust_score': 0
            }
    
    def _calculate_user_trust_score(self, user: User) -> float:
        """计算用户信任分数"""
        score = 50.0  # 基础分数
        
        # MFA启用加分
        if user.mfa_enabled:
            score += 20
        
        # 设备注册加分
        if user.device_registered:
            score += 15
        
        # 角色权重
        if 'admin' in user.roles:
            score += 10
        elif 'user' in user.roles:
            score += 5
        
        # 失败尝试扣分
        score -= user.failed_attempts * 5
        
        # 最近登录时间
        if user.last_login:
            days_since_login = (datetime.now() - user.last_login).days
            if days_since_login > 30:
                score -= 10
            elif days_since_login > 7:
                score -= 5
        
        return max(0, min(100, score))
    
    def _calculate_device_trust_score(self, device: Device) -> float:
        """计算设备信任分数"""
        score = 50.0  # 基础分数
        
        # 合规状态
        if device.compliance_status:
            score += 25
        else:
            score -= 20
        
        # 设备类型
        if device.device_type in ['laptop', 'desktop']:
            score += 10
        elif device.device_type in ['mobile', 'tablet']:
            score += 5
        
        # 安全补丁级别
        if device.security_patch_level == 'latest':
            score += 15
        elif device.security_patch_level == 'recent':
            score += 10
        elif device.security_patch_level == 'outdated':
            score -= 15
        
        # 最近活动
        if device.last_seen:
            hours_since_seen = (datetime.now() - device.last_seen).total_seconds() / 3600
            if hours_since_seen > 168:  # 一周
                score -= 10
            elif hours_since_seen > 24:  # 一天
                score -= 5
        
        return max(0, min(100, score))
    
    def _calculate_risk_score(self, request: AccessRequest, user: User, device: Device) -> float:
        """计算访问请求风险分数"""
        risk_score = 0.0
        
        # 用户风险因素
        if user.failed_attempts > 3:
            risk_score += 30
        
        if not user.mfa_enabled:
            risk_score += 25
        
        # 设备风险因素
        if not device.compliance_status:
            risk_score += 35
        
        if device.security_patch_level == 'outdated':
            risk_score += 20
        
        # 访问模式风险
        risk_score += self._analyze_access_pattern(request, user)
        
        # 地理位置风险
        risk_score += self._analyze_location_risk(request, user, device)
        
        # 时间风险
        risk_score += self._analyze_time_risk(request)
        
        return min(100, risk_score)
    
    def _analyze_access_pattern(self, request: AccessRequest, user: User) -> float:
        """分析访问模式风险"""
        risk = 0.0
        
        # 获取用户历史访问记录
        user_logs = [log for log in self.access_logs if log.user_id == user.user_id]
        
        if len(user_logs) < 5:
            # 新用户或访问记录少
            risk += 10
        else:
            # 分析访问频率
            recent_logs = [log for log in user_logs 
                          if (datetime.now() - log.timestamp).days <= 7]
            
            if len(recent_logs) > 50:
                # 异常高频访问
                risk += 15
            
            # 分析访问资源类型
            accessed_resources = set(log.resource for log in recent_logs)
            if request.resource not in accessed_resources:
                # 访问新资源
                risk += 5
        
        return risk
    
    def _analyze_location_risk(self, request: AccessRequest, user: User, device: Device) -> float:
        """分析地理位置风险"""
        risk = 0.0
        
        # 简化的地理位置风险分析
        # 实际实现中应该使用更精确的地理位置服务
        
        # 检查IP地址变化
        recent_logs = [log for log in self.access_logs 
                      if log.user_id == user.user_id and 
                      (datetime.now() - log.timestamp).hours <= 24]
        
        if recent_logs:
            recent_ips = set(log.source_ip for log in recent_logs)
            if request.source_ip not in recent_ips:
                risk += 10
        
        # 检查设备位置变化
        if device.location != request.location:
            risk += 15
        
        return risk
    
    def _analyze_time_risk(self, request: AccessRequest) -> float:
        """分析时间风险"""
        risk = 0.0
        
        # 检查访问时间
        hour = request.timestamp.hour
        
        # 非工作时间访问
        if hour < 6 or hour > 22:
            risk += 10
        
        # 周末访问
        if request.timestamp.weekday() >= 5:
            risk += 5
        
        return risk
    
    def _apply_policies(self, request: AccessRequest, user: User, device: Device, risk_score: float) -> Dict[str, Any]:
        """应用策略规则"""
        result = {
            'allowed': False,
            'reason': '默认拒绝',
            'required_actions': [],
            'session_timeout': 3600
        }
        
        # 按优先级排序策略
        sorted_policies = sorted(self.policies.values(), key=lambda p: p.priority, reverse=True)
        
        for policy in sorted_policies:
            if not policy.enabled:
                continue
            
            if self._match_policy_conditions(policy, request, user, device, risk_score):
                # 执行策略动作
                for action in policy.actions:
                    if action == 'allow':
                        result['allowed'] = True
                        result['reason'] = f'策略 {policy.name} 允许访问'
                    elif action == 'deny':
                        result['allowed'] = False
                        result['reason'] = f'策略 {policy.name} 拒绝访问'
                        return result  # 拒绝策略立即返回
                    elif action == 'require_mfa':
                        result['required_actions'].append('mfa')
                    elif action == 'require_device_verification':
                        result['required_actions'].append('device_verification')
                    elif action.startswith('session_timeout:'):
                        timeout = int(action.split(':')[1])
                        result['session_timeout'] = timeout
                
                # 如果匹配到策略，停止处理后续策略
                break
        
        return result
    
    def _match_policy_conditions(self, policy: PolicyRule, request: AccessRequest, 
                                user: User, device: Device, risk_score: float) -> bool:
        """匹配策略条件"""
        conditions = policy.conditions
        
        # 检查用户条件
        if 'user_roles' in conditions:
            required_roles = conditions['user_roles']
            if not any(role in user.roles for role in required_roles):
                return False
        
        if 'user_trust_score_min' in conditions:
            if user.trust_score < conditions['user_trust_score_min']:
                return False
        
        # 检查设备条件
        if 'device_compliance' in conditions:
            if device.compliance_status != conditions['device_compliance']:
                return False
        
        if 'device_trust_score_min' in conditions:
            if device.trust_score < conditions['device_trust_score_min']:
                return False
        
        # 检查风险条件
        if 'max_risk_score' in conditions:
            if risk_score > conditions['max_risk_score']:
                return False
        
        # 检查资源条件
        if 'resources' in conditions:
            allowed_resources = conditions['resources']
            if request.resource not in allowed_resources:
                return False
        
        # 检查时间条件
        if 'allowed_hours' in conditions:
            allowed_hours = conditions['allowed_hours']
            current_hour = request.timestamp.hour
            if current_hour not in allowed_hours:
                return False
        
        return True
    
    def _get_risk_level(self, risk_score: float) -> RiskLevel:
        """获取风险级别"""
        if risk_score >= 75:
            return RiskLevel.CRITICAL
        elif risk_score >= 50:
            return RiskLevel.HIGH
        elif risk_score >= 25:
            return RiskLevel.MEDIUM
        else:
            return RiskLevel.LOW
    
    def _update_trust_scores(self, request: AccessRequest, user: User, device: Device, allowed: bool):
        """更新信任分数"""
        if allowed:
            # 成功访问，轻微提升信任分数
            user.trust_score = min(100, user.trust_score + 1)
            device.trust_score = min(100, device.trust_score + 1)
            user.failed_attempts = 0
        else:
            # 访问被拒绝，降低信任分数
            user.trust_score = max(0, user.trust_score - 5)
            device.trust_score = max(0, device.trust_score - 3)
            user.failed_attempts += 1
    
    def generate_security_report(self) -> Dict[str, Any]:
        """生成安全报告"""
        total_requests = len(self.access_logs)
        if total_requests == 0:
            return {'message': '暂无访问记录'}
        
        # 统计访问成功率（这里简化处理，实际需要记录访问结果）
        recent_logs = [log for log in self.access_logs 
                      if (datetime.now() - log.timestamp).days <= 7]
        
        # 用户风险分析
        high_risk_users = [user for user in self.users.values() 
                          if user.trust_score < 30]
        
        # 设备风险分析
        non_compliant_devices = [device for device in self.devices.values() 
                               if not device.compliance_status]
        
        # 访问模式分析
        resource_access_count = {}
        for log in recent_logs:
            resource_access_count[log.resource] = resource_access_count.get(log.resource, 0) + 1
        
        most_accessed_resources = sorted(resource_access_count.items(), 
                                       key=lambda x: x[1], reverse=True)[:10]
        
        return {
            'report_time': datetime.now().isoformat(),
            'total_users': len(self.users),
            'total_devices': len(self.devices),
            'total_policies': len(self.policies),
            'recent_access_requests': len(recent_logs),
            'high_risk_users': len(high_risk_users),
            'non_compliant_devices': len(non_compliant_devices),
            'most_accessed_resources': most_accessed_resources,
            'average_user_trust_score': sum(u.trust_score for u in self.users.values()) / len(self.users) if self.users else 0,
            'average_device_trust_score': sum(d.trust_score for d in self.devices.values()) / len(self.devices) if self.devices else 0
        }

def main():
    """主函数 - 演示零信任架构分析器"""
    analyzer = ZeroTrustArchitectureAnalyzer()
    
    # 注册用户
    user1 = User(
        user_id="user001",
        username="alice",
        email="alice@company.com",
        roles=["user", "developer"],
        department="engineering",
        trust_score=0,
        last_login=datetime.now() - timedelta(days=1),
        failed_attempts=0,
        mfa_enabled=True,
        device_registered=True
    )
    analyzer.register_user(user1)
    
    # 注册设备
    device1 = Device(
        device_id="device001",
        device_type="laptop",
        os_version="Windows 11",
        security_patch_level="latest",
        compliance_status=True,
        trust_score=0,
        last_seen=datetime.now(),
        location="Beijing",
        owner="alice"
    )
    analyzer.register_device(device1)
    
    # 创建策略
    policy1 = PolicyRule(
        rule_id="policy001",
        name="开发者访问策略",
        description="允许开发者访问开发环境",
        conditions={
            "user_roles": ["developer"],
            "device_compliance": True,
            "max_risk_score": 30,
            "resources": ["dev-server", "test-db"],
            "allowed_hours": list(range(8, 18))  # 8:00-18:00
        },
        actions=["allow", "session_timeout:7200"],
        priority=10,
        enabled=True
    )
    analyzer.create_policy(policy1)
    
    # 模拟访问请求
    request1 = AccessRequest(
        request_id="req001",
        user_id="user001",
        device_id="device001",
        resource="dev-server",
        action="read",
        timestamp=datetime.now(),
        source_ip="192.168.1.100",
        location="Beijing",
        user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64)"
    )
    
    # 评估访问请求
    result = analyzer.evaluate_access_request(request1)
    print("访问请求评估结果:")
    print(json.dumps(result, indent=2, ensure_ascii=False))
    
    # 生成安全报告
    report = analyzer.generate_security_report()
    print("\n安全报告:")
    print(json.dumps(report, indent=2, ensure_ascii=False))

if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
数据加密管理系统
实现端到端数据加密、密钥管理和数据分类
"""

import os
import json
import logging
import hashlib
import hmac
import base64
import time
from typing import Dict, List, Any, Optional, Tuple
from dataclasses import dataclass, asdict
from enum import Enum
from cryptography.fernet import Fernet
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import rsa, padding
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
import secrets

# 配置日志
logging.basicConfig(level=logging.INFO)
logger = logging.getLogger(__name__)

class DataClassification(Enum):
    """数据分类级别"""
    PUBLIC = "public"
    INTERNAL = "internal"
    CONFIDENTIAL = "confidential"
    RESTRICTED = "restricted"
    TOP_SECRET = "top_secret"

class EncryptionAlgorithm(Enum):
    """加密算法"""
    AES_256_GCM = "aes_256_gcm"
    CHACHA20_POLY1305 = "chacha20_poly1305"
    RSA_4096 = "rsa_4096"
    FERNET = "fernet"

@dataclass
class DataPolicy:
    """数据策略"""
    classification: DataClassification
    encryption_required: bool
    encryption_algorithm: EncryptionAlgorithm
    key_rotation_days: int
    access_roles: List[str]
    retention_days: int
    audit_required: bool

@dataclass
class EncryptionKey:
    """加密密钥"""
    key_id: str
    algorithm: EncryptionAlgorithm
    key_data: bytes
    created_at: float
    expires_at: Optional[float]
    classification: DataClassification
    usage_count: int
    max_usage: Optional[int]

@dataclass
class EncryptedData:
    """加密数据"""
    data_id: str
    encrypted_content: bytes
    key_id: str
    algorithm: EncryptionAlgorithm
    iv: Optional[bytes]
    tag: Optional[bytes]
    classification: DataClassification
    metadata: Dict[str, Any]
    created_at: float

class DataEncryptionManager:
    """数据加密管理器"""
    
    def __init__(self):
        self.keys: Dict[str, EncryptionKey] = {}
        self.data_store: Dict[str, EncryptedData] = {}
        self.policies: Dict[DataClassification, DataPolicy] = {}
        self.audit_log: List[Dict[str, Any]] = []
        
        # 初始化默认策略
        self._initialize_default_policies()
    
    def _initialize_default_policies(self):
        """初始化默认数据策略"""
        self.policies = {
            DataClassification.PUBLIC: DataPolicy(
                classification=DataClassification.PUBLIC,
                encryption_required=False,
                encryption_algorithm=EncryptionAlgorithm.FERNET,
                key_rotation_days=365,
                access_roles=["*"],
                retention_days=2555,  # 7年
                audit_required=False
            ),
            DataClassification.INTERNAL: DataPolicy(
                classification=DataClassification.INTERNAL,
                encryption_required=True,
                encryption_algorithm=EncryptionAlgorithm.AES_256_GCM,
                key_rotation_days=180,
                access_roles=["employee"],
                retention_days=1825,  # 5年
                audit_required=True
            ),
            DataClassification.CONFIDENTIAL: DataPolicy(
                classification=DataClassification.CONFIDENTIAL,
                encryption_required=True,
                encryption_algorithm=EncryptionAlgorithm.AES_256_GCM,
                key_rotation_days=90,
                access_roles=["manager", "admin"],
                retention_days=1095,  # 3年
                audit_required=True
            ),
            DataClassification.RESTRICTED: DataPolicy(
                classification=DataClassification.RESTRICTED,
                encryption_required=True,
                encryption_algorithm=EncryptionAlgorithm.CHACHA20_POLY1305,
                key_rotation_days=30,
                access_roles=["admin"],
                retention_days=365,  # 1年
                audit_required=True
            ),
            DataClassification.TOP_SECRET: DataPolicy(
                classification=DataClassification.TOP_SECRET,
                encryption_required=True,
                encryption_algorithm=EncryptionAlgorithm.CHACHA20_POLY1305,
                key_rotation_days=7,
                access_roles=["security_admin"],
                retention_days=90,
                audit_required=True
            )
        }
    
    def generate_key(self, classification: DataClassification, 
                    algorithm: EncryptionAlgorithm = None) -> str:
        """生成加密密钥"""
        try:
            policy = self.policies.get(classification)
            if not policy:
                raise ValueError(f"未找到分类 {classification} 的策略")
            
            if algorithm is None:
                algorithm = policy.encryption_algorithm
            
            key_id = self._generate_key_id()
            
            # 根据算法生成密钥
            if algorithm == EncryptionAlgorithm.AES_256_GCM:
                key_data = os.urandom(32)  # 256位密钥
            elif algorithm == EncryptionAlgorithm.CHACHA20_POLY1305:
                key_data = os.urandom(32)  # 256位密钥
            elif algorithm == EncryptionAlgorithm.RSA_4096:
                private_key = rsa.generate_private_key(
                    public_exponent=65537,
                    key_size=4096
                )
                key_data = private_key.private_bytes(
                    encoding=serialization.Encoding.PEM,
                    format=serialization.PrivateFormat.PKCS8,
                    encryption_algorithm=serialization.NoEncryption()
                )
            elif algorithm == EncryptionAlgorithm.FERNET:
                key_data = Fernet.generate_key()
            else:
                raise ValueError(f"不支持的加密算法: {algorithm}")
            
            # 计算过期时间
            expires_at = time.time() + (policy.key_rotation_days * 24 * 3600)
            
            # 创建密钥对象
            encryption_key = EncryptionKey(
                key_id=key_id,
                algorithm=algorithm,
                key_data=key_data,
                created_at=time.time(),
                expires_at=expires_at,
                classification=classification,
                usage_count=0,
                max_usage=None
            )
            
            self.keys[key_id] = encryption_key
            
            # 记录审计日志
            self._log_audit("key_generated", {
                "key_id": key_id,
                "algorithm": algorithm.value,
                "classification": classification.value
            })
            
            logger.info(f"生成密钥 {key_id}，算法: {algorithm.value}")
            return key_id
            
        except Exception as e:
            logger.error(f"生成密钥失败: {e}")
            raise
    
    def encrypt_data(self, data: bytes, classification: DataClassification, 
                    key_id: str = None, metadata: Dict[str, Any] = None) -> str:
        """加密数据"""
        try:
            policy = self.policies.get(classification)
            if not policy:
                raise ValueError(f"未找到分类 {classification} 的策略")
            
            if not policy.encryption_required and classification != DataClassification.PUBLIC:
                logger.warning(f"分类 {classification} 不要求加密，但仍然执行加密")
            
            # 如果没有指定密钥，生成新密钥
            if key_id is None:
                key_id = self.generate_key(classification, policy.encryption_algorithm)
            
            encryption_key = self.keys.get(key_id)
            if not encryption_key:
                raise ValueError(f"密钥 {key_id} 不存在")
            
            # 检查密钥是否过期
            if encryption_key.expires_at and time.time() > encryption_key.expires_at:
                raise ValueError(f"密钥 {key_id} 已过期")
            
            # 检查密钥使用次数
            if encryption_key.max_usage and encryption_key.usage_count >= encryption_key.max_usage:
                raise ValueError(f"密钥 {key_id} 使用次数已达上限")
            
            data_id = self._generate_data_id()
            iv = None
            tag = None
            
            # 根据算法加密数据
            if encryption_key.algorithm == EncryptionAlgorithm.AES_256_GCM:
                iv = os.urandom(12)  # GCM推荐12字节IV
                cipher = Cipher(
                    algorithms.AES(encryption_key.key_data),
                    modes.GCM(iv)
                )
                encryptor = cipher.encryptor()
                encrypted_content = encryptor.update(data) + encryptor.finalize()
                tag = encryptor.tag
                
            elif encryption_key.algorithm == EncryptionAlgorithm.CHACHA20_POLY1305:
                iv = os.urandom(12)  # ChaCha20需要12字节nonce
                cipher = Cipher(
                    algorithms.ChaCha20(encryption_key.key_data, iv),
                    modes.GCM(b'\x00' * 16)  # ChaCha20-Poly1305
                )
                encryptor = cipher.encryptor()
                encrypted_content = encryptor.update(data) + encryptor.finalize()
                tag = encryptor.tag
                
            elif encryption_key.algorithm == EncryptionAlgorithm.FERNET:
                fernet = Fernet(encryption_key.key_data)
                encrypted_content = fernet.encrypt(data)
                
            elif encryption_key.algorithm == EncryptionAlgorithm.RSA_4096:
                private_key = serialization.load_pem_private_key(
                    encryption_key.key_data,
                    password=None
                )
                public_key = private_key.public_key()
                
                # RSA加密有长度限制，需要分块加密
                max_chunk_size = 446  # 4096位RSA密钥的最大明文长度
                encrypted_chunks = []
                
                for i in range(0, len(data), max_chunk_size):
                    chunk = data[i:i + max_chunk_size]
                    encrypted_chunk = public_key.encrypt(
                        chunk,
                        padding.OAEP(
                            mgf=padding.MGF1(algorithm=hashes.SHA256()),
                            algorithm=hashes.SHA256(),
                            label=None
                        )
                    )
                    encrypted_chunks.append(encrypted_chunk)
                
                encrypted_content = b''.join(encrypted_chunks)
            else:
                raise ValueError(f"不支持的加密算法: {encryption_key.algorithm}")
            
            # 创建加密数据对象
            encrypted_data = EncryptedData(
                data_id=data_id,
                encrypted_content=encrypted_content,
                key_id=key_id,
                algorithm=encryption_key.algorithm,
                iv=iv,
                tag=tag,
                classification=classification,
                metadata=metadata or {},
                created_at=time.time()
            )
            
            self.data_store[data_id] = encrypted_data
            
            # 更新密钥使用计数
            encryption_key.usage_count += 1
            
            # 记录审计日志
            if policy.audit_required:
                self._log_audit("data_encrypted", {
                    "data_id": data_id,
                    "key_id": key_id,
                    "classification": classification.value,
                    "data_size": len(data)
                })
            
            logger.info(f"数据加密完成，数据ID: {data_id}")
            return data_id
            
        except Exception as e:
            logger.error(f"数据加密失败: {e}")
            raise
    
    def decrypt_data(self, data_id: str, user_roles: List[str] = None) -> bytes:
        """解密数据"""
        try:
            encrypted_data = self.data_store.get(data_id)
            if not encrypted_data:
                raise ValueError(f"数据 {data_id} 不存在")
            
            # 检查访问权限
            policy = self.policies.get(encrypted_data.classification)
            if policy and user_roles:
                if not any(role in policy.access_roles or "*" in policy.access_roles 
                          for role in user_roles):
                    raise PermissionError(f"用户角色 {user_roles} 无权访问 {encrypted_data.classification.value} 级别数据")
            
            encryption_key = self.keys.get(encrypted_data.key_id)
            if not encryption_key:
                raise ValueError(f"密钥 {encrypted_data.key_id} 不存在")
            
            # 根据算法解密数据
            if encrypted_data.algorithm == EncryptionAlgorithm.AES_256_GCM:
                cipher = Cipher(
                    algorithms.AES(encryption_key.key_data),
                    modes.GCM(encrypted_data.iv, encrypted_data.tag)
                )
                decryptor = cipher.decryptor()
                decrypted_data = decryptor.update(encrypted_data.encrypted_content) + decryptor.finalize()
                
            elif encrypted_data.algorithm == EncryptionAlgorithm.CHACHA20_POLY1305:
                cipher = Cipher(
                    algorithms.ChaCha20(encryption_key.key_data, encrypted_data.iv),
                    modes.GCM(encrypted_data.tag)
                )
                decryptor = cipher.decryptor()
                decrypted_data = decryptor.update(encrypted_data.encrypted_content) + decryptor.finalize()
                
            elif encrypted_data.algorithm == EncryptionAlgorithm.FERNET:
                fernet = Fernet(encryption_key.key_data)
                decrypted_data = fernet.decrypt(encrypted_data.encrypted_content)
                
            elif encrypted_data.algorithm == EncryptionAlgorithm.RSA_4096:
                private_key = serialization.load_pem_private_key(
                    encryption_key.key_data,
                    password=None
                )
                
                # RSA解密需要分块处理
                chunk_size = 512  # 4096位RSA密钥的密文块大小
                decrypted_chunks = []
                
                for i in range(0, len(encrypted_data.encrypted_content), chunk_size):
                    chunk = encrypted_data.encrypted_content[i:i + chunk_size]
                    decrypted_chunk = private_key.decrypt(
                        chunk,
                        padding.OAEP(
                            mgf=padding.MGF1(algorithm=hashes.SHA256()),
                            algorithm=hashes.SHA256(),
                            label=None
                        )
                    )
                    decrypted_chunks.append(decrypted_chunk)
                
                decrypted_data = b''.join(decrypted_chunks)
            else:
                raise ValueError(f"不支持的解密算法: {encrypted_data.algorithm}")
            
            # 记录审计日志
            if policy and policy.audit_required:
                self._log_audit("data_decrypted", {
                    "data_id": data_id,
                    "key_id": encrypted_data.key_id,
                    "classification": encrypted_data.classification.value,
                    "user_roles": user_roles
                })
            
            logger.info(f"数据解密完成，数据ID: {data_id}")
            return decrypted_data
            
        except Exception as e:
            logger.error(f"数据解密失败: {e}")
            raise
    
    def rotate_key(self, old_key_id: str) -> str:
        """轮换密钥"""
        try:
            old_key = self.keys.get(old_key_id)
            if not old_key:
                raise ValueError(f"密钥 {old_key_id} 不存在")
            
            # 生成新密钥
            new_key_id = self.generate_key(old_key.classification, old_key.algorithm)
            
            # 查找使用旧密钥的数据
            affected_data = [
                data for data in self.data_store.values()
                if data.key_id == old_key_id
            ]
            
            # 重新加密数据
            for data in affected_data:
                # 解密数据
                decrypted_content = self.decrypt_data(data.data_id)
                
                # 删除旧数据
                del self.data_store[data.data_id]
                
                # 使用新密钥重新加密
                new_data_id = self.encrypt_data(
                    decrypted_content,
                    data.classification,
                    new_key_id,
                    data.metadata
                )
                
                logger.info(f"数据 {data.data_id} 重新加密为 {new_data_id}")
            
            # 标记旧密钥为已过期
            old_key.expires_at = time.time()
            
            # 记录审计日志
            self._log_audit("key_rotated", {
                "old_key_id": old_key_id,
                "new_key_id": new_key_id,
                "affected_data_count": len(affected_data)
            })
            
            logger.info(f"密钥轮换完成: {old_key_id} -> {new_key_id}")
            return new_key_id
            
        except Exception as e:
            logger.error(f"密钥轮换失败: {e}")
            raise
    
    def classify_data(self, data: bytes, content_type: str = None) -> DataClassification:
        """自动数据分类"""
        try:
            # 简化的数据分类逻辑，实际应用中可以使用机器学习模型
            data_str = data.decode('utf-8', errors='ignore').lower()
            
            # 检查敏感关键词
            top_secret_keywords = ['top secret', 'classified', 'confidential', 'secret key', 'password']
            restricted_keywords = ['restricted', 'internal only', 'private', 'ssn', 'credit card']
            confidential_keywords = ['confidential', 'proprietary', 'financial', 'personal']
            internal_keywords = ['internal', 'employee', 'staff', 'company']
            
            if any(keyword in data_str for keyword in top_secret_keywords):
                return DataClassification.TOP_SECRET
            elif any(keyword in data_str for keyword in restricted_keywords):
                return DataClassification.RESTRICTED
            elif any(keyword in data_str for keyword in confidential_keywords):
                return DataClassification.CONFIDENTIAL
            elif any(keyword in data_str for keyword in internal_keywords):
                return DataClassification.INTERNAL
            else:
                return DataClassification.PUBLIC
                
        except Exception as e:
            logger.warning(f"数据分类失败，使用默认分类: {e}")
            return DataClassification.INTERNAL
    
    def get_data_info(self, data_id: str) -> Dict[str, Any]:
        """获取数据信息"""
        encrypted_data = self.data_store.get(data_id)
        if not encrypted_data:
            return None
        
        return {
            "data_id": data_id,
            "classification": encrypted_data.classification.value,
            "algorithm": encrypted_data.algorithm.value,
            "key_id": encrypted_data.key_id,
            "created_at": encrypted_data.created_at,
            "metadata": encrypted_data.metadata,
            "size": len(encrypted_data.encrypted_content)
        }
    
    def get_key_info(self, key_id: str) -> Dict[str, Any]:
        """获取密钥信息"""
        key = self.keys.get(key_id)
        if not key:
            return None
        
        return {
            "key_id": key_id,
            "algorithm": key.algorithm.value,
            "classification": key.classification.value,
            "created_at": key.created_at,
            "expires_at": key.expires_at,
            "usage_count": key.usage_count,
            "max_usage": key.max_usage,
            "is_expired": key.expires_at and time.time() > key.expires_at
        }
    
    def cleanup_expired_keys(self) -> List[str]:
        """清理过期密钥"""
        current_time = time.time()
        expired_keys = []
        
        for key_id, key in list(self.keys.items()):
            if key.expires_at and current_time > key.expires_at:
                # 检查是否还有数据使用此密钥
                using_data = [
                    data for data in self.data_store.values()
                    if data.key_id == key_id
                ]
                
                if not using_data:
                    del self.keys[key_id]
                    expired_keys.append(key_id)
                    logger.info(f"清理过期密钥: {key_id}")
        
        return expired_keys
    
    def generate_audit_report(self) -> Dict[str, Any]:
        """生成审计报告"""
        current_time = time.time()
        
        # 统计数据
        total_keys = len(self.keys)
        expired_keys = sum(1 for key in self.keys.values() 
                          if key.expires_at and current_time > key.expires_at)
        
        total_data = len(self.data_store)
        data_by_classification = {}
        for data in self.data_store.values():
            classification = data.classification.value
            data_by_classification[classification] = data_by_classification.get(classification, 0) + 1
        
        # 最近的审计事件
        recent_events = [
            event for event in self.audit_log
            if current_time - event['timestamp'] <= 86400  # 最近24小时
        ]
        
        return {
            "report_time": current_time,
            "summary": {
                "total_keys": total_keys,
                "expired_keys": expired_keys,
                "total_encrypted_data": total_data,
                "data_by_classification": data_by_classification
            },
            "recent_events": len(recent_events),
            "audit_log_size": len(self.audit_log)
        }
    
    def _generate_key_id(self) -> str:
        """生成密钥ID"""
        return f"key_{int(time.time())}_{secrets.token_hex(8)}"
    
    def _generate_data_id(self) -> str:
        """生成数据ID"""
        return f"data_{int(time.time())}_{secrets.token_hex(8)}"
    
    def _log_audit(self, action: str, details: Dict[str, Any]):
        """记录审计日志"""
        audit_entry = {
            "timestamp": time.time(),
            "action": action,
            "details": details
        }
        self.audit_log.append(audit_entry)

def main():
    """主函数 - 演示数据加密管理系统"""
    dem = DataEncryptionManager()
    
    # 测试数据
    test_data = b"This is confidential financial data containing sensitive information."
    
    # 自动分类数据
    classification = dem.classify_data(test_data)
    print(f"数据分类: {classification.value}")
    
    # 加密数据
    data_id = dem.encrypt_data(test_data, classification, metadata={"source": "financial_system"})
    print(f"数据已加密，ID: {data_id}")
    
    # 获取数据信息
    data_info = dem.get_data_info(data_id)
    print(f"数据信息: {json.dumps(data_info, indent=2, default=str)}")
    
    # 解密数据
    decrypted_data = dem.decrypt_data(data_id, user_roles=["admin"])
    print(f"解密成功: {decrypted_data == test_data}")
    
    # 密钥轮换
    key_id = data_info["key_id"]
    new_key_id = dem.rotate_key(key_id)
    print(f"密钥轮换: {key_id} -> {new_key_id}")
    
    # 生成审计报告
    report = dem.generate_audit_report()
    print(f"审计报告: {json.dumps(report, indent=2, default=str)}")

if __name__ == "__main__":
    main()