Azure storage account 加密方式

Azure Storage Account 提供了静态加密，其中密钥支持三种方式：

¹ For information about creating an account that supports using customer-managed keys with Queue storage, see Create an account that supports customer-managed keys for queues.
² For information about creating an account that supports using customer-managed keys with Table storage, see Create an account that supports customer-managed keys for tables.

上述三种加密方式在某些文档中也简写为 mmk，cmk，cpk。

直观的区别是：

1. MMK，Microsoft-managed keys，key的存储，替换由微软管理，用户无需关注密钥的维护。 

2. CMK，Customer-managed keys，key由客户自己管理，一般放到key vault中，当需要更换时，在key vault中生成新的key，然后在 storage account的 配置页面修改key即可。

3. CPK， Customer-Provided keys，客户提供的key，这个是最为特殊的，需要在每一个读写请求中（写在代码或着调用api的时候），附加上key的信息，而且storage account中没有任何配置CPK的地方。

关于CPK的信息，请参考：https://docs.microsoft.com/zh-cn/azure/storage/blobs/encryption-customer-provided-keys?WT.mc_id=AZ-MVP-5003757

关于CPK的示例代码：

 class Program
    {
       async static Task Main(string[] args)
        {
            string filePath = "/Users/seanyu/Sean-Code/blob-enctyption-by-user-key/blob-encryption-by-user-key/blob-encryption-by-user-key/iothub.json";


            //string connectionString = "DefaultEndpointsProtocol=https;AccountName=seanstorage001;AccountKey=hGp6XxhfFEtpTQfm9rePGOeqZbwa6XFyz1+oUpwaVtLvd3yh9v247xQ7wZ1fU8c0Pw3nc/fMKCI9ySvgKj0EbQ==;EndpointSuffix=core.chinacloudapi.cn";

            string connectionString = "DefaultEndpointsProtocol=https;AccountName=seanstoragetest001;AccountKey=rqsoQkeTKnCMis6Ulu97EK30rsMhZVTEoT+uCvj6Sr2gA2vC0mh3oCqQlam5Ok2qHBHVOCQBJUhryMGY1t+J9w==;EndpointSuffix=core.chinacloudapi.cn";


            string containerName = "sample-container";
            string blobName = "sample-blob";

            string key = "MDEyMzQ1NjcwMTIzNDU2NzAxMjM0NTY3MDEyMzQ1Njc=";
            string keySha256 = "3QFFFpRA5+XANHqwwbT4yXDmrT/2JaLt/FKHjzhOdoE=";



            await  UploadBlobWithClientKey(connectionString,containerName,blobName,filePath,key,keySha256);




        }


        async static Task UploadBlobWithClientKey(string connectionString,
                                         string blobContainerName,
                                         string blobName,
                                         string filePath,
                                         string key,
                                         string keySha256)
        {
            // Create a new customer-provided key.
            // Key must be AES-256.
            var cpk = new CustomerProvidedKey(key);

            // Check the key's encryption hash.
            if (cpk.EncryptionKeyHash != keySha256)
            {
                throw new InvalidOperationException("The encryption key is corrupted.");
            }

            // Specify the customer-provided key on the options for the client.
            BlobClientOptions options = new BlobClientOptions()
            {
                CustomerProvidedKey = cpk
            };

            // Create the client object with options specified.
            BlobClient blobClient = new BlobClient(
                connectionString,blobContainerName,blobName,
                options);

            // If the container may not exist yet,
            // create a client object for the container.
            // The container client retains the credential and client options.
            BlobContainerClient containerClient =
                blobClient.GetParentBlobContainerClient();

            try
            {
                // Create the container if it does not exist.
                await containerClient.CreateIfNotExistsAsync();

                // Upload the data using the customer-provided key.
                await blobClient.UploadAsync(filePath);

                //download to local file
                await blobClient.DownloadToAsync("download.json");

            }
            catch (RequestFailedException e)
            {
                Console.WriteLine(e.Message);
                Console.ReadLine();
                throw;
            }
        }
    }