数字王国的第一道门 / The First Gate of the Digital Kingdom

第 1 章：数字王国的第一道门

Chapter 1: The First Gate of the Digital Kingdom

> *"在现实世界里，我们锁门是为了挡住小偷；在数字世界里，我们每点击一次屏幕，也都在推开一扇看不见的门。问题是——这扇门，是谁在守护？"* > *"In the real world, we lock doors to keep thieves out; in the digital world, every tap pushes open an invisible gate. The question is—who is guarding that gate?"*

---

1.0 一则让小明失眠的怪事 / A Story That Kept Xiaoming Awake

小明今年十一岁，是一名五年级的小学生。他像这个时代绝大多数孩子一样，每天放学回家第一件事，是把 iPad 充上电，然后打开一个叫"灵动相册"的 APP，准备整理今天春游时拍的照片。

*Xiaoming is eleven years old, a fifth-grade student. Like most kids of his generation, the first thing he does after school is plug in his iPad and open an app called "Smart Album" to sort through today's spring-excursion photos.*

那天晚上十点，妈妈发现小明的手机屏幕在枕头底下亮了一下。她把手机拿起来，屏幕上赫然出现一条通知：

*That night at 10 p.m., Xiaoming's mother noticed the phone screen glowing under his pillow. She picked it up, and there was a notification on the display:*

> 灵动相册正在访问你的相机胶卷（已读取 47 张照片） > *Smart Album is accessing your camera roll (47 photos read)*

小明这才承认，三天前他在一个短视频里看到一条广告："灵动相册——一键让你的照片会跳舞！"他点了下载链接，安装了一款从未在任何应用商店搜索过的 APP。

*Xiaoming then admitted that three days earlier he had seen an ad on a short-video platform: "Smart Album—make your photos dance with one tap!" He had tapped the download link and installed an app he had never searched for in any official store.*

第二天，技术老师用"果果查询"工具（一个公开的隐私查询网站）查了一下"灵动相册"的开发者——结果令人后背发凉：这款 APP 在后台悄悄调用了「相机、麦克风、相册、通讯录、定位」五项权限，而它真正的功能只是给照片加几个卡通贴纸。

*The next day, his technology teacher ran the developer's name through a public privacy-check site. The result was chilling: the app had silently requested five sensitive permissions—camera, microphone, photo library, contacts, and location—yet its real function was merely to add cartoon stickers to photos.*

小明的 47 张春游照片，可能已经被上传到了一台远在地球另一端的服务器。照片里有同班同学的脸、教室的布置、妈妈给他买的限量版球鞋，甚至还有他在家中书桌前写作业的画面。

*Xiaoming's 47 spring-trip photos may already have been uploaded to a server on the other side of the planet. Among them: his classmates' faces, the layout of his classroom, a pair of limited-edition sneakers his mom had bought him, and even a snapshot of him doing homework at his desk.*

这是 2024 年中国互联网上每天都在发生的故事，也是本书第 1 章要回答的核心问题：在我们每天点击、滑动、登录的数字世界里，究竟谁在保护我们？

*This is a story that happens every day on the Chinese internet in 2024, and it is the core question of Chapter 1: in the digital world where we tap, swipe, and log in every day, who exactly is protecting us?*

答案不是某一个英雄，而是一套叫做"信息安全（Cybersecurity）"的学科。在接下来的小节里，你会学到这套学科的"地基三块砖"——机密性、完整性、可用性。

*The answer is not a single hero, but a discipline called Cybersecurity. In the following sections, you will learn the "three foundation bricks" of this discipline—Confidentiality, Integrity, and Availability.*

---

1.1 数字世界里的"三块砖" / The Three Bricks of the Digital World

1.1.1 一座看不见的城堡 / An Invisible Castle

想象一下，你正在建造一座城堡。这座城堡不需要砖头和水泥，而是由 0 和 1 组成的光脉冲搭建而成。城堡里住着你的照片、聊天记录、作业文件、游戏存档，甚至还有你的银行账户余额。

*Imagine you are building a castle. But this castle is not built of bricks and cement; it is constructed from light pulses made of 0s and 1s. Inside live your photos, chat logs, homework files, game saves, and even your bank-account balance.*

信息安全专家的工作，就是为这座城堡设计三种防护：

*Information-security experts design three kinds of protection for this castle:*

1. 机密性（Confidentiality）——确保只有"对的人"能看见"对的内容"； *Ensure that only the "right people" can see the "right content";*

2. 完整性（Integrity）——确保数据从 A 点到 B 点的旅程中，没有被"偷偷改过"； *Ensure that data traveling from point A to point B has not been "tampered with" along the way;*

3. 可用性（Availability）——确保当你需要打开城堡大门时，门一定开得开。 *Ensure that when you need to open the castle's gate, it always opens.*

这三件事，被信息安全界简称为 CIA 三要素（CIA Triad）。注意，这里的 CIA 不是美国中央情报局（Central Intelligence Agency），而是 Confidentiality（机密性）、Integrity（完整性）、Availability（可用性） 三个英文单词首字母的合称。

*These three things are collectively called the CIA Triad. Note that "CIA" here does not stand for the U.S. Central Intelligence Agency; it is the acronym of the three English words Confidentiality, Integrity, and Availability.*

```mermaid flowchart TD C[Confidentiality<br/>机密性<br/>Only the right people<br/>can read the data] I[Integrity<br/>完整性<br/>The data has not been<br/>tampered with] A[Availability<br/>可用性<br/>The service opens<br/>when you need it] T[CIA Triad<br/>三足鼎立] S[Secure System<br/>真正安全的系统] C --> T I --> T A --> T T --> S ```

> 图 1-1　CIA 三要素的"三足鼎立"结构 > 就像一只三条腿的凳子，缺了任何一条腿，凳子就会倒下。一座真正安全的数字系统，必须同时具备这三项特性。 > > *Figure 1-1: The "three-legged tripod" structure of the CIA Triad. Like a three-legged stool, removing any one leg causes it to collapse. A truly secure digital system must possess all three properties simultaneously.*

1.1.2 机密性：用"看不见的锁"保护隐私 / Confidentiality: "Invisible Locks" for Privacy

机密性（Confidentiality） 是 CIA 三要素中最容易被孩子理解的一条。它的核心问题是：这份数据，是不是只有被授权的人才能看到？

*Confidentiality is the easiest of the three for kids to understand. Its core question is: Can only authorized people see this data?*

让我们回到小明的问题。"灵动相册"在未经小明同意的情况下读取了相册内容，这直接违反了机密性原则——因为照片的"被授权查看者"应该只有小明本人，以及小明明确分享过的家人或朋友。

*Let's return to Xiaoming's case. "Smart Album" reading his photo library without permission directly violates confidentiality—because the "authorized viewers" of those photos should have been only Xiaoming himself, plus family or friends he had explicitly shared with.*

实现机密性，最常见的工具是加密（Encryption）。所谓加密，就是把一段明文（比如"我的银行密码是 123456"）通过数学变换，变成一段密文（比如"xQ#9kLz!2"）。即使黑客拦截了这串字符，看到的也只是一堆无意义的乱码。

*The most common tool for confidentiality is encryption. Encryption transforms a piece of plaintext (e.g., "my bank password is 123456") via a mathematical operation into ciphertext (e.g., "xQ#9kLz!2"). Even if a hacker intercepts that string, all they see is meaningless gibberish.*

你可以把加密想象成一封不可逆的"光之信"——除非你手里有那把特定的钥匙，否则就算信被敌人打开，他们也只会看到一片刺眼的白光，什么都读不出来。

*You can imagine encryption as an "irreversible beam of light" letter—unless you hold the specific key, even if the enemy opens the letter, they only see a blinding white glow and read nothing.*

在日常生活中，加密无处不在：

• 当你用 HTTPS 打开一个网址（地址栏前面有一个小锁图标 🔒），你的浏览器和服务器之间的所有数据都经过了 TLS 加密；
• 当你妈妈用指纹解锁手机，手机内部存储的指纹模板也是经过哈希（Hash）加密的——任何工程师都无法"反向解密"出你的指纹图案；
• 当你在微信里发一条"今天作业好多啊"，这条消息在传输过程中会被 AES-256 算法加密为 256 位（约 78 位数字）的密文。

*In daily life, encryption is everywhere:*

• *When you open a website via HTTPS (the little 🔒 in the address bar), all data between your browser and the server is encrypted by TLS.*
• *When your mother unlocks her phone with a fingerprint, the stored fingerprint template is hashed—engineers cannot "reverse-decode" it into a fingerprint image.*
• *When you send "So much homework today" on WeChat, the message is encrypted in transit by AES-256 into 256-bit (~78-digit) ciphertext.*

1.1.3 完整性：让数据"防篡改" / Integrity: Making Data "Tamper-Proof"

完整性（Integrity） 解决的问题是：这份数据，从 A 点到 B 点，有没有被谁偷偷改过一个字？

*Integrity answers: Has this data been altered by anyone between point A and point B?*

小明的故事讲的是机密性被破坏，但如果机密性是"看不见"，完整性则更像是"动得了吗"。试想一个场景：

*Xiaoming's story was about a confidentiality breach. But if confidentiality is "can it be seen?", integrity is more like "can it be touched?" Imagine this scenario:*

> 你给同学小明发了一条消息："周末去图书馆，下午 3 点。" > 消息在传输途中，被一个中间人悄悄改成了："周末去网吧，晚上 11 点。" > *You send your friend Xiaoming a message: "Weekend, library, 3 p.m." In transit, a man-in-the-middle silently rewrites it to "Weekend, internet cafe, 11 p.m."*

如果消息没有任何完整性校验，小明收到时只会以为是你改了主意。听起来像小说情节？实际上，中间人攻击（Man-in-the-Middle Attack, MITM） 正是 2010 年代公共 Wi-Fi 热点最常见的攻击方式之一。

*If the message has no integrity check, Xiaoming will simply think you changed your mind. Sounds like a novel plot? In fact, Man-in-the-Middle (MITM) attacks were among the most common threats on public Wi-Fi hotspots in the 2010s.*

为了防止这种篡改，计算机科学家发明了哈希函数（Hash Function）。它的奇妙之处在于：

*To prevent this tampering, computer scientists invented hash functions. Their magic lies in this:*

• 输入任意长度的数据，输出一段**固定长度**的"指纹"（称为**摘要 / Digest**）。