From 547232bb26e49bd11670ac3295424b87c622aa7c Mon Sep 17 00:00:00 2001 From: curry772 Date: Tue, 12 May 2026 16:34:20 +0900 Subject: [PATCH] =?UTF-8?q?feat:=20HSM=20=ED=82=A4=20=ED=8C=8C=EC=83=9D=20?= =?UTF-8?q?=EC=A0=84=EB=9E=B5=20elink-online-common=EC=9C=BC=EB=A1=9C=20?= =?UTF-8?q?=EC=9D=B4=EB=8F=99=20=EB=B0=8F=20=EC=84=9C=EB=B8=8C=EB=AA=A8?= =?UTF-8?q?=EB=93=88=20=EC=97=85=EB=8D=B0=EC=9D=B4=ED=8A=B8?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - HsmContextSha256KeyDerivationStrategy: custom 패키지에서 elink-online-common으로 이동 - elink-online-common: feature/crypto-module 브랜치 (HSM 전략 클래스 + master 머지) - elink-online-core-jpa: CryptoModuleConfig JPA Entity 및 Loader 추가 Co-Authored-By: Claude Sonnet 4.6 --- elink-online-common | 2 +- elink-online-core-jpa | 2 +- ...HsmContextSha256KeyDerivationStrategy.java | 68 ------------------- 3 files changed, 2 insertions(+), 70 deletions(-) delete mode 100644 src/main/java/com/eactive/eai/custom/security/keyderiv/strategy/HsmContextSha256KeyDerivationStrategy.java diff --git a/elink-online-common b/elink-online-common index 3eac4ee..3b6b3f6 160000 --- a/elink-online-common +++ b/elink-online-common @@ -1 +1 @@ -Subproject commit 3eac4eeaa6d57be87f10d8bc8b0aef6fa033a19d +Subproject commit 3b6b3f6e4c1e211b14e52709c7cdf0ace9bb408b diff --git a/elink-online-core-jpa b/elink-online-core-jpa index 03aa7ce..9620845 160000 --- a/elink-online-core-jpa +++ b/elink-online-core-jpa @@ -1 +1 @@ -Subproject commit 03aa7ced90ee145177aaa9b60e407ea538f7a58f +Subproject commit 9620845daf825595bbd155afb19a9471af4a255d diff --git a/src/main/java/com/eactive/eai/custom/security/keyderiv/strategy/HsmContextSha256KeyDerivationStrategy.java b/src/main/java/com/eactive/eai/custom/security/keyderiv/strategy/HsmContextSha256KeyDerivationStrategy.java deleted file mode 100644 index 2f720fe..0000000 --- a/src/main/java/com/eactive/eai/custom/security/keyderiv/strategy/HsmContextSha256KeyDerivationStrategy.java +++ /dev/null @@ -1,68 +0,0 @@ -package com.eactive.eai.custom.security.keyderiv.strategy; - -import java.nio.charset.StandardCharsets; -import java.security.MessageDigest; -import java.util.Map; - -import javax.crypto.SecretKey; - -import com.eactive.eai.common.hsm.HsmCryptoService; -import com.eactive.eai.common.security.keyderiv.DerivedKey; -import com.eactive.eai.common.security.keyderiv.KeyDerivationStrategy; -import com.eactive.eai.common.util.ApplicationContextProvider; - -/** - * HSM 마스터키 + 런타임 컨텍스트값을 연결(concatenate)한 뒤 SHA-256 해싱으로 키를 도출하는 전략. - * SHA-256 출력은 항상 32바이트(AES-256)이므로 별도 keyLength 파라미터가 불필요하다. - * - * key_deriv_params (JSON) 예시: - * { - * "hsmKeyAlias" : "MASTER_KEY_AES", - * "contextKey" : "X-Api-Group-Seq" -- runtimeContext에서 꺼낼 키 이름 - * } - */ -public class HsmContextSha256KeyDerivationStrategy implements KeyDerivationStrategy { - - /** DB key_deriv_strategy 컬럼에 사용하는 FQCN 참조용 상수. */ - public static final String STRATEGY_CLASS = HsmContextSha256KeyDerivationStrategy.class.getName(); - - private static final String PARAM_HSM_KEY_ALIAS = "hsmKeyAlias"; - private static final String PARAM_CONTEXT_KEY = "contextKey"; - - @Override - public DerivedKey deriveKey(Map params, Map runtimeContext) throws Exception { - String hsmKeyAlias = required(params, PARAM_HSM_KEY_ALIAS); - String contextKey = required(params, PARAM_CONTEXT_KEY); - - SecretKey masterKey = hsmCryptoService().getSecretKey(hsmKeyAlias); - byte[] masterKeyBytes = masterKey.getEncoded(); - byte[] contextBytes = runtimeContext.getOrDefault(contextKey, "") - .getBytes(StandardCharsets.UTF_8); - - byte[] combined = new byte[masterKeyBytes.length + contextBytes.length]; - System.arraycopy(masterKeyBytes, 0, combined, 0, masterKeyBytes.length); - System.arraycopy(contextBytes, 0, combined, masterKeyBytes.length, contextBytes.length); - - byte[] derived = MessageDigest.getInstance("SHA-256").digest(combined); - return new DerivedKey(derived, derived); - } - - @Override - public String buildCacheKey(String cryptoName, Map params, Map runtimeContext) { - String contextKey = params.getOrDefault(PARAM_CONTEXT_KEY, ""); - String contextValue = runtimeContext.getOrDefault(contextKey, ""); - return cryptoName + ":" + contextValue; - } - - private String required(Map params, String key) { - String value = params.get(key); - if (value == null || value.trim().isEmpty()) { - throw new IllegalArgumentException("key_deriv_params 필수값 누락: " + key); - } - return value; - } - - private HsmCryptoService hsmCryptoService() { - return ApplicationContextProvider.getContext().getBean(HsmCryptoService.class); - } -}