feat: 암호화모듈 프레임워크 적용 및 사이트 특화 전략 추가

- 서브모듈 포인터 업데이트 (elink-online-common, elink-online-core-jpa) - HsmContextSha256KeyDerivationStrategy: SHA-256(masterKey || contextValue) 키 도출 전략 elink-online-common에서 eapim-online custom 패키지로 분리 (사이트 의존성) FQCN: com.eactive.eai.custom.security.keyderiv.strategy.HsmContextSha256KeyDerivationStrategy - HsmContextSha256KeyDerivationStrategyTest 추가 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-06 16:50:17 +09:00
parent efcc7fe208
commit c225104711
4 changed files with 249 additions and 2 deletions
@@ -0,0 +1,68 @@
+package com.eactive.eai.custom.security.keyderiv.strategy;
+
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.util.Map;
+
+import javax.crypto.SecretKey;
+
+import com.eactive.eai.common.hsm.HsmCryptoService;
+import com.eactive.eai.common.security.keyderiv.DerivedKey;
+import com.eactive.eai.common.security.keyderiv.KeyDerivationStrategy;
+import com.eactive.eai.common.util.ApplicationContextProvider;
+
+/**
+ * HSM 마스터키 + 런타임 컨텍스트값을 연결(concatenate)한 뒤 SHA-256 해싱으로 키를 도출하는 전략.
+ * SHA-256 출력은 항상 32바이트(AES-256)이므로 별도 keyLength 파라미터가 불필요하다.
+ *
+ * key_deriv_params (JSON) 예시:
+ * {
+ *   "hsmKeyAlias" : "MASTER_KEY_AES",
+ *   "contextKey"  : "X-Api-Group-Seq"  -- runtimeContext에서 꺼낼 키 이름
+ * }
+ */
+public class HsmContextSha256KeyDerivationStrategy implements KeyDerivationStrategy {
+
+	/** DB key_deriv_strategy 컬럼에 사용하는 FQCN 참조용 상수. */
+	public static final String STRATEGY_CLASS = HsmContextSha256KeyDerivationStrategy.class.getName();
+
+	private static final String PARAM_HSM_KEY_ALIAS = "hsmKeyAlias";
+	private static final String PARAM_CONTEXT_KEY   = "contextKey";
+
+	@Override
+	public DerivedKey deriveKey(Map<String, String> params, Map<String, String> runtimeContext) throws Exception {
+		String hsmKeyAlias = required(params, PARAM_HSM_KEY_ALIAS);
+		String contextKey  = required(params, PARAM_CONTEXT_KEY);
+
+		SecretKey masterKey   = hsmCryptoService().getSecretKey(hsmKeyAlias);
+		byte[] masterKeyBytes = masterKey.getEncoded();
+		byte[] contextBytes   = runtimeContext.getOrDefault(contextKey, "")
+				.getBytes(StandardCharsets.UTF_8);
+
+		byte[] combined = new byte[masterKeyBytes.length + contextBytes.length];
+		System.arraycopy(masterKeyBytes, 0, combined, 0, masterKeyBytes.length);
+		System.arraycopy(contextBytes,  0, combined, masterKeyBytes.length, contextBytes.length);
+
+		byte[] derived = MessageDigest.getInstance("SHA-256").digest(combined);
+		return new DerivedKey(derived, derived);
+	}
+
+	@Override
+	public String buildCacheKey(String cryptoName, Map<String, String> params, Map<String, String> runtimeContext) {
+		String contextKey   = params.getOrDefault(PARAM_CONTEXT_KEY, "");
+		String contextValue = runtimeContext.getOrDefault(contextKey, "");
+		return cryptoName + ":" + contextValue;
+	}
+
+	private String required(Map<String, String> params, String key) {
+		String value = params.get(key);
+		if (value == null || value.trim().isEmpty()) {
+			throw new IllegalArgumentException("key_deriv_params 필수값 누락: " + key);
+		}
+		return value;
+	}
+
+	private HsmCryptoService hsmCryptoService() {
+		return ApplicationContextProvider.getContext().getBean(HsmCryptoService.class);
+	}
+}