HSM 암복화 테스트 중 추가 기능 수정

Jenkinsfile

@@ -1,10 +1,6 @@
 pipeline {
   agent { label 'djb-vm' }
 
-  triggers {
-    pollSCM('H/10 * * * *')
-  }
-
   options {
     timestamps()
     disableConcurrentBuilds()
@@ -72,10 +68,11 @@ pipeline {
           sh '''
             set -eu
             cd build/libs
-            sha1sum eapim-online.war > SHA1SUMS
+            sha1sum eapim-online.war > eapim-online.war.sha1
-            sha256sum eapim-online.war > SHA256SUMS
+            sha256sum eapim-online.war > eapim-online.war.sha256
+            md5sum eapim-online.war > eapim-online.war.md5
           '''
-          archiveArtifacts artifacts: 'build/libs/eapim-online.war,build/libs/SHA1SUMS,build/libs/SHA256SUMS', fingerprint: true
+          archiveArtifacts artifacts: 'build/libs/eapim-online.war,build/libs/eapim-online.war.sha1,build/libs/eapim-online.war.sha256,build/libs/eapim-online.war.md5', fingerprint: true
         }
       }
     }
@@ -162,4 +159,5 @@ pipeline {
       }
     }
   }
+
 }

src/main/java/com/eactive/eai/adapter/controller/DJBApiAdapterController.java

@@ -22,6 +22,7 @@ import com.eactive.eai.adapter.AdapterVO;
 import com.eactive.eai.adapter.handler.AdapterErrorMessageHandler;
 import com.eactive.eai.adapter.handler.AdapterErrorMessageHandlerFactory;
 import com.eactive.eai.adapter.http.HttpStatusException;
+import com.eactive.eai.adapter.http.client.HttpClientAdapterServiceKey;
 import com.eactive.eai.adapter.http.dynamic.HttpAdapterServiceKey;
 import com.eactive.eai.adapter.http.dynamic.HttpAdapterServiceSupport;
 import com.eactive.eai.adapter.http.dynamic.HttpDynamicInAdapterManager;
@@ -65,6 +66,7 @@ public class DJBApiAdapterController implements HttpAdapterServiceKey {
 			"/tsb/{path:^(?!oauth).*$}", "/tsb/{path:^(?!oauth).*$}/**",
 			"/shb/{path:^(?!oauth).*$}", "/shb/{path:^(?!oauth).*$}/**",
 			"/tst/{path:^(?!oauth).*$}", "/tst/{path:^(?!oauth).*$}/**",
+			"/**/{path:^(?!oauth).*$}", "/**/{path:^(?!oauth).*$}/**",
 			})
 	public ResponseEntity<String> callApi(HttpServletRequest servletRequest, HttpServletResponse servletResponse)
 			throws Exception {
@@ -136,29 +138,36 @@ public class DJBApiAdapterController implements HttpAdapterServiceKey {
 		} catch (Exception e) {
 			logger.error(adapterGroupName + "-" + adapterName + ">>" + e.getMessage(), e);
 			
-			String errorMsg = null;
+			String responseErrorMsg = null;
 			
-			errorMsg = genErrorResponseMessage(adapterGroupName, adapterName,
-					transactionProp, e, adptMsgType, encode, errorResponseFormat);
 			if (e instanceof FilterException) {
+				responseErrorMsg = genErrorResponseMessage(adapterGroupName, adapterName,
+						transactionProp, MessageUtil.ERROR_CODE_AP_ERROR, e, adptMsgType, encode, errorResponseFormat);
 				FilterException e1 = (FilterException) e;
-				this.logError(servletRequest, uuid, adapterGroupName, e1.getCode(), errorMsg, transactionProp, e);
+				this.logError(servletRequest, adapterGroupName, e1.getCode(), responseErrorMsg, transactionProp, e);
 				logger.error("ApiAdapterController] " + adapterGroupName + "-" + adapterName + ">>" + e.getMessage());
-				responseEntity = ResponseEntity.status(e1.getStatus()).contentType(mediaType).body(errorMsg);
+				responseEntity = ResponseEntity.status(e1.getStatus()).contentType(mediaType).body(responseErrorMsg);
 			} else if (e instanceof JwtAuthException) {
+				responseErrorMsg = genErrorResponseMessage(adapterGroupName, adapterName,
+						transactionProp, MessageUtil.ERROR_CODE_AP_ERROR, e, adptMsgType, encode, errorResponseFormat);
 				JwtAuthException e1 = (JwtAuthException) e;
-				this.logError(servletRequest, uuid, adapterGroupName, e1.getCode(), errorMsg, transactionProp, e);
+				this.logError(servletRequest, adapterGroupName, e1.getCode(), responseErrorMsg, transactionProp, e);
 				logger.error("ApiAdapterController] " + adapterGroupName + "-" + adapterName + ">>" + e.getMessage(), e);
-				responseEntity = ResponseEntity.status(HttpStatus.UNAUTHORIZED).contentType(mediaType).body(errorMsg);
+				responseEntity = ResponseEntity.status(HttpStatus.UNAUTHORIZED).contentType(mediaType).body(responseErrorMsg);
 			} else if (e instanceof HttpStatusException) {
+				responseErrorMsg = genErrorResponseMessage(adapterGroupName, adapterName,
+						transactionProp, MessageUtil.ERROR_CODE_AUTH_FAIL, e, adptMsgType, encode, errorResponseFormat);
 				logger.error("ApiAdapterController] " + adapterGroupName + "-" + adapterName + ">>" + e.getMessage());
 				HttpStatusException e1 = (HttpStatusException) e;
-				responseEntity = ResponseEntity.status(e1.getStatus()).contentType(mediaType).body(errorMsg);
+				responseEntity = ResponseEntity.status(e1.getStatus()).contentType(mediaType).body(responseErrorMsg);
 			} else {
+				responseErrorMsg = genErrorResponseMessage(adapterGroupName, adapterName,
+						transactionProp, MessageUtil.ERROR_CODE_AP_ERROR, e, adptMsgType, encode, errorResponseFormat);
+				this.logError(servletRequest, adapterGroupName, MessageUtil.ERROR_CODE_AP_ERROR, responseErrorMsg, transactionProp, e);
 				logger.error(adapterGroupName + "-" + adapterName + ">>" + e.getMessage(), e);
-				responseEntity = ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).contentType(mediaType).body(errorMsg);
+				responseEntity = ResponseEntity.status(HttpStatus.INTERNAL_SERVER_ERROR).contentType(mediaType).body(responseErrorMsg);
 			}
-			responseData = errorMsg;
+			responseData = responseErrorMsg;
 			
 		} finally {
 			/**
@@ -178,7 +187,7 @@ public class DJBApiAdapterController implements HttpAdapterServiceKey {
 	}
 	
 	private String genErrorResponseMessage(String adapterGroupName, String adapterName,
-			Properties callProp, Throwable e, String adptMsgType, String encode, String errorResponseFormat) {
+			Properties callProp, String code, Throwable e, String adptMsgType, String encode, String errorResponseFormat) {
 		String errorHandlerClass = AdapterPropManager.getInstance().getProperty(adapterName, "ERR_MSG_HANDLER");
 		if (StringUtils.isNotBlank(errorHandlerClass)) {
 			if (logger.isInfo())
@@ -187,6 +196,7 @@ public class DJBApiAdapterController implements HttpAdapterServiceKey {
 			if (handler != null) {
 				Object resposne;
 				try {
+					callProp.put("INBOUND_RESULT_CODE", code);
 					resposne = handler.generateNonStandardInboundErrorResponseMessage(adapterGroupName, adapterName,
 							callProp, null, null, e);
 					return (String)resposne;
@@ -197,7 +207,7 @@ public class DJBApiAdapterController implements HttpAdapterServiceKey {
 			}
 		}
 		return MessageUtil.makeErrorMessageByMessageType(adptMsgType, encode,
-				MessageUtil.ERROR_CODE_AP_ERROR, e.getMessage(), errorResponseFormat);
+				code, e.getMessage(), errorResponseFormat);
 	}
 
 	/**
@@ -250,21 +260,14 @@ public class DJBApiAdapterController implements HttpAdapterServiceKey {
 			String errorCode = "RECEAIIRP010";
 			String[] msgArgs = new String[1];
 			msgArgs[0] = request.getRequestURI();
-			EAIServerManager eaiServerManager = EAIServerManager.getInstance();
+			this.logError(request, "HTTP_IN_NO_URI", errorCode,
-			String serverName = eaiServerManager.getLocalServerName();
-
-			String instanceid1 = serverName.substring(0, 2);
-			String instanceid2 = serverName.substring(serverName.length() - 2, serverName.length());
-			String instid = instanceid1 + instanceid2;
-			String uuid = instid + UUIDGenerator.getUUID();
-			this.logError(request, uuid, "HTTP_IN_NO_URI", errorCode,
 					ExceptionUtil.make(new Exception("cat not find uri"), errorCode, msgArgs), null, null);
 		} catch (Throwable t) {
 			logger.warn("inbound logging failed", t);
 		}
 	}
 	
-	private void logError(HttpServletRequest request, String uuid, String adapterGroupName, String errorCode,
+	private void logError(HttpServletRequest request, String adapterGroupName, String errorCode,
 			String errorMsg, Properties prop, Exception e) {
 		try {
 			EAIServerManager eaiServerManager = EAIServerManager.getInstance();
@@ -272,7 +275,15 @@ public class DJBApiAdapterController implements HttpAdapterServiceKey {
 			
 			InboundErrorInfoVO errorInfoVO = new InboundErrorInfoVO();
 			
-			errorInfoVO.setEaiSvcSno(uuid); // EAI서비스일련번호
+			String txId = prop.getProperty(TransactionContextKeys.TRANSACTION_UUID);
+			if (StringUtils.isEmpty(txId)) {
+				String instanceid1 = serverName.substring(0, 2);
+				String instanceid2 = serverName.substring(serverName.length() - 2, serverName.length());
+				String instid = instanceid1 + instanceid2;
+				txId = instid + UUIDGenerator.getUUID();
+			}
+			
+			errorInfoVO.setEaiSvcSno(txId); // EAI서비스일련번호
 			errorInfoVO.setAdptBwkGrpNm(adapterGroupName); // 어댑터업무그룹명
 			errorInfoVO.setErrCd(errorCode); // 에러코드
 			errorInfoVO.setErrTxt(errorMsg); // 에러내용

src/main/java/com/eactive/eai/authserver/config/AuthorizationServerConfig.java

@@ -36,6 +36,7 @@ import org.springframework.security.oauth2.provider.token.store.JwtAccessTokenCo
 import org.springframework.security.oauth2.provider.token.store.JwtTokenStore;
 import org.springframework.security.oauth2.provider.token.store.KeyStoreKeyFactory;
 
+import com.eactive.eai.agent.encryption.EncryptionManager;
 import com.eactive.eai.authserver.dao.TokenIssuanceLogDAO;
 import com.eactive.eai.authserver.jwt.PssJwtAccessTokenConverter;
 import com.eactive.eai.authserver.service.OAuth2Manager;
@@ -131,10 +132,11 @@ public class AuthorizationServerConfig extends AuthorizationServerConfigurerAdap
 		String keyAlias = "elink-oauth";
 		String keyPassword = "elink1234";
 		if (vo != null) {
-			keystorePath = vo.getProperty(PROP_KEYSTORE_PATH);
+			EncryptionManager encManager = EncryptionManager.getInstance();
-			keystorePassword = vo.getProperty(PROP_KEYSTORE_PW);
+			keystorePath = encManager.decryptDBData(vo.getProperty(PROP_KEYSTORE_PATH));
-			keyAlias = vo.getProperty(PROP_KEY_ALIAS);
+			keystorePassword = encManager.decryptDBData(vo.getProperty(PROP_KEYSTORE_PW));
-			keyPassword = vo.getProperty(PROP_KEY_PW);
+			keyAlias = encManager.decryptDBData(vo.getProperty(PROP_KEY_ALIAS));
+			keyPassword = encManager.decryptDBData(vo.getProperty(PROP_KEY_PW));
 		} else {
 			logger.warn("The properties has not been set.[" + PROP_GROUP_AUTH_SERVER + "]");
 		}

src/main/java/com/eactive/eai/custom/adapter/http/client/impl/filter/EncFieldOutCryptoFilter.java

@@ -2,8 +2,12 @@ package com.eactive.eai.custom.adapter.http.client.impl.filter;
 
 import java.util.Properties;
 
+import com.eactive.eai.adapter.http.client.impl.HttpClient5AdapterServiceRest;
 import com.eactive.eai.adapter.http.client.impl.filter.HttpClientAdapterFilter;
 import com.eactive.eai.adapter.http.client.impl.filter.OutCryptoFilter;
+import com.eactive.eai.util.JsonPathUtil;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.node.ObjectNode;
 /**
  * 제주은행 Open API 기본 암복호화 필더
  */
@@ -20,7 +24,20 @@ public class EncFieldOutCryptoFilter implements HttpClientAdapterFilter {
 	@Override
 	public Object doPreFilter(String adptGrpName, String adptName, Properties prop, Object message, Properties tempProp)
 			throws Exception {
-		return filter.doPreFilter(adptGrpName, adptName, prop, message, setProp(tempProp));
+		String headerGroupName = prop.getProperty(HttpClient5AdapterServiceRest.HEADER_GROUP);
+		
+		JsonNode root = JsonPathUtil.toTree(message);
+		ObjectNode rootObjectNode = (ObjectNode) root;
+		JsonNode header = rootObjectNode.get(headerGroupName);
+		rootObjectNode.remove(headerGroupName);
+		
+		Object enc = filter.doPreFilter(adptGrpName, adptName, prop, rootObjectNode, setProp(tempProp));
+		
+		ObjectNode encJson = (ObjectNode)JsonPathUtil.toTree(enc);
+		encJson.set(headerGroupName, header);
+		
+		return encJson;
+		
 	}
 
 	@Override

src/main/java/com/eactive/eai/custom/adapter/http/dynamic/filter/DecrytTestFilter.java

@@ -0,0 +1,88 @@
+package com.eactive.eai.custom.adapter.http.dynamic.filter;
+
+import java.util.Base64;
+import java.util.Properties;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.json.simple.JSONObject;
+import org.springframework.http.HttpStatus;
+
+import com.eactive.eai.adapter.http.dynamic.filter.FilterException;
+import com.eactive.eai.adapter.http.dynamic.filter.HttpAdapterFilter;
+import com.eactive.eai.common.security.AESCryptoModuleExtension;
+import com.eactive.eai.common.security.ARIACryptoModuleExtension;
+import com.eactive.eai.common.security.CryptoModuleExtension;
+import com.eactive.eai.common.util.Logger;
+import com.eactive.eai.util.HexaConverter;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+
+public class DecrytTestFilter implements HttpAdapterFilter {
+
+	private static final Logger logger = Logger.getLogger(Logger.LOGGER_ADAPTER);
+
+	private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
+
+	@Override
+	public Object doPreFilter(String adptGrpName, String adptName, Object message, Properties prop,
+			HttpServletRequest request, HttpServletResponse response) throws Exception {
+		try {
+			ObjectNode rootNode = null;
+			String jsonStr = null;
+			if (message instanceof String) {
+				jsonStr = (String) message;
+			} else if (message instanceof JSONObject) {
+				jsonStr = ((JSONObject) message).toJSONString();
+			} else {
+				return message;
+			}
+			rootNode = (ObjectNode) OBJECT_MAPPER.readTree(jsonStr);
+
+			JsonNode alg = rootNode.get("alg");
+			JsonNode mode = rootNode.get("mode");
+			JsonNode padding = rootNode.get("padding");
+			JsonNode aadNode = rootNode.get("aad");
+			JsonNode iv = rootNode.get("iv");
+			byte[] binIv = null;
+			if(iv != null) {
+				String strIv = iv.asText();
+				binIv = HexaConverter.hexToBin(strIv);
+			}
+			JsonNode encKey = rootNode.get("encKey");
+			String strEncKey = encKey.asText();
+			byte[] binEncKey = HexaConverter.hexToBin(strEncKey);
+
+			CryptoModuleExtension ext = "ARIA".equalsIgnoreCase(alg.asText()) ? new ARIACryptoModuleExtension()
+					: new AESCryptoModuleExtension();
+			ext.init(alg.asText(), mode.asText(), padding.asText(), binIv, binEncKey, binEncKey);
+
+			JsonNode encryptedData = rootNode.get("encryptedData");
+			byte[] cipherBytes = Base64.getDecoder().decode(encryptedData.asText().trim());
+			
+			byte[] decryptedBytes = null;
+			if(rootNode.has("aad"))
+				decryptedBytes = ext.decrypt(cipherBytes, HexaConverter.hexToBin(aadNode.asText()));
+			else
+				decryptedBytes = ext.decrypt(cipherBytes);
+			
+			rootNode.put("hsmKeyRaw", new String(decryptedBytes));
+
+			String jsonString = OBJECT_MAPPER.writeValueAsString(rootNode);
+			return jsonString;
+
+		} catch (Exception e) {
+			logger.error("복호화 실패", e);
+			throw new FilterException("복호화 실패", ERROR_PRE_FAIL, HttpStatus.INTERNAL_SERVER_ERROR.value(), e);
+		}
+	}
+
+	@Override
+	public Object doPostFilter(String adptGrpName, String adptName, Object resultMessage, Properties prop,
+			HttpServletRequest request, HttpServletResponse response) throws Exception {
+		return resultMessage;
+	}
+
+}

src/main/java/com/eactive/eai/custom/adapter/http/dynamic/filter/DouzoneEncFieldInCryptoFilter.java

@@ -43,11 +43,10 @@ public class DouzoneEncFieldInCryptoFilter implements HttpAdapterFilter {
 
 	private void setContext(Properties tempProp) {
 		Properties inboundHeaders = (Properties) tempProp.get(HttpAdapterServiceKey.INBOUND_HEADER);
-		String empNm = inboundHeaders.getProperty("x-emp-nm");
-		tempProp.setProperty(InCryptoFilter.PROP_AAD_HEADER, empNm);
-
 		String chnlNm = inboundHeaders.getProperty("x-chnl-nm");
-		tempProp.setProperty(KeyDerivationStrategy.PARAM_CONTEXT_KEY, chnlNm);
+		tempProp.setProperty("x-chnl-nm", chnlNm);
+
+		tempProp.setProperty(InCryptoFilter.PROP_AAD_HEADER, "x-emp-nm");
 	}
 
 	@Override

src/main/java/com/eactive/eai/custom/adapter/http/dynamic/filter/EncrytTestFilter.java

@@ -0,0 +1,147 @@
+package com.eactive.eai.custom.adapter.http.dynamic.filter;
+
+import java.security.KeyStore;
+import java.util.Base64;
+import java.util.Properties;
+
+import javax.crypto.SecretKey;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.json.simple.JSONObject;
+import org.springframework.http.HttpStatus;
+
+import com.eactive.eai.adapter.http.dynamic.filter.FilterException;
+import com.eactive.eai.adapter.http.dynamic.filter.HttpAdapterFilter;
+import com.eactive.eai.common.hsm.HsmManager;
+import com.eactive.eai.common.security.AESCryptoModuleExtension;
+import com.eactive.eai.common.security.ARIACryptoModuleExtension;
+import com.eactive.eai.common.security.CryptoModuleExtension;
+import com.eactive.eai.common.util.Logger;
+import com.eactive.eai.util.HexaConverter;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+
+public class EncrytTestFilter implements HttpAdapterFilter {
+
+	private static final Logger logger = Logger.getLogger(Logger.LOGGER_ADAPTER);
+
+	private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
+
+	@Override
+	public Object doPreFilter(String adptGrpName, String adptName, Object message, Properties prop,
+			HttpServletRequest request, HttpServletResponse response) throws Exception {
+		try {
+			ObjectNode rootNode = null;
+			String jsonStr = null;
+			if (message instanceof String) {
+				jsonStr = (String) message;
+			} else if (message instanceof JSONObject) {
+				jsonStr = ((JSONObject) message).toJSONString();
+			} else {
+				return message;
+			}
+			rootNode = (ObjectNode) OBJECT_MAPPER.readTree(jsonStr);
+
+			// 1. HSM에서 키 가져오기
+			byte[] hsmKeyBytes = null;
+			JsonNode hsmKeyAlias = rootNode.get("hsmKeyAlias");
+			if (hsmKeyAlias != null) {
+				String hsmKeyAliasValue = hsmKeyAlias.textValue();
+				KeyStore keyStore = HsmManager.getInstance().getKeyStore();
+
+				java.security.Key key = keyStore.getKey(hsmKeyAliasValue, null);
+				if (key instanceof SecretKey) {
+					SecretKey secretKey = (SecretKey) key;
+					hsmKeyBytes = secretKey.getEncoded();
+					if (hsmKeyBytes != null) {
+						String hsmKeyBase64 = Base64.getEncoder().encodeToString(hsmKeyBytes);
+						String hsmKeyHex = HexaConverter.binToHex(hsmKeyBytes);
+						logger.debug("HsmManager] HSM - {} : [{}]", hsmKeyAliasValue, hsmKeyHex);
+						rootNode.put("hsmKeyBase64", hsmKeyBase64);
+						rootNode.put("hsmKeyHex", hsmKeyHex);
+						rootNode.put("hsmKeyRaw", new String(hsmKeyBytes));
+					} else {
+						logger.debug("HsmManager] HSM - secretKey null {} : [{}]", hsmKeyAliasValue, secretKey);
+					}
+					
+				}
+			}
+
+			// 2. 암호화 파라미터가 있으면 암호화 후 복호화 검증
+			JsonNode alg = rootNode.get("alg");
+			JsonNode mode = rootNode.get("mode");
+			JsonNode padding = rootNode.get("padding");
+			
+			JsonNode enc = rootNode.get("enc");
+			String strEnc = "BASE64";
+			if(enc != null)
+				strEnc = enc.asText();
+				
+			JsonNode ivNode = rootNode.get("iv");
+			JsonNode aadNode = rootNode.get("aad");
+			JsonNode encKeyNode = rootNode.get("encKey");
+			JsonNode dataNode = rootNode.get("data");
+
+			if (alg != null && mode != null && padding != null && encKeyNode != null
+					&& dataNode != null) {
+				byte[] binIv = null;
+				if(ivNode != null) {
+					String strIvValue = ivNode.asText();
+					if(strIvValue.length() == 32||strEnc.equalsIgnoreCase("HEX"))
+						binIv = HexaConverter.hexToBin(strIvValue);
+					else
+						binIv = Base64.getDecoder().decode(strIvValue.trim());
+				}
+				
+				String strEncKeyValue = encKeyNode.asText();
+				byte[] binEncKey = null;
+				if(strEnc.equalsIgnoreCase("BASE64"))
+					binEncKey = Base64.getDecoder().decode(strEncKeyValue.trim());
+				else
+					binEncKey = HexaConverter.hexToBin(strEncKeyValue);
+
+				CryptoModuleExtension ext = "ARIA".equalsIgnoreCase(alg.asText()) ? new ARIACryptoModuleExtension()
+						: new AESCryptoModuleExtension();
+				ext.init(alg.asText(), mode.asText(), padding.asText(), binIv, binEncKey, binEncKey);
+
+				byte[] plainBytes = dataNode.asText().getBytes();
+
+				// 암호화
+				byte[] encryptedBytes = null;
+				if(rootNode.has("aad"))
+					encryptedBytes = ext.encrypt(plainBytes, HexaConverter.hexToBin(aadNode.asText()));
+				else
+					encryptedBytes = ext.encrypt(plainBytes);
+				
+				String encryptedBase64 = Base64.getEncoder().encodeToString(encryptedBytes);
+				rootNode.put("encryptedData", encryptedBase64);
+				logger.debug("암호화 결과: [{}]", encryptedBase64);
+
+				// 복호화 검증
+				byte[] decryptedBytes = null;
+				if(rootNode.has("aad"))
+					decryptedBytes = ext.decrypt(encryptedBytes, HexaConverter.hexToBin(aadNode.asText()));
+				else
+					decryptedBytes = ext.decrypt(encryptedBytes);
+				
+				rootNode.put("decryptedVerify", new String(decryptedBytes));
+				logger.debug("복호화 검증: [{}]", new String(decryptedBytes));
+			}
+
+			String jsonString = OBJECT_MAPPER.writeValueAsString(rootNode);
+			return jsonString;
+
+		} catch (Exception e) {
+			throw new FilterException("HSM key 암호화/복호화 검증 실패", ERROR_PRE_FAIL, HttpStatus.INTERNAL_SERVER_ERROR.value(), e);
+		}
+	}
+
+	@Override
+	public Object doPostFilter(String adptGrpName, String adptName, Object resultMessage, Properties prop,
+			HttpServletRequest request, HttpServletResponse response) throws Exception {
+		return resultMessage;
+	}
+
+}

src/main/java/com/eactive/eai/custom/adapter/http/dynamic/filter/GenKeyFilter.java

@@ -0,0 +1,117 @@
+package com.eactive.eai.custom.adapter.http.dynamic.filter;
+
+import java.util.Base64;
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Properties;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.json.simple.JSONObject;
+import org.springframework.http.HttpStatus;
+
+import com.eactive.eai.adapter.http.dynamic.filter.FilterException;
+import com.eactive.eai.adapter.http.dynamic.filter.HttpAdapterFilter;
+import com.eactive.eai.common.security.keyderiv.DerivedKey;
+import com.eactive.eai.common.util.Logger;
+import com.eactive.eai.custom.common.security.keyderiv.HsmContextSha256KeyDerivationStrategy;
+import com.eactive.eai.custom.common.security.keyderiv.HsmKeyAndIvSliceDerivationStrategy;
+import com.eactive.eai.util.HexaConverter;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+
+public class GenKeyFilter implements HttpAdapterFilter {
+
+	private static final Logger logger = Logger.getLogger(Logger.LOGGER_ADAPTER);
+
+	private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
+
+	@Override
+	public Object doPreFilter(String adptGrpName, String adptName, Object message, Properties prop,
+			HttpServletRequest request, HttpServletResponse response) throws Exception {
+		try {
+			ObjectNode rootNode = null;
+			String jsonStr = null;
+			if (message instanceof String) {
+				jsonStr = (String) message;
+			} else if (message instanceof JSONObject) {
+				jsonStr = ((JSONObject) message).toJSONString();
+			} else {
+				return message;
+			}
+			rootNode = (ObjectNode) OBJECT_MAPPER.readTree(jsonStr);
+
+			JsonNode hsmKey = rootNode.get("hsmKey");
+			JsonNode hsmIv = rootNode.get("hsmIv");
+			JsonNode contextKey = rootNode.get("contextKey");
+			JsonNode type = rootNode.get("type");
+			
+			JsonNode enc = rootNode.get("enc");
+			String strEnc = "BASE64";
+			if(enc != null)
+				strEnc = enc.asText();
+			
+			byte[] binIv = null;
+			if(hsmIv != null) {
+				String strIvValue = hsmIv.asText();
+				if(strIvValue.length() == 32||strEnc.equalsIgnoreCase("HEX"))
+					binIv = HexaConverter.hexToBin(strIvValue);
+				else
+					binIv = Base64.getDecoder().decode(strIvValue.trim());
+			}
+		
+			String strEncKeyValue = hsmKey.asText();
+			byte[] binEncKey = null;
+			if(strEnc.equalsIgnoreCase("BASE64"))
+				binEncKey = Base64.getDecoder().decode(strEncKeyValue.trim());
+			else
+				binEncKey = HexaConverter.hexToBin(strEncKeyValue);
+
+			DerivedKey derivedKey = null;
+			if(type.asText().equals("douzone")) {
+				Map<String, String> params = new HashMap<>();
+				Map<String, String> runtimeContext = new HashMap<>();
+				params.put("contextKey", "contextKey");
+				runtimeContext.put("contextKey", contextKey.asText());
+				HsmContextSha256KeyDerivationStrategy douzoneStrategy = new HsmContextSha256KeyDerivationStrategy();
+				derivedKey = douzoneStrategy.deriveKey(params, runtimeContext, binEncKey);
+			} else if(type.asText().equals("kakaobank")) {
+				HsmKeyAndIvSliceDerivationStrategy kakaobank = new HsmKeyAndIvSliceDerivationStrategy();
+				derivedKey = kakaobank.deriveKey(binEncKey, binIv);
+			}
+			
+			JsonNode aad = rootNode.get("aad");
+			if (aad != null) {
+				rootNode.put("generatedAdd", HexaConverter.binToHex(aad.asText().getBytes()));
+			}
+			
+			String encBase64 = Base64.getEncoder().encodeToString(derivedKey.getDecKey());
+			logger.debug("generated KEY {} : [{}]", type.asText(), encBase64);
+			rootNode.put("generatedKeyBase64", encBase64);
+			rootNode.put("generatedKeyHex", HexaConverter.binToHex(derivedKey.getDecKey()));
+			rootNode.put("generatedKeyRaw", new String(derivedKey.getDecKey()));
+			
+			if(derivedKey.getIv() != null) {
+				String encBase64Iv = Base64.getEncoder().encodeToString(derivedKey.getIv());
+				logger.debug("generated IV {} : [{}]", type.asText(), encBase64Iv);
+				rootNode.put("generatedIvBase64", encBase64Iv);
+				rootNode.put("generatedIvHex", HexaConverter.binToHex(derivedKey.getIv()));
+				rootNode.put("generatedIvRaw", new String(derivedKey.getIv()));
+			}
+			String jsonString = OBJECT_MAPPER.writeValueAsString(rootNode);
+			return jsonString;
+
+		} catch (Exception e) {
+			throw new FilterException("HSM key 암호화/복호화 검증 실패", ERROR_PRE_FAIL, HttpStatus.INTERNAL_SERVER_ERROR.value(), e);
+		}
+	}
+
+	@Override
+	public Object doPostFilter(String adptGrpName, String adptName, Object resultMessage, Properties prop,
+			HttpServletRequest request, HttpServletResponse response) throws Exception {
+		return resultMessage;
+	}
+
+}

src/main/java/com/eactive/eai/custom/adapter/http/dynamic/filter/HSMKeyCryptoFilter.java

@@ -0,0 +1,77 @@
+package com.eactive.eai.custom.adapter.http.dynamic.filter;
+
+import java.security.KeyStore;
+import java.util.Base64;
+import java.util.Properties;
+
+import javax.crypto.SecretKey;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.json.simple.JSONObject;
+import org.springframework.http.HttpStatus;
+
+import com.eactive.eai.adapter.http.dynamic.filter.FilterException;
+import com.eactive.eai.adapter.http.dynamic.filter.HttpAdapterFilter;
+import com.eactive.eai.common.hsm.HsmManager;
+import com.eactive.eai.common.util.Logger;
+import com.eactive.eai.util.HexaConverter;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+
+public class HSMKeyCryptoFilter implements HttpAdapterFilter {
+
+	private static final Logger logger = Logger.getLogger(Logger.LOGGER_ADAPTER);
+	
+	private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
+
+	@Override
+	public Object doPreFilter(String adptGrpName, String adptName, Object message, Properties prop,
+			HttpServletRequest request, HttpServletResponse response) throws Exception {
+		try {
+			ObjectNode rootNode = null;
+			String jsonStr = null;
+			if (message instanceof String) {
+				jsonStr = (String) message;
+			} else if (message instanceof JSONObject) {
+				jsonStr = ((JSONObject) message).toJSONString();
+			} else {
+				return message;
+			}
+			rootNode = (ObjectNode)OBJECT_MAPPER.readTree(jsonStr);
+			
+			JsonNode hsmKeyAlias = rootNode.get("hsmKeyAlias");
+			if (hsmKeyAlias != null) {
+				String hsmKeyAliasValue = hsmKeyAlias.textValue();
+				KeyStore keyStore = HsmManager.getInstance().getKeyStore();
+				
+				java.security.Key key = keyStore.getKey(hsmKeyAliasValue, null);
+				if (key instanceof SecretKey) {
+					SecretKey secretKey = (SecretKey) key;
+					byte[] encoded = secretKey.getEncoded();
+					if (encoded != null) {
+						String encBase64 = Base64.getEncoder().encodeToString(encoded);
+						logger.debug("HsmManager] HSM - {} : [{}]", hsmKeyAliasValue, encBase64);
+						rootNode.put("hsmKeyBase64", encBase64);
+						rootNode.put("hsmKeyRaw", HexaConverter.binToHex(encoded));
+					} else {
+						logger.debug("HsmManager] HSM - secretKey null {} : [{}]", hsmKeyAliasValue, secretKey);
+					}
+				}
+			}
+			String jsonString = OBJECT_MAPPER.writeValueAsString(rootNode);
+			return jsonString;
+
+		} catch (Exception e) {
+			throw new FilterException("HSM key 가져오기 실패", ERROR_PRE_FAIL, HttpStatus.INTERNAL_SERVER_ERROR.value(), e);
+		}
+	}
+
+	@Override
+	public Object doPostFilter(String adptGrpName, String adptName, Object resultMessage, Properties prop,
+			HttpServletRequest request, HttpServletResponse response) throws Exception {
+		return resultMessage;
+	}
+
+}

src/main/java/com/eactive/eai/custom/adapter/http/dynamic/filter/KakaopayFilter.java

@@ -0,0 +1,45 @@
+package com.eactive.eai.custom.adapter.http.dynamic.filter;
+
+import java.util.Properties;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import com.eactive.eai.adapter.http.dynamic.filter.FilterException;
+import com.eactive.eai.adapter.http.dynamic.filter.HttpAdapterFilter;
+import com.eactive.eai.common.util.JacksonUtil;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+/**
+ * 카카오뱅크 암복호화에 맟추어 커스텀 필요
+ */
+public class KakaopayFilter implements HttpAdapterFilter {
+
+	private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
+
+	@Override
+	public Object doPreFilter(String adptGrpName, String adptName, Object message, Properties prop,
+			HttpServletRequest request, HttpServletResponse response) throws Exception {
+		
+		JsonNode rootNode = JacksonUtil.readTree(message, OBJECT_MAPPER);
+		
+		// term_agreements[0].is_agreed 값이 true 인지 확인
+		boolean firstAgreed = JacksonUtil.getBoolean(rootNode, "term_agreements[0].is_agreed", false);
+		
+		if (!firstAgreed) {
+			throw new FilterException("EB000003", "금리한도조회실패 - 고객 요청으로 인한 CB 조회 실패", 200);
+		}
+		
+		return message;
+
+	}
+
+	@Override
+	public Object doPostFilter(String adptGrpName, String adptName, Object resultMessage, Properties prop,
+			HttpServletRequest request, HttpServletResponse response) throws Exception {
+		return resultMessage;
+	}
+
+}
+

src/main/java/com/eactive/eai/custom/authoutbound/client/impl/DJBErpNsmapiAccessTokenService.java

@@ -0,0 +1,297 @@
+
+package com.eactive.eai.custom.authoutbound.client.impl;
+ 
+import java.io.IOException;
+import java.nio.charset.Charset;
+import java.security.KeyManagementException;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
+import java.security.UnrecoverableKeyException;
+import java.security.cert.CertificateException;
+import java.util.Date;
+import java.util.Properties;
+
+import javax.net.ssl.SSLContext;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.hc.client5.http.classic.methods.HttpPost;
+import org.apache.hc.client5.http.config.RequestConfig;
+import org.apache.hc.client5.http.impl.classic.CloseableHttpClient;
+import org.apache.hc.client5.http.impl.classic.CloseableHttpResponse;
+import org.apache.hc.client5.http.impl.classic.HttpClients;
+import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager;
+import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuilder;
+import org.apache.hc.client5.http.ssl.NoopHostnameVerifier;
+import org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory;
+import org.apache.hc.client5.http.ssl.TrustAllStrategy;
+import org.apache.hc.core5.http.HttpEntity;
+import org.apache.hc.core5.http.HttpHost;
+import org.apache.hc.core5.http.io.entity.EntityUtils;
+import org.apache.hc.core5.ssl.SSLContextBuilder;
+import org.apache.hc.core5.util.Timeout;
+import org.springframework.security.web.util.UrlUtils;
+
+import com.eactive.eai.adapter.AdapterGroupVO;
+import com.eactive.eai.adapter.AdapterManager;
+import com.eactive.eai.adapter.http.client.HttpClientAdapterServiceKey;
+import com.eactive.eai.adapter.http.secure.HttpClient5SSLContextFactory;
+import com.eactive.eai.authoutbound.OutboundOAuthCredentialVo;
+import com.eactive.eai.authoutbound.client.HttpClientAccessTokenServiceByDB;
+import com.eactive.eai.common.util.Logger;
+import com.eactive.eai.httpouttlsinfo.HttpOutTlsInfoManager;
+import com.eactive.eai.httpouttlsinfo.HttpOutTlsInfoVO;
+import com.eactive.eai.util.TestModeChecker;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.openbanking.eai.common.token.AccessTokenVO;
+import com.openbanking.eai.common.token.OAuth2AccessTokenVO;
+
+/**
+ * 1. 기능 : HTTP 웹 컴포넌트를 POST 방식으로 호출할 수 있는 기능을 제공한다. 2. 처리 개요 : * - 2009.11.24
+ * retry 로직 제거 : 요청 3. 주의사항
+ *
+ * @author :
+ * @version : v 1.0.0
+ * @see : WLIAdapterFactory.java, WLIAdapter.java, WLIDefaultAdapter.java
+ * @since :
+ * 
+ */
+public class DJBErpNsmapiAccessTokenService implements HttpClientAccessTokenServiceByDB {
+
+	public static Logger logger = Logger.getLogger(Logger.LOGGER_DEFAULT);
+
+	private static boolean testMode = TestModeChecker.isTestMode();
+
+	/**
+	 * 1. 기능 : 법인검증 토큰 발급에 사용 2. 처리 개요 : - 속성 정보를 설정 하고 토큰 발급 URL 호출 한다. 3. 주의사항
+	 *  - JSON 방식
+	 *  - ( Header	Authorization	Basic <base64_Encode(client_id:client_secret)> ) 으로 구성
+	 * @param adapterProp Http Adapter 속성 정보
+	 * @return 반환 된 AccessTokenVO
+	 * @exception Exception 수동 시스템 간 통신 중 발생
+	 **/
+	public AccessTokenVO execute(String name, Properties adapterProp, OutboundOAuthCredentialVo oAuthCredentialVo)
+			throws Exception {
+		AdapterGroupVO gvo = AdapterManager.getInstance().getAdapterGroupVO(name);
+		String adapterUrl = adapterProp.getProperty("URL");
+		String encode = gvo.getMessageEncode();
+		String timeoutTemp = adapterProp.getProperty("HTTP_TIME_OUT");
+		if (StringUtils.isBlank(timeoutTemp)) {
+			timeoutTemp = "30000";
+		}
+		String connectionTimeoutTemp = adapterProp.getProperty("CONNECTION_TIMEOUT");
+		if (StringUtils.isBlank(connectionTimeoutTemp)) {
+			connectionTimeoutTemp = "30000";
+		}
+
+		int timeout = Integer.parseInt(timeoutTemp);
+		int connectionTimeout = Integer.parseInt(connectionTimeoutTemp);
+		long currentTime = System.currentTimeMillis();
+
+		String uri = oAuthCredentialVo.getUrl();
+
+		if (!UrlUtils.isAbsoluteUrl(uri)) {
+			uri = appendPath(adapterUrl, uri);
+		}
+		String contentType = "application/json;";
+
+		Charset charset;
+		if (StringUtils.isNotBlank(encode)) {
+			charset = Charset.forName(encode);
+		} else {
+			charset = Charset.defaultCharset();
+			encode = charset.toString();
+		}
+
+		boolean useForwardProxy = StringUtils.equalsIgnoreCase(adapterProp.getProperty("FORWARD_PROXY_USE_YN"), "Y");
+		String forwardProxyUrl = adapterProp.getProperty("FORWARD_PROXY_URL");
+
+		logger.debug(
+				"uri:{}, charset:{}, transactionTimeout:{}, connectionTimeout:{}, useForwardProxy:{}, forwardProxyUrl:{}",
+				uri, encode, timeout, connectionTimeout, useForwardProxy, forwardProxyUrl);
+
+		
+		// mTLS config with default connection parameters
+		boolean useMtls = StringUtils.equalsIgnoreCase(adapterProp.getProperty(HttpClientAdapterServiceKey.USE_MTLS),
+				"Y");
+		AdapterGroupVO adapterGroup = AdapterManager.getInstance().getAdapterGroup(name);
+		String clientId = adapterGroup.getClientId();
+
+		if (logger.isInfo()) {
+			logger.info("adapterGroupName. : {}, useMtls. : {}, clientId : {}", name, useMtls, clientId);
+		}
+
+		int maxTotalConnections = HttpClientAdapterServiceKey.DEFAULT_MAX_TOTAL_CONNECTIONS;
+		int maxHostConnections = HttpClientAdapterServiceKey.DEFAULT_MAX_CONNECTION_PER_HOST;
+
+		HttpOutTlsInfoVO mtlsInfo = null;
+		SSLContext sslContext = null;
+		PoolingHttpClientConnectionManagerBuilder cmBuilder = PoolingHttpClientConnectionManagerBuilder.create();
+		PoolingHttpClientConnectionManager connectionManager = null;
+
+		try {
+			if (useMtls) {
+				HttpOutTlsInfoManager tlsManager = HttpOutTlsInfoManager.getInstance();
+				if (StringUtils.isNotEmpty(clientId)) {
+					mtlsInfo = tlsManager.getHttpOutTlsInfo(clientId);
+				}
+			}
+
+			if (useMtls && mtlsInfo != null) {
+				String storeType = mtlsInfo.getStoreType();
+				String keyStoreInfo = mtlsInfo.getKeystoreInfo();
+				String keyStorePassword = mtlsInfo.getKeystorePassword();
+				String trustStoreInfo = mtlsInfo.getTruststoreInfo();
+				String trustStorePassword = mtlsInfo.getTruststorePassword();
+
+				String[] tlsVersions = null;
+				String[] cipherSuites = null;
+
+				if (StringUtils.isAnyEmpty(keyStoreInfo, keyStorePassword)) {
+					throw new Exception("mTLS keyStore config error");
+				}
+
+				boolean skipTrust = false;
+				if (StringUtils.isAnyEmpty(trustStoreInfo, trustStorePassword)) {
+					if (logger.isWarn())
+						logger.warn("Skip trustStore validation adapterGroupName : " + name);
+					skipTrust = true;
+				}
+
+				sslContext = HttpClient5SSLContextFactory.createMTLSContextFromContent(storeType, keyStoreInfo,
+						keyStorePassword, trustStoreInfo, trustStorePassword, skipTrust, tlsVersions, cipherSuites);
+
+				SSLConnectionSocketFactory sslSocketFactory = null;
+				if (testMode) {
+					sslSocketFactory = new SSLConnectionSocketFactory(sslContext, NoopHostnameVerifier.INSTANCE);
+				} else {
+					sslSocketFactory = new SSLConnectionSocketFactory(sslContext);
+				}
+				cmBuilder.setSSLSocketFactory(sslSocketFactory);
+			} else {
+				sslContext = SSLContextBuilder.create().loadTrustMaterial(new TrustAllStrategy()).build();
+				SSLConnectionSocketFactory csf = new SSLConnectionSocketFactory(sslContext);
+				cmBuilder.setSSLSocketFactory(csf);
+			}
+		} catch (KeyManagementException | NoSuchAlgorithmException | KeyStoreException | CertificateException
+				| IOException | UnrecoverableKeyException e) {
+			throw new RuntimeException(e);
+		} catch (Exception e) {
+			throw new RuntimeException(e);
+		}
+
+		connectionManager = cmBuilder.build();
+		connectionManager.setMaxTotal(maxTotalConnections);
+		connectionManager.setDefaultMaxPerRoute(maxHostConnections);
+
+		//json body setting
+//		Map<String,Object> jsonMap = new HashMap<>();
+//		jsonMap.put("scope",oAuthCredentialVo.getScope());
+//		jsonMap.put("grant_type",oAuthCredentialVo.getGrantType());
+//		ObjectMapper objMapper = new ObjectMapper();
+//		String authJsonBody = objMapper.writeValueAsString(jsonMap);
+
+		try (CloseableHttpClient httpClient = HttpClients.custom().setConnectionManager(connectionManager).build();) {
+			HttpPost httpPost = new HttpPost(uri);
+//			httpPost.setEntity(new StringEntity(authJsonBody));
+			httpPost.setHeader("Content-Type", contentType+" charset=" + encode);
+
+			//HTTP HEADER에 client id, client secret를 base64Encode 한 후 추가
+//			String cId = oAuthCredentialVo.getClientId();
+//			String cSecret = oAuthCredentialVo.getClientSecret();
+//			String authValue = cId + ":" + cSecret;
+//			String encodedAuth = Base64.getEncoder().encodeToString(authValue.getBytes(StandardCharsets.UTF_8));
+			
+			String encodedAuth = oAuthCredentialVo.getClientId();
+			httpPost.setHeader("Authorization","Basic "+ encodedAuth);
+
+
+			RequestConfig.Builder requestConfigBuilder = RequestConfig.custom();
+
+			if (useForwardProxy) {
+				java.net.URL url = new java.net.URL(forwardProxyUrl);
+
+				// 프로토콜, 호스트, 포트 추출
+				String protocol = url.getProtocol();
+				String host = url.getHost();
+				int port = url.getPort();
+				HttpHost proxy = new HttpHost(protocol, host, port);
+				requestConfigBuilder.setProxy(proxy);
+			}
+
+			RequestConfig requestConfig = requestConfigBuilder
+					.setConnectTimeout(Timeout.ofMilliseconds(connectionTimeout))
+					.setResponseTimeout(Timeout.ofMilliseconds(timeout)).build();
+			httpPost.setConfig(requestConfig);
+
+			logger.debug("uri               = [" + uri + "]");
+			logger.debug("oauthClientId     = [" + oAuthCredentialVo.getClientId() + "]");
+			logger.debug("oauthClientSecret = [" + oAuthCredentialVo.getClientSecret() + "]");
+			logger.debug("oauthScope        = [" + oAuthCredentialVo.getScope() + "]");
+			logger.debug("oauthGrantType    = [" + oAuthCredentialVo.getGrantType() + "]");
+			logger.debug("oauthauthValue    = [" + encodedAuth + "]");
+			logger.debug("contentType       = [" + contentType + "]");
+			logger.debug("encode            = [" + encode + "]");
+
+			OAuth2AccessTokenVO accessToken = new OAuth2AccessTokenVO();
+			try (CloseableHttpResponse response = httpClient.execute(httpPost)) {
+				if (response.getCode() != 200) {
+					throw new Exception("OAuth token receive status fail value= " + response.getCode());
+				}
+				
+				logger.info("HttpClientAccessTokenServiceWithBase64Header==>" + response.getCode());
+
+				HttpEntity entity = response.getEntity();
+				String responseString = EntityUtils.toString(entity, encode);
+				logger.debug("Base64Header oauthToken RECV = [" + responseString + "]");
+
+				if (StringUtils.isNotBlank(responseString)) {
+
+					ObjectMapper objectMapper = new ObjectMapper();
+					JsonNode responseJSON = objectMapper.readTree(responseString);
+					
+					if (responseJSON.has("data")) {
+						JsonNode data = responseJSON.path("data");
+						if(data.has("token")) {
+							String token = data.path("token").asText();
+							accessToken.setAccessToken(token);
+						} else {
+							throw new Exception("oauth token return null");
+						}
+					} else {
+						throw new Exception("oauth token return null");
+					}
+//					accessToken.setExpiration(new Date(currentTime + oAuthCredentialVo.getIntervalSec() * 1000L));
+					accessToken.setExpiration(new Date(currentTime + 30_000L));
+					
+					logger.debug("oauthToken =" + accessToken.toString());
+					
+					return accessToken;
+				} else {
+					throw new Exception("oauth token return null");
+				}
+			} catch (Exception e) {
+				e.printStackTrace();
+		        logger.error("[HttpClientAccessTokenServiceWithBase64Header] retrieve accessToken exception :" + e.getMessage());
+		        return accessToken;
+			}
+		}
+	}
+
+	/**
+	 * URL에 경로를 추가합니다. 중복되는 슬래시를 방지합니다.
+	 *
+	 * @param baseUrl   기본 URL
+	 * @param pathToAdd 추가할 경로
+	 * @return 완성된 URL 문자열
+	 */
+	public static String appendPath(String baseUrl, String pathToAdd) {
+		if (!baseUrl.endsWith("/") && !pathToAdd.startsWith("/")) {
+			return baseUrl + "/" + pathToAdd;
+		} else if (baseUrl.endsWith("/") && pathToAdd.startsWith("/")) {
+			return baseUrl + pathToAdd.substring(1);
+		} else {
+			return baseUrl + pathToAdd;
+		}
+	}
+}

src/main/java/com/eactive/eai/custom/common/security/keyderiv/HsmContextSha256KeyDerivationStrategy.java

@@ -2,14 +2,11 @@ package com.eactive.eai.custom.common.security.keyderiv;
 
 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
 import java.util.Map;
 
-import javax.crypto.SecretKey;
-
-import com.eactive.eai.common.hsm.HsmCryptoService;
 import com.eactive.eai.common.security.keyderiv.DerivedKey;
-import com.eactive.eai.common.security.keyderiv.KeyDerivationStrategy;
+import com.eactive.eai.common.security.keyderiv.strategy.BaseHsmKeyDerivationStrategy;
-import com.eactive.eai.common.util.ApplicationContextProvider;
 
 /**
  * HSM 마스터키 + 런타임 컨텍스트값을 연결(concatenate)한 뒤 SHA-256 해싱으로 키를 도출하는 전략.
@@ -21,15 +18,18 @@ import com.eactive.eai.common.util.ApplicationContextProvider;
  *   "contextKey"  : "X-Api-Group-Seq"  -- runtimeContext에서 꺼낼 키 이름
  * }
  */
-public class HsmContextSha256KeyDerivationStrategy implements KeyDerivationStrategy {
+public class HsmContextSha256KeyDerivationStrategy extends BaseHsmKeyDerivationStrategy {
 
 	@Override
 	public DerivedKey deriveKey(Map<String, String> params, Map<String, String> runtimeContext) throws Exception {
-		String hsmKeyAlias = required(params, PARAM_HSM_KEY_ALIAS);
+		byte[] masterKeyBytes = super.getHsmKey(params);
-		String contextKey  = required(params, PARAM_CONTEXT_KEY);
 		
-		SecretKey masterKey   = hsmCryptoService().getSecretKey(hsmKeyAlias);
+		return deriveKey(params, runtimeContext, masterKeyBytes);
-		byte[] masterKeyBytes = masterKey.getEncoded();
+	}
+
+	public DerivedKey deriveKey(Map<String, String> params, Map<String, String> runtimeContext, byte[] masterKeyBytes)
+			throws NoSuchAlgorithmException {
+		String contextKey  = required(params, PARAM_CONTEXT_KEY);
 		byte[] contextBytes   = runtimeContext.getOrDefault(contextKey, "")
 				.getBytes(StandardCharsets.UTF_8);
 
@@ -55,8 +55,4 @@ public class HsmContextSha256KeyDerivationStrategy implements KeyDerivationStrat
 		}
 		return value;
 	}
-
-	private HsmCryptoService hsmCryptoService() {
-		return ApplicationContextProvider.getContext().getBean(HsmCryptoService.class);
-	}
 }

src/main/java/com/eactive/eai/custom/common/security/keyderiv/HsmKeyAndIvSliceDerivationStrategy.java

@@ -24,7 +24,11 @@ public class HsmKeyAndIvSliceDerivationStrategy extends BaseHsmKeyDerivationStra
     public DerivedKey deriveKey(Map<String, String> params, Map<String, String> runtimeContext) throws Exception {
         byte[] keyBytes = super.getHsmKey(params);
         byte[] rawIv    = super.getHsmIv(params);
-        String ivHex    = DatatypeConverter.printHexBinary(rawIv);
+        return deriveKey(keyBytes, rawIv);
+    }
+
+	public DerivedKey deriveKey(byte[] keyBytes, byte[] rawIv) {
+		String ivHex    = DatatypeConverter.printHexBinary(rawIv);
         if (ivHex.length() < IV_HEX_END) {
             throw new IllegalArgumentException(
                     "hsmIvAlias hex 길이 부족: 최소 " + IV_HEX_END + "자 필요, 실제=" + ivHex.length()
@@ -32,7 +36,7 @@ public class HsmKeyAndIvSliceDerivationStrategy extends BaseHsmKeyDerivationStra
         }
         byte[] iv = DatatypeConverter.parseHexBinary(ivHex.substring(IV_HEX_OFFSET, IV_HEX_END));
         return new DerivedKey(keyBytes, keyBytes, iv);
-    }
+	}
 
     @Override
     public String buildCacheKey(String cryptoName, Map<String, String> params, Map<String, String> runtimeContext) {

src/test/java/com/eactive/eai/custom/adapter/http/dynamic/filter/CryptoFilterHsmIntegrationTest.java

@@ -0,0 +1,470 @@
+package com.eactive.eai.custom.adapter.http.dynamic.filter;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assumptions.assumeTrue;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.io.File;
+import java.io.InputStream;
+import java.lang.reflect.Constructor;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Properties;
+import java.util.UUID;
+import java.util.concurrent.TimeUnit;
+
+import javax.crypto.SecretKey;
+import javax.crypto.spec.SecretKeySpec;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.MethodOrderer;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.TestMethodOrder;
+import org.springframework.beans.factory.support.BeanDefinitionBuilder;
+import org.springframework.context.support.GenericApplicationContext;
+
+import com.eactive.eai.adapter.http.dynamic.filter.InCryptoFilter;
+import com.eactive.eai.adapter.http.filter.AbstractCryptoFilter;
+import com.eactive.eai.common.hsm.HsmCryptoService;
+import com.eactive.eai.common.hsm.HsmManager;
+import com.eactive.eai.common.property.PropManager;
+import com.eactive.eai.common.security.CryptoModuleConfigVO;
+import com.eactive.eai.common.security.CryptoModuleManager;
+import com.eactive.eai.common.security.CryptoModuleService;
+import com.eactive.eai.common.security.keyderiv.strategy.HsmKeyDerivationStrategy;
+import com.eactive.eai.common.security.loader.CryptoModuleConfigLoader;
+import com.eactive.eai.common.security.mapper.CryptoModuleConfigMapper;
+import com.eactive.eai.common.util.ApplicationContextProvider;
+import com.eactive.eai.custom.common.security.keyderiv.HsmContextSha256KeyDerivationStrategy;
+import com.eactive.eai.data.entity.onl.security.CryptoModuleConfig;
+
+/**
+ * CryptoFilter HSM 연동 통합 테스트 (SoftHSM2 / SunPKCS11)
+ *
+ * SoftHSM2에서 MASTER_KEY를 조회하여 키를 도출한 뒤
+ * InCryptoFilter 의 암복호화 전체 흐름을 검증한다.
+ *
+ * 사전 조건:
+ *   C:\SoftHSM2 에 SoftHSM2 설치 (미설치 시 자동 건너뜀)
+ *   MASTER_KEY alias는 없으면 자동 생성됨
+ *
+ * 검증 전략:
+ *   HSM → 키 도출 → CryptoModuleExtension → InCryptoFilter doPostFilter(암호화) → doPreFilter(복호화) → 원문 일치
+ */
+@TestMethodOrder(MethodOrderer.DisplayName.class)
+public class CryptoFilterHsmIntegrationTest {
+
+    // -------------------------------------------------------------------------
+    // 상수
+    // -------------------------------------------------------------------------
+
+    private static final String SOFTHSM2_DLL     = "C:/SoftHSM2/lib/softhsm2-x64.dll";
+    private static final String SOFTHSM2_UTIL    = "C:/SoftHSM2/bin/softhsm2-util.exe";
+    private static final String TOKEN_LABEL      = "eapim-test";
+    private static final String PIN              = "1234";
+    private static final String MASTER_KEY_ALIAS = "MASTER_KEY";
+
+    /** HsmKeyDerivationStrategy: HSM 마스터키를 파생 없이 직접 사용 */
+    private static final String MOD_HSM_GCM      = "HSM_GCM";
+    /** HsmContextSha256KeyDerivationStrategy: HSM 마스터키 + 컨텍스트값 SHA-256 파생 */
+    private static final String MOD_CTX_SHA_GCM  = "CTX_SHA256_GCM";
+
+    private static final String CTX_KEY          = "X-Api-Group-Seq";
+    private static final String CTX_VAL_A        = "GROUP-A";
+    private static final String CTX_VAL_B        = "GROUP-B";
+
+    // -------------------------------------------------------------------------
+    // 정적 필드
+    // -------------------------------------------------------------------------
+
+    private static GenericApplicationContext springCtx;
+    private static HsmManager                hsmManager;
+    private static File                      tempCfgFile;
+
+    // -------------------------------------------------------------------------
+    // 내부 클래스: runtimeContext를 고정값으로 반환하는 필터
+    // -------------------------------------------------------------------------
+
+    static class ContextAwareCryptoFilter extends InCryptoFilter {
+        private final String key;
+        private final String value;
+
+        ContextAwareCryptoFilter(String key, String value) {
+            this.key   = key;
+            this.value = value;
+        }
+
+        @Override
+        protected Map<String, String> buildRuntimeContext(Properties prop, HttpServletRequest request) {
+            Map<String, String> ctx = new HashMap<>();
+            ctx.put(key, value);
+            return ctx;
+        }
+    }
+
+    // -------------------------------------------------------------------------
+    // 인스턴스 필드
+    // -------------------------------------------------------------------------
+
+    private HttpServletRequest  mockReq;
+    private HttpServletResponse mockRes;
+
+    // -------------------------------------------------------------------------
+    // 전체 설정 / 해제
+    // -------------------------------------------------------------------------
+
+    @BeforeAll
+    static void setUpAll() throws Exception {
+        assumeTrue(new File(SOFTHSM2_DLL).exists(),
+                "SoftHSM2 미설치 (C:/SoftHSM2) - 테스트 건너뜀");
+        System.setProperty("SOFTHSM2_CONF", "C:\\SoftHSM2\\etc\\softhsm2.conf");
+
+        // 1. 토큰 초기화
+        ensureTokenInitialized();
+
+        // 2. PKCS11 설정 문자열
+        // attributes(*,...): generate/import 모두 CKA_SENSITIVE=false → getEncoded() 사용 가능
+        String cfgContent = "name = SoftHSM\n"
+                + "library = " + SOFTHSM2_DLL + "\n"
+                + "slotListIndex = 0\n"
+                + "attributes(*, CKO_SECRET_KEY, CKK_AES) = {\n"
+                + "  CKA_SENSITIVE = false\n"
+                + "  CKA_EXTRACTABLE = true\n"
+                + "}\n";
+        tempCfgFile = File.createTempFile("pkcs11-filter-it-", ".cfg");
+        Files.write(tempCfgFile.toPath(), cfgContent.getBytes("UTF-8"));
+
+        // 3. Mock PropManager (DB 없이 HSM 설정값 제공)
+        PropManager mockPropManager = mock(PropManager.class);
+        when(mockPropManager.getProperty("HSM", "PKCS11_CONFIG")).thenReturn(cfgContent);
+        when(mockPropManager.getProperty("HSM", "PIN")).thenReturn(PIN);
+        when(mockPropManager.getProperty(eq("HSM"), eq("CACHE_RELOAD_YN"), anyString())).thenReturn("N");
+
+        // 4. HsmManager (private 생성자 → 리플렉션)
+        Constructor<HsmManager> hsmCtor = HsmManager.class.getDeclaredConstructor();
+        hsmCtor.setAccessible(true);
+        hsmManager = hsmCtor.newInstance();
+
+        // 5. CryptoModuleManager (private 생성자 → 리플렉션)
+        CryptoModuleConfigLoader mockLoader = mock(CryptoModuleConfigLoader.class);
+        when(mockLoader.findAll()).thenReturn(buildModuleConfigs());
+
+        Constructor<CryptoModuleManager> managerCtor = CryptoModuleManager.class.getDeclaredConstructor();
+        managerCtor.setAccessible(true);
+        CryptoModuleManager manager = managerCtor.newInstance();
+
+        CryptoModuleService  cryptoService    = new CryptoModuleService();
+        HsmCryptoService     hsmCryptoService = new HsmCryptoService();
+
+        // 6. Spring ApplicationContext 구성
+        springCtx = new GenericApplicationContext();
+        springCtx.getBeanFactory().registerSingleton("propManager",            mockPropManager);
+        springCtx.getBeanFactory().registerSingleton("hsmManager",             hsmManager);
+        springCtx.getBeanFactory().registerSingleton("hsmCryptoService",       hsmCryptoService);
+        springCtx.getBeanFactory().registerSingleton("cryptoModuleConfigLoader", mockLoader);
+        springCtx.getBeanFactory().registerSingleton("cryptoModuleManager",    manager);
+        springCtx.getBeanFactory().registerSingleton("cryptoModuleService",    cryptoService);
+        springCtx.getBeanFactory().registerSingleton("cryptoModuleConfigMapper", testMapper());
+        springCtx.registerBeanDefinition("applicationContextProvider",
+                BeanDefinitionBuilder.genericBeanDefinition(ApplicationContextProvider.class)
+                        .getBeanDefinition());
+        springCtx.refresh();
+
+        // 7. HsmManager 시작 (SunPKCS11 Provider 초기화 + KeyStore 오픈)
+        hsmManager.start();
+        assertTrue(hsmManager.isReady(), "HsmManager 초기화 실패");
+        System.out.println("[HSM] Provider: " + hsmManager.getPkcs11Provider().getName());
+
+        // 8. MASTER_KEY 등록 (없으면 자동 생성)
+        ensureMasterKey();
+
+        // 9. CryptoModuleManager 시작 (모듈 설정 로드)
+        manager.start();
+        System.out.println("[Crypto] 모듈 로드 완료");
+    }
+
+    @AfterAll
+    static void tearDownAll() throws Exception {
+        if (hsmManager != null && hsmManager.isStarted()) hsmManager.stop();
+        if (springCtx  != null) springCtx.close();
+        if (tempCfgFile != null) tempCfgFile.delete();
+    }
+
+    @BeforeEach
+    void setUp() {
+        mockReq = mock(HttpServletRequest.class);
+        mockRes = mock(HttpServletResponse.class);
+    }
+
+    // =========================================================================
+    // 1. HsmKeyDerivationStrategy — HSM 마스터키 직접 사용 (InCryptoFilter)
+    // =========================================================================
+
+    @Test
+    @DisplayName("1-1. FIELD/GCM HsmKey — doPostFilter 암호화 → doPreFilter 복호화 라운드트립")
+    void testHsmGcm_field_roundTrip() throws Exception {
+        InCryptoFilter filter   = new InCryptoFilter();
+        String           original = "{\"acno\":\"1234567890\",\"amount\":\"100000\"}";
+
+        Properties prop = new Properties();
+        prop.setProperty(AbstractCryptoFilter.PROP_MODULE_NAME, MOD_HSM_GCM);
+        // SCOPE 기본값 FIELD, 경로 기본값 사용
+
+        // 암호화: body 전체 → /encrypted_data 필드
+        String encrypted = (String) filter.doPostFilter("G", "A", original, prop, mockReq, mockRes);
+        System.out.println("[1-1] encrypted: " + encrypted);
+        assertTrue(encrypted.contains("encrypted_data"), "/encrypted_data 필드가 있어야 한다");
+
+        // 복호화: /encrypted_data 필드 → body 전체 교체
+        String decrypted = (String) filter.doPreFilter("G", "A", encrypted, prop, mockReq, mockRes);
+        System.out.println("[1-1] decrypted: " + decrypted);
+        assertEquals(original, decrypted);
+    }
+
+    @Test
+    @DisplayName("1-2. BODY/GCM HsmKey — doPostFilter 암호화 → doPreFilter 복호화 라운드트립")
+    void testHsmGcm_body_roundTrip() throws Exception {
+        InCryptoFilter filter   = new InCryptoFilter();
+        String           original = "{\"acno\":\"1234567890\",\"amount\":\"100000\"}";
+
+        Properties prop = new Properties();
+        prop.setProperty(AbstractCryptoFilter.PROP_MODULE_NAME, MOD_HSM_GCM);
+        prop.setProperty(AbstractCryptoFilter.PROP_SCOPE, "BODY");
+
+        // 암호화: body 전체 → Base64 암호문
+        String encrypted = (String) filter.doPostFilter("G", "A", original, prop, mockReq, mockRes);
+        System.out.println("[1-2] encrypted(Base64): " + encrypted);
+        assertNotEquals(original, encrypted, "암호문은 평문과 달라야 한다");
+
+        // 복호화: Base64 암호문 → 원문
+        String decrypted = (String) filter.doPreFilter("G", "A", encrypted, prop, mockReq, mockRes);
+        System.out.println("[1-2] decrypted: " + decrypted);
+        assertEquals(original, decrypted);
+    }
+
+    @Test
+    @DisplayName("1-3. FIELD/GCM HsmKey + AAD 헤더 — 동일 요청 ID로 암복호화 성공")
+    void testHsmGcm_field_withAad_success() throws Exception {
+        InCryptoFilter filter    = new InCryptoFilter();
+        String           original  = "{\"amount\":\"500000\"}";
+        String           requestId = "REQ-20240101-001";
+
+        when(mockReq.getHeader("X-Request-Id")).thenReturn(requestId);
+
+        Properties prop = new Properties();
+        prop.setProperty(AbstractCryptoFilter.PROP_MODULE_NAME, MOD_HSM_GCM);
+        prop.setProperty(AbstractCryptoFilter.PROP_AAD_HEADER,  "X-Request-Id");
+
+        String encrypted = (String) filter.doPostFilter("G", "A", original, prop, mockReq, mockRes);
+        String decrypted = (String) filter.doPreFilter( "G", "A", encrypted, prop, mockReq, mockRes);
+        System.out.println("[1-3] decrypted: " + decrypted);
+        assertEquals(original, decrypted);
+    }
+
+    @Test
+    @DisplayName("1-4. FIELD/GCM HsmKey + AAD 헤더 — 다른 요청 ID로 복호화 시 GCM 인증 실패")
+    void testHsmGcm_field_withAad_wrongAad_fails() throws Exception {
+        InCryptoFilter filter    = new InCryptoFilter();
+        String           original  = "{\"amount\":\"500000\"}";
+
+        // 암호화 시 요청 ID
+        HttpServletRequest encReq = mock(HttpServletRequest.class);
+        when(encReq.getHeader("X-Request-Id")).thenReturn("REQ-CORRECT");
+
+        // 복호화 시 다른 요청 ID
+        HttpServletRequest decReq = mock(HttpServletRequest.class);
+        when(decReq.getHeader("X-Request-Id")).thenReturn("REQ-WRONG");
+
+        Properties prop = new Properties();
+        prop.setProperty(AbstractCryptoFilter.PROP_MODULE_NAME, MOD_HSM_GCM);
+        prop.setProperty(AbstractCryptoFilter.PROP_AAD_HEADER,  "X-Request-Id");
+
+        String encrypted = (String) filter.doPostFilter("G", "A", original, prop, encReq, mockRes);
+
+        assertThrows(Exception.class,
+                () -> filter.doPreFilter("G", "A", encrypted, prop, decReq, mockRes),
+                "잘못된 AAD로 GCM 복호화 시 예외가 발생해야 한다");
+        System.out.println("[1-4] 다른 AAD 복호화 예외 확인 완료");
+    }
+
+    // =========================================================================
+    // 2. HsmContextSha256KeyDerivationStrategy — 컨텍스트 기반 SHA-256 파생 키
+    // =========================================================================
+
+    @Test
+    @DisplayName("2-1. FIELD/GCM ContextSha256 — 동일 컨텍스트로 암복호화 라운드트립")
+    void testCtxSha256Gcm_field_roundTrip() throws Exception {
+        InCryptoFilter filter   = new ContextAwareCryptoFilter(CTX_KEY, CTX_VAL_A);
+        String       original = "{\"accNo\":\"0011234567890\",\"amount\":\"50000\"}";
+
+        Properties prop = new Properties();
+        prop.setProperty(AbstractCryptoFilter.PROP_MODULE_NAME, MOD_CTX_SHA_GCM);
+
+        String encrypted = (String) filter.doPostFilter("G", "A", original, prop, mockReq, mockRes);
+        System.out.println("[2-1] encrypted: " + encrypted);
+        assertTrue(encrypted.contains("encrypted_data"));
+
+        String decrypted = (String) filter.doPreFilter("G", "A", encrypted, prop, mockReq, mockRes);
+        System.out.println("[2-1] decrypted: " + decrypted);
+        assertEquals(original, decrypted);
+    }
+
+    @Test
+    @DisplayName("2-2. FIELD/GCM ContextSha256 — 암호화와 다른 컨텍스트로 복호화 시 GCM 인증 실패")
+    void testCtxSha256Gcm_differentContext_throwsException() throws Exception {
+        InCryptoFilter encFilter = new ContextAwareCryptoFilter(CTX_KEY, CTX_VAL_A);
+        InCryptoFilter decFilter = new ContextAwareCryptoFilter(CTX_KEY, CTX_VAL_B);
+        String       original  = "{\"data\":\"sensitive\"}";
+
+        Properties prop = new Properties();
+        prop.setProperty(AbstractCryptoFilter.PROP_MODULE_NAME, MOD_CTX_SHA_GCM);
+
+        String encrypted = (String) encFilter.doPostFilter("G", "A", original, prop, mockReq, mockRes);
+
+        assertThrows(Exception.class,
+                () -> decFilter.doPreFilter("G", "A", encrypted, prop, mockReq, mockRes),
+                "다른 컨텍스트 키로 파생된 키는 복호화에 실패해야 한다");
+        System.out.println("[2-2] 다른 컨텍스트 복호화 예외 확인 완료");
+    }
+
+    @Test
+    @DisplayName("2-3. FIELD/GCM ContextSha256 — 컨텍스트별 독립 암복호화 (GROUP-A, GROUP-B 각각 성공)")
+    void testCtxSha256Gcm_perGroupRoundTrip() throws Exception {
+        InCryptoFilter filterA  = new ContextAwareCryptoFilter(CTX_KEY, CTX_VAL_A);
+        InCryptoFilter filterB  = new ContextAwareCryptoFilter(CTX_KEY, CTX_VAL_B);
+        String       plainA   = "{\"group\":\"A\",\"amount\":\"1000\"}";
+        String       plainB   = "{\"group\":\"B\",\"amount\":\"2000\"}";
+
+        Properties prop = new Properties();
+        prop.setProperty(AbstractCryptoFilter.PROP_MODULE_NAME, MOD_CTX_SHA_GCM);
+
+        String encA = (String) filterA.doPostFilter("G", "A", plainA, prop, mockReq, mockRes);
+        String encB = (String) filterB.doPostFilter("G", "B", plainB, prop, mockReq, mockRes);
+
+        assertEquals(plainA, (String) filterA.doPreFilter("G", "A", encA, prop, mockReq, mockRes));
+        assertEquals(plainB, (String) filterB.doPreFilter("G", "B", encB, prop, mockReq, mockRes));
+        System.out.println("[2-3] GROUP-A, GROUP-B 각각 독립 암복호화 성공");
+    }
+
+    // =========================================================================
+    // 헬퍼
+    // =========================================================================
+
+    private static List<CryptoModuleConfig> buildModuleConfigs() {
+        return Arrays.asList(
+                buildDynamic(MOD_HSM_GCM, "AES", "GCM", "NoPadding",
+                        HsmKeyDerivationStrategy.class.getName(),
+                        "{\"hsmKeyAlias\":\"" + MASTER_KEY_ALIAS + "\"}"),
+                buildDynamic(MOD_CTX_SHA_GCM, "AES", "GCM", "NoPadding",
+                        HsmContextSha256KeyDerivationStrategy.class.getName(),
+                        "{\"hsmKeyAlias\":\"" + MASTER_KEY_ALIAS + "\",\"contextKey\":\"" + CTX_KEY + "\"}")
+        );
+    }
+
+    private static CryptoModuleConfig buildDynamic(String name, String alg, String mode, String padding,
+            String strategy, String params) {
+        CryptoModuleConfig c = new CryptoModuleConfig();
+        c.setCryptoId(UUID.randomUUID().toString());
+        c.setCryptoName(name);
+        c.setAlgType(alg);
+        c.setCipherMode(mode);
+        c.setPadding(padding);
+        c.setKeySourceType("DYNAMIC");
+        c.setKeyDerivStrategy(strategy);
+        c.setKeyDerivParams(params);
+        c.setCacheYn("Y");
+        c.setCacheTtlSec(60);
+        c.setUseYn("Y");
+        // ivHex = null: GCM에서 IV를 AAD 대체값으로 사용하지 않도록 의도적으로 미설정
+        return c;
+    }
+
+    private static void ensureMasterKey() throws Exception {
+        java.security.KeyStore ks = hsmManager.getKeyStore();
+
+        // 이전 실행 키 삭제 (sensitive 여부 무관하게 항상 고정키로 재등록)
+        if (ks.containsAlias(MASTER_KEY_ALIAS)) {
+            ks.deleteEntry(MASTER_KEY_ALIAS);
+            System.out.println("[HSM] 기존 MASTER_KEY 삭제");
+        }
+
+        // CryptoModuleServiceTest.KEY_128 과 동일한 고정 키 → 두 테스트 간 암호문 비교 가능
+        // attributes(*, CKO_SECRET_KEY, CKK_AES) 지시어로 임포트 시 CKA_SENSITIVE=false 적용
+        byte[] keyBytes = "0123456789abcdef".getBytes(StandardCharsets.UTF_8);
+        SecretKey fixedKey = new SecretKeySpec(keyBytes, "AES");
+        ks.setKeyEntry(MASTER_KEY_ALIAS, fixedKey, null, null);
+
+        // 임포트 후 getEncoded() 검증
+        SecretKey stored = (SecretKey) ks.getKey(MASTER_KEY_ALIAS, null);
+        byte[] encoded = stored.getEncoded();
+        System.out.println("[HSM] MASTER_KEY 등록 완료: alias=" + MASTER_KEY_ALIAS
+                + " / getEncoded()=" + (encoded != null ? encoded.length + "bytes, " + new String(encoded) : "null (추출 불가!)"));
+    }
+
+    private static void ensureTokenInitialized() throws Exception {
+        ProcessBuilder pb = new ProcessBuilder(
+                SOFTHSM2_UTIL, "--init-token", "--free",
+                "--label", TOKEN_LABEL, "--pin", PIN, "--so-pin", PIN);
+        pb.redirectErrorStream(true);
+        Process p   = pb.start();
+        String  out = readOutput(p);
+        p.waitFor(10, TimeUnit.SECONDS);
+        System.out.println("[SoftHSM2] init-token: " + out.trim());
+    }
+
+    private static CryptoModuleConfigMapper testMapper() {
+        return new CryptoModuleConfigMapper() {
+            @Override
+            public CryptoModuleConfigVO toVo(CryptoModuleConfig e) {
+                CryptoModuleConfigVO vo = new CryptoModuleConfigVO();
+                vo.setCryptoId(e.getCryptoId());
+                vo.setCryptoName(e.getCryptoName());
+                vo.setCryptoDesc(e.getCryptoDesc());
+                vo.setAlgType(e.getAlgType());
+                vo.setCipherMode(e.getCipherMode());
+                vo.setPadding(e.getPadding());
+                vo.setIvHex(e.getIvHex());
+                vo.setKeySourceType(e.getKeySourceType());
+                vo.setEncKeyHex(e.getEncKeyHex());
+                vo.setDecKeyHex(e.getDecKeyHex());
+                vo.setKeyDerivStrategy(e.getKeyDerivStrategy());
+                vo.setKeyDerivParams(e.getKeyDerivParams());
+                vo.setCacheYn(e.getCacheYn());
+                vo.setCacheTtlSec(e.getCacheTtlSec());
+                vo.setUseYn(e.getUseYn());
+                return vo;
+            }
+
+            @Override
+            public CryptoModuleConfig toEntity(CryptoModuleConfigVO vo) {
+                return null;
+            }
+        };
+    }
+
+    private static String readOutput(Process p) throws Exception {
+        InputStream   is  = p.getInputStream();
+        byte[]        buf = new byte[4096];
+        StringBuilder sb  = new StringBuilder();
+        int len;
+        while ((len = is.read(buf)) != -1) {
+            sb.append(new String(buf, 0, len, "UTF-8"));
+        }
+        return sb.toString();
+    }
+}

src/test/java/com/eactive/eai/custom/adapter/http/dynamic/filter/KakaopayFilterTest.java

@@ -0,0 +1,108 @@
+package com.eactive.eai.custom.adapter.http.dynamic.filter;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+
+import com.eactive.eai.adapter.http.dynamic.filter.FilterException;
+
+class KakaopayFilterTest {
+
+	private KakaopayFilter filter;
+
+	@BeforeEach
+	void setUp() {
+		filter = new KakaopayFilter();
+	}
+
+	// -----------------------------------------------------------------------
+	// doPreFilter
+	// -----------------------------------------------------------------------
+
+	@Test
+	void preFilter_firstAgreedTrue_returnsMessage() throws Exception {
+		String message = "{\"term_agreements\":[{\"is_agreed\":true}]}";
+
+		Object result = filter.doPreFilter(null, null, message, null, null, null);
+
+		assertSame(message, result);
+	}
+
+	@Test
+	void preFilter_firstAgreedFalse_throwsFilterException() throws Exception {
+		String message = "{\"term_agreements\":[{\"is_agreed\":false}]}";
+
+		FilterException ex = assertThrows(FilterException.class,
+				() -> filter.doPreFilter(null, null, message, null, null, null));
+		assertEquals("EB000003", ex.getMessage());
+		assertEquals(200, ex.getStatus());
+	}
+
+	@Test
+	void preFilter_isAgreedFieldMissing_throwsFilterException() {
+		// is_agreed 필드 없음 → getBoolean 기본값 false → 예외
+		String message = "{\"term_agreements\":[{}]}";
+
+		assertThrows(FilterException.class,
+				() -> filter.doPreFilter(null, null, message, null, null, null));
+	}
+
+	@Test
+	void preFilter_termAgreementsEmpty_throwsFilterException() {
+		// 배열이 비어있어 [0] 접근 불가 → getBoolean 기본값 false → 예외
+		String message = "{\"term_agreements\":[]}";
+
+		assertThrows(FilterException.class,
+				() -> filter.doPreFilter(null, null, message, null, null, null));
+	}
+
+	@Test
+	void preFilter_termAgreementsMissing_throwsFilterException() {
+		// term_agreements 필드 자체 없음 → getBoolean 기본값 false → 예외
+		String message = "{}";
+
+		assertThrows(FilterException.class,
+				() -> filter.doPreFilter(null, null, message, null, null, null));
+	}
+
+	@Test
+	void preFilter_multipleEntries_firstAgreedTrue_returnsMessage() throws Exception {
+		// 첫 번째 true, 두 번째 false → 통과
+		String message = "{\"term_agreements\":["
+				+ "{\"is_agreed\":true},"
+				+ "{\"is_agreed\":false}"
+				+ "]}";
+
+		Object result = filter.doPreFilter(null, null, message, null, null, null);
+
+		assertSame(message, result);
+	}
+
+	@Test
+	void preFilter_multipleEntries_firstAgreedFalse_throwsFilterException() {
+		// 첫 번째 false, 두 번째 true → 예외
+		String message = "{\"term_agreements\":["
+				+ "{\"is_agreed\":false},"
+				+ "{\"is_agreed\":true}"
+				+ "]}";
+
+		assertThrows(FilterException.class,
+				() -> filter.doPreFilter(null, null, message, null, null, null));
+	}
+
+	// -----------------------------------------------------------------------
+	// doPostFilter
+	// -----------------------------------------------------------------------
+
+	@Test
+	void postFilter_alwaysReturnsResultMessage() throws Exception {
+		String resultMessage = "{\"result\":\"ok\"}";
+
+		Object result = filter.doPostFilter(null, null, resultMessage, null, null, null);
+
+		assertSame(resultMessage, result);
+	}
+}