BGMS log masking module
Period
After the SK Telecom breach, some customers asked for log masking in addition to phone number encryption. It had to apply to 14 types of MSA servers, so I built it as a module that any server can add.
Local caching avoids more than 25 Redis lookups per log entry
- Checks whether a customer needs masking first, then wraps the log object before it is passed on and masks it inside the module
Redis bottleneck
- Problem
- Each log entry queried Redis to check whether the customer required masking. A single sending log averaged more than 25 Redis lookups, so the risk of a bottleneck grew quickly.
- Solution
- Added a local cache inside the module, so cache hits skip Redis. The list of customers that require masking is synchronized locally every day to stay current.
Finding fields in nested objects
- Problem
- Values passed to the logger were not plain strings but nested objects, lists and JSON. Finding the fields to mask meant searching every level, which getters and setters could not do.
- Solution
- Serialized the log object with Gson and traversed the JSON tree with DFS. During traversal, the bsid decides whether the customer requires masking, and fields beneath it such as recipient, phone_number and message are masked. Because fields are found the same way regardless of object structure, the module could be added to any server.