Implementing Data Masking in Spring Boot Applications

Data masking is a critical technique for protecting sensitive information in modern information systems. By transforming or obscuring data, it ensures that sensitive details remain confidential while maintaining usability. This article demonstrates how to implement data masking within a Spring Boot application.

Core Concepts of Data Masking

Data masking involves altering sensitive information to prevent exposure. Common approaches include:

• Masking: Replacing segmetns with symbols (e.g., replacing middle digits of phone numbers with asterisks)
• Encryption: Converting data into ciphetrext
• Truncation: Displaying only partial data (e.g., showing only the first and last digits of an ID number)

Project Setup

Create a Spring Boot project with the following dependencies in pom.xml:

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-data-jpa</artifactId>
    </dependency>
    <dependency>
        <groupId>com.h2database</groupId>
        <artifactId>h2</artifactId>
        <scope>runtime</scope>
    </dependency>
</dependencies>

Entity Definition

Define a User entity containing snesitive fields:

package com.example.masking.entity;

import javax.persistence.Entity;
import javax.persistence.GeneratedValue;
import javax.persistence.GenerationType;
import javax.persistence.Id;

@Entity
public class User {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    private String fullName;
    private String mobileNumber;
    private String nationalId;

    // Accessor methods
}

Masking Utility Class

Implement a utility class for masking operations:

package com.example.masking.util;

public class DataMaskingHelper {

    public static String maskPhoneNumber(String phone) {
        if (phone == null || phone.length() < 7) return phone;
        return phone.substring(0, 3) + "****" + phone.substring(7);
    }

    public static String maskNationalId(String id) {
        if (id == null || id.length() < 4) return id;
        return "****" + id.substring(id.length() - 4);
    }
}