I am trying to balance good security practices against excessive logging of user metadata / Personally Identifiable Information.
I am constructing a web app that allows for secure messaging. In part of my system design, I am trying to minimize leaking of user metadata.
Part of my system design includes a module that tracks IP addresses to prevent abuse, such as Denial-of-Service or account cracking. I only keep the log of IP addresses around as long as needed. A straightforward approach would be to log the IP address and a timestamp in a logfile, and delete entries after a period of time. To head off any distractions, the intent is to ban abusive IP addresses for a set amount of time (i.e., linear offset), not permanently.
The threat model is that the logs could be used to determine who was using the system and when. I want the users of this system to have confidence that even if a server is compromised, that the logs are not designed in such a way that a third party could infer who used the system, and when, to talk to whom.
My first thought was that storing information in a form that can be verified later, yet not stored in plaintext, is similar to how one securely stores system passwords using a key derivation function (i.e., applying a hash to a passphrase and a salt for a large number of iterations). Thus, the same way that a user password can be verified against its KDF-based hash, an IP can be checked against its KDF-based hash in the log file to see if the same IP address has been logged before.
What are the strengths and weaknesses of this approach? Are there superior methods for storing user metadata / PII not in plaintext, in a format that a web app can verify?
Updated to clarify web app purpose, and the threat model.