O'Reilly logo

Stay ahead with the world's most comprehensive technology and business learning platform.

With Safari, you learn the way you learn best. Get unlimited access to videos, live online training, learning paths, books, tutorials, and more.

Start Free Trial

No credit card required

Java Security

Java Security

by Scott Oaks
Publisher: O'Reilly Media, Inc.
Release Date: May 1998
ISBN: 1565924037
View table of contents
Start reading

Book Description

Java's most striking claim is that it provides a secure programming environment. However, despite lots of discussion, few people understand precisely what Java's claims mean and how it backs up those claims. Java Security is an in-depth exploration aimed at developers, network administrators, and anyone who needs to work with or understand Java's security mechanisms. It discusses in detail what security does and doesn't mean, what Java's default security policies are, and how to create and implement your own policies. In doing so, Java Security provides detailed coverage of security managers, class loaders, the access controller, and much of the java.security package. It discusses message digests, certificates, and digital signatures, showing you how to use Java's facilities for signing classes or to implement your own signature facility. It shows you how to write a class loader that recognizes signed classes, verifies the signature, and cooperates with a security manager to grant additional privileges. It also discusses the problem of managing cryptographic keys and shows you how to implement your own key management systems. Java Security is an essential book for everyone using Java in real-world software. If you're deploying software written in Java, you need to know how to grant your classes the privileges they need, without granting privileges to untrusted classes. You need to know how to protect your systems against intrusion and corruption. Java provides the tools; this book shows you how to use them.

Table of Contents

  1. Java Security
    1. Preface
      1. Who Should Read This Book?
      2. Versions Used in This Book
      3. Conventions Used in This Book
      4. Organization of This Book
      5. How to Contact Us
      6. Acknowledgments
      7. Feedback for the Author
    2. 1. Java Application Security
      1. What Is Security?
      2. The Java Sandbox
      3. Applications, Applets, and Programs
        1. Anatomy of a Java Application
      4. Running a Java Application
        1. Outline of the JavaRunner Application
        2. Built-in Java Application Security
      5. Summary
    3. 2. Java Language Security
      1. Java Language Security Constructs
        1. Object Serialization and Memory Integrity
      2. Enforcement of the Java Language Rules
        1. Compiler Enforcement
        2. The Bytecode Verifier
          1. Inside the bytecode verifier
          2. Delayed bytecode verification
          3. Controlling bytecode verification
        3. Runtime Enforcement
      3. Summary
    4. 3. Java Class Loaders
      1. Security and the Class Loader
        1. Class Loaders and Security Enforcement
        2. Class Loaders and Namespaces
      2. Anatomy of a Class Loader
        1. The Internal Class Loader
        2. The Applet Class Loader
        3. The RMI Class Loader
        4. The Secure Class Loader
        5. The URL Class Loader
        6. Choosing the Right Class Loader
      3. Loading Classes
      4. Implementing a Class Loader
        1. Implementing the ClassLoader Class
          1. Protected methods in the ClassLoader class
        2. Implementing the SecureClassLoader Class
          1. Protected methods of the SecureClassLoader class
        3. Implementing Security Policies in the Class Loader
      5. Extensions to the Class Loader
        1. Loading from Multiple Sites
        2. A JAR File Class Loader
      6. Miscellaneous Class Loading Topics
        1. Delegation
        2. Loading Resources
        3. Loading Libraries
      7. Summary
    5. 4. The Security Manager Class
      1. Overview of the Security Manager
        1. Security Managers and the Java API
      2. Trusted and Untrusted Classes
      3. Using the Security Manager
        1. Setting a Security Manager
        2. Methods Relating to File Access
        3. Methods Relating to Network Access
        4. Methods Protecting the Java Virtual Machine
        5. Methods Protecting Program Threads
        6. Methods Protecting System Resources
        7. Methods Protecting Security Aspects
      4. Summary
    6. 5. The Access Controller
      1. The CodeSource Class
      2. Permissions
        1. The Permission Class
        2. Permissions of the Java API
        3. Using the Permission Class
        4. The BasicPermission Class
        5. Permission Collections
        6. The Permissions Class
      3. The Policy Class
        1. The Default Policy
      4. Protection Domains
      5. The AccessController Class
      6. Guarded Objects
      7. Summary
    7. 6. Implementing Security Policies
      1. Protected Methods of the Security Manager
        1. The Class Loader Depth
        2. Protected Instance Variables in the Security Manager
      2. Security Managers and the Class Loader
        1. The Class Loader and the Security Manager
      3. Implementation Techniques
        1. Utility Classes
        2. Implementing Network Access
        3. Network Permissions in the Class Loader
        4. Implementing Thread Security
        5. Implementing Package Access
        6. Establishing a Security Policy in 1.2
        7. Establishing a 1.1 Security Policy
          1. The RMI security manager
          2. A complete 1.1 security manager
          3. Implementing the file access methods
          4. Implementing network, thread, and package access
          5. Implementing miscellaneous methods
      4. Running Secure Applications
        1. The Secure JavaRunner Program
        2. The Secure Java Launcher
      5. Summary
    8. 7. Introduction to Cryptography
      1. The Need for Authentication
        1. Author Authentication
        2. Data Authentication
        3. Java’s Role in Authentication
      2. The Role of Authentication
      3. Cryptographic Engines
        1. Message Digests
        2. Cryptographic Keys
        3. Digital Signatures
        4. Encryption Engines
      4. Summary
    9. 8. Security Providers
      1. The Architecture of Security Providers
        1. Components of the Architecture
        2. Choosing a Security Provider
      2. The Provider Class
        1. Using the Provider Class
        2. Implementing the Provider Class
      3. The Security Class
        1. The Security Class and the Security Manager
      4. The Architecture of Engine Classes
      5. Summary
    10. 9. Message Digests
      1. Using the Message Digest Class
        1. Secure Message Digests
      2. Message Digest Streams
        1. The DigestOutputStream Class
        2. The DigestInputStream Class
      3. Implementing a MessageDigest Class
      4. Summary
    11. 10. Keys and Certificates
      1. Keys
        1. The Key Interface
          1. DSA keys
        2. The KeyPair Class
      2. The KeyPairGenerator Class
        1. Using the KeyPairGenerator Class
        2. Generating DSA Keys
        3. Implementing a Key Pair Generator
      3. The KeyFactory Class
        1. Using the KeyFactory class
        2. Implementing a Key Factory
        3. Key Specifications
          1. The EncodedKeySpec class
          2. The AlgorithmParameterSpec interface
        4. A Key Factory Example
      4. Certificates
        1. The Certificate Class
        2. The CertificateFactory Class
        3. The X509Certificate Class
        4. Advanced X509Certificate Methods
        5. Revoked Certificates
      5. Keys, Certificates, and Object Serialization
      6. Summary
    12. 11. Key Management
      1. Overview of Key Management
        1. Principals
      2. The KeyStore Class
      3. A Key Management Example
        1. Installing a KeyStore Class
      4. Summary
    13. 12. Digital Signatures
      1. The Signature Class
        1. Using the Signature Class
        2. The SignedObject Class
        3. Signing and Certificates
      2. Signed Classes
        1. Reading Signed JAR Files
        2. The Signed JAR File and Security Policies
      3. Implementing a Signature Class
      4. Summary
    14. 13. Encryption
      1. Export Restrictions
      2. The Sun Security Provider in the JCE
      3. Key Types in the JCE
        1. Secret Keys
      4. Secret Key Engines
        1. The KeyGenerator Class
          1. Using the KeyGenerator class
          2. Implementing a KeyGenerator class
        2. The SecretKeyFactory Class
          1. Secret key specifications
          2. The secret key factory SPI
      5. Encrypting Data
        1. Using the Cipher Class
        2. Cipher Algorithms
        3. Implementing the Cipher Class
      6. Cipher Streams
        1. The CipherOutputStream Class
        2. The CipherInputStream Class
        3. SSL Encryption
      7. Symmetric Key Agreement
      8. Sealed Objects
      9. Summary
    15. A. Security Tools
      1. The keytool
        1. Global Options to keytool
        2. Adding a Certificate Entry
        3. Adding a Key Entry
        4. Modifying Keystore Entries
        5. Deleting Keystore Entries
        6. Examining Keystore Data
        7. Importing a 1.1-Based Identity Database
        8. Miscellaneous Commands
      2. The jarsigner Tool
        1. Creating a Signed JAR File
        2. Verifying a JAR File
      3. The policytool
        1. Managing Policy Codebases
        2. Managing Permissions
        3. Managing Certificate Entries
      4. Files to Administer by Hand
        1. The java.security File
        2. The java.policy File
    16. B. Identity-Based Key Management
      1. Identities
        1. The Identity Class
          1. Using the identity class
          2. Implementing an Identity class
          3. The Identity class and the security manager
        2. Signers
          1. Using the Signer class
          2. Implementing a signer
          3. Signers and the security manager
      2. Identity Scopes
        1. Using the IdentityScope Class
        2. Writing an Identity Scope
        3. IdentityScope and the Security Manager
      3. Key Management in an Identity Scope
        1. Implementing an Identity Class
        2. Implementing a Signer Class
        3. A Shared System Identity Scope
        4. Creating Identities
      4. Summary
    17. C. Security Resources
      1. Security Bugs
        1. Java Security Bugs
        2. Tracking Security Bugs
      2. Third-Party Security Providers
      3. Security References
    18. D. Quick Reference
      1. Package java.security
        1. Class java.security.AccessControlContext
        2. Class java.security.AccessController
        3. Class java.security.AlgorithmParameterGenerator
        4. Class java.security.AlgorithmParameterGeneratorSpi
        5. Class java.security.AlgorithmParameters
        6. Class java.security.AlgorithmParametersSpi
        7. Class java.security.AllPermission
        8. Class java.security.BasicPermission
        9. Class java.security.CodeSource
        10. Class java.security.DigestInputStream
        11. Class java.security.DigestOutputStream
        12. Interface java.security.Guard
        13. Class java.security.GuardedObject
        14. Class java.security.Identity
        15. Class java.security.IdentityScope
        16. Interface java.security.Key
        17. Class java.security.KeyFactory
        18. Class java.security.KeyFactorySpi
        19. Class java.security.KeyPair
        20. Class KeyPairGenerator
        21. Class KeyPairGeneratorSpi
        22. Class java.security.KeyStore
        23. Class java.security.MessageDigest
        24. Class java.security.MessageDigestSpi
        25. Class java.security.Permission
        26. Class java.security.PermissionCollection
        27. Class java.security.Permissions
        28. Class java.security.Policy
        29. Interface java.security.Principal
        30. Interface java.security.PrivateKey
        31. Class java.security.ProtectionDomain
        32. Class java.security.Provider
        33. Interface java.security.PublicKey
        34. Class java.security.SecureClassLoader
        35. Class java.security.SecureRandom
        36. Class java.security.Security
        37. Class java.security.SecurityPermission
        38. Class java.security.Signature
        39. Class java.security.SignatureSpi
        40. Class java.security.SignedObject
        41. Class java.security.Signer
        42. Class java.security.UnresolvedPermission
      2. Package java.security.cert
        1. Class java.security.cert.Certificate
        2. Class java.security.cert.CertificateFactory
        3. Class java.security.cert.X509Certificate
        4. Class java.security.cert.X509CRL
        5. Class java.security.cert.X509CRLEntry
        6. Interface java.security.cert.X509Extension
      3. Package java.security.interfaces
        1. Interface java.security.interfaces.DSAKey
        2. Interface java.security.interfaces.DSAKeyPairGenerator
        3. Interface java.security.interfaces.DSAParams
        4. Interface java.security.interfaces.DSAPrivateKey
        5. Interface java.security.interfaces.DSAPublicKey
        6. Interface java.security.interfaces.RSAPrivateKey
        7. Interface java.security.interfaces.RSAPublicKey
      4. Package java.security.spec
        1. Interface java.security.spec.AlgorithmParameterSpec
        2. Class java.security.spec.DSAParameterSpec
        3. Class java.security.spec.DSAPrivateKeySpec
        4. Class java.security.spec.DSAPublicKeySpec
        5. Class java.security.spec.EncodedKeySpec
        6. Interface java.security.spec.KeySpec
        7. Class java.security.spec.PKCS8EncodedKeySpec
        8. Class java.security.spec.RSAPrivateKeySpec
        9. Class java.security.spec.RSAPublicKeySpec
        10. Class java.security.spec.X509EncodedKeySpec
      5. Package javax.crypto
        1. Class javax.crypto.Cipher
        2. Class javax.crypto.CipherInputStream
        3. Class javax.crypto.CipherOutputStream
        4. Class javax.crypto.CipherSpi
        5. Class javax.crypto.KeyAgreement
        6. Class javax.crypto.KeyAgreementSpi
        7. Class javax.crypto.KeyGenerator
        8. Class javax.crypto.KeyGeneratorSpi
        9. Class javax.crypto.NullCipher
        10. Class javax.crypto.SealedObject
        11. Interface javax.crypto.SecretKey
        12. Class javax.crypto.SecretKeyFactory
        13. Class javax.crypto.SecretKeyFactorySpi
      6. Package javax.crypto.interfaces
        1. Interface javax.crypto.interfaces.DHKey
        2. Interface javax.crypto.interfaces.DHPrivateKey
        3. Interface javax.crypto.interfaces.DHPublicKey
      7. Package javax.crypto.spec
        1. Class javax.crypto.spec.DESKeySpec
        2. Class javax.crypto.spec.DESedeKeySpec
        3. Class javax.crypto.spec.DHGenParameterSpec
        4. Class javax.crypto.spec.DHParameterSpec
        5. Class javax.crypto.spec.DHPrivateKeySpec
        6. Class javax.crypto.spec.DHPublicKeySpec
        7. Class javax.crypto.spec.IvParameterSpec
        8. Class javax.crypto.spec.PBEKeySpec
        9. Class javax.crypto.spec.PBEParameterSpec
      8. Miscellaneous Packages
        1. Class java.awt.AWTPermission
        2. Class java.io.FilePermission
        3. Class java.io.SerializablePermission
        4. Class java.lang.ClassLoader
        5. Class java.lang.RuntimePermission
        6. Class java.lang.SecurityManager
        7. Class java.lang.reflect.ReflectPermission
        8. Class java.net.NetPermission
        9. Class java.net.SocketPermission
        10. Class java.net.URLClassLoader
        11. Class java.rmi.RMISecurityManager
        12. Class java.rmi.server.RMIClassLoader
        13. Class java.util.PropertyPermission
    19. Index
    20. Colophon