Enterprise Java? Security
Building Secure J2EE? Applications
Published on 11. March 2004
Book
Paperback/Softback
608 pages
978-0-321-11889-9 (ISBN)
Description
Enterprise Java (TM) Security: Building Secure J2EE (TM) Applications provides application developers and programmers with the know-how they need to utilize the latest Java security technologies in building secure enterprise infrastructures. Written by the leading Java security experts at IBM, this comprehensive guide covers the current status of the Java (TM) 2 Platform, Enterprise Edition (J2EE), and Java (TM) 2 Platform, Standard Edition (J2SE (TM)), security architectures and offers practical solutions and usage patterns to address the challenges of Java security.
To aid developers who need to build secure J2EE applications, Enterprise Java (TM) Security covers at length the J2EE security technologies, including the security aspects of servlets, JavaServer Pages(TM) (JSP (TM)), and Enterprise JavaBeans (TM) (EJB (TM))-technologies that are at the core of the J2EE architecture. In addition, the book covers Web Services security.
Examples and sample code are provided throughout the book to give readers a solid understanding of the underlying technology.
The relationship between Java and cryptographic technologies is covered in great detail, including:
Java Cryptography Architecture (JCA)
Java Cryptography Extension (JCE)
Public-Key Cryptography Standards (PKCS)
Secure/Multipurpose Internet Mail Extensions (S/MIME)
Java Secure Socket Extension (JSSE)
To aid developers who need to build secure J2EE applications, Enterprise Java (TM) Security covers at length the J2EE security technologies, including the security aspects of servlets, JavaServer Pages(TM) (JSP (TM)), and Enterprise JavaBeans (TM) (EJB (TM))-technologies that are at the core of the J2EE architecture. In addition, the book covers Web Services security.
Examples and sample code are provided throughout the book to give readers a solid understanding of the underlying technology.
The relationship between Java and cryptographic technologies is covered in great detail, including:
Java Cryptography Architecture (JCA)
Java Cryptography Extension (JCE)
Public-Key Cryptography Standards (PKCS)
Secure/Multipurpose Internet Mail Extensions (S/MIME)
Java Secure Socket Extension (JSSE)
More details
Language
English
Place of publication
New Jersey
United States
Publishing group
Pearson Education (US)
Target group
College/higher education
Dimensions
Height: 234 mm
Width: 181 mm
Thickness: 29 mm
Weight
892 gr
ISBN-13
978-0-321-11889-9 (9780321118899)
Copyright in bibliographic data and cover images is held by Nielsen Book Services Limited or by the publishers or by their respective licensors: all rights reserved.
Schweitzer Classification
Persons
Marco Pistoia is a Research Staff Member in the Java and Web Services Security department at the IBM T. J. Watson Research Center in Yorktown Heights, New York. He has written ten books and several conference papers and journal articles, and has also presented worldwide on all areas of Java and e-business security. Most recently, he was the lead author of the book Java 2 Network Security, Second Edition (Prentice Hall, 1999).
Nataraj Nagaratnam is a Senior Technical Staff Member and the lead security architect for IBM's WebSphere software family in Raleigh, North Carolina. He has coauthored the Web Services security specifications and actively participates in the Java community process on the topics related to J2EE security. He was the lead author of one of the first books on Java networking, Java Networking and AWT API SuperBible (Waite Group Press, 1996).
Larry Koved is a Research Staff Member and the manager of the Java and Web Services Security department at the IBM T. J. Watson Research Center in Yorktown Heights, New York. He was actively involved in the design of JAAS and the EJB V1.1 security architecture, has published over twenty-five articles and technical reports, and has presented at conferences worldwide.
Anthony Nadalin is a Senior Technical Staff Member and IBM Software Group's lead security architect for Java and Web Services in Austin, Texas. He is responsible for security infrastructure design and development across IBM, Tivoli, and Lotus. He has authored and coauthored over thirty technical journal and conference articles, as well as the book Java and Internet Security (iUniverse.com, 2000).
0321118898AB01122004
Nataraj Nagaratnam is a Senior Technical Staff Member and the lead security architect for IBM's WebSphere software family in Raleigh, North Carolina. He has coauthored the Web Services security specifications and actively participates in the Java community process on the topics related to J2EE security. He was the lead author of one of the first books on Java networking, Java Networking and AWT API SuperBible (Waite Group Press, 1996).
Larry Koved is a Research Staff Member and the manager of the Java and Web Services Security department at the IBM T. J. Watson Research Center in Yorktown Heights, New York. He was actively involved in the design of JAAS and the EJB V1.1 security architecture, has published over twenty-five articles and technical reports, and has presented at conferences worldwide.
Anthony Nadalin is a Senior Technical Staff Member and IBM Software Group's lead security architect for Java and Web Services in Austin, Texas. He is responsible for security infrastructure design and development across IBM, Tivoli, and Lotus. He has authored and coauthored over thirty technical journal and conference articles, as well as the book Java and Internet Security (iUniverse.com, 2000).
0321118898AB01122004
Content
Foreword.
Preface.
About the Authors.
I. ENTERPRISE SECURITY AND JAVA.
1. An Overview of Java Technology and Security.
Why Java Technology for Enterprise Applications?
Enterprise Java Technology.
Java Technology as Part of Security.
An Overview of Enterprise Security Integration.
Time to Market.
2. Enterprise Network Security and Java Technology.
Networked Architectures.
Network Security.
Server-Side Java Technology.
Java and Firewalls.
Summary.
II. ENTERPRISE JAVA COMPONENTS SECURITY.
3. Enterprise Java Security Fundamentals.
Enterprise Systems.
J2EE Applications.
Secure Interoperability between ORBs.
Connectors.
JMS.
Simple E-Business Request Flow.
J2EE Platform Roles.
J2EE Security Roles.
Declarative Security Policies.
Programmatic Security.
Secure Communication within a WAS Environment.
Secure E-Business Request Flow.
4. Servlet and JSP Security.
Introduction.
Advantages of Servlets.
Servlet Life Cycle.
The Deployment Descriptor of a Web Module.
Authentication.
Authorization.
Principal Delegation.
Programmatic Security.
Runtime Restrictions for Web Components.
Usage Patterns.
Partitioning Web Applications.
5. EJB Security.
Introduction.
EJB Roles and Security.
Authentication.
Authorization.
Delegation.
Security Considerations.
6. Enterprise Java Security Deployment Scenarios.
Planning a Secure-Component System.
Deployment Topologies.
Secure Communication Channel.
Security Considerations.
III. THE FOUNDATIONS OF JAVA 2 SECURITY.
7. J2SE Security Fundamentals.
Access to Classes, Interfaces, Fields, and Methods.
Class Loaders.
The Class File Verifier.
The Security Manager.
Interdependence of the Three Java Security Legs.
Summary.
8. The Java 2 Permission Model.
Overview of the Java 2 Access-Control Model.
Java Permissions.
Java Security Policy.
The Concept of CodeSource.
ProtectionDomains.
The Basic Java 2 Access-Control Model.
Privileged Java 2 Code.
ProtectionDomain Inheritance.
Performance Issues in the Java 2 Access-Control Model.
Summary.
9. Authentication and Authorization with JAAS.
Overview of JAAS and JAAS Terminology.
Authentication.
Authorization Overview.
JAAS and J2EE.
Additional Support for Pluggable Authentication.
IV. ENTERPRISE JAVA AND CRYPTOGRAPHY.
10. The Theory of Cryptography.
The Purpose of Cryptography.
Secret-Key Cryptography.
Public-Key Cryptography.
11. The Java 2 Platform and Cryptography.
The JCA and JCE Frameworks.
The JCA API.
The JCE API.
JCE in Practice.
Security Considerations.
12. PKCS and S/MIME in J2EE.
PKCS Overview.
S/MIME Overview.
Signing and Verifying Transactions with PKCS and S/MIME.
Encrypting Transactions with PKCS and S/MIME.
Security Considerations.
Future Directions.
13. The SSL and TLS Protocols in a J2EE Environment.
The SSL and TLS Protocols.
HTTPS.
Using the SSL Support Built into J2EE Products.
Using SSL from within J2EE Programs.
Examples.
Summary.
V. ADVANCED TOPICS.
14. Enterprise Security for Web Services.
XML.
SOAP
WSDL.
Security for Web Services: Motivations.
Security Technologies.
Web Services Security Model Principles.
Application Patterns.
Use Scenario.
Web Services Provider Security.
Security Considerations.
Futures.
15. Security Considerations for Container Providers.
Understanding the Environment.
Authentication.
Authorization.
Secure Communication.
Secure Association.
Access to System Resources.
Mapping Identities at Connector Boundaries.
16. Epilogue.
VI. APPENDIXES.
Appendix A. Security of Distributed Object Architectures.
Appendix B. X.509 Digital Certificates.
Appendix C. Technical Acronyms Used in This Book.
Appendix D. Sources Used in This Book.
Index.
Preface.
About the Authors.
I. ENTERPRISE SECURITY AND JAVA.
1. An Overview of Java Technology and Security.
Why Java Technology for Enterprise Applications?
Enterprise Java Technology.
Java Technology as Part of Security.
An Overview of Enterprise Security Integration.
Time to Market.
2. Enterprise Network Security and Java Technology.
Networked Architectures.
Network Security.
Server-Side Java Technology.
Java and Firewalls.
Summary.
II. ENTERPRISE JAVA COMPONENTS SECURITY.
3. Enterprise Java Security Fundamentals.
Enterprise Systems.
J2EE Applications.
Secure Interoperability between ORBs.
Connectors.
JMS.
Simple E-Business Request Flow.
J2EE Platform Roles.
J2EE Security Roles.
Declarative Security Policies.
Programmatic Security.
Secure Communication within a WAS Environment.
Secure E-Business Request Flow.
4. Servlet and JSP Security.
Introduction.
Advantages of Servlets.
Servlet Life Cycle.
The Deployment Descriptor of a Web Module.
Authentication.
Authorization.
Principal Delegation.
Programmatic Security.
Runtime Restrictions for Web Components.
Usage Patterns.
Partitioning Web Applications.
5. EJB Security.
Introduction.
EJB Roles and Security.
Authentication.
Authorization.
Delegation.
Security Considerations.
6. Enterprise Java Security Deployment Scenarios.
Planning a Secure-Component System.
Deployment Topologies.
Secure Communication Channel.
Security Considerations.
III. THE FOUNDATIONS OF JAVA 2 SECURITY.
7. J2SE Security Fundamentals.
Access to Classes, Interfaces, Fields, and Methods.
Class Loaders.
The Class File Verifier.
The Security Manager.
Interdependence of the Three Java Security Legs.
Summary.
8. The Java 2 Permission Model.
Overview of the Java 2 Access-Control Model.
Java Permissions.
Java Security Policy.
The Concept of CodeSource.
ProtectionDomains.
The Basic Java 2 Access-Control Model.
Privileged Java 2 Code.
ProtectionDomain Inheritance.
Performance Issues in the Java 2 Access-Control Model.
Summary.
9. Authentication and Authorization with JAAS.
Overview of JAAS and JAAS Terminology.
Authentication.
Authorization Overview.
JAAS and J2EE.
Additional Support for Pluggable Authentication.
IV. ENTERPRISE JAVA AND CRYPTOGRAPHY.
10. The Theory of Cryptography.
The Purpose of Cryptography.
Secret-Key Cryptography.
Public-Key Cryptography.
11. The Java 2 Platform and Cryptography.
The JCA and JCE Frameworks.
The JCA API.
The JCE API.
JCE in Practice.
Security Considerations.
12. PKCS and S/MIME in J2EE.
PKCS Overview.
S/MIME Overview.
Signing and Verifying Transactions with PKCS and S/MIME.
Encrypting Transactions with PKCS and S/MIME.
Security Considerations.
Future Directions.
13. The SSL and TLS Protocols in a J2EE Environment.
The SSL and TLS Protocols.
HTTPS.
Using the SSL Support Built into J2EE Products.
Using SSL from within J2EE Programs.
Examples.
Summary.
V. ADVANCED TOPICS.
14. Enterprise Security for Web Services.
XML.
SOAP
WSDL.
Security for Web Services: Motivations.
Security Technologies.
Web Services Security Model Principles.
Application Patterns.
Use Scenario.
Web Services Provider Security.
Security Considerations.
Futures.
15. Security Considerations for Container Providers.
Understanding the Environment.
Authentication.
Authorization.
Secure Communication.
Secure Association.
Access to System Resources.
Mapping Identities at Connector Boundaries.
16. Epilogue.
VI. APPENDIXES.
Appendix A. Security of Distributed Object Architectures.
Appendix B. X.509 Digital Certificates.
Appendix C. Technical Acronyms Used in This Book.
Appendix D. Sources Used in This Book.
Index.