JAVA 2 Network Security
2nd Edition
Published on 23. August 1999
Book
Mixed media product
713 pages
978-0-13-015592-4 (ISBN)
Description
Learn how to use Java reliably, securely, and safely! Unlike other books, which focus on how Java can be broken, this one focuses on delivering practical help with Java security to everyone involved in building and deploying industrial-strength Java-based applications. Now that Java is "leaving the sandbox," you need stronger security than ever, and Java 2 Network Security, Second Edition shows you how to get it. One of the first books to cover the new Java 2 network security model that has been written in full cooperation with Sun's own developers, it compares the pros and cons of every leading approach to Java security. You'll review specific techniques for deploying or limiting Java across corporate firewalls; discover how to integrate Java and SSL; master Java's powerful Cryptography APIs; and learn how to architect your applications to improve their inherent security. The accompanying CD-ROM contains all programs included in the book, plus shareware designed to help readers develop more secure Java programs and more thoroughly understand the new Java 2 security model.
More details
Edition
2nd edition
Language
English
Place of publication
Armonk
United States
Publishing group
Pearson Education (US)
Target group
College/higher education
Dimensions
Height: 235 mm
Width: 178 mm
Thickness: 32 mm
Weight
1112 gr
ISBN-13
978-0-13-015592-4 (9780130155924)
Copyright in bibliographic data and cover images is held by Nielsen Book Services Limited or by the publishers or by their respective licensors: all rights reserved.
Schweitzer Classification
Other editions
Previous edition
Robert MacGreggor | IBM Books
Java Network Security
Book
02/1998
Prentice Hall
€34.73
Article exhausted; check for reprint
Persons
The Team That Wrote This Redbook
This redbook was produced by a team of specialists from around the world working at the International Technical Support Organization Raleigh Center.
The leader of this project was Marco Pistoia.
Marco Pistoia is a Network Security Specialist, working as a project leader at the International Technical Support Organization, Raleigh Center. He writes extensively and teaches IBM classes worldwide on all areas of the e-business Application Framework, WebSphere, Java and Internet security. Marco holds a degree with honors in Pure Mathematics from the University of Rome and a masters degree in Computer Science. Before joining the ITSO, he was a System Engineer in IBM Italy. He received an Outstanding Technical Achievement Award in 1996.
Duane F. Reller is a Senior Software Engineer in the System/390 Programming Laboratory in Endicott, New York, USA. He has 25 years of experience in System/390 Hardware and Software development. He holds a Bachelor's degree in Electrical Technology and a Master of Science degree in Computer Science from the State University of New York at Binghamton. His areas of expertise include Hardware and Software System's Architecture and Management.
Deepak Gupta is a Senior Software Engineer in IBM, India. He has two and a half years of experience in Internet technologies. He holds a degree in Electronics and Communications from the University of Roorkee, India. His areas of expertise include Internet security and Electronic Commerce. Deepak was involved in IBM India's largest e-Commerce project and in India's first secured e-Commerce site allowing Rupee-based transactions, for which he was conferred the Employee of the Month Award. He has also given several talks on Internet security and e-Commerce.
Milind Nagnur is a Senior Associate in the Operations and Systems Risk Management (OSRM) group of Price Waterhouse Coopers in Mumbia, India. He has a couple of years exposure in Internet technologies, with emphasis on security and control issues in real business applications. He holds a degree in Mechanical Engineering from the Indian Institute in Bombay, India, and an MBA from the Indian Institute of Management in Calcutta, India.
Ashok K. Ramani is a Senior Software Engineer in IBM India. He has two and a half years experience in Internet technologies. He holds a degree in MSc.(Tech) Information Systems from the Birla Institute of Technology and Science, Pilani, India. His areas of expertise include Internet security and Electronic Commerce. Ashok was involved in IBM India's largest e-Commerce project and India's first secure e-Commerce site allowing Rupee-based transactions for which he was conferred the Employee of the Month Award. He has won special recognition awards at IBM India for his contribution to e-Commerce projects. He has also presented several talks on Internet security and e-Commerce.
Thanks to the following people for their invaluable contributions to this project:
Anthony J. Nadalin, Julianne Yarsa, Shirley Fox, Donna Smith Skibbie, Bruce Rich IBM Enterprise Security, Austin Center
Larry Koved IBM, Thomas J. Watson Research, Hawthorne
Li Gong, Jan Luehe, Roland Schemers Sun Microsystems, Inc.
Pat Donleycott, Jorge Ferrari, Martin Murhammer, Gail Christensen, Margaret Ticknor, Shawn Walsh, Linda Robinson, Tate Renner IBM, International Technical Support Organization, Raleigh Center
Rob Macgregor, Dave Durbin, John Owlett, Andrew Yeomans Authors of the first edition
Pete Lawther, Simon Phipps Contributors to the first edition
This redbook was produced by a team of specialists from around the world working at the International Technical Support Organization Raleigh Center.
The leader of this project was Marco Pistoia.
Marco Pistoia is a Network Security Specialist, working as a project leader at the International Technical Support Organization, Raleigh Center. He writes extensively and teaches IBM classes worldwide on all areas of the e-business Application Framework, WebSphere, Java and Internet security. Marco holds a degree with honors in Pure Mathematics from the University of Rome and a masters degree in Computer Science. Before joining the ITSO, he was a System Engineer in IBM Italy. He received an Outstanding Technical Achievement Award in 1996.
Duane F. Reller is a Senior Software Engineer in the System/390 Programming Laboratory in Endicott, New York, USA. He has 25 years of experience in System/390 Hardware and Software development. He holds a Bachelor's degree in Electrical Technology and a Master of Science degree in Computer Science from the State University of New York at Binghamton. His areas of expertise include Hardware and Software System's Architecture and Management.
Deepak Gupta is a Senior Software Engineer in IBM, India. He has two and a half years of experience in Internet technologies. He holds a degree in Electronics and Communications from the University of Roorkee, India. His areas of expertise include Internet security and Electronic Commerce. Deepak was involved in IBM India's largest e-Commerce project and in India's first secured e-Commerce site allowing Rupee-based transactions, for which he was conferred the Employee of the Month Award. He has also given several talks on Internet security and e-Commerce.
Milind Nagnur is a Senior Associate in the Operations and Systems Risk Management (OSRM) group of Price Waterhouse Coopers in Mumbia, India. He has a couple of years exposure in Internet technologies, with emphasis on security and control issues in real business applications. He holds a degree in Mechanical Engineering from the Indian Institute in Bombay, India, and an MBA from the Indian Institute of Management in Calcutta, India.
Ashok K. Ramani is a Senior Software Engineer in IBM India. He has two and a half years experience in Internet technologies. He holds a degree in MSc.(Tech) Information Systems from the Birla Institute of Technology and Science, Pilani, India. His areas of expertise include Internet security and Electronic Commerce. Ashok was involved in IBM India's largest e-Commerce project and India's first secure e-Commerce site allowing Rupee-based transactions for which he was conferred the Employee of the Month Award. He has won special recognition awards at IBM India for his contribution to e-Commerce projects. He has also presented several talks on Internet security and e-Commerce.
Thanks to the following people for their invaluable contributions to this project:
Anthony J. Nadalin, Julianne Yarsa, Shirley Fox, Donna Smith Skibbie, Bruce Rich IBM Enterprise Security, Austin Center
Larry Koved IBM, Thomas J. Watson Research, Hawthorne
Li Gong, Jan Luehe, Roland Schemers Sun Microsystems, Inc.
Pat Donleycott, Jorge Ferrari, Martin Murhammer, Gail Christensen, Margaret Ticknor, Shawn Walsh, Linda Robinson, Tate Renner IBM, International Technical Support Organization, Raleigh Center
Rob Macgregor, Dave Durbin, John Owlett, Andrew Yeomans Authors of the first edition
Pete Lawther, Simon Phipps Contributors to the first edition
Content
I. INTRODUCTION TO JAVA AND SECURITY.
1. An Overview of Java and Security.
Java Is Not Just a Language. What Java Does. Java Is Not an Island: Java as a Part of Security. Understanding Java 2 Security. Summary.
2. Attack and Defense.
Components of Java. Java 2 and Cryptography. Attacking the World of Java. Summary.
3. The New Java Security Model.
The Need for Java Security. Evolution of the Java Security Model. Java 2 Protection Domain and Permissions Model. New Class Search Path. Java 2 Class Loading Mechanism. The Policy File. Security Manager vs Access Controller. Security Management with Java 2. Summary.
II. UNDER THE HOOD.
4. The Java Virtual Machine.
The Java Virtual Machine, Close Up. Summary.
5. Class Files in Java 2.
The Traditional Development Life Cycle. The Java Development Life Cycle. The Java 2 Class File Format. The Constant Pool. Java Bytecode.
6. The Class Loader and Class File Verifier.
Class Loaders. The Class File Verifier. The Bytecode Verifier in Detail. An Incompleteness Theorem for Bytecode Verifiers. Summary.
7. The Java 2 Security Manager.
What Security Manager Does. Operation of the Security Manager. Attacking the Defenses of Java. Avoiding Security Hazards. Examples of Security Manager Extensions. Summary.
8. Security Configuration Files in the Java 2 SDK.
A Note on java.home and the JRE Installation Directory. Keystores. The Security Properties File, java.security. Security Policy Files. An Example of Security Settings in the Java 2 Platform. File Read Access to Files in the Code Base URL Directory. Security Properties and Policy File Protection. How to Implement a Policy Server.
9. Java 2 SDK Security Tools.
Key and Certificate Management Tool. Java Archive Tool. JAR Signing and Verification Tool. Policy File Creation and Management Tool.
10. Security APIs in Java.
The Package java.security. The Package java.security.spec. The Package java.security.cert. Package java.security.interfaces. The Package java.security.acl. Examples Using the Java 2 Security APIs. The Permission Classes. How to Write Privileged Code.
11. The Java Plug-In.
Main Features of Java Plug-In. What Does the Java Plug-In Do? Java Plug-In HTML Changes. Java Plug-In Control Panel. Java Plug-In Security Scenario.
12. Java Gets Out of Its Box.
JAR Files and Applet Signing. Signed Code Scenario in JDK 1.1 and Sun HotJava. Signed Code Scenario in Java 2 SDK, Standard Edition, V1.2. Signed Code Scenario in Netscape Communicator. Signed Code Scenario in Microsoft Internet Explorer. The JAR Bug-Fixed In Java 2 SDK, Standard Edition, V1.2.1. Future Developments.
III. BEYOND THE ISLAND OF JAVA SURFING INTO THE UNKNOWN.
13. Cryptography in Java.
Security Questions, Cryptographic Answers. The Java Cryptography Architecture Framework. JCA Terms and Definitions. Java Cryptography Extension. Java Cryptography in Practice. Asymmetric Encryption with the Java 2 SDK and JCE 1.2. How to Implement Your Own Provider.
14. Enterprise Java.
Browser Add-On Applets. Networked Architectures. Secure Clients and Network Computers. Server-Side Java. Servlets. Distributed Object Architectures-RMI. Enterprise JavaBeans.
15. Java and Firewalls in and out of the Net.
What Is a Firewall? What Does a Firewall Do? Detailed Example of TCP/IP Protocol. Proxy Servers and SOCKS Gateways. The Effect of Firewalls on Java. Java and Firewall Scenarios. Remote Method Invocation. Summary.
16. Java and SSL.
What Is SSL? Using SSL from an Applet. Java and SSL with Sun Microsystems. How to Use Java and SSL. Java and SSL with IBM SSLite. Conclusions. Summary.
17. Epilogue.
Future Directions of Java. Conclusion.
Appendix A: Getting Internal System Properties.
Program GetAllProperties. Program GetProperty.
Appendix B: Signature Formats.
Appendix C: X.509 Certificates.
X.509 Certificate Versions.
Appendix D: Sources of Information about Java Security.
Companies. Universities.
Appendix E: What's on the Diskette?
How to Access the Diskette. How to Get the Same Software Material from the Web.
Appendix F: Special Notices.
Appendix G: Related Publications.
International Technical Support Organization Publications. Redbooks on CD-ROMs. Other Publications.
How to Get ITSO Redbooks.
IBM Redbook Fax Order Form.
Glossary.
Index.
ITSO Redbook Evaluation.
1. An Overview of Java and Security.
Java Is Not Just a Language. What Java Does. Java Is Not an Island: Java as a Part of Security. Understanding Java 2 Security. Summary.
2. Attack and Defense.
Components of Java. Java 2 and Cryptography. Attacking the World of Java. Summary.
3. The New Java Security Model.
The Need for Java Security. Evolution of the Java Security Model. Java 2 Protection Domain and Permissions Model. New Class Search Path. Java 2 Class Loading Mechanism. The Policy File. Security Manager vs Access Controller. Security Management with Java 2. Summary.
II. UNDER THE HOOD.
4. The Java Virtual Machine.
The Java Virtual Machine, Close Up. Summary.
5. Class Files in Java 2.
The Traditional Development Life Cycle. The Java Development Life Cycle. The Java 2 Class File Format. The Constant Pool. Java Bytecode.
6. The Class Loader and Class File Verifier.
Class Loaders. The Class File Verifier. The Bytecode Verifier in Detail. An Incompleteness Theorem for Bytecode Verifiers. Summary.
7. The Java 2 Security Manager.
What Security Manager Does. Operation of the Security Manager. Attacking the Defenses of Java. Avoiding Security Hazards. Examples of Security Manager Extensions. Summary.
8. Security Configuration Files in the Java 2 SDK.
A Note on java.home and the JRE Installation Directory. Keystores. The Security Properties File, java.security. Security Policy Files. An Example of Security Settings in the Java 2 Platform. File Read Access to Files in the Code Base URL Directory. Security Properties and Policy File Protection. How to Implement a Policy Server.
9. Java 2 SDK Security Tools.
Key and Certificate Management Tool. Java Archive Tool. JAR Signing and Verification Tool. Policy File Creation and Management Tool.
10. Security APIs in Java.
The Package java.security. The Package java.security.spec. The Package java.security.cert. Package java.security.interfaces. The Package java.security.acl. Examples Using the Java 2 Security APIs. The Permission Classes. How to Write Privileged Code.
11. The Java Plug-In.
Main Features of Java Plug-In. What Does the Java Plug-In Do? Java Plug-In HTML Changes. Java Plug-In Control Panel. Java Plug-In Security Scenario.
12. Java Gets Out of Its Box.
JAR Files and Applet Signing. Signed Code Scenario in JDK 1.1 and Sun HotJava. Signed Code Scenario in Java 2 SDK, Standard Edition, V1.2. Signed Code Scenario in Netscape Communicator. Signed Code Scenario in Microsoft Internet Explorer. The JAR Bug-Fixed In Java 2 SDK, Standard Edition, V1.2.1. Future Developments.
III. BEYOND THE ISLAND OF JAVA SURFING INTO THE UNKNOWN.
13. Cryptography in Java.
Security Questions, Cryptographic Answers. The Java Cryptography Architecture Framework. JCA Terms and Definitions. Java Cryptography Extension. Java Cryptography in Practice. Asymmetric Encryption with the Java 2 SDK and JCE 1.2. How to Implement Your Own Provider.
14. Enterprise Java.
Browser Add-On Applets. Networked Architectures. Secure Clients and Network Computers. Server-Side Java. Servlets. Distributed Object Architectures-RMI. Enterprise JavaBeans.
15. Java and Firewalls in and out of the Net.
What Is a Firewall? What Does a Firewall Do? Detailed Example of TCP/IP Protocol. Proxy Servers and SOCKS Gateways. The Effect of Firewalls on Java. Java and Firewall Scenarios. Remote Method Invocation. Summary.
16. Java and SSL.
What Is SSL? Using SSL from an Applet. Java and SSL with Sun Microsystems. How to Use Java and SSL. Java and SSL with IBM SSLite. Conclusions. Summary.
17. Epilogue.
Future Directions of Java. Conclusion.
Appendix A: Getting Internal System Properties.
Program GetAllProperties. Program GetProperty.
Appendix B: Signature Formats.
Appendix C: X.509 Certificates.
X.509 Certificate Versions.
Appendix D: Sources of Information about Java Security.
Companies. Universities.
Appendix E: What's on the Diskette?
How to Access the Diskette. How to Get the Same Software Material from the Web.
Appendix F: Special Notices.
Appendix G: Related Publications.
International Technical Support Organization Publications. Redbooks on CD-ROMs. Other Publications.
How to Get ITSO Redbooks.
IBM Redbook Fax Order Form.
Glossary.
Index.
ITSO Redbook Evaluation.