Java Security

Java Security, 2nd Edition focuses on the platform features of Java that provide security--the class loader, bytecode verifier, and security manager--and recent additions to Java that enhance this security model: digital signatures, security providers, and the access controller. The book covers in depth the security model of Java 2, version 1.3, including the two new security APIs: JAAS (Java Authentication and Authorization Service) and JSSE (Java Secure Sockets Extension).

Scott Oaks is a Java Technologist at Sun Microsystems, where he has worked since 1987. While at Sun, he has specialized in many disparate technologies, from the SunOS kernel to network programming and RPCs. Since 1995, hes focused primarily on Java and bringing Java technology to end-users. Scott also authored OReillys Java Security, Java Threads and Jini in a Nutshell titles.

Preface

xi

Java Application Security

1

(17)

What Is Security?

1

(3)

Software Used in This Book

4

(6)

The Java Sandbox

10

(5)

Security Debugging

15

(2)

Summary

17

(1)

The Default Sandbox

18

(25)

Elements of the Java Sandbox

18

(2)

Permissions

20

(12)

Keystores

32

(1)

Code Sources

32

(1)

Policy Files

33

(5)

The Default Sandbox

38

(3)

The java.security File

41

(1)

Comparison with Previous Releases

41

(1)

Summary

42

(1)

Java Language Security

43

(15)

Java Language Security Constructs

44

(6)

Enforcement of the Java Language Rules

50

(6)

Comparisons with Previous Releases

56

(1)

Summary

57

(1)

The Security Manager

58

(26)

Overview of the Security Manager

59

(5)

Operating on the Security Manager

64

(1)

Methods of the Security Manager

65

(15)

Comparison with Previous Releases

80

(2)

Summary

82

(2)

The Access Controller

84

(28)

The CodeSource Class

85

(1)

Permissions

86

(12)

The Policy Class

98

(3)

Protection Domains

101

(1)

The AccessController Class

102

(7)

Guarded Objects

109

(1)

Comparison with Previous Releases

110

(1)

Summary

111

(1)

Java Class Loaders

112

(19)

The Class Loader and Namespaces

112

(3)

Class Loading Architecture

115

(2)

Implementing a Class Loader

117

(10)

Miscellaneous Class Loading Topics

127

(2)

Comparison with Previous Releases

129

(1)

Summary

130

(1)

Introduction to Cryptography

131

(15)

The Need for Authentication

132

(5)

The Role of Authentication

137

(1)

Cryptographic Engines

138

(6)

Summary

144

(2)

Security Providers

146

(20)

The Architecture of Security Providers

146

(6)

The Provider Class

152

(6)

The Security Class

158

(5)

The Architecture of Engine Classes

163

(1)

Comparison with Previous Releases

164

(1)

Summary

164

(2)

Keys and Certificates

166

(39)

Keys

167

(5)

Generating Keys

172

(9)

Key Factories

181

(8)

Certificates

189

(13)

Keys, Certificates, and Object Serialization

202

(1)

Comparison with Previous Releases

203

(1)

Summary

204

(1)

Key Management

205

(39)

Key Management Terms

206

(3)

The Keytool

209

(12)

The Key Management API

221

(7)

A Key Management Example

228

(6)

Secret Key Management

234

(7)

Comparison with Previous Releases

241

(2)

Summary

243

(1)

Message Digests

244

(17)

Using the Message Digest Class

244

(4)

Secure Message Digests

248

(3)

Message Digest Streams

251

(4)

Implementing a Message Digest Class

255

(5)

Comparison with Previous Releases

260

(1)

Summary

260

(1)

Digital Signatures

261

(27)

The Signature Class

261

(11)

Signed Classes

272

(9)

Implementing a Signature Class

281

(5)

Comparison with Previous Releases

286

(1)

Summary

287

(1)

Cipher-Based Encryption

288

(23)

The Cipher Engine

288

(17)

Cipher Streams

305

(4)

Sealed Objects

309

(1)

Comparison with Previous Releases

310

(1)

Summary

310

(1)

SSL and HTTPS

311

(35)

An Overview of SSL and JSSE

311

(10)

SSL Client and Server Sockets

321

(3)

SSL Sessions

324

(3)

SSL Contexts and Key Managers

327

(10)

Miscellaneous SSL Issues

337

(4)

The HTTPS Protocol Handler

341

(3)

Debugging JSSE

344

(1)

Summary

345

(1)

Authentication and Authorization

346

(33)

JAAS Overview

347

(2)

Simple JAAS programming

349

(3)

Simple JAAS Administration

352

(10)

Advanced JAAS Topics

362

(16)

Summary

378

(1)

The jave.security File

379

(3)

Security Resources

382

(10)

Identity-Based Key Management

392

(28)

The Secure Java Container

420

(30)

Implementing a JCE Security Provider

450

(8)

Quick Reference

458

(109)

Index

567

What is included with this book?

The New copy of this book will include any supplemental materials advertised. Please check the title of the book to determine if it should include any access cards, study guides, lab manuals, CDs, etc.

The Used, Rental and eBook copies of this book are not guaranteed to include any supplemental materials. Typically, only the book itself is included. This is true even if the title states it includes any access cards, study guides, lab manuals, CDs, etc.

FREE SHIPPING

Amazon no longer offers textbook rentals. We do!

Summary

Author Biography

Table of Contents

Supplemental Materials