Inside Java 2 Platform Security: Architecture, API Design, and Implementation
Be the First to Write a Review and tell the world about this title!Books on similar topics, in best-seller order: Books from the same publisher, in best-seller order:
Inside Java™ 2 Platform Security, the definitive and comprehensive
guide to the Java security platform, has been thoroughly updated to reflect
key additions and revisions to Java security technologies currently in use by
leading technology companies. This second edition, penned by the Java experts
at Sun Microsystems, provides a detailed look into the central workings of the
Java security architecture and describes tools and techniques for successful
implementation on even the most demanding network computing environment.
While Java has always provided a stronger security model than other platforms,
this book reviews all the methods and practices required to improve security
without sacrificing functionality. With tips on how to customize, extend, and
refine the Java security architecture, users will have everything they need
to protect their information assets from both external and internal threats.
This book's in-depth coverage encompasses security architecture, deployment,
customization, new developments, and much more.
Security fundamentals
Secure class loading
Specifying fine-grained security policy
Enforcing security policy with AccessController, SecurityManager, and more
Digital certificates, certification paths, signed code, JAAS, and other
authentication measures
Java-based cryptography with code examples
JSSE, Java GSS-API, and RMI for network security
Previews of other platforms for security, including Java Card, J2ME and
Jini
Designed for both the system administrator and software practitioner, this
book delivers vital knowledge for building and maintaining a secure system using
the Java 2 platform. With detailed code and usage examples throughout, Inside
Java™ 2 Platform Security, Second Edition, is an indispensable
resource for all platform security needs.
The Java™ Series is supported, endorsed, and authored by the creators
of the Java technology at Sun Microsystems, Inc. It is the official place to
go for complete, expert, and definitive information on Java technology. The
books in this Series provide the inside information you need to build effective,
robust, and portable applications and applets. The Series is an indispensable
resource for anyone targeting the Java™ 2 platform.
Table of
Contents
Preface.
How This Book Is Organized.
Acknowledgements.
About the Authors.
Preface to the First Edition.
Computer and Network Security Fundamentals.
Cryptography versus Computer Security.
Threats and Protection.
Perimeter Defense
Access Control and Security Models.
Using Cryptography.
Authentication.
Mobile Code.
Where Java Technology-Based Security Fits In.
Basic Security for the Java Programming Language.
The Java Programming Language and Platform.
Original Basic Security Architecture.
Bytecode Verification and Type Safety.
Signed Applets.
Further Enhancements.
Java 2 Security Architecture.
Security Architecture Requirements of Java™
2.
Overview of the Java 2 Security Architecture.
Architecture Summary.
Lessons Learned.
Secure Class Loading.
Class Files, Types, and Defining Class Loaders.
Well-Known Class Loader Instances.
Class Loader Hierarchies.
Loading Classes.
SecureClassLoader Details.
URLClassLoader Details.
Class Paths.
Elements of Security Policy.
Permissions.
Describing Code.
ProtectionDomain.
Security Policy.
Assigning Permissions.
Dynamic Security Policy.
Enforcing Security Policy.
SecurityManager.
AccessControlContext.
DomainCombiner.
AccessController.
Customizing Security Policy.
Customizing Security Policy Enforcement.
Customizing Security Policy Decisions.
Customizing the Access Control Context.
Establishing Trust.
Digital Certificates.
Establishing Trust with Certification Paths.
Establishing Trust in Signed Code.
User-Centric Authentication and Authorization using JAAS.
Distributed End-Entity Authentication.
Object Security.
Security Exceptions.
Fields and Methods.
Static Fields.
Private Object State and Object Immutability.
Privileged Code.
Serialization.
Inner Classes.
Native Methods.
Signing Objects.
Sealing Objects.
Guarding Objects.
Programming Cryptography.
Cryptographic Concepts.
Design Principles.
Cryptographic Services and Service Providers.
Core Cryptography Classes.
Additional Cryptography Classes.
Code Examples.
Standard Names.
Algorithm Specifications.
Network Security.
Java GSS-API.
JSSE.
Remote Method Invocation.
Deploying the Security Architecture.
Installing the Latest Java 2 Platform Software.
The Installation Directory.
Setting System and Security Properties.
Securing the Deployment.
Installing Provider Packages.
Policy Configuration.
JAAS Login Configuration Files.
Security Tools.
Other Platforms and Future Directions.
Introduction to Java Card.
Introduction to Java 2 Micro Edition.
Security Enhancements On the Horizon for J2SE.
Brief Introduction To Jini Network Technology.
Brief Introduction to J2EE.
Client Containers.
Final Remarks.
Bibliography.
Index
Author Bio
Li Gong is managing director of Sun Microsystems' Engineering and Research
Institute in Beijing, China. Previously at Sun, he was engineering head of Java
Security and Networking, Java Embedded Servers, and JXTA. He obtained B.S. and
M.S. degrees from Tsinghua University, Beijing, and a Ph.D. from the University
of Cambridge. He is associate editor-in-chief of IEEE Internet Computing.
Gary Ellison is a senior staff engineer at Sun Microsystems, where he
designs secure network computing platforms. From 1999 through 2002, he led the
architecture, design, and implementation of the security and networking components
of the Java 2 Platform, Standard Edition. He holds a B.Sc. in mathematics and
physical science from The Ohio State University.
Mary Dageforde is a freelance consultant who writes software documentation
for various computer companies. She has an M.S. in computer science from Stanford
University and a software design and development background. Since 1990, she
has concentrated on documenting APIs, languages, tools, and systems.
|
