Java Security. 2nd Edition

(ebook) (audiobook) (audiobook)

Autor:: Scott Oaks

Promocja Przejdź

Java Security. 2nd Edition Scott Oaks - okladka książki

Java Security. 2nd Edition Scott Oaks - audiobook MP3

Java Security. 2nd Edition Scott Oaks - audiobook CD

Wydawnictwo:: O'Reilly Media (Z chęcią przeczytam książkę w języku polskim)
Ocena:: Bądź pierwszym, który oceni tę książkę
Stron:: 620
Dostępne formaty:: ePub

Mobi

Ebook (160,65 zł najniższa cena z 30 dni)

~~199,00 zł~~ (-15%)
169,14 zł

Dodaj do koszyka lub Kup na prezent Kup 1-kliknięciem

(160,65 zł najniższa cena z 30 dni)

Przenieś na półkę

Do przechowalni

One of Java's most striking claims is that it provides a secure programming environment. Yet despite endless discussion, few people understand precisely what Java's claims mean and how it backs up those claims. If you're a developer, network administrator or anyone else who must understand or work with Java's security mechanisms, Java Security is the in-depth exploration you need.Java Security, 2nd Edition, focuses on the basic platform features of Java that provide security--the class loader, the bytecode verifier, and the security manager--and recent additions to Java that enhance this security model: digital signatures, security providers, and the access controller. The book covers the security model of Java 2, Version 1.3, which is significantly different from that of Java 1.1. It has extensive coverage of the two new important security APIs: JAAS (Java Authentication and Authorization Service) and JSSE (Java Secure Sockets Extension). Java Security, 2nd Edition, will give you a clear understanding of the architecture of Java's security model and how to use that model in both programming and administration.The book is intended primarily for programmers who want to write secure Java applications. However, it is also an excellent resource for system and network administrators who are interested in Java security, particularly those who are interested in assessing the risk of using Java and need to understand how the security model works in order to assess whether or not Java meets their security needs.

Wybrane bestsellery

O autorze książki

Scott Oaks jest architektem w Oracle Corporation. Zajmuje się wydajnością chmury Oracle i oprogramowaniem platformy. Wcześniej przez wiele lat pracował w Sun Microsystems ? specjalizował się w takich dziedzinach jak programowanie sieci, technologia RPC czy oprogramowanie OPEN LOOK Virtual Window Manager. W 2001 roku dołączył do Java Performance Group, w której działa aktywnie do dziś. Jest autorem wielu książek dla programistów.

Ebooka "Java Security. 2nd Edition" przeczytasz na:

czytnikach Inkbook, Kindle, Pocketbook, Onyx Booxs i innych
systemach Windows, MacOS i innych

systemach Windows, Android, iOS, HarmonyOS
na dowolnych urządzeniach i aplikacjach obsługujących formaty: PDF, EPub, Mobi

Masz pytania? Zajrzyj do zakładki Pomoc »

Audiobooka "Java Security. 2nd Edition" posłuchasz:

w aplikacji Ebookpoint na Android, iOS, HarmonyOs
na systemach Windows, MacOS i innych

na dowolonych urządzeniach
i aplikacjach obsługujących format MP3
(pliki spakowane w ZIP)

Masz pytania? Zajrzyj do zakładki Pomoc »

Kurs Video "Java Security. 2nd Edition" zobaczysz:

Oceny i opinie klientów: Java Security. 2nd Edition Scott Oaks (0) Weryfikacja opinii następuję na podstawie historii zamówień na koncie Użytkownika umieszczającego opinię. Użytkownik mógł otrzymać punkty za opublikowanie opinii uprawniające do uzyskania rabatu w ramach Programu Punktowego.

Szczegóły książki

ISBN Ebooka:: 978-14-493-7211-8, 9781449372118
Data wydania ebooka :: 2001-05-17 Data wydania ebooka często jest dniem wprowadzenia tytułu do sprzedaży i może nie być równoznaczna z datą wydania książki papierowej. Dodatkowe informacje możesz znaleźć w darmowym fragmencie. Jeśli masz wątpliwości skontaktuj się z nami sklep@helion.pl.
Język publikacji:: angielski
Rozmiar pliku ePub:: 1.9MB
Rozmiar pliku Mobi:: 5.7MB

Zgłoś erratę
Kategorie:
Programowanie » Java - Programowanie
Hacking » Inne

Spis treści książki

Java Security
A Note Regarding Supplemental Files
Preface
- Who Should Read This Book?
- Versions Used in This Book
- Conventions Used in This Book
  - Command Conventions
  - Code Conventions
- Organization of This Book
- Whats New in This Edition
- How to Contact Us
- Acknowledgments
- Feedback for the Author
1. Java Application Security
- What Is Security?
- Software Used in This Book
  - The Java 2 Platform
  - The Java Cryptography Extension
  - The Java Secure Sockets Extension
  - The Java Authentication and Authorization Service
  - More About Export Controls
  - Other Software Versions
- The Java Sandbox
  - Applets, Applications, and Programs
  - Anatomy of a Java Program
- Security Debugging
- Summary
2. The Default Sandbox
- Elements of the Java Sandbox
- Permissions
  - File Permissions
  - Socket Permissions
  - Property Permissions
  - Runtime Permissions
  - AWT Permissions
  - Net Permissions
  - Security Permissions
  - Serializable Permissions
  - Reflection Permissions
  - All Permissions
- Keystores
- Code Sources
- Policy Files
  - The policytool
    - Managing policy codebases
    - Managing permissions
  - Permissions Outside of Policy Files
- The Default Sandbox
  - The Default Policy File
- The java.security File
- Comparison with Previous Releases
- Summary
3. Java Language Security
- Java Language Security Constructs
  - Object Serialization and Memory Integrity
- Enforcement of the Java Language Rules
  - Compiler Enforcement
  - The Bytecode Verifier
    - Inside the bytecode verifier
    - Delayed bytecode verification
  - Runtime Enforcement
- Comparisons with Previous Releases
  - Controlling Bytecode Verification
- Summary
4. The Security Manager
- Overview of the Security Manager
  - Security Managers and the Java API
- Operating on the Security Manager
- Methods of the Security Manager
  - Methods Relating to File Access
  - Methods Relating to Network Access
  - Methods Protecting the Java Virtual Machine
  - Methods Protecting Program Threads
  - Methods Protecting System Resources
  - Methods Protecting Security Aspects
- Comparison with Previous Releases
  - Trusted and Untrusted Classes
  - Differences in the Security Manager Class
    - File access
    - Network access
    - System access
    - Thread access
    - Security access
- Summary
5. The Access Controller
- The CodeSource Class
- Permissions
  - The Permission Class
  - Using the Permission Class
  - The BasicPermission Class
  - Permission Collections
  - The Permissions Class
- The Policy Class
  - Installing a Policy Class
- Protection Domains
- The AccessController Class
  - Access Control Contexts
- Guarded Objects
- Comparison with Previous Releases
- Summary
6. Java Class Loaders
- The Class Loader and Namespaces
- Class Loading Architecture
- Implementing a Class Loader
  - Class Loader Classes
  - Key Methods of the Class Loader
    - The loadClass( ) method
    - The findClass( ) method
    - The defineClass( ) methods
  - Responsibilities of the Class Loader
  - Using the URL Class Loader
    - Step 1: Optionally call the checkPackageAccess( ) method
    - Step 2: Use the previously-defined class, if available
    - Step 3: Defer class loading to the parent
    - Step 4: Optionally call the checkPackageDefinition( ) method
    - Step 5: Read in the class bytes
    - Step 6: Create the appropriate protection domain
    - Steps 7-8: Define the class, verify it, and resolve it
  - Using the SecureClassLoader Class
  - Other Class Loaders
- Miscellaneous Class Loading Topics
  - Delegation
  - Loading Resources
  - Loading Libraries
- Comparison with Previous Releases
- Summary
7. Introduction to Cryptography
- The Need for Authentication
  - Author Authentication
  - Data Authentication
  - Javas Role in Authentication
- The Role of Authentication
- Cryptographic Engines
  - Cryptographic Keys
  - Message Digests
  - Digital Signatures
  - Encryption Engines
- Summary
8. Security Providers
- The Architecture of Security Providers
  - Components of the Architecture
  - Choosing a Security Provider
- The Provider Class
  - Using the Provider Class
  - Implementing the Provider Class
  - Deploying the Provider Class
- The Security Class
  - The Security Class and the Security Manager
- The Architecture of Engine Classes
- Comparison with Previous Releases
- Summary
9. Keys and Certificates
- Keys
  - The Key Interface
  - Asymmetric Keys
    - DSA keys
    - RSA keys
    - Diffie-Hellman keys
    - The KeyPair class
  - Symmetric Keys
- Generating Keys
  - The KeyPairGenerator Class
    - Using the KeyPairGenerator class
    - Generating DSA keys
  - Implementing a Key Pair Generator
  - The KeyGenerator Class
    - Using the KeyGenerator class
    - Implementing a KeyGenerator class
- Key Factories
  - The KeyFactory Class
    - Using the KeyFactory class
    - Implementing a key factory
  - The SecretKeyFactory Class
  - Key Specifications
    - The EncodedKeySpec class
    - The AlgorithmParameterSpec interface
  - A Key Factory Example
    - Existing key specification classes
- Certificates
  - The Certificate Class
  - The CertificateFactory Class
  - The X509Certificate Class
  - Advanced X509Certificate Methods
  - Revoked Certificates
- Keys, Certificates, and Object Serialization
- Comparison with Previous Releases
- Summary
10. Key Management
- Key Management Terms
- The keytool
  - Global Options to keytool
  - Creating a Key Entry
  - Generating a Certificate Request
  - Importing a Certificate
  - Creating a Certificate Entry
  - Modifying Keystore Entries
  - Deleting Keystore Entries
  - Examining Keystore Data
  - Miscellaneous Commands
  - Using Certificates from Netscape
- The Key Management API
  - Principals
  - The KeyStore Class
- A Key Management Example
  - Installing a KeyStore Class
- Secret Key Management
  - Secret Key Distribution
  - Secret Key Agreement
- Comparison with Previous Releases
- Summary
11. Message Digests
- Using the Message Digest Class
- Secure Message Digests
  - The Mac Class
  - Calculating Your Own MAC
- Message Digest Streams
  - The DigestOutputStream Class
  - The DigestInputStream Class
- Implementing a MessageDigest Class
  - The MacSpi Class
- Comparison with Previous Releases
- Summary
12. Digital Signatures
- The Signature Class
  - Using the Signature Class
  - The SignedObject Class
  - Signing and Certificates
- Signed Classes
  - The jarsigner Tool
    - Creating a signed jar file
    - Verifying a jar file
  - Reading Signed Jar Files
- Implementing a Signature Class
- Comparison with Previous Releases
- Summary
13. Cipher-Based Encryption
- The Cipher Engine
  - Using the Cipher Class for Encryption/Decryption
  - Performing Your Own Padding
  - Initialization of a PBEWithMD5AndDES Cipher
  - Using the Cipher Class for Key Wrapping
  - Implementing the Cipher Class
- Cipher Streams
  - The CipherOutputStream Class
  - The CipherInputStream Class
- Sealed Objects
- Comparison with Previous Releases
- Summary
14. SSL and HTTPS
- An Overview of SSL and JSSE
  - Keystores and Truststores
  - JSSE Certificates
  - JSSE Socket Factories
- SSL Client and Server Sockets
  - SSL Server Sockets
  - SSL Sockets
- SSL Sessions
- SSL Contexts and Key Managers
  - Working with Key Managers
  - Working with Trust Managers
- Miscellaneous SSL Issues
  - SSL Proxies
  - Client-Side Authentication
  - Choosing an SSL Cipher Suite
  - SSL Handshaking
  - JSSE Permissions
- The HTTPS Protocol Handler
  - Verifying HTTPS Hosts
  - HTTPS Properties
- Debugging JSSE
- Summary
15. Authentication and Authorization
- JAAS Overview
- Simple JAAS programming
  - The JAAS Setup Code
    - The LoginContext class
    - The Subject class
  - The JAAS User-Specific Code
- Simple JAAS Administration
  - Configuring Login Modules
    - Login control flags
    - Sample login modules
  - Writing Policy Files
    - Writing JAAS policy files
    - Writing standard policy files
  - Running the Example
- Advanced JAAS Topics
  - JAAS Callbacks
    - The name callback
    - The password callback
    - The text input callback
    - The text output callback
    - The choice callback
    - The confirmation callback
    - The language callback
  - Writing a Login Module
  - The JAAS Policy Class
  - Administering a JAAS Policy
  - Client/Server Authentication
  - Groups and Roles
- Summary
A. The java.security File
B. Security Resources
- Security Bugs
  - Java Security Bugs
  - Tracking Security Bugs
- Third-Party Security Providers
- Security References
C. Identity-Based Key Management
- Javakey
  - Creating Identities and Signers
  - Generating Keys and Certificates
  - Exporting and Importing Credentials
  - Signing a jar File
  - Miscellaneous javakey Commands
- Identities
  - The Identity Class
    - Using the identity class
    - Implementing an Identity class
    - The Identity class and the security manager
  - Signers
    - Using the Signer class
    - Implementing a signer
    - Signers and the security manager
- Identity Scopes
  - Using the IdentityScope Class
  - Writing an Identity Scope
  - IdentityScope and the Security Manager
- Key Management in an Identity Scope
  - Implementing an Identity Class
  - Implementing a Signer Class
  - A Shared System Identity Scope
  - Creating Identities
- Summary
D. The Secure Java Container
- The 1.1-Based Class Loader
  - Defining Signed Classes
- The 1.1-Based Security Manager
  - Protected Methods of the Security Manager
    - The class loader depth
    - Protected instance variables in the security manager
  - Implementation Techniques
    - Implementing network access
    - Implementing thread security
    - Implementing the file access methods
- Running Secure Applications
- Summary
E. Implementing a JCE Security Provider
F. Quick Reference
- Package java.security
  - Class java.security.AccessControlContext
  - Class java.security.AccessController
  - Class java.security.AlgorithmParameterGenerator
  - Class java.security.AlgorithmParameter-GeneratorSpi
  - Class java.security.AlgorithmParameters
  - Class java.security.AlgorithmParametersSpi
  - Class java.security.AllPermission
  - Class java.security.BasicPermission
  - Interface java.security.Certificate
  - Class java.security.CodeSource
  - Class java.security.DigestInputStream
  - Class java.security.DigestOutputStream
  - Interface java.security.DomainCombiner
  - Interface java.security.Guard
  - Class java.security.GuardedObject
  - Class java.security.Identity
  - Class java.security.IdentityScope
  - Interface java.security.Key
  - Class java.security.KeyFactory
  - Class java.security.KeyFactorySpi
  - Class java.security.KeyPair
  - Class KeyPairGenerator
  - Class KeyPairGeneratorSpi
  - Class java.security.KeyStore
  - Class java.security.KeyStoreSpi
  - Class java.security.MessageDigest
  - Class java.security.MessageDigestSpi
  - Class java.security.Permission
  - Class java.security.PermissionCollection
  - Class java.security.Permissions
  - Class java.security.Policy
  - Interface java.security.Principal
  - Interface java.security.PrivateKey
  - Class java.security.ProtectionDomain
  - Class java.security.Provider
  - Interface java.security.PublicKey
  - Class java.security.SecureClassLoader
  - Class java.security.SecureRandom
  - Class java.security.SecureRandomSpi
  - Class java.security.Security
  - Class java.security.SecurityPermission
  - Class java.security.Signature
  - Class java.security.SignatureSpi
  - Class java.security.SignedObject
  - Class java.security.Signer
  - Class java.security.UnresolvedPermission
- Package java.security.cert
  - Class java.security.cert.Certificate
  - Class java.security.cert.CertificateFactory
  - Class java.security.cert.CertificateFactorySpi
  - Class java.security.cert.CRL
  - Class java.security.cert.X509Certificate
  - Class java.security.cert.X509CRL
  - Class java.security.cert.X509CRLEntry
  - Interface java.security.cert.X509Extension
- Package java.security.interfaces
  - Interface java.security.interfaces.DSAKey
  - Interface java.security.interfaces.DSAKeyPair-Generator
  - Interface java.security.interfaces.DSAParams
  - Interface java.security.interfaces.DSAPrivateKey
  - Interface java.security.interfaces.DSAPublicKey
  - Interface java.security.interfaces.RSAKey
  - Interface java.security.interfaces.RSAPrivateCrtKey
  - Interface java.security.interfaces.RSAPrivateKey
  - Interface java.security.interfaces.RSAPublicKey
- Package java.security.spec
  - Interface java.security.spec.Algorithm-ParameterSpec
  - Class java.security.spec.DSAParameterSpec
  - Class java.security.spec.DSAPrivateKeySpec
  - Class java.security.spec.DSAPublicKeySpec
  - Class java.security.spec.EncodedKeySpec
  - Interface java.security.spec.KeySpec
  - Class java.security.spec.PKCS8EncodedKeySpec
  - Class java.security.spec.RSAKeyGenParameterSpec
  - Class java.security.spec.RSAPrivateCrtKeySpec
  - Class java.security.spec.RSAPrivateKeySpec
  - Class java.security.spec.RSAPublicKeySpec
  - Class java.security.spec.X509EncodedKeySpec
- Package javax.crypto
  - Class javax.crypto.Cipher
  - Class javax.crypto.CipherInputStream
  - Class javax.crypto.CipherOutputStream
  - Class javax.crypto.CipherSpi
  - Class javax.crypto.ExemptionMechanism
  - Class javax.crypto.ExemptionMechanismSpi
  - Class javax.crypto.KeyAgreement
  - Class javax.crypto.KeyAgreementSpi
  - Class javax.crypto.KeyGenerator
  - Class javax.crypto.KeyGeneratorSpi
  - Class javax.crypto.Mac
  - Class javax.crypto.MacSpi
  - Class javax.crypto.NullCipher
  - Class javax.crypto.SealedObject
  - Interface javax.crypto.SecretKey
  - Class javax.crypto.SecretKeyFactory
  - Class javax.crypto.SecretKeyFactorySpi
- Package javax.crypto.interfaces
  - Interface javax.crypto.interfaces.DHKey
  - Interface javax.crypto.interfaces.DHPrivateKey
  - Interface javax.crypto.interfaces.DHPublicKey
- Package javax.crypto.spec
  - Class javax.crypto.spec.DESKeySpec
  - Class javax.crypto.spec.DESedeKeySpec
  - Class javax.crypto.spec.DHGenParameterSpec
  - Class javax.crypto.spec.DHParameterSpec
  - Class javax.crypto.spec.DHPrivateKeySpec
  - Class javax.crypto.spec.DHPublicKeySpec
  - Class javax.crypto.spec.IvParameterSpec
  - Class javax.crypto.spec.PBEKeySpec
  - Class javax.crypto.spec.PBEParameterSpec
  - Class javax.crypto.spec.RC2ParameterSpec
  - Class javax.crypto.spec.RC5ParameterSpec
  - Class javax.crypto.spec.SecretKeySpec
- Package javax.net
  - Class javax.net.ServerSocketFactory
  - Class javax.net.SocketFactory
- Package javax.net.ssl
  - Class javax.net.ssl.HandshakeCompletedEvent
  - Interface javax.net.ssl.HandshakeCompleted-Listener
  - Class javax.net.ssl.SSLServerSocket
  - Class javax.net.ssl.SSLServerSocketFactory
  - Interface javax.net.ssl.SSLSession
  - Class javax.net.ssl.SSLSessionBindingEvent
  - Interface javax.net.ssl.SSLSessionBindingListener
  - Interface javax.net.ssl.SSLSessionContext
  - Class javax.net.ssl.SSLSocket
  - Class javax.net.ssl.SSLSocketFactory
- Package javax.security.auth
  - Class javax.security.auth.AuthPermission
  - Interface javax.security.auth.Destroyable
  - Class javax.security.auth.Policy
  - Class javax.security.auth.PrivateCredential-Permission
  - Interface javax.security.auth.Refreshable
  - Class javax.security.auth.Subject
  - Class javax.security.auth.SubjectDomainCombiner
- Package javax.security.auth.callback
  - Interface javax.security.auth.callback.Callback
  - Interface javax.security.auth.callback.Callback-Handler
  - Class javax.security.auth.callback.ChoiceCallback
  - Class javax.security.auth.callback.Confirmation-Callback
  - Class javax.security.auth.callback.LanguageCallback
  - Class javax.security.auth.callback.NameCallback
  - Class javax.security.auth.callback.Password-Callback
  - Class javax.security.auth.callback.TextInputCallback
  - Class javax.security.auth.callback.TextOutput-Callback
- Package javax.security.auth.login
  - Class javax.security.auth.login.AppConfiguration-Entry
  - Class javax.security.auth.login.Configuration
  - Class javax.security.auth.login.LoginContext
- Package javax.security.auth.spi
  - Interface javax.security.auth.spi.LoginModule
- Package javax.security.cert
  - Class javax.security.cert.Certificate
  - Class javax.security.cert.X509Certificate
- Package com.sun.net.ssl
  - Interface com.sun.net.ssl.HostnameVerifier
  - Class com.sun.net.ssl.HttpsURLConnection
  - Interface com.sun.net.ssl.KeyManager
  - Class com.sun.net.ssl.KeyManagerFactory
  - Class com.sun.net.ssl.KeyManagerFactorySpi
  - Class com.sun.net.ssl.SSLContext
  - Class com.sun.net.ssl.SSLContextSpi
  - Class com.sun.net.ssl.SSLPermission
  - Interface com.sun.net.ssl.TrustManager
  - Class com.sun.net.ssl.TrustManagerFactory
  - Class com.sun.net.ssl.TrustManagerFactorySpi
  - Interface com.sun.net.ssl.X509KeyManager
  - Interface com.sun.net.ssl.X509TrustManager
- Package com.sun.security.auth
  - Class com.sun.security.auth.NTDomainPrincipal
  - Class com.sun.security.auth.NTNumericCredential
  - Class com.sun.security.auth.NTSid
  - Class com.sun.security.auth.NTSid
  - Class com.sun.security.auth.NTSidDomainPrincipal
  - Class com.sun.security.auth.NTSidGroupPrincipal
  - Class com.sun.security.auth.NTSidPrimaryGroup-Principal
  - Class com.sun.security.auth.NTSidUserPrincipal
  - Class com.sun.security.auth.NTUserPrincipal
  - Class com.sun.security.auth.PolicyFile
  - Interface com.sun.security.auth.PrincipalComparator
  - Class com.sun.security.auth.SolarisNumericGroup-Principal
  - Class com.sun.security.auth.SolarisNumericUser-Principal
  - Class com.sun.security.auth.SolarisPrincipal
  - Class com.sun.security.auth.X500Principal
- Package com.sun.security.auth.login
  - Class com.sun.security.auth.login.ConfigFile
- Package com.sun.security.auth.module
  - Class com.sun.security.auth.module.JndiLogin-Module
  - Class com.sun.security.auth.module.NTLoginModule
  - Class com.sun.security.auth.module.SolarisLogin-Module
- Miscellaneous Packages
  - Class java.awt.AWTPermission
  - Class java.io.FilePermission
  - Class java.io.SerializablePermission
  - Class java.lang.ClassLoader
  - Class java.lang.RuntimePermission
  - Class java.lang.SecurityManager
  - Class java.lang.reflect.ReflectPermission
  - Class java.net.NetPermission
  - Class java.net.SocketPermission
  - Class java.net.URLClassLoader
  - Class java.rmi.RMISecurityManager
  - Class java.rmi.server.RMIClassLoader
  - Class java.util.PropertyPermission
Index
About the Author
Colophon
Copyright