Security Application Of Java Computer Science
In the modern internet world data plays a key role which can't be accessed by unauthorized users who can invade and destroy the user's data while transmitting in the network. The result of compilation java source code is byte code. For java application byte code is primary source, the code may have come from the local systems or it may have travelled around the network. To secure application from the external threads, we need to have secured measures, secured environment which fulfills the business needs. Java provides restricted environment in which untrusted programs runs.
The high level security features of Java are Platform Security, Cryptography, Authentication and Access Control, Secure Communication, Public Key Infrastructure. Java security technology provides the security framework for developers and tools to securely manage applications for administrators. In this Research paper I am going to explain about the security features of Java
PLATFORM SECURITYByte Code Verifier.
In distributed computing user, business logic, database access and processing are in different geographical locations. In such case web applets which may be untrusted have to be download and executed in the personal computers by the web browser which leads to various attacks like modifying the private data like bank account, installing virus .Here we have to take certain security measures to find malicious applet. This is done by verifying byte code of the downloaded code. When Java source code is compiled it gets translated into machine independent byte code. When a program is downloaded a byte code verifier checks the Java Language Specifications, rules, namespace restrictions, memory management violations, stack underflows and illegal data typecasts , When verification process is completed then the byte code is ready to execute safely. Sensitive applications make use of smart cards which provides more security to java applets.Class loader:
Java class loader is used to load the java classes dynamically in to the virtual machine. With the presence of java class loader the java run time environment not need to know about the files systems while running a java application. Class loader plays a crucial role in the Java security which coordinates with access controller or security manager and enforces certain rules on the namespace. Based on the request Security manager it find some information about the class and apply the appropriate security policy to it. Java has to follow namespace rules for avoiding some security problems. When accessing two different sites there may be a change to have the same fully qualified name in such case they are loaded by separate instance of the class loaders corresponding applets are loaded on different pages in this way class loader provides security and solves logical problem .
CRYPTOGRAPHYJAVA cryptography architecture
The Framework of Java Cryptography architecture provides developing and accessing functionalities of Cryptography for the Java platform. It provides various Cryptographic services that include Digital Signature algorithms, Symmetric stream encryption, Asymmetric encryption, Password-based encryption Key agreement algorithms, Message Authentication Codes Key generators, Digital signature algorithms. The classes of javax.crypto package provide cipher and keyAgreement. Java platform has implemented many built in cryptographic algorithms, signature algorithms(RSA and DSA),, encryption algorithms(DES, AES, and ARCFOUR), message digest algorithms(MD5 and SHA-1) Diffie-Hellman key agreement algorithm. The Cryptographic services which are located on the PKCS#11 token are accessed with the provider name sunPKCS11 which is a native bridge.JAVA cryptography extension
Java Cryptograpgy Extention (JCE) API consists of classes and interfaces which has algorithms and security features , it provides framework and implementation for keygeneration authentication Code algorithm and encryption. It tells how to create a key,cipher and it represents s data encryption and decryption.Public Key Infrastructure(PKI)
The framework which enables secure communication or secure exchange of information is Public Key Infrastructure(PKI) which verifies the authenticity of certificates when it is confined to the digital certificates.PKI classes are located in java.security and java.security.cert packages. Cryptographic keys are stored in java.security.keyStore class and certificate in java.security.cert.CertStore Classencryption and decryption
sandbox and its working
policies and permissions and its working---Access Control:Avoiding untrusted code to create malicious things by accessing Java API is called Access control.In network , the code downloaded is untrusted and run in a restricted environment called "the sandbox."The installed java.lang.Security Manager object defines access control policies of the sandbox which restricts untrusted operation on local system by throwing Security Exception by using appropriate method.Java-enabled web browser is the common user that installs a Security Manager object to allow applets to run without damaging the host system.How the sandbox works : Use of a class should be subject to access control by making use of Security Manager class. When an operation is going to perform it first checks constructor of Security Manager object which throws a Security Exception if untrusted operation is going to perform so that the operation can be avoided.Eg : FileInputStream class - provided with access control - FileInputStream() constructor - to use the SecurityManager class. If The checkRead() method of Security Manager Object is called and has no return value; it either returns normally or throws a Security Exception for untrusted operation.Thus access can be control in Sandbox.java.security package and its digital signature capabilities helps to trusted download for which full access permission is given to Java APIs. javakey program manages keys and digitally signs JAR files of Java code.---Secure Communication
In Distributed Computing Environment is a widely-used industry standard in which user's location, business processing and database access and processing done in a remote computer, in such case data need to travels across a wide network where there is a change of accessing data by unauthorized users who is not the intended recipient. Data may consist of sensitive information, like credit card numbers and passwords certain security measures must be taken to make the data secure from unauthorized parties. We have to take care of sending data to the appropriate and authorized party, and that data has not been edited, either intentionally or unintentionally, during its journey alone a network. Secure communication need to use Cryptography techniques to send data via network, The Java platform provides APIs which implementations standard secure communication protocols.SSL/TLS:
SSL/TSL protocals provide functionality for Client authentication, Server authentication, Message integrity and data encryption which helps the application in secure transmit of data over application protocol. Secure Network socket is provided by the class javax.net.ssl.SSLSocket which encapsulates TLS and SSL on the class java.net.Socket. To consume and produce packets java uses javax.net.ssl.SSLEngine class.JSSE
Using Secure Sockets Layer and Transport Layer Security Java secure Socket Extension enables secure web data transmit. To implement JSSE we need to get find the provide for JSSE, then need to find sockets from the Java Secure Socket Extension factories that is from java.net.Socket class. SSLSocketFactory provides client side sockets and SSLServerSocketFactory provides server side sockets. This two sockets provides framework for Java Socket Security Extension.
REAL TIME APPLICATIONSx
Article name: Security Application Of Java Computer Science essay, research paper, dissertation