Internet security programming with Java 2 standard version (J2SE) 1.4
Part I: Server
Qusay H. mahmoud is in November 2002 madman translation in November 2002
Any message transmitted in a computer network or Internet may be intercepted, in which some are more sensitive, such as credit card numbers or other private data. In order to better use Internet in Enterprise Environment and E-Commerce, application software must use encryption, verification, and secure communication protocols to protect users' data security. Secure Hypertext Transfer Protocol, HTTPS is HTTP, which is built on secure sockets layer, ssl, which has been successfully applied to e-commerce.
Java Secure Socket Extension, JSSE enables Internet security communication into reality. It is a 100% pure Java implementation SSL framework. This package allows Java developers to develop secure network applications; to establish secure data channels based on TCP / IP-based application protocols such as HTTP, FTP, Telnet, or NTTP, establish a secure data channel between the client and the server.
JSSE has been integrated in Java 2 SDK standard version 1.4 (J2SE 1.4), this is a good news. This means that as long as you have J2SE 1.4, you don't need to download other packages, you can create an SSL-based Internet application. This series of articles have 2 articles, which is a manual on the development of safety interent applications for future markets. This article is primarily the server side, and the next article is the client. This article starts from an overview SSL and tells you how to do the following:
Using JSSE API combines a simple HTTP server in your C / S app to develop a simple HTTP server to process HTTPS requests to develop, configure and run a secure HTTP server using Keytool that contains keytool in J2SE.
Overview SSL
The SSL protocol is developed in 1994 to allow the server (typical, such as browser) and HTTP servers to communicate. It encrypts, source verification, data integrity, etc., to protect data exchanged on unsafe public networks. SSL has some versions: SSL 2.0 has security hazards, now there is a few unused; SSL 3.0 applications are relatively widely; finally, Transport Layer Security, TLS), which is improved by SSL 3.0, has become Internet standard And applied to almost all newly near software.
Prior to data propagation, encryption techniques protect data from illegal by transforming data into meaningless content. The process is: data is encrypted, transmitted, then decrypt at the other end (client or server).
Source certification is an approach to verifying the identity of the data sender. The browser or other client attempts to communicate with the web server for the first time, the server will presented a set of trust information in the form of a certificate.
The certificate is issued and verified by the authoritative certification body (CA) - a trustworthy authorized author. A certificate describes the public key of a person. A signature document will make a guarantee: I prove that this public key in the document belongs to the entity named in this document. Signature (authoritative certification body). Currently well-known authoritative certifications include VeriSign, Entrust and Thawte. Note that the SSL / TLS certificate now used is an X.509 certificate.
Data integrity is to ensure that data is not changed during transmission.
Sedents of SSL and TCP / IP protocol
SSL is a solid sleeve layer. Its connection action and TCP connection are similar, so you can imagine SSL connections just a secure TCP connection because the location of SSL is above the TCP in the Protocol Hierarchy, as shown in Figure 1. Note this is important. However, SSL does not support certain TCP characteristics, such as frequency band data. Figure 1: Levels of SSL and TCP / IP protocol
AC-lived encryption technology
One of the features of SSL is to provide a standard method for providing AC's transactions for e-commerce. SSL's developers recognize that not everyone will use the same client software, so that all clients will include any detailed encryption algorithm. The same is true for the server. Clients and servers located at both ends of the connection require AC encryption and decryption algorithm (cryptographic group) when initializing "handshake". If they do not have enough public algorithms, the connection attempt will fail.
Note When the SSL allows the client and the server to verify each other, the typical method is that only the server side is verified on the SSL layer. The client is typically verified by the application layer, password transmitted by the SSL protection channel. This mode is often used in banks, shares trading, and other secure network applications.
SSL is completely "handshake" protocol as shown in Figure 2. It shows the information exchange order in the SSL "handshake" process.
Figure 2: SSL "Handshake" protocol
The meaning of these news is as follows:
ClientHello: Send information to the client's client, such as SSL protocol versions, session ID, and password group information, such as encryption algorithms and supportable sizes. ServerHello: Select the server that best password group and sends this message to the client. The password group includes client and server support. CERTIFICATE: The server sends a certificate containing its public key to the client. This message is optional and will need it when the server requests verification. In other words, the certificate is used to confirm the identity of the server to the client. CERTIFICATE REQUEST: This message is only sent when it is asking itself only on the server. Most e-commerce applications do not require a client to do itself. Server Key Exchange: If the certificate contains the public key to the server is not sufficient to exchange, the message is sent. ServerHellodone: This message notifies the client, and the server has completed the initialization of the AC process. CERTIFICATE: Send only when the server requests the client to verify yourself. Client Key Exchage: The client generates a key to the server sharing. If you use the Rivest-Shamir-Adelman (RSA) encryption algorithm, the client will send the key encrypted to the server after using the public key of the server. The server decrypts the message with your own private key or key to get the shared key. Now, clients and servers share a secure-distributed key. Certificate Verify: If the server requests to verify the client, this message allows the server to complete the verification process. Change Cipher SPEC: The client requires the server to use the encryption mode. Finished: The client tells the server that it is ready to communicate. Change Cipher SPEC: The server requires the client to use the encryption mode. Finished: The server tells the client that it is ready to communicate. This is the sign of the SSL "handshake" result. Encrypted Data: The client and server can now develop communication on encrypted information on a secure communication channel.
JSS
Java Secure Conditioning (JSSE) provides an SSL and TLS protocol implemented by a framework and a 100% pure Java implementation. It provides mechanisms such as data encryption, server authentication, message completion, and optional client authentication. Outside of JSS, it will be complex, fundamentally encryption algorithm, which reduces the risk of sensitive or dangerous security attacks. In addition, since it can seamlessly combine SSL in the application, it is very simple to develop safe applications. The JSSE framework can support many different secure communication protocols, such as SSL 2.0 and 3.0 and TLS 1.0, but J2SE V1.4.1 only implements SSL 3.0 and TLS 1.0. JSSE programming
The JSSE API provides an extended network socket class, credit, and key management, and socket factory framework for simplifying socket creation, to expand two packages for java.security and java.net. These classes are included in the javax.net and javax.net.ssl packages.
SSLSocket and SSLServersocket
Javax.net.ssl.sslsocket is a subclass of java.net.socket, so he supports all standard socket methods, and some methods for newly adding a security socket. The javax.net.ssl.sslServersocket class is similar to the SSLSocket class, just it is used to create a server socket, while SSLSocket is not.
Create a SSLSocket instance how two methods:
Use the SSLSocketFactory instance to execute the Createsocket method to create. It is obtained by the Accept method of SSLServersocket.
SSLSocketFactory and SSLServersocketFactory
The Javax.Net.ssl.SSLSocketFactory class is an object factory for creating a security socket. Javax.net.ssl.sslServersocketFactory is also such a factory, but it is used to create a secure server socket.
You can get the SSLSocketFactory instance by the following method:
Execute the SSLSocketFactory.getDefault method to get a default factory. Construct a new factory through a specific configuration behavior.
Note that the default factory configuration is only allowed to verify.
Safe existing Client / Server applications
Integrated SSL in existing C / S applications to make it secure, and you can do it. In order to make the server becomes safe, the black displayed content in the following example is required:
Import java.io. *;
Import javax.net.ssl. *;
Public class server {
INT port = portnumber;
SSLServersocket Server;
Try {
SSLSERVERSOCKETFAACTORY FACTORY =
SSLServersocketFactory) SSLServersocketFactory.getDefault ();
Server = (SSLServersocket)
Factory.createServersocket (portnumber);
SSLSocket Client = (SSLSocket)
Server.accept ();
// Create Input and Output Street STREAMS as Usual
// send Secure Messages to Client Through T
// output stream
// Receive Secure Messages from Clom Clom Cliant Through
// the input stream
} catch (exception e) {}
}
In order to make the client becomes safe, the following example is required to display the black display:
Import java.io. *;
Import javax.net.ssl. *;
Public class client {
...
Try {
SSLSocketFactory Factory = (SSLSocketFactory)
SSLSocketFactory.getDefault ();
Server = (SSLServersocket)
Factory.createServersocket (portnumber);
SSLSocket Client = (SSLSocket)
Factory.createsocket (ServerHost, Port);
// Create Input and Output Street STREAMS as Usual
// send Secure Messages to Server Through the
// Output Stream Receive Secure SECURE
// Messages from Server Through The Input Stream. INPUT STREAM
} catch (exception e) {
}
}
Sunjsse provider
J2SE V1.4.1 and a JSSE provider, SunJSS is released. Sunjsse is installed and pre-registered with Java encryption system. Please consider SunJsse as an implementation that provides SSL V3.0 and TLS V1.0 implementations, as well as ordinary SSL and TLS password groups. If you want to find your implementation (here is SunJsse), you can call the GetSupportedCiphersuites method for SSLSocket. However, not all of these password groups are available. In order to find out those who are available, call the GeTENABLEDCIPHERSUITES method. This list can be changed with the setENabledciphersuites method.
A complete example
I found that the most complicated thing to develop JSS is related to system settings and management certificates and keys. In this example, I demonstrate how to develop, configure, and run a complete HTTP server application that supports the GET request method.
HTTP overview
Hypertext Transfer Protocol, HTTP is a "request-response" application protocol. This protocol supports a fixed method such as GET, POST, PUT, DELETE, and so on. The GET method is generally requested to request resources to the server. Here are two examples of GET requests:
Get / http / 1.0
Unsafe HTTP server
In order to develop an HTTP server, you have to understand how the HTTP protocol works. This server is a simple server that only supports the GET request method. Code Example 1 is the implementation of this example. This is a multi-threaded HTTP server, and the ProcessConnection class is used to perform new requests in different threads. When the server receives a request from the browser, it parses this request and finds the required document. If the requested document is available on the server, then the requested document will be sent to the server by the ShipDocument method. If the requested document is not open, the send to the server is an error message.
Code example 1: httpserver.java
Import java.io. *;
Import java.net. *;
Import java.util.StringTokenizer;
/ **
* This class imports a multithreaded Simple HTTP
* Server That Supports the get request method.
* IT Listens on Port 44, Waits Client Requests, And
* Serves Documents.
* /
Public clas httpserver {
// the port number Which The Server
// Will Be listening on
Public static final int http_port = 8080;
Public Serversocket GetServer () throws exception {
Return New Serversocket (http_port);
}
// Multi-Threading - Create a New Connection
// for Each Request
Public void run () {
Serversocket Listen;
Try {
Listen = Get Server ();
While (true) {
Socket client = listen.accept ();
ProcessConnection CC = New
ProcessConnection (Client);
}
} catch (exception e) {
System.out.println ("Exception:
E.getMessage ());
}
}
// main program
Public static void main (String Argv []) Throws
EXCEPTION {
Httpserver httpserver = new httpserver ();
httpserver.run ();
}
}
Class ProcessConnection Extends thread {
Socket client;
BufferedReader IS;
Dataoutputstream OS;
Public ProcessConnection (Socket S) {// Constructor
Client = S;
Try {
IS = New BufferedReader (New InputStreamReader)
Client.getInputStream ()));
OS = New DataOutputStream (Client.getOutputStream ());
} catch (ioexception e) {
System.out.println ("Exception:" E.getMessage ());
}
this.start (); // Thread Starts Here ... this start ()
Will Call Run ()
}
Public void run () {
Try {
// Get a Request and Parse IT.
String Request = is.readline ();
System.out.println ("Request: Request);
StringTokenizer ST = New StringTokenizer (Request);
IF ((st.countToKens ()> = 2) &&
St.NextToken (). Equals ("get")) {
IF ((Request =
St.NextToken ()). StartSwith ("/"))
Request = Request.substring (1);
IF (Request.Equals (")) Request = Request " INDEX.HTML ";
FILE F = New File (Request);
Shipdocument (OS, F);
} else {
Os.WriteBytes ("400 Bad Request");
}
Client.Close ();
} catch (exception e) {
System.out.println ("Exception:"
E.getMessage ());
}
}
/ **
* Read The Requested File and Ships IT
* to the browser if found.
* /
Public Static Void Shipdocument (DataOutputStream OUT,
FILE F) THROWS EXCEPTION {
Try {
DataInputStream in = New
DataInputStream (New FileInputStream (f));
INT LEN = (int) f.Length ();
BYTE [] BUF = New byte [LEN];
IN.Readfully (BUF);
In.Close ();
Out.WriteBytes ("HTTP / 1.0 200 OK / R / N");
Out.WriteBytes ("Content-Length:"
F.Length () "/ r / n");
Out.WriteBytes ("Content-Type:
TEXT / HTML / R / N / R / N ");
Out.write (buf);
Out.flush ();
} catch (exception e) {
Out.writebytes ("
