Table of Contents

PART I: THE BACKGROUND
1. A Security Primer
   • The Security Problem
   • Computers, Networks and The Internet
   • Security Concepts
   • Security Attacks
   • System Vulnerabilities
   • Towards The Solution

2. A Quick Tour of the Java Platform
   • Packaging of Java Platform
   • Evolution of Java
   • Java Security Model
     • Java Language Security
     • Access Control
     • Cryptographic Security
   • J2SE Platform
   • J2EE Platform
   PART II: THE TECHNOLOGY

3. Cryptography with Java
   • Cryptographic Services and Providers
   • Cryptographic Keys
   • Encryption and Decryption
   • Message Digest
   • Message Authentication Code
   • Digital Signature
   • Key Agreement
   • Summary of Cryptographic Operations
   • Cryptography with crypttool
   • Limited versus Unlimited Cryptography
   • Performance of Cryptographic Operations
   • Practical Applications
   • Legal Issues with Cryptography

4. PKI with Java
   • Digital Certificates
   • Managing Certificates
   • Certification Authority
   • PKI Architectures
   • Java API for PKI
     • Certificates and Certification Paths
     • Certificate Revocation List
     • Repository of Certificates and CRLs
     • Building Certification Paths
     • Validating Certification Paths
   • Applications of PKI
   • PKI Use-Cases

5. Access Control
   • A Quick Tour of the Java Access Control Features
   • Access Control Requirements for the Java Platofrm
   • User Identification and Authentication
   • Policy-Based Authorization
   • Developing a Login Module
   • Applying JAAS to a Simple Application
   • Performance Issues

6. Securing the Wire
   • Brief Overview of SSL
   • Java API for SSL
   • KeyManager and TrustManager APIs
   • Understanding SSL Protocol
   • HTTP Over SSL
   • RMI Over SSL
   • Performance Issues
   • Trouble Shooting

7. Securing the Message
   • Message Security Standards
   • A Brief Note on Handling XML
   • XML Signature
   • Java API for XML Signature
   • XML Encryption
   • Java API for XML Encryption
   • XML Signature and Encryption Combinations
   PART III: THE APPLICATION

8. RMI Security
   • Sample Application Using RMI
   • Security from Downloaded Code
   • SSL for Transport Security
   • RMI and Access Control

9. Web Application Security
   • Java Web Applications
   • Apache Tomcat
   • A Simple Web Application: RMB
   • Security Requirements
   • User Authentication Schemes
   • Web Container Security Features
   • HTTPS with Apache Tomcat
   • Common Vulnerabilities

10. EJB Security
    • A Brief Overview of EJBs
    • Working with WebLogic Server 7.0
    • EJB Security Mechanisms
    • Declarative Security for EJBs
    • Declarative Security Example
    • EJB Security and J2SE Access Control

11. Web Service Security
    • Web Services Standards
    • Web Services in Java
    • Apache Axis
    • Servlet Security for Web Services
    • WS Security
    • WS Security with Apache Axis

12. Conclusions
    • Technology Stack
    • Authentication and Authorization
    • Distributed Application Security
    • Comprehensive Security

• Appendix A: Public Key Cryptography Standards
• Appendix B: Standard Names -- Java Cryptographic Services
• Appendix C: JSTK Tools
• Appendix D: Example Programs
• Appendix E: Products Used For Examples
• Appendix F: Standardization Bodies