- Select from a list security restrictions that Java 2 environments normally impose on applets running in a browser.
- Given an architectural system specification, identify appropriate locations for implementation of specified security features, and select suitable technologies for implementation of those features.
Security Manager: categories of permission.
Permitted Operations:
- Ability to create a thread
- Limited ability to manipulate threads that the browser created for applet Security manager doesnt monitor CPU/Network or bandwidth utilization.
- Ability to perform manipulations for the AWT for GUI to work properly
- Ability to read system properties, but not modify them
- Allowed to make network connection only to host from which it was loaded(if not it could start Dos and also try to connect to internal resouces/systems of the local network)
- Cannot change the prioirty of the threads but can request more memory and throw OutOfmemoryException.
- Message digest is proof that a piece of data has not been modified. The process of creating message digest is know as hashing. Java 2 suports this.
- If applet is not trusted then it cannot do anything on the client machine.
- Cannot read/write from client
- Cannot read java.home or java.classpath.
Denied Operations Any operation that might be used to compromise the host is usually denied.
Exceptions to this are CPU Usages, Bandwith usagea and memory usage.
Principal, Roles, Identification, Authorization, Authentication, Access control.
Cryptography 1) Symmetric 2) Asymmetric - Has 2 keys private and a public key. Public key can be used to encrypt the message. It cannot be used to decrypt the message or derive the private key. Only the private key can be used to decrypt the message. Asymmetric cryptography is CPU intensive. Also know as public key crytography.
Signatures and Certificates.
SSL, HTTPS, WEB logins
Notes from cade/web/Simulators
No comments:
Post a Comment