javacardx.security
Class CredentialManager.SecurityRequirements

java.lang.Object
  extended by javacardx.security.CredentialManager.SecurityRequirements
Enclosing class:
CredentialManager

@SensitiveType(sensitivity=INTEGRITY)
public static class CredentialManager.SecurityRequirements
extends Object

Encapsulates the requirements for a secure connection or access. The requirements may be:

Similarly to credential managers, the security requirements to be used for a particular connection or access may depend on the mode of operation (WEB, GCF,...) and on the endpoint URI being used for the connection or access.

When invoked for a web application, the default implementation of the isClientAuthRequired(String, byte), isConfidentialityRequired(String, byte) and isIntegrityRequired(String, byte) methods of the SecurityRequirements base class indicate the requirement for client authentication and the overall requirements for content integrity and confidentiality of the current application as declared in the web application's runtime descriptor and deployment descriptor, respectively. The overall requirements of a web application for content integrity and confidentiality corresponds to the transport guarantee requirements declared overall on its web resources, that is whether at least one user data security constraint has a transport guarantee value of INTEGRAL and whether at least one other user data security constraint has a transport guarantee value of CONFIDENTIAL.

SecurityRequirements objects can be set and retrieved using the CredentialManager.setSecurityRequirements(javacardx.security.CredentialManager.SecurityRequirements, byte) method and the CredentialManager.getSecurityRequirements(byte) method, respectively.

The security requirements that must apply for a particular connection being established are looked up by the protocol handler independently of the credential manager.

See Runtime Environment Specification for the Java Card Platform, Connected Edition, chapters 3, 6 and 8 for details regarding credential management and related descriptor-based configuration.

See Also:
CredentialManager, SecurityInfo, TLSSecurityInfo

Constructor Summary
CredentialManager.SecurityRequirements()
          Creates a SecurityRequirements object that encapsulates the requirements for client authentication and the overall requirements for content integrity and confidentiality of the current web application, as declared in the web application's runtime descriptor and deployment descriptor.
 
Method Summary
 String[] chooseCipherSuites(String[] supportedCipherSuites, String endpointURI, byte mode)
          Chooses the list of cipher suite names that can be used for connection/access to the specified endpoint URI in the specified mode.
 boolean isClientAuthRequired(String endpointURI, byte mode)
          Indicates if client authentication is required for connection/access to the specified endpoint URI.
 boolean isConfidentialityRequired(String endpointURI, byte mode)
          Indicates if confidentiality guarantee is required for connection/access to the specified endpoint URI.
 boolean isIntegrityRequired(String endpointURI, byte mode)
          Indicates if integrity guarantee is required for connection/access to the specified endpoint URI.
 
Methods inherited from class java.lang.Object
equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Constructor Detail

CredentialManager.SecurityRequirements

public CredentialManager.SecurityRequirements()
Creates a SecurityRequirements object that encapsulates the requirements for client authentication and the overall requirements for content integrity and confidentiality of the current web application, as declared in the web application's runtime descriptor and deployment descriptor. If the current application is not a web application all the requirements default to false.

Method Detail

isClientAuthRequired

public boolean isClientAuthRequired(String endpointURI,
                                    byte mode)
Indicates if client authentication is required for connection/access to the specified endpoint URI.

This method is only called for server connections.

The default implementation of this method when invoked for the mode of operation CredentialManager.MODE_WEB_SERVER returns the client authentication requirement declared in the Runtime Descriptor of the current application, if it is a Web application. It returns false for any other mode of operation or other type of application.

Parameters:
endpointURI - the canonicalized endpoint URI.
mode - the mode of operation: CredentialManager.MODE_GCF_SERVER or CredentialManager.MODE_WEB_SERVER.
Returns:
true if client authentication is required for connection/access to the specified endpoint URI, false otherwise.

isIntegrityRequired

public boolean isIntegrityRequired(String endpointURI,
                                   byte mode)
Indicates if integrity guarantee is required for connection/access to the specified endpoint URI.

The default implementation of this method when invoked for the mode of operation CredentialManager.MODE_WEB_SERVER returns the overall integrity requirement declared in the Web application Deployment Descriptor of the current application, if it is a Web application. It returns false for any other mode of operation or other type of application.

Parameters:
endpointURI - the canonicalized endpoint URI.
mode - the mode of operation: CredentialManager.MODE_GCF_SERVER, CredentialManager.MODE_GCF_CLIENT or CredentialManager.MODE_WEB_SERVER.
Returns:
true if the integrity guarantee is required for connection/access to the specified endpoint URI, false otherwise.

isConfidentialityRequired

public boolean isConfidentialityRequired(String endpointURI,
                                         byte mode)
Indicates if confidentiality guarantee is required for connection/access to the specified endpoint URI.

The default implementation of this method when invoked for the mode of operation CredentialManager.MODE_WEB_SERVER returns the overall confidentiality requirement declared in the Web application Deployment Descriptor of the current application, if it is a Web application. It returns false for any other mode of operation or other type of application.

Parameters:
endpointURI - the canonicalized endpoint URI.
mode - the mode of operation: CredentialManager.MODE_GCF_SERVER, CredentialManager.MODE_GCF_CLIENT or CredentialManager.MODE_WEB_SERVER.
Returns:
true if the confidentiality guarantee is required for connection/access to the specified endpoint URI, false otherwise.

chooseCipherSuites

public String[] chooseCipherSuites(String[] supportedCipherSuites,
                                   String endpointURI,
                                   byte mode)
Chooses the list of cipher suite names that can be used for connection/access to the specified endpoint URI in the specified mode.

The list of supported cipher suites passed through the supportedCipherSuites parameter corresponds to the cipher suites supported on the platform (in mode of operation CredentialManager.MODE_GCF_CLIENT) or by the peer (in mode of operation CredentialManager.MODE_GCF_SERVER or CredentialManager.MODE_WEB_SERVER) that match the application's requirements for confidentiality, integrity and peer authentication as expressed by the methods isConfidentialityRequired(String, byte), isIntegrityRequired(String, byte) and isClientAuthRequired(String, byte), respectively.

The returned list designates the cipher suites to be used in decreasing preference order. If null is returned, any cipher suite from the list of supported cipher suites may be used (without any preference). If an empty list is returned, then no cipher suite has been chosen and the connection/access may fail. When a GCF client or server secure connection is successfully established, a call to SecurityInfo.getCipherSuite() returns one of these chosen cipher suite names. When an HTTP request received over a web server secure connection is serviced, the value of the request attribute javax.servlet.request.cipher_suite is one of these chosen cipher suite names.

The names passed in and returned are from the Cipher Suite column of the CipherSuite definitions table in Appendix C of RFC 5246.

Parameters:
supportedCipherSuites - the list of cipher suite names supported on the platform or by the peer.
endpointURI - the canonicalized endpoint URI.
mode - the mode of operation: CredentialManager.MODE_GCF_SERVER, CredentialManager.MODE_GCF_CLIENT or CredentialManager.MODE_WEB_SERVER.
Returns:
list of cipher suite names in decreasing preference order that can be used for connection/access to the specified endpoint URI.
See Also:
SecurityInfo, HttpServletRequest


Copyright (c) 2009 Sun Microsystems, Inc. All rights reserved.