Table of Contents
Remarks on Internet and Java Security Spring 99
Abstract of CPS616 Java and Internet Security Presentation
Some Reference Material
Some General Issues I
Some General Issues II
Need for Security in Commerce - I
Need for Security in Commerce - II
Structure of Internet and Security-I
Structure of Internet and Security-II
Structure of Internet and Security-III
A PKZIP Anecdote
Downloading Software is Dangerous?
The Moldavia Pornographic Phone Scam
An Early Netscape DNS Bug
Tempest and Control Zones
Military Security Levels
Firewalls and Gateways - I
Firewalls and Gateways II
Encrypted Tunnels
The Great Clipper Controversy
Export Restrictions on Cryptography
Denial of Service versus “Attacks”
Combining Denial of Service with more Malicious Attack
Comments on Denial of Service
Some Attacking Concepts
Naïve way Viruses Spread themselves
Introduction to Cryptography
Breaking an Encryption Scheme
Types of Cryptographic Function
Security Uses of Cryptography
Secret Key Cryptography
Uses of Secret Key Cryptography
Secret Key Authentication
Message Integrity with Secret Key Cryptography
Public Key Cryptography
Insecure Link Transmission with Public Key Cryptography
Authentication with public key Cryptography
Digital Signatures and Public Key Cryptography
Use of Digital Signatures with public key Cryptography
Hash and Message Digests
Some Math Behind Secret Key Cryptography
Some Math behind RSA Algorithm -I
Some Math behind RSA Algorithm -II
Certificate Authorities
Review of Certificate Process
Sample Certificate from Netscape
VeriSign Digital ID’s or Certificates - I
VeriSign Digital ID’s or Certificates - II
VeriSign’s Description of Digital ID’s
VeriSign’s Description of Certificate Revocation I
VeriSign’s Description of Certificate Revocation II
The Java Security Model
Sandbox mechanism
What can applets do - I?
What can applets do - II?
What can applets do - III?
The Byte Code Verifier
Byte Code Verification
Why is type checking important!
Applet Class Loader
Going beyond the Sandbox: History of Java Security Models
Going beyond the Sandbox-2
Going beyond the Sandbox-3
JDK 1.2 Security Model
JAVA Fine-grained Access Control-1
JAVA Fine-grained Access Control-2
JAVA Fine-grained Access Control-3
JAVA Fine-grained Access Control-4
JAVA Fine-grained Access Control-5
JAVA Fine-grained Access Control-6
JAVA Fine-grained Access Control-7
Java Security-Related Tools
How to sign Java Code
Signing Classes with the Netscape Object Signing Tool
Netscape Object Signing Tool -2
Netscape Object Signing Tool -3
Signing Java Applets with Microsoft's Authenticode
Microsoft's Authenticode 2
Signing Code with Sun's JDK 1.1.x
Signing Code with Sun's JDK 1.1.x-2
Signing Code with Sun's JDK 1.1.x-3
Browsing Signed Applets
The Java Authentication Framework
The Java Authentication Framework-2
Signing Code with Sun's Java 2
Signing Code with Sun's Java 2-II
Signing Code with Sun's Java 2-III
Signing Code with Sun's Java 2-IV
Some Comparisons of Sign Tools
Some Comparisons of Sign Tools - 2
Secure Electronic Transaction SET
Electronic Shopping Experience - I
Electronic Shopping Experience - II
Features of SET - I
Features of SET - II
SET Encryption Summary
Sample SET Cryptography Use
Sample SET Cryptography Steps 2 to 5
Sample SET Cryptography Step 6
Sample SET Cryptography Steps 7-10
Structure of Public Key System in SET
Features of Public Key System in SET - I
Features of Public Key System in SET - II
Cardholder Registration Process in SET
Merchant Registration Process in SET
Purchase Request Process in SET
Payment Authorization and Capture Processes in SET
SSL and S/MIME
SSL from Netscape I
SSL from Netscape II
SSL from Netscape III
Netscape’s Description of S/MIME
Generating Certificates on Unix-1
Generating Certificates on Unix-2
Sample Certificate and primary Key
Secure Server Example-NPAC Grading System-1
Secure Server Example-NPAC Grading System-2
Secure Server Example-NPAC Grading System-3
Secure Server Example-NPAC Grading System-4
Java Security Manager
Java Security Package
Java Digital Signatures-1
Java Digital Signatures-2
Some Other Security Systems
KERBEROS
KERBEROS - 2
SESAME Security System
Details on SESAME I
Details on SESAME II
The GSS-API Security Interface
Globus System Security Policy and Requirements -- Overview
Further Properties of Globus Entities
Globus Application Requirements
Relevant Components of Globus
Issues in the Globus Security Model
Elements of Globus Security Policy I
Elements of Globus Security Policy II
Globus Security Functional Requirements - I
Globus Security Functional Requirements - II
JavaScript Security Model
JavaScript Security Issues
Same Origin Policy
Signed Script Policy-1
Signed Script Policy-2
Signed Script Policy-3
Codebase Principals-1
Codebase Principals-2
Scripts Signed by Different Principals
Principals of Windows and Layers
Determining Container Principals
Identifying Signed Scripts
Using Expanded Privileges
Targets
Targets-2
Importing and Exporting Functions
Weaknesses in the JavaScript Model
Signing Scripts
Signing Scripts-2
Signing Scripts-3
Signing Scripts-4
|