CredentialManager.SecurityRequirements (Java Card API, Connected Edition)
Date: 2009-12-11

Overview | Package | Class | Tree | Deprecated | Index | Help
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD

## javacardx.security
Class CredentialManager.SecurityRequirements

    java.lang.Object
      javacardx.security.CredentialManager.SecurityRequirements

Enclosing class:
  CredentialManager

    @SensitiveType(sensitivity=INTEGRITY)
    public static class CredentialManager.SecurityRequirements

extends Object

Encapsulates the requirements for a secure connection or access. The requirements may be:

- whether client authentication is required,
- whether integrity of the data exchanged over the connection is required,
- whether confidentiality of the data exchanged over the connection is required.

Similarly to credential managers, the security requirements to be used for a particular connection or access may depend on the mode of operation (WEB, GCF,...) and on the endpoint URI being used for the connection or access.

When invoked for a web application, the default implementation of the `isClientAuthRequired(String, byte)`, `isConfidentialityRequired(String, byte)` and `isIntegrityRequired(String, byte)` methods of the `SecurityRequirements` base class indicate the requirement for client authentication and the overall requirements for content integrity and confidentiality of the current application as declared in the web application's runtime descriptor and deployment descriptor, respectively. The overall requirements of a web application for content integrity and confidentiality corresponds to the transport guarantee requirements declared overall on its web resources, that is whether at least one user data security constraint has a transport guarantee value of `INTEGRAL` and whether at least one other user data security constraint has a transport guarantee value of `CONFIDENTIAL`.

SecurityRequirements objects can be set and retrieved using the `CredentialManager.setSecurityRequirements(javacardx.security.CredentialManager.SecurityRequirements, byte)` method and the `CredentialManager.getSecurityRequirements(byte)` method, respectively.

The security requirements that must apply for a particular connection being established are looked up by the protocol handler independently of the credential manager.

See Runtime Environment Specification for the Java Card Platform, Connected Edition, chapters 3, 6 and 8 for details regarding credential management and related descriptor-based configuration.

See Also:
  `CredentialManager`, `SecurityInfo`, `TLSSecurityInfo`

Constructor Summary
`CredentialManager.SecurityRequirements()` Creates a SecurityRequirements object that encapsulates the requirements for client authentication and the overall requirements for content integrity and confidentiality of the current web application, as declared in the web application's runtime descriptor and deployment descriptor.

Method Summary
`String[]` | `chooseCipherSuites(String[] supportedCipherSuites, String endpointURI, byte mode)` Chooses the list of cipher suite names that can be used for connection/access to the specified endpoint URI in the specified mode.
`boolean` | `isClientAuthRequired(String endpointURI, byte mode)` Indicates if client authentication is required for connection/access to the specified endpoint URI.
`boolean` | `isConfidentialityRequired(String endpointURI, byte mode)` Indicates if confidentiality guarantee is required for connection/access to the specified endpoint URI.
`boolean` | `isIntegrityRequired(String endpointURI, byte mode)` Indicates if integrity guarantee is required for connection/access to the specified endpoint URI.

Methods inherited from class java.lang.Object
`equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

Constructor Detail

### CredentialManager.SecurityRequirements

    public CredentialManager.SecurityRequirements()

  Creates a SecurityRequirements object that encapsulates the requirements for client authentication and the overall requirements for content integrity and confidentiality of the current web application, as declared in the web application's runtime descriptor and deployment descriptor. If the current application is not a web application all the requirements default to `false`.

Method Detail

### isClientAuthRequired

    public boolean isClientAuthRequired(String endpointURI,
                                        byte mode)

  Indicates if client authentication is required for connection/access to the specified endpoint URI.

  This method is only called for server connections.

  The default implementation of this method when invoked for the mode of operation `CredentialManager.MODE_WEB_SERVER` returns the client authentication requirement declared in the Runtime Descriptor of the current application, if it is a Web application. It returns false for any other mode of operation or other type of application.

  Parameters:
    `endpointURI` - the canonicalized endpoint URI.
    `mode` - the mode of operation: `CredentialManager.MODE_GCF_SERVER` or `CredentialManager.MODE_WEB_SERVER`.
  Returns:
    true if client authentication is required for connection/access to the specified endpoint URI, false otherwise.

### isIntegrityRequired

    public boolean isIntegrityRequired(String endpointURI,
                                       byte mode)

  Indicates if integrity guarantee is required for connection/access to the specified endpoint URI.

  The default implementation of this method when invoked for the mode of operation `CredentialManager.MODE_WEB_SERVER` returns the overall integrity requirement declared in the Web application Deployment Descriptor of the current application, if it is a Web application. It returns false for any other mode of operation or other type of application.

  Parameters:
    `endpointURI` - the canonicalized endpoint URI.
    `mode` - the mode of operation: `CredentialManager.MODE_GCF_SERVER`, `CredentialManager.MODE_GCF_CLIENT` or `CredentialManager.MODE_WEB_SERVER`.
  Returns:
    true if the integrity guarantee is required for connection/access to the specified endpoint URI, false otherwise.

### isConfidentialityRequired

    public boolean isConfidentialityRequired(String endpointURI,
                                             byte mode)

  Indicates if confidentiality guarantee is required for connection/access to the specified endpoint URI.

  The default implementation of this method when invoked for the mode of operation `CredentialManager.MODE_WEB_SERVER` returns the overall confidentiality requirement declared in the Web application Deployment Descriptor of the current application, if it is a Web application. It returns false for any other mode of operation or other type of application.

  Parameters:
    `endpointURI` - the canonicalized endpoint URI.
    `mode` - the mode of operation: `CredentialManager.MODE_GCF_SERVER`, `CredentialManager.MODE_GCF_CLIENT` or `CredentialManager.MODE_WEB_SERVER`.
  Returns:
    true if the confidentiality guarantee is required for connection/access to the specified endpoint URI, false otherwise.

### chooseCipherSuites

    public String[] chooseCipherSuites(String[] supportedCipherSuites,
                                       String endpointURI,
                                       byte mode)

  Chooses the list of cipher suite names that can be used for connection/access to the specified endpoint URI in the specified mode.

  The list of supported cipher suites passed through the `supportedCipherSuites` parameter corresponds to the cipher suites supported on the platform (in mode of operation `CredentialManager.MODE_GCF_CLIENT`) or by the peer (in mode of operation `CredentialManager.MODE_GCF_SERVER` or `CredentialManager.MODE_WEB_SERVER`) that match the application's requirements for confidentiality, integrity and peer authentication as expressed by the methods `isConfidentialityRequired(String, byte)`, `isIntegrityRequired(String, byte)` and `isClientAuthRequired(String, byte)`, respectively.

  The returned list designates the cipher suites to be used in decreasing preference order. If `null` is returned, any cipher suite from the list of supported cipher suites may be used (without any preference). If an empty list is returned, then no cipher suite has been chosen and the connection/access may fail. When a GCF client or server secure connection is successfully established, a call to `SecurityInfo.getCipherSuite()` returns one of these chosen cipher suite names. When an HTTP request received over a web server secure connection is serviced, the value of the request attribute `javax.servlet.request.cipher_suite` is one of these chosen cipher suite names.

  The names passed in and returned are from the Cipher Suite column of the CipherSuite definitions table in Appendix C of RFC 5246.

  Parameters:
    `supportedCipherSuites` - the list of cipher suite names supported on the platform or by the peer.
    `endpointURI` - the canonicalized endpoint URI.
    `mode` - the mode of operation: `CredentialManager.MODE_GCF_SERVER`, `CredentialManager.MODE_GCF_CLIENT` or `CredentialManager.MODE_WEB_SERVER`.
  Returns:
    list of cipher suite names in decreasing preference order that can be used for connection/access to the specified endpoint URI.
  See Also:
    `SecurityInfo`, `HttpServletRequest`

Overview | Package | Class | Tree | Deprecated | Index | Help
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD

Copyright (c) 2009 Sun Microsystems, Inc. All rights reserved.