secure & authentication by lai hieu - exo sea

www.exoplatform.com

Copyright 2011 eXo Platform

Secure & Authentication of communication

Lai Trung HieuCollaboration Team

2www.exoplatform.com


Introduction



DNS Spoofing



Website security indicators

https://www.google.com/support/chrome/bin/answer.py?answer=95617&hl=en-US



Agenda

Secure & AuthenticationDigital certificate & PKIAn example conversationJava security architecture overvieweXo platform implementation

www.exoplatform.com


Secure & Authentication



SSL story

SSL was invented by Netscape Communications in 1994.

May 1996, Internet Engineering Task Force (IETF) start to research TLS to be standardize SSL protocol.

TLS then became an IETF standards track protocol.

January 1999 TLS, 1.0 (SSL 3.1) first published in RFC 2246 1999 to be update version for SSL 3.0.

April 2006, TLS 1.1 (SSL 3.2)

August 2008 TLS 1.2 (SSL 3.3)



TLS/SSL fundamental

Based on public key cryptography



Applications

Web browsing Electronic mail Internet faxingInstant messaging Voice-over-IP

www.exoplatform.com


Digital certificate & PKI



Copyright 2010 eXo Platform SAS

Digital certificate

Electronic document which uses a digital signature to bind a public key with an identity



ConfidenceIntegrityAuthenticateTo identify who is who on the Internet?

Issuer’s nameEntity namepublic keyExpired dateUsages



Public key infrastructure

Public & private key concept

www.exoplatform.com


An example conversation



Introduction

{Some thing} information to be exchanged

{Something}key information encrypted by key

Digest[Something] make a digest for information



Digital signature

Nobita: Hi, Are you Doraemon?

Doraemon: Nobita, It’s me Doraemon!

{digest[Nobita, It’s me Doraemon!!]}Doraemon’private key



Exchange keys



Here is my public key.

Nobita: Show me your evidence!


digest[Nobita, It’s me Doraemon!!]}Doraemon’private key



Digital certificate



Here is my digital certificate.







Xeko: Nobita, It’s me Doraemon!



Xeko : ???



Exchange secret key(session key)







Nobita: Ok, Doreamon. Here is{secret key}Doraemon’s public key

Doraemon: {blah blah}secret-key

Nobita: {blah hihi}secret-key

www.exoplatform.com


Java security architecture

overview




A set of APIs spanning major security areas:• Cryptography• Public key Infrastructure• Authentication• Secure communication• Access control

Basic Security Architecture



Cryptography

• Message digest algorithms• Digital signature algorithms• Symmetric bulk encryption • Symmetric stream encryption• Asymmetric encryption• Password-based encryption (PBE)• Elliptic Curve Cryptography (ECC)• Key agreement algorithms• Key generators• Message Authentication Codes (MACs)• (Pseudo-)random number generator

java.securityjava.crypto

•RSA and DSA signature algorithms•DES, AES, and ARCFOUR encryption algorithms•MD5 and SHA-1 message digest algorithms•Diffie-Hellman key agreement algorithm



Public Key Infrastructure

•Key and Certificate Storage•PKI Tools

• Keytool• Jarsignertool



Authentication

•LoginContext & LoginModule•Krb5LoginModule for authentication using Kerberos protocols•JndiLoginModule for username/password authentication using LDAP or NIS databases•KeyStoreLoginModule for logging into any type of key store, including a PKCS#11 token key store



Secure Communication

•SSL/TLS• javax.net.ssl.SSLSocket• javax.net.ssl.SSLEngine

•Simple Authentication and Security Layer (SASL)•GSS-API and Kerberos



Access Control

•Permissions•Policy•Access Control Enforcement

www.exoplatform.com


eXo platform implementation



• User certificates management• OpenPGP/ SMIME support• Reply a topic by mail• And more….

www.exoplatform.com


Q & A

www.exoplatform.com


Thank you!

secure & authentication by lai hieu - exo sea

Technology

secretkey nobita

doraemonprivate key

digest nobita

public key infrastructure

doraemons public key

key digestsomethingmake

digital certificate

digital signature nobita