Expert Oracle and Java Security · Programming Secure Oracle Database Applications With Java by Coffin, David -- Read -- Imperial Library of Trantor

Index

Title Dedication Contents at a Glance Contents About the Author About the Technical Reviewer Acknowledgments Introduction Chapter 1: Introduction

Requirements For Windows and UNIX/Linux Users Background How to Use This Book Organization of This Book Java Objects and Oracle Database Structures Chapter Review

Chapter 2: Oracle Database Security

Finding a Test Oracle Database Working from an Existing Oracle Database Oracle Users and Schemas SQL*Plus, SQL Developer, JDeveloper, or TOAD Organization of the Next Few Sections Working as the SYS User Working as the Security Administrator Working as the HR Schema User Test Application User Access Audit Trail Logs for the Sensitive View Regarding Synonyms Chapter Review

Chapter 3: Secure Java Development Concepts

Java Development Kit Oracle Java Database Connectivity JAR File Directory Separator Java Packages Development at Command Prompt Java Code and Syntax Concepts Exceptions Java Virtual Machine Sandbox Chapter Review

Chapter 4: Java Stored Procedures

Java Stored Procedure Example Method Syntax in Java Stored Procedures Cleaning Up The Oracle Java Virtual Machine Chapter Review

Chapter 5: Public Key Encryption

Generate Keys on the Client RSA Public Key Cryptography Java Code to Generate and Use RSA Keys Testing on the Client Key Exchange Testing on Client and Server Chapter Review

Chapter 6: Secret Password Encryption

Approach Java Code for Secret Password Encryption Oracle Structures for Secret Password Encryption Java Methods for Secret Password Decryption Testing DES Encryption on the Client Only Coding to Test Client/Server Secret Password Encryption Testing Our Secure Client/Server Data Transmission Chapter Review

Chapter 7: Data Encryption in Transit

Security Administrator Activities Application Security User Activities Updating the Application Security Package Methods for Using and Testing Encryption in Transit Loading Updated OracleJavaSecure Class into Oracle Security Structures for the HR User Inserting an EMPLOYEES Record: Update a Sequence Demonstrations and Tests of Encrypted Data Exchange Executing the Demonstrations and Tests Packaging Template to Implement Encryption Don't Stop Now Chapter Review

Chapter 8: Single Sign-On

Another Layer of Authentication? Who Is Logged-In on the Client? Access Oracle Database as Our Identified User Proxy Sessions Using Connection Pools Application Use of Oracle SSO Chapter Review

Chapter 9: Two-Factor Authentication

Get Oracle Database to Send E-Mail Getting Oracle Database to Browse Web Pages The Two-Factor Authentication Process Security Considerations for Two-Factor Distribution Avenues Oracle Structures Supporting Two-Factor Authentication Update OracleJavaSecurity.java for Two-Factor Authentication Testing Two-Factor Authentication Chapter Review

Chapter 10: Application Authorization

Secure Application Role Procedure for Multiple Applications Rewrite and Refactor Method to Distribute Two-Factor Code Update to Two-Factor Distribution Formats Application Authorization Overview User for Application Authorization Structures for Application Authorization A Set of Connection Strings for an Application Save Connection Strings from the Client Perspective Save Connection Strings from the Server Perspective Get an Application Connection String: The Java Client Side Get a List of Application Connection Strings: The Server Side Test Application Authentication, Phase 1 Testing a Second Application Get Application Authentication Connection and Role Test Application Authentication, Phase 2 Chapter Review

Chapter 11: Enhancing Security

Hide the APPVER Connection String Create an Oracle Client Wallet Trace Oracle Client Code Logging Oracle Thin Client Trace Data Encrypt Data Stored on Oracle Database Manage Connection Strings for Applications Add Other Authentication Credentials Update Application Security Structures Authenticate on a Separate Oracle Instance Test Enhanced Security Test from a Different Application, TestOracleJavaSecure Chapter Review

Chapter 12: Administration of Security

A Security Administration Interface Application Login Screen Security Administration Menu Add/Modify User Functional Screen User Administration Screen Application Assignment Screen Application Registration Screen Application Selection Screen Connection String Editor Connection String Copy Screen Limiting Certain Administrators to Certain Applications Scripts Execution and Code Compilation Final Updates to OracleJavaSecure Single Oracle Instance Code Bootstrap OJSAdmin Chapter Review

Appendix A: List of Methods from OracleJavaSecure Class Appendix B: Oracle Procedures, Functions and Triggers for Oracle and Java Security Index