Java安全体系在Web程序中的研究和应用*

提出了一种基于Java的Web程序安全解决方案。该方案采用JAAS（Java Authentication Authorization Service）实现可插入式登录模块，采用X509数字证书作为用户身份认证，通过配置Web服务器，并利用服务器证书和客户端证书实现服务器与客户端之间的SSL双向认证；待认证成功后，再利用服务器和客户端协商好的对称密钥来建立HTTPS连接，以实现数据的安全传送。该方案为基于Java的Web程序提供了一个安全接口，可以方便地移植。

Research and Application of Java Security System in Web Program

Propose a security solving-scheme for Web program based on Java.The scheme realizes pluggable Authentication module by JAAS(Java Authentication Authorization Service),and take X509 digital certificate as user's identity authentication.Through configuring the Web server,and using the server certificate and client certificate,it actualizes the SSL bidirectional authentication between server and client.After the successful authentication,the HTTPS connection successfully established by negotiated symmetrical key between server and client can make the secure transmission of data.The scheme provides a secure interface for Web program which based on Java,and it can be transplant conveniently.