Advanced Security

Introduction

The JMS server supports advanced security functionality to ensure that messages exchanged between consumer and producer applications are not compromised. In particular, the server can be configured to use the Secure Socket Layer (SSL) for all communication purposes. Also, since the structure and names of destinations may compromise an application, the built-in name service can be disabled. This chapter provides an overview of the advanced security features in the Novell exteNd Messaging Platform JMS.

Secure Sockets Layer (SSL) was developed by Netscape to allow client and server applications to exchange information securely. The SSL protocol layers on top of any transport protocol and can run under application protocols such as HTTP. SSL is based on public-key cryptography and the philosophy behind SSL has been described as follows: "The SSL Protocol is designed to provide privacy between two communicating applications (a client and a server). Second, the protocol is designed to authenticate the server, and optionally the client."

Below is is a high level description of the SSL protocol:

  1. The client requests a SSL connection from the server.

  2. The two parties negotiate a common ciphersuite, which consists of:

    1. a public key exchange algorithm - Diffie-Hellman or RSA

    2. a certificate algorithm - Digital Signature Algorithm (used in DSS certificates), RSA, or anonymous (no certificates used)

    3. a symmetric encryption algorithm, used to encrypt data, such as DES, Triple-DES, RC2, RC4, etc.

    4. a message digest algorithm, such as MD5 and SHA-1, used to check the integrity of the data

  3. The server provides its certificate chain so it can be authenticated by the client. Optionally, the client may provide its certificate chain to be authenticated by the server.

  4. The two parties compute the cryptographic parameters used in the ciphersuite, including the secret keys needed for data encryption.

  5. The two parties exchange application data, using the negotiated algorithms and computed cryptographic parameters.

Once the cryptographic parameters are established, the application data is transparently encrypted and checked for integrity in both directions. For a more thorough description of the SSL protocol and public key cryptography, please refer to alternative literature.

SSL Support

The JMS server leverages SSL support in the underlying ORB. The protection falls into two categories:

The cipher suites listed above have four components:

  1. The key exchange algorithm: DHE (Diffie-Hellman ephemeral) or RSA

  2. The certificate algorithm: DSS, RSA, or anon (anonymous, no certificate)

  3. The symmetric cipher: DES in CBS mode, DES-EDE in CBC mode (tripple-DES), RC4 (40 bit or 128 bit), or NULL (no data encryption cipher)

  4. The message digest: MD5 or SHA-1

    5. When specifying the cipher suite, it's either possible to refer to a group of suites or simply specify a comma-separated list of suites that the JMS server should honor. The names of individual suites are as listed above. The following strings for cipher suite combinations are defined:

    The order in which cipher suites are specified determines their priority. This means that the first common cipher suite in the client's list of suites and the JMS server's list of suites will be used to establish communication.

    Pluggable Security

    The pluggable security if configured using the following properties from the JMQMessageService interface:

    SSL Administration

    The SSL configuration is specified using the following properties from the JMQMessageService interface:

    These properties are part of the msgsvc.properties file used by the JMS server program jmqserv.


    Copyright © 2003, 2004 Novell, Inc. All rights reserved. Copyright © 2001, 2002, 2003 SilverStream Software, LLC. All rights reserved.