de.fhg.igd.semoa.security
Class AgentEncryptor

java.lang.Object
  de.fhg.igd.semoa.security.AgentEncryptor

public class AgentEncryptor

extends Object

This class encrypts agent structures according to a given policy. When agents with encryption are created, the policy is expressed by means of a Groups instance.

Version:

"$Id: AgentEncryptor.java 1913 2007-08-08 02:41:53Z jpeters $"

Author:

Volker Roth

See Also:

Groups

Field Summary

protected Map	folders_ The folders that are access restricted and assigned a particular access control group.
protected Map	groups_ The access control groups indexed by name.
static int	MAX_P7_LEN The maximum number of octets that an encoded P7 is allowed to have.
protected Resource	struct_ The resource holding the agentstructure.

Constructor Summary

AgentEncryptor(Resource res)
Creates an instance that operates on the agent structure stored by the given Resource.

AgentEncryptor(Resource res, Groups groups)
Creates an instance with the given Resource.

Method Summary

void	decrypt() This method decrypts the folders in the agent structure.
void	encrypt() This method encrypts the folders in the agent structure.
void	init() This method intialises this instance from the agent structure stored in the Resource that was passed to the constructor of this instance.
void	init(Map folders, Map groups) This method initialises the encryptor with the given maps of folder/name and name/group entries.
boolean	isPlain() This method returns true if the structure does not contain encrypted data an thus must not be processed by this instance.
void	validateOwner(X509Certificate cert) This method verifies that the given signing certificate is the authorised owner of the data belonging to the given group.This is done by checking the MACs in the GROUPS entry of the SEAL-INF/INSTALL.MF file.
void	validateRecipient(PrivateKey privkey, X509Certificate cert) This method verifies that the given certificate is a valid recipient of the initialised access groups.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

MAX_P7_LEN

public static final int MAX_P7_LEN

The maximum number of octets that an encoded P7 is allowed to have.

See Also:

Constant Field Values

groups_

protected Map groups_

The access control groups indexed by name. Each entry maps to a PKCS#7 EnvelopedData structure that is used to encrypt data that should be accessible to that group.

folders_

protected Map folders_

The folders that are access restricted and assigned a particular access control group. The values of this map consist of Attributes.

struct_

protected Resource struct_

The resource holding the agentstructure.

Constructor Detail

AgentEncryptor

public AgentEncryptor(Resource res)

Creates an instance that operates on the agent structure stored by the given Resource.

This constructor is typically used when agents are decrypted by a receiving host. Before actual decryption can take place, the bulk encryption keys must be unlocked.

Parameters:

res - The agent's Resource.

AgentEncryptor

public AgentEncryptor(Resource res,
                      Groups groups)

Creates an instance with the given Resource. The access groups and folder assignments are taken over directly from it.

This constructor is typically used when agents are created.

Parameters:

groups - The Groups with the readily initialized definition of the groups and folder assignments. The group files must already be unlocked. In other words, the groups structures must contain the secret bullk encryption key.

Method Detail

validateOwner

public void validateOwner(X509Certificate cert)
                   throws GeneralSecurityException

This method verifies that the given signing certificate is the authorised owner of the data belonging to the given group.This is done by checking the MACs in the GROUPS entry of the SEAL-INF/INSTALL.MF file. This establiches a simple non-interactive proof of knowledge of the symmetric bulk decryption key for the respective groups. Only valid recipients can make this check since the symmetric key must be known available for this check.

This feature is required to avoid cut & paste attacks on encrypted portions of an agent's structure. Else, an attacker might cut encrypted data and group defs from an agent and paste them into one of its own. If this agent is then sent to a host that is authorised to decrypt then the data is disclosed and may be read by the attacker's agent.

Parameters:

cert - The signing key certificate of the agent's owner.

Throws:

GeneralSecurityException - if a cut & paste attack was detected.

validateRecipient

public void validateRecipient(PrivateKey privkey,
                              X509Certificate cert)
                       throws NoSuchAlgorithmException

This method verifies that the given certificate is a valid recipient of the initialised access groups. Any groups that do not have a recipient matching the given certificate are removed. The PKCS#7 EnvelopedData instances are initialised with the given private key and certificate.

Parameters:

cert - The public encryption key certificate of the recipient.

Throws:

NoSuchAlgorithmException

init

public void init(Map folders,
                 Map groups)

This method initialises the encryptor with the given maps of folder/name and name/group entries.

Parameters:

folders - The map of folder/name entries. Each value of this map defines the name of a group in groups. In other words each value in this map corresponds to a key in the other.

groups - The map of name/group entries. each value in this map consists of a PKCS#7 EnvelopedData structure that contains the encrypted bulk encryption key to use when enveloping data that should be accessible only to the group of recipients defined in that structure.

init

public void init()
          throws IOException

This method intialises this instance from the agent structure stored in the Resource that was passed to the constructor of this instance. It reads the P7 files and the INSTALL.MF file and reconstructs the corresponding mappings.

This method only reads in the appropriate structures. The agent is not ready to be decrypted after calling this method. This requires initialisation of the decryption keys which is done through a call to validateRecipient.

Throws:

IOException

encrypt

public void encrypt()
             throws IOException

This method encrypts the folders in the agent structure.

Throws:

IOException

decrypt

public void decrypt()
             throws IOException

This method decrypts the folders in the agent structure.

Throws:

IOException

isPlain

public boolean isPlain()

This method returns true if the structure does not contain encrypted data an thus must not be processed by this instance.

Returns:

true if do processing is required.