14 Security and IMlet Signing

Security Policy Provider Clients

Oracle Java ME SDK 8 supports the following clients by default:

• Signed: An example client with all permissions granted.

• untrusted: Defines the security policy for untrusted applications. According to the X.509 authentication scheme, unsigned applications are bound to the untrusted client.

Configuring the Security Policy

To configure the security policy for a device, right-click the device in the Device Selector and select Security Configuration. Figure 14-1 shows the Security Configuration window.

Figure 14-1 The Security Configuration Window

Description of "Figure 14-1 The Security Configuration Window"

The options in the Security Providers group at the top of the Security Configuration window can be used if you want to specify a custom security provider implementation JAR file, and class names of your custom authentication provider and security policy provider. For information about creating custom providers, see Chapter 15, "Custom Security Policy and Authentication Providers".

To add a client, click Add under the Clients list, specify a name and click OK. To remove a client, select it in the list and click Remove.

When you select a client from the list, you can add, edit, and remove permissions and certificates for the selected client.

To add a permission, select the necessary client, and click Add under the Permissions list. Then select the permission from the list, specify the name of the protected resource (you can use wildcards) and the requested actions separated by commas (for example, read,write), and click OK. To edit a permission, select it from the list of permissions, and click Edit under the Permissions list. To remove a permission, select it in the list, and click Remove.

To add a certificate, select the necessary client, and click Add under the Certificates list. Then select the certificate from the list of available certificates and click OK. To remove a certificate, select it in the list, and click Remove.

Signing a Project

Devices use signing information to verify an application's source and validity before allowing it to access protected APIs.

Oracle Java ME SDK 8 provides a default built-in keystore, but you can also create any number of key pairs using the Keystores Manager as described in Managing Keystores and Key Pairs.

The key pair consists of the following keys:

• A private key that is used to create a digital signature.

• A public key that anyone can use to verify the authenticity of the digital signature.

To sign a project with a key pair:

1. Right-click a project and select Properties.

2. In the Signing category, select Sign JAR.

3. Select an existing keystore or click Open Keystores Manager to create another keystore. For information about managing keystores, see Managing Keystores and Key Pairs.

4. Select a key pair alias.

   A keystore might be accessed by several key pairs, each with a different alias. If you prefer to use a unique key pair, click Open Keystores Manager and create a new key pair.

   The Certificate Details area displays the subject, issuer, and validity dates for the selected keystore.

5. Click OK.

It is also necessary to export the certificate to the device. For more information, see Managing Root Certificates.

Managing Keystores and Key Pairs

For test purposes, you can create a signing key pair to sign an IMlet. The Keystores Manager administers this task. The keystores known to the Keystores Manager are listed when you sign a project.

To deploy an IMlet on a device, you must obtain a signing key pair from a certificate authority recognized by the device. You can also import keys from an existing Java SE platform keystore.

To create a keystore:

1. Open the Tools menu and select Keystore Management.

2. Click Add Keystore.

3. Select Create a New Keystore and specify a name, location, and password.

4. Click OK.

To add an existing keystore:

1. Open the Tools menu and select Keystore Management.

2. Click Add Keystore.

3. Select Add Existing Keystore and specify the path to the keystore file. The default location for user-defined keystores is the user's folder under C:\Users.

4. Click OK.

   You might have to unlock this keystore and each key pair within it.

To create a new key pair:

1. Open the Tools menu and select Keystore Management.

2. Select a keystore.

   
   

   Note: You cannot create key pairs in the default built-in keystore.

   
   

3. Click New.

4. Specify an alias used to refer to this key pair and at least one field under Certificate Details. Optionally, you can also provide a password.

5. Click OK.

To remove a key pair, select it in the list and click Delete.

Managing Root Certificates

The Oracle Java ME SDK 8 command-line tools manage the emulator's list of root certificates.

External devices have similar lists of root certificates. When you deploy your application on an external device, you must use signing keys issued by a certificate authority whose root certificate is on the device. This makes it possible for the device to verify your application.

Each emulator instance has its own keystore. The keystore file is named _main.ks and located under appdb\certs in the device's configuration directory. For example, the default keystore for EmbeddedDevice1 is userdir\javame-sdk\8.0\work\EmbeddedDevice1\appdb\certs\_main.ks

You can use the -import option to import certificates from these keystores as described in Manage Certificates (mekeytool).

To export a certificate to an emulated device:

1. Open the Tools menu and select Keystore Management.

2. Select a keystore, and then select a key.

3. Click Export.

4. Select and emulator and a certificate, and click Export.

   
   

   Note: Before exporting, you can modify the list of registered keys by selecting any key and clicking Delete Key to delete it from the list.

   
   

5. Click Close when you are done.

Command-Line Security Features

The full spectrum of the Oracle Java ME SDK 8 security features are also available from the command line. You can adjust the emulator's default protection domain, sign IMlet suites, and manage certificates.

> mekeytool.exe -Xdevice:EmbeddedDevice1 -list