|
|
|
|
|
|
Public Key Implementation
The underlying plug-in interface for public key security consists of six component interfaces, each of which requires one or more plug-ins. By instantiating these interfaces with your preferred plug-ins, you can bring custom message-based digital signature and message-based encryption to your applications.
The six component interfaces are:
The public key initialization interface allows public key software to open public and private keys. For example, gateway processes may need to have access to a specific private key in order to decrypt messages before routing them. This interface is implemented as a fanout.
Key Management
The key management interface allows public key software to manage and use public and private keys. Note that message digests and session keys are encrypted and decrypted using this interface, but no bulk data encryption is performed using public key cryptography. Bulk data encryption is performed using symmetric key cryptography.
Certificate Lookup
The certificate lookup interface allows public key software to retrieve X.509v3 certificates for a given principal. Principals are authenticated users. The certificate database may be stored using any appropriate tool, such as Lightweight Directory Access Protocol (LDAP), Microsoft Active Directory, Netware Directory Service (NDS), or local files.
Certificate Parsing
The certificate parsing interface allows public key software to associate a simple principal name with an X.509v3 certificate. The parser analyzes a certificate to generate a principal name to be associated with the certificate.
Certificate Validation
The certificate validation interface allows public key software to validate an X.509v3 certificate in accordance with specific business logic. This interface is implemented as a fanout, which allows BEA Tuxedo customers to use their own business rules to determine the validity of a certificate.
Proof Material Mapping
The proof material mapping interface allows public key software to access the proof materials needed to open keys, provide authorization tokens, and provide auditing tokens.
Implementing Custom Public Key Security
You can provide public key security for your application by using a custom plug-in. You choose a plug-in by configuring the BEA Tuxedo registry, a tool that controls all security plug-ins.
If you use a custom public key plug-in, you must configure the registry for your public key plug-in before you can install it. For more detail about the registry, see Setting the BEA Tuxedo Registry.
Default Public Key Implementation
The default public key implementation supports the following algorithms:
|
|
|
|
|
|
Copyright © 2000 BEA Systems, Inc. All rights reserved.
|