The Java EE 7 Tutorial
47.2 Security Mechanisms
The characteristics of an application should be considered when deciding the layer and type of security to be provided for applications. The following sections discuss the characteristics of the common mechanisms that can be used to secure Java EE applications. Each of these mechanisms can be used individually or with others to provide protection layers based on the specific needs of your implementation.
47.2.1 Java SE Security Mechanisms
Java SE provides support for a variety of security features and mechanisms.
-
Java Authentication and Authorization Service (JAAS) is a set of APIs that enable services to authenticate and enforce access controls upon users. JAAS provides a pluggable and extensible framework for programmatic user authentication and authorization. JAAS is a core Java SE API and is an underlying technology for Java EE security mechanisms.
-
Java Generic Security Services (Java GSS-API) is a token-based API used to securely exchange messages between communicating applications. The GSS-API offers application programmers uniform access to security services atop a variety of underlying security mechanisms, including Kerberos.
-
Java Cryptography Extension (JCE) provides a framework and implementations for encryption, key generation and key agreement, and Message Authentication Code (MAC) algorithms. Support for encryption includes symmetric, asymmetric, block, and stream ciphers. Block ciphers operate on groups of bytes; stream ciphers operate on one byte at a time. The software also supports secure streams and sealed objects.
-
Java Secure Sockets Extension (JSSE) provides a framework and an implementation for a Java version of the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols and includes functionality for data encryption, server authentication, message integrity, and optional client authentication to enable secure Internet communications.
-
Simple Authentication and Security Layer (SASL) is an Internet standard (RFC 2222) that specifies a protocol for authentication and optional establishment of a security layer between client and server applications. SASL defines how authentication data is to be exchanged but does not itself specify the contents of that data. SASL is a framework into which specific authentication mechanisms that specify the contents and semantics of the authentication data can fit.
Java SE also provides a set of tools for managing keystores, certificates, and policy files; generating and verifying JAR signatures; and obtaining, listing, and managing Kerberos tickets.
For more information on Java SE security, visit http://docs.oracle.com/javase/7/docs/technotes/guides/security/
.
47.2.2 Java EE Security Mechanisms
Java EE security services are provided by the component container and can be implemented by using declarative or programmatic techniques (see Securing Containers). Java EE security services provide a robust and easily configured security mechanism for authenticating users and authorizing access to application functions and associated data at many different layers. Java EE security services are separate from the security mechanisms of the operating system.
<IP_ADDRESS> Application-Layer Security
In Java EE, component containers are responsible for providing application-layer security, security services for a specific application type tailored to the needs of the application. At the application layer, application firewalls can be used to enhance application protection by protecting the communication stream and all associated application resources from attacks.
Java EE security is easy to implement and configure and can offer fine-grained access control to application functions and data. However, as is inherent to security applied at the application layer, security properties are not transferable to applications running in other environments and protect data only while it is residing in the application environment. In the context of a traditional enterprise application, this is not necessarily a problem, but when applied to a web services application, in which data often travels across several intermediaries, you would need to use the Java EE security mechanisms along with transport-layer security and message-layer security for a complete security solution.
The advantages of using application-layer security include the following.
-
Security is uniquely suited to the needs of the application.
-
Security is fine grained, with application-specific settings.
The disadvantages of using application-layer security include the following.
-
The application is dependent on security attributes that are not transferable between application types.
-
Support for multiple protocols makes this type of security vulnerable.
-
Data is close to or contained within the point of vulnerability.
For more information on providing security at the application layer, see Securing Containers.
<IP_ADDRESS> Transport-Layer Security
Transport-layer security is provided by the transport mechanisms used to transmit information over the wire between clients and providers; thus, transport-layer security relies on secure HTTP transport (HTTPS) using Secure Sockets Layer (SSL). Transport security is a point-to-point security mechanism that can be used for authentication, message integrity, and confidentiality. When running over an SSL-protected session, the server and client can authenticate each other and negotiate an encryption algorithm and cryptographic keys before the application protocol transmits or receives its first byte of data. Security is active from the time the data leaves the client until it arrives at its destination, or vice versa, even across intermediaries. The problem is that the data is not protected once it gets to the destination. One solution is to encrypt the message before sending.
Transport-layer security is performed in a series of phases, as follows.
-
The client and server agree on an appropriate algorithm.
-
A key is exchanged using public-key encryption and certificate-based authentication.
-
A symmetric cipher is used during the information exchange.
Digital certificates are necessary when running HTTPS using SSL. The HTTPS service of most web servers will not run unless a digital certificate has been installed. Digital certificates have already been created for GlassFish Server.
The advantages of using transport-layer security include the following.
-
It is relatively simple, well-understood, standard technology.
-
It applies to both a message body and its attachments.
The disadvantages of using transport-layer security include the following.
-
It is tightly coupled with the transport-layer protocol.
-
It represents an all-or-nothing approach to security. This implies that the security mechanism is unaware of message contents, so that you cannot selectively apply security to portions of the message as you can with message-layer security.
-
Protection is transient. The message is protected only while in transit. Protection is removed automatically by the endpoint when it receives the message.
-
It is not an end-to-end solution, simply point-to-point.
For more information on transport-layer security, see Establishing a Secure Connection Using SSL.
<IP_ADDRESS> Message-Layer Security
In message-layer security, security information is contained within the SOAP message and/or SOAP message attachment, which allows security information to travel along with the message or attachment. For example, a portion of the message may be signed by a sender and encrypted for a particular receiver. When sent from the initial sender, the message may pass through intermediate nodes before reaching its intended receiver. In this scenario, the encrypted portions continue to be opaque to any intermediate nodes and can be decrypted only by the intended receiver. For this reason, message-layer security is also sometimes referred to as end-to-end security.
The advantages of message-layer security include the following.
-
Security stays with the message over all hops and after the message arrives at its destination.
-
Security can be selectively applied to different portions of a message and, if using XML Web Services Security, to attachments.
-
Message security can be used with intermediaries over multiple hops.
-
Message security is independent of the application environment or transport protocol.
The disadvantage of using message-layer security is that it is relatively complex and adds some overhead to processing.
GlassFish Server supports message security using Metro, a web services stack that uses Web Services Security (WSS) to secure messages. Because this message security is specific to Metro and is not a part of the Java EE platform, this tutorial does not discuss using WSS to secure messages. See the Metro User's Guide at https://metro.java.net/guide/
.


Located near Soka, Bali, 1e+9 is proud to be able to support the 1st Beter Farm in Indonesia.
In order to stay in touch with the Indonesian and Balinese traditional culture and methods, our way of thinking is always to use natural building materials: Bamboo, wood, stone etc.
We would like to realize a green, natural and eco image that blends in with the environment.


In image noise model experiment five common noise models simulations are displayed, with plots of the power spectrum of the test image, noisy image, and noise only, and plots of Autocorrelation function of the test image and noisy image.
The five noise models are:
The additive signal independent noise model (ASIN-model) implies signal distortions described as
Equation 6‑1
where is noise-less signal, is a random process statistically independent on signal and referred to as additive noise and is signal contaminated with noise. Given signal, additive noise generates signal ensemble that consists of copies of this signal distorted by different realizations of noise.
The assumption of statistical independence implies that statistical averaging over the noise ensemble applied to signal or to results of its transformations acts only on the noise component. For instance, for the considered ASIN-model:
Equation 6‑2
In this model, mean value of noise is usually of no concern and it is natural to assume that . With this assumption, mean value of the signal corrupted with additive zero mean noise is equal to the uncorrupted signal and standard deviation of its fluctuations is equal to the standard deviation of noise:
Equation 6‑3
Equation 6‑4
A typical statistical model of additive noise is homogeneous zero mean Gaussian random process. It is completely statistically determined by its probability density called normal distribution
Equation 6‑5
Where is its standard deviation, and by its correlation function.
One of the basic results of the probability theory is the central limit theorem, which states that distribution density of sum of statistically independent random values tends to the normal distribution with the growth of the number of those random values. This implies that the normal distribution is a good model of the distribution of many types of noise in image sensors, and, in particular, of thermal noise caused by random fluctuations of velocities of electrons in electronic signal sensors.
Uncorrelated random process, whose correlation function is a delta-function and spectral density is a constant, is conventionally called white noise by analogy with “white light” that contains all colors with uniform weights
Distortions caused by inappropriate sampled signal low pass filtering for the reconstruction exhibit themselves in appearance of signal high frequencies doubles from spectrum replicas not cleaned out by the reconstruction filter. For sinusoidal signals, their doubles cause low frequency beatings in the reconstructed signal that appear as moiré patterns. Owing to this reason, these aliasing effects are called moiré effects. In images, moiré effects usually appear in form of “pixelation” [1]. Moiré noise is highly correlated additive noise. These correlations manifest themselves as concentrated peaks in noise power spectrum in certain areas of frequency domain. Additive noise with Noise power spectrum that is concentrated only around a few isolated points in frequency domain is considered as periodical noise, or moiré noise. [2]
Moiré noise can be illustrate as an interference of uniformly distributed amplitude at random frequencies added to the original image, i.e. , where:
,
Equation 6‑6
This type of noise is a frequent distortion in imaging systems that use mechanical scanning for generating images. Banding noise exhibits itself in chaotic behavior of mean values of image signal in the direction of scan, i.e. in the direction of image rows [3]. Bending noise is illustrated as an addition of a constant value along the row, with random value in each column:
Equation 6‑7
where , , and is the noise standard deviation.
The dominant noise in the lighter parts of an image from an image sensor is typically that caused by statistical quantum fluctuations, that is, variation in the number of photons sensed at a given exposure level. This noise is known as “photon shot noise” [4]. Shot noise has a Poisson distribution, which is usually not very different from Gaussian
Shot noise is illustrated by: , i.e. for input pixel value of , the output is a random variable, Poisson distributed. For Poisson model, random variable values are nonnegative integer numbers that have Poisson probability distribution:
(2.4. 1)
Where is mean value of It is the property of Poisson probability distribution that standard deviation of is equal to its mean:
(2.4. 2)
When , the Poisson distribution, according to the Moivre-Laplace theorem, tends to normal distribution with standard deviation :
(2.4. 3)
An important peculiarity of the Poisson distributions is that the ratio of its standard deviation to mean value tends to zero with growth of the mean value:
(2.4. 4)
Which means that with growth of the mean value of random variable with Poisson distribution its fluctuations from its mean value are becoming relatively less noticeable. [2]
Image distortions in form of impulse noise or “pepper-and-salt” noise usually occur in image transmission via noisy digital communication channels and in storage of digital imagery. Signal transmission errors result in losses, with certain probability, of individual image samples and in replacing their values by random values. Impulse noise may also appear as a residual noise after applying denoising filtering to noisy images with additive or speckle noise. In this case, impulse noise originates from large outbursts of additive or speckle noise that the filtering failed to remove. “Pepper-and-salt” noise usually occurs due to memory cell faults in digital image storage. The possibility of successful filtering of impulse and “pepper-and-salt” noise allows to lower requirements to transmitter power or, given the transmitter power, to raise the transmission distance and to lower requirements to the reliability of digital storage.
As a factor that affects image perception, impulse noise is more destructive than additive normal noise [5].
Impulse noise model (ImpN- model) is defined by the following equation:
Equation 6‑8
which implies that random distortions of signal are caused by two independent random factors: by a binary random process that assumes values 0 and 1, and by a random variable that assumes values from the same value range as that of the noise-less signal . ImpN-model is characteristic for signal transmission and storage systems with random faults. The process describes signal transmission and memory faults and is specified by the probability that (the probability of error, or the probability of signal loss). Statistical properties of noise can be arbitrary; most frequently it is uniformly distributed in the signal dynamic range. If random process assumes only two values equal to the minimum and to the maximum of, it produces impulse noise that in image processing jargon is called the pepper-and-salt noise because it is seen as contrast black and white points.
Figure 6‑1: Gaussian Noise example, top left - test image, top right - test image with Gaussian noise (standard deviation = 24), bottom left – spectrums of the test image, noisy image and noise only image, bottom right – test image correlation (blur) with noisy image correlation (red).
Figure 6‑1 illustrated the properties of the Gaussian noise. The noise spectrum appears constant in all the frequencies (hence the “white” in white noise), and the addition of a delta to the original image auto correlation function.
Figure 6‑2: Moiré Noise example, top left - test image, top right - test image with moiré noise (noise intensity = 50.2), lower left – averaged DFT power spectra of the test image rows, averaged DFT power spectra of the noisy image rows, and averaged DFT power spectra of the noise only image rows, bottom right – test image correlation (blur) with noisy image correlation (red).
The characteristics of the moiré noise are illustrated at Figure 6‑2 . In the spectrum plot of the noise only image, two peaks of the noise are noticeable, and those peaks are also somewhat noticeable in the spectrum of the noisy image. The visual appearance of the moiré noise is periodic patterns on the image surface.
Figure 6‑3: Bending Noise example, top left - test image, top right - test image with bending noise (noise range = 128, i.e. ), lower left – averaged DFT power spectra of the test image rows, averaged DFT power spectra of the noisy image rows, and averaged DFT power spectra of the noise only image rows, bottom right – test image correlation (blur) with noisy image correlation (red).
Bending noise is characterized by a constant value noise in all the columns, and a random probability for its appearance at each row, as it is shown at Figure 6‑3. Along the rows, it has a constant value which translates to a strong DC component at the power spectrum. The autocorrelation function, normally a very smooth function, is highly fluctuates. This is a characteristic of banding noise, and it is a good way to detect and clean such a noise.
Figure 6‑4: Shot Noise example, top left - test image, top right - test image with Shot noise. Lower left – averaged DFT power spectra of the test image rows, averaged DFT power spectra of the noisy image rows, and averaged DFT power spectra of the noise only image rows. Bottom right is test image correlation (blur) with noisy image correlation (red).
The resemblance between the white Gaussian noise and shot noise is illustrated at Figure 6‑4. Similarly to the Gaussian noise, the noise spectrum appears constant in all the frequencies and the addition of a delta to the original image auto correlation function. Visually, shot noise and Gaussian noise appears similar as well.
Figure 6‑5: Impulse Noise example, top left - test image, top right - test image with Impulse noise (error probability = 0.1). Lower left – averaged DFT power spectra of the test image rows, averaged DFT power spectra of the noisy image rows, and averaged DFT power spectra of the noise only image rows. Bottom right is test image correlation (blur) with noisy image correlation (red).
Figure 6‑5 illustrates
the impulse noise appearance. Impulse noise appears a dots on the image,
tampered pixels.
|
[1] |
L. Yaroslavsky, "Lec. 4 Principles of signal digitization. Signal sampling". |
|
[2] |
L. P. Yaroslavsky, "Models of Signal Random Interferences," in Theoretical Foundations of Digital Imaging Using MATLAB, CRC Press, 2012, p. 46. |
|
[3] |
L. P. Yaroslavsky, "Empirical Wiener filters for image deblurring," in Theoretical Foundations of Digital Imaging Using MATLAB, CRC Press, 2012, p. 411. |
|
[4] |
L. W. MacDonald, "Shot Noise," in Digital Heritage: Applying Digital Imaging to Cultural Heritage, Elsevier, 2006. |
|
[5] |
L. P. Yaroslavsky, "Filtering Impulse Noise," in Theoretical Foundations of Digital Imaging Using MATLAB, CRC Press, 2012, p. 435. |


GraphicsInfo QML Type
Provides information about the used Qt Quick backend More...
| Import Statement: | import QtQuick 2.7 |
| Since: | QtQuick 2.8 |
Properties
- api : enumeration
- majorVersion : int
- minorVersion : int
- profile : enumeration
- renderableType : enumeration
- shaderCompilationType : enumeration
- shaderSourceType : enumeration
- shaderType : enumeration
Detailed Description
The GraphicsInfo attached type provides information about the scenegraph backend used to render the contents of the associated window.
If the item to which the properties are attached is not currently associated with any window, the properties are set to default values. When the associated window changes, the properties will update.
Property Documentation
This property describes the graphics API that is currently in use.
The possible values are:
- GraphicsInfo.Unknown - the default value when no active scenegraph is associated with the item
- GraphicsInfo.Software - Qt Quick's software renderer based on QPainter with the raster paint engine
- GraphicsInfo.OpenGL - OpenGL or OpenGL ES
- GraphicsInfo.Direct3D12 - Direct3D 12
This property holds the major version of the graphics API in use.
With OpenGL the default version is 2.0
.
See also minorVersion and profile.
This property holds the minor version of the graphics API in use.
With OpenGL the default version is 2.0
.
See also majorVersion and profile.
This property holds the configured OpenGL context profile.
The possible values are:
- GraphicsInfo.OpenGLNoProfile (default) - OpenGL version is lower than 3.2 or OpenGL is not in use.
- GraphicsInfo.OpenGLCoreProfile - Functionality deprecated in OpenGL version 3.0 is not available.
- GraphicsInfo.OpenGLCompatibilityProfile - Functionality from earlier OpenGL versions is available.
Reusable QML components will typically use this property in bindings in order to choose between core and non core profile compatible shader sources.
See also majorVersion, minorVersion, and QSurfaceFormat.
This property holds the renderable type. The value has no meaning for APIs other than OpenGL.
The possible values are:
- GraphicsInfo.SurfaceFormatUnspecified (default) - Unspecified rendering method
- GraphicsInfo.SurfaceFormatOpenGL - Desktop OpenGL or other graphics API
- GraphicsInfo.SurfaceFormatOpenGLES - OpenGL ES
See also QSurfaceFormat.
This property contains a bitmask of the shader compilation approaches supported by the Qt Quick backend the application is using.
- GraphicsInfo.RuntimeCompilation
- GraphicsInfo.OfflineCompilation
With OpenGL the value is GraphicsInfo.RuntimeCompilation, which corresponds to the traditional way of using ShaderEffect. Non-OpenGL backends are expected to focus more on GraphicsInfo.OfflineCompilation, however.
Note: The value is only up-to-date once the item is associated with a window. Bindings relying on the value have to keep this in mind since the value may change from 0
to the actual bitmask after component initialization is complete. This is particularly relevant for ShaderEffect items inside ShaderEffectSource items set as property values.
This QML property was introduced in QtQuick 2.8.
See also shaderType and shaderSourceType.
This property contains a bitmask of the supported ways of providing shader sources.
- GraphicsInfo.ShaderSourceString
- GraphicsInfo.ShaderSourceFile
- GraphicsInfo.ShaderByteCode
With OpenGL the value is GraphicsInfo.ShaderSourceString, which corresponds to the traditional way of inlining GLSL source code into QML. Other, non-OpenGL Qt Quick backends may however decide not to support inlined shader sources, or even shader sources at all. In this case shaders are expected to be pre-compiled into formats like SPIR-V or D3D shader bytecode.
Note: The value is only up-to-date once the item is associated with a window. Bindings relying on the value have to keep this in mind since the value may change from 0
to the actual bitmask after component initialization is complete. This is particularly relevant for ShaderEffect items inside ShaderEffectSource items set as property values.
This QML property was introduced in QtQuick 2.8.
See also shaderType and shaderCompilationType.
This property contains the shading language supported by the Qt Quick backend the application is using.
- GraphicsInfo.UnknownShadingLanguage - Not yet known due to no window and scenegraph associated
- GraphicsInfo.GLSL - GLSL or GLSL ES
- GraphicsInfo.HLSL - HLSL
Note: The value is only up-to-date once the item is associated with a window. Bindings relying on the value have to keep this in mind since the value may change from GraphicsInfo.UnknownShadingLanguage to the actual value after component initialization is complete. This is particularly relevant for ShaderEffect items inside ShaderEffectSource items set as property values.
This QML property was introduced in QtQuick 2.8.
See also shaderCompilationType and shaderSourceType.


Hi, I'm Lauriane, the one behind CRIQUETS CRAQUEZ.
I'm a passionate storyteller with a strong belief in the power of communication to grow the business externally and build internal unity and shared vision. Good PR and communications tell a story.
That's why my brand is called "Criquets Craquez".
Where I'm from, that's how we start telling stories. English has "once upon a time", Spanish "érase una vez", French "il était une fois".
Wait, stop. Aren't you French?
Yes, I am! But I grew up on a small French island in the Indian Ocean, called La Réunion. We are of Creole culture, a melting pot of European, African, Indian, Chinese and insular traditions. "Criquets craquez" is a Creole saying!
Your brand's DNA is unique: what it stands for, why you created it, its values… All of it tell a unique story that you want to keep consistent and enrich everytime you communicate.
That's where I come in. Strategy and growth are my area of expertise. Words, visuals and websites are my specialties. (Pancakes too, but that's another story.)
You don't want to have any website or any logo just for the sake of it. Any organization can! You need to be unique. And guess what? You are!
Every company, every organization, every brand has its own story. Whether it's already clear in your mind and you need someone to tell it, or you need help to figure it out and put words or visuals on it, I'm here for you.
To connect or to learn more about my work experience
Ready to start your next project?
Give me a call or send me an email and we'll get started on telling your story!


You are viewing an historical archive of past issues. Please
report new issues to the appropriate project issue tracker on
GitHub.
Comments
-
Greg Hurrell
See also ticket #1635, "Mark already-open files in bold".
-
Greg Hurrell
Closed ticket #1632 as a duplicate.
-
Greg Hurrell
Also requested in this forum thread.
-
Greg Hurrell
This was done a long time ago; will mark as closed.
-
Greg Hurrell
Status changed:
- From: new
- To: closed
Add a comment
Comments are now closed for this issue.