eventweb.security

Class SesnKey

java.lang.Object

eventweb.security.SesnKey

public class SesnKey
extends java.lang.Object

Session security key.

Utility for creating and manipulating session security keys

Session key strategy with HttpCliChan backchannel:

1. Servlet sets srvSesKey in web page containing TvIoWwgt
2. HttpCliChan class creates cliSesKey (HttpCliChan now knows all keys)
3. HttpCliChan creates first session key with cli low subkey in low subkey and srv low subkey in high subkey.
4. HttpCliChan sends session key and BackChannel request in service request
5. Service front channel verifies client based on high subkey
6. Service opens backchannel and listens for client
7. HttpCliChan connects to backchanell port
8. HttpCliChan creates second session key with cli high subkey in low subkey and srv high subkey in high subkey.
9. HttpCliChan sends second session key in BackChannel handshake message
10. HttpCliChan calculates final session key by adding srvSesKey & cliSesKey together
11. Service backchannel verifies client based on high subkey (Service now knows all keys)
12. Service calculates final session key by adding srvSesKey and cliSesKey
13. Service sends final session key in handshake reply message
14. HttpCliChan backchannel verifies server based on final session key.

This scenario requires a spoofer to intercept the original web page and all messages prior to break in, since whole keys are never sent in a single message. It should require an average of about 16,000 tries to guess a subkey, but if it misses on it's first guess, it doesn't get to try again.

Key Values:
Key values less than 1 are invalid.
-1 = An attempt to set an invalid key value occured
0 = An un-initilized key. (Similar to null)
Key values between 1 and MAXKEY (inclusive) are valid
1 = A valid value, but can only be set explicitly
1 is for use as a key value where full session authentication is not required.

Version:

1.3.1 05/10/15

Author:

Stephen W. Thompson

Field Summary

Fields

Modifier and Type	Field and Description
static SesnKey	DEFAULT_KEY Default session key
static java.lang.String[]	DEP_LIST Class dependencies
protected static int	MAXKEY Maximum valid key value
static java.lang.String	VERSION Class version

Constructor Summary

Constructors

Constructor and Description
SesnKey() Create a new session key with a random value.
SesnKey(java.lang.String value) Create a new session key.

Method Summary

Methods

Modifier and Type	Method and Description
static SesnKey	bcConnKey(SesnKey clientKey, SesnKey serverKey) Generate Backchannel connect key.
static SesnKey	clientKey(SesnKey fcConnKey, SesnKey bcConnKey) Assemble full client key from connect keys.
static void	configure(boolean setDebugClass) Configure the class.
static SesnKey	connAckKey(SesnKey clientKey, SesnKey serverKey) Generate connection acknowledge key.
boolean	equals(SesnKey key2) Compare keys.
static SesnKey	fcConnKey(SesnKey clientKey, SesnKey serverKey) Generate Frontchannel connect key.
boolean	newBcKeyValid(SesnKey bcConnKey) Determine if a backchannel key is a valid successor to this key.
boolean	newFcKeyValid(SesnKey fcConnKey) Determine if a frontchannel key is a valid successor to this key.
void	setDebugging(boolean debug) Set or clear debug mode.
java.lang.String	toString() Get the key as a string.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Field Detail

VERSION

public static final java.lang.String VERSION

Class version

DEP_LIST

public static final java.lang.String[] DEP_LIST

Class dependencies

DEFAULT_KEY

public static final SesnKey DEFAULT_KEY

Default session key

MAXKEY

protected static final int MAXKEY

Maximum valid key value

See Also:

Constant Field Values

Constructor Detail

SesnKey

public SesnKey()

Create a new session key with a random value.

SesnKey

public SesnKey(java.lang.String value)

Create a new session key.

Parameters:

value - String representation of value for new key

Method Detail

configure

public static void configure(boolean setDebugClass)

Configure the class.

Parameters:

setDebugClass - If true, turn on debugging for static methods

fcConnKey

public static SesnKey fcConnKey(SesnKey clientKey,
                SesnKey serverKey)

Generate Frontchannel connect key.

Parameters:

clientKey - Client session key

serverKey - Server session key

Returns:

Frontchannel connect key

bcConnKey

public static SesnKey bcConnKey(SesnKey clientKey,
                SesnKey serverKey)

Generate Backchannel connect key.

Parameters:

clientKey - Client session key

serverKey - Server session key

Returns:

Backchannel connect key

clientKey

public static SesnKey clientKey(SesnKey fcConnKey,
                SesnKey bcConnKey)

Assemble full client key from connect keys.

Parameters:

fcConnKey - Frontchannel connect key

bcConnKey - Backchannel connect key

Returns:

Assembled client connect key

connAckKey

public static SesnKey connAckKey(SesnKey clientKey,
                 SesnKey serverKey)

Generate connection acknowledge key.

Parameters:

clientKey - Client session key

serverKey - Server session key

Returns:

Connection acknowledge key

setDebugging

public void setDebugging(boolean debug)

Set or clear debug mode.

Parameters:

debug - If true, debugging is set for this instance

equals

public boolean equals(SesnKey key2)

Compare keys.

Parameters:

key2 - Key to be compared to this key

Returns:

true, If key2 has the same value as this key

newFcKeyValid

public boolean newFcKeyValid(SesnKey fcConnKey)

Determine if a frontchannel key is a valid successor to this key.

Parameters:

fcConnKey - The key to validate

Returns:

true, if the key is a valid successor

newBcKeyValid

public boolean newBcKeyValid(SesnKey bcConnKey)

Determine if a backchannel key is a valid successor to this key.

Parameters:

bcConnKey - The key to validate

Returns:

true, if the key is a valid successor

toString

public java.lang.String toString()

Get the key as a string.

Overrides:

toString in class java.lang.Object

Returns:

Key value as an integer string