【作者】 彭海；

【导师】 向宏；

【作者基本信息】 重庆大学 ， 计算机软件与理论， 2006， 硕士

【摘要】 互联网技术的普及和发展,推动着企业级应用的构建和更新进程。为了缩短企业级应用的设计和开发周期,降低其构建成本,J2EE多层体系结构的开发模式已经成为开发企业级应用的首选方式。基于具有开放性的网络上的J2EE多层体系结构虽然具有传统C/S结构所没有的优势,但同时也面对一些新问题的挑战。开放性的网络导致多层体系结构的企业级应用面临来自各方面的安全威胁。如何保护信息不被非法获取、盗用、篡改和破坏,已成为所有企业级应用研究者共同关心的重要课题。本文从企业级系统应用层安全的角度出发,深入研究J2EE多层体系结构的安全策略模型。J2EE提供的安全策略简化了系统的信息安全模型,能够很方便地满足基于J2EE的分布式应用系统的安全需求,但是在面对更加复杂的安全需求时,J2EE安全策略在验证授权和角色管理中还存在不足之处:其在Web层的声明式验证机制无法为用户提供更多验证信息,可扩展性较差;在EJB层缺少业务逻辑层可供采用的验证机制,而是借助于Web层的验证机制,其耦合程度较高有悖于业务逻辑分离于表现逻辑的原则;在角色管理方面,J2EE采用数据库或者应用服务器来管理角色信息,其中,数据库管理角色的方式增加了应用开发的复杂度,应用服务器管理角色降低了系统的可移植性,两者都具有片面性。针对以上不足,本文提出了改进的安全策略模型,在Web层设计可扩展的验证模块来代替原来声明式安全采用的验证机制;在EJB层设计验证模块用于对业务逻辑资源的访问控制;在角色信息管理方面,使用目录服务器存储用户角色,来降低系统开发复杂度,提高系统的可移植性。本文最后将改进模型成功地应用于案例电子政务系统中,证实了该模型的可行性、优越性和通用性,对建立企业级应用的安全保障体系的研究有重要的参考价值。更多还原

【Abstract】 The popularization and development of Internet technologies are promoting the process of constructing enterprise application. In order to increase the design and develop efficiency, reduce the cost of building the enterprise application system, the J2EE multilayer system structure pattern has become the main method of building enterprise application. Based on the open network, the multilayer system structure has more superiority than the traditional structure which we called C/S, but also faces some new problems simultaneously. Because of the open network, the multilayer system structure is facing security threat from various aspects. How to protect the information from the illegal gain, the embezzlement and the destruction, has become an important problem that researcher cared about together.This thesis deeply researches the J2EE security strategy on the application tier of enterprise system. The security strategy predigests the information security model and meets the security requirements expediently. But there are some disadvantages when the security requirements become more complex. The expositive security on the Web-Tier can not offer more information for authentication; there is no authentication for EJB-Tier to use, make the EJB-Tier depend on the Web-Tier; J2EE uses database or application server to manage the role information. Use database to manage the role information will increase the complex of enterprise application, and the way of application server will reduce the ability of migrate other J2EE platform.To solve these problems, the thesis designs an improved security strategy model. The model designs an extensible authentication to replace the way which the expositive security uses on Web-Tier and an authentication for controlling the accessing to the protect resource on EJB-Tier. The improved model uses directory server to manage the role information. It reduces the complex of application development, and increases the ability of migrate other J2EE platform. The thesis implements an e-government system base on the improved model successfully at last. It proves the model is feasible, reformative and universal, and has referenced value for building security structure of enterprise application.更多还原