The resultant system should store all the data of the users who is utilizing it. For this every end-user should be identified and the system should afford a unique identity for the end-user. Privacy should be maintained for the data that belongs to a particular end-user and affording a password can do this. This means, the end-user should be able to refer the previous data reaches him/her. The end-user should be able to send data to other users. The end-user should be able to store the addresses of other persons and should be able to retrieve whenever they required. End-user should be able to change the password to get lot of security. End-user should be able to maintain the data in different locations so that they may identify lot of quickly.
Communication plays a key role in human life. A person can express any thing to others in different ways with communication. If they had a problem or if they got a happy moment or a sad one, they had a nature of sharing that with others. In this scenario, there should be a communication media among the people, so that they can express their thoughts with every other from this communication media. In olden days, people communicate with every other utilizing letters that takes much time to reach the other person and the response from the other person as well takes much time. If there is any delay then it will be too late to reach the right person. The present scenario is, even the people are near they are not getting time to share the ideas. For example, in an organization, if a meeting to be conducted, the organization staff should be intimated about that meeting. It is very difficult to pass this data to every and every person, if the organization is big. In order to avoid that, there should be a system, which passes the data to all the people present in the organization with in no time. For this purpose a system should be build which sustain the facilities given in the abstract.
- Check Mail
- Write Mail
- Manage Addresses
- Mail Management
- Folder Management
- Password Management
This module deals with the part of end-user creation. The system should identify the end-user uniquely so that privacy can be managed and right data reaches the right end-user. So every end-user should have an id from which they can login and procedure their data. This id will be created in registration procedure.
This is the procedure where the end-user gets access to the data, which he/she stored. In order to maintain the privacy, the id and password will be taken here and if they are correct the end-user will enter into the system.
Here the end-user is able to read the data/data present in the mailbox. End-user can as well refer the previous mails if they are not deleted.
When a end-user want to send some data to other users, this feature will be very much useful.
This module helps the end-user in such a way that all the contacts can be maintained and can be kept as a reference.
This module enables the end-user to keep mails of different categories in different folders.
This is very much useful for a end-user to maintain their folders and helps in mail management.
In order to maintain the privacy, end-user should afford a password to the system to protect the data. In this the end-user can change the password time to time.
- HTML 4.0 for client-side validations and End-user Interface
- Jdk 1.6 and Jsdk 2.0 for applying the business logic
- Oracle 9i for data storage and maintenance.
- Windows 2000 or XP
- WebLogic 8.1.0
- S/W & H/W Requirement:
- Jdk 1.6, Jsdk2.0
- ODBC Drivers installed
- JDBC Drivers installed
- Web Logic Server 8.1
- Oracle 9i
- Windows 2000 or XP
- Personal computer with 80486 or higher processor
- 2.1 GB hard disk space
- 64 MB RAM
Prototype Mail service
For developing the prototype mail service we utilized java mail server so we are going to introduce java mail server.
Java Mail Server
The JavaMail API is an optional package (standard extension) for reading, composing, and sending electronic messages. We utilize the package to make Mail End-user Agent (MUA) kind programs, similar to Eudora, pine, and Microsoft Outlook. The API's main purpose is not for transporting, delivering, and forwarding messages; this is the purview of applications like sendmail and other Mail Transfer Agent (MTA) kind programs. MUA-kind programs let users read and write e-mail, whereas MUAs rely on MTAs to handle the actual delivery. The JavaMail API is build to afford protocol-independent access for sending and receiving messages by dividing the API into two parts:
- The first part of the API is the focus of this course -- basically, how to send and receive messages independent of the provider/protocol.
- The second part speaks the protocol-specific languages, similar to SMTP, POP, IMAP, and NNTP. With the JavaMail API, to facilitate correspond with a server, we required a provider for a protocol. The creation of protocol-specific providers is not covered in this course due to Sun affords a sufficient set for free.
Before looking into the JavaMail API specifics, let's step back and take a look at the protocols utilized with the API. There are essentially four that fit come to recognize:
We will as well run throughout NNTP and some others. appreciative the fundamentals of all the protocols will help we recognize how to utilize the JavaMail API. While the API is build to be protocol atheist, we can't beat the boundaries of the fundamental protocols. If a ability isn't sustained by a selected protocol, the JavaMail API doesn't magically add the ability on top of it. (As we'll soon see, this can be a problem when working with POP.)
The Easy Mail Transfer Protocol (SMTP) is described by RFC 821 . It described the technique for delivery of e-mail. In the context of the JavaMail API, our JavaMail-based program will communicate with our company or Internet Service Provider's (ISP's) SMTP server. That SMTP server will broadcast the message on to the SMTP server of the recipient to finally be obtain by the end-user from POP or IMAP. This does not need our SMTP server to be an open broadcast, as authentication is continued, but it is our liability to make sure the SMTP server is configured correctly. There is nothing in the JavaMail API for tasks as configuring a server to broadcast messages.
Post Office Protocol; Currently in version 3, as well known as POP3, RFC 1939 described this protocol. POP is the technique maximum people on the Internet utilize to get their mail. It described sustain for a single mailbox for every end-user. That is all it does, and that is as well the source of a lot of confusion.
IMAP is a lot of advanced protocol for receiving messages. Described in RFC 2060 , IMAP represents for Internet Message Access Protocol, and is currently in version 4, as well known as IMAP4. When utilizing IMAP, our mail server must sustain the protocol. We can't just change our program to utilize IMAP instead of POP and expect everything in IMAP to be sustained.
Assuming our mail server supports IMAP, our JavaMail-based program can take advantage of users having multiple folders on the server and these folders can be shared by multiple users. Due to the lot of advanced capabilities, we might think IMAP would be utilized by everyone. It isn't.
MIME represents for Multipurpose Internet Mail Extensions. As a end-user of the JavaMail API, we usually don't require to worry about these formats. However, these formats do exist and are utilized by our programs.
NNTP and others
Due to of the split of the JavaMail API among provider and everything else, we can simply add sustain for additional protocols. Sun maintains a list of third-party providers that take advantage of protocols for which Sun does not afford out-of-the-box
Architecture of Prototype Mail Service
The Problems with Trusting Email
Today email is one of the maximum popular applications on the Internet and this position has been earned due to of its clear business benefits. However for several years, there has been a dramatic rise in email fraud and phishing, so much so that the "From:" field in an email message or the message content itself can no longer be trusted at face value. It is easy to spoof these details, allowing attackers to make and utilize false identities with minimum effort. The recent substantial fraud committed at a leading European bank, which involved email trust issues, serves as clear evidence of what happens when emails are trusted blindly without any security trails.
To overcome such threats in electronic communication, Ascertia affords the multi-purpose Advanced Digital Signature Services (ADSS) Server as a solution for digitally signing and examining any kind of electronic document so that it's content can be simply trusted and the identity of its authors, reviewers and/or approvers can be automatically verified.
Ascertia offers the Secure Email Server as an automated email application that utilizes ADSS Server to manage the security elements:
- Signing outgoing email attachments utilizing PDF digital signatures, XML Digital signatures or PKCS#7/CMS signatures.
- Examining incoming signed emails including identity checking the sender's certificate utilizing real-time OCSP, plus optional signer's certificate quality checking.
- Examining incoming signed email attachments including checking the document author's signing certificate utilizing OCSP, plus optional certificate quality checking.
- Signing outgoing emails utilizing standard S/MIME digital signatures that are verifiable by maximum email clients, e.g. Microsoft Outlook, Lotus Notes & Thunderbird.
- Archiving outgoing emails so that operators can recover, review and even resend emails that were processed earlier. (This functionality is planned for Q1 2009).
Options exist to sustain advanced long-term signature profiles utilizing CAdES and XAdES and the PDF equivalent.
The following sections explain the Secure Email Server architecture and how it and ADSS Server collaborate to achieve the above objectives.
Secure Email Server Architecture
The Ascertia Secure Email Server is a full MTA email server that supports both SMTP and POP3 protocols. It is built utilizing the open source Apache James, a popular platform independent pure Java mail server. Apache James affords a mail application platform with an embedded standard extension technique built around:
- Matchers: These afford message selection services and are written specifically to filter and identify those emails that required processing by passing them to the Mailet.
- Mailets: These afford message processing services and are written specifically to processes the filter email. The Mailet calls ADSS Server to digitally sign or verify the email or its attachment. The Apache James server is thus a container for the Mailet.
The high-level architecture of Secure Email Server is shown below. The green boxes show the standard Apache James modules including the SMTP and POP3 engines that handle inbound and outbound email messages. The Ascertia core mail processing engine is shown by the orange boxes representing a specific Matcher and Mailet for handling digital signature creation and verification functionality:
A future version of the product will afford extended functionality to afford email archiving as well as email encryption/decryption services from the Matcher/Mailet architecture.
A typical deployment of Secure Email Server is shown below, with an existing email server handling emails as normal, but then routing these to the Secure Email Server for signing. If the Matcher rules determine that the email requires signing, the Mailet sends a signing request message to safely located ADSS Server:
For incoming emails, the Secure Email Server Matcher filters those emails and attachments that are signed and then the Mailet makes a request to the ADSS Server to verify these signatures. The original email and the verification results are then passed to the internal email server for later delivery to the internal mail recipient(s). It is recommended that they are delivered to security administrators if the signatures fail to verify.
The Secure Email Server can as well be utilized to sign and archive received emails and attachments to afford evidence of what has been received and when it was received from external parties.
Matcher Processing Options
The Matcher will be configured to meet organizational desires. Mails can be filtered based on:
- Text matches within:
- The FROM Field
- The TO field
- The CC field
- The BCC field
- The SUBJECT field
- The email BODY
- PDF documents
- XML data
- Other file types, like Office documents
Note: A future release will be able to offer to replace signatures that have been applied at the desktop but corrupted by the corporate email server adding corporate messages, Anti-Spam and other messages. Encrypted emails will as well be handled - ask for details.
Mailet Processing Options
The Mailet will be configured as needed to afford a range of services, e.g.:
- Sign an attachment (according to the attachment kind or policy)
- Verify an attachment (according to the attachment kind or policy)
- Sign the email (including any attachments) (Q3/2008)
- Verify the email (including any attachments)
- Archive the email (Q1/2009)
- Encrypt the email (Q1/2009)
- Decrypt the email (Q1/2009)
When examining signatures various options are possible (a) if the signature is trusted, then the email can be passed to intended recipient with the results shown in the email body or as an attachment, or (b) if the signatures are not trusted, then the email can be forwarded to a security operator for review and action. Other recipients email addresses can as well be added.
The other result is "indeterminate" i.e. the status of the signature cannot be determined due to there is insufficient data, usually a lack of trust for the signing certificate.
Automated response emails could be configured.
The handling of received encrypted emails will be something Ascertia will afford a solution for in 2009. Our automated processing plans can be discussed as necessiate under NDA.
One of the major benefits of the Secure Email Sever solution is that no cryptographic keys required to be deployed to end-users. End-users don't even require learning how to sign their emails as the signatures are automatically applied. And of course for mobile devices or webmail users this is very useful. The signing keys are managed by the ADSS Server in either a secure HSM or held in encrypted form within the ADSS Server database. The choice of how to utilize the signing keys includes:
- Utilize a departmental signing key within the ADSS Server and sign all emails utilizing this. For example sign all emails sent by members of the Finance Department utilizing the finance department key.
- Utilize individual keys for every email end-user - the ADSS Server can make the digital signature utilizing the signing key of the identified email sender. The Secure Email Server extracts this data from the email's "FROM" field.
The solution has been build to afford high-levels of practical security. ADSS Server has been build to manage cryptographic keys, signing / verification operations and other auxiliary trust services. Ascertain has build ADSS Server with security in mind:
- All service requests to and responses from the ADSS Server are recorded in secure cryptographically-protected logs.
- The Secure Email Server is treated as any other business application and it desires to be registered on ADSS Server and have its requests authenticated.
- ADSS Server can optionally utilize FIPS 140-2 PKCS#11 tamper-resistant hardware security modules (HSMs) for the storage and processing of private keys.
- Secure Email Server can utilize multiple ADSS Server instances for high availability
- Secure web-based administrative interfaces with role based access controls are afforded and enforced for ADSS Server operators.
- ADSS server can utilize an optional dual control facility so that at least two authorized operators are necessiate to build and then approve any configuration changes.
Evaluation of Prototype Mail Service
The Standard Performance Evaluation Corporation (SPEC) is a non-profit corporation formed to establish, maintain and endorse a standardized set of relevant benchmarks that can be applied to the newest generation of high-performance computers. SPEC develops benchmark suites and as well reviews and publishes submitted results from our member organizations and other benchmark licensees.
OVERVIEW OF JAVA TECHNOLOGY
Java, whether we love it, or hate it, it's here to stay. Like everyone's favorite language C, Java has had a major impact on the computing scene. When the past of computers is written, its name will be up there with the celebrity.
If we were to decide just one language to learn today, it is supposed to be Java. It's being pushed aggressively by Sun and is growing by leaps and bounds. There are plenty of Java programmers out there and lot of join the party every day.
Java started out as a bit of a mishap. A side under Bill Joy was working at Sun on a new encoding language for embedded applications. Java was at first expected to work in toasters and fridges, not on current computers! The early prognosis for Java was not good and it was only the climb of the Internet which keeps Java from oblivion. Since then, neither the Net nor Sun nor Java has seem to be back and all have full-fledged from strength to strength.
World Wide Web is an open ended data retrieval system build to be utilized in the distributed environment. This system contains web pages that afford both data and controls. We can navigate to a new web page in any direction. This is made possible worth HTML java was meant to be utilized in distributed environment like internet. So java could be simply incorporated into the web system and is capable of supporting animation graphics, games and other special effect. The web has become lot of dynamic and interactive with sustain of java. We can run a java program on remote machine over internet with sustain of web.
Introduction to Servlets
Servlets afford a Java(TM)-based solution utilized to address the problems currently associated with doing server-side programming, including inextensible scripting solutions, platform-specific APIs, and incomplete interfaces.
Servlets are objects that conform to a precise interface that can be plugged into a Java-based server. Servlets are to the server-side what applets be to the client-side - object byte codes that can be dynamically loaded off the net. They vary from applets in that they are faceless objects (without graphics or a GUI component). They serve up as platform-independent, dynamically-loadable, pluggable assistant byte code objects on the server face that can be utilized to dynamically extend server side functionality.
What is a Servlet
Servlets are unit that extends request/response-oriented servers, like Java enabled web servers. For example, a servlet power be responsible for taking data in an HTML order-entry form and applying the business logic utilized to update a company's order database.
Servlets are to servers and applets are to browsers. Unlike applets, though, servlets have no graphical end-user interface.
Servlets can be embedded in many different servers due to the servlet API, which we utilize to write servlets, assumes nothing about the server's environment or protocol. Servlets have turn out to be maximum widely utilized within HTTP servers; lots of web servers sustain the Servlet API.
Architecture of the Servlet Package
The javax.servlet packages supply interfaces and classes for writing servlets. The construction of the package is described below.
The Servlet Interface
The Servlet boundary affirms, but does not implement, methods that manage the servlet and its communications with clients. Servlet writers afford some or all of these methods when mounting a servlet.
When a servlet accepts a call from a client, it receives two objects:
- A ServletRequest, which encapsulates the communication from the client to the server.
- A ServletResponse, which summarize the communication from the servlet back to the client.
ServletRequest and ServletResponse are interfaces definite by the javax.servlet package.
The ServletRequest Interface
The ServletRequest interface permits the servlet access to:
- Data like the names of the parameters passed in by the client, the protocol (scheme) being utilized by the client, and the names of the remote host that made the request and the server that received it.
- The key stream, ServletInputStream. Servlets utilize the input stream to get data from clients that employ application protocols like the HTTP POST and PUT methods.
Interfaces that extend ServletRequest line permit the servlet to retrieve further protocol-specific data. For example, the HttpServletRequest interface surrounds methods for accessing HTTP specific header data.
The ServletResponse Interface
The ServletResponse interface gives the servlet methods for replying to the client. It
- Permits the servlet to set the content length and MIME kind of the reply.
- Supply an output stream, ServletOutputStream, and a Writer from which the servlet can hurl the reply data.
Interfaces that expand the ServletResponse interface give the servlet lot of protocol-specific competence. For example, the HttpServletResponse interface encloses methods that permit the servlet to control HTTP-specific header data.
Every servlet has the same life cycle:
- A server loads and initializes the servlet.
- The servlet handles zero or lot of client requests.
- The server removes the servlet
Initializing a Servlet
When a server loads a servlet, the server runs the servlet's init function. Initialization completes earlier than client requests are handled and before the servlet is shattered. Even though maximum servlets are scurry in multi-threaded servers, servlets boast no concurrency issues during servlet initialization. The server calls the init function once, when the server loads the servlet, and will not call the init method again unless the server is reloading the servlet. The server can not refill a servlet until after the server has damaged the servlet by calling the destroy method.
Utilizing Session Tracking from a Servlet
The following example utilizes the doGet method from a servlet that prints the number of times users access a particular servlet. public void doGet (HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException