使用应用程序证书保护 JMS 通信
我有一个使用 Eclipse Workbench 框架的客户端应用程序。我希望我的客户端应用程序使用 jar 文件中提供的证书连接/订阅 JMS 主题。也就是说，我没有使用最终用户的证书 - 它是一个应用程序证书。
现在明显的安全风险是任何人都可以打开我的 jar 文件并取出证书并使用它连接到 JMS 队列，而无需使用我的客户端应用程序。 （这很糟糕）。
你可能会说，在证书上使用密码并对密码进行加密。但是...客户端应用程序需要先解密密码，然后再将其提供给 JMS 连接。因此解密代码必须位于客户端 Jar 文件中，坏人可以反编译该文件并获取解密密码的代码。现在他有了证书和密码。
最后，这是我的问题...有没有办法将应用程序的证书绑定到 jar 文件或代码，以便只有我的客户端应用程序可以使用该证书连接到 JMS 队列？
感谢您阅读本文。
I have a client application using the Eclipse Workbench framework. I'd like my client app to connect/subscribe to a JMS topic using a certificate provided in the jar file. That is, I'm NOT using the end user's certificate - it's an app cert.
Now the obvious security risk is that anyone can open up my jar file and take out the cert and use it to connect to the JMS queue without using my client app. (That's bad).
You might say, use a password on the certificate and encrypt the password. BUT... The client app would need to decrypt the password before providing it to the JMS connection. And so the decryption code would have to be in the client Jar file, which a bad guy could decompile and get the code that decrypts the password too. So now he has the cert and the password.
Finally, here's my question... Is there a way to tie the application's certificate to the jar file or to the code so that only my client application can use that cert to connect to the JMS queue?
Thanks for reading this far.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
这是标准的 DRM 问题。您想要发送加密的内容，以便坏人无法执行未经授权的操作。但是您运送给客户的产品需要对其进行解密，以便这些客户可以按照您授权的方式使用它。
如果你找到防弹解决方案，以 10 亿美元的价格卖给好莱坞。哎呀，以 $1.1B 的价格卖掉它，并给我这个想法的分成。
好吧，不需要防弹吗？现在你要像上面描述的那样尝试隐藏它。你想要保护的东西有什么价值？如果它很低，那么您只需花费很少的精力来解决您的解决方案，也许它就能站得住脚。如果它的价值很高，就会有人破解它（以好莱坞为例）。
That's the standard DRM problem. You want to ship something encrypted so that Bad Guys can't do something unauthorized. But the product you ship to customers needs to decrypt it so those customers can use it in the way you authorize.
If you find bullet-proof solution, sell it for $1B to Hollywood. Heck, sell it for $1.1B and give me my cut for the idea.
OK, it doesn't need to be bullet-proof? Now you're down to trying to hide it like you describe above. What's the value of what you're trying to protect? If it's low, little effort will be expended to work around your solution and maybe it'll stand. If it's high value, someone will crack it (see Hollywood as an example).