Improvement And Implementation Of The Authentication Of Security Strategy In J2EE

The popularization and development of Internet technologies are promoting the process of constructing enterprise application. In order to increase the design and develop efficiency, reduce the cost of building the enterprise application system, the J2EE multilayer system structure pattern has become the main method of building enterprise application. Based on the open network, the multilayer system structure has more superiority than the traditional structure which we called C/S, but also faces some new problems simultaneously. Because of the open network, the multilayer system structure is facing security threat from various aspects. How to protect the information from the illegal gain, the embezzlement and the destruction, has become an important problem that researcher cared about together.This thesis deeply researches the J2EE security strategy on the application tier of enterprise system. The security strategy predigests the information security model and meets the security requirements expediently. But there are some disadvantages when the security requirements become more complex. The expositive security on the Web-Tier can not offer more information for authentication; there is no authentication for EJB-Tier to use, make the EJB-Tier depend on the Web-Tier; J2EE uses database or application server to manage the role information. Use database to manage the role information will increase the complex of enterprise application, and the way of application server will reduce the ability of migrate other J2EE platform.To solve these problems, the thesis designs an improved security strategy model. The model designs an extensible authentication to replace the way which the expositive security uses on Web-Tier and an authentication for controlling the accessing to the protect resource on EJB-Tier. The improved model uses directory server to manage the role information. It reduces the complex of application development, and increases the ability of migrate other J2EE platform. The thesis implements an e-government system base on the improved model successfully at last. It proves the model is feasible, reformative and universal, and has referenced value for building security structure of enterprise application.