28.06.2013 Views

Papers in PDF format

Papers in PDF format

Papers in PDF format

SHOW MORE
SHOW LESS

Create successful ePaper yourself

Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.

Recently, Java has changed the way many Web authors design sites and applications. In our Java applications,<br />

we use tickets and the swap to ma<strong>in</strong>ta<strong>in</strong> high levels of security. Tickets are an excellent security mechanism<br />

for Java applets that do not reta<strong>in</strong> a cont<strong>in</strong>uous socket connection with the database server. Also, the database<br />

server can use the swap to enforce proper behavior of the Java applets. A good programmer could decompile<br />

the Java byte code and rewrite an applet to modify <strong>in</strong>ternal state and allow illegal database access. By keep<strong>in</strong>g<br />

the state <strong>in</strong> the swap, CGI scripts can ensure that the Java applets access only appropriate data items.<br />

6. Conclusion<br />

In this paper we have presented a system of develop<strong>in</strong>g applications with Web front-ends that can be accessed<br />

only by a given set of users. Us<strong>in</strong>g simple techniques like the secure loop, the swap, and the lifetime of an<br />

<strong>in</strong>put form, the capabilities of commercial Web application builders can be duplicated and surpassed. These<br />

techniques have been found to be successful <strong>in</strong> the development of a number of secure databases for the<br />

National Institute for Health. It is our hope that by reveal<strong>in</strong>g these techniques, more users will be able to place<br />

their own applications on the Web and help stimulate the growth of the Internet to its full potential.<br />

7. References<br />

[Allaire 1996] Cold Fusion, Allaire. http://www.allaire.com/cfusion/<br />

[Berners-Lee et al. 1994] T. Berners-Lee, R. Cailliau, A. Luotonen, H. Frystik Nielsen, and A. Secret (1994), The World-<br />

Wide Web. Comm. of the ACM, Vol. 37, No. 8, pp. 76-82, Aug. 1994.<br />

[Bluestone 1995] World Wide Web Application Development,<br />

http://www.bluestone.com/papers/whitepapers/www_app_devel.html<br />

[ExperTelligence 1995] ExperTelligence, Inc. WebBase - the Database Server of the Web, http://www.webbase.com<br />

[GATE Technology 1995] GATE Technology, Member's Only - Security for the Web. http://www.iquest.net/cgib<strong>in</strong>/gate2?webmaster|gate/members.html<br />

[Gleeson & Westaway 1995] Mart<strong>in</strong> Gleeson and T<strong>in</strong>a Westaway (1995) Beyond Hypertext: Us<strong>in</strong>g the WWW for<br />

Interactive Applications. AusWeb95. Ball<strong>in</strong>a, New South Wales, Australia.<br />

http://www.scu.edu.au/ausweb95/papers/hypertext/gleeson/<br />

[Gwertzman 1996] Gwertzman, James and Seltzer, Margo. World-Wide Web Cache Consistency.<br />

http://www.eecs.harvard.edu/~v<strong>in</strong>o/web/usenix.196/<br />

[Netscape 1996a] Netscape, Persistent Client State Http Cookies. http://home.netscape.com/newsref/std/cookie_spec.html<br />

[Netscape 1996b] Netscape, "On Internet Security" http://home.netscape.com/<strong>in</strong>fo/security-doc.html<br />

[NCSA 1996] The Common Gateway Interface, http://hoohoo.ncsa.uiuc.edu/docs/cgi/overview.html<br />

[Rescoria 1996] Rescoria, E. The Secure HyperText Transfer Protocol (Internet Draft) http://<strong>in</strong>fo.<strong>in</strong>ternet.isi.edu/<strong>in</strong>drafts/files/draft-ietf-wts-shttp-02.txt<br />

[Schoenfeld<strong>in</strong>ger 1995] Werner J. Schoenfeld<strong>in</strong>ger, WWW Meets L<strong>in</strong>da. Fourth International World Wide Web<br />

Conference. Boston, Massachusetts, USA. December 11-14, 1995.<br />

http://www.w3.org/pub/Conferences/WWW4/<strong>Papers</strong>/174/Overview.html]<br />

[Sybase 1996] Sybase, Web.sql Programmer’s Guide. Emeryville, CA: Sybase, Inc.<br />

http://www.sybase.com/products/<strong>in</strong>ternet/websql/docs/pguide/pguide1.htm<br />

[TCG 1995] Turner Consult<strong>in</strong>g Group, The Edison Database. http://era.<strong>in</strong>fo.nih.gov/

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!