TEASER

http://unb.g2s.com/0130001sd/

3

Java Media Frameworkby Buddhima Wijeweera

Sometimes is necessary of using media thru Java applications, this varies from simply integrating an audio player to streaming video. Still it’s not common to add an audio or a video player with Java, simply with the help of an IDE. Therefore, you’ll need to get the help of a 3ed party library to complete that purpose. One solution for this problem is to use Java Media Framework.

An Object Oriented Model for Robust Multi-threaded Programmingby William la Forge

This article is about JActor2 a multi-threaded OO programming model, inspired by Alan Kay’s early thoughts on Objects. JActor2 is based on asynchronous 2-way messaging with assured responses. The net result being code that is both simpler and more robust, and hence easier to maintain.

Introduction to Google’s Guava Libraryby Hubert Klein Ikkink

In this article author wanted to show how we can achieve functional-like programming with Google Guava. The author introduces functions and predicates that can be used to map and filter collections in Java.

Developing, Deploying and Consuming a Web Services Using Netbeans IDEby Rajeev Hathi

This article will walk you through the steps of creating, deploying, testing and consuming a simple Hello World JAX-WS Web service as part of a code-first approach using the popular Java based Netbeans IDE.

Introduction to Spring 4 By Using Spring Bootby Timothy Spann

In this article Timothy Spann will lead you through a fresh Spring version and a fresh Spring Tool to assist in rapidly developing Spring 4 REST Applications. You will see how easy it is to develop a RESTful Spring 4 application that connects to a MongoDB database using the excellent new tool, Spring Boot. It will be a quick overview, but you will find a lot of referenced information to continue with.

How to Secure Apache Tomcatby Ioannis Kostaras

Web Security is a multi-layered topic that must cover the operating system, the network, the web server, the supporting DBMS, and the web application itself. This article provides useful steps to secure the third aforementioned layer and more specifically the Apache Tomcat installation on Ubuntu (and Linux in general) operating system. Which files to protect, what kind of users to create and how to enable SSL are some of the topics covered.

07

15

30

43

50

60

Developing Java Applications

Copyright © 2014 Hakin9 Media Sp. z o.o. SK

Table of Contents

Developing Java Applications

Preserving Domain Objects Across Layersby Paul Wells

In this article, Paul Wells and his team present an example of how to configure Jackson with Spring OAP and Spring Data JPA in order to eliminate the need to translate domain classes to these bridging classes – leaving the encapsulation intact and leaving us free to concentrate on building an optimal domain object model.

Java and Smart Cardsby Soma Ghosh

In today’s world, it is a dire necessity to make any user oriented application to be available on a smart card or a mobile device. Hence, a need arises for an open, safe, inter-operable environment to develop and deploy these applications. Java card API has the answer.

Part I: Cloud Computing – An Overviewby Sujatha Perepa, Bhargav Perepa

The continuous evolution of cloud computing and its successful result oriented implementations led to an enthusiastic participation from vendors, open source consortiums, standards bodies and businesses. In part I of this paper, authors will focus on Cloud Computing overview and its concepts. In Part II (next issue), authors plan to explore the realm of cloud computing from the IBM perspective and how IBM is participating and contributing to the Cloud’s open architecture initiative.

Collaborative Development for Faster Solutionsby Leticia Adriana Simental Rodríguez and Victor Adrian Sosa Herrera

In this article, Leticia and Victor want to show how Collaboration team with IBM Rational Developer Application and IBM Rational Team Concert can optimize the time that takes a development team requires to reproduce and fix an application problem.

74

86

91

100

advertisement

Developing Java Applications

5

Dear Readers!

I haven’t published anything for a while. Despite this, I didn’t forgot how pleasant is to carefully prepare each article or letter for you, and to cooperate with wonderful authors whose experience is vast and dates sometimes back to the beginning of computers and programming era. And all of this with the awareness, that your eyes will watch a high quality magazine.

This time we have a lot of great articles that for sure will attract your attention for sure and cause that you come back many times to read it again. So I would first encourage you dear reader drive your attention to the article Rajeev Hathi’s article: “Developing, deploying and consuming a Web Service using Netbeans IDE” is pretty easy to follow for anyone, even though it is an advanced topic. The writing ability of this author makes that the subject seem very simple. Next, if you are a developer, I would like to attract your interest with the article “Introduction to Google’s Guava library” article written by Hubert Klein Ikkink. I also can suggest a very good article written by Sujatha and Bhargav Perepa about introduction to Cloud Computing. Their article will be the first of a series of three articles which promise additional in-depth discussion on this timely subject. I encourage you to collect all three parts of the article whose next two parts will be published in upcoming releases. Please stay tuned! If you also value a good read then I can suggest a really good article written by Buddhima Wijeweera who will tell you more how to use Java Media Framework.

Of course I would like to write about every article we have in this release but it would be better if you dear reader examine them by yourself and even if it is possible wire us a comment. I encourage you to share with us your feelings and suggestions about our articles by sending an mail to karol.ruczajewski@software.com.pl.

Java Magazine Team

Editor in Chief: Karol Ruczajewskikarol.ruczajewski@software.com.pl

Editorial Advisory Board: Laszlo Acs, Armando Estanol, Osvaldo Tulini, Jim Powell, Mbella Ekoume, Jose Antonio Gordillo, Jonathan Segura Castro, Jeremy Sechler.

Special thanks to our Beta testers and Proofreaders who helped us with this issue. Our magazine would not exist without your assistance and expertise.

Publisher: Paweł Marciniak

Managing Director: Ewa Dudzic

Production Director: Andrzej Kucaandrzej.kuca@software.com.plArt. Director: Ireneusz Pogroszewskiireneusz.pogroszewski@software.com.plDTP: Ireneusz Pogroszewski

Marketing Director: Ewa Dudzic

Publisher: Software Media SK02-676 Warsaw, PolandPostepu 17D

Whilst every effort has been made to ensure the highest quality of the magazine, the editors make no warranty, expressed or implied, concerning the results of the content’s usage. All trademarks presented in the magazine were used for informative purposes only.

All rights to trademarks presented in the magazine are reserved by the companies which own them.

DISCLAIMER!The techniques described in our magazine may be used in private, local networks only. The editors hold no responsibility for the misuse of the techniques presented or any data loss.

www.uat.edu > 877.UAT.GEEK

[ IT’S IN YOUR DNA ]

[ GEEKED AT BIRTH ]

You can talk the talk.Can you walk the walk?

LEARN:Advancing Computer ScienceArti� cial Life ProgrammingDigital Media Digital Video Enterprise Software DevelopmentGame Art and Animation Game DesignGame Programming Human-Computer Interaction Network Engineering Network SecurityOpen Source Technologies Robotics and Embedded Systems Serious Game and SimulationStrategic Technology Development Technology Forensics Technology Product DesignTechnology StudiesVirtual Modeling and DesignWeb and Social Media Technologies

Please see www.uat.edu/fastfacts for the latest information about degree program performance, placement and costs.

Developing Java Applications

7

Preserving Domain Objects Across Layersby Paul Wells

In this article we present an example of how to configure Jackson with Spring OAP and Spring Data JPA in order to eliminate the need to translate domain classes to these bridging classes – leaving the encapsulation intact and leaving us free to concentrate on building an optimal domain object model.

What you will learn...• You will learn how to create a Hello World Spring MVC web application configured to accept and return Json data

across a REST API while storing the data in a MySQL database.

What you should know...• You will need some familiarity with Java, XML, Json, SQL and Maven.

In a Spring MVC webserver there are two areas which often lead the programmer to abandon the solid OO principal of encapsulation. One is the need to martial objects to and from the client as Json and the other is to load and save objects in a relational database. In the former case, a Data Transfer Object (DTO) is used as a bridge between the Java domain and Json in the controller layer. In the latter case, a Data Access Object (DAO) is used as a bridge between the Java domain and the relational database in the repository layer. Hence, the encapsulation is blown at two points: when domain objects are translated field-by-field to DTOs – because DTOs are what the marshalling tools appear to require – and similarly when domain objects are translated field-by-field to DAOs – because DAOs are what the ORM tools appear to require.

Domain Objects and LayersLayers of abstraction give structure and clarity to a software architecture. You can tell at a glance what sort of thing should be happening in, say, the data access layer or the service layer without needing to pick through the code line by line. Without using layering you, the programmer, give yourself a much tougher job tracking down defects, implementing new stories and bringing new team members up to speed.

“...putting behaviour into the domain objects should not contradict the solid approach of using layering to separate domain logic from such things as persistence and presentation responsibilities.” Martin Fowler

In this article we will build a minimalist Spring MVC application with a REST API. To keep things brief we will not be building a client application nor writing any unit tests or integration tests and everything can be installed and run locally. Our server will have a controller layer, a service layer and a repository layer. There will be a single business object and we will implement just one method of the API. We also won’t be doing anything fancy with transactions.

The point of this bare-bones example is to show how, with the right libraries and configuration, behaviour-modelling domain objects can be preserved across architectural layers without the need for DTOs and DAOs. Once you have this example working you’ll find your project can move quickly as you add more methods to your API and add more domain classes.

Tools we will need• A database: MySQL

• An IDE: Eclipse

• A build tool: Maven

• A REST client: Chrome

Developing Java Applications

8

Setting up the tools is not within the scope of this article as these topics are covered extensively by other sources. For simplicity it is best to install each on your local machine.

Setup the projectIn Eclipse create a new Java project and setup the package and folder structure as shown in Figure 1.

Figure 1. Project Layout in Eclipse

The pom, web.xml and dispatcher-config.xml are listed below in full.

Listing 1. DiyStore/pom.xml

<?xml version=”1.0” encoding=”UTF-8”?><project xmlns=”http://maven.apache.org/POM/4.0.0” xmlns:xsi=”http://www.w3.org/2001/XMLSchema-

instance” xsi:schemaLocation=”http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd”>

<modelVersion>4.0.0</modelVersion> <groupId>com</groupId> <artifactId>DiyStore</artifactId> <packaging>war</packaging> <version>0.0.1-SNAPSHOT</version> <name>DiyStore Maven Webapp</name> <properties> <mysql.connector>5.1.25</mysql.connector> <hibernate.version>4.2.3.Final</hibernate.version> <spring.version>3.2.3.RELEASE</spring.version> <spring.data.version>1.3.2.RELEASE</spring.data.version> <jackson.version>1.9.12</jackson.version> </properties> <dependencies> <!-- DataBase libs --> <dependency> <groupId>mysql</groupId> <artifactId>mysql-connector-java</artifactId> <version>${mysql.connector}</version> </dependency> <dependency> <groupId>commons-dbcp</groupId> <artifactId>commons-dbcp</artifactId>

Developing Java Applications

9

<version>1.4</version> </dependency> <!-- Hibernate --> <dependency> <groupId>org.hibernate</groupId> <artifactId>hibernate-core</artifactId> <version>${hibernate.version}</version> </dependency> <dependency> <groupId>org.hibernate</groupId> <artifactId>hibernate-entitymanager</artifactId> <version>${hibernate.version}</version> </dependency> <!-- Spring --> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-webmvc</artifactId> <version>${spring.version}</version> </dependency> <dependency> <groupId>org.springframework.data</groupId> <artifactId>spring-data-jpa</artifactId> <version>${spring.data.version}</version> <exclusions> <exclusion> <artifactId>spring-aop</artifactId> <groupId>org.springframework</groupId> </exclusion> </exclusions> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-orm</artifactId> <version>${spring.version}</version> </dependency> <dependency> <groupId>org.springframework</groupId> <artifactId>spring-tx</artifactId> <version>${spring.version}</version> </dependency> <!-- CGLIB is required to process @Configuration classes --> <dependency> <groupId>cglib</groupId> <artifactId>cglib</artifactId> <version>3.0</version> </dependency> <!-- Other --> <dependency> <groupId>javax.servlet</groupId> <artifactId>javax.servlet-api</artifactId> <version>3.0.1</version> <scope>provided</scope> </dependency> <!-- CNVR resources --> <dependency> <groupId>org.codehaus.jackson</groupId> <artifactId>jackson-mapper-asl</artifactId> <version>${jackson.version}</version> </dependency>

Developing Java Applications

10

<!-- Logging --> <dependency> <groupId>org.slf4j</groupId> <artifactId>slf4j-log4j12</artifactId> <version>1.7.5</version> </dependency> <dependency> <groupId>log4j</groupId> <artifactId>log4j</artifactId> <version>1.2.17</version> </dependency> </dependencies> <build> <finalName>DiyStore</finalName> <plugins> <plugin> <artifactId>maven-compiler-plugin</artifactId> <version>2.3.2</version> <configuration> <source>1.6</source> <target>1.6</target> </configuration> </plugin> </plugins> </build></project>

Listing 2. /src/main/webapp/WEB-INF/web.xml

<?xml version=”1.0” encoding=”UTF-8”?><web-app xmlns=”http://java.sun.com/xml/ns/javaee” xmlns:web=”http://java.sun.com/xml/

ns/javaee/web-app_2_5.xsd” xmlns:xsi=”http://www.w3.org/2001/XMLSchema-instance” xsi:schemaLocation=”http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd” version=”3.0”>

<servlet> <servlet-name>dispatcher</servlet-name> <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class> <init-param> <param-name>contextConfigLocation</param-name> <param-value>/WEB-INF/spring/dispatcher-config.xml</param-value> </init-param> <load-on-startup>1</load-on-startup> </servlet> <servlet-mapping> <servlet-name>dispatcher</servlet-name> <url-pattern>/</url-pattern> </servlet-mapping></web-app>

Listing 3. /src/main/webapp/WEB-INF/spring/dispatcher-config.xml

<?xml version=”1.0” encoding=”UTF-8”?><beans xmlns=”http://www.springframework.org/schema/beans” xmlns:aop=”http://www.

springframework.org/schema/aop” xmlns:context=”http://www.springframework.org/schema/context” xmlns:tx=”http://www.springframework.org/schema/tx” xmlns:xsi=”http://www.w3.org/2001/XMLSchema-instance” xsi:schemaLocation=” http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd http://www.

Developing Java Applications

11

springframework.org/schema/tx http://www.springframework.org/schema/tx/spring-tx-2.5.xsdhttp://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop-2.5.xsdhttp://www.springframework.org/schema/context http://www.springframework.org/schema/context/

spring-context-2.5.xsd”>

<!-- Say where to find our components --> <context:component-scan base-package=”com.agilej.example.diy” /></beans>

Run mvn eclipse:eclipse and refresh the project in Eclipse. This will pull in the dependency libraries and add them to the Eclipse build path for a clean build in the IDE. The pom declares the full set of dependency libraries required to make our application DTO-free and DAO-free. Web.xml is a standard for all Spring MVC applications, essentially telling the web container to chill-out and let Spring handle everything. Dispatcher-config.xml contains a single vital piece of information which narrows down the search for our component which we are about to add next.

Create the databaseCreate a database called “diy” and in that database create a single table as follows:

create table items (id int(6) NOT NULL AUTO_INCREMENT, name varchar(20) NOT NULL, make varchar(20) NOT NULL, PRIMARY KEY (id));

In this example we are letting the database look after the generation of unique object ID numbers.

Create the model entity classNext we need a corresponding Java class. This class will have multiple roles, but it must, nonetheless match its database table. Create the com.agilej.example.diy.model.Item class. The field names and types of the class must match the column types in the table.

Note that in this example we show only getter and setter methods. In its full role as a domain class it would have a richer set of methods which implement the business behaviour and maintain the internal integrity of the object.

Listing 4. com.agilej.example.diy.model.Item

package com.agilej.example.diy.model;

import javax.persistence.Entity;import javax.persistence.GeneratedValue;import javax.persistence.Id;import javax.persistence.Table;

@Entity@Table(name = “items”)public class Item{ @Id @GeneratedValue private Integer id;

private String name; private String make;

Developing Java Applications

12

public Integer getId() { return id; }

public void setId(Integer id) { this.id = id; }

public String getName() { return name; }

public void setName(String name) { this.name = name; }

public String getMake() { return make; }

public void setMake(String make) { this.make = make; }}

Create the Spring configurationWe use a Java class to configure Spring which explains the presence of the cglib dependency in the pom. Create com.agilej.example.diy.init.WebAppConfig as listed below. Note that this configuration class does the following things for us:

• Sets the hibernate dialect

• Declares the transaction manager

• Locates the database

• Tells the JPA where to look for entity classes

As we are working locally, we are accessing the database by its default credentials. Obviously we would change these to something stronger before deployment of the finished project.

Listing 5. com.agilej.example.diy.init.WebAppConfig

package com.agilej.example.diy.init;

import java.util.Locale;import java.util.Properties;

import javax.sql.DataSource;

import org.hibernate.ejb.HibernatePersistence;

Developing Java Applications

13

import org.springframework.context.annotation.Bean;import org.springframework.context.annotation.ComponentScan;import org.springframework.context.annotation.Configuration;import org.springframework.data.jpa.repository.config.EnableJpaRepositories;import org.springframework.jdbc.datasource.DriverManagerDataSource;import org.springframework.orm.jpa.JpaTransactionManager;import org.springframework.orm.jpa.LocalContainerEntityManagerFactoryBean;import org.springframework.transaction.annotation.EnableTransactionManagement;import org.springframework.web.accept.ContentNegotiationManager;import org.springframework.web.servlet.View;import org.springframework.web.servlet.ViewResolver;import org.springframework.web.servlet.config.annotation.EnableWebMvc;import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;import org.springframework.web.servlet.view.json.MappingJacksonJsonView;

@Configuration@EnableWebMvc@EnableTransactionManagement@ComponentScan(“com.agilej.example.diy”)@EnableJpaRepositories(“com.agilej.example.diy.repository”)public class WebAppConfig extends WebMvcConfigurerAdapter{ /** Say how to access the database */ @Bean public DataSource dataSource() { DriverManagerDataSource dataSource = new DriverManagerDataSource(); dataSource .setDriverClassName(“com.mysql.jdbc.Driver”); dataSource .setUrl(“jdbc:mysql://localhost:3306/diy?useUnicode=true&characterEncoding=U

TF-8”); dataSource.setUsername(“root”); dataSource.setPassword(“”); return dataSource; }

/** Say where to find the entity classes and how to map them to the database */ @Bean public LocalContainerEntityManagerFactoryBean entityManagerFactory() { LocalContainerEntityManagerFactoryBean entityManagerFactoryBean = new

LocalContainerEntityManagerFactoryBean(); entityManagerFactoryBean .setDataSource(dataSource()); entityManagerFactoryBean .setPersistenceProviderClass(HibernatePersistence.class); entityManagerFactoryBean .setPackagesToScan(“com.agilej.example.diy.model”); entityManagerFactoryBean .setJpaProperties(getHibernateProperties()); return entityManagerFactoryBean; }

private Properties getHibernateProperties() { Properties hibernateProperties = new Properties(); hibernateProperties .put(“hibernate.dialect”,

Developing Java Applications

14

“org.hibernate.dialect.MySQL5InnoDBDialect”); hibernateProperties.put(“hibernate.show_sql”, “true”); return hibernateProperties; }

/** Provide a transaction manager */ @Bean public JpaTransactionManager transactionManager() { JpaTransactionManager transactionManager = new JpaTransactionManager(); transactionManager .setEntityManagerFactory(entityManagerFactory() .getObject()); return transactionManager; }

/** Say that entities should be transported as Json */ @Bean public ViewResolver contentNegotiatingViewResolver( ContentNegotiationManager manager) { return new ViewResolver() { public View resolveViewName(String viewName, Locale locale) throws Exception { MappingJacksonJsonView view = new MappingJacksonJsonView(); view.setPrettyPrint(true); return view; } }; }}

Create the JPA repositoryOne of the roles of the entity we created in step 3 is a Data Access Object (DAO) – an in-Java representation of a row in a database table. Now we need something which lets us perform CRUD interactions with the database using these entity objects. The something we need is a JPA Repository interface.

@EnableJpaRepositories(“com.agilej.example.musicalinstruments.repository”) in the WebAppConfig class declares where JPA should look for repository interfaces.

Listing 6. com.agilej.example.diy.repository.ItemRepository

package com.agilej.example.diy.repository;

import org.springframework.data.jpa.repository.JpaRepository;

import com.agilej.example.diy.model.Item;

public interface ItemRepository extends JpaRepository<Item, Integer>{}

Note that this interface supplies template parameters to its superinterface stating which type of entity this repository deals with and the type of its primary key. Note also that there are no methods declared on

Developing Java Applications

15

ItemRepository. CRUD operations we get for free. Detailed find operations can be defined by adding additional methods which follow a naming convention – custom find operations are outside the scope of this article.

Create the serviceThe service layer is where we worry about the real business logic. A service makes use of entities and repositories to manipulate the data and orchestrate business-level actions. Create the service interface against business requirements (will be injected into the controller and only has dependencies to the entity package). The service layer in our example doesn’t do anything more than forward the call to create on to the repository layer. Note that this is the service for the DiyStore and not the ItemService. A single service would most likely contain methods which make use of several repositories and possibly make calls to other services.

Listing 7. com.agilej.example.disy.service.DiyStoreService

package com.agilej.example.diy.service;

import com.agilej.example.diy.model.Item;

public interface DiyStoreService{ public Item create(Item newItem);}

Implement the interface

• Add @Service

• Add @Transactional

• Autowire the repository

• Implement the methods

Listing 8. com.agilej.example.disy.service.DiyStoreServiceImpl

package com.agilej.example.diy.service;

import org.springframework.beans.factory.annotation.Autowired;import org.springframework.stereotype.Service;import org.springframework.transaction.annotation.Transactional;

import com.agilej.example.diy.model.Item;import com.agilej.example.diy.repository.ItemRepository;

@Service@Transactional(rollbackFor = Exception.class)public class DiyStoreServiceImpl implements DiyStoreService{ @Autowired private ItemRepository itemRepository;

@Override public Item create(Item newItem) { return itemRepository.save(newItem); }}

Developing Java Applications

16

Create the controllerThanks to Spring MVC a REST API is a simple thing to implement. The controller worries about handling API calls and farming the requests out to services. The marshalling is handled automatically by Jackson. So now, at last, we see the entity classes serving as both DAOs and DTOs.

Listing 9. com.agilej.example.diy.controller.DiyStoreController

package com.agilej.example.diy.controller;

import org.springframework.beans.factory.annotation.Autowired;import org.springframework.http.MediaType;import org.springframework.stereotype.Controller;import org.springframework.web.bind.annotation.RequestBody;import org.springframework.web.bind.annotation.RequestMapping;import org.springframework.web.bind.annotation.RequestMethod;import org.springframework.web.bind.annotation.ResponseBody;

import com.agilej.example.diy.model.Item;import com.agilej.example.diy.service.DiyStoreService;

@Controller@RequestMapping(value = “/store”)public class DiyStoreController{ @Autowired private DiyStoreService diyStoreService;

@RequestMapping(value = “/create”, method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_VALUE, consumes = MediaType.APPLICATION_JSON_VALUE) @ResponseBody public Item createSmartphone(@RequestBody Item item) { return diyStoreService.create(item); }}

Try it out• Build it on the command line with maven

• Deploy it with the Tomcat manager (found at http://localhost:8080/manager/html)

• Test it with the chrome REST client and check that the response code is 200

• Check that a record is added to the database

Developing Java Applications

17

Figure 2. Testing our web app with the Advanced REST client

Listing 10. Checking the database

mysql> select * from Items;+----+--------+---------+| id | name | make |+----+--------+---------+| 1 | hammer | Stanley |+----+--------+---------+1 row in set (0.00 sec)

ConclusionsWith this approach we can use the same class for DTO and DAO roles. This conforms to Domain Driven Design’s use of the same name for the same entity wherever it appears. We have avoided three antipatterns. Firstly, there is no scope for any mismatch between DAO field names and database table column names. Secondly, we avoid tedious calling of getters and setters property by property just to convert between DTOs, domain objects and DAOs. Thirdly, we prevent the anaemic DTO and DAO types from dominating the architecture resulting in the domain object behaviour tending to get pushed onto the services.

Developing Java Applications

Jackson and AOP make the marshalling invisible. The antipattern we avoid is server side code littered with interpretation of raw Json, which once it takes hold can leak from controller to service layers.

Spring JPA gives us ORM CRUD operations for free, with the DAO layer being wholly declarative. The antipattern is a bloated DAO layer of boilerplate code in a fat DAO layer whose sole purpose is to communicate with the database assembling Hibernate Query Language (HQL) and/or SQL. Furthermore, this trait of dropping query statements into the code can also spread to the service layer.

Of course, it would be too much to expect that in all cases there is a one-to-one mapping between domain classes, DAOs and DTOs. But a lot of the time there is, and for all those cases the domain classes alone now have it covered.

On the Web • https://code.google.com/p/gbif-providertoolkit/wiki/TomcatInstallationMacOSX• http://www.mkyong.com/spring-mvc/spring-mvc-hello-world-example/• http://martinfowler.com/bliki/AnemicDomainModel.html• http://docs.spring.io/spring-data/jpa/docs/1.4.3.RELEASE/reference/html/index.html • http://www.mkyong.com/spring-mvc/spring-3-rest-hello-world-example/ • http://www.luckyryan.com/2013/02/07/migrate-spring-mvc-servlet-xml-to-java-config/ • https://spring.io/blog/2013/05/11/content-negotiation-using-spring-mvc • Domain Driven Design, Evans

About the AuthorPaul Wells: has 20 years of software engineering experience mainly engaged as a Java consultant across a wide mix of industries in and around London and Cambridge in the UK. In recent years he has devoted his attention to developing a UML reverse engineering product called AgileJ which helps programmers get up to speed with the architecture when joining a new project.

advertisement

Developing Java Applications

19

Java and Smart Cardsby Soma Ghosh

In today’s world, it is a dire necessity to make any user oriented application to be available on a smart card or a mobile device. Hence, a need arises for an open, safe, inter-operable environment to develop and deploy these applications. Java card API has the answer.

What should you know…• reader should have functional knowledge in Java.

What you will learn…• how to access a Smart card information from Java application as well as incorporate compact, interoperable and

platform independent utilities inside Smart card.

Smart card is a card with a memory and/or microprocessor chip that contains a self-contained information and logic. A microprocessor chip can edit information on the card while as a memory chip contains only a pre-defined operation and information. In all cases, the card operations are self-contained and do not access a remote database during transaction.

Smart cards fall into the following categories depending on their contents and usages:

Integrated Circuit (IC) Microprocessor CardsThese cards come with a microprocessor to manipulate data in its memory storage. Due to this capability as well as built-in security, IC Microprocessor cards are used for holding currency, securely accessing a network and preventing fraud in cellphones.

• Data Capacity: 8Kb

• Microprocessor: 8-bit

IC Memory CardsThese cards do not have a microprocessor, hence depends on a card reader application to perform its task. IC Memory cards are mainly used as pre-paid phone cards.

• Data Capacity: 1 Kb

• Microprocessor: None.

Optical Memory Cards

• Data Capacity: 4.9 Mb

• Microprocessor: None

How Java adapts to smart card?While Java Card can leverage most of the benefits of Java technology, e.g. portability, the runtime environment has to be modified for its execution in smart card environment:

Developing Java Applications

20

Applet Security

In Java standard edition, a basic applet is not allowed to access files and native libraries on the machine for security purposes. In Java card API, this has to be changed. Java card API allows creation of special applets that can access native files and resources on the card.

Resource constraint

The Java Virtual Machine and the core libraries have been compacted to work in the resource constraint environment of Smart cards.

User authentication

Java Card has classes that can manage Smart card features like PINs and passwords.

Firewall

Java Card provides isolation features that allow applications from several vendors to co-exist without compromising security.

What is Java card API?The Java Card API provides the necessary classes and libraries as well as the specifications for Java applets to access native services in a Smart card environment. The Java Card API has two editions – Classic and Connected.

The Classic Edition of the Java Card specification is applicable to all currently deployed Smart cards.

The Connected Edition of the Java Card specification is a step ahead in which Java Card has been extended to support a Web application model, with servlets running on the card, and TCP/IP as basic protocol.

The Virtual Machine and Runtime Environment in Java Connected Edition support multithreading, hierarchical class loaders and permissions in order to support a Web application model. The Connected Edition also runs on high-end secure microcontrollers, typically based on a 32-bit processor and supporting a high-speed communication interface like USB.

The basics of Java Card appletIn this section, we will discuss how a Java Card applet can be identified, its life cycle and how it communicates securely with a card reader.

Identifying Java Card AppletA user readable string identifies a normal Java application whereas a Java applet and package containing the applet are identified by a sequence of bytes, called Application Identifier (AID.) An AID is 5-16 bytes in length.

The first 5 bytes are called National registered application provider (RID) and assigned by ISO. The remaining bytes are called Proprietary application identifier extension (PIX), as indicated by the name, are proprietary.

A Java card applet will have the same RID as the containing package while their PIX will differ by the last bit.

Java Applet Execution Framework

A Java Card Applet must extend the javacard.framework.Applet class . This parent class contains methods, which are called when the Card Reader terminal sends commands to the Java Card Runtime environment (JCRE). Some of the methods are as below:

Developing Java Applications

21

• install – The method is used to create an instance of the Applet.

• register – This method is used to register the newly created instance of Applet with the JCRE.

• select – This method notifies that the current Applet has been selected.

• process – This method is called to process commands from the Card reader device to JCRE and send back responses.

• deselect – This method notifies the current Applet that another Applet has been selected.

Java Card Applet Life cycleThe life cycle of a Java card applet can be described as follows (Refer Figure 1):

• An instance of Applet is created.

• The newly created instance is registered with JCRE.

• JCRE get a SELECT Command with AID information.

• If there is a currently active Applet, it is deselected and performs some cleanup functions before becoming inactive.

• Applet identified by AID is selected.

• It processes all subsequent commands and sends response back.

• Another SELECT Command comes in with a different AID and current Applet is deselected and becomes inactive.

Figure 1. Life Cycle of a Java Card Applet

Developing Java Applications

22

Request/Response between CAD and JCREThe communication between the JCRE and the Card Acceptance Device (CAD) is essentially a request and response type. The request comprises of a series of commands called Command Application Protocol Data Unit (APDU) whereas the responses are called Response APDU, exchanged alternately between the JCRE and the CAD. A command APDU contains a Mandatory Header and an optional body.

The Mandatory part consists of:

• Indicator of structure and format of the command and response APDUs.

• Instruction.

• Instruction parameters.

The optional part consists of:

• Size of the data field

• Data field.

• Expected size of the response APDU.

A response APDU consists of an optional data field and a mandatory trailer. The mandatory trailer indicates a status of the command processing.

ConclusionIn this article, we have learnt how Java Card API helps create platform independent secured applications for a smart card. Also, we discussed the life cycle of a Java card applet and the interface between Java Card applet and a Card Reading device. In subsequent articles, we will develop a Java card applet that can act as a cafeteria card.

A great future lies ahead in Java Card API when the JCRE can be fully integrated with a web application model, enabling us to access smart card features from the click of a mouse.

About the AuthorSoma Ghosh has been working as a Senior Software engineer in various large companies for the past fifteen years, applying Java Standard and Enterprise editions in Telecommunications, Retail & Distribution, Workforce and Healthcare domains, thus enhancing and improving customer experience as well as business process.

IN SOME CASES

nipper studioHAS VIRTUALLY

REMOVED

MANUAL AUDITCISCO SYSTEMS INC.

theNEED FOR a

Titania’s award winning Nipper Studio configuration auditing tool is helping security consultants and end-user organizations worldwide improve their network security. Its reports are more detailed than those typically produced by scanners, enabling you to maintain a higher level of vulnerability analysis in the intervals between penetration tests.

Now used in over 45 countries, Nipper Studio provides a thorough, fast & cost effective way to securely audit over 100 different types of network device. The NSA, FBI, DoD & U.S. Treasury already use it, so why not try it for free at www.titania.com

www.titania.com

U P D A T ENOW WITHS T I GAUDITING