IBM WebSphere V5.0 Security - CGISecurity

►►►Users are mapped directly to specifc security roles.Groups are formed, users are defined as members of a group, and the groupsare defined to specific security roles.A combination of user/group mapping to security roles is used to handle anyexceptions.2.2.3 Public Key Infrastructure (PKI)This section provides a brief overview of the Public Key Infrastructure (PKI). PKIis a part of IT security and today‘s security needs bring it into focus.PKI is closely related to cryptography. Although it seems complicated, it is not.We do not need to use low-level mathematical algorithms, but we do need tounderstand the background involved.Secret key cryptographyThe secret key algorithms were invented earlier than were the public keyalgorithms. They use one key to encrypt and decrypt the data.Plain text Encryption Cipher text Decryption Plain textFigure 2-3 Symmetric key encryptionFigure 2-3 illustrates the concept of symmetric key cryptography. The algorithmsused provide a great advantage: they are faster than the public key cryptographyintroduced later. They have a considerable disadvantage as well: the same key isneeded for encryption and decryption, and both parties must have the samekeys. In today‘s cryptography, the secret keys do not belong to persons but tocommunication sessions. At the beginning of a session, one of the partiescreates a session key and delivers it to the other party; they can thencommunicate securely. At the end of the session, both parties delete the key and,if they want to communicate again, must create another key.The following section will discuss how to secure the delivery of the session key.Public key cryptographyThe first imperative of public key cryptography is the ability to deliver the sessionkeys securely. It has many more benefits than secret key cryptography, as we willsee in the following section.12 IBM WebSphere V5.0 Security Handbook