net.named_data.jndn.encrypt

Class AccessManagerV2

java.lang.Object

net.named_data.jndn.encrypt.AccessManagerV2

public class AccessManagerV2
extends Object

AccessManagerV2 controls the decryption policy by publishing granular per-namespace access policies in the form of key encryption (KEK, plaintext public) and key decryption (KDK, encrypted private key) key pairs. This works with EncryptorV2 and DecryptorV2 using security v2. For the meaning of "KDK", etc. see: https://github.com/named-data/name-based-access-control/blob/new/docs/spec.rst

Constructor Summary

Constructors

Constructor and Description
AccessManagerV2(PibIdentity identity, Name dataset, KeyChain keyChain, Face face) Create an AccessManagerV2 to serve the NAC public key for other data producers to fetch, and to serve encrypted versions of the private keys (as safe bags) for authorized consumers to fetch.

Method Summary

Modifier and Type	Method and Description
Data	addMember(CertificateV2 memberCertificate) Authorize a member identified by memberCertificate to decrypt data under the policy.
HashMap	getCache_() Get the the storage cache, which should only be used for testing.
void	shutdown()
int	size() Get the number of packets stored in in-memory storage.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

AccessManagerV2

public AccessManagerV2(PibIdentity identity,
                       Name dataset,
                       KeyChain keyChain,
                       Face face)
                throws Tpm.Error,
                       TpmBackEnd.Error,
                       PibImpl.Error,
                       Pib.Error,
                       KeyChain.Error,
                       EncodingException,
                       IOException,
                       SecurityException

Create an AccessManagerV2 to serve the NAC public key for other data producers to fetch, and to serve encrypted versions of the private keys (as safe bags) for authorized consumers to fetch. KEK and KDK naming: [identity]/NAC/[dataset]/KEK /[key-id] (== KEK, public key) [identity]/NAC/[dataset]/KDK/[key-id] /ENCRYPTED-BY/[user]/KEY/[key-id] (== KDK, encrypted private key) \_____________ ______________/ \/ registered with NFD

Parameters:

identity - The data owner's namespace identity. (This will be used to sign the KEK and KDK.)

dataset - The name of dataset that this manager is controlling.

keyChain - The KeyChain used to sign Data packets.

face - The Face for calling registerPrefix that will be used to publish the KEK and KDK Data packets.

Throws:

Tpm.Error

TpmBackEnd.Error

PibImpl.Error

Pib.Error

KeyChain.Error

EncodingException

IOException

SecurityException

Method Detail

shutdown

public final void shutdown()

addMember

public final Data addMember(CertificateV2 memberCertificate)
                     throws Pib.Error,
                            PibImpl.Error,
                            UnrecognizedKeyFormatException,
                            EncodingException,
                            TpmBackEnd.Error,
                            KeyChain.Error,
                            InvalidKeySpecException,
                            NoSuchAlgorithmException,
                            NoSuchPaddingException,
                            InvalidKeyException,
                            IllegalBlockSizeException,
                            BadPaddingException,
                            CertificateV2.Error

Authorize a member identified by memberCertificate to decrypt data under the policy.

Parameters:

memberCertificate - The certificate that identifies the member to authorize.

Returns:

The published KDK Data packet.

Throws:

Pib.Error

PibImpl.Error

UnrecognizedKeyFormatException

EncodingException

TpmBackEnd.Error

KeyChain.Error

InvalidKeySpecException

NoSuchAlgorithmException

NoSuchPaddingException

InvalidKeyException

IllegalBlockSizeException

BadPaddingException

CertificateV2.Error

size

public final int size()

Get the number of packets stored in in-memory storage.

Returns:

The number of packets.

getCache_

public final HashMap getCache_()

Get the the storage cache, which should only be used for testing.

Returns:

The storage cache.