35 - Java Serialization - Protecting sensitive information using SHA1 - Code Demo 2

@backstreetbrogrammer

--------------------------------------------------------------------------------
Chapter 15 - Serialization - Protecting sensitive information using SHA1 - Code Demo 2
--------------------------------------------------------------------------------
When developing a class that provides controlled access to resources, care must be taken to protect sensitive information and functions.
During deserialization, the private state of the object is restored.
To avoid compromising a class, the sensitive state of an object must not be restored from the stream, or it must be re-verified by the class.

The easiest technique is to mark fields that contain sensitive data as private transient.
Transient fields are not persistent and will not be saved by any persistence mechanism.
Marking the field will prevent the state from appearing in the stream and from being restored during deserialization.
Since writing and reading (of private fields) cannot be superseded outside the class, the transient fields of the class are safe.

However, if we really want to serialize secured or confidential fields, we should use "encryption" and "decryption" of the field.

We will use Message Digest SHA-1 AES algorithm for "encryption" and "decryption" of the secured fields.

ERRATA: I have changed the hash function from "SHA-1" to "SHA-512" in the GitHub:
https://github.com/backstreetbrogrammer/05_Persistence/blob/main/src/main/java/com/backstreetbrogrammer/chapter15_securedFields/MarketDataSecured.java


- Java Serialization Playlist: https://youtube.com/playlist?list=PLQDzPczdXrTjGLkI8kd2d0bfNHx0v7dTy
- Java Serialization Github: https://github.com/backstreetbrogrammer/05_Persistence

- Dynamic Programming Playlist: https://youtube.com/playlist?list=PLQDzPczdXrTilRgmNUQ632OrD-wfRLUR_
- Dynamic Programming Github: https://github.com/backstreetbrogrammer/08_DynamicProgramming

#java #javadevelopers #javaprogramming #javaserialization