This collection of integrated, Eclipse-based tools enables developers to

• determine permission requirements for Eclipse plug-ins, OSGi bundles, and Java™ applications
• determine what portions of Eclipse plug-ins, OSGi bundles, and Java software should be made privileged
• improve cycle time in performing security analysis of Eclipse plug-ins, OSGi bundles, and Java applications
• enable Java, OSGi, and Eclipse update site administrators to inspect JAR files
• include an Eclipse-based, graphical user interface for JAR signing
• manage digital certificates with a KeyStore editor, which supports viewing and editing of keystore entries (such as changing certificate aliases, removing certificates, copying certificates between certificate stores, and importing certificates from the file system).

SWORD4J provides support for analyzing, signing, and inspecting

• JAR files
• Java projects
• Eclipse plug-ins
• plug-in projects
• plug-in folders
• OSGi bundles

How does it work?

This set of Eclipse plug-ins performs static analysis of Java programs. The Authorization Analysis functionality determines which authorizations are needed in order to run Java code when a SecurityManager is enabled. The Privilege Code Analysis functionality identifies which portions of code could be made privileged. The JAR inspection functionality provides for the inspection of JAR files, revealing methods, certificates, and OSGi plug-in permissions. The keystore editor allows management of certificate and key entries through the Eclipse user interface. The JarSigner plug-in provides a dialog box interface to the Java jarsigner utility.

Who should use this tool:

• Java developers who want to identify the Java 2 security permissions required by their code; detect the portions of their code that should be made privileged; sign their code prior to deployment; or inspect a Java Archive (JAR) received from a third party
• administrators who wish to determine the security requirements for third-party applications.

A note about static analysis: Static analysis of a Java application means that the software being analyzed is never executed; instead, its associated bytecodes are inspected programatically, and the execution of the application is merely modeled. Source code is not a prerequisite for determining privilege requirements or inspecting JAR files.

Larry Koved is a research staff member and the manager of the Secure Applications and Middleware department at the IBM T. J. Watson Research Center in Hawthorne, N.Y. Mr. Koved was actively involved in the design of JAAS and EJB 1.1 security architecture. He has published over twenty-five articles and technical reports, written a book on Enterprise Java Security, and made presentations at conferences worldwide.

Marco Pistoia, Ph.D., is a research staff member in the Security, Networking, and Privacy department at the IBM T. J. Watson Research Center in Yorktown Heights, N.Y. He has written ten books and several papers and journal articles on all areas of Java and e-business security. Dr. Pistoia's books include Enterprise Java Security, published by Addison-Wesley in 2004, and Java 2 Network Security, published by Prentice Hall PTR in 1999. He has published and presented at several conferences worldwide, such as Sun Microsystems' JavaOne, ACM OOPSLA, ACM ECOOP, IEEE InfoCom, the O'Reilly Conference on Java, IBM Solutions, IBM SecureWorld, and Colorado Software Summit. Dr. Pistoia has been invited to teach graduate courses on Java security, and has presented at the New York State Center for Advanced Technology in Telecommunications (CATT), Brooklyn, N.Y. He received his M.S. in mathematics summa cum laude from the University of Rome, Italy, in 1995, and his Ph.D. in mathematics at Polytechnic University, Brooklyn, N.Y., in 2005 with a dissertation entitled A Unified Mathematical Model for Stack- and Role-Based Authorization Systems. His technical interests lie in mobile-code security, component software, and static analysis of object-oriented languages.

Ted Habeck is an advisory software engineer in the Enterprise Mobility Frameworks department at the IBM T. J. Watson Research Center in Hawthorne, N.Y. He recently presented an earlier version of this tool at EclipseCON 2005 in Burlingame, California, and he is an Eclipse comitter.