org.hardtokenmgmt.core.token
Class SyncronizedToken

java.lang.Object
  org.hardtokenmgmt.core.token.SyncronizedToken

All Implemented Interfaces:

IToken

public class SyncronizedToken
extends java.lang.Object
implements IToken

Special wrapper class used to make the calls to syncronized and making sure only one thread at the time calls the PKCS11 module This class is returned by the TokenManager.

Version:

$Id$

Author:

Philip Vendil 2007 jun 11

Field Summary

Fields inherited from interface org.hardtokenmgmt.core.token.IToken

KEYALG_RSA, KEYTYPE_ALL, KEYTYPE_AUTH, KEYTYPE_ENC, KEYTYPE_SIGN, OBJECTTYPE_DATA, PINTYPE_BASIC, PINTYPE_SIGN

Method Summary

void	addObject(java.lang.String pintype, java.lang.String pin, IObject object) Adds a object (data, domainparameter) to the token
PINInfo	blockPIN(java.lang.String pintype) Method used to block a PIN, used for administrators to later change it
PINInfo	changePIN(java.lang.String pintype, java.lang.String oldpin, java.lang.String newpin) Method used to change the value of the
boolean	checkPIN(java.lang.String pintype, java.lang.String pin) Method used to check if a PIN is valid and true if it is
void	clearCertificateCache() Method instructing the token to clear it's certificate cache if it have any.
void	clearToken(java.lang.String[] pintypes, java.lang.String[] puks) Method that should clear a token, either erase the card completely or remove all objects on the card for non-ereasable tokens.
void	downloadCert(java.lang.String label, java.lang.String pintype, java.lang.String pin, java.lang.String basicpin, java.security.cert.X509Certificate cert) Downloads a certificate to the token.
void	downloadKeyStore(java.lang.String keytype, java.lang.String pintype, java.lang.String pin, java.lang.String certLabel, java.security.KeyStore keyStore, java.lang.String keyStorePasswd) Method that downloads a keystores key and certificate on the token.
java.lang.String	generatePUK(java.lang.String pintype) Method that should generate the PUK code placed on the card for the specified PIN.
void	genKey(java.lang.String pintype, java.lang.String pin, java.lang.String basicpin, java.lang.String keytype, java.lang.String algorithm, int keysize, java.lang.String label) Method that should generate a key on the card with the specified algorithm.
org.bouncycastle.jce.PKCS10CertificationRequest	genPKCS10(java.lang.String keytype, java.lang.String pintype, java.lang.String pin, UserDataGenerator userDataGenerator) Method that generates a PKCS10 request using the specified key.
java.security.cert.X509Certificate	getCertificate(java.lang.String certficateLabel) Method that tries to find a certificate stored on the token wiht the specified label.
java.util.Collection	getCertificates(java.lang.String pintype) Method that retrieves all certificates stored on the token.
java.lang.String	getHardTokenSN() Method that should return the current hard token serial number of the card.
java.util.Collection	getKeyLabels(java.lang.String pintype) Method to get all labels of the keys (private) on the card.
java.util.Collection	getObjects(java.lang.String pintype, java.lang.String pin, java.lang.String objectType) Returns all objects of type (data or domain parameters) stored on the card
PINInfo	getPINInfo(java.lang.String pintype) Method that returns the current PIN related info about the given PIB
long	getSlotId(java.lang.String pintype) Method returning the slotId that is associated with this token.
java.lang.String[]	getSupportedPINTypes() Method that should return the tokens supported PIN types Either PINTYPE_ constants or customdefined labels
IToken	getWrappedToken()
void	init(boolean useVirtualSlots, iaik.pkcs.pkcs11.Token token) Method that should be called by the TokenManager only when creating an instance.
void	initToken(java.lang.String tokenlabel, java.lang.String tokenserial, java.lang.String[] pintypes, java.lang.String[] pins, java.lang.String[] puks) Method that should initialize a token, cards that non-ereasable should clean the card as much as possible.
boolean	isTokenSupported(iaik.pkcs.pkcs11.Token token) Method used for knowing if an implementation supports the current token in process.
void	removeCertificate(java.lang.String pintype, java.lang.String pin, java.lang.String basicpin, java.security.cert.X509Certificate cert) Method removing the specified certificate from the token.
void	removeKey(java.lang.String pintype, java.lang.String pin, java.lang.String basicpin, java.lang.String label) Method removing a specified key from a card
void	removeObject(java.lang.String pintype, java.lang.String pin, java.lang.String basicPin, IObject object) Method that removes a Data or Domain Parameters object from the card
boolean	requirePUKInDB() Method determining if the token requires the PUK to be uploaded to DB prior to initialization This is mainly for tokens that cannot be reformatted.
PINInfo	unblockPIN(java.lang.String pintype, java.lang.String puk, java.lang.String newpin) Method used to enter the PUK code to unblock a PIN code after to many erronious tries.
PINInfo	unlockPIN(java.lang.String pintype, java.lang.String pin) Method used to login to a PIN in order to be able to perform operations on the card, this is not the same as unblock PIN

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

addObject

public void addObject(java.lang.String pintype,
                      java.lang.String pin,
                      IObject object)
               throws OperationNotSupportedException,
                      iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Adds a object (data, domainparameter) to the token

Specified by:

addObject in interface IToken

Parameters:

pintype - of the PIN that should protect the key, null for no protection

pin - the pin to unlock the private area (May not be required, then can null be used)

object - a object to add to the token

Throws:

OperationNotSupportedException - if this operation or some of it's parameters isn't supported

iaik.pkcs.pkcs11.TokenException - for other token related failures.

See Also:

IToken.addObject(java.lang.String, java.lang.String, org.hardtokenmgmt.core.token.IObject)

blockPIN

public PINInfo blockPIN(java.lang.String pintype)
                 throws OperationNotSupportedException,
                        iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Method used to block a PIN, used for administrators to later change it

Specified by:

blockPIN in interface IToken

Parameters:

pintype - one of the PINTYPE_ constants

Returns:

a PINInfo object indicating the new status of the PIN

Throws:

OperationNotSupportedException - if this operation or some of it's parameters isn't supported

iaik.pkcs.pkcs11.TokenException - for other token related failures.

See Also:

IToken.blockPIN(java.lang.String)

changePIN

public PINInfo changePIN(java.lang.String pintype,
                         java.lang.String oldpin,
                         java.lang.String newpin)
                  throws OperationNotSupportedException,
                         iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Method used to change the value of the

Specified by:

changePIN in interface IToken

Parameters:

pintype - one of the PINTYPE_ constants

oldpin - the old pinvalue

newpin - the new pinvalue

Returns:

a PIN info object containing the current status of the PIN

Throws:

OperationNotSupportedException

iaik.pkcs.pkcs11.TokenException

See Also:

IToken.changePIN(java.lang.String, java.lang.String, java.lang.String)

clearCertificateCache

public void clearCertificateCache()

Description copied from interface: IToken

Method instructing the token to clear it's certificate cache if it have any. It's up to the implementation if there should be any caching of certificates or not.

Specified by:

clearCertificateCache in interface IToken

See Also:

IToken.clearCertificateCache()

clearToken

public void clearToken(java.lang.String[] pintypes,
                       java.lang.String[] puks)
                throws OperationNotSupportedException,
                       iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Method that should clear a token, either erase the card completely or remove all objects on the card for non-ereasable tokens.

Specified by:

clearToken in interface IToken

Parameters:

pintypes - optional parameter used by some cards with non-erasable filesystem and needs the PUK code to erease some areas. Should contain an array of PINTYPE_contants or custom label strings

puks - optional parameter used by some cards with non-erasable filesystem and needs the PUK code to erease some areas.

Throws:

OperationNotSupportedException - if this operation or some of it's parameters isn't supported

iaik.pkcs.pkcs11.TokenException - for other token related failures.

See Also:

IToken.clearToken(java.lang.String[], java.lang.String[])

downloadCert

public void downloadCert(java.lang.String label,
                         java.lang.String pintype,
                         java.lang.String pin,
                         java.lang.String basicpin,
                         java.security.cert.X509Certificate cert)
                  throws ObjectAlreadyExistsException,
                         OperationNotSupportedException,
                         iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Downloads a certificate to the token. Should mainly be used for root certificates.

Specified by:

downloadCert in interface IToken

Parameters:

label - the label used to mark the object on the token.

pintype - of the PIN needed to unlock the token

pin - the pin to unlock (May not be required, then can null be used)

basicpin - to unlock the certificate store.

Throws:

ObjectAlreadyExistsException - if a certificate with the label already exists.

OperationNotSupportedException - if this operation or some of it's parameters isn't supported

iaik.pkcs.pkcs11.TokenException - for other token related failures.

See Also:

IToken.downloadCert(java.lang.String, java.lang.String, java.lang.String, java.lang.String, java.security.cert.X509Certificate)

downloadKeyStore

public void downloadKeyStore(java.lang.String keytype,
                             java.lang.String pintype,
                             java.lang.String pin,
                             java.lang.String certLabel,
                             java.security.KeyStore keyStore,
                             java.lang.String keyStorePasswd)
                      throws ObjectAlreadyExistsException,
                             OperationNotSupportedException,
                             iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Method that downloads a keystores key and certificate on the token.

Specified by:

downloadKeyStore in interface IToken

Parameters:

keytype - one of the KEYTYPE_ constants or the label of the object for custom keys

pintype - of the PIN needed to unlock the token

pin - the pin to unlock (May not be required, then can null be used)

certLabel - label the label used to mark the object on the token.

keyStore - the java keystore to extract the keystore from

keyStorePasswd - the passwordused to lock the keystore

Throws:

ObjectAlreadyExistsException - if a certificate or key with the label already exists.

OperationNotSupportedException - if this operation or some of it's parameters isn't supported

iaik.pkcs.pkcs11.TokenException - for other token related failures.

See Also:

IToken.downloadKeyStore(java.lang.String, java.lang.String, java.lang.String, java.lang.String, java.security.KeyStore, java.lang.String)

genKey

public void genKey(java.lang.String pintype,
                   java.lang.String pin,
                   java.lang.String basicpin,
                   java.lang.String keytype,
                   java.lang.String algorithm,
                   int keysize,
                   java.lang.String label)
            throws ObjectAlreadyExistsException,
                   OperationNotSupportedException,
                   iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Method that should generate a key on the card with the specified algorithm.

Specified by:

genKey in interface IToken

Parameters:

pintype - one of the PINTYPE_ indicating the PIN that should protect the key

pin - the pin to unlock (May not be required, then can null be used)

basicpin - pin to unlock the basic area, might be used for signature keys

keytype - one of the KEYTYPE_ constants or the label of the object for custom keys

algorithm - one of the KEYALG_ constants

keysize - the size of the key

label - a reference to the key to use.

Throws:

ObjectAlreadyExistsException - if the keytype already exists.

OperationNotSupportedException - if this operation or some of it's parameters isn't supported

iaik.pkcs.pkcs11.TokenException - for other token related failures.

See Also:

IToken.genKey(java.lang.String, java.lang.String, java.lang.String, java.lang.String, java.lang.String, int, java.lang.String)

genPKCS10

public org.bouncycastle.jce.PKCS10CertificationRequest genPKCS10(java.lang.String keytype,
                                                                 java.lang.String pintype,
                                                                 java.lang.String pin,
                                                                 UserDataGenerator userDataGenerator)
                                                          throws OperationNotSupportedException,
                                                                 iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Method that generates a PKCS10 request using the specified key.

Specified by:

genPKCS10 in interface IToken

Parameters:

keytype - which key that should be used for the request.

pintype - of the PIN needed to unlock the token

pin - the pin to unlock (May not be required, then can null be used)

userDataGenerator - user data generator to use when fetching token labels.

Returns:

a PKCS10CertificateRequest for the specified key.

Throws:

OperationNotSupportedException - if this operation or some of it's parameters isn't supported

iaik.pkcs.pkcs11.TokenException - for other token related failures.

See Also:

IToken.genPKCS10(String, String, String, UserDataGenerator)

getCertificate

public java.security.cert.X509Certificate getCertificate(java.lang.String certficateLabel)
                                                  throws OperationNotSupportedException,
                                                         iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Method that tries to find a certificate stored on the token wiht the specified label. The method will traverse through all supported pin types.

Specified by:

getCertificate in interface IToken

Parameters:

certficateLabel - of the certficate to look for

Returns:

the X509Certificate on null of it couldn't be found.

Throws:

OperationNotSupportedException - if this operation isn't supported

iaik.pkcs.pkcs11.TokenException - for other token related failures.

See Also:

IToken.getCertificate(java.lang.String)

getCertificates

public java.util.Collection getCertificates(java.lang.String pintype)
                                     throws OperationNotSupportedException,
                                            iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Method that retrieves all certificates stored on the token.

Specified by:

getCertificates in interface IToken

Parameters:

pintype - of the PIN that are connected to the certificates

Returns:

a Collection of X509Certificate

Throws:

OperationNotSupportedException - if this operation isn't supported

iaik.pkcs.pkcs11.TokenException - for other token related failures.

See Also:

IToken.getCertificates(java.lang.String)

getHardTokenSN

public java.lang.String getHardTokenSN()
                                throws iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Method that should return the current hard token serial number of the card. If the token doesn't have any serialnumber yet should null be returned.

Specified by:

getHardTokenSN in interface IToken

Throws:

iaik.pkcs.pkcs11.TokenException

See Also:

IToken.getHardTokenSN()

getKeyLabels

public java.util.Collection getKeyLabels(java.lang.String pintype)
                                  throws OperationNotSupportedException,
                                         iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Method to get all labels of the keys (private) on the card.

Specified by:

getKeyLabels in interface IToken

Parameters:

pintype - of the PIN needed to unlock the key

Returns:

a collection of String

Throws:

OperationNotSupportedException - if this operation or some of it's parameters isn't supported

iaik.pkcs.pkcs11.TokenException - for other token related failures.

See Also:

IToken.getKeyLabels(java.lang.String)

getObjects

public java.util.Collection getObjects(java.lang.String pintype,
                                       java.lang.String pin,
                                       java.lang.String objectType)
                                throws OperationNotSupportedException,
                                       iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Returns all objects of type (data or domain parameters) stored on the card

Specified by:

getObjects in interface IToken

Parameters:

pintype - of the PIN needed to unlock the token, if neccessary

pin - the pin to unlock (May not be required, then can null be used)

objectType - of object to return, one of the OBJECTTYPE_ constants

Returns:

a Collection of IObject

Throws:

OperationNotSupportedException - if this operation isn't supported

iaik.pkcs.pkcs11.TokenException - for other token related failures.

See Also:

IToken.getObjects(java.lang.String, java.lang.String, java.lang.String)

getPINInfo

public PINInfo getPINInfo(java.lang.String pintype)
                   throws OperationNotSupportedException,
                          iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Method that returns the current PIN related info about the given PIB

Specified by:

getPINInfo in interface IToken

Parameters:

pintype - one of the PINTYPE_ constants

Returns:

a PINInfo object

Throws:

OperationNotSupportedException - if this operation or some of it's parameters isn't supported

iaik.pkcs.pkcs11.TokenException - for other token related failures.

See Also:

IToken.getPINInfo(java.lang.String)

getSupportedPINTypes

public java.lang.String[] getSupportedPINTypes()

Description copied from interface: IToken

Method that should return the tokens supported PIN types Either PINTYPE_ constants or customdefined labels

Specified by:

getSupportedPINTypes in interface IToken

See Also:

IToken.getSupportedPINTypes()

init

public void init(boolean useVirtualSlots,
                 iaik.pkcs.pkcs11.Token token)
          throws iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Method that should be called by the TokenManager only when creating an instance.

Specified by:

init in interface IToken

Throws:

iaik.pkcs.pkcs11.TokenException

See Also:

IToken.init(boolean, iaik.pkcs.pkcs11.Token)

initToken

public void initToken(java.lang.String tokenlabel,
                      java.lang.String tokenserial,
                      java.lang.String[] pintypes,
                      java.lang.String[] pins,
                      java.lang.String[] puks)
               throws OperationNotSupportedException,
                      iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Method that should initialize a token, cards that non-ereasable should clean the card as much as possible. Keys protected by each PIN may be generated but isn't required

Specified by:

initToken in interface IToken

Parameters:

tokenlabel - the label of the token, can be null if no token label should be set.

tokenserial - the serial number that should be written to the card, only used if the card supports the serial number to be set during initialization otherwise could null be used.

pintypes - an array of PINTYPE_contants or custom label strings. Indicates which key that should have which PIN and PUK

pins - an array of pin codes used in the initialization, should be used with the keytype array get hold of key to use. be defined in the getKeyIndex type.

puks - an array of puk codes for each PIN

Throws:

OperationNotSupportedException - if this operation or some of it's parameters isn't supported

iaik.pkcs.pkcs11.TokenException - for other token related failures.

See Also:

IToken.initToken(String, String, String[], String[], String[])

isTokenSupported

public boolean isTokenSupported(iaik.pkcs.pkcs11.Token token)
                         throws iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Method used for knowing if an implementation supports the current token in process.

Specified by:

isTokenSupported in interface IToken

Parameters:

token - the current token inserted into the slot.

Returns:

true if the current IToken implementation supports this token.

Throws:

iaik.pkcs.pkcs11.TokenException - if a pkcs11 related problem occurs

See Also:

IToken.isTokenSupported(iaik.pkcs.pkcs11.Token)

removeCertificate

public void removeCertificate(java.lang.String pintype,
                              java.lang.String pin,
                              java.lang.String basicpin,
                              java.security.cert.X509Certificate cert)
                       throws OperationNotSupportedException,
                              iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Method removing the specified certificate from the token.

Specified by:

removeCertificate in interface IToken

Parameters:

pintype - of the PIN needed to unlock the token

pin - the pin to unlock (May not be required, then can null be used)

basicpin - pin to unlock the basic area, might be used for signature certificates

Throws:

OperationNotSupportedException - if this operation or some of it's parameters isn't supported

iaik.pkcs.pkcs11.TokenException - for other token related failures.

See Also:

IToken.removeCertificate(java.lang.String, java.lang.String, java.lang.String, java.security.cert.X509Certificate)

removeKey

public void removeKey(java.lang.String pintype,
                      java.lang.String pin,
                      java.lang.String basicpin,
                      java.lang.String label)
               throws OperationNotSupportedException,
                      iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Method removing a specified key from a card

Specified by:

removeKey in interface IToken

Parameters:

pintype - of the PIN needed to unlock the token

pin - the pin to unlock (May not be required, then can null be used)

basicpin - pin to unlock the basic area, might be used for signature certificates

label - of the key

Throws:

OperationNotSupportedException - if this operation or some of it's parameters isn't supported

iaik.pkcs.pkcs11.TokenException - for other token related failures.

See Also:

IToken.removeKey(java.lang.String, java.lang.String, java.lang.String, java.lang.String)

removeObject

public void removeObject(java.lang.String pintype,
                         java.lang.String pin,
                         java.lang.String basicPin,
                         IObject object)
                  throws OperationNotSupportedException,
                         iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Method that removes a Data or Domain Parameters object from the card

Specified by:

removeObject in interface IToken

Parameters:

pintype - of the PIN needed to unlock the token

pin - the pin to unlock (May not be required, then can null be used)

basicPin - to unlock (May not be required, then can null be used)

object - the iaik.pkcs.pkcs11.objects.Object object to remove

Throws:

OperationNotSupportedException - if this operation or some of it's parameters isn't supported

iaik.pkcs.pkcs11.TokenException - for other token related failures.

See Also:

IToken.removeObject(String, String, String, IObject)

unblockPIN

public PINInfo unblockPIN(java.lang.String pintype,
                          java.lang.String puk,
                          java.lang.String newpin)
                   throws OperationNotSupportedException,
                          iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Method used to enter the PUK code to unblock a PIN code after to many erronious tries.

Specified by:

unblockPIN in interface IToken

Parameters:

pintype - one of the PINTYPE_ constants

puk - the PUK that should be used to unblock

newpin - the new PIN.

Returns:

a PINInfo object indicating the new status of the PIN

Throws:

OperationNotSupportedException - if this operation or some of it's parameters isn't supported

iaik.pkcs.pkcs11.TokenException - for other token related failures.

See Also:

IToken.unblockPIN(java.lang.String, java.lang.String, java.lang.String)

unlockPIN

public PINInfo unlockPIN(java.lang.String pintype,
                         java.lang.String pin)
                  throws OperationNotSupportedException,
                         iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Method used to login to a PIN in order to be able to perform operations on the card, this is not the same as unblock PIN

Specified by:

unlockPIN in interface IToken

Parameters:

pintype - one of the PINTYPE_ constants

pin - the pin that should be used for login

Returns:

a PIN info object containing the current status of the PIN

Throws:

OperationNotSupportedException - if this operation or some of it's parameters isn't supported

iaik.pkcs.pkcs11.TokenException - for other token related failures.

See Also:

IToken.unlockPIN(java.lang.String, java.lang.String)

requirePUKInDB

public boolean requirePUKInDB()
                       throws iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Method determining if the token requires the PUK to be uploaded to DB prior to initialization This is mainly for tokens that cannot be reformatted.

Specified by:

requirePUKInDB in interface IToken

Returns:

'true' if PUK data must exist in database before card is managed. 'false' othervise.

Throws:

iaik.pkcs.pkcs11.TokenException

See Also:

IToken.requirePUKInDB()

checkPIN

public boolean checkPIN(java.lang.String pintype,
                        java.lang.String pin)
                 throws OperationNotSupportedException,
                        iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Method used to check if a PIN is valid and true if it is

Specified by:

checkPIN in interface IToken

Throws:

OperationNotSupportedException - if this operation or some of it's parameters isn't supported

iaik.pkcs.pkcs11.TokenException - for other token related failures.

getSlotId

public long getSlotId(java.lang.String pintype)
               throws OperationNotSupportedException,
                      iaik.pkcs.pkcs11.TokenException

Description copied from interface: IToken

Method returning the slotId that is associated with this token.

Specified by:

getSlotId in interface IToken

Returns:

the tokens slotId

Throws:

OperationNotSupportedException - if this operation or some of it's parameters isn't supported

iaik.pkcs.pkcs11.TokenException - for other token related failures.

generatePUK

public java.lang.String generatePUK(java.lang.String pintype)
                             throws OperationNotSupportedException

Description copied from interface: IToken

Method that should generate the PUK code placed on the card for the specified PIN. Should only be used in the case requirePUKInDB is false and PUK codes should be generated during token initialization. This is mainly for tokens that cannot be reformatted.

Specified by:

generatePUK in interface IToken

Returns:

a valid PUK supported by the token

Throws:

OperationNotSupportedException - if this method isn't supported by this token.

getWrappedToken

public IToken getWrappedToken()

Returns:

method returning the underlying token implementation that the Syncronized token is wrapped around.