### Implementing Access Control and User Authentication in Java for P2P File Sharing System #### Introduction Access control and user authentication are critical components for any production-ready system, especially for a peer-to-peer file sharing system where security and privacy are paramount. In this task, we will implement a robust access control system that ensures only authorized users can access specific files and resources. #### Key Components 1. **User Authentication** - We'll create a user authentication system that verifies user credentials before granting access to the system. - We'll use secure password hashing to store user credentials securely. 2. **Access Control System** - We'll implement role-based access control (RBAC) to define different levels of access for users. - We'll create permission levels for files and folders to control who can read, write, or execute them. 3. **Session Management** - We'll implement session management to keep track of authenticated users and their permissions. #### Implementation Details Let's break down the implementation step by step. #### 1. User Class First, let's create a `User` class that will hold user information and their permissions. ```java public class User { private String username; private String hashedPassword; // Store passwords securely using hashing private Set permissions; public User(String username, String password) { this.username = username; this.hashedPassword = hashPassword(password); this.permissions = new HashSet<>(); } // Method to hash password using SHA-256 private String hashPassword(String password) { try { MessageDigest md = MessageDigest.getInstance("SHA-256"); byte[] hashBytes = md.digest(password.getBytes()); return bytesToHex(hashBytes); } catch (NoSuchAlgorithmException e) { throw new RuntimeException("SHA-256 algorithm not found", e); } } private String bytesToHex(byte[] bytes) { StringBuilder hexString = new StringBuilder(); for (byte b : bytes) { String hex = String.format("%02x", 0xff & b); hexString.append(hex); } return hexString.toString(); } // Getters and setters public String getUsername() { return username; } public String getHashedPassword() { return hashedPassword; } public Set getPermissions() { return permissions; } public void addPermission(String permission) { permissions.add(permission); } } ``` #### 2. Authenticator Class Next, let's create an `Authenticator` class that will handle user registration and authentication. ```java import java.util.concurrent.ConcurrentHashMap; import java.util.concurrent.ConcurrentMap; public class Authenticator { private ConcurrentMap users; private ConcurrentMap sessions; public Authenticator() { this.users = new ConcurrentHashMap<>(); this.sessions = new ConcurrentHashMap<>(); } public boolean registerUser(String username, String password) { if (users.containsKey(username)) { return false; // Username already exists } User user = new User(username, password); users.put(username, user); return true; } public String loginUser(String username, String password) { if (!users.containsKey(username)) { return null; // User not found } User user = users.get(username); if (!user.getHashedPassword().equals(user.hashPassword(password))) { return null; // Incorrect password } // Generate a session token String sessionToken = generateSessionToken(); sessions.put(sessionToken, username); return sessionToken; } private String generateSessionToken() { // Generate a random token using SecureRandom SecureRandom random = new SecureRandom(); byte[] bytes = new byte[32]; random.nextBytes(bytes); return bytesToHex(bytes); } private String bytesToHex(byte[] bytes) { StringBuilder hexString = new StringBuilder(); for (byte b : bytes) { String hex = String.format("%02x", 0xff & b); hexString.append(hex); } return hexString.toString(); } public boolean isValidSession(String sessionToken) { return sessions.containsKey(sessionToken); } public String getUsernameFromSession(String sessionToken) { return sessions.get(sessionToken); } } ``` #### 3. FilePermission Class Let's create a `FilePermission` class to define permissions for files and folders. ```java public enum Permission { READ, WRITE, EXECUTE } public class FilePermission { private String filePath; private Map> permissions; public FilePermission(String filePath) { this.filePath = filePath; this.permissions = new HashMap<>(); } public void grantPermission(String user, Permission permission) { if (!permissions.containsKey(user)) { permissions.put(user, new HashSet<>()); } permissions.get(user).add(permission); } public void revokePermission(String user, Permission permission) { if (permissions.containsKey(user)) { permissions.get(user).remove(permission); } } public boolean hasPermission(String user, Permission permission) { if (!permissions.containsKey(user)) { return false; } return permissions.get(user).contains(permission); } } ``` #### 4. AccessControlManager Class Finally, let's create an `AccessControlManager` class that will manage access control across the system. ```java public class AccessControlManager { private Authenticator authenticator; private Map filePermissions; public AccessControlManager(Authenticator authenticator) { this.authenticator = authenticator; this.filePermissions = new HashMap<>(); } public void setFilePermission(String filePath, String user, Permission permission) { if (!filePermissions.containsKey(filePath)) { filePermissions.put(filePath, new FilePermission(filePath)); } filePermissions.get(filePath).grantPermission(user, permission); } public void removeFilePermission(String filePath, String user, Permission permission) { if (filePermissions.containsKey(filePath)) { filePermissions.get(filePath).revokePermission(user, permission); } } public boolean checkAccess(String filePath, String user, Permission permission) { if (!authenticator.isValidSession(user)) { return false; // Invalid session } if (!filePermissions.containsKey(filePath)) { return false; // File not found in permissions } return filePermissions.get(filePath).hasPermission(user, permission); } } ``` #### Integration with Existing System To integrate this with your existing P2P file sharing system: 1. **During Registration/Login:** - When a new user tries to register or login, use the `Authenticator` class to handle the process. 2. **When Accessing Files:** - Before allowing any file operation (read/write), check the user's permissions using the `AccessControlManager`. 3. **Setting Permissions:** - When a user shares a file, use the `AccessControlManager` to set permissions for other users. #### Example Usage ```java public class ExampleUsage { public static void main(String[] args) { // Initialize authenticator Authenticator authenticator = new Authenticator(); // Register a new user boolean registered = authenticator.registerUser("johnDoe", "securePassword123"); if (registered) { System.out.println("User registered successfully"); } // Login user and get session token String sessionToken = authenticator.loginUser("johnDoe", "securePassword123"); if (sessionToken != null) { System.out.println("User logged in successfully. Session Token: " + sessionToken); // Initialize AccessControlManager AccessControlManager acm = new AccessControlManager(authenticator); // Grant read permission to "janeDoe" for a file acm.setFilePermission("/shared/docs/report.pdf", "janeDoe", Permission.READ); // Check if user has permission boolean hasAccess = acm.checkAccess("/shared/docs/report.pdf", "janeDoe", Permission.READ); if (hasAccess) { System.out.println("User has read access to the file"); } } } } ``` #### Next Steps After implementing access control and user authentication, you should: 1. Integrate this with your existing network communication layer. 2. Update your user interface to include login/registration forms. 3. Add permission management interface for users to manage file permissions. #### Enhancements 1. **Role-Based Access Control (RBAC):** - Implement roles (e.g., Admin, Moderator, User) with different permission levels. 2. **Group Permissions:** - Allow permissions to be assigned to groups instead of individual users. 3. **Fine-Grained Permissions:** - Implement more specific permissions for different file operations. 4. **Audit Logging:** - Log all access attempts for auditing purposes. 5. **Two-Factor Authentication:** - Add an additional layer of security using time-based one-time passwords (TOTP) or SMS-based authentication. #### Further Reading - [Java Secure Coding Guidelines](https://www.oracle.com/java/technologies/java-se/security/java-standard-edition-security-guidelines.html) - [Role-Based Access Control (RBAC)](https://en.wikipedia.org/wiki/Role-based_access_control) - [OAuth 2.0 Protocol](https://oauth.net/2/) - [JSON Web Tokens (JWT)](https://jwt.io/)