How to secure a client/ server socket communication

Question

Assume that client and server apps are running on different machine

Today:

// Server will receive the request and cast it as needed
ProxyResponse message = (ProxyResponse) objStream.readObject();

// Update message with some content
...

// Sent it back to client
ObjectOutputStream oos = new ObjectOutputStream(toClient);
oos.writeObject(message);

I'd like to further enhance this to make sure data sent out is somehow protected. How would you recommend i approach this?

I am looking for an example of how data passed between client an server be encrypted and decrypted on both ends and sent over an SSL.

Answer 1

The JDK provides an SSL socket implementation that seems an appropriate place to start. It's straightforward to use.

Originally, you probably have code like this:

final SocketFactory factory = SocketFactory.getDefault();
final Socket socket = factory.createSocket(host, port);

You simply change the factory:

final SocketFactory factory = SSLSocketFactory.getDefault();
final Socket socket = factory.createSocket(host, port);

The same is true for ServerSocketFactory.

Answer 2

You can use asymmetric or symmetric based encryption. Look at the BouncyCastle library. Using symmetric key encryption, this would be as simple as each side having a shared key that is used to encrypt the data.

Based on your updated answer, I agree that you should look into SSLSocket.