Improving access security for Oracle Forms applications using eOI

Faced with the recent major cyber-attacks on INA (Croatia Oil Company) and the US Colonial Pipeline, it is necessary to ensure the confidentiality and integrity of communication in the environment of critical power system infrastructure and to control access to ICT (Information and Communication Technologies) resources. By being aware that Oracle Forms is not “dead" but support and new versions have been announced and for the years ahead it was important to find a secure user authentication mechanism in Oracle Forms applications.Leaving JAVA support in the browser in the form of Java applets, JNLP embedded in HTML or Java web start technologies, the only possible way to run Oracle Forms applications is a standalone launcher i.e. starting Forms using Oracle Java JRE environment. The presentation will explain the mechanism of two-factor authentication with smart card (e.g. eOI - Croatian national electronic ID card) certificates to achieve an extremely high level of cyber security.Through the presentation we will present PKCS #11 (Public Key Cryptography Standards) mechanism relying on the Windows keystore to access the smart card and also the mechanism for direct access to the smart card that can be used on both Windows or Linux based client’s machine. PKCS #11 is one of the public-key cryptography standards and also refers to the programming interface to create and manipulate cryptographic tokens or smart cards. The approach using soft certificates using PKCS #12 standards will be further clarified in the presentation. PKCS #12 defines an archive file format for storing many cryptographic objects as a single file.The lecture will refer to the way of configuring OHS (Oracle HTTP Server) to configure acceptable credentials and certificates through Oracle Wallet. Oracle Wallet is a container/repository that stores credentials such as certificates, certificate requests, and private keys so that OHS can request a user certificate from the specific issuer.Very useful presentation where you can learn how, in addition to Oracle Forms, you can use smart cards or soft certificates that apply to all other Java-based applications that access resources on servers via HTTPS protocol. The cybersecurity mechanisms presented can be used in the implementation of the NIS2 (Directive on security of Network and Information Systems) guidance requirements to avoid the establishment of administrative sanctions, including penalties for violations in risk management and cybersecurity management.