sigleton：

Spring singleton is best described as per container and per bean.

The singleton scope is the default scope in Spring.

prototype：

creation of a new bean instance every time a request for that specific bean is made。

use the prototype scope for all beans that are stateful, while the singleton scope should be used for stateless beans.

prototype-scoped bean as somewhat of a replacement for the Java 'new' operator.

Spring does not manage the complete lifecycle of a prototype bean。It is the responsibility of the client code to clean up prototype scoped objects and release any expensive resources that the prototype bean(s) are holding onto.

request（web专用）、session（web专用）、globle session（web专用）

servlet 2.4+ web.xml

<web-app>
...
<listener>
<listener-class>org.springframework.web.context.request.RequestContextListener</listener-class>
</listener>
...
</web-app>

servlet 2.3 web.xml

<web-app>
..
<filter>
<filter-name>requestContextFilter</filter-name>
<filter-class>org.springframework.web.filter.RequestContextFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>requestContextFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
...
</web-app>

the global session scope is similar to the standard HTTP Session scope (described immediately above), and really only makes sense in the context of portlet-based web applications.

if you are writing a standard Servlet-based web application and you define one or more beans
as having global session scope, the standard HTTP Session scope will be used, and no error will be raised.

<bean id="userPreferences" class="com.foo.UserPreferences" scope="session">
<!-- this next element effects the proxying of the surrounding bean -->
<aop:scoped-proxy/>
</bean>

<!-- a singleton-scoped bean injected with a proxy to the above bean -->
<bean id="userService" class="com.foo.SimpleUserService">
<!-- a reference to the proxied 'userPreferences' bean -->
<property name="userPreferences" ref="userPreferences"/>
</bean>
</beans>

<bean id="userPreferences" class="com.foo.UserPreferences" scope="session"/>
<bean id="userManager" class="com.foo.UserManager">
<property name="userPreferences" ref="userPreferences"/>
</bean>
From the above configuration it is evident that the singleton bean 'userManager' is being injected with a
reference to the HTTP Session-scoped bean 'userPreferences'. The salient point here is that the
'userManager' bean is a singleton... it will be instantiated exactly once per container, and its dependencies (in
this case only one, the 'userPreferences' bean) will also only be injected (once!). This means that the
'userManager' will (conceptually) only ever operate on the exact same 'userPreferences' object, that is the
one that it was originally injected with. This is not what you want when you inject a HTTP Session-scoped
bean as a dependency into a collaborating object (typically). Rather, what we do want is a single
'userManager' object, and then, for the lifetime of a HTTP Session, we want to see and use a
'userPreferences' object that is specific to said HTTP Session.

3.[http://java.sun.com] – 官方的Java开发者网站 – 每周都有新文章发表.

4.[http://www.developer.com/java] – 由Gamelan.com 维护的Java技术文章网站.

5.[http://www.java.net] – Sun公司维护的一个Java社区网站.

6.[http://www.builder.com] – Cnet的Builder.com网站 – 所有的技术文章, 以Java为主.

7.[http://www.ibm.com/developerworks/java] – IBM的Developerworks技术网站; 这是其中的Java技术主页.

8.[http://www.javaworld.com] – 最早的一个Java站点. 每周更新Java技术文章.

9.[http://www.devx.com/java] – DevX维护的一个Java技术文章网站.

10.[http://www.fawcette.com/javapro] – JavaPro在线杂志网站.

11.[http://www.sys-con.com/java] – Java Developers Journal的在线杂志网站.

12.[http://www.javadesktop.org] – 位于Java.net的一个Java桌面技术社区网站.

13.[http://www.theserverside.com] – 这是一个讨论所有Java服务器端技术的网站.

14.[http://www.jars.com] – 提供Java评论服务. 包括各种framework和应用程序.

15.[http://www.jguru.com] – 一个非常棒的采用Q&A形式的Java技术资源社区.

16.[http://www.javaranch.com] – 一个论坛，得到Java问题答案的地方，初学者的好去处。

17.[http://www.ibiblio.org/javafaq/javafaq.html] – comp.lang.java的FAQ站点 – 收集了来自comp.lang.java新闻组的问题和答案的分类目录.

18.[http://java.sun.com/docs/books/tutorial/] – 来自SUN公司的官方Java指南 – 对于了解几乎所有的java技术特性非常有帮助.

19.[http://www.javablogs.com] – 互联网上最活跃的一个Java Blog网站.

20.[http://java.about.com/] – 来自About.com的Java新闻和技术文章网站.

import java.security.Signature;
import java.security.KeyPair;
import java.security.PublicKey;
import java.security.PrivateKey;
import java.security.NoSuchAlgorithmException;
import java.security.InvalidKeyException;
import java.security.SignatureException;

public class SignatureExample {
    public byte[] signData(byte[] data, PrivateKey key)
    {
        try {
            Signature signer = Signature.getInstance("SHA1withDSA");

            signer.initSign(key);

            signer.update(data);

            return(signer.sign());
        } catch(NoSuchAlgorithmException nsae) {
            System.out.println("Exception: " + nsae);
            nsae.printStackTrace();
        } catch(InvalidKeyException ike) {
            System.out.println("Exception: " + ike);
            ike.printStackTrace();
        } catch(SignatureException se) {
            System.out.println("Exception: " + se);
            se.printStackTrace();
        }

        return(null);
    }

    public boolean verifySig(byte[] data, PublicKey key, byte[] sig)
    {
        try {
            Signature signer = Signature.getInstance("SHA1withDSA");

            signer.initVerify(key);

            signer.update(data);

            return(signer.verify(sig));
        } catch(NoSuchAlgorithmException nsae) {
            System.out.println("Exception: " + nsae);
            nsae.printStackTrace();
        } catch(InvalidKeyException ike) {
            System.out.println("Exception: " + ike);
            ike.printStackTrace();
        } catch(SignatureException se) {
            System.out.println("Exception: " + se);
            se.printStackTrace();
        }

        return(false);
    }

public static void main(String args[])
    {
        SignatureExample sigEx = new SignatureExample();
        KeyPairGeneratorExample kpge = new KeyPairGeneratorExample();
        KeyPair keyPair = kpge.generateKeyPair(717);

        byte[] data = {65,66,67,68,69,70,71,72,73,74};
        byte[] digitalSignature = sigEx.signData(data, keyPair.getPrivate());

        boolean verified;

        // This verification will succeed
        verified = sigEx.verifySig(data, keyPair.getPublic(), digitalSignature);
        if(verified) {
            System.out.println("** The digital signature has been verified");
        } else {
            System.out.println("** The digital signature is invalid, the wrong " +
                               "key was used, or the data has been compromised");
        }

        System.out.println("");

        // Generate a new key pair. Guaranteed to be different and incompatible
        // with first set.
        keyPair = kpge.generateKeyPair(517);
        // This verification will fail
        verified = sigEx.verifySig(data, keyPair.getPublic(), digitalSignature);
        if(verified) {
            System.out.println("** The digital signature has been verified");
        } else {
            System.out.println("** The digital signature is invalid, the wrong " +
                               "key was used, or the data has been compromised");
        }
    }
}

KeyPairGeneratorExample类会在后面讨论，它用来获得公钥和密钥。数据使用密钥签名，使用公钥验证。

//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

JCA形成了安全API的核心。在设计之初，有2个重要的原则。

第一、JCA是实现无关的且可互操作的。实现无关是通过加密服务提供者（cryptography service providers）来实现的。

      一个provider实现了一种加密服务（例如生成随机数字或者创建一个电子签名）。

      互操作性保证不同的provider可以一起工作。例如，不同的provider使用相同的算法，被一个provider加密可以被另外一个provider解密。

第二、JCA是算法无关性和可扩展性的。

       算法无关性是通过引擎类（engine classes：提供特定的加密服务，如密钥生成器或者信息摘要服务）的规范来实现的。

       算法可扩展性确保这些引擎类可以很容易的用新的算法更新。

JDK包含一些默认的加密服务提供者，在名称为SUN的包底下，有如下provider：

❑ Implementation of DSA (Digital Signature Algorithm)

❑ Implementation of MD5 and SHA-1 message digest algorithms

❑ Key pair generator to generate public and private key pairs for the DSA algorithm

❑ DSA algorithm parameter generator

❑ DSA algorithm parameter manager

❑ DSA key factory that supports converting public keys to and from private keys

❑ SHA1PRNG pseudo-random number generator

❑ X.509 Certificate path builder and validator for PKIX

❑ A certificate store using the PKIX LDAP V2 Schema

❑ Certificate factory for X.509 certificates and Certificate Revocation Lists (CRLs)

❑ A keystore

所有的provider将会做详细的讨论。所有的例子都是使用SUN包的默认的provider的实现。如果你使用第三方的provider包，请参考第三方文档。

Java Cryptography提供给用户identification/authentication 和数字信息签名。

Java Authentication and Authorization Services 提供了编程式的访问控制和用户授权，基于许可和安全策略授权访问程序特征。

安全机制的Java实现解决了很多标准的安全机制的实现，例如：访问控制（access control），公钥/私钥(public/private key)生成和管理，电子内容的签名，和电子证书的管理。

.Java Cryptography Architecture (JCA)在JDK1.1中被引进。自从最初的版本，JCA从提供电子签名和消息摘要到证书管理到粒度合理可配置的访问控制的API。 安全机制实现的另外重要特性有加密数据的交流，密钥管理和互换，和消息验证代码{MessageAuthentication Code (MAC)}的支持。 这些特性都可以再Java Cryptography Extension（JCE中）找到。JCE是在JDK1.4的时被集成的。 将JCA和JCE的功能结合，可以让你有一个完善的安全机制和加密相关的安全需求的系统实现。    1、1 JCA 设计和架构    1、2 Java Cryptography Extension

2、使用JAAS实现安全

未完。。。