WebService的用户控制方式与加密算法分类的整理

@Service 
@Transactional 
@WebService(endpointInterface = "com.mycompany.sms.ws.SmsService", targetNamespace = "http://www.mycompany.cn/sms", serviceName = "ServiceInstance") 
public class SmsServiceImpl implements SmsService { 
 
  private SecretKey secretKey; 
 
  @Autowired 
  private SessionManager sessionManager; 
 
  // 将十六进制数字字符串转成字节流【保持16位】 
  private String hexStr = "3243456789123459"; 
 
  public SmsServiceImpl() { 
    byte[] hex = SecurityHelper.hexStrToByte(hexStr); 
    secretKey = new SecretKeySpec(hex, "DES"); 
  } 
 
  @Override 
  public String login(String account, String password) { 
    User user = sessionManager.login(secretKey, account, password); 
    return user.getSessionId(); 
  } 
 
  @Override 
  public void logoff(String sessionId) { 
    sessionManager.logoff(sessionId); 
  } 
 
  @Override 
  public boolean sendMessage(String sessionId, String msgNumber, 
      String msgContent) { 
    sessionManager.getUser(secretKey, sessionId); 
    do something...; 
    return true; 
  } 
} 

@Component 
public class SessionManager { 
 
  @Autowired 
  private CacheProvider cacheProvider; 
 
  public User login(SecretKey secretKey, String account, String password) { 
    SecurityHelper securityHelper = new SecurityHelper(secretKey); 
    String password2; 
    try { 
      password2 = SecurityHelper.byteToHexStr(securityHelper 
          .encode(account.getBytes("UTF-8"))); 
    } catch (UnsupportedEncodingException e) { 
      throw new LoginException(e); 
    } 
    if (password2.equals(password)) { 
      User user = new User(account); 
      user.setSecretKey(secretKey.getEncoded()); 
      addSession(user); 
      return user; 
    } else { 
      throw new LoginException("登录失败"); 
    } 
  } 
 
  public void logoff(String sessionId) { 
    removeSession(sessionId); 
  } 
 
  private void addSession(User user) { 
    cacheProvider.put("webservice-session-" + user.getSessionId(), user); 
  } 
 
  private void removeSession(String sessionId) { 
    cacheProvider.remove("webservice-session-" + sessionId); 
  } 
 
  public User getUser(SecretKey secretKey, String sessionId) { 
    User user = (User) cacheProvider.get("webservice-session-" + sessionId); 
    if (user == null) { 
      throw new WsException("用户未登录或登录超时"); 
    } else if (!bytesEquals(secretKey.getEncoded(), user.getSecretKey())) { 
      throw new WsException("没有调用本接口的权限"); 
    } else { 
      return user; 
    } 
  } 
 
  private boolean bytesEquals(byte[] bytes1, byte[] bytes2) { 
    for (int i = 0; i < bytes1.length; i++) { 
      if (bytes1[i] != bytes2[i]) { 
        return false; 
      } 
    } 
    return true; 
  } 
 
}