How to hide this method?

Question

I want to use Protection Proxy Pattern,but I feel nervous about my
real method,how can i hide it(such as set it friendly or protected)?
you can see this code:
interface Safe{
     public String getSecret();
class RealSafe implements Safe{
     public String getSecret(){
          return new String("You can get the secret");
class ProtectionProxy implements Safe{
     private String password=null;
     public ProtectionProxy(String temp){
          password=temp;
     public String getSecret(){
          if(password.equals("I have the rights")){
               RealSafe realobj=new RealSafe();
               return realobj.getSecret();
          else{
               return new String("Illegal password,You can't get the secret");
How to hide the getSecret() in class RealSafe with the precondition of using Protection Proxy Pattern???????
How can i do? i need your help,please!

Answer 1

You can't prevent a malicious developer constructing an instance of RealSafe. They could always decompile your application and make changes to it if they wanted anyway!
The ProtectionProxy is really just a convenience for users of your API. It provides "reasonable" security through a means of determining whether the current user has access to the data. It does not provide a means of determining whether the current developer has access to it!
Your proxy lays down the rules for accessing the class being proxied. This works when the client application plays by the rules (as most applications do).
So all you need to do is make sure that developers who play by the rules can't construct an instance of RealSafe:
public class SafeFactory
  public static Safe getSafe(...)
    Safe safe = new RealSafe(...);
    return new ProtectionProxy(safe);
class RealSafe implements Safe
  RealSafe(...)
class ProtectedSafe implements Safe
  private Safe safe;
  ProtectedSafe(Safe safe)
    this.safe = safe;
}Thus the only way for a developer to get hold of an instance of Safe is to use SafeFactory.getSafe which always returns a ProtectedSafe.
Make sure you don't mistake this sort of pattern for robust security, though. It simply allows your client application to catch "UnauthorizedExceptions" and react accordingly. As pointed out in this thread there're various ways of getting at the data that's hiding inside a Proxy. If you're really concerned about preventing someone viewing your data unless they are authorised you need to either encrypt it or only load it (and not cache it) when their credentials have been provided.
Hope this helps.