Technical Information
Trust-Based Security for Java
|
|
|
Security has been a major stumbling block for Java. The original Java security model granted limited privileges to Java applets downloaded from the network and free reign to classes loaded from the local disk. As a result, developers were constrained in the Web applications they could create, and systems administrators lived with the fear that unrestricted local classes might open up security holes that could be exploited by malicious applets.
To overcome those limitations, Microsoft has developed trust-based security for Java, a cross-platform system that provides fine-grained administration of the privileges granted to Java applets and libraries. It utilizes Java CAB signing, ensuring that an applet can only perform actions for which it specifically requests permissions. With trust-based security for Java, developers can precisely limit the section of code where privileges have been granted, and administrators can have flexible control over the privileges granted to local classes. When combined with Microsoft® Internet Explorer zones, trust-based security can also simplify security decisions for end users.
More secure and more flexible than other Java security models, trust-based security also reduces administrative costs and preserves compatibility with existing code, making it a more cost effective model as well. Most important, it can help to answer one of the larger questions facing the software industry today: How can users trust code that is published on the Internet?
Developer FAQ for Java code signing in Internet Explorer 4.01 and later - Frequently asked questions concerning the new Java CAB signing system, with background information on how the new security system works, on CAB levels, special features, where to get signing tools, and more.
 Signing a cabinet file with Java privileges using signcode -
This technical document explains CAB file privilege levels, zones, and offers insights into the way CAB files work with Internet Explorer. The document also shows how to use signcode with privilege information and how to sign a CAB file with Java permissions.
CryptoAPI Tools
- CryptoAPI Tools are used to digitally sign files to be used with Microsoft® Authenticode™, and to view and manage certificates, certificate revocation lists (CRLs), and certificate trust lists (CTLs). These technical documents provide an excellent overview of code signing and certification, and a detailed reference on the tools that the Java extensions are based on.
SDK security articles and references - The SDK for Java folks have a collection of articles and reference materials that cover everything from trust-based security, to cabinet files, and packages.
Knowledge base articles - Microsoft's knowledge base contains a wealth of information about specific technical issues. Below is a list of articles that cover technical questions relating to Java and security.
|
News and Information
