CONTENTS | PREV | NEXT The Java Language Environment


10.4 Security

Network security is of paramount importance to Internet users, especially with the exponential growth of Internet commerce. Network-based applications must be able to defend themselves against a veritable gallimaufry of network viruses, worms, Trojan horses, and other forms of intruders. This section discusses the layers of defense provided by Java, the Java run-time system, and the higher-level protocols of HotJava itself.

One of the most important technical challenges in building a system like HotJava is making it secure. Downloading, installing, and executing fragments of code imported from across the network is potentially an open invitation to all sorts of problems. On the one hand, such a facility provides great power that can be used to achieve very valuable ends; on the other hand, the facility could potentially be subverted to become a breeding ground for computer viruses. The topic of safety is a very broad one and doesn't have a single answer. HotJava has a series of facilities that layer and interlock to provide a fairly high degree of safety.


10.4.1 The First Layer--the Java Language Interpreter

The first layer of security in Java applications come from the ground rules of Java itself. These features have been described in detail in previous chapters in this paper.

When HotJava imports a code fragment, it doesn't actually know whether or not the code fragment follows Java language rules for safety. As described earlier, imported code fragments are subjected to a series of checks, starting with straightforward tests that the format of the code is correct and ending with a series of consistency checks by the Bytecode Verifier.


10.4.2 The Next Layer--the Higher Level Protocols

Given this base set of guarantees that interfaces cannot be violated, higher level parts of the system implement their own protection mechanisms. For example, the file access primitives implement an access control list that controls read and write access to files by imported code (or code invoked by imported code). The defaults for these access control lists are very restrictive. If an attempt is made by a piece of imported code to access a file to which access has not been granted, a dialog box pops up to allow the user to decide whether or not to allow that specific access.



CONTENTS | PREV | NEXT
Please send any comments or corrections to jdk-comments@java.sun.com
Copyright © 1997 Sun Microsystems, Inc. All Rights Reserved.