Platform Security
One of the things that makes Java so interesting is the security
features that are built in to the platform itself. Java was designed
to enable small programs, applets, to be
downloaded and run without danger. Applets are nifty, but without the
right precautions they would be very dangerous. Java’s
bytecode
verifier, ClassLoader, and
SecurityManager work in tandem to safely execute
downloaded classes.
The Java Development Kit (JDK™) 1.2 (in beta as this book goes to press) includes some interesting security enhancements, including the concepts of protection domains, permissions, and policies. I won’t rehash Java’s platform security features here. For a good summary, see Exploring Java by Pat Niemeyer and Joshua Peck (O’Reilly). For a more thorough treatment, including the new JDK 1.2 features, see Java Security by Scott Oaks (O’Reilly). The security that the Java platform provides comes “for free” to application developers. Application-level security, however, needs to be developed into the application. This book is about programming application-level security through the use of cryptography.
Application-level security can compensate for an insecure platform, in some cases. Internet Protocol (IP) networks, for example, are insecure. It’s impossible to prevent packet snooping, Domain Name System (DNS) spoofing, or foul-ups like misdelivered email. A carefully crafted application, however, can compensate for an insecure platform like the IP network. If the body of ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access