J2ee and .Net security, (PDF) - CGISecurity

More documents

Recommendations

Info

1.3.1. C# C# is an object-oriented language, derived from C++, and syntactically similar (with some exceptions) to the Java language. C# is a “brand new” language, and may suffer from teething troubles as a result. While it is not a part of the .Net framework, it is a part of the .Net strategy, and mirrors Java’s function within J2EE. 1.3.2. Common Language Runtime (CLR) All .Net components are compiled into an interim language called Intermediate Language (IL), which is then executed in the runtime environment provided by the CLR. A growing number of compilers for languages such as C#, Visual Basic.Net, C++, etc. are available for use with .Net, giving programmers the ability to work in .Net using familiar languages. The CLR is part of the core of the .Net Framework, providing a secure execution environment through the principles of what Microsoft describes as managed code and code access security. The CLR also provides housekeeping functionality through garbage collection. 1.3.3. ASP. Net ASP.Net is an onward progression from ASP (Active Server Pages). Differences from ASP include programmatical changes and the fact that ASP.Net pages are now compiled and executed in a CLR. 1.3.4. ADO.Net ADO.Net is the successor to Microsoft’s ActiveX Data Objects (ADO). Whereas ADO provided two-dimensional access to data, through the use of rows and columns, ADO.Net describes data as objects and utilises XML for transmitting data between application tiers. 1.3.5. Assemblies An assembly is a collection of code used as the building block of a .Net framework deployment. Assemblies are designed to include security information (in terms of permissions requested and strong name), versioning information (which enables multiple versions of software to co-exist on a single system, theoretically eliminating DLL conflicts), code and supporting resources. Assemblies can be built using the Visual Studio.Net IDE and the Assembly Generation Tool. 1.4. What is J2EE made of? J2EE is Sun’s reference standard for enterprise development, first introduced in December 1999, and now at version 1.3. Core elements of J2EE are described in this section. 1.4.1. Java language Java is an object-oriented language derived from C++, with features that simplify coding such as memory management through garbage collection, no pointers, etc. Java is designed to be “Write once, run anywhere”, this goal being achieved through the use of portable bytecode. 1.4.2. JVM/JRE The JRE (Java Runtime Environment) consists of the Java Virtual Machine, a just-in-time compiler and some foundation classes. Java classes are compiled into platformindependent bytecode that is executed in the JVM. 1.4.3. JSPs and Servlets Java Server Pages (JSPs) are analogous to ASP technology, providing the capability to build dynamic web pages composed of HTML with embedded dynamic components, e.g. references to Beans. Servlets are described as applets that run on the web server, and are used where CGI would traditionally have been employed to build dynamic web applications.
1.4.4. EJB Enterprise Java Beans (EJB) are used to build distributed applications by providing the communications and execution framework for distributed components. Critical services provided by an EJB container include transaction management, security, resource management and persistence. 1.4.5. JDBC Java Database Connectivity (JDBC) is an API for connecting to relational databases, manipulating their contents, and processing the output of issued SQL statements. Numerous database vendors have developed drivers based on the JDBC API. 2. Security Models Enterprise development requires that security targets be met for the development and deployment of code. Development platforms and runtime environments must provide for authentication and authorisation, data integrity, audit trails, non-repudiation and privacy of data. The responsibilities for these tasks are spread across multiple platform elements in a typical n-tier application architecture. This section will attempt to discuss the approaches taken by .Net and J2EE, focussing mainly on the runtime environments. 2.1. .NET Framework security architecture The CLR and base classes are responsible in large part for security functions within the .Net framework. The CLR uses a number of criteria to determine the security permissions of code to be executed, and obtains some security information from XML configuration files. The base classes control access to resources such as the file system by determining the permissions of the caller. .Net’s two primary security functions are described in the following sections. 2.1.1. Code access security Code access security is a core part of the CLR’s security function. Code access security determines the level of trust assigned to a piece of code based on its origins, publisher and other factors. Some key concepts used to define code access security are described below. 2.1.1.1. Evidence-based security .Net uses the concept of “Evidence-based security”, to describe the process by which assemblies are examined by the CLR at runtime. The CLR queries assemblies using the following primary criteria: • Where did this code originate? • Who created this assembly? The first question can be broken out into “Which URL did the assembly originate from?” and “Which zone did the assembly originate from?”. Microsoft uses the concept of zones to describe security environments like the Internet, local networks or intranets, the local machine, etc. Evidence can also be in the form of a digital certificate signed by the publisher of the assembly or the strong name (a unique identifier, consisting of a text name, digital signature, and a public key) of the assembly. The second question is reasonably straightforward – “What information is available on the creator of this assembly?”.
Page 1: J2EE and .Net security 1. Introduct
Page 5 and 6: Role-based security describes the m
Page 7 and 8: protection domains, associated with
Page 9 and 10: Both platforms use similar concepts

J2ee and .Net security, (PDF) - CGISecurity

Create successful ePaper yourself

Delete template?

Save as template?