4WWW95: low level security in Java

author:

frank yellin, Sun Microsystems

security in Java:

frank told us that Java was originally designed for personal assistant type systems. the Java programming language is similar to C, but it was designed to be secure through the following features:

1. the complete source code for both, the compiler and the interpreter are available
2. the Java language is strictly defined
3. no pointer arithmetic available
4. garbage collection
5. extensive compile-time checking
6. class file verification

the bytecodes produce by the Java compiler are executed by means of a runtime system or emulator for the virtual machine's instruction set. the same bytecode can be run on any platform for which a virtual machine is available. before the virtual machine interprets a class file, the later undergoes a four pass verification process to ensure system security:

1. verify correct class file format
2. performs all verifications that can be done without actually looking at the bytecodes
3. this most complex pass inspects the bytecodes, performs data flow analysis and so on. this pass is known as "bytecode verifier".
4. performs tests that were delayed in pass 3 to increase performance

my personal concern: this sounds all very nice, but how do i know that i can trust the virtual machine ?

for more information, see

• the Java language overview
• the Java language overview, a white paper

back to 4WWW95 main document.