Comparing Java and .NET security: Lessons learned and missed

Nathanael Paul

doi:10.1016/j.cose.2006.02.003

2006-07-01

Nathanael Paul *

David Evans

DOI：10.1016/j.cose.2006.02.003

原文链接

查看原文

摘要

En 中文

Many systems execute untrusted programs in virtual machines (VMS) to mediate their access to system resources. Sun introduced the Java VM in 1995, primarily intended as a lightweight platform for executing untrusted code inside web pages. More recently, Microsoft developed the NET platform with similar goals. Both platforms share many design and implementation properties, but there are key differences between Java and NET that have an impact on their security. This paper examines how NET's design avoids vulnerabilities and limitations discovered in Java and discusses lessons learned (and missed) from experience with Java security. (c) 2006 Elsevier Ltd. All rights reserved.

Keyword:

virtual machine security

Java security

.NET security

security design principles

bytecode verifier

malicious code

code safety