14th IEEE International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprise (WETICE'05) (2005)
June 13, 2005 to June 15, 2005
Almut Herzog , Linkoping University, Sweden
Nahid Shahmehri , Linkoping University, Sweden
<p>Web browsers, web servers, Java application servers and OSGi frameworks are all instances of Java execution environments that run more or less untrusted Java applications. In all these environments, Java applications can come from different sources. Consequently, application developers rarely know which other applications exist in the target Java execution environment.</p> <p>This paper investigates the requirements that need to be imposed on such a container from a security point of view and how the requirements have been implemented by different Java application containers.</p> <p>More specifically, we show a general risk analysis considering assets, threats and vulnerabilities of a Java container. This risk analysis exposes generic Java security problems and leads to a set of security requirements. These security requirements are then used to evaluate the security architecture of existing Java containers for Java applications, applets, servlets, OSGi bundles, and Enterprise Java Beans. For comparison, the requirements are also examined for a C++ application.</p>
N. Shahmehri and A. Herzog, "An Evaluation of Java Application Containers according to Security Requirements," 14th IEEE International Workshops on Enabling Technologies: Infrastructure for Collaborative Enterprise (WETICE'05)(WETICE), Linkoping, Sweden, 2005, pp. 178-186.