Dharmesh Talaviya

Understanding Dot Net Development Framework Security Model

There are various changes made to the security model in the .Net development and they help us by making it much simpler to host, secure as well as provide services to trusted and partially trusted codes.

The Code Access Security (CAS) policy system has been overhauled  as it was not just difficult to use but even experts found it hard to get  right. Another feature that has  witnessed improvements is the Security Transparency model. All of these various improvements have made  it much easier for offshore .Net development team to sandbox various codes as  well as for libraries to safely give away their services.

Brief description - .NET Development  Framework Security

Before you  know how this can help you it is very important to know what this is all  about. Firstly you should know that code  that is just partially trusted is not given permission and is restricted. The  main aim of CAS is to see that the untrusted code runs only once it has  achieved the required permissions and that it performs only how much it is  authorised to do. The whole model can be broadly classified into three main  sections:

 
• Policy- The main purpose of .Net development  framework security policy is to judge a code and give permissions to an  untrusted application. Each code has certain objects that can help decide from  where the code has been uploaded, the publisher, etc. Previous history can be  used to help decide which permissions need to be given to a certain code and  these results are called permission grant sets. But this policy like already  mentioned earlier has now been overhauled in the latest version in-order to  give hosts greater ease of performing their own policy.

 
• Sandboxing- This is a procedure wherein  restrictions are made to assemblies or particular applications within a grant  set. To begin sandboxing-first an application domain that already has a  permission grant for specific applications is created. Sandboxing takes place  for all partially trusted code.

 
• Enforcement- This refers to the procedures that  outsource .Net development team keep all the untrusted or partially trusted  code within its sandbox. Making proper  use of Enforcement APIs helps prevent untrusted codes from performing unwanted  processes. This also helps both hosts as well as libraries to provide services  to a certain extent to partially trusted code. The new transparency model in  the .NET development Framework model 4 makes it easier to do this  securely.

This .Net  development framework security model is of utmost importance to both hosts and  library developers and both of them need each other to move on. Libraries  depend on this model so as to ensure access by untrusted code is strictly  controlled. Even the .Net development outsourced team don’t need to know  exactly how this security model works as the framework itself ensures that the  code in the sandbox is limited to using

Article Tags: Development Framework Security, Framework Security Model, Development Framework, Framework Security, Security Model, Development Team, Partially Trusted

Source: Free Articles from ArticlesFactory.com

ABOUT THE AUTHOR