This one is about serialization and private keys. The model defines the fundamental security requirements for the Java environment, serves as a basis for a security test plan, and is a first step toward further assurance documentation and analysis. An important piece of work in Java security. The Security of Static Typing with Dynamic Linking A paper by Drew Dean of Princeton, To appear in Proceedings of the Fourth ACM Conference on Computer and Communications Security, April 1997. A paper by Sophia Drossopoulou and Susan Eisenbach to be presented at the 11th European Conference on Object Oriented Programming, June 1997.
Formal analysis is underway.
A Comparison between Java and ActiveX Security A paper by David Hopwood presented at the Compsec '97 - the 14th World Conference on Computer Security, Audit and Control. Java is not type-safe A paper by ATT researcher Vijay Saraswat explaining why Java is not type safe. Type safety is the cornerstone of Java security. Implementing Protection Domains in the Java Development Kit 1.2 By L. Gong and R. Schemers. Published in Proceedings of the Internet Society Symposium on Network and Distributed System Security, San Diego, California, March 1998.