I will present in this talk an overview of Microsoft's .NET Framework security infrastructure. The .NET Framework's Common Language Runtime -- a language-neutral, type-safe, garbage-collected execution environment -- provides subprocess-level isolation among software components. The CLR's trust management engine dynamically constructs and assigns sets of permissions (capabilities) to assemblies (code distribution units) as each assembly is loaded into the CLR. Stack introspection is used at run-time to provide enforcement of permission requirements and defenses against luring attacks. Security requirements may be specified declaratively in metadata at the class or method level or imperatively in the method body. Common cryptographic techniques are used to provide secure, unspoofable binding among assemblies and support side-by-side execution. As time permits I'll also briefly describe the Framework's new cryptographic object models and included support for the XML Digital Signature standard.
Gates 4B (opposite 490), 12/11/01, 4:30 PM