,NET Security - Code Access Security

.NET Security Concepts

1. Evidence (CAS)
2. Permission (CAS)
3. Permission Set (CAS)
4. Code Group (CAS)
5. Security Policy (CAS)

6. Identity (RBS)
7. Principal (RBS)


Evidence

Evidence is the information that the runtime collect about an assembly to determine which code group the assembly belongs.

Evidence is used by the .NET Framework Code Access Security System at Assembly Load Time to assign Permissions to the assembly.

Evident normally describe the assembly’s origin such as application directory, website or URL and assembly’s identity such as hash, strong name or publisher.

In CAS evidence is used just as a person’s passport, password or PIN to prove the identity and associate certain level of trust.

Common Evidence Types in .NET

Application Directory

The directory in which assembly resides.

Site

The site from where the assembly is downloaded such as www.microsoft.com

URL

The URL from where the assembly is downlaoded such as

www.microsoft.com/projects/myassembly.exe

Zone

The zone in which the assembly is running such as My Computer, Local Intranet or Internet.

Publisher

The assembly’s publisher digital signature, which uniquely identify the developer of the assembly.

Strong Name

The strong name that uniquely identify the assembly name and version.