Li Gong is often suspicious. It's his job to be that way; he's JavaSoft's computer security expert.

As a teenager growing up in China, Li Gong knew the computer would be his ticket to the future. The precocious youngster kept that in mind when he took the National Test, an entrance exam that determines a Chinese student's fate...forever. Young Gong got what he wanted: entrance to a computer science curriculum. "Once you go to a department, you cannot go back," Gong recalls. "I picked computer science."

Gong got both his BS and MS from Tsinghua University and went on to Cambridge to get his doctoral degree in security from the University of Cambridge, England. Despite his credentials, he was at first unable to get the work he wanted in the United States. According to Gong, it was because China was on the U.S.'s "enemies list." Ironically, he would be considered a "security hazard."

Gong went on to become a computer scientist with the Computer Science Laboratory of SRI International (formerly called Stanford Research Institute), Menlo Park, California. He conducted research in the fields of security and fault-tolerance of distributed systems and networks.

While maintaining an association with SRI, Gong is also a member of the editorial board of the Journal of Computer Security, and co-chair of several conferences on computer security. Gong is so well respected in the security field that JavaSoft eagerly brought him on board to work on Java security issues, as the Java Security Architect, which includes managing the security engineering group. Over the years, work with SRI has revolved around these issues:

• Enclaves: a secure group platform (selfprotecting computing environment) for a networked environment. Gong is designing and building a TCP/IP-based system for enabling users across the Net to dynamically establish and disband secure, private groups. Within a group, members can engage in shared, but not necessarily identical activities.

• Security of ATM networks. An investigation of security issues, which turn out to be sometimes similar to, and sometimes different from, those in IP networks.

• Combining fault tolerance with security, Gong has borrowed ideas from Fail-Stop Processors (FSPs) to construct a model of fail-stop security protocols. (Such processors, upon failure, halt before any error is visible from the outside.)

• Gong is exploring how authentication in classical Byzantine agreement can be much more resilient to protocol security failures than traditional protocols using Signed Messages (digital signatures). Gong chose only publicly and widely accepted cryptographic algorithm standards (official or de facto).

• Secure MPEG-1/2 video. Gong is dissecting the simple selective encryption of MPEG-1 video. Gong's new paper, "An Empirical Study of Secure MPEG Video Transmissions," explains how you see parts of pictures by playing "encrypted" ciphers directly on a regular MPEG player.

• Trusted multicast. This project is to develop architectures and protocols for building secure multicast facilities in environments such as the Net. Mobility issues are also considered.

Q&A

JDC: Before you came to work for JavaSoft, what was your opinion of Java's security?

LG: Suspicious. Java was marketed as a secure language, but when anyone would insist it was "secure," we--in the security field--sat up and said, "Okay, let's take a look." There's still a perceived lack of security. Java bugs and holes were found in the early stages, and Java security became a hot issue.

JDC: How did you come to work at Javasoft?

LG: I actually called Sun up and pointed out the problems to management. Then one day, they decided they needed a security person, and they called me up.

JDC: What was your initial game plan?

LG: To basically build a security team. Then the plan was to recognize customer needs and problems that needed to be fixed. There's a new architecture for Java security that is being implemented now. The JDK's architecture is stronger and flexible. So, basically we are meeting the customer's demands.

JDC: Give me an example of a security scenario that you've rectified?

LG: Suppose you go to the Charles Schwab home page, and some Java applet comes down the pipe, telling you to buy or sell a certain stock. Well, you want to be able to authenticate that transaction; in other words, the user needs to know you are talking to Charles Schwab and vice versa. So you want the valid applet, especially if you want it to interact with your banking account. We provide Charles Schwab the tools to make a strong security package easy and effective. When an applet is downloaded, there is a check to see if the applet code is signed (using digital signatures). We're working to secure channels back and forth, while providing a set of tools for others to build applications.

JDC: What's the best thing about Java?

LG: People like Java's platform-independence. There's no configuration tying it to the browser or software distribution. That's really the convenience. And it's easy to program.

JDC: What's the thing people fear most about Java security?

LG: People don't have a handle on what Java security means, and scare articles in the Wall Street Journal don't help. Somehow there is this perception that Java security is out of control. And this is what I'm trying to correct.

JDC: What's the biggest security challenge that you've faced?

LG: You can't design architecture that is tied to a particular style to a degree that it can't evolve. For instance, JavaBeans is a new technology for using Java as a component of ready-made software. What is the security challenge here? You have to break down the security issues of JavaBeans into minimum units. And you have to have an eye on the future to handle JavaBeans tomorrow. You have to define the right features for the foreseeable future.

JDC: What neat things will develop as a result of Java?

LG: A Java card, or a universal carrying card that runs Java. So when you put it into an ATM, it runs a VISA applet; when you go to a Web page, it communicates.

JDC: What's a big security mistake companies make?

LG: Many companies think they need to work on their own Java security problems. We'll provide that information for them--or they could end up doing more bad than good.

JDC: What does the future bode for Java?

LG: It's a cool language--it should be the common tool. One of the barriers in the wide deployment of Java is this fear of insecurity. My work is to bring this barrier down.

Building a Better Sandbox
What exactly does it take to build a secure "sandbox"?