The Java Security API is designed to allow developers to incorporate both low-level and high-level security functionality into their Java applications. The first release of Java Security in JDK 1.1 contains a subset of this functionality, including APIs for digital signatures and message digests. In addition, there are abstract interfaces for key management, certificate management and access control. Specific APIs to support X.509 v3 certificates and other certificate formats, and richer functionality in the area of access control, will follow in subsequent JDK releases.Security Guides
JDK 1.1 also provides a tool that can sign Java ARchive (JAR) files, which can contain classes and other data (such as images and sounds). The appletviewer allows any downloaded applets in JAR files signed (using the tool) by a trusted entity to run with the same full rights as local applications. That is, such applets are not subject to the "sandbox" restrictions of the original Java security model. Later releases will provide more sophisticated security policies, including greater granularity in the allowable trust levels.