Best approach to create a security environment in Java

Question

I need to create a desktop application that will run third party code, and I need to avoid the third party code from export by any way (web, clipboard, file io) informations from the application.
Somethig like:
public class MyClass {
    private String protectedData;
    public void doThirdPartyTask() {
        String unprotedtedData = unprotect(protectedData);
        ThirdPartyClass.doTask(unprotectedData);
    private String unprotect(String data) {
class ThirdPartyClass {
    public static void doTask(String unprotectedData) {
        // Do task using unprotected data.
        // Malicious code may try to externalize the data.
}I'm reading about SecurityManager and AccessControler, but I'm still not sure what's the best approach to handle this.
What should I read about to do this implementation?

Answer 1

Whilst code without any permissions (as supplied through the ProtectionDomain by the class' ClassLoader) cannot access network, file and system clipboard, this does not mean it is entirely isolated.
Even modern cryptographic systems are surprisingly vulnerable to side-channel attacks.
Where an untrusted agent has access to sensitive data, it isn't very feasible to stop any escape of that data. Sure, you can block off overt posting of the data, but you cannot reasonably block off all covert channels.
Steganographic techniques are a particularly obvious way to covertly send sensitive data out amongst intended publications.