How java's security model work?

The java sandbox model is the security moddel for java.

also 

The Java security model is based on controlling the operations that a class can perform when it is loaded into a running environment. For this reason, this model is called code-centric or code-based.

The following sections explain the basic concepts necessary to understand how this model works:

• Permissions

• Protection Domains and Security Policies

• Security Managers and Access Controllers

For more details about the Java security model, see http://java.sun.com/developer/technicalArticles/Security/whitepaper/JS_White_Paper.pdf.