Security - Telenor

More documents

Recommendations

Info

52 7 FORE Systems. Firewall Switching Agent. White Paper, October 1998. 8 Fulmer, C. Firewall Product Overview. (1999, December 30) [online] – URL: http://www.waterw. com/~manowar/ vendor.html. 9 ICSA. ICSA Firewall Policy Guide V2.00, Security White Paper series. ICSA (1999, December 15) [online] – URL: http://www. icsa.net/services/consortia/firewalls/fwpg. shtml. 10 Moran, T. Fight Fire with Firewalls. Microsoft Corporation (1998, July 27) [online] – URL: http://msdn. microsoft.com/workshop/server/proxy/server 072798.asp. 11 Newman, D. Super Firewalls. Data Communications, Lab Tests. (1999, May 21) [online] – URL: http://www.data.com/. 12 OMG. Joint Revised Submission, CORBA/ Firewall Security+Errata. OMG Document. OMG (1998, July 6) [online] – URL: ftp://ftp.omg.org/pub/docs/orbos/ 98-07-03.pdf. 13 OMG. The CORBA Security Service Specification (Rev. 1.2). OMG (1998, January 15) [online] – URL: ftp://ftp.omg.org/pub/ docs/ptc/98-01-02.pdf. 14 OMG. The Object Management Group. (2000, June 20) [online] – URL: http://www.omg.org/. 15 Phonex Adaptive Firewall Technology, Multi-Layer Stateful Inspection. White Paper. Progressive Systems, Inc. (2000, June 20) [online] – URL: http:// www. progressive-systems.com. 16 Schreiner, R. CORBA Firewalls White Papers. TechnoSec Ltd. (1998, December 15) [online] – URL: http://www. technosec. com/whitepapers/corba/fw/main.html 17 Thompson, M J. Corporate Network Security (1998, September 21) [online] – URL: http://www.thestandard.com.au/metrics/ display/0,1283,750,00.html 18 Warroom Study. Security in Cyberspace : Hearings before the Permanent Subcommittee on Investigations of the Committee on Governmental Affairs. United States Senate, 104 th Congress, 2 nd Session, 1996. ISBN 0- 16-053913-7. (http://www.warroomresearch. com/researchcollabor/infosecuritysurvey. htm) Telektronikk 3.2000
Habtamu Abie (42) is Research Scientist at the Norwegian Computing Centre. He has previously worked as Senior Engineer and Research Scientist at Telenor R&D (1997– 1999) and as Scientific Associate and Scientific Fellow at CERN in Geneva, Switzerland (1989–1993). From 1994 to 1997 he also held a research position at ABB Corporate Research and worked as a Software Development Engineer at Nera AS and Alcatel Telecom Norway AS. He received his Engineering Diploma in Electrical Data Processing from Gjøvik Engineering College (1983), and his B.Sc. (1985) and M.Sc. degrees (1988) in Computer Science from the University of Oslo. He is also working towards his Ph.D. in Computer Science at the Department of Informatics, University of Oslo and UNIK. His past and present research interests encompass security for distributed systems, distributed object computing, architecture and methodology, formal methods and tools, data acquisition and control systems, hard realtime systems, and mobile and personal computing. habtamu.abie@nr.no Telektronikk 3.2000 CORBA Firewall Security: Increasing the Security of CORBA Applications *) HABTAMU ABIE Traditional network firewalls prevent unauthorised access and attacks by protecting the points of entry into the network. Currently, however, there is no standard mechanism by which a firewall identifies and controls the flow of Internet Inter-ORB Protocol (IIOP), that has become the de-facto standard interoperability protocol for Internet providing “out-of-thebox” interoperation with ORBs, and is based on vendor-neutral transport layer. The OMG’s intention in proposing its CORBA Firewall Security is to provide a standard approach to the control of IIOP traffic through network firewalls, allowing controlled outside access to CORBA objects, thus increasing their accessibility and security. This article describes and analyses the OMG’s CORBA Firewall Security, paying special attention to such issues as the specific problems associated with it, how current firewall techniques are used to control CORBA based communication, their potential limitations and how these might be overcome, and the various aspects of firewall traversal. In addition, a possible CORBA firewall application scenario is presented. Some CORBA Firewall compliant products are emerging on the market, and this current trend in the implementation of CORBA firewall products will also be described. 1 Introduction Nowadays networks are subject to continual change and modification as they are adapted to changing circumstances and new situations brought about by reorganisations, acquisitions, outsourcing, mergers, joint ventures and strategic partnerships. In addition, networks are increasingly connected to the Internet. Due to these developments, the maintenance of security has become a far more complicated matter than hitherto. Common Object Request Broker Architecture (CORBA) has become the de-facto standard. Its extensive infrastructure supports all the features required by new business situations of the type mentioned above, and its increasing use in open systems necessitates the development of sophisticated security technologies at the interface between networks of different security domains such as between Intranet and Internet or Extranet. One of the best ways to ensure interface security is the use of a firewall. Conventional network firewalls (see [1] for an overview of firewall technologies) prevent unauthorised access and attacks by protecting the points of entry into the network. Currently, however, there is no standard mechanism by which a firewall identifies and controls the flow of IIOP, since IIOP has become the de-facto standard interoperability protocol for Internet providing “out-of-the-box” interoperation with Object Request Brokers (ORBs). The Object Manage- ment Group (OMG) [10], a non-profit consortium with a current membership exceeding 840 organisations, whose purpose is to promote the theory and practice of object technology in distributed computing systems, is the body responsible for setting standards and specifications for CORBA Firewall Security. The purpose of the OMG’s CORBA Firewall Security is to provide a standard approach to control IIOP traffic through network firewalls, allowing outside access to CORBA objects, thereby increasing their security. This article discusses CORBA Firewall Security with the emphasis on such issues as the specific problems associated with it, how CORBA communication can easily and securely be handled by firewalls, how current firewall techniques are used to control CORBA based communications and their potential limitations, and how to overcome such potential limitations. It also describes various aspects of firewall traversal, IIOP/SSL, callbacks, desired proxy behaviour, chaining or pass-through mode for IIOP/SSL, and CORBA interworking through firewalls. In addition, this article assesses the CORBA Firewall implementation technologies available on the market, such as WonderWall of IONA, Inprise’s Gateway, ObjectWall of Technosec, NAI’s ORB Gateway, etc. This discussion is essential to an understanding of current trends in the development of CORBA firewall products. *) The work was carried out while the author was a Research Scientist at Telenor R&D. 53
Page 2 and 3:
Telektronikk Volume 96 No. 3 - 2000
Page 4 and 5: Øyvind Eilertsen (34) is Research
Page 6 and 7: 4 E(P) = a ⋅ P + b (mod 26) D(C)
Page 8 and 9: 6 In 1997, NIST initiated the proce
Page 10 and 11: 8 decrypt the signed hash value, re
Page 12 and 13: Lars R. Knudsen (38) is Professor a
Page 14 and 15: Table 1 Timetable for AES Table 2 T
Page 16 and 17: 14 K m i Stream cipher algorithm Fi
Page 18 and 19: 16 6 Use of Encryption in Telecommu
Page 20 and 21: 18 mode, integrity mode, key divers
Page 22 and 23: 20 7 Beaver, D. Computing with DNA.
Page 24 and 25: 22 In both cases, my trust depends
Page 26 and 27: 24 A number of standard PC applicat
Page 28 and 29: Henning Wright Hansen (28) is Resea
Page 30 and 31: 28 Securing Locally Stored Informat
Page 32 and 33: Figure 3 A simple Public Key Infras
Page 34 and 35: 32 The Policy Control Center An imp
Page 36 and 37: Tønnes Brekne (31) is on leave fro
Page 38 and 39: 36 Sets definable by such predicate
Page 40 and 41: 38 A failure is caused by some type
Page 42 and 43: Figure 1 This figure illustrates th
Page 44 and 45: 42 ating system(s) and/or platform
Page 46 and 47: Message Sender Recipient Message pa
Page 48 and 49: 46 Assume some agent a carries with
Page 50 and 51: 48 gateway from attack, while the i
Page 52 and 53: 50 transfer at the expense of secur
Page 56 and 57: Figure 2-1 Object invocations throu
Page 58 and 59: Figure 4-1 3 Levels of different fi
Page 60 and 61: 58 phase two, in which the client r
Page 62 and 63: 60 5 CORBA Firewall Traversal 5.1 F
Page 64 and 65: 62 7.2 Visibroker Gatekeeper of Inp
Page 66 and 67: 64 References 1 Abie, H. An Overvie
Page 68 and 69: Cost Figure 1 Minimising total cost
Page 70 and 71: 68 In the coming years it is likely
Page 72 and 73: 70 financial, social, environmental
Page 74 and 75: Consequence 72 Insignificant Substa
Page 76 and 77: 74 in a one week time-frame, using
show all

Security - Telenor

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?