Common Object Request Broker Architecture (CORBA)

CORBA allows applications to communicate with one another regardless of where they may be stored.

The ORB is the component that sits in the middle that establishes relationships between client and server objects. Using the ORB, a client can locate and use an object on a server object either on the same machine or across a network.

The ORB operates regardless of the processor type or programming language; therefore, it is independent of technology. From a security perspective, not only does the ORB handle all the requests on the system, but it can also enforce security policies and rules. The policies and rules would describe what the users and systems are allowed to perform and also what user and system actions they are not allowed to do.

1. Access control

2. Data protection

3. Non-repudiation

4. Auditing

The client application can send requests through what are called messages to the target object and because the message is sent through the ORB security system, rules and policies can be enforced.

CORBA Implementations

As a best practice from the perspective of security, CORBA implementations need to consider the following as examples:

• Specific CORBA security features that are supported
• Implementation of CORBA security building blocks, such as cryptography blocks or support for Kerberos systems
• Ease by which system administrators can use the CORBA interfaces to set up the organization's security policies
• Types of access control mechanisms that are supported
• Types, granularity, and tools for capturing and reviewing audit logs
• Any technical evaluations, such as those related to the Common Criteria

There are other methods for securing distributed application environments. These include Java RMI and EJB. EJB is a Sun Microsystems model providing similar environments to CORBA by using API specifications for building distributed and component-based applications.

EJB uses Java's RMl implementations for communications in a similar architecture. The EJB server can provide a set of services for transactions, security, and resource sharing.

All of these architectures can support the enforcement of policies and rules that can be applied between interactions of components or objects.