PrismTech

Xtradyne I-DBC IIOP Firewall

I-DBC is a turn-key solution for IIOP firewalling and complete CORBA security in mission critical environments.

PrismTech offers enterprises I-DBC to eliminate the risks associated with the deployment of CORBA and EJB based applications over the Internet or other networks outside the firewall. The IIOP DBC acts as a security gateway (i.e., as a CORBA firewall) that can be integrated transparently into existing systems without any modification of the existing software system.

I-DBC concentrates all incoming IIOP traffic on exactly one transport address (1 IP address, 1 port). In order to make CORBA/EJB and NAT operate together, it automatically and transparently adapts CORBA/EJB object references (IORs) to NAT translated addresses. The I-DBC performs SSL encryption and authenticates clients and servers using a variety of authentication mechanisms.
 

For reliable application level firewall security, the I-DBC performs deep packet inspection for all data streams expected to be IIOP messages and blocks all traffic with incorrect, malformed, or malicious content. The I-DBC protects the internal network and applications infrastructure from attacks, the CORBA/EJB applications from misuse and unauthorized access, and the IIOP messages in transfer over the outside network from exposure and tampering.

The product ensures a high degree of security by performing strong authentication, authorization, auditing, and reliable encryption. It enables easy CORBA security management by offering centralized policy administration. The product enables application end-to-end security.
 

The product - in particular the IIOP proxy component - has been designed and implemented following well established firewall design principles and implementation practices. It adds an additional layer of security for defense-in-depth to multi-tier applications, not only in scenarios with IIOP end-to-end, but also in typical J2EE scenarios.

For J2EE Web applications, the I-DBC constitutes an additional security barrier between the Web Server and the EJB server, providing reliable security for the business logic in the EJB server even in the case of successful attempts from the Internet to take over the Web Server.

A Complete Quality Solution: Transparency, Performance, Scalability, High-Availability

Xtradyne's CORBA firewall (I-DBC) easily integrates with a company's existing network infrastructure and does not require any modifications to existing applications. The software provides ultimate deployment flexibility. High availability is supported through full support for clusters (for details see our white paper on high-availability and scalability).

Xtradyne's IIOP firewall product is delivered with all software components necessary to operate a corporate IIOP firewall (application-level gateway), including a bastion host component, the Xtradyne Security Policy Server, and the Xtradyne Administration Console. For details, see the product data sheet.

For environments with a variety of installed software middleware, the IIOP DBC offers full support to be deployed together with Xtradyne's WS-DBC, the Web Services Domain Boundary Controller, thus saving investments in scenarios that require security for both technologies.

• [+]Background

  Traditional firewall technology, such as packet filtering and stateful inspection, does not provide the means to securely run CORBA and EJB based distributed applications through existing firewall installations: CORBA and EJB middleware do not work together with traditional firewall concepts, and traditional firewalls do not provide application level security, such as fine-grained access control.

  There are two obvious problems for the use of the Internet Inter-ORB Protocol (IIOP) across today's firewalls:

  

  Firstly, the dynamic allocation of addresses by CORBA and EJB middleware makes it difficult to know in advance the host and port addresses used for transactions. Thus, firewall administrators cannot set firewall rules for the passing of IIOP traffic through firewalls that allow IIOP to pass but do not weaken the existing firewall's security.

  Secondly, the addressing information of CORBA objects and Enterprise Java Beans, contained in the object references, is invalidated when crossing a Network Address Translating router or firewall.

  Furthermore, reliable enterprise firewall security must comprise deep packet inspection and security enforcement at the application protocol level for all IIOP traffic crossing the enterprise's domain boundary. User authentication, authorization, content filtering, encryption, and security audit are essential requirements for the secure exposure of CORBA and EJB based services to business partners and the outside world.

  The only viable solution for the problems and requirements mentioned above is an application level firewall component for the enterprise's firewall installation, an IIOP security gateway.

  PrismTech provides the only complete and middleware independent turn-key solution for IIOP firewalling and CORBA/EJB server security in high-security, high-availability, and high-performance environments

• [+]Features

  General Features

  Full firewall security for IIOP traffic
  No need to open whole port ranges for Corba or EJB access, concentration of all IIOP traffic to 1 transport address (1 port on 1 IP address), deep packet inspection.

  CORBA security without programming
  Transparent integration into your network infrastructure. No application code changes are required.

  Vendor independence
  Independent of specific IIOP middleware products, ensuring interoperability with all Corba and EJB compliant server products.

  Transparent support for network address translation
  With the I-DBC, Corba and EJB applications work seamlessly together with NAT-Routers in all possible scenarios and without special configuration of the applications.

  Unified security management
  Security management of heterogeneous Corba and EJB servers can be centralized instead of managing island solution for each server.

  Simple intuitive security administration
  The I-DBC comes with a convenient and easy-to-use graphical user interface.

  Expressive and powerful security policy model
  Detailed and fine-grained security policies can be defined to control authentication, authorization, and audit. Authorization policies are based on concepts such as groups, roles, authentication levels, etc..

  High-performance and throughput, low latency
  Complete performance optimized native code implementation.

  Linear scalability, High-availability
  The I-DBC supports several clustering technologies for load balancing and high-availability.

  Individual Traffic Shaping
  Allows to limit the available bandwidth for individual clients to guarantee fairness and service availability for all users.

  ---

  Security Features

  Fine-grained, role-based access control
  The I-DBC provides advanced policy concepts that let administrators write policies that are both expressive and scalable. Access control can be enforced at the level of individual objects, and at their single operations, too.

  Rich set of authentication mechanisms
  The following authentication mechanisms are supported: X.509, RSA SecurID, UserID/Password schemes, IP addresses, public.

  Message confidentiality
  TLS/SSL encryption to protect messages against eavesdropping and single block analysis.

  Message filtering
  Administrators can conveniently define expressive message filters to enforce content-based access control and thus thwart application-level attacks, such as SQL injection.

  Transport security
  TLS/SSL for all communication links, additionally IP-based authentication.

  Deep Packet Inspection
  Message header inspection and enforcement of message size limitations.

  Security Policy Server
  Centralized security management with separate enterprise policy server component, which can be securely deployed in a trusted network.

  Traffic Overflow Control
  Safeguards against certain Denial-of-Service attacks.

  Online Certificate Status Protocol (OCSP)
  OCSP is supported to check for credential revocations.

  Corba Standards
  The I-DBC fully supports the following CORBA standards: OMG CORBA 2.3 - 3.0, Support for GIOP/IIOP protocol versions 1.0, 1.1, 1.2, 1.3 including support for Bi-Directional GIOP, Java RMI over IIOP, CORBA Interoperable Name Service (INS).

  ---

  Management Features

  Easy import of EJB role definitions
  Convenient import facility for EJB deployment descriptors.

  Easy import of IDL interface definitions
  Convenient import facility for IDL interface definitions to simplify the definition of access control policies and the definition of message filters to enforce content-based access control.

  Support for multiple, concurrent administrator access and role-based administration rights
  The I-DBC is designed for enterprise deployment and fully supports concurrent administrator access, which is controlled by role-based definition of administrator permissions.

  Auditing and Monitoring
  The I-DBC provides command line interfaces and graphical user interface features for run-time auditing and monitoring.

  SNMP Support
  Audit events can trigger SNMP traps to allow for integration with System Management tools.

  Secure logging
  Logging mechanisms are separated from enforcement mechanisms and protected in the policy server.

  Policy versioning and rollback
  The I-DBC internally versions policy and configuration data and supports rollbacks to previous versions in case of administrator errors

• [+]Datasheet

  General Characteristics:

  IIOP application-level firewall (for CORBA and Java-RMI/IIOP) with extended CORBA/IIOP security capabilities.

  Feature Summary:

  • Secure firewall traversal for IIOP traffic including concentration of transport connections to single IP address and port. Transparent support for Native Address Translation and Virtual Service End-points
  • 3A security (authentication, authorization, auditing) + security administration
  • IIOP message content inspection and enforcement of message size limitations
  • Integrated Traffic Shaping provides bandwidth limitation for individual clients to guarantee fairness and service availability for all users
  • High Performance solution which can even reduce transaction latency by off-loading
  • Cluster support allowing for high availability and load balancing

  Supported CORBA Standards:

  • OMG CORBA 2.3 – 3.0 (GIOP/IIOP 1.0-1.3)
  • Support for Java RMI over IIOP
  • CORBA Interoperable Name Service (INS)

  Security Standards:

  • X.509
  • RSA SecurID Authentication
  • OCSP 1.0
  • SSL/TLS
  • XSSO and Sun PAM

  Interoperability:

  CORBA applications built with the following Application Server and ORB products have been successfully operated with the IIOP Domain Boundary Controller (this list will be continually extended; additional product application experience information available on request):

  • BEA WebLogic Server
  • Borland Visibroker and Borland Enterprise Server
  • IBM WebSphere Application Server
  • IONA ASP, Orbix 2000, Orbix 3.3, and Orbacus
  • Oracle 8i ORB
  • SUN JavaIDL, and RMI overIIOP, and EJB reference implementation
  • Various Open Source ORBs including JacORB, OmniORB, TAO/ACE, ORBit, OpenORB, MICO, and IIOP.net

  Supported Operating Systems:

  Linux/x86 and Solaris/x86 editions:

  • RHEL 3 WS, ES or AS Update 4 (and higher)
  • RHEL 4 WS, ES or AS Update 4 (and higher)
  • RHEL 5 Client or Server (and higher)
  • SuSE Professional and Enterprise Linux 8.x and higher
  • Novell SUSE Linux Enterprise 10.x, and openSUSE 10.x
  • Sun Solaris 10

  Solaris/UltraSPARC edition:

  • Sun Solaris 8, 9, and 10

  System Requirements:

  Linux/x86 and Solaris/x86 editions:

  • PC with 800 MHz Intel Pentium III processor (or equivalent) and later (multi-core and multi-processor systems supported)
  • Memory: 512 MB minimum; 1 GB recommended
  • Hard disk space: 256MB minimum, 1 GB recommended
  • 1 network interface card (NIC); up to 3 NICs supported

  Solaris/UltraSPARC edition:

  • Sun Server with single UltraSPARC IIi processor 650 MHz or higher (multi-core and multi-processor systems supported)
  • Memory: 512 MB minimum; 1 GB recommended
  • Hard disk space: 256 MB minimum, 1 GB recommended
  • 1 network interface card (NIC); up to 3 NICs supported

  Support for optional SSL accelerator cards:

  • nCipher nFast Accelerator
  • SUN Crypto Accelerator 1000

  LDAP server support:

  • Microsoft Active Directory and Sun ONE Directory Server
  • Support for other LDAP Directory Server products on request

  ---

  Administration Console

  General characteristics:

  The Administration Console is a Java rich client application with a convenient and easy-to-use graphical user interface.

  Supported Operating Systems:

  • Microsoft Windows 2000 SP2, and XP SP2
  • RHEL 3 WS, ES or AS Update 4 (and higher)
  • RHEL 4 WS, ES or AS Update 4 (and higher)
  • RHEL 5 Desktop Client or Server (and higher)
  • SuSE Professional and Enterprise Linux 8.x and higher
  • Novell SUSE Linux Enterprise 10.x, and openSUSE 10.x
  • Sun Solaris 10 on x86
  • Sun Solaris 8, 9, and 10 on Sun UltraSPARC

  Minimum System Requirements:

  •  800 MHz Intel Pentium III processor (or equivalent) and later
  • Memory: 512 MB minimum
  • Hard disk space: 200 MB minimum
  •  1 network interface card, or more

• [+]Performance Data

  Detailed IIOP Domain Boundary Controller Performance Data

  

  (1) outgoing messages plus incoming messages
  (2) measured at the client side; time between sending the request message and receiving the reply message
  (3) outgoing messages plus incoming messages
  (4) SSL between Client and BDC

  Client runs on Dual PIII 650Mhz with 512 MB RAM
  DBC runs on single PIII 866Mhz with 512 MB RAM
  Server runs on Dual XEON PIII 700Mhz with 512 MB Ram

   

  

  

  

• [+]Deployment Examples

  A typical deployment scenario is the screened subnet firewall architecture. As shown in the figure below two packet filters are used to create an outer, screened subnet or demilitarized zone (DMZ). This subnet contains the IIOP Domain Boundary Controller, which provides the gateway to IIOP receivers located inside the protected domain.

   

  

   

  The IIOP receiver can be a standalone application, or a container environment such as an EJB application server. The exterior firewall (packet filter) is the connection point to the public network. It restricts internet access to specific systems in the screened subnet and allows only these systems to access the internet. It blocks all other traffic from/to the public network. The interior firewall (packet filter) restricts access from the protected network to specific systems on the screened subnet and allows only these to access the protected network. It blocks all other traffic to the protected domain.

  Other Deployment Examples

  The I-DBC is an infrastructure building block that can be deployed in many ways, in diverse scenarios. In the figure below you see other typical deployments in various alternatives, e.g. for the protection of EJB servers in J2EE scenarios, and for the protection of Corba enabled mainframes.

  

Xtradyne WS-DBC - The XML/SOAP Firewall for Enterprises

The Web Services Domain Boundary Controller (WS-DBC) provides enterprises the specific, encompassing, and reliable protection needed for Web Services: against malformed messages and malicious content (XML, SOAP) at the company's domain boundary (firewall, DMZ), while in transit by means of encryption (SSL at transport level, XML Encryption and XML Digital Signature at field level), and for Authentication, Authorization, and Audit (user, group, role, content based access control).

The product is a powerful, flexible, enterprise-grade XML/SOAP Firewall solution specifically designed for use in environments that demand the utmost in performance, scalability, availability, and policy management (such as telecommunications and finance). Easy and effortless installation makes it particularly suitable for the secure XML-based integration of ERP systems, within the enterprise, and with partners outside the firewall.

The WS-DBC is an XML/SOAP firewall that reliably protects against all the specific risks associated with the exposure of Web Services across the company's firewall and the exchange of XML messages over external networks. The product hides Web services behind virtual service endpoints and inspects all SOAP messages, blocking messages with incorrect, malformed, or malicious content. It protects applications from misuse and unauthorized access, and the XML messages on the network from eavesdropping and tampering.

The WS-DBC is a WS-Security gateway that provides all security functions needed for the detailed control of access to the company's XML based application systems. It performs authentication, authorization, and audit functions for all service requests. It enables centralized security administration for a multitude of XML Web Service based application systems with large numbers of (internal and external) users. The WS-DBC as a highly secure policy enforcement point can be integrated transparently without any modifications of the existing software.

• [+]Background

  Enterprise Web Services Need Thorough Firewall Protection

  XML-based Web Services are a convenient and powerful way for companies to deploy new business services and to integrate existing business applications. Interoperability based on standards such as SOAP and WSDL makes applications and services accessible for a wide range of other applications and users.

  Web Services extend the reach of an enterprise's business functions from intranet clients to the site of business partners that access services over extranets or the Internet.

  The open and flexible nature of the XML/SOAP messaging framework enables easy integration, but it can also expose corporations to severe security risks:

  
   

  • With HTTP as the underlying transport protocol and access over port 80, SOAP messages tunnel existing corporate firewall installations. Without appropriate security checks this powerful messaging technology undermines the company's firewall security.
  • Malicious SOAP messages can cause damage to critical computing assets in the internal network, such as databases and backend systems.
  • Unauthorized users can illegally access services and data via Web Services interfaces of the company's application systems.
  • SOAP messages in transfer over unprotected networks are prone to eavesdropping, forgery, and other forms of misuse.

  Without answers to these security threats, deploying Web Services in production environments means serious risks for the security and reliability of the company's business processes. The introduction of Web Services must be accompanied by the introduction of appropriate security technology, most importantly at the enterprise′s domain boundaries.

  Safeguarding the Business

  Firewall installations must be complemented with application level gateways that perform deep packet inspection on all SOAP traffic crossing the enterprise firewall. Each Web Service must be protected by authentication, authorization, and audit (AAA).

  Integrity and confidentiality of the information must be protected during processing and while in transit. Each access to a service must be controlled. Authorization models must fit the requirements of typical Web Services applications, such as in extranet and B2B scenarios.

  Content inspection is necessary to prevent application-level attacks that are based on malicious message content. Possible attacks include virus-ridden binary message content, hand-crafted command injections, or other sophisticated application-level attacking techniques. Validating and filtering messages can detect these attacks and also prevent the leakage of internal data.

  Finally, security must live up to the typical operational requirements in enterprise settings. Enterprise services and XML security integration must be possible without undue effort, best with application vendor independent security gateways. All message controls must be performed at wire-speed, and all security functions must be extremely scalable and highly available.

• [+]Features

  General Features

  Full application security for Web Services as XML/SOAP firewall
  Deep packet inspection for all SOAP messages. Each message is checked for syntax and content.

  Web Services/SOAP security without programming
  This SOAP Security gateway can be transparently integrated into your application and network infrastructure. No application code changes are required.

  Security integration of various service platforms
  By supporting open standards, this SOAP firewall integrates with all Web Services platforms and also with other vendors' security services.

  Unified security management
  Security management of heterogeneous service platforms can be centralized instead of managing island solutions for each service platform.

  Simple intuitive security administration
  This SOAP firewall comes with a convenient and easy-to-use graphical user interface.

  Incoming and outgoing access control
  The WS-DBC can be used to protect services as well as to control outgoing data.

  Expressive and powerful security policy model
  Detailed and fine-grained security policies can be defined to control authentication, authorization, and audit. Authorization policies are based on concepts such as groups, roles, authentication levels, etc..

  High-performance and throughput, low latency
  Highly performance-optimized, native code implementation.

  Linear scalability, High-availability
  The WS-DBC supports several clustering technologies for load balancing and high-availability.

  Full support for business federation through federated trust
  The WS-DBC provides full support for secure business role assignment and authorization for extranet and B2B scenarios. Enterprises benefit from deploying SOAP firewalls on both partner enterprises to easily map credentials and integrate security policies.

  ---

  Security Features

  Virtual service endpoints
  By exposing virtual service addresses to clients, the WS-DBC insulates actual services from direct access and supports flexible mappings from virtual to actual services.

  Fine-grained, role-based access control
  The WS-DBC provides advanced policy concepts that let administrators write policies that are both expressive and scalable.

  Rich set of authentication mechanisms
  The following authentication mechanisms are supported: X.509, SAML, HTTP Basic Authentication, RSA SecurID, IP addresses, public.

  Web Services standards
  The WS-DBC fully supports the following Web Services standards: WSDL, SOAP, SOAP attachments, XML Digital Signature, XML Encryption, WS-Security, SAML, XACML.

  Message validation
  The WS-DBC can validate SOAP messages using XML Schema to enforce conformance of incoming XML data with the data types expected by the application.

  Message filtering
  Administrators can conveniently define expressive message filters to enforce content-based access control and thus thwart application-level attacks, such as SQL injection.

  Message integrity
  Message authenticity and integrity is protected using XML Digital Signature.

  Message confidentiality
  XML encryption to protect messages against eavesdropping and single block analysis.

  Transport security, encryption
  TLS/SSL for all communication links, additionally IP-based authentication.

  Security Policy Server
  Centralized security management with separate enterprise policy server component, which can be securely deployed in a trusted network.

  Credentials mapping
  The WS-DBC provides flexible and freely configurable credentials mappings for B2B scenarios.

  Online Certificate Status Protocol (OCSP)
  OCSP is supported to check for credential revocations.

  ---

  Management Features

  Simple exposure of Web Services
  WSDL descriptions can be conveniently imported.

  Enterprise integration with LDAP support
  Policies can be stored either in flat files or in enterprise LDAP directories (iPlanet, Active Directory), thus enabling integration with existing user and group management.

  Support for multiple, concurrent administrator access and role-based administration rights
  The WS-DBC is designed for enterprise deployment and fully supports concurrent administrator access, which is controlled by role-based definition of administrator permissions.

  Auditing and Monitoring
  The WS-DBC provides command line interfaces and graphical user interface features for run-time auditing and monitoring.

  Secure logging
  Logging mechanisms are separated from enforcement mechanisms and protected in the policy server.

  Policy versioning and rollback
  The WS-DBC internally versions policy and configuration data and supports rollbacks to previous versions in case of administrator errors.

  Delegated security management per application
  Responsibility for single applications can be separated and delegated according to the existing organization. For example, the firewall security group only administers perimeter security issues; whereas for each application, the responsible operation team defines and manages application specific security.

• [+]Datasheet

  General Characteristics:

  XML Web Services (SOAP/WSDL) application-level firewall with extended XML/WS-Security capabilities.

  Feature Summary:

  • 3A security (authentication, authorization, auditing) and administration
  • User, group and role-based access control, fine-grained down to single operations
  • Virtual service endpoints mask service addresses
  • SOAP message validation
  • SOAP content inspection
  • Authorization and access control based on parameter values
  • high performance, high availability, highly scalable
  • Versioning of security policies and delegation of administration rights (administration roles)
  • Cluster support allowing for high availability and load balancing

  Web Services Standards:

  • WSDL 1.1, WSDL 2.0
  • XML Schema
  • SOAP 1.1, SOAP 1.2
  • XPATH 1.0
  • XML Digital Signature 1.0
  • XML Encryption 1.0
  • XACML 1.0
  • WS-Security 1.0, WS-Security 1.1
  • SAML

  Security Standards:

  • X.509
  • HTTP Basic Authentication
  • OCSP 1.0
  • SSL/TLS

  Interoperability:

  Web Services built with the following products have been successfully operated with the Web Services Domain Boundary Controller (this list will be continually extended; additional product application experience information available on request):

  • BEA Weblogic
  • Microsoft .NET
  • IBM WebSphere
  • Apache SOAP and Axis

  Supported Operating Systems:

  Linux/x86 edition:

  • RHEL 3 WS, ES or AS Update 4 (and higher)
  • RHEL 4 WS, ES or AS Update 4 (and higher)
  • RHEL 5.1 Client or Server (and higher)
  • SuSE Professional and Enterprise Linux 8.x and higher
  • Novell SUSE Linux Enterprise 10.x, and openSUSE 10.x

  Solaris/UltraSPARC edition:

  • Sun Solaris 8, 9, and 10

  Minimum System Requirements:

  Linux/x86 edition:

  • PC with 800 MHz Intel Pentium III processor (or equivalent) and
    later (multi-core and multi-processor systems supported)
  • Memory: 512 MB minimum; 1 GB recommended
  • Hard disk space: 256 MB minimum, 1 GB recommended
  • 1 network interface card (NIC); up to 3 NICs supported

  Solaris/UltraSPARC edition:

  • Sun server or workstation with single UltraSPARC IIi processor 650 MHz or higher (multi-core and multi-processor systems supported)
  • Memory: 512 MB minimum; 1 GB recommended
  • Required hard disk space: 256 MB minimum, 1 GB recommended
  • 1 network interface card (NIC); up to 3 NICs supported

  Support for optional SSL accelerator cards:

  • nCipher nFast Accelerator
  • SUN Crypto Accelerator 1000

  LDAP server support:

  •  Microsoft Active Directory and Sun ONE Directory Server 5.1
  • Support for other LDAP Directory Server products on request

  ---

  Administration Console

  General characteristics:

  The Administration Console is a Java rich client application with a convenient and easy-to-use graphical user interface.

  Supported Operating Systems:

  • Microsoft Windows 2000 SP2, and XP SP2
  • RHEL 3 WS, ES or AS Update 4 (and higher)
  • RHEL 4 WS, ES or AS Update 4 (and higher)
  • RHEL 5.1 Client or Server (and higher)
  • SuSE Professional and Enterprise Linux 8.x and higher
  • Novell SUSE Linux Enterprise 10.x, and openSUSE 10.x
  • Sun Solaris 10 on x86
  • Sun Solaris 8, 9, and 10 on Sun UltraSPARC

  System Requirements:

  • 800 MHz Intel Pentium III processor (or equivalent) and later
  • Memory: 512 MB minimum
  • Hard disk space: 200 MB minimum
  • 1 network interface card, or more

• [+]Deployment Examples

  Two common deployment scenarios for the use of the Web Services DBC as an XML firewall are the DMZ (De-Militarized Zone) scenario and the B2B scenario explained below. While the DMZ scenario focuses on the protection of the own network an application servers alone, the B2B scenario additionally supports secure federation of enterprise services with partner companies.

  DMZ Scenario

  In the DMZ scenario, two firewalls are used to create an outer screened subnet, or demilitarized zone (DMZ). This subnet contains the Web Services DBC gateway component, which protects SOAP receivers in the protected domain by analyzing and potentially terminating SOAP traffic. This scenario is shown in the figure below.

   

  

   

  The SOAP receiver can be a standalone application, or a container environment such as a Web Server or a J2EE Application Server. The exterior firewall (packet filter) is the connection point to the public network. It restricts access to specific systems in the screened subnet and allows only these systems to access the public network. The packet filter blocks all other traffic from/to the public network. The second, interior firewall (packet filter) restricts access from the protected network to specific systems on the screened subnet and allows only these to access the protected network. It blocks all other traffic to the protected domain.

  In the example shown here, also in the protected domain is the Security Policy Server (The WS-DBC, together with arbitrarily many other DBCs, can be controlled by a central Security Policy Server with a single unified security policy if desired; otherwise the security policy module that comes with the WS-DBC software is typically installed at the same machine as the WS-DBC). If desired, the Policy Server can talk to the gateway over a dedicated management network using a separate network interface.

  Federated Trust (B2B) Scenario

  The second main deployment scenario is used to integrate across enterprises, e.g., in a manufacturer-supplier application such as supply chain management . One of the key challenges here is how disparate IT infrastructures can be federated without either enterprise having to creating a large number of new accounts for each partner it is willing to cooperate with. It is also highly undesirable to modify existing applications, or distribute new credentials to clients. In this setting, a sender-side WS-DBC can offer a huge cost-saving benefit by:

  • mapping between different credentials (e.g. roles), and
  • hiding the heterogeneity of client and server SOAP platforms.

  This scenario is illustrated in the figure below.

  

  The sender-side WS-DBC can authenticate incoming SOAP messages relying on the authentication mechanisms and credentials used in the sender-side domain. It can map these to roles or user IDs recognized at the receiver end. The sender-side WS-DBC would then transparently create, sign, and insert standard SAML assertions that contain these mapped credentials. Moreover, it can perform outgoing access control and message content filtering to enforce security policies at the sender. The receiver-side WS-DBC can establish trust in SOAP messages by verifying the sending gateway's XML Digital Signature found in message headers. Based on the authenticated identities or role memberships, it can then perform access control, auditing, content filtering, etc. Security-aware Web Services that are able to process SAML may perform additional security checks, if desired

Xtradyne Security Policy Server - Unified Middleware Security Management

With the Web Services DBC product and the IIOP DBC product, Xtradyne offers enterprises two very powerful application security gateway products for the firewalling of Web Services and Corba/EJB based applications. Both DBC products provide extensive AAA functionality (authentication, authorization, audit), which makes them suitable not only for firewall security at application level, but also as complete security solutions for the enterprise, including internal users, for Web Services and Corba.

The Standard editions of both Xtradyne DBC products include the Xtradyne Security Policy Server in its basic version, where it controls the gateway modules and allows security management and the use of LDAP directories. For advanced security management of arbitrarily many Web Services and Corba applications with one unified security policy Xtradyne offers, as a separate product, the Enterprise edition of the Security Policy Server.

One Xtradyne Security Policy Server installation can control all Web Services DBCs and IIOP DBCs installed in the customer's network. The unified security management allows user authentication, fine-grained authorization (down to the single operations on Corba objects, EJBs, or of the Web Service), and detailed security audit for all SOAP/Web Services, Corba, and EJB based services with one security policy.

 
The policy server's powerful access control model supports users, groups, and security roles. The support of LDAP directory servers allows the use of already existing user and group management systems without the need to duplicate user information. The Administration Console that comes with the Enterprise edition of the Security Policy Server allows unified security management for all SOAP and IIOP based applications in the enterprise.

High availability of the Security Policy Server is supported through full support for replication and several forms of clustering.

Supported Platforms

The Security Policy Server is available on Solaris 8 and 9, Red Hat Linux 7.1, 7.2 and 8.0, Suse Linux 7.3, 8.0 and 8.1. The Administration Console runs on any platform that provides a Java Virtual Machine, including Windows XP, 2000, NT, HP-UX, AIX, etc.