1. Data and Applications Security Developments and Directions Dr. Bhavani Thuraisingham The University of Texas at Dallas Lecture #12 Secure Object Systems February 13, 2008

2. Outline l Background on object systems l Discretionary security l Multilevel security l Objects for modeling secure applications l Object Request Brokers l Secure Object Request Brokers l Secure frameworks l Directions

3. Concepts in Object Database Systems l Objects- every entity is an object - Example: Book, Film, Employee, Car l Class - Objects with common attributes are grouped into a class l Attributes or Instance Variables - Properties of an object class inherited by the object instances l Class Hierarchy - Parent-Child class hierarchy l Composite objects - Book object with paragraphs, sections etc. l Methods - Functions associated with a class

4. Example Class Hierarchy Document Class D1 D2 Book Subclass B1 # of Chapters Volume # Print-doc-att(ID) Method1 : Journal Subclass J1 Print-doc (ID) Method2: ID Name Author Publisher

5. Example Composite Object Composite Document Object Section 1 Object Section 2 Object Paragraph 1 Object Paragraph 2 Object

6. Security Issues l Access Control on Objects, Classes, Attributes etc. l Execute permissions on Methods l Multilevel Security l Security impact on class hierarchies l Security impact on composite hierarchies

7. Objects and Security Secure OOM Unified Object Model is Evolving Secure OODB Persistent data store Secure OODA Design and analysis Secure DOM Infrastructure Secure OOPL Programming language Secure Frameworks Business objects Secure OOT Technologies

8. Access Control

9. Access Control Hierarchies

10. Secure Object Relational Model

11. Policy Enforcement

12. Sample Systems

13. Multilevel Security

14. Some Security Properties l Security level of an instance must dominate the level of the class l Security level of a subclass must dominate the level of the superclass l Classifying associations between two objects l Method must execute at a level that dominates the level of the method

15. Multilevel Secure Object Relational Systems

16. Sample MLS Object Systems

17. Objects for Secure Applications

18. Object Modeling

19. Dynamic Model

20. Functional Model

21. UML and Policies

22. Distributed Object Management Systems l Integrates heterogeneous applications, systems and databases l Every node, database or application is an object l Connected through a Bus l Examples of Bus include - Object Request Brokers (Object Management Group) - Distributed Component Object Model (Microsoft)

23. Object-based Interoperability Object Request Broker Client Object Server Object Example Object Request Broker: Object Management Group’s (OMG) CORBA (Common Object Request Broker Architecture)

24. Javasoft’s RMI (Remote Method Invocation) RMI Business Objects Clients Java-based Servers

25. Objects and Security Secure OOM Unified Object Model is Evolving Secure OODB Persistent data store Secure OODA Design and analysis Secure DOM Infrastructure Secure OOPL Programming language Secure Frameworks Business objects Secure OOT Technologies

26. Secure Object Request Brokers

27. CORBA (Common Object Request Broker Architecture) Security l Security Service provides the following: - Confidentiality - Integrity - Accountability - Availability l URLs - http://www.javaolympus.com/J2SE/NETWORKING/CORBA/COR BASecurity.jsp http://www.javaolympus.com/J2SE/NETWORKING/CORBA/COR BASecurity.jsp - http://student.cosy.sbg.ac.at/~amayer/projects/corbasec/sec_ov erview.html http://student.cosy.sbg.ac.at/~amayer/projects/corbasec/sec_ov erview.html - www.omg.org www.omg.org

28. OMG Security Specifications

29. CORBA (Common Object Request Broker Architecture) Security l Security Service provides the following: - Confidentiality - Integrity - Accountability - Availability l URLs - http://www.javaolympus.com/J2SE/NETWORKING/CORBA/COR BASecurity.jsp http://www.javaolympus.com/J2SE/NETWORKING/CORBA/COR BASecurity.jsp - http://student.cosy.sbg.ac.at/~amayer/projects/corbasec/sec_ov erview.html http://student.cosy.sbg.ac.at/~amayer/projects/corbasec/sec_ov erview.html - www.omg.org www.omg.org

30. CORBA (Common Object Request Broker Architecture) Security - 2 l Identification and Authentication of Principles l Authorization and Access Control l Security Auditing l Security of communications l Administration of security information l Non repudiation

31. Dependable Object Request Brokers Technology provided by Project Hardware Display Processor & Refresh Channels Consoles (14) Navigation Sensors Data Links Data Analysis Programming Group (DAPG) Future App Future App Future App Multi-Sensor Tracks Sensor Detections Real Time Operating System MSI App Data Mgmt. Data Xchg. Infrastructure Services Integrate Security, Real- time and Fault Tolerance Computing

32. Secure Frameworks

33. Directions l Object Models - UML for Security applications is becoming common practice - Secure distributed object systems has gained popularity - Evolution into secure object-based middleware - Secure object-based languages - Integrating security and real-time for object systems l Distributed Objects - Security cannot be an afterthought for object-based interoperability - Use ORBs that have implemented security services - Trends are moving towards Java based interoperability and Enterprise Application Integration (EAI) - Examples of EAI products are Web Sphere (IBM) and Web Logic (BEA) - Security has to be incorporated into EAI products