1. B2BObjectsDSN, Washington, June 20021 Distributed Object Middleware to Support Dependable Information Sharing between Organisations Nick Cook, Santosh Shrivastava, University of Newcastle Stuart Wheater, HP Arjuna Lab

2. B2BObjectsDSN, Washington, June 20022 Presentation outline Context Application scenarios, problems to address and interaction styles B2BObjects middleware  state coordination  Java RMI-based implementation Related work Conclusions and future work

3. B2BObjectsDSN, Washington, June 20023 Context Organisations increasingly use the Internet both to provide services and to use services of others Example: trend to concentrate on “core” business and to out-source “non-core” operations B2B interaction:  subject to agreement between organisations  underpinned by information sharing Need: dependable mechanisms for information sharing

4. B2BObjectsDSN, Washington, June 20024 Application Scenarios Dispersal of operational support  Service provider delegates service configuration to customer  Customer configuration and service provision are validated against service agreement Distributed auction service  Auction houses provide a distributed auction service that mediates updates to shared auction state by customers (buyers and sellers)  Updates governed by agreements between customers and auction houses Multi-party interactions that demand regulated information update

5. B2BObjectsDSN, Washington, June 20025 Problems to address in B2B interactions Assume each organisation has local policies for information sharing consistent with an agreement that governs the interaction between them Each organisation requires:  that their intended actions on shared information meet locally determined, evaluated and enforced policy  that the intended actions are acknowledged and accepted by others  that the intended actions of others comply with the interaction agreement and are irrefutably attributable to the relevant party Overall requirements:  validation of actions on shared information and  collection and verification of non-repudiable evidence of those actions

6. B2BObjectsDSN, Washington, June 20026 Direct vs. indirect interaction styles B2BObjects presents abstraction of shared state Interaction state = application state that belongs to more than one organisation

7. B2BObjectsDSN, Washington, June 20027 B2BObjects overview

8. B2BObjectsDSN, Washington, June 20028 Object augmentation Intra-organisation interface State mgt. & checkpointing Inter-organisation interface B2BObjects Application object logic Cert. mgt. & non-repudiation Remote coordination calls Local application calls

9. B2BObjectsDSN, Washington, June 20029 State coordination State change proposal = new state signed by proposer Proposal dispatched to all other parties for local validation (rules may be asymmetric) Recipient response = a signed receipt and a signed decision on the (local) validity of the state change Proposer disseminates complete set of responses to all other parties Proposed state is valid if the responses represent unanimous agreement to the change Signed evidence is irrefutably bound to relevant key- holder Similar processes govern connection to and disconnection from object coordination

10. B2BObjectsDSN, Washington, June 200210 Protocol overview Non-repudiable two-phase commit  message content ensures consistent view of object state and of group membership Assumptions:  Crypto-primitives: sig. scheme, sec. hash, sec. PRNG  Trusted services: cert. authorities, trusted time-stamping  Infrastructure: eventual message delivery (bounded no. of temporary network and computer related failures)  Information disclosure is not conditional Characteristics:  Highly optimistic: progress to new agreed state is guaranteed if all parties validate proposal  Local autonomy: any party can veto a proposal  Safety: cannot misrepresent validity of state or actions of parties; detect and resolve divergent views  Liveness: dishonest parties can prevent termination (necessary price of local autonomy)

11. B2BObjectsDSN, Washington, June 200211 Java RMI-based implementation B2BObject interface: forward calls and application-specific validation etc.  connect, validateConnect, getState, validateState, applyState … B2BObjectController interface for state change scoping and access type indication  enter, examine, overwrite, leave … B2BCoordinator package  Local interface to propagate new state proposal, connection request etc.: propagateNewState …  Remote interface for protocol execution between coordinators: proposeNewState, commitNewState …  Coordinator implements state-checkpointing and non- repudiation services

12. B2BObjectsDSN, Washington, June 200212 Example usage Application object method: setAttribute(Atype attr) throws …; B2BObject wrapper method: setAttribute(Atype attr) throws … { controller.enter(); controller.overwrite(); appObject.setAttribute(attr); controller.leave(); // init.coordination } Usage in B2B application: try { b2bObj.setAttribute(attr); } catch (…) { // handle exceptions }

13. B2BObjectsDSN, Washington, June 200213 Example application: order processing Customer and supplier share order information Asymmetric validation rules apply to updates:  The customer is allowed to add items and the quantity required  The supplier is only allowed to price items B2BObjects implementation:  Each party has replica of an order object that implements the B2BObject interface  Middleware coordinates object state  Proposed changes to object state are subject to validation according to the agreed rules  Invalid changes are rejected

14. B2BObjectsDSN, Washington, June 200214 Customer Supplier Attempt by supplier to change both the price of widget2 and the quantity fails at customer validation Rejection of supplier’s proposed change

15. B2BObjectsDSN, Washington, June 200215 Related work Fair exchange: protocols that use on-line or off-line TTPs to ensure fair information disclosure and guarantee termination EU MAFTIA project: work on timely trusted computing base for deployment of trusted B2BCoordinator; work on toleration of a proportion of corrupted parties in agreement protocols (majority decisions) Policy (Ponder, Law-Governed Interaction): relevant to generation of validation code that reflects interaction policy EU MULTIPLECX project: systematic generation of non- repudiation evidence at method invocation Not aware of other work that provides the abstraction of shared state with systematic non-repudiation and validation

16. B2BObjectsDSN, Washington, June 200216 Conclusions and future work B2BObjects addresses requirement for dependable information sharing:  Presents familiar shared objects abstraction  Regulates updates to shared objects  Provides systematic non-repudiation and state checkpointing  Application programmer concentrates on business logic Future work includes:  Concurrency control where there is no “natural” application-level concurrency control  Transactions across multiple B2BObjects  Support for loosely-coupled (asynchronous) interaction, e.g. implementation using Java Message Service