An Architecture for Secure Fault-Tolerant Global Applications

Applications are increasingly being developed over the Internet, and Internet programming languages seek new abstractions for programming what is in effect a “global computer. ” The characteristics of the evolving Internet environment have led to new ways of thinking about how to structure such global applications. We advocate a programming language approach to building Internet applications that reflects this change in viewpoint. This approach has a particular emphasis on the demands of fault-tolerant applications, while being centrally concerned with safeguarding security. I. GLOBAL COMPUTING AND INTERNET PROGRAMMING The last decade has seen an explosion in the use of the Internet as a platform for delivering e-commerce (B2B, B2C) to the global economy. The increasing globalization of network computing, particularly for e-commerce, has led to growing interest in programming abstractions for what is in effect a global virtual computer, hence the emergence of global computing as a research area [1], as recognized for example by the European Commission FET Proactive Initiative on Global Computing. Today global applications are extending their reach into ubiquitous wireless computing environments. While RPC and RMI systems have automated the “easy” aspects of network computing, dealing with independent failures continues to pose challenges for distributed application developers [2], [3], [4], [5]. Technologies developing for making local networked applications fault-tolerant may not be appropriate to global applications [4]. The characteristics of local and global environments are dissimilar, and numerous impossibility results exist for the latter [6], [7]. Cardelli [1] cites the aspects of global applications that differentiate them from LAN applications. Rather than (as with LANs and the pre-1990s Internet) there being ubiquitious secure point-topoint communication channels between any two sites in the network, the reality in the Internet today is that communication channels must span administrative boundaries imposed by firewalls, proxy servers and network address translators. All of this highlights the demand for programming environments, and particularly programming languages, that support building global applications. Fig. 1(a) describes the current state of the art in distributed computing over the Internet. The typical protocol stack (of network layer for routing, transport layer for reliable communication, and application layer) is complicated by the increasing sophistication of the network environment [8]. Thus network and transport protocols are increasingly creaking under the demands of additional tasks such as security and firewalls, network address translation, and load balancing [9]. In recognition of the problems that the developing Internet environment is posing, there is a growing suggestion that these additional tasks should be moved out of the lower layer protocols and performed at higher layers in the protocol stack [10], [11], [12], in the application layer or in some layer mediating between the application and the transport, as depicted in Fig. 1(b). In the latter figure we posit a “connection” layer that is part of, or layered underneath, the application layer, as has indeed been suggested in the networks community [21], [22], [12]. For example IETF RFC 3235 offers guidelines for applications that need to navigate across administrative domains delimited by network address translators [11]. We regard this as the essence of global computing and Internet programming languages [1], distinguishing them from local computing and LAN programming languages. II. FAULT TOLERANCE IN DISTRIBUTED PROGRAMMING LANGUAGES Achieving atomic failure is recognized as an essential step in building fault-tolerance into distributed applications. Various mechanisms have been proposed for achieving atomic failure. Transactions [13] have been adopted as a basic mechanism in some distributed programming languages for supporting the building of fault-tolerant applications. This was pioneered in the Argus distributed language [14], and subsequently in object-oriented distributed languages such as Avalon/C++ and Venari/ML [15], [16]. Transactions are an essential component in various well-known distributed computing platforms, including CORBA OTS, COM MTS, and Java Jini and JavaBeans [17], [18], [19], [20]. Our work is concerned with providing support for fault tolerance for global applications. Specifically we are interested in supporting fault tolerance protocols for such applications, and the implications for these protocols of the restructuring of protocols in Fig. 1. As an example, the Java Jini system [19] has support for fault tolerance, with its provision for transactions. The most important aspect of this support is a set