Network Message Encryption
In the Remote Procedure Call (RPC) context, client-side refers to the node initiating a request and server-side refers to the node processing a request. Each node can take on either client or server roles, and a node processing a request received from server-side RPC can invoke client-side RPC for a callback to the initiating client.
Although the network message encryption is enabled by default, the default implementation supplied by JADE is a dummy "do nothing" procedure. To avoid the server-side enforcement of encryption, you must manually disable encryption in the [JadeSecurity] section of your JADE initialization file.
When network message encryption is enabled, the following actions are performed.
-
JADE looks in the [JadeSecurity], [JadeAppServer], or [JadeThinClient] section of the JADE initialization file for the name of a user-defined encryption library (DLL). For details, see "
-
The JADE RPC modules attempt to dynamically load the encryption DLL by a LoadLibrary call during initialization and use the GetProcAddress call to attempt to obtain the address of predefined functions by name.
-
On a JADE client-only node, if the LoadLibrary call or any of the GetProcAddress calls fails, the server connections are refused and an exception is raised.
-
On a remote access-capable node, if the dynamic load fails, an exception is logged in the JADE event log and remote access provider support is disabled, preventing any client from connecting.
When RPC message encryption is enabled on a node, RPC messages sent across the network are passed to a user-supplied encryption routine on the client-side and a decryption routine on the server-side. The encryption routine can encrypt the data stream in any fashion and can change the length before transmission.
The server-side decryption routine must ensure that it restores the data stream to its initial pre-encrypted value. If one peer correspondent in an RPC connection is employing encryption and the other is not, this is detected by the protocol, and offending messages are rejected with the appropriate exception raised.
When encryption is enabled, the JADE RPC generates a 32-bit integer Cyclic Redundancy Check (CRC) value and stores this in the RPC header.
The CRC is used to provide a level of protection against invalid encryption or decryption processing that fails to restore the original message intact and prevents spurious messages being passed upwards to higher-level APIs. Only the data part of the RPC message is passed to the user encryption routine; the header remains non-encrypted.
The encryption and decryption hooks are invoked by JADE only if encryption support is enabled. Your library must export both encryption and decryption functions to enable correct operation of encryption support. Encrypted RPC messages cannot be longer that 50,000 bytes following encryption.
