RMI (intro)

What is RMI? 



RMI stands for Remote Method Invocation. It is an application programming interface (API) that allows an object running on one Java Virtual Machine (JVM) to invoke methods on an object running on another Java Virtual Machine (JVM), client server architecture is a good example where RMI is used. Basically, RMI provides for communication between programs written in the Java programming language.

Architecture 

In an RMI application there are two programs, a server side program and a client side program. Inside the server side program, a remote object is created and reference of that object is made available for clients. The client side program requests the remote object from the server to invoke its methods. 


(A diagram to represent RMI architecture)


Stub & Skeleton?

  • Stub is a representation the remote object in the client and its acts as a gateway for the client program.
  • Skeleton is the object that in the server-side. stub communicates with the skeleton to pass request to the remote object.

RRL?

RRL represent Remote Reference Layer, and it is the layer which deals with the references made by the client to the remote object.

Transport Layer?

This is the layer that connects the client and the server over a network. 

The Flow

  1. Client makes a call to the remote object.
  2. Client's call received  by the stub, which eventually passes this request to the remote reference layer (RRL).
  3. When the client side RRL receives the request, it passes the request to the RRL on the server side by invoking required methods (invoke() method of the object remoteRef).
  4. RRL on the server side gets the request from the client side RRL.
  5. RRL on the server side passes the request to the skeleton (proxy on the server).
  6. Server side invokes the required object and the specific methods on the server.
  7. Result is again passed to the client.

Why RMI?

RMI API can be used to, 
  • Minimize the complexity of the application.
  • Preserve type safety.
  • Minimize the difference between working with local and remote objects.

I developed a simple application to demonstrate the flow of RMI API 😊, all the source codes are available in a GitHub repository. (read README for instruction)









Comments

Post a Comment

Popular posts from this blog

Let's Configure HTTP'Secure' in Apache-Tomcat

Image
What is HTTPS?.. if you don't have any idea about what is HTTPS, refer my previous blog post about HTTPS . If you have an idea about HTTPS and SSL/TLS handshake, you are good to go 😊  Creating a digital  certificate We can create a digital certificate using "Java KeyStore (JKS)". This is a repository of security certificates. We can generate a keystore file using keytool command. in order to work with keytool, you must have "JAVA" installed in your computer.  keytool is a key and certificate management utility that allows users to administrate their own public/private key pairs, and the keystore file we are going to generate bellow will also be our local tomcat server's server certificate.   Options  When creating a "keystore", we need to provide some options and values to it. -genkey/-genkeypair -alias  -keyalg  -keystore  -keysize -validity -sigalg -storepass -keypass -dname  -genkey/-genkeypair -genkey
Read more

Mitigate CSRF with Double Submit Cookies

Image
I previously explained what is CSRF  and how we can mitigate a CSRF attack using Synchronizer token pattern technique. In this blog post I'm going to talk about another CSRF mitigation technique called "Double Submit Cookies Pattern"  😉 What is Double Submit Cookies Pattern? This is a technique, that sends a random seed or a "token" as we call it, in both a cookie and as a request parameter, with the server verifying if the cookie value and the request value match. Why DSCP? Now its obvious that a third party entity cannot perform a CSRF attack without the CSRF token, and in here attacker or the third party entity cannot get the token because its in a cookie, and third party web pages cannot retrieve cookies from another web page that has a different domain. For example, assume that the genuine web page is banker.com, and the attacker's web page is attacker.com, when a user logged in to the banker.com, and accidentally redirect to attacker
Read more