Giả sử rằng thông điệp toàn vẹn và bảo mật đã đạt được bằng cách sử dụng cùng một phím được sử dụng thành lập phiên. Trong trường hợp đó, bất cứ khi nào chính là thỏa hiệp, một kẻ xâm nhập có thể có thể để giải mã các tin nhắn được bàn giao trong một cuộc trò chuyện cũ, rõ ràng không phải là một tính năng mong muốn. | SEC. FAULT TOLERANCE 479 Figure 10-20. An example architecture of a fault-tolerant CORBA system. by the replication manager specifying the type of object to create. The client remains unaware of the fact that it is implicitly creating an object group. The number of replicas that are created when starting a new object group is normally determined by the system-dependent default value. The replica manager is also responsible for replacing a replica in the case of a failure thereby ensuring that the number of replicas does not drop below a specified minimum. The architecture also shows the use of message-level interceptors. In the case of the Eternal system each invocation is intercepted and passed to a separate replication component that maintains the required consistency for an object group and whieh ensures that messages are logged to enable recovery. Invocations are subsequently sent to the other group members using reliable totally-ordered multicasting. In the case of active replication an invocation request is passed to each replica object by handing it to that object s underlying runtime system. However in the case of passive replication an invocation request is passed only to the RTS of the primary whereas the other servers only log the invocation request for recovery purposes. When the primary has completed the invocation its state is then multicast to the backups. This architecture is based on using interceptors. Alternative solutions exist as well including those in which fault tolerance has been incorporated in the runtime system potentially affecting interoperability or in which special services are used on top of the RTS to provide fault tolerance. Besides these differences practice shows that there are other problems not yet covered by the CORBA standard. As an example of one problem that occurs in practice if replicas are created on different implementations there is no guarantee that this approach will actually work. A review of the different .
