Implementing Security Exits › Implementing INMC Link Security

Implementing INMC Link Security

A security exit is provided as one of the facilities of INMC (Inter-Network Management Connection). This provides security for the connections between domains.

The security exit is coded as an assembler language exit routine. An exit must exist in each of the domains that are being linked. The exits are installed with the following components:

• Primary exit—communicates with the secondary exit in the other domain and decides whether to establish the link and allow traffic flow
• Secondary exit—responds to messages received from the primary exit and makes no decisions whether a link is established or terminated

This allows each end of an INMC link to determine independently whether a link should be activated, without having to depend on cooperation from the remote domain in order to enforce the decision.

These components are described in more detail in the following sections.

Primary Exit

The INMC primary exit decides whether a newly opened INMC link to a remote domain should be made available for general traffic. The secondary exit is not involved in this decision.

In order to pass control to the exit to make this decision the following calls are made by INMC to the exit:

• The Initialization Call—made when an INMC link to another domain is activated. The primary exit is notified of the event and whether the remote domain is configured with a secondary exit.
• The Deliver Call—made to the primary exit when INMC receives the reply from the (remote) secondary exit to a message sent to it earlier by the primary exit.
• The Notify Call—made to the primary exit when INMC determines that an unexpected event (for example, link outage) has occurred, which results in the deactivation of the link.

For every piece of data sent by the primary exit, there is always a response from the secondary exit. This response can be one of the following:

• Data exchange is complete.
• Link outage has occurred and no reply is possible.

If any protocol errors occur, a hang or stalemate condition might occur between the primary and secondary exits. Care, therefore, must be taken when designing the flow of information between the exit pairs and the rules defined for the various parameter lists passed to the exits must be adhered to.

Secondary Exit

The function of the secondary exit is to act solely as a respondent to any messages received from the primary exit in the remote domain. The secondary exit has no power to recommend activation or closure of the link.

Calls made to the secondary exit are as follows:

• The Initialization Call—made when an INMC link becomes active. The exit can then perform any initialization required before returning to INMC.
• The Deliver Call—made to the secondary exit to deliver a message from the primary exit. The secondary exit must respond with a reply to the message, even if that reply is a null message.
• The Disconnect Call—made if the primary exit decides that the conversation is to be ended or when a link outage occurs.

This call allows the secondary exit to end cleanly and tidy up any allocated resources.