Chenghui Luo · Defense Technical Information Center (DTIC) · 2004
Mobile code is computer code that is produced on one node of a computer network but is transferred and executed on another network node. A mobile agent is a mobile software module composed of autonomous mobile code. Mobile agent software is a promising new computing paradigm for distributed computing in a large computer network environment, because of the autonomy and efficiency of mobile code. In the course of the Mobile Code Security (MCS) project supported by the U.S. Air Force Research Laboratory, a MCS Framework has been developed by Fraunhofer CRCG. The MCS Framework provides a multi-layered approach to safeguarding mobile agents, and includes technologies to support: complete obfuscation, and encrypted execution and code watermarking technologies.
Cited by 0
Sergio Loureiro · 2001
Cited by 19
Elsevier eBooks · 2000
Cited by 11
Hamilton Link, Richard Schroeppel, William L. Neumann et al. · OSTI OAI (U.S. Department of Energy Office of Scientific and Technical Information) · 2004
If software is designed so that the software can issue functions that will move that software from one computing platform to another, then the software is said to be 'mobile'. There are two general areas of security problems associated with mobile code. The 'secure host' problem involves protecting the host from malicious mobile code. The 'secure mobile code' problem, on the other hand, involves protecting the code from malicious hosts. This report focuses on the latter problem. We have found three distinct camps of opinions regarding how to secure mobile code. There are those who believe special distributed hardware is necessary, those who believe special distributed software is necessary, and those who believe neither is necessary. We examine all three camps, with a focus on the third. In the distributed software camp we examine some commonly proposed techniques including Java, D'Agents and Flask. For the specialized hardware camp, we propose a cryptographic technique for 'tamper-proofing' code over a large portion of the software/hardware life cycle by careful modification of current architectures. This method culminates by decrypting/authenticating each instruction within a physically protected CPU, thereby protecting against subversion by malicious code. Our main focus is on the camp that believes that neither specialized software nor hardware is necessary. We concentrate on methods of code obfuscation to render an entire program or a data segment on which a program depends incomprehensible. The hope is to prevent or at least slow down reverse engineering efforts and to prevent goal-oriented attacks on the software and execution. The field of obfuscation is still in a state of development with the central problem being the lack of a basis for evaluating the protection schemes. We give a brief introduction to some of the main ideas in the field, followed by an in depth analysis of a technique called 'white-boxing'. We put forth some new attacks and improvements on this method as well as demonstrating its implementation for various algorithms. We also examine cryptographic techniques to achieve obfuscation including encrypted functions and offer a new application to digital signature algorithms. To better understand the lack of security proofs for obfuscation techniques, we examine in detail general theoretical models of obfuscation. We explain the need for formal models in order to obtain provable security and the progress made in this direction thus far. Finally we tackle the problem of verifying remote execution. We introduce some methods of verifying remote exponentiation computations and some insight into generic computation checking.
Cited by 2Open access
Lecky-Thompson, Guy · 1997
Cited by 0Open access
Sergio Loureiro Refik, Sergio Loureiro, Refik Molva et al. · 2000
this article presents two aspects of mobile code security, namely the protection of hosts receiving a malicious mobile code and the protection of a mobile code within a malicious host.
Cited by 0
Des Télécommunications, Spécialité Informatique Et Réseaux, Par Sergio Loureiro et al. · 2001
Cited by 0
2004
Cited by 2
Mohamed Hefeeda, Bharat Bhargava · 2001
While mobile agents approach provides a great flexibility and customizability compared to the traditional client-server approaches, it introduces many serious security problems. These problems are mainly protecting the hosting server and the visiting agent from each other. In this paper we discuss the security issues in the mobile agents technology. Specifically, we describe the techniques used to protect a hosting server from malicious agents roaming the network. We also present mechanisms for protecting a mobile agent during traveling from its source to the designated destination.
Cited by 0
Satish Ramdoss, Govindakrishnan Kannan, Venkata Rachabatthula et al. · 2008
Over the years computer systems have evolved from centralized monolithic computing devices supporting static applications, into networked environments that allow complex forms of distributed mobile computing. As the sophistication of mobile software increases, so do the associated security threats and vulnerabilities. The definition of 'safe ' in this context is known as a safety policy. The safety policy is basically a set of restrictions placed on mobile code to prevent the code from violating the security of the runtime system. We first define the notion of trust and further construct trust models of security applications. Traditional security applications that ensure mobile code security include techniques such as cryptography, code instrumentation and the use of the system kernel as a reference monitor. More recent approaches combine some of the traditional ideas with new, more sophisticated ideas to enhance mobile code security. These new approaches include the techniques of sandboxing, code-signing, firewalling and proofcarrying code (PCC)
Cited by 0
Chapman & Hall/CRC computer and information science series · 2005
Cited by 0
Auerbach Publications eBooks · 2009
Cited by 0
Zbigniew Kotulski, Aneta Zwierko · IGI Global eBooks · 2011
The recent development in the mobile technology (mobile phones, middleware, wireless networks, etc.) created a need for new methods of protecting the code transmitted through the network. The oldest and the simplest mechanisms concentrate more on integrity of the code itself and on the detection of unauthorized manipulation. The newer solutions not only secure the compiled program, but also the data, that can be gathered during its “journey,” and even the execution state. Some other approaches are based on prevention rather than detection. In this chapter we present a new idea of securing mobile agents. The proposed method protects all components of an agent: the code, the data, and the execution state. The proposal is based on a zero-knowledge proof system and a secure secret sharing scheme, two powerful cryptographic primitives. Next, the chapter includes security analysis of the new method and its comparison to other currently more widespread solutions. Finally, we propose a new direction of securing mobile agents by straightening the methods of protecting integrity of the mobile code with risk analysis and a reputation system that helps avoiding a high-risk behavior.Request access from your librarian to read this chapter's full text.
Cited by 0
K. Cartrysse, et al. · 2008
Mobile code is code that can be executed at a remote location, where be-forehand it might not be known whether this location is trustworthy and a requirement may be that the to be executed code is encrypted and remains encrypted during execution. This paper presents a model of mobile code and defines perfect secrecy. The model and definition allows to derive conditions and theoretical boundaries for protection of mobile code.
Cited by 0
Auerbach Publications eBooks · 2009
Cited by 1
Sergio Loureiro · 1999
: This position paper discusses the problem of evaluating a function on an untrusted host, while maintaining the confidentiality of the function. A new non-interactive protocol designed to evaluate a function on an untrusted host is presented. The protocol prevents the disclosure of the function under cryptographic assumptions. Keywords: Mobile code protection, privacy of computations, malicious hosts. 1 Introduction With the advent of new computing paradigms like mobile code and ubiquitous computing, the privacy and integrity of software programs become a major concern beyond classical data security considerations. Running a program in a potentially hostile environment may raise various security requirements, as follows: - a company might need to prevent the disclosure of certain sensitive algorithms implemented in its software products despite extensive code analysis and reverse engineering by potential intruders including its customers; - a mobile software agent acting on behalf...
Cited by 18
2004
Cited by 1
Jonathan T. Moore · ScholarlyCommons (University of Pennsylvania) · 1998
This paper presents a survey of existing techniques for achieving mobile code security, as well as a representative sampling of systems which use them. In particular, the problem domain is divided into two portions: protecting hosts from malicious code; and protecting mobile code from malicious hosts. The discussion of the malicious code problem includes a more in-depth study of the Java security model, as well as touching upon several other systems. The malicious host problem, however, is much more difficult to solve, so our discussion is mostly restricted to ongoing research in that area. 1 Introduction The recent explosion of the Internet, and in particular, the World Wide Web, offers an astounding amount of interconnected computing resources. However, for most users, their use of Internet resources is primarily limited by bandwidth. In particular, especially in home computers, there are many CPU cycles to spare in comparison to the rate at which data can be retrieved. This suggest...
Cited by 19Open access
Andrew Herbert · 1996
No abstract available.
Cited by 0
nfadel · Bulletin of Miscellaneous Information (Royal Gardens Kew)
Cited by 0