Security Modeling and Evaluation for Mobile Agents Anthony Chan and Michael Lyu The Chinese University of Hong Kong

Classification of Mobile Code Ghezzi and Vigna’s classification of mobile code paradigms Know-how: the code to execute Resources: input/output for code execution Processor: abstract machine that holds the state of computation

Attack model of malicious hosts against mobile agents (Other agents) Environment Malicious Host Agent System call Read/manipulate properties; control execution Read/manipulate Model proposed by Fritz Hohl: Attacks scenarios that can be described: spy out and modify the whole data part of an agent spy out and modify the code part of an agent manipulate the code execution sequence of an agent manipulate the execution environment of an agent

Mobile agent application zAdvantages of developing the application using mobile agents over conventional client/server: yreduced network traffic for client: client (handheld PC) needs to handle only two network transmissions (agent sending and receiving) ynon-interactivity of client: client can be plugged to network, send agent, disconnect from network; then after a while reconnect at another physical location, and receive agent

Mobile Agent Security: A Closer Look zTwo facets of mobile agent security: yhost security xprotect hosts from malicious agents (code/data) xsimilar to remote evaluation and code on demand approaches yagent security xprotect agents from malicious hosts xa relatively new area in security research

Possible solutions zAn open research question zTwo cases: yclosed network: malicious hosts are identifiable xagent integrity checking xencrypted transmission xtime limiting techniques yopen network: malicious hosts are not identifiable

Open network zEncryption yneed to hide the code (algorithm) and data of agents so that any malicious hosts would not be able to tamper yone possible way would be “mobile cryptography” using probabilistic encryption zTime-limiting techniques ylimit the time for an agent to survive ysecurity modeling

Security Modeling Agent Host 1Host 2Host n … Assume: the time to breach the agent on host i is inversely exponential to the number of instructions carried out by host i the number of instructions carried out by a host is directly proportional to time

Security modeling Let an agent stays at host i for time T i, P(breach at host i) = 1 - exp(- i T i ), i is a constant Then the agent security, i.e., probability of no breach at all host, We may use this to measure the time we allow an agent to stay on a host, so that the agent is still safe up to a certain probability