Upload
others
View
1
Download
0
Embed Size (px)
Citation preview
1
Section IX: Security and Privacy Aspects Section
Security for Mobile Agents: Issues and Challenges
Paolo Bellavista, Antonio Corradi, Corrado Federici, Rebecca Montanari, Daniela Tibaldi
Dip. Elettronica, Informatica e Sistemistica – University of Bologna
Viale Risorgimento, 2 - 40136 Bologna - ITALY Phone: +39-051-2093001; Fax: +39-051-2093073
Email: {pbellavista, acorradi, cfederici, rmontanari, dtibaldi}@ deis.unibo.it
Abstract Mobile Agent (MA) technology raises significant security concerns and requires a thorough security framework with a wide range of strategies and mechanisms for the protection of both agent platform and mobile agents against possibly malicious reciprocal behavior. The security infrastructure should have the ability to flexibly and dynamically offer different solutions to achieve different qualities of security service depending on application requirements. The chapter presents the security threats that typically arise in MA applications and describes the proposed currently available countermeasures to protect both nodes and mobile agents. In addition, the chapter surveys the state-of-the-art research activities about integrated security supports in MA systems and identifies open research issues and on-going research work.
1 Security: a Missing Link for Mobile Agents Acceptance
The convergence of the Internet with wireless communications have raised new challenges in the
support of user and terminal mobility, in facing heterogeneity, and in adapting to the dynamic
changes in the network infrastructure [1]. The new scenario seems a suitable application area for
computing paradigms that exploit the notion of code mobility, defined as the capability to
dynamically change the binding between software components and their location of execution [2].
As mobile networks gain widespread acceptance and ubiquitous environments start to emerge, the
ability to change the locations where applications can execute becomes an increasingly important
requirement. For example, we can think to heterogeneous and resource-limited portable devices that
can benefit from the possibility to download on-demand device-specific software components and
discard them when no longer needed.
2
Along this line, the Mobile Agent (MA) paradigm with its properties of autonomy,
asynchronicity and local resource exploitation particularly suits the peculiarities of the new Internet
scenario. The typical proposed applications for MAs include information retrieval, network
management, electronic commerce and service provisioning support in telecommunication systems
[3], [4]. Recently, additional proposals are starting to explore the adoption of MAs for
implementing novel middleware solutions for mobile computing [1]. These solutions advocate the
adoption of MAs at service provision time to act as middleware proxies over the fixed network on
behalf of users/devices. These MA-based middleware proxies can autonomously carry on
operations, even in case of temporary device disconnection and can migrate dynamically, either to
follow device movements or to operate locally to the needed resources.
However, the widespread acceptance and adoption of the MA technology is currently delayed
by several complex security problems still to be completely solved. MAs have fostered even more
the traditional security issues to the limit. Compared to the client/server model, the MA paradigm
offers greater opportunities for performing various attacks because MA systems provide a
distributed computing infrastructure on which applications belonging to different (usually
untrusted) users can execute concurrently [5], [6]. Additionally, the execution sites hosting MAs
may be managed by different authorities with different and possibly conflicting objectives and may
communicate across untrusted communication infrastructures, such as the Internet.
The MA technology introduces another dimension of complexity. Unlike other kinds of mobile
code, such as applets that are pulled once and in one hop to remote systems, MAs may move
through a series of systems with different levels of trust and potentially untrusted (multiple-hop)
[7]. MA principals and owners of the execution environment are usually different: this raises new
threats specific to the MA technology. Since hosting nodes have complete control over MA
execution, in principle they can do anything to the agent, to both its code and its state.
These various and different issues have led MA security to receive increasing attention in recent
3
years from both a theoretical and a practical point of view. Without an appropriate security level for
agents, MA applications could only execute in trusted environments, and could not be deployed in
the Internet scenario. Various security techniques and initial frameworks have been developed
mainly in the area of site protection from potentially malicious agents [8]. The complementary issue
of protecting agents from malicious execution sites represents a new and challenging research area
that calls for new security models and frameworks, that have been up to now investigated only by
few researchers [8], [9], [10], [11].
2 Security Requirements
The term mobile agent contains two distinct concepts, mobility and agency, and refers to a self-
contained and identifiable software component that can move across the network (hence mobile)
and act on behalf of users (hence agent) [12]. According to this definition, in principle, we can
consider a MA as the equivalent of a “well-trained English butler” who knows user needs, likes and
habits, and moves in the open Internet landscape to securely carry out application-specific goals on
its user behalf [13]. Such well-trained butler would be equipped with security credentials, such as
stamped passports, that make it identifiable, permit interaction with other agents, and with hosting
environments and allow the signing of agreements and contracts [14].
However, this vision has various security implications that still need to be solved to transform
our desiderata into reality. To exemplify the security requirements and issues raised by the MA
technology, let us consider the case of a shopping mobile agent that has to find the most convenient
offer for a flight ticket. Suppose that Bob with his palmtop is willing to access a Flight-Ticket
Booking Service (FBS), while he is driving on the way back from work, to urgently search for and
book the cheapest Rome-to-London flight ticket. FBS provisioning relies on middleware proxies to
accommodate portable devices with strict resource constraints [1]. In particular, Bob accesses FBS
via a light-weight client running on her access device. Before starting a FBS provisioning session
4
the client requires Bob to authenticate. After a successful authentication, a middleware mobile
proxy, called in the following Alfred (the well-trained English butler), is instantiated to represent
Bob over the fixed network and to support Bob’s shopping operations.
A trusting relationship should be established between Bob and Alfred: Bob should be confident
that Alfred will only do what he asks without abusing/misusing its autonomy capabilities. It should
not be possible for an air travel agency to persuade Alfred to purchase a flight from London to
Dublin. Neither should Alfred be able to make the commitment to purchase the London-to-Dublin
flight. If a trusting relationship exists, Bob may also delegate Alfred to sign the flight purchase
contract on his behalf when one convenient offer is found.
Suppose now that Alfred generates a shopping mobile agent and delegates it the flight searching
and booking operations. The shopping agent could migrate among the various air-travel agencies
nodes to locally operate on needed resources, whereas Alfred could closely follow Bob movements.
Once completed its tasks, the shopping agent returns to Alfred the result of the computation. The
shopping agent should be granted the same rights and submitted to the same restrictions as Alfred.
In this scenario, several security issues arise and several attacks are possible, as Figure 1 shows.
Since MA execution is at the mercy of hosting nodes, how is it possible to ensure that these nodes
do not manipulate the results of the shopping agent computation and do not illegally access to MA
private information? If no countermeasures are taken, for instance, an intermediate air-travel agency
could intentionally alter cancel the flight ticket offers previously collected by the MA in order to
gain a bargain advantage. If the shopping agent carries Bob’s private key, the air travel agency
could also steal the key to forge a purchase transaction commitment.
The hosting execution environment should also need certain protection from the shopping agent.
A malicious shopping agent may try to gain privileged or unrestricted access to information
belonging to the current execution environment, or may try to misuse services offered by the
execution environment to attack the hosting node itself or to use the node as the basis for probing
5
and exploiting the vulnerabilities of other systems [6]. For example, unregulated access to the file
system may permit agents to install a virus or a Trojan horse, whereas unrestricted access to node
resources may allow the shopping agent to produce denial of service attacks, to jeopardize
operativity of hosting sites by exhausting memory, storage system, and CPU cycles.
Figure 1. Security threats in Mobile Agent systems.
Recent research efforts have mainly focused on the development of ad-hoc security techniques that
can only partially circumvent the aforementioned security threats. For example, no viable solution
exists that can convince Bob to give his signing key to Alfred (and hence to the shopping agent) and
to trust air-travel agencies to use it only properly.
We still also lack general comprehensive security framework that can provide solutions for
addressing in a uniform and coherent manner all the security issues arising in MA applications. That
framework should define how to express security requirements, how to administer them, how to
distribute them to relevant entities and how to enforce them. The desired behavior of both agent
platforms and agents should be defined at a high-level of abstraction, separately from agent/system
(1) User-Agent Trust(2) Inter-Agent security (3) Agent-Node security(4) Node-Agent Security(5) Network security
Execution Node
(3)
(5)
(4)
(2)
Execution Node
Bob
(1)Alfred
Agent generation
Agentmigration
Agent execution
NETWORK
(*) © D. LiguΘri(**) © FumettieStorie di Pezzin & Marinato
(*)
(*)
(**)
Execution Node
(*)
(*)
“Evil” Agent
“Angel “Shopping Agent
Agent execution
Agent execution
(1)
6
code to facilitate the dynamic adaptation of security controls to the evolution of both the execution
environment and the application requirements.
Differently from the traditional approach to MA security, security concerns should inform every
phase of MA system development, from requirement engineering to design, implementation, testing
and deployment [15]. The ultimate challenge is, therefore, unifying security with system
engineering. Just as MA system engineers analyze and select system features to answer to
functional requirements, security engineers must develop applicable security models and deploy
those security measures that can make available different qualities of security service depending on
specific security requirements of applications and on the most suitable trade-off between security
and efficiency.
3 Security Countermeasures
This section is intended to outline the key features and to point out the limitations of the most
common protection techniques adopted to protect both agent platforms and agents against reciprocal
malicious behavior.
3.1 User-agent Trust
Any “well-trained English butler” should be delegated with proper rights in order to carry out his
tasks. Delegation is a means by which users can trust agents to make decisions on their behalf.
Several trust-management systems based on the notion of delegation have been proposed in
recent years in decentralized systems to allow one entity to give some of its authority to other
entities, e.g., the Simple Public Key Infrastructure (SPKI) [16], Attribute Certificates [17].These
systems have been recognized fruitfulness even for supporting delegation in mobile agent systems
and are starting to be integrated in several MA system projects [18], [19].
SPKI exploits public-key based certificates for supporting both authentication and authorization
[16]. SPKI certificates securely bind a user and his public key with a set of rights and specify
7
whether the user is authorized to delegate his rights. SPKI supports a very simple notion of
delegation that makes it suitable only for small networks. The main weakness is that it does not
allow to specify any other constraints on delegation. For instance, it is not possible to impose
limitations on the entities to whom the user can delegate his rights or specify which rights the user
can delegate.
Another emerging technique for delegation is based on the exploitation of Attribute Certificates
(ACs) that securely bind users with their rights, but do not contain the user public key [17]. ACs
permit to support a flexible delegation model because it is possible to specify not only whether the
AC owner is authorized to delegate some of his privileges but also the conditions that must hold for
the delegation to take place. For example, the AC issuer can impose some restrictions on the entities
to whom the AC owner can delegate his privileges, on the delegation chain length and also on the
subset of privileges that the AC owner can delegate.
3.2 Protecting Agent Platforms
The problem of protecting agent platforms from malicious agent behavior requires to perform
various security checks both when an agent arrives and while it is executing. Before executing an
agent, the hosting node should guard against malicious agent logic which is defined as a set of
instructions that cause a site security policy to be violated. If the agent code is proven to be secure,
the host should authenticate the incoming agent and should mediate agent operations on needed
resources by means of access control checks.
3.2.1 Secure Agent Code
Research on provably secure code has been undertaken for several years targeted at allowing to
verify that a piece of code is secure before it begins execution. Some research activities in the field
of safe programming languages can enhance the development of code safety by proposing solutions
based on strong typing, restricted memory-reference manipulations, and runtime-supported memory
8
allocation and deallocation [8]. Another formal technique that can be used to develop provably
secure code is the Proof Carrying Code that forces agent code producer to formally prove that the
mobile code has the safety properties required by the hosting agent platform. The proof of the code
correct behavior is transmitted to the hosting node that can validate the received code [20]. The
major problems with Proof Carrying Code techniques are the need of a standard formalism for
establishing safety policies and the significant performance overhead sometimes unacceptable to
both transmit and verify proofs.
A more pragmatic approach, adopted in most MA systems, is to trust a specific piece of agent
code because one trusts the developer/supplier of the agent code. This technique requires ways to
verify through cryptographic means that a particular piece of agent code originates from the trusted
party.
Another approach based on path history logs can be exploited to allow hosting platforms to
decide whether to execute an incoming agent [21]. The underlying idea is to maintain an
authenticable record of the prior platforms visited by an agent, so that a newly visited platform can
determine whether to process the agent and what resource constraints to apply. Computing a path
history requires each agent platform to add a signed entry to the agent path, indicating its identity
and the identity of the next platform to be visited, and to supply the complete path history to the
next platform.
Another technique for detecting malicious agent logic uses a state appraisal function that
becomes part of the agent code and guarantees that the agent state has not been tampered with by
malicious entities [22]. The success of this technique relies on the possibility to predict alterations
to the agent state, and to prepare countermeasures, in the form of appraisal functions. The state
appraisal function is produced by the agent author and it is signed together with the rest of the
agent. The visited platform uses this function to verify that the agent is in a correct state and to
determine what privileges to grant to the agent.
9
3.2.2 Agent Authentication
Authentication mechanisms are required for associating agents with responsible principals, where
principals represent the subjects that request operations, e.g., an individual, a corporation, a service
provider, and a network administrator. For authenticating incoming agents, agent principals can be
associated with personal public/private keys and can be forced to digitally sign agents to ensure the
correct identification of their responsible party. The public-key based authentication process safely
verifies the correspondence between principal identities and keys. Most authentication solutions
based on public-key cryptography delegate key lifecycle management to Public Key Infrastructures
(PKIs) [23]. Authentication can also ascertain the paternity of agents by associating them with their
responsible role. A role-based model facilitates the administration and management of a large
number of principals, by simplifying the dynamic handling of principals and permissions.
3.2.3 Agent Authorization
Research in the authorization field has focused on two main areas. Some researches attempt to
realize access control mechanisms, while others are concerned about finding languages for
expressing access control requirements.
Access control mechanisms can enforce the control of agent behavior at run-time and can limit
access to resources. The early sandboxing technique is a typical example [24]. However, the rigidity
of the sandbox model makes it inadequate for complex agent-based applications. The JDK 1.2
security architecture evolves from the sandbox by introducing fine-grained, extensible access
control structures for a wide range of applications and clearly separates the enforcement mechanism
from the security policy specification [25]. However, the JDK 1.2 provides support for traditional
access control lists only, so more sophisticated access control requires further extensions to this
architecture. Another proposal for controlling the execution of mobile agents written in the Tcl
scripting language is the Safe-Tcl security framework which uses at least two interpreters – one
10
regular for trusted code and a safe interpreter for untrusted code [8]. When untrusted code executing
in the safe interpreter executes a command requiring access to a system resource, the trusted
interpreter evaluates whether access should be granted or denied.
Several MA systems adopt simple access control lists (ACLs) to implement access control in
MA applications. However, ACLs exhibit limitations in enforcing all the complex access controls
necessary in MA applications. The complexity of access control decisions in MA based applications
derives from both static and dynamic considerations. On the one hand, it is mandatory to consider
static attributes, such as the identity of the source code implementer, the host from where the code
was loaded, and the identity/role of the principal on behalf of whom the mobile agent is executing.
On the other hand, it is necessary to take into account also dynamic attributes relating to the current
context in which the mobile agent operates. An agent may be granted different permissions
depending on the current time, the current application state, or the state of the resources that the
code is accessing. In most current solutions based on ACLs, complex access control constraints are
often directly hard-coded into the applications, thus imposing reconfiguration, rebuilding, or even
rewriting of significant parts of the application at any policy change.
Several research approaches are emerging that propose language-based solutions to separate
policy from access control implementation [26], [27], [28], [29]. From the research field in mobile
code technologies, entirely procedural languages have been developed to restrict mobile agents
operations depending on their historical behavior in addition to common discriminators like the MA
source location or the identity/role of its user [26]. Other languages combine procedural and
declarative rules. They describe both the minimal set of capabilities the hosting node must grant to
enable an incoming mobile agent to perform its task, as well as the trust conditions to be evaluated
to determine its trustworthiness [27]. In addition, more expressive logic-based declarative languages
not specifically proposed for MA systems could be considered. They can be extended to cater for
mobility and employed in MA systems to provide access control decisions that can take into
11
account temporal and application-dependent dynamic aspects [28], [29], [30].
3.3 Protecting Agents
The main issues to be comprehensively addressed to protect agents against malicious hosts are
agent execution, integrity and secrecy. Protecting agent execution requires to ensure that agents are
not hijacked to untrusted destinations that may present agents with a false environment, thus
causing them to execute incorrectly, do not commit to unwilling actions and do not suffer of
premature termination or starvation due to unfair administrator’s policies that fail to provide
necessary system resources (such as access to files, communication channels or cpu time).
Protecting agent integrity requires the identification of agent tampering, either of its code or of its
state, by malicious execution hosts. Providing agent secrecy requires hiding the agent code and state
parts from the site responsible for its execution.
There is no universal and general solution to the problem of agent protection. Little can be done
to ensure correct agent execution. A security practice could be to develop agents with the necessary
support services for its execution embedded into its code. For example, agents may have the crypto
code to perform sensitive operations or to resolve names. This would make agents independent
from the services offered by hosts, but it would simply reduce the possibility of hosts to attack
agents and would also significantly increases the transmission costs because of the bigger agent
bytecode size.
Only few partial approaches have been proposed to either prevent or detect attacks against agent
integrity and secrecy. Prevention techniques are aimed at turning attacks into computationally
unfeasible or useless tasks, while detection techniques are aimed at allowing agent responsible users
to verify whether some attacks have been carried out against their agents once they return back.
With regard to the prevention of attacks to agent integrity and secrecy, some proposals try to
overcome the problem by not permitting mobile agents to move to untrusted hosts. Others face the
12
problem by taking organizational measures [31]. Only trusted parties are permitted to set up an
agent platform and to host agent execution, but this is currently a too restrictive requirement.
Some mainly rely on special tamper-proof hardware that avoids unauthorized modification of
agent code/state by executing the agent in a physically sealed environment. Even the administrators
of the agent execution system do not have access to this execution environment [32]. However, the
cost of tamper proof hardwares makes this approach impractical for a large number of users.
Tamper proof hardwares can only be deployed in closed corporate system or secure military
networks [11]. In addition, this approach clashes with openness and limits the scalability of
applications as it forces agents to migrate only to nodes that are equipped with tamper-proof
hardware.
Others try to address the problem by adopting algorithms that obfuscate agent code and data to
make it difficult for hostile environments to analyze code and data structures at least for the time the
agent executes in a host. State variable splitting and recomposition, hardly predictable program flow
by using run time data values dependencies are only examples of obfuscation operations [33]. This
approach has, however, two main limitations: the difficulty to identify in advance an agent lifetime
that minimizes the possibility to successfully inspect agent data and code and the need for a global
time clock to check expiration time.
The prevention of attacks to agent secrecy seems extremely difficult to guarantee. A few
researchers address the issue by using the concept of computing with encrypted functions [34]. The
key idea behind that approach is to have the agent platform execute agent code embodying an
encrypted function without being able to discern the original unencrypted function. However, this
technique is not of general validity because it applies only to certain classes of polynomials and
rational functions. In addition, it still remains to be seen whether agent platform administrators will
be willing to run agents executing arbitrary encrypted functions that cannot be interpreted.
Other approaches control the possibility of an agent to reveal private information [35]. Using the
13
environmental key generation method, agent private information can be encrypted and only
disclosed when some predefined environmental condition have been met.
Detection techniques can be exploited to discern if any tampering with agent code or state has
occurred. Among the proposals that adopt a detection strategy some present cryptographic
approaches to encapsulate the results of agent computation at each visited platform for subsequent
verification with the aim of preserving the forward integrity of results collected by the agents during
its roaming. Some of these solutions employ centralized solutions that rely on Trusted Third Parties
(TTP) to encapsulate partial results. The TTP can be used to track the agent execution at each
intermediate step by recording partial results [36]. The central role of a TTP may cause some
inefficiencies that can be overcome by more distributed protocols [37], [38], [39]. Another method,
called execution tracing, for detecting unauthorised modifications of agent code/state relies on non-
modifiable traces of agent computation created at each intermediate execution host [40]. Each
single trace is a sequence formed by an identifier of executed instructions along with values of
internal state variables involved. A signed hash of the trace is sent from node to node upon
conclusion along with final agent execution state until the agent returns back to its sender node. If
the agent owner suspects that some host behaves maliciously, it starts a check procedure by asking
to each involved host its copy of the trace, by locally executing the returned agent and by
comparing the computation results with the received traces. The major drawbacks of the approach
are not only the management of the trace logs, but also their size and the intensive message
exchanges between the sender nodes and all visited nodes at any integrity check.
Finally, some solutions partially achieve integrity by replicating agents and by exploiting
replication to compare the results obtained by following different paths [37], [41]. These
approaches ensure that destroying or tampering with one or more agent do not compromise the
correctness of agent computation because even in case of attacks a still adequate number of agent is
expected to return with meaningful results.
14
4 Overview of Security Solutions in MA–based systems
This section is devoted to examine the different directions of security solutions provided by the
most diffused MA systems. Despite differences and peculiarities in supported security models, it is
possible to recognize some common features. Because a large number of MA systems are based on
Java, most MA security solutions rely on the Java security model and have been developed on top
of the Java security architecture. In particular, earlier MA systems rely on the use of the sandbox
model and of the Java Security Manager to limit the scope of the agent while executing [24],
whereas more recent MA systems propose flexible solutions based on the more evolved Java2
security [25].
Most MA systems mainly focus on security solutions for the protection of agent platforms,
whereas the issue of protecting agents from possibly malicious hosting execution sites is often
neglected and rarely addressed.
With regard to agent platform protection, most common approaches rely on cryptographic
mechanisms that permit to verify the identity of the agent owner, to assign access restrictions to the
agent based on the owner identity/role and to execute agents in a secure environment that can
enforce these restrictions.
In the Concordia system the agent platform protection is achieved through agent authentication
and resource access control [42]. Any Concordia agent has a unique identity associated with the
identity of the user that has launched it. Resource control is based on the Java 1.1 security model
and relies on simple access control lists that allow or deny access to resources on the basis only of
agent identities.
Voyager implements a proprietary security manager to restrict agent operations with the
drawback of modifying the security manager implementation if any security policy changes [43]. In
Grasshopper, customizable access control lists rule agent access to resources on the basis of the
identity of the agent and of the group that it belongs to [44].
15
The Aglets system provides an aglet Security Manager to implement own security policies [31].
The behavior of the Security Manager cannot be changed directly, but via a GUI tool or directly
editing policy files. In the Aglet security model, agents can access resources depending on their
associated principles, i.e. entities that can be authenticated. Examples of defined principles include
the agent, the agent developer and the agent owner.
D'Agents authenticates the owner of an agent, assigns resource limits to the agent based on this
identity and enforces those limits [45]. Resources are divided into indirect resources that are
accessed through another agent and built-in resources that are directly accessible through language
primitives. The agent that controls an indirect resource enforces its own access restrictions. For
builtin resources there are some absolute access policies that are enforced by the server.
Ajanta protects hosting resources through an ad-hoc Security Manager that uses identity-based
access control lists to grant or deny agent access [46]. The Ajanta Security Manager is used only for
mediating access to system-level resources. For all application-defined resources, Ajanta uses a
proxy-based mechanism where a proxy intercepts agent requests and denies or grants access based
on its own security policy and on the agent’s credentials, i.e. tamperproof information including the
agent owner.
The MARISM-A platform provides security mechanisms to protect migration, confidentiality and
integrity of agents [47]. MARISM-A is based on Java and is very similar to other existing agent
platforms, like Grasshopper, but its main different feature is its simple extensibility. In fact, its core
provided features, like confidentiality and authentication for agent communication, can be extended
with some more complex security mechanisms. For example, an extension of MARISM-A core
security model exploits SPKI (Simple PKI) features to realize a role based access control model.
The SOMA support to agent platform protection is built on top of the Java 1.2 security model that
allows both identity-based and role-based access control [48]. The use of the Ponder language
permits the specification of flexible and fine-grained authorization policies, separately from agent
16
code and system access control mechanisms, that can control agent access to resources on the basis
of composite factors, both static (identity/role of agent owner/creator), and dynamic (time,
application state, resource state). In addition, the integration of Ponder within SOMA allows not
only to define agent rights, but also agent duties.
Similar security approaches to the SOMA system are proposed in the NOMADS environment
[49]. NOMADS is an example of MA system that provides dynamic access and resource control
and a policy-based approach to host security. Safe execution of agents is based on the ability of
NOMADS to control the resources accessed and consumed by agents. The resource control
mechanism allows control over the rate and quantity of resources used by agents. These resource
control mechanisms, built on a custom Java Virtual Machine called Aroma [50], complement
Java's access control mechanisms and help in making the NOMADS system secure against
malicious agents.
With regard to agent protection against malicious hosting nodes, Concordia, Voyager and
Grasshopper do not currently support integrated solutions. Aglets addresses the issue by relying on
an organizational approach that prevents agents to move toward untrusted execution environments.
In contrast, the Ajanta system provides a wide range of integrated techniques to at least detect any
illegal tampering to agent code and state. Similar approaches are provided in the SOMA platform
[39].
5 Open Issues and Directions of work in secure MA-systems
This section examines some of the most relevant open issues that still need to be faced before the
MA technology is ready for commercial applications and overviews the primary current directions
of work in MA systems.
With regard to host protection, an open research issue relates to the development of effective
countermeasures against denial of service. An hostile host may create clones of authorized agents
17
and use them to attack other nodes. The detection of cloning is still a very hard problem in MA
environments. Only a very few proposals tackle this issue, but solutions are expensive in terms of
computational overhead and limit the autonomy and efficiency of the agent execution by relying on
interactive protocols [51]. To reduce the risks of denial of service attacks resulting from a poorly
programmed or malicious agent overuse of critical resources, authorization should be associated
with monitoring techniques to exclude excessive resource consumption and with auditing
mechanisms to record all MA activities. Few solutions are starting to investigate tools and
mechanisms for combined resource and access control management [49], [52]. However, there are
several technological limitations to overcome. Most approaches rely on standard Java security
mechanisms that can only either grant or deny access to a particular service [53]. Changes to the
Java Virtual Machine are necessary to minimize the impact of denial of service attacks and to
provide meaningful accounting, at the expense of portability, however.
In addition, the concept of secure cascaded delegation should be regarded as an ongoing research
issue in need of further investigation. Cascaded delegation occurs when one agent (initiator) may
authorize other agents (delegates) to perform some tasks with its rights. Secure delegation implies
the ability to reconstruct the complete delegation chain and to verify the proper authorization of
agents that claim to act on behalf of someone else. However, several practical issues may arise
when considering open MA environments. Due to the unsolved agent protection attacks from
malicious nodes, the delegation process can occur only in trusted nodes. In addition, in several
application scenarios for both legal reasons and accountability, auditing mechanisms should be
available to keep track of the initiator of delegation and of the delegated permissions in a non-
repudiable manner.
Trust issues remain also a major reason for hampering a final acceptance of MAs [54]. For
mobile agents to undertake more sophisticated missions and to operate effectively without the
responsible user supervision, users will have to trust their agents to maintain conformance to the
18
desired objectives. The user trust into agents cannot be simply reduced to delegating agents specific
rights to MAs (see Section 3.1); users need to rely on mechanisms to constantly monitor and rule
agent behavior within the bounds of desired constraints.
Another crucial security requirement when deploying MAs in pervasive computing
environments is the dynamic establishment of trust relationships between MAs and visited nodes.
The dynamic determination of execution nodes requires dynamic establishment and enforcement of
access control and the integration of access control with probing of resource availability so as to
influence agent migration itineraries [55].
Among the various described open issues the ones that are starting to most attract research
interest are in the area of agent trustworthiness and dynamic security policy negotiation. If users and
administrators can be assured that agent behavior conforms to desired constraints and objectives,
everyone can stop worrying and start loving agents [14]. In addition, the need for dynamic policy
negotiation is increasingly emerging in those application scenarios where a primary requirement is
the dynamic formation of temporary coalitions. The following sections overview some of the
emerging proposals in these two areas.
5.1 Agents and Trust
Key to implementing a trustworthy MA system is to devise an infrastructure mechanism that allows
to control agent autonomy and to dynamically adjust governing strategies to deal with changing
priorities and contexts [14]. However, this is not an easy task.
A heading research direction growing considerably in these last years is the integration of MA
platforms with policy-based management solutions [56]. Policies that constrain the behavior of
system components are becoming an increasingly popular approach to dynamic application
adjustability in both academia and industry. [57] points out all the benefits of policy-based
approaches, including reusability, efficiency, extensibility, context-sensitivity, verifiability, support
19
for both simple and sophisticated components, protection from poorly-designed, buggy, or
malicious components, and reasoning about component behavior.
In particular, policy-based network management has been the subject of extensive research over
the last decade [56]. Policies are often applied to automate network administration tasks, such as
configuration, security, recovery, and QoS.
In the field of MA systems, policies can be a powerful means to model agent behavior in terms
of rights and duties. Explicit policies governing human-agent interaction, based on careful
observation of work practice and with an understanding of current social science research, can help
in assuring that effective and natural coordination, appropriate levels and modalities of feedback,
and adequate predictability and responsiveness to human control are maintained [57].
The development of policy-driven MA systems requires the consideration of some general
requirements. A basic requirement is the choice of an expressive language for policy specification.
In modern inter-organizational MA environments, languages should include the ability to group
policies that apply to agents to simplify the management of large-scale complex agent systems. As a
final consideration, the implementation of policy specifications should not introduce prohibitive
performance costs that would limit the deployment of the MA technology.
There is already some research work integrating policy-based management with MA systems
[58], [59]. This works focuses on the use of policies for controlling agent-related security aspects.
Policies specify complex and flexible access controls for agent-to-resource and agent-to-agent
interactions and express which actions agents must perform in response to events. An important
advantage of a policy-based approach to MA system security is the possibility to specify, represent,
and manipulate policy information independently from the components in charge of policy
interpretation and cleanly separated from agent/system code. Modern inter-organizational
environments require sophisticated security policies that are difficult to implement in current MA
platforms where policies are often directly hard-coded into applications, thus making difficult the
20
reconfiguration required at any policy change. Separation of concerns enables policies to be
dynamically changed and allows to modify the behavior of MAs by simply loading or unloading
relevant policies without the need of re-implementing agent code from scratch.
5.2 Dynamic Configuration of Access Control
Dynamic migration implies that a MA may not know in advance which nodes are going to host its
execution throughout its lifetime. Since target nodes and MAs are typically owned by different
authorities, their interests can conflict with respect to resource access and utilization. Thus, there
should be a mechanism for a priori acquisition of resource availability and for the dynamic
establishment of access control between agents and nodes. The knowledge of the availability of
resources in a particular site may show several benefits. MAs can exploit the visibility of available
resources to adjust their behavior accordingly and to reduce the risk of undesired task failure during
execution. Resource availability visibility can also help MAs in deciding whether it is more
profitable to stay in a locality than to move and explore a new computing environment. When
entering a new locality, a MA should be provided with the mechanisms needed to express its
desired resource visibility and to dynamically negotiate access control policies to obtain access to
needed resources. Policy negotiation allows MAs to enlarge the set of accessible resources with no
risk of illegitimate resource usage for the hosting nodes.
Some research activities are starting to emerge to provide controlled resource visibility and to
support policy negotiation [60], [55]. The COSMOS framework allows to dynamically determine
the MA contexts, and to effectively rule the access to them, by taking into account different types of
metadata (user profiles and system/user-level authorization policies), expressed at a high level of
abstraction and cleanly separated from the service logic [60]. As a distinctive feature, COSMOS
provides MAs entering a new locality with a controlled visibility of the directly accessible
physical/logical resources and of the other MAs locally executing (active context views). Active
21
context views contain resources that both MAs are willing to access and the COSMOS access
control function have qualified as accessible.
COSMOS addresses also the privacy issues that arise when exploiting MAs for building
context-aware services [1]. In fact, context awareness requires computing devices to gather, collect
and propagate up to the service level both user- and environment-specific information to permit
more informed service management strategies. However, the visibility of user-specific information,
such as user location, could be exploited to infer user tasks or preferences, thus to violate user
privacy. COSMOS protects user privacy by enabling users to specify which personal context
information they are willing to make public. User specifications, carried in the MA state part, guide
and automate COSMOS access controls to user personal context information.
With regard to dynamic establishment of access control, a negotiation model integrated in the
FarGo system is described in [55]. The model makes resource providers and consumers reach an
agreement on the allowed access and on the amount of resource utilization. The goal of negotiation
is to identify a set of permissions acceptable to both resource providers and consumers; the result of
the negotiation is a contract. Because the negotiation is closely tied to the application level rather
than depending on the infrastructure level, it is the application to choose when to invoke the
negotiation and which negotiation strategy to apply.
6 Conclusions
Mobile code-based programming models have recently gained wide prominence for their appealing
features in terms of flexibility, extensibility and efficiency. In particular, MAs have attracted a great
research interest and are emerging in mobility-enabled scenarios as an enabling technology for the
design, implementation and deployment of both advanced Internet services and middleware
solutions. However, the MA technology poses severe security risks and calls for novel security
mechanisms and frameworks.
22
Great research efforts have been devoted to develop countermeasures for the security threats
arising in MA systems. Although a great number of mechanisms currently exist, further
improvements are still necessary trough either the incremental refinements of available protection
mechanisms to reduce processing and storage overhead or the combination of complementary
mechanisms to form a more effective protection scheme. In addition, no single solution to all the
problems of agent execution, integrity and secrecy seems to exist, unless tamper proof hardwares
are introduced, which is likely to be overhead-prone. Currently no manufacturer produces these
devices at low costs even though the recent Trusted Computing Platform Alliance TCPA-Palladium
(recently renamed TCG–NGSCB Next Generation Secure Computer Base) represents a significant
step toward this goal. Even if tamper proof hardware devices would gain wider diffusion, we would
still need to certify that the manufacturers do not introduce malicious back doors.
The development of thorough security frameworks is another research direction that requires
more investigation, experimentation and experience. The state-of-the-art of MA systems points out
that there is very little support for fully integrated security frameworks that can provide the required
degree of flexibility. Most current security frameworks lack a clear separation between policies and
security mechanisms and provide monolithic security solutions where applications cannot choose
their suitable trade-off between security, scalability and performance. In addition, only very few
frameworks provide the required support to protect agents against malicious hosts.
We can conclude that albeit security is crucial for wider diffusion of the MA paradigm, it is still
in a somewhat immature state. Issues related to trust, delegation and security policy negotiation are
non trivial to solve and only pioneer solution attempts are starting to emerge. In addition, intense
standardization efforts should be directed to promote wider acceptance of security supports and to
facilitate their use, thus leveraging the adoption of the MA technology in fielded systems.
Acknowledgements Work supported by the Italian Ministero dell'Istruzione, dell'Università e della Ricerca (MIUR) in
23
the framework of the FIRB WEB-MINDS Project "Wide-scale Broadband Middleware for Network Distributed Services" and by the National Research Council (CNR) in the framework of the Strategic IS-MANET Project "Middleware Support for Mobile Ad-hoc Networks and their Application". We also thank Niranjan Suri for valuable comments and suggestions.
References:
[1] P. Bellavista, D. Bottazzi, A. Corradi, R. Montanari, S. Vecchi, “Mobile Agent Middlewares for Context-aware Applications”, Section III, Handbook of Mobile Computing, CRC Press, 2003.
[2] A. Fuggetta, G. P. Picco, G. Vigna, “Understanding Code Mobility”, IEEE Transactions on
Software Engineering, Vol. 24, No. 5, 1998. [3] M. Baldi, G. P. Picco, “Evaluating the Tradeoffs of Mobile Code Design Paradigms in
Network Management Applications”, 20th International Conference on Software Engineering (ICSE'98), IEEE Press, Los Alamitos CA, 1998.
[4] R. H. Glitho, T. Magedanz (eds.), Special Issue on “Applicability of Mobile Agents to
Telecommunications”, IEEE Network, Vol. 16, No. 3, 2002. [5] M. S. Greenberg, J. C. Byington, T. Holding, D. G. Harper, “Mobile Agents and Security”,
IEEE Communications Magazine, Vol. 36, No. 7, 1998. [6] W. Jansen, “Countermeasures for Mobile Agent Security”, Computer Communications,
Elsevier Press, Vol. 23, No. 17, 2000 [7] G. Knoll, N. Suri, J.M. Bardshaw, “Path-based Security for Mobile Agents”, Electronic Notes
in Theoretical Computer Science, Vol. 58, No. 2, 2002. [8] G. Vigna, “Mobile Agents and Security”, LNCS 1419, Springer-Verlag, 1998. [9] R. Oppliger, “Security issues related to mobile code and agent-based systems”, Computer
Communications, Elsevier Press, Vol. 22, No. 12, 1999. [10] N. Borselius, “Mobile agent security”, Electronics and Communication Engineering Journal,
IEE Press, Vol. 14, No. 5, 2002. [11] J. Zachary, “Protecting Mobile Code in the Wild”, IEEE Internet Computing, Vol. 7, No. 2,
2003. [12] V. A. Pham, A. Karmouch, “Mobile software agents: an overview”, IEEE Communications
Magazine, Vol. 36, No. 7, 1998. [13] N. Negroponte, “Agents: From Direct Manipulation to Delegation”, Software Agents, AAAI
Press, 1997. [14] J. Bradshaw, G. Cabri, R. Montanari, “Taking Back Cyberspace”, IEEE Computer, Vol. 36,
No. 7, 2003.
24
[15] P. T. Devanbu, S. Stubblebine, “Software engineering for security: a roadmap”, International
Conference on Software Engineering (ICSE’00), ACM Press, Limerick, Ireland, 2000. [16] J. Howell, D. Kotz, “A Formal Semantics for SPKI”, 6th European Symposium on Research in
Computer Security (ESORICS 2000), LNCS 1895, Springer-Verlag, France, 2000 [17] J. Linn, M. Nystrom, “Attribute Certification: An Enabling Technology for Delegation and
Role-Based Controls in Distributed Environments”, 4th ACM Workshop on Role-Based Access Control (RBAC’99), ACM Press, Fairfax, USA, 1999.
[18] W. A. Jansen, “A Privilege Management Scheme for Mobile Agent Systems”, 5th
International Conference on Autonomous Agents, ACM Press, Canada, May 2001. [19] S. Mudumbai, A. Essiari, W. Johnston, “Anchor Toolkit - A Secure Mobile Agent System”,
3rd International Symposium on Mobile Agents (ASA/MA'99), Palm Springs (CA, USA), October 1999.
[20] G. Necula, “Proof Carrying Code”, 24th ACM Symposium on Principle of Programming
Languages, ACM Press, Paris, France, 1997. [21] D. Chess, B. Grosof, C. Harrison, D. Levine, C. Parris, G. Tsudik, “Itinerant Agents for
Mobile Computing”, IEEE Personal Communications, Vol. 2, No. 5, 1995. [22] W. Farmer, J. Guttman, V. Swarup, “Security for Mobile Agents: Authentication and State
Appraisal”, 4th European Symposium on Research in Computer Security, Rome, Italy, 1996. [23] W. Ford, M. Baum, “Secure Electronic Commerce”, Prentice-Hall, 1997. [24] L. Gong, “Java Security: Present and Near Future”, IEEE Micro, Vol. 17, No. 3, 1997. [25] L. Gong, “Inside Java 2 Platform Security”, Addison Wesley, 1999. [26] G. Edjlali, A. Acharya, V. Chaudhary, “History-based access control for mobile code”, 5th
ACM Conference on Computer and Communications Security, ACM Press, San Francisco, California, USA, 1998.
[27] M. Blaze, J. Feigenbaum, J. Ioannidis, A. D. Keromytis, “The Role of Trust Management in
Distributed Systems Security”, Secure Internet Programming: Issues in Distributes and Mobile Object Systems, Springer-Verlag, 1999.
[28] S. Jajodia, P. Samarati, V. S. Subrahmanian, “A logical language for expressing
authorizations”, IEEE Symposium on Security and Privacy, IEEE Press, 1997. [29] V. Varadharajan, C. Crall, J. Pato, “Authorization in Enterprise-wide Distributed System. A
practical Design and Application”, 14th Annual Computer Security Applications Conference, IEEE Press, 1998.
[30] E. Lupu, M. Sloman, N. Dulay, N. Damianou, “Ponder : realising enterprise viewpoint
25
concepts”, 4th International Enterprise Distributed Object Computing Conference, IEEE Press, Makuhari, Japan, 2000.
[31] D. Lange, M. Oshima, “Programming and Deploying Java Mobile Agents with Aglets”,
Addison Wesley, 1998. [32] U.G. Wilhelm, S. Staamann, L. Butty, “Introducing Trusted Third Parties to the Mobile Agent
Paradigm. In J. Vitek, C. Jensen (Eds.), Secure Internet Programming: Security Issues for Mobile and Distributed Objects, Springer-Verlag, 1999.
[33] F. Hohl, “Time Limited Blackbox Security: Protecting Mobile Agents from Malicious Hosts”,
Mobile Agents and Security, LNCS 1419, Springer-Verlag, 1998. [34] T. Sander C. Tschudin, “Protecting Mobile Agents against malicious hosts”, Mobile Agents
and Security, LNCS 1419, Springer-Verlag, 1998. [35] J. Riordan, B. Schneier, “Environmental key generation towards clueless agents”, Mobile
Agents and Security, LNCS 1419, Springer-Verlag, 1998. [36] A. Corradi, M. Creminini, C. Stefanelli, “Security Models and Abstractions in a Mobile Agent
Environment”, IEEE Workshop on Collaboration in Presence of Mobility, Stanford, CA, USA, 1998.
[37] B. Yee, “A Sanctuary for Mobile Agents”, DARPA Workshop on Foundations for Secure
Mobile Code, Monterey, CA, USA, 1997. [38] G. Karjoth, N. Asokan, C. Gülcü, “Protecting the Computation Results of Free-Roaming
Agents”, 2nd International Workshop on Mobile Agents, Stuttgart, Germany, 1998. [39] A. Corradi, M. Cremonini, R. Montanari, C. Stefanelli: “Mobile Agents Integrity for
Electronic Commerce Applications”, Information Systems, Elsevier Press, Vol. 24, N.6, 1999. [40] G. Vigna, “Cryptographic Traces for Mobile Agents”, Mobile Agents and Security, LNCS
1419, Springer-Verlag, 1998. [41] B.Shneider, “Towards fault tolerant and secure agentry”, 11th International Workshop on
distributed algorithms, LNCS 1320, Springer-Verlag, Berlin, Germany, 1997. [42] D. Wong, N. Paciorek, T. Walsh, J. DiCelie, M. Young, B. Peet, “Concordia: An
Infrastructure for Collaborating Mobile Agents”, First International Workshop on Mobile Agents, LNCS 1219, Springer-Verlag, Berlin, Germany, 1997.
[43] ObjectSpace – Voyager, http:///www.objectspace.com/ voyager/. [44] IKV++ - GrassHopper, http://www.ikv.de/products/ grasshopper/. [45] R. Gray, G. Cybenko, D. Kotz, D. Rus, “D'Agents: Security in a multiple-language, mobile-
agent system”, Mobile Agent Security, LNCS 1419, Springer-Verlag, 1998.
26
[46] A. Tripathi, “Mobile Agent Programming in Ajanta”, 19th IEEE International Conference on Distributed Computing Systems Workshop (ICDCS’99), IEEE Computer Society Press, Austin, Texas, 1999.
[47] S. Robles, J. Mir, J. Ametller, J. Borrell, “Implementation of Secure Architectures for Mobile
Agents in MARISM-A”, 4th International Workshop On Mobile Agents For Telecommunication Applications (MATA’02), LNCS 2521, Springer-Verlag, Barcelona, Spain, 2002.
[48] R. Montanari, C. Stefanelli, N. Dulay, “Flexible Security Policies for Mobile Agents
Systems”, Microprocessors and Microsystems, Elsevier Science Press, Vol.25, N.2, 2001. [49] N. Suri, J. M. Bradshaw, M. R. Breedy, P. T. Groth, G. A. Hill, R. Jeffers, T. S. Mitrovich, B.
R. Pouliot, D. S. Smith, “NOMADS: Toward a Strong and Safe Mobile Agent System”, 4th International Conference on Autonomous Agents, ACM Press, Barcelona, Spain, 2000.
[50] N. Suri, J. M. Bradshaw, M. R. Breedy, K. M. Ford, P. T. Groth, G. A. Hill, R. Saavedra,
“State Capture and Resource Control for Java: The Design and Implementation of the Aroma Virtual Machine”, http://nomads.coginst.uwf.edu/.
[51] J. Baek, D. Lee, R. S. Ramakrishna, “A design of protocol for detecting an agent clone in
mobile agent systems and its correctness proof”, 8th Annual ACM Symposium on Principles of Distributed Computing, ACM Press, Atlanta, Georgia, USA, 1999.
[52] P. Bellavista, A. Corradi, C. Stefanelli, “Java for On-line Distributed Monitoring of
Heterogeneous Systems and Services”, The Computer Journal, Oxford University Press, Vol. 45, No. 6, 2002.
[53] J.M. Bradshaw, M. Greaves, H. Holmback, T. Karygiannis, W. Jansen, B. G. Silverman, N.
Suri, A. Wong, “Agents for the masses”, IEEE Intelligent Systems, Vol. 14, No. 2, 1999. [54] A. Patrick, “Building Trustworthy Software Agents”, IEEE Internet Computing, Vol. 6, No. 6,
2002. [55] Y. Gidron, I. Ben-Shaul, O. Holder, Y. Aridor, “Dynamic configuration of access control for
mobile components in FarGo”, Concurrency and Computation: Practice and Experience, Vol. 13, No. 1, 2001.
[56] S. Wright, R. Chadha, G. Lapiotis, “Special Issue on Policy Based Networking”, IEEE
Network, Vol. 16, No. 2, 2002. [57] J. M. Bradshaw, P. Beautement, L. Bunch, S. V. Drakunov et al, “Making agents Acceptable
to People”, Handbook of Intelligent Information Technology (in press), IOS Press, Amsterdam, the Netherlands, 2003.
[58] A. Corradi, N. Dulay, R. Montanari, C. Stefanelli, “Policy-driven Management of Mobile
Agent Systems”, International Workshop on Policies for Distributed Systems and networks - Policy 2001, LNCS 1995, Springer-Verlag, Bristol, UK, 2001.
27
[59] J. M. Bradshaw, N. Suri, A. J. Canas, R. Davis, K. Ford, R. Hoffman, R. Jeffers, T. Reichherzer, “Terraforming cyberspace”, Computer, IEEE Press, Vol. 34, No. 7, 2001.
[60] P. Bellavista, R. Montanari, D. Tibaldi, “COSMOS: a Context-centric Access Control
Middleware for Mobile Environments”, to appear in 5th International Worshop on Mobile Agents for Telecommunication Applications (MATA’03), Springer Verlag, LNCS, Marrakesch, Ottobre ’03.