A Survey of Self-protected Mobile Agents
---
paper_title: Secure mobile multiagent systems in virtual marketplaces : a case study on comparison shopping

paper_content:

The growth of the Internet has deeply influenced our daily lives as well as our commercial structures. Agents and multiagent systems will play a major role in the further development of Internet-based applications like virtual marketplaces. However, there is an increasing awareness of the security problems involved. These systems will not be successful until their problems are solved. This report examines comparison shopping, a virtual marketplace scenario and an application domain for a mobile multiagent system, with respect to its security issues. The interests of the participants in the scenario, merchants and clients, are investigated. Potential security threats are identified and security objectives counteracting those threats are established. These objectives are refined into building blocks a secure multiagent system should provide. The building blocks are transformed into features of agents and executing platforms. Originating from this analysis, solutions for the actual implementation of these building blocks are suggested. It is pointed out under which assumptions it is possible to achieve the security goals, if at all.
---
paper_title: Multi-Agent System Security for Mobile Communication

paper_content:

This thesis investigates security in multi-agent systems for mobile communication. Mobile as well as non-mobile agent technology is addressed. A general security analysis based on properties of agents and multi-agent systems is presented along with an overview of security measures applicable to multi-agent systems, and in particular to mobile agent systems. A security architecture, designed for deployment of agent technology in a mobile communication environment, is presented. The security architecture allows modelling of interactions at all levels within a mobile communication system. This architecture is used as the basis for describing security services and mechanisms for a multi-agent system. It is shown how security mechanisms can be used in an agent system, with emphasis on secure agent communication. Mobile agents are vulnerable to attacks from the hosts on which they are executing. Two methods for dealing with threats posed by malicious hosts to a trading agent are presented. The first approach uses a threshold scheme and multiple mobile agents to minimise the effect of malicious hosts. The second introduces trusted nodes into the infrastructure. Undetachable signatures have been proposed as a way to limit the damage a malicious host can do by misusing a signature key carried by a mobile agent. This thesis proposes an alternative scheme based on conventional signatures and public key certificates. Threshold signatures can be used in a mobile agent scenario to spread the risk between several agents and thereby overcome the threats posed by individual malicious hosts. An alternative to threshold signatures, based on conventional signatures, achieving comparable security guarantees with potential practical advantages compared to a threshold scheme is proposed in this thesis. Undetachable signatures and threshold signatures are both concepts applicable to mobile agents. This thesis proposes a technique combining the two schemes to achieve undetachable threshold signatures. This thesis defines the concept of certificate translation, which allows an agent to have one certificate translated into another format if so required, and thereby save storage space as well as being able to cope with a certificate format not foreseen at the time the agent was created.
---
paper_title: Classification of malicious host threats in mobile agent computing

paper_content:

Full-scale adoption of mobile agent technology in untrustworthy network environments, such as the Internet, has been delayed by several security complexities [Montanari, 2001]. Presently, there is a large array of security issues and sub-issues within mobile agent computing that makes it tough to distinguish between different types of problems, and therefore also interfere with the definition of suitable solutions. Literature addressing the full range of problems is limited and mostly discusses single security threats or subsets of security problems and their possible solutions. The purpose of this paper is to analyse the different security threats that can possibly be imposed on agents by malicious hosts, and then provide a classification of these threats before we describe the current solution approaches that are implemented to address the identified problems. By providing such a classification we were able to identify specific gaps in current research efforts, and enable researchers to systematically focus their attention on different classes of solutions to remedy these threats.
---
paper_title: Two-Party Computing with Encrypted Data

paper_content:

We consider a new model for online secure computation on encrypted inputs in the presence of malicious adversaries. The inputs are independent of the circuit computed in the sense that they can be contributed by separate third parties. The model attempts to emulate as closely as possible the model of "Computing with Encrypted Data" that was put forth in 1978 by Rivest, Adleman and Dertouzos which involved a single online message. In our model, two parties publish their public keys in an offline stage, after which any party (i.e., any of the two and any third party) can publish encryption of their local inputs. Then in an on-line stage, given any common input circuit C and its set of inputs from among the published encryptions, the first party sends a single message to the second party, who completes the computation.
---
paper_title: Computing arbitrary functions of encrypted data

paper_content:

Suppose that you want to delegate the ability to process your data, without giving away access to it. We show that this separation is possible: we describe a "fully homomorphic" encryption scheme that keeps data private, but that allows a worker that does not have the secret decryption key to compute any (still encrypted) result of the data, even when the function of the data is very complex. In short, a third party can perform complicated processing of data without being able to see it. Among other things, this helps make cloud computing compatible with privacy.
---
paper_title: Time Limited Blackbox Security: Protecting Mobile Agents From Malicious Hosts

paper_content:

In this paper, an approach to partially solve one of the most difficult aspects of security of mobile agents systems is presented, the problem of malicious hosts. This problem consists in the possibility of attacks against a mobile agent by the party that maintains an agent system node, a host. The idea to solve this problem is to create a blackbox out of an original agent. A blackbox is an agent that performs the same work as the original agent, but is of a different structure. This difference allows to assume a certain agent protection time interval, during which it is impossible for an attacker to discover relevant data or to manipulate the execution of the agent. After that time interval the agent and some associated data get invalid and the agent cannot migrate or interact anymore, which prevents the exploitation of attacks after the protection interval.
---
paper_title: TAMAP: a new trust-based approach for mobile agent protection

paper_content:

Human activities are increasingly based on the use of distant resources and services, and on the interaction between remotely located parties that may know little about each other. Mobile agents are the most suited technology. They must therefore be prepared to execute on different hosts with various environmental security conditions. This paper introduces a trust-based mechanism to improve the security of mobile agents against malicious hosts and to allow their execution in various environments. It is based on the dynamic interaction between the agent and the host. Information collected during the interaction enables generation of an environment key. This key allows then to deduce the host’s trust degree and permits the mobile agent to adapt its execution accordingly to the host trustworthiness, its behavior history and the provided Quality of Service (QoS). An adaptive mobile agent architecture is therefore proposed. It endows the mobile agent with the ability to react with an unexpected behavior.
---
paper_title: Strong Cryptography Armoured Computer Viruses Forbidding Code Analysis: the Bradley Virus 1

paper_content:

Imagining what the nature of future viral attacks might look like is the key to successfully protecting against them. This paper discusses how cryptography and key management techniques may definitively checkmate antiviral analysis and mechanisms. We present a generic virus, denoted bradley which protects its code with a very secure, ultra-fast symmetric encryption. Since the main drawback of using encryption in that case lies on the existence of the secret key or information about it within the viral code, we show how to bypass this limitation by using suitable key management techniques. Finally, we show that the complexity of the bradley code analysis is at least as high as that of the cryptanalysis of its underlying encryption algorithm.
---
paper_title: An Approach to the Sensitive Information Protection for Mobile Code

paper_content:

Environmental key generation can be used when mobile code producer (MCP) needs mobile code consumer (MCC) to decrypt the code correctly only if some special environmental conditions are true. In this paper, we introduce a new approach, which is based on environmental key generation, to protect sensitive information within mobile code. It is achieved through introduction of trusted computing technology-sealing. Our approach uses the combination of hardware and software technology, so it is tamper-resistant to attackers.
---
paper_title: Computing Functions of a Shared Secret

paper_content:

In this work we introduce and study threshold (t-out-of-n) secret sharing schemes for families of functions ${\cal F}$. Such schemes allow any set of at least t parties to compute privately the value f(s) of a (previously distributed) secret s, for any $f\in {\cal F}$. Smaller sets of players get no more information about the secret than what follows from the value f(s). The goal is to make the shares as short as possible. Results are obtained for two different settings: we study the case when the evaluation is done on a broadcast channel without interaction, and we examine what can be gained by allowing evaluations to be done interactively via private channels.
---
paper_title: TAMAP: a new trust-based approach for mobile agent protection

paper_content:

Human activities are increasingly based on the use of distant resources and services, and on the interaction between remotely located parties that may know little about each other. Mobile agents are the most suited technology. They must therefore be prepared to execute on different hosts with various environmental security conditions. This paper introduces a trust-based mechanism to improve the security of mobile agents against malicious hosts and to allow their execution in various environments. It is based on the dynamic interaction between the agent and the host. Information collected during the interaction enables generation of an environment key. This key allows then to deduce the host’s trust degree and permits the mobile agent to adapt its execution accordingly to the host trustworthiness, its behavior history and the provided Quality of Service (QoS). An adaptive mobile agent architecture is therefore proposed. It endows the mobile agent with the ability to react with an unexpected behavior.
---
paper_title: Secure Internet programming: security issues for mobile and distributed objects

paper_content:

Foundations.- Trust: Benefits, Models, and Mechanisms.- Protection in Programming-Language Translations.- Reflective Authorization Systems: Possibilities, Benefits, and Drawbacks.- Abstractions for Mobile Computation.- Type-Safe Execution of Mobile Agents in Anonymous Networks.- Types as Specifications of Access Policies.- Security Properties of Typed Applets.- Concepts.- The Role of Trust Management in Distributed Systems Security.- Distributed Access-Rights Management with Delegation Certificates.- A View-Based Access Control Model for CORBA.- Apoptosis - the Programmed Death of Distributed Services.- A Sanctuary for Mobile Agents.- Mutual Protection of Co-operating Agents.- Implementations.- Access Control in Configurable Systems.- Providing Policy-Neutral and Transparent Access Control in Extensible Systems.- Interposition Agents: Transparently Interposing User Code at the System Interface.- J-Kernel: A Capability-Based Operating System for Java.- Secure Network Objects.- History-Based Access Control for Mobile Code.- Security in Active Networks.- Using Interfaces to Specify Access Rights.- Introducing Trusted Third Parties to the Mobile Agent Paradigm.
---
paper_title: Protecting mobile agents ’ data using trusted computing technology

paper_content:

A technique efficiently creates a database used to correlate information identifying data session traffic exchanged between entities of a computer network with information relating to multi-protocol intermediate devices configured to carry the session traffic throughout the network. The intermediate devices are preferably routers configured to carry System Network Architecture (SNA) session traffic between SNA entities comprising a host network connection and a physical unit (PU) station. The host network connection utilizes a channel-attached router for connectivity with a host computer. The technique allows a network management station (NMS) program to establish a NMS database by obtaining a PU name associated with an active SNA session without requiring a presence on or continual communication with a virtual telecommunication access method on the host.
---
paper_title: Public Protection of Software

paper_content:

One of the overwhelming problems that software producers must contend with, is the unauthorized use and distribution of their products. Copyright laws concerning software are rarely enforced, thereby causing major losses to the software companies. Technical means of protecting software from illegal duplication are required, but the available means are imperfect. We present, protocols that enables software protection, without causing overhead in distribution and maintenance. The protocols may be implemented by a conventional cryptosystem, such as the DES, or by a public key cryptosystem, such as the RSA. Both implementations are proved to satisfy required security criterions.
---
paper_title: On the Problem of Trust in Mobile Agent Systems

paper_content:

Systems that support mobile agents are increasingly being used on the global Internet. Security concerns dealing with the protection of the execution environment from malicious agents are extensively being tackled. We concentrate on the reverse problem, namely how a mobile agent can be protected from malicious behaviour of the execution environment, which is largely ignored. We will identify the problem of trust as the major issue in this context and describe a trusted and tamper-proof hardware that can be used to divide this problem among several principals, each of which has to be trusted with a special task. We show that the presented approach can be used to mitigate an important problem in the design of open systems.
---
paper_title: Classification of malicious host threats in mobile agent computing

paper_content:

Full-scale adoption of mobile agent technology in untrustworthy network environments, such as the Internet, has been delayed by several security complexities [Montanari, 2001]. Presently, there is a large array of security issues and sub-issues within mobile agent computing that makes it tough to distinguish between different types of problems, and therefore also interfere with the definition of suitable solutions. Literature addressing the full range of problems is limited and mostly discusses single security threats or subsets of security problems and their possible solutions. The purpose of this paper is to analyse the different security threats that can possibly be imposed on agents by malicious hosts, and then provide a classification of these threats before we describe the current solution approaches that are implemented to address the identified problems. By providing such a classification we were able to identify specific gaps in current research efforts, and enable researchers to systematically focus their attention on different classes of solutions to remedy these threats.
---
paper_title: Using trust for secure collaboration in uncertain environments

paper_content:

The SECURE project investigates the design of security mechanisms for pervasive computing based on trust. It addresses how entities in unfamiliar pervasive computing environments can overcome initial suspicion to provide secure collaboration.
---
paper_title: A service-oriented trust management framework

paper_content:

In this paper we present and analyse a service-oriented trust management framework based on the integration of role-based modelling and risk assessment in order to support trust management solutions. We also survey recent definitions of trust and subsequently introduce a service-oriented definition of trust, and analyse some general properties of trust in e-services, emphasising properties underpinning the propagation and transferability of trust.
---
paper_title: TAMAP: a new trust-based approach for mobile agent protection

paper_content:

Human activities are increasingly based on the use of distant resources and services, and on the interaction between remotely located parties that may know little about each other. Mobile agents are the most suited technology. They must therefore be prepared to execute on different hosts with various environmental security conditions. This paper introduces a trust-based mechanism to improve the security of mobile agents against malicious hosts and to allow their execution in various environments. It is based on the dynamic interaction between the agent and the host. Information collected during the interaction enables generation of an environment key. This key allows then to deduce the host’s trust degree and permits the mobile agent to adapt its execution accordingly to the host trustworthiness, its behavior history and the provided Quality of Service (QoS). An adaptive mobile agent architecture is therefore proposed. It endows the mobile agent with the ability to react with an unexpected behavior.
---
paper_title: Modelling and evaluating trust relationships in mobile agents based systems

paper_content:

This paper considers a trust framework for mobile agent based systems. It introduces the concept of trust reflection and presents a novel method using views of the trustor to derive the trust symmetry. This new approach addresses the trust initialization issues and allows for different levels of initial trust to be established based on trustor's initial assessment and then enables different trust dynamics to evolve in the course of future interactions in situations where full trust appraisal is not possible at the beginning of interactions. This is an important aspect for security in distributed systems, especially in mobile agent based systems due to the fact that the agent owner principals may not have all the information to appraise full trust in other entities(e.g. foreign hosts to be visited by the mobile agent) when composing an itinerary prior to the deployment of mobile agent. Our framework proposes a new formalism to capture and reason about trust reflection and presents an algorithm for updating trust during system operation. This is then applied to a simulated mobile agent system and an analysis of the results is presented.
---
paper_title: A Pessimistic Approach to Trust in Mobile Agent Platforms

paper_content:

The problem of protecting an execution environment from possibly malicious mobile agents has been studied extensively, but the reverse problem, protecting the agent from malicious execution environments, has not. We propose an approach that relies on trusted and tamper-resistant hardware to prevent breaches of trust, rather than correcting them after the fact. We address the question of how to base trust on technical reasoning. We present a pessimistic approach to trust that tries to prevent malicious behavior from occurring in the first place, rather than correcting it after it has occurred.
---
paper_title: E-Commerce Trust Metrics and Models

paper_content:

Traditional models of trust between vendors and buyers fall short of requirements for an electronic marketplace, where anonymous transactions cross territorial and legal boundaries as well as traditional value-chain structures. Alternative quantifications of trust may offer better evaluations of transaction risk in this environment. This article introduces a notion of quantifiable trust and then develops models that can use these metrics to verify e-commerce transactions in ways that might be able to satisfy the requirements of mutual trust. The article uses two examples in illustrating these concepts: one for an e-commerce printing enterprise and the other for Internet stock trading.
---
paper_title: Trust Relationships in a Mobile Agent System

paper_content:

The notion of trust is presented as an important component in a security infrastructure for mobile agents. A trust model that can be used in tackling the aspect of protecting mobile agents from hostile platforms is proposed. We define several trust relationships in our model, and present a trust derivation algorithm that can be used to infer new relationships from existing ones. An example of how such a model can be utilized in a practical system is provided.
---
paper_title: Trust revelation in multiagent interaction

paper_content:

We analyze untrustworthy interactions, that is, interactions in which a party may fail to carry out its obligations. Such interactions pose agents with the problem of how to estimate the trustworthiness of the other party. The efficiency of untrustworthy interactions critically depends on the amount and the nature of information about untrustworthy agents. We propose a solution to the problem of learning and estimating trustworthiness. Instead of relying on a third party for providing information or for backing up multiagent interaction, we propose an incentivecompatible interaction mechanism in which agents truthfully reveal their trustworthiness at the beginning of every interaction. In such a mechanism agents always report their true level of trustworthiness, even if they are untrustworthy.
---
paper_title: Trust is much more than subjective probability: mental components and sources of trust

paper_content:

In this paper we claim the importance of a cognitive view of trust (its articulate, analytic and founded view) in contrast with a mere quantitative and opaque view of trust supported by economics and game theory (GT). We argue in favour of a cognitive view of trust as a complex structure of beliefs and goals, implying that the truster must have a "theory of the mind" of the trustee. Such a structure of beliefs determines a "degree of trust" and an estimation of risk, and then a decision to rely or not on the other, which is also based on a personal threshold of risk acceptance/avoidance. Finally, we also explain rational and irrational components and uses of trust.
---
paper_title: On the Problem of Trust in Mobile Agent Systems

paper_content:

Systems that support mobile agents are increasingly being used on the global Internet. Security concerns dealing with the protection of the execution environment from malicious agents are extensively being tackled. We concentrate on the reverse problem, namely how a mobile agent can be protected from malicious behaviour of the execution environment, which is largely ignored. We will identify the problem of trust as the major issue in this context and describe a trusted and tamper-proof hardware that can be used to divide this problem among several principals, each of which has to be trusted with a special task. We show that the presented approach can be used to mitigate an important problem in the design of open systems.
---
paper_title: Trust metrics, models and protocols for electronic commerce transactions

paper_content:

The paper introduces the notion of quantifiable trust for electronic commerce. It describes metrics and models for the measurement of trust variables and fuzzy verification of transactions. Trust metrics help preserve system availability by determining risk on transactions. Furthermore, when several entities are involved in electronic transactions, previously know techniques are applied for trust propagation. Malicious transacting entities may try to illegitimately gain access to private trust information. Suitable protocols are developed to minimize breach of privacy and incorporate a non repudiable context using cryptographic techniques.
---

Title: A Survey of Self-protected Mobile Agents

Section 1: INTRODUCTION
Description 1: Introduce the concept of mobile agents and outline the security risks they encounter, focusing on the need for self-protection mechanisms.

Section 2: MOBILE AGENT' SELF-PROTECTION
Description 2: Present classical techniques for mobile agent self-protection and emphasize the importance of trusted execution environments.

Section 3: Mobile agent security
Description 3: Discuss different security threats mobile agents face and common approaches to protect themselves, including cryptographic methods and obfuscation techniques.

Section 4: Cryptographic Approaches
Description 4: Detail cryptographic methods such as hiding functions used in mobile agent self-protection and their limitations.

Section 5: Obfuscation Techniques
Description 5: Explain obfuscation techniques for protecting mobile agent code from reverse engineering and their practical constraints.

Section 6: Environmental Key
Description 6: Explore the concept of using environmental keys for agent self-protection and estimating host trustworthiness.

Section 7: The k-out-of-n Threshold Scheme Approach
Description 7: Describe the k-out-of-n threshold scheme and other related methods for ensuring secure distributed computing with mobile agents.

Section 8: Trusted execution environments
Description 8: Review trusted hardware and software approaches for creating trusted execution environments to protect mobile agents.

Section 9: Synthesis
Description 9: Synthesize previous findings on trusted hardware and software security approaches and discuss the necessity of dynamic trust estimation for mobile agents.

Section 10: TRUST ESTIMATION
Description 10: Elaborate on the concept of trust in mobile agent security, reviewing various trust models and their application in dynamically assessing host trustworthiness.