ITR: Bandwidth Efficient Techniques for Ensuring Mobile Code Integrity and Authentication

验证移动代码完整性和作者身份验证的现有方法包括使用证书、加密代码以及使用数字签名对应用程序进行签名。该提案解决了为用户提供一个系统的挑战，该系统可以克服证书（需要额外带宽）和传统签名（可以删除）的弱点，而不会变得像加密代码那样引人注目。这项研究提出了一种新颖的方法，其中代码充当其自己的身份验证设备。这项研究的总体目标是开发基础和统一框架，以确保移动代码的完整性和身份验证，然后构建一个由一组体现所开发技术的自动工具组成的原型环境。结果将是：(1) 静态分析移动代码表示的技术，以有效计算篡改检测标记并嵌入、提取和验证标记，(2) 静态分析技术，用于生成唯一的程序指纹，以用作较不严格的篡改检测形式和智能识别。财产保护，（3）一套独立于平台的工具，可以自动化确保移动代码完整性和身份验证的过程，（4）对已开发技术进行彻底的实验评估，以及（5）增加本科生对实验计算机科学研究的参与，特别注意鼓励研究生教育和计算机科学领域的女性。这项拟议的研究代表了确保对移动代码完整性高度信任的重要一步，移动代码正在成为利用互联网的软件系统的主要组成部分。

Existing methods to validate mobile code integrity and author authentication include using certificates, encrypting the code, and using digital signatures to sign applications. This proposal addresses the challenge of providing users with a system that can overcome the weaknesses of certificates (which require additional bandwidth) and conventional signatures (which can be removed) without becoming as obtrusive as encrypted code. This research proposes a novel approach in which the code serves as its own authentication device. The overall goal of this proposed research is to develop both the foundations and a unifying framework for ensuring integrity and authentication of mobile code, and then to build a prototype environment consisting of a set of automatic tools that embody the developed techniques.The results will be:(1) techniques for statically analyzing mobile code representations to efficiently compute a tamper detection mark and to embed, extract, and validate the mark, (2) static analysis techniques for generating a unique program fingerprint to be used as a less stringent form of tamper detection and for intellectual property protection, (3) a suite of platform-independent tools that automate the process of ensuring integrity and authentication for mobile code, (4) thorough experimental evaluation of the developed techniques, and (5) increased participation of undergraduates in experimental computerscience research, with particular attention to encouraging the pursuit of graduate education and women in computerscience.This proposed research represents a significant step towards ensuring high confidence in the integrity of mobile code, which is becoming a major component of software systems exploiting the Internet.