ITR: Bandwidth Efficient Techniques for Ensuring Mobile Code Integrity and Authentication

验证移动的代码完整性和作者身份验证的现有方法包括使用证书、加密代码以及使用数字签名来对应用程序进行签名。这一建议解决了向用户提供一个系统的挑战，该系统可以克服证书（需要额外的带宽）和传统签名（可以删除）的弱点，而不会像加密代码那样引人注目。这项研究提出了一种新的方法，其中代码作为自己的认证设备。本研究的总体目标是为确保移动的代码的完整性和认证开发基础和统一框架，然后构建一个原型环境，该环境由一组体现所开发技术的自动工具组成。结果将是：（1）用于静态分析移动的代码表示以有效地计算篡改检测标记并嵌入、提取和验证该标记的技术，（2）静态分析技术，用于生成唯一的程序指纹以用作较不严格的篡改检测形式和用于知识产权保护，（3）一套独立于平台的工具，可以自动化确保移动的代码的完整性和身份验证的过程，（4）对开发的技术进行彻底的实验评估，（5）增加本科生对实验计算机科学研究的参与，这项拟议的研究是确保对移动的代码完整性高度信任的重要一步，移动代码正成为利用互联网的软件系统的主要组成部分。

Existing methods to validate mobile code integrity and author authentication include using certificates, encrypting the code, and using digital signatures to sign applications. This proposal addresses the challenge of providing users with a system that can overcome the weaknesses of certificates (which require additional bandwidth) and conventional signatures (which can be removed) without becoming as obtrusive as encrypted code. This research proposes a novel approach in which the code serves as its own authentication device. The overall goal of this proposed research is to develop both the foundations and a unifying framework for ensuring integrity and authentication of mobile code, and then to build a prototype environment consisting of a set of automatic tools that embody the developed techniques.The results will be:(1) techniques for statically analyzing mobile code representations to efficiently compute a tamper detection mark and to embed, extract, and validate the mark, (2) static analysis techniques for generating a unique program fingerprint to be used as a less stringent form of tamper detection and for intellectual property protection, (3) a suite of platform-independent tools that automate the process of ensuring integrity and authentication for mobile code, (4) thorough experimental evaluation of the developed techniques, and (5) increased participation of undergraduates in experimental computerscience research, with particular attention to encouraging the pursuit of graduate education and women in computerscience.This proposed research represents a significant step towards ensuring high confidence in the integrity of mobile code, which is becoming a major component of software systems exploiting the Internet.