ITR: Bandwidth Efficient Techniques for Ensuring Mobile Code Integrity and Authentication

点击翻译按钮获取中文摘要

Existing methods to validate mobile code integrity and author authentication include using certificates, encrypting the code, and using digital signatures to sign applications. This proposal addresses the challenge of providing users with a system that can overcome the weaknesses of certificates (which require additional bandwidth) and conventional signatures (which can be removed) without becoming as obtrusive as encrypted code. This research proposes a novel approach in which the code serves as its own authentication device. The overall goal of this proposed research is to develop both the foundations and a unifying framework for ensuring integrity and authentication of mobile code, and then to build a prototype environment consisting of a set of automatic tools that embody the developed techniques.The results will be:(1) techniques for statically analyzing mobile code representations to efficiently compute a tamper detection mark and to embed, extract, and validate the mark, (2) static analysis techniques for generating a unique program fingerprint to be used as a less stringent form of tamper detection and for intellectual property protection, (3) a suite of platform-independent tools that automate the process of ensuring integrity and authentication for mobile code, (4) thorough experimental evaluation of the developed techniques, and (5) increased participation of undergraduates in experimental computerscience research, with particular attention to encouraging the pursuit of graduate education and women in computerscience.This proposed research represents a significant step towards ensuring high confidence in the integrity of mobile code, which is becoming a major component of software systems exploiting the Internet.