ITR: Bandwidth Efficient Techniques for Ensuring Mobile Code Integrity and Authentication

ITR：确保移动代码完整性和身份验证的带宽高效技术

• 批准号: 0219559
• 负责人: Lori Pollock
• 金额: $ 32.82万
• 依托单位: University of Delaware
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2002
• 资助国家: 美国
• 起止时间: 2002-09-01 至 2006-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0219559&HistoricalAwards=false
• 关键词: ITR; Bandwidth; Efficient; Techniques; Ensuring

Existing methods to validate mobile code integrity and author authentication include using certificates, encrypting the code, and using digital signatures to sign applications. This proposal addresses the challenge of providing users with a system that can overcome the weaknesses of certificates (which require additional bandwidth) and conventional signatures (which can be removed) without becoming as obtrusive as encrypted code. This research proposes a novel approach in which the code serves as its own authentication device. The overall goal of this proposed research is to develop both the foundations and a unifying framework for ensuring integrity and authentication of mobile code, and then to build a prototype environment consisting of a set of automatic tools that embody the developed techniques.The results will be:(1) techniques for statically analyzing mobile code representations to efficiently compute a tamper detection mark and to embed, extract, and validate the mark, (2) static analysis techniques for generating a unique program fingerprint to be used as a less stringent form of tamper detection and for intellectual property protection, (3) a suite of platform-independent tools that automate the process of ensuring integrity and authentication for mobile code, (4) thorough experimental evaluation of the developed techniques, and (5) increased participation of undergraduates in experimental computerscience research, with particular attention to encouraging the pursuit of graduate education and women in computerscience.This proposed research represents a significant step towards ensuring high confidence in the integrity of mobile code, which is becoming a major component of software systems exploiting the Internet.

验证移动代码完整性和作者身份验证的现有方法包括使用证书、加密代码和使用数字签名对应用程序进行签名。这个提议解决了为用户提供一个能够克服证书（需要额外带宽）和传统签名（可以删除）的弱点的系统的挑战，而不会像加密代码那样引人注目。本研究提出了一种新的方法，其中代码作为自己的身份验证设备。本研究的总体目标是开发确保移动代码完整性和身份验证的基础和统一框架，然后构建一个由一组体现所开发技术的自动工具组成的原型环境。结果将是：(1)静态分析移动代码表示以有效地计算篡改检测标记并嵌入、提取和验证标记的技术；(2)生成唯一程序指纹的静态分析技术，用于不太严格的篡改检测和知识产权保护；(3)一套独立于平台的工具，用于自动化确保移动代码完整性和身份验证的过程。(4)对开发的技术进行彻底的实验评估；(5)增加本科生参与实验计算机科学研究，特别注意鼓励研究生教育和女性在计算机科学领域的发展。这项提议的研究代表了确保移动代码完整性高可信度的重要一步，移动代码正在成为利用互联网的软件系统的主要组成部分。