Collaborative Research: MASSA: Mobile Agent System Security Through Analysis

移动代理系统允许应用程序显式地跨网络重新定位自己。移动代理范例在服务可定制性和灵活性、对分布式资源的优化访问以及对在移动网络环境中部署应用程序的自然支持方面提供了许多优势。然而，尽管移动代理范式提供了优势，在移动代理得到广泛接受之前，必须解决一些基本的安全问题。该项目的总体目标是开发一个通用框架，为使用安全移动代理系统时的安全问题建模和分析提供自动化支持。在UCSB和佐治亚理工学院进行的初步工作表明，适当的分析技术有助于识别移动代理系统中的安全漏洞。特别是，UCSB和佐治亚理工学院的研究人员成功地应用了动态黑盒技术和静态白盒技术来诊断移动代理系统中存在的安全威胁。拟议的研究包括三个主要努力。首先，将开发一个评估移动代理系统安全威胁的框架。该框架通过抽象特定移动代理技术的细节来支持安全问题和机制的高级建模，并包含静态和动态分析技术。其次，设计并实现了一个支持框架中安全分析的原型系统。第三，收集实验对象，进行实验。所进行的实验将允许在为现有移动代理系统定义的实际示例上评估所提出框架的有效性和实用性。

Mobile agents systems allow applications to explicitly relocate themselves across the network. The mobile agent paradigm provides a number of advantages in terms of service customizability and flexibility, optimized access to distributed resources, and natural support to the deployment of applications in a mobile networking environment. However, despite the advantages provided by the mobile agent paradigm, some fundamental security issues must be addressed before mobile agents receive widespread acceptance.The overall objective of the project is to develop a general framework that provides automated support for modeling and analysis of security issues in the use of secure mobile agent systems. Preliminary work conducted at UCSB and Georgia Tech shows that appropriate analysis techniques facilitate identification of security vulnerabilities in mobile agent systems. In particular, the researchers at UCSB and Georgia Tech have successfully applied both dynamic black-box techniques and static white-box techniques to diagnose the presence of security threats in mobile agent systems.The proposed research involves three primary efforts. First, a framework for assessing security threats for mobile agent systems will be developed. The framework supports the high-level modeling of security issues and mechanisms, by abstracting the details of specific mobile agent technologies, and encompasses static and dynamic analysis techniques. Second, a prototype system that supports the security analyses in the framework will be designed and implemented. Third, experimental subjects will be collected and experimentation will be performed. The experiments performed will allow for evaluating the effectiveness and practicality of the proposed framework on real examples defined for existing mobile agent systems.