A Mechanism to Avoid Collusion Attacks Based on Code Passing in Mobile Agent Systems

Mobile agents are software entities consisting of code, data, state and itinerary that can migrate autonomously from host to host executing their code. Despite its benefits, security issues strongly restrict the use of code mobility. The protection of mobile agents against the attacks of malicious hosts is considered the most difficult security problem to solve in mobile agent systems. In particular, collusion attacks have been barely studied in the literature. This paper presents a mechanism that avoids collusion attacks based on code passing. Our proposal is based on a Multi-Code agent, which contains a different variant of the code for each host. A Trusted Third Party is responsible for providing the information to extract its own variant to the hosts, and for taking trusted timestamps that will be used to verify time coherence.

[1]  J. C. Byington,et al.  Mobile agents and security , 1998, IEEE Commun. Mag..

[2]  Wayne Jansen,et al.  NIST Special Publication 800-19 – Mobile Agent Security , 2000 .

[3]  Rolf Oppliger.  Security issues related to mobile code and agent-based systems , 1999, Comput. Commun..

[4]  Peter Van Roy,et al.  Programming languages for distributed applications , 2009, New Generation Computing.

[5]  Wayne A. Jansen,et al.  Countermeasures for mobile agent security , 2000, Comput. Commun..

[6]  Jose L. Muñoz,et al.  Implementation and Performance Evaluation of a Protocol for Detecting Suspicious Hosts , 2003, MATA.

[7]  Joan Borrell,et al.  Protecting Mobile Agent Itineraries , 2003, MATA.

[8]  Volker Roth,et al.  Mutual Protection of Co-operating Agents , 2001, Secure Internet Programming.

[9]  Levente Buttyán,et al.  Introducing Trusted Third Parties to the Mobile Agent Paradigm , 2001, Secure Internet Programming.

[10]  E. Horlait.  Mobile Agents for Telecommunication Applications , 2003, Lecture Notes in Computer Science.

[11]  Rolf Oppliger,et al.  Advanced security techniques for network protection , 2000, Comput. Commun..

[12]  Christian F. Tschudin,et al.  Protecting Mobile Agents Against Malicious Hosts , 1998, Mobile Agents and Security.

[13]  Andreu Riera,et al.  Securing the itinerary of mobile agents through a non-repudiation protocol , 1999, Proceedings IEEE 33rd Annual 1999 International Carnahan Conference on Security Technology (Cat. No.99CH36303).

[14]  Jan Vitek,et al.  Secure Internet Programming , 1999 .

[15]  Jose L. Muñoz,et al.  Secure brokerage mechanisms for mobile electronic commerce , 2006, Comput. Commun..

[16]  Wayne A. Jansen,et al.  Mobile Agent Security , 1999 .

[17]  José M. Troya,et al.  A framework for secure execution of software , 2004, International Journal of Information Security.

[18]  Fritz Hohl,et al.  Time Limited Blackbox Security: Protecting Mobile Agents From Malicious Hosts , 1998, Mobile Agents and Security.

[19]  Kam-Wing Ng,et al.  Detection of Malicious Host Attacks by Tracing with Randomly Selected Hosts , 2004, EUC.

[20]  Athanasios T. Karygiannis,et al.  SP 800-19. Mobile Agent Security , 1999 .

[21]  David Kinny,et al.  Reliable Agent Communication — A pragmatic perspective , 2001, New Generation Computing.

[22]  Dirk Westhoff,et al.  Methods for Protecting a Mobile Agent's Route , 1999, ISW.

[23]  Giovanni Vigna,et al.  Cryptographic Traces for Mobile Agents , 1998, Mobile Agents and Security.

[24]  Bennet S. Yee.  A Sanctuary for Mobile Agents , 2001, Secure Internet Programming.

[25]  Bruce Schneier,et al.  Environmental Key Generation Towards Clueless Agents , 1998, Mobile Agents and Security.

[26]  Samuel Pierre,et al.  A security protocol for mobile agents based upon the cooperation of sedentary agents , 2007, J. Netw. Comput. Appl..

[27]  Samuel Pierre,et al.  Protection of a mobile agent with a reference clone , 2006, Comput. Commun..

[28]  Fritz Hohl,et al.  A framework to protect mobile agents by using reference states , 2000, Proceedings 20th IEEE International Conference on Distributed Computing Systems.

[29]  Jose L. Muñoz,et al.  Punishing malicious hosts with the cryptographic traces approach , 2006, New Generation Computing.