Security - Telenor

not be compatible with the security policy
within which the host platform operates.
• Regardless of whether data are passed on to
the host or not, the second issue after policy
compatibility is the enforcement of legitimate
data usage. This has a lot in common with
copyright issues.
Policy data that an agent carries with it, may
therefore end up having a lifetime significantly
longer than the agent’s entire computation. This
in turn implies that agent visits may entail irreversible
changes to remote security policies or
access control structures.
Enforcing security policies is a problem that is
generally difficult, particularly when the policies
also say something about how data may be used,
distributed, etc. There are mainly two sides of
this problem in the mobile agent context:
• securing the host against policy violations by
an agent running on the host’s agent platform;
and
• securing an agent against policy violations by
the host platform on which it is running.
A lot of work has already been done on the first
half of this problem. Schneider recently proposed
in [8] a mechanism that handles a class of
policies more sophisticated than those that can
be modeled by the classic access control matrix.
The real challenge is providing the same protection
to the agent and its data. This appears to be
a very hard problem, as the agent computation is
running on a platform completely under the control
of a potential attacker. Therefore one must
assume that the attacker effectively has read and
write access to all parts of the agent.
2 Terminology
For the sake of brevity, the term agent will hereafter
refer to mobile, autonomous processes
(sometimes also called mobile agents), or code
for processes embedded within data (sometimes
also called embedded agents), unless otherwise
is stated. The main practical difference between
the two types of processes covered by the term
mobile agent is that code embedded in data most
often is not autonomous. A platform is the environment
within which an agent executes.
Denote by Ψ the set of all possible executions
(terminating and non-terminating) by any single
process. Each element in Ψ is a string where
each symbol represents an event, a state, or a
combination of these; the type of representation
is not relevant for the purposes of this article.
Telektronikk 3.2000
A process p has an associated set of possible
executions Ψ p .
Let φ be the set of all algorithmically definable
operations. A very general model of access control
is an extension of the access control matrix.
The normal access control matrix model consists
of a matrix of elements A[s, o], which contains
the rights subject s has to object o. An object is
merely a named data structure. A subject is an
object that happens to represent executable code
or a hardware processor of some kind. A right is
a reference to an operation in φ that may be
applied to an object. Note also that s may apply
some right r ∈ A[s, o] to o at any time. This
model may be generalized by:
• letting A[s, o] be a set of triples (r, q, c),
where
- r is a reference to an algorithmically
expressible operation selected from φ;
- q is a state of some sort;
- c is an algorithm that takes q as a parameter
and checks if s may apply r to o; and
• requiring c to return the decision result as well
as a q' that replaces the q stored in A[s, o]
prior to the access attempt.
By dropping the informal requirement of algorithmic
expressibility, as well as allowing subjects
to be both legal persons and automated
components, the above model can accommodate
both the automated and manual parts of a system
(read: both computers and people).
A subject s has a right (r, q, c) to an object o
if and only if it has the legitimate authority to
apply r to o under the constraints defined by
c and q. A security policy can be viewed as a
system for assigning and managing rights.
An interesting model proposed by Schneider in
[8] is one based on execution monitoring. In the
execution monitoring model, a security policy
is defined by a predicate P operating on a set
P Ψ. Since it is not practical to evaluate predicates
on sets, another predicate ^ P is defined,
which operates on the elements of each set: the
execution of a process. ^ P is necessarily at least as
restrictive as P (see [8] for details), and one says
that a process p adheres to its security policy if
for any given execution σ, ^ ⊆
P (σ) holds.
35