Security - Telenor

36
Sets definable by such predicates are also called
properties. Sets that cannot be defined by first
order logic are called quasi-properties for the
duration of this article.
A system, or a part of it, is called secure if:
1. the operator’s risk associated with operating the
system is bounded and under control; and/or
2. all executions adhere to the security policy
defined using the risk assessment.
There exist a lot of models for access control,
but until recently there was only one widespread
mechanism employed in implementations: the
reference monitor. Execution monitoring can be
considered a generalization of the reference
monitor model, where a monitor can be built
into a process p prior to execution. This monitor
observes events, states, or a combination of
these as they occur during p’s execution. These
actions form a string σ which is the prefix of
some execution ψ ∈ Ψ p . If σ is such that there is
no execution in Ψ p ∩ P having σ as prefix, the
process p is terminated. By definition p has violated
the security policy by attempting an execution
not in P.
3 Securing Agents
This section lists many of the properties (and
quasi-properties) one could wish from mobile
agents in a security context. It outlines the challenges
that arise when one tries to construct
agents that satisfy these properties. The challenges
are subdivided according to the sourcebased
partitioning of threats given in Section 1.
Mobile agents are dependent on a host platform,
which:
1. supports their computations;
2. interacts with them; and
3. supports their interaction with other “nearby”
agents.
In the case of the autonomous agent in Example
1, one possible platform type would be TACO-
MA. In the case of the macro agent in Example
2, the platform could be a Word or Excel program
combined with underlying network services
used to transport Word and/or Excel documents
between hosts.
From this starting point, threats can be partitioned
according to their source(s):
• agents; and
• agent environments.
Many of the relevant problems have been studied
in some depth before, either in the context of
viruses (in the sense of Cohen in [3]) or hostile
applets. The results for viruses are perhaps especially
interesting for agents embedded in document
data, as is the case with Excel and Word
macros, and languages like PostScript. This article,
however, will not focus on the challenges
that still remain with respect to malicious software.
In the following, subsections titled “Agent
Attacks” deal with attacks carried out by agents
on other agents in the host platform environment
or on the host platform itself.
4 Availability
Availability is of fundamental importance. If
resources are not available to legitimate users,
other security properties or quasi-properties are
usually of little or no interest. For an agent platform
at some host, availability may be associated
with an ability to:
• receive incoming agents, and initiate their
computation within a reasonable amount of
time;
• supply visiting agents with the resources necessary
for them to complete their tasks at that
host within a reasonable amount of time; and
• do limited recovery from faults, for as many
types of faults as is cost-effectively possible.
For an agent at some platform, availability may
be associated with an ability to:
• have limited fault-tolerance in the face of
host-induced faults;
• have some graceful mode of failure as a
(hopefully) last resort, which informs the
sender of the failure, and how far the computation
had proceeded prior to the failure.
Availability is primarily a dependability issue,
but it is also security relevant. Several attacks
base themselves on causing resource outages in
the attacked system (or a component therein).
Attacks of this type are usually called denial-ofservice
attacks. The point of causing resource
outages may be to:
1. cause parts or all of the system to stop functioning
and cause economic or other damage;
or
2. generate a vulnerability, which can subsequently
be used to mount the “real” attack.
Telektronikk 3.2000