Secure mobile agent systems using Java: where are we heading?

ABSTRACT

Java is the predominant language for mobile agent systems, both for implementing mobile agent execution environments and for writing mobile agent applications. This is due to inherent support for code mobility by means of dynamic class loading and separable class name spaces, as well as a number of security properties, such as language safety and access control by means of stack introspection. However, serious questions must be raised whether Java is actually up to the task of providing a secure execution environment for mobile agents. At the time of writing, it has neither resource control nor proper application separation. In this article we take an in-depth look at Java as a foundation for secure mobile agent systems.

REFERENCES

• 1: Godmar Back , Wilson Hsieh, Drawing the Red Line in Java, Proceedings of the The Seventh Workshop on Hot Topics in Operating Systems, p.116, March 28-30, 1999
• 2: Walter Binder, Design and Implementation of the J-SEAL2 Mobile Agent Kernel, Proceedings of the 2001 Symposium on Applications and the Internet (SAINT 2001), p.35, January 08-12, 2001
• 3: Walter Binder , Jane G. Hulaas , Alex Villazón, Portable resource control in Java, Proceedings of the 16th ACM SIGPLAN conference on Object oriented programming, systems, languages, and applications, p.139-155, October 14-18, 2001, Tampa Bay, FL, USA
• 4: James Gosling , Greg Bollella, The Real-Time Specification for Java, Addison-Wesley Longman Publishing Co., Inc., Boston, MA, 2000
• 5: C. Bryce , J. Vitek, The JavaSeal Mobile Agent Kernel, Proceedings of the First International Symposium on Agent Systems and Applications Third International Symposium on Mobile Agents, p.103, October 03-06, 1999
• 6: S. Doyon and M. Debbabi. On object initialization in the Java bytecode. Computer Communications, 23(17): 1594-1605, Nov. 2000.
• 7: Michael Franz , Thomas Kistler, Slim binaries, Communications of the ACM, v.40 n.12, p.87-94, Dec. 1997 [doi>10.1145/265563.265576]
• 8: James Gosling , Bill Joy , Guy L. Steele, The Java Language Specification, Addison-Wesley Longman Publishing Co., Inc., Boston, MA, 1996
• 9: Java Community Process. JSR 121 --- Application Isolation API Specification. Web pages at http://www.jcp.org/jsr/detail/121.jsp.
• 10: Tim Lindholm , Frank Yellin, Java Virtual Machine Specification, Addison-Wesley Longman Publishing Co., Inc., Boston, MA, 1999

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection

Additional Classification:
  C. Computer Systems Organization
  C.1 PROCESSOR ARCHITECTURES
      C.1.3 Other Architecture Styles
          Subjects: Cellular architecture (e.g., mobile)

  D. Software
  D.3 PROGRAMMING LANGUAGES
      D.3.2 Language Classifications

          Nouns: Java

General Terms:
Design, Security

Keywords:
Java, mobile agents, security, survey