Mobile agent technology presents an attractive alternative to the client-server paradigm for several network and real-time applications. However, for most applications, the lack of a viable agent security model has limited the adoption of the agent paradigm. This thesis presents a security model for mobile agents based on a security infrastructure for Computational Grids, and specifically, on X.509 Proxy Certificates. Proxy Certificates serve as credentials for Grid applications, and their primary purpose is temporary delegation of authority. Exploiting the similarity between Grid applications and mobile agent applications, this thesis motivates the use of Proxy Certificates as credentials for mobile agents. A new extension for Proxy Certificates is proposed in order to make them suited to mobile agent applications, and mechanisms are presented for agent-to-host authentication, restriction of agent privileges, and secure delegation of authority during spawning of new agents. Finally, the implementation of the proposed security mechanisms as modules within a multi-lingual and modular agent infrastructure, the Distributed Agent Delivery System, is discussed.

With the growing popularity of e-commerce applications that use software agents, the protection of mobile agent data has become imperative. To that end, the performance of four methods that protect the data integrity of mobile agents is evaluated. The methods investigated include existing approaches known as the Partial Result Authentication Codes, Hash Chaining, and Set Authentication Code methods, and a technique of our own design, called the Modified Set Authentication Code method, which addresses the limitations of the Set Authentication Code method. The experiments were run using the DADS agent system (developed at the Network Research Laboratory at UNT), for which a Data Integrity Module was designed. The experimental results show that our Modified Set Authentication Code technique performed comparably to the Set Authentication Code method.

An increasingly promising and widespread topic of research in distributed computing is the mobile agent paradigm: code travelling and performing computations on remote hosts in an autonomous manner. One of the biggest challenges faced by this new paradigm is security. The issue of protecting sensitive code and data carried by a mobile agent against tampering from a malicious host is particularly hard but important. Based on secure multi-party computation, a recent research direction shows the feasibility of a software-only solution to this problem, which had been deemed impossible by some researchers previously. The best result prior to this dissertation is a single-agent protocol which requires the participation of a trusted third party. Our research employs multi-agent protocols to eliminate the trusted third party, resulting in a protocol with minimum trust assumptions. This dissertation presents one of the first formal definitions of secure mobile agent computation, in which the privacy and integrity of the agent code and data as well as the data provided by the host are all protected. We present secure protocols for mobile agent computation against static, semi-honest or malicious adversaries without relying on any third party or trusting any specific participant in the system. The security of our protocols is formally proven through standard proof technique and according to our formal definition of security. Our second result is a more practical agent protocol with strong security against most real-world host attacks. The security features are carefully analyzed, and the practicality is demonstrated through implementation and experimental study on a real-world mobile agent platform. All these protocols rely heavily on well-established cryptographic primitives, such as encrypted circuits, threshold decryption, and oblivious transfer. Our study of these tools yields new contributions to the general field of cryptography. Particularly, we correct a well-known construction of the encrypted circuit and give one of the first provably secure implementations of the encrypted circuit.

by Mo Chun Man. / Thesis (M.Phil.)--Chinese University of Hong Kong, 2001. / Includes bibliographical references (leaves 72-80). / Abstracts in English and Chinese. / Chapter 1 --- INTRODUCTION --- p.1 / Chapter 1.1 --- The Mobile Agents --- p.2 / Chapter 1.2 --- The Mobile Agent Paradigm --- p.4 / Chapter 1.2.1 --- Initiatives --- p.5 / Chapter 1.2.2 --- Applications --- p.7 / Chapter 1.3 --- The Mobile Agent S ystem --- p.8 / Chapter 1.4 --- Security in Mobile Agent System --- p.9 / Chapter 1.5 --- Thesis Organization --- p.11 / Chapter 2 --- BACKGROUND AND FOUNDATIONS --- p.12 / Chapter 2.1 --- Encryption/Decryption --- p.12 / Chapter 2.2 --- One-way Hash Function --- p.13 / Chapter 2.3 --- Message Authentication Code (MAC) --- p.13 / Chapter 2.4 --- Homomorphic Encryption Scheme --- p.14 / Chapter 2.5 --- One-Round Oblivious Transfer --- p.14 / Chapter 2.6 --- Polynomial-time Algorithms --- p.14 / Chapter 2.7 --- Circuit --- p.15 / Chapter 3 --- SURVEY OF PROTECTION SCHEMES ON MOBILE AGENTS --- p.16 / Chapter 3.1 --- Introduction --- p.16 / Chapter 3.2 --- Detection Approaches --- p.17 / Chapter 3.2.1 --- Execution Traces --- p.17 / Chapter 3.2.2 --- Partial Result Encapsulation --- p.18 / Chapter 3.2.3 --- State Appraisal --- p.20 / Chapter 3.3 --- Prevention Approaches --- p.20 / Chapter 3.3.1 --- Sliding Encryption --- p.20 / Chapter 3.3.2 --- Tamper-resistant Hardware --- p.21 / Chapter 3.3.3 --- Multi-agent Cooperation --- p.22 / Chapter 3.3.4 --- Code Obfuscation --- p.23 / Chapter 3.3.5 --- Intention Spreading and Shrinking --- p.26 / Chapter 3.3.6 --- Encrypted Function Evaluation --- p.26 / Chapter 3.3.7 --- Black Box Test Prevention --- p.27 / Chapter 3.4 --- Chapter Summary --- p.29 / Chapter 4 --- TAXONOMY OF ATTACKS --- p.30 / Chapter 4.1 --- Introduction --- p.30 / Chapter 4.2 --- Whatis attack? --- p.31 / Chapter 4.3 --- How can attacks be done? --- p.32 / Chapter 4.4 --- Taxonomy of Attacks --- p.33 / Chapter 4.4.1 --- Purposeful Attack --- p.33 / Chapter 4.4.2 --- Frivolous Attack --- p.36 / Chapter 4.4.3 --- The Full Taxonomy --- p.38 / Chapter 4.5 --- Using the Taxonomy --- p.38 / Chapter 4.5.1 --- Match to Existing Protection Schemes --- p.38 / Chapter 4.5.2 --- Insight to Potential Protection Schemes --- p.41 / Chapter 4.6 --- Chapter Summary --- p.42 / Chapter 5 --- PROTECTION FOR REACTIVE MOBILE AGENTS --- p.43 / Chapter 5.1 --- Introduction --- p.43 / Chapter 5.2 --- The Model --- p.45 / Chapter 5.2.1 --- The Non-reactive and Reactive Mobile Agent Model --- p.45 / Chapter 5.2.2 --- The Computation Flow --- p.47 / Chapter 5.2.3 --- An Example --- p.49 / Chapter 5.3 --- tools --- p.51 / Chapter 5.3.1 --- Encrypted Circuit Construction --- p.51 / Chapter 5.3.2 --- Circuit Cascading --- p.53 / Chapter 5.4 --- Proposed Protection Scheme --- p.54 / Chapter 5.4.1 --- Two-hop Protocol --- p.55 / Chapter 5.4.2 --- Multi-hop Protocol --- p.60 / Chapter 5.5 --- Security Analysis --- p.60 / Chapter 5.5.1 --- Security under Purposeful Attacks --- p.61 / Chapter 5.5.2 --- Security under Frivolous Attacks --- p.62 / Chapter 5.6 --- Improvements --- p.62 / Chapter 5.6.1 --- Basic Idea --- p.63 / Chapter 5.6.2 --- Input Retrieval Protocol --- p.63 / Chapter 5.6.3 --- Combating Frivolous Attacks --- p.65 / Chapter 5.7 --- Further Considerations --- p.66 / Chapter 5.8 --- Chapter Summary --- p.67 / Chapter 6 --- CONCLUSIONS --- p.68 / APPENDIX --- p.71 / BIBLIOGRAPHY --- p.72

by Lam Tak-Cheung. / Thesis (M.Phil.)--Chinese University of Hong Kong, 2002. / Includes bibliographical references (leaves 61-66). / Abstracts in English and Chinese. / Chapter 1. --- Introduction --- p.1 / Chapter 1.1 --- Evolution of the Mobile Agent Paradigm --- p.2 / Chapter 1.2 --- Beneficial Aspects of Mobile Agents --- p.3 / Chapter 1.3 --- Security Threats of Mobile Agents --- p.4 / Chapter 1.4 --- Organization of the Thesis --- p.6 / Chapter 2. --- Background of Cryptographic Theories --- p.7 / Chapter 2.1 --- Introduction --- p.7 / Chapter 2.2 --- Encryption and Decryption --- p.7 / Chapter 2.3 --- Six Cryptographic Primitives --- p.8 / Chapter 2.3.1 --- Symmetric Encryption --- p.8 / Chapter 2.3.2 --- Asymmetric Encryption --- p.9 / Chapter 2.3.3 --- Digital Signature --- p.9 / Chapter 2.3.4 --- Message Digest --- p.10 / Chapter 2.3.5 --- Digital Certificate --- p.11 / Chapter 2.3.6 --- Zero-Knowledge Proof --- p.11 / Chapter 2.4 --- RSA Public Key Cryptosystem --- p.12 / Chapter 2.5 --- Blind Signature --- p.13 / Chapter 2.6 --- Secret Sharing --- p.14 / Chapter 2.7 --- Conclusion Remarks --- p.14 / Chapter 3. --- Background of Mobile Agent Clones --- p.15 / Chapter 3.1 --- Introduction --- p.15 / Chapter 3.2 --- Types of Agent Clones --- p.15 / Chapter 3.3 --- Mobile Agent Cloning Problems --- p.16 / Chapter 3.4 --- Baek's Detection Scheme for Mobile Agent Clones --- p.17 / Chapter 3.4.1 --- The Main Idea --- p.17 / Chapter 3.4.2 --- Shortcomings of Baek's Scheme --- p.18 / Chapter 3.5 --- Conclusion Remarks --- p.19 / Chapter 4. --- Background of E-cash --- p.20 / Chapter 4.1 --- Introduction --- p.20 / Chapter 4.2 --- The General E-cash Model --- p.21 / Chapter 4.3 --- Chaum-Pedersen's General Transferable E-cash --- p.22 / Chapter 4.4 --- Ferguson's Single-term Off-line E-coins --- p.23 / Chapter 4.4.1 --- Technical Background of the Secure Tools --- p.24 / Chapter 4.4.2 --- Protocol Details --- p.27 / Chapter 4.5 --- Conclusion Remarks --- p.30 / Chapter 5. --- A Mobile Agent Clone Detection System using General Transferable E-cash --- p.31 / Chapter 5.1 --- Introduction --- p.31 / Chapter 5.2 --- Terminologies --- p.33 / Chapter 5.3 --- Mobile Agent Clone Detection System with Transferable E-cash --- p.34 / Chapter 5.4 --- Security and Privacy Analysis --- p.37 / Chapter 5.5 --- Attack Scenarios --- p.39 / Chapter 5.5.1 --- The Chosen Host Response Attack --- p.39 / Chapter 5.5.2 --- The Truncation and Substitution Attack --- p.40 / Chapter 5.6 --- An Alternative Scheme without Itinerary Privacy --- p.41 / Chapter 5.7 --- Conclusion Remarks --- p.43 / Chapter 6. --- Specific Implementation of the Mobile Agent Clone Detection System with Transferable Ferguson's E-coin --- p.45 / Chapter 6.1 --- Introduction --- p.45 / Chapter 6.2 --- The Clone Detection Environment --- p.46 / Chapter 6.3 --- Protocols --- p.48 / Chapter 6.3.2 --- Withdrawing E-tokens --- p.48 / Chapter 6.3.2 --- The Agent Creation Protocol --- p.51 / Chapter 6.3.3 --- The Agent Migration Protocol --- p.51 / Chapter 6.3.4 --- Clone Detection and Culprit Identification --- p.52 / Chapter 6.4 --- Security and Privacy Analysis --- p.54 / Chapter 6.5 --- Complexity Analysis --- p.55 / Chapter 6.5.1 --- Compact Passport --- p.55 / Chapter 6.5.2 --- Passport growth in size --- p.56 / Chapter 6.6 --- Conclusion Remarks --- p.56 / Chapter 7. --- Conclusions --- p.58 / Appendix 一 Papers derived from this thesis Bibliography

Chan, Hing-wing. / Thesis (M.Phil.)--Chinese University of Hong Kong, 2000. / Includes bibliographical references (leaves 76-79). / Abstracts in English and Chinese. / Abstract --- p.i / Abstract (Chinese) --- p.ii / Acknowledgements --- p.iii / Contents --- p.iv / List of Figures --- p.vii / List of Tables --- p.viii / Chapter Chapter 1. --- Introduction --- p.1 / Chapter 1.1. --- Mobile Agents and the Problems --- p.1 / Chapter 1.2. --- Approach --- p.3 / Chapter 1.3. --- Contributions --- p.3 / Chapter 1.4. --- Organization of This Thesis --- p.4 / Chapter Chapter 2. --- The Mobile Code Paradigm --- p.6 / Chapter 2.1. --- Mobile Code: an Alternative to Client/Servers --- p.6 / Chapter 2.1.1. --- Classification of Mobile Codes --- p.8 / Chapter 2.1.2. --- Applications of Mobile Code Paradigms --- p.10 / Chapter 2.1.3. --- Supporting Implementation Technologies --- p.11 / Chapter 2.2. --- The Problems of Mobile Code --- p.13 / Chapter 2.2.1. --- Security Issues in Distributed Systems --- p.13 / Chapter 2.2.2. --- Security Concerns of Mobile Code Paradigms --- p.15 / Chapter 2.2.2.1. --- Security Attacks --- p.15 / Chapter 2.2.2.2. --- Security Mechanisms --- p.17 / Chapter 2.2.2.3. --- A Security Comparison between Paradigms --- p.20 / Chapter 2.2.3. --- Security Features of Implementation Technologies --- p.20 / Chapter 2.2.3.1. --- Security Services of Message-based Technology --- p.21 / Chapter 2.2.3.2. --- Security Services of Object-based Technology --- p.21 / Chapter 2.2.3.3. --- Security Services of Mobile Technology --- p.22 / Chapter 2.2.3.4. --- A Comparison of Technologies on Security Services --- p.22 / Chapter 2.3. --- Chapter Summary --- p.23 / Chapter Chapter 3. --- "Mobile Agents, Its Security and Reliability Issues" --- p.24 / Chapter 3.1. --- Advantages and Applications of Mobile Agents --- p.24 / Chapter 3.2. --- Security Concerns of Mobile Agents --- p.26 / Chapter 3.2.1. --- Host Security --- p.27 / Chapter 3.2.2. --- Agent Security --- p.27 / Chapter 3.3. --- Techniques to Protect Mobile Agents --- p.29 / Chapter 3.3.1. --- Protected Agent States --- p.29 / Chapter 3.3.2. --- Mobile Cryptography --- p.30 / Chapter 3.4. --- Reliability Concerns of Mobile Agents --- p.31 / Chapter Chapter 4. --- Security and Reliability Modeling for Mobile Agents --- p.32 / Chapter 4.1. --- Attack Model and Scenarios --- p.33 / Chapter 4.2. --- General Security Models --- p.34 / Chapter 4.2.1. --- Security and Reliability --- p.34 / Chapter 4.2.2. --- Deriving Security Models --- p.36 / Chapter 4.2.3. --- The Time-to-Effort Function --- p.38 / Chapter 4.3. --- A Security Model for Mobile Agents --- p.40 / Chapter 4.4. --- Discussion of the Proposed Model --- p.43 / Chapter 4.5. --- A Reliability Model for Mobile Agents --- p.43 / Chapter Chapter 5. --- The Concordia Mobile Agent Platform --- p.46 / Chapter 5.1. --- Overview --- p.46 / Chapter 5.2. --- Special Features --- p.47 / Chapter Chapter 6. --- SIAS: A Shopping Information Agent System --- p.49 / Chapter 6.1. --- What the System Does --- p.49 / Chapter 6.2. --- System Design --- p.50 / Chapter 6.2.1. --- Object Description --- p.50 / Chapter 6.2.2. --- Flow Description --- p.52 / Chapter 6.3. --- Implementation --- p.53 / Chapter 6.3.1. --- Choice of Programming Language --- p.53 / Chapter 6.3.2. --- Choice of Mobile Agent Platform --- p.53 / Chapter 6.3.3. --- Other Implementation Details --- p.54 / Chapter 6.4. --- Snapshots --- p.54 / Chapter 6.5. --- Security Design of SIAS --- p.57 / Chapter 6.5.1. --- Security Problems of SIAS --- p.58 / Chapter 6.5.2. --- Our Solutions to the Problems --- p.60 / Chapter 6.5.3. --- Evaluation of the Secure SIAS --- p.64 / Chapter 6.5.3.1. --- Security Analysis --- p.64 / Chapter 6.5.3.2. --- Performance Vs Query Size --- p.65 / Chapter 6.5.3.3. --- Performance Vs Number of Hosts --- p.67 / Chapter 6.6. --- Reliability Design of SIAS --- p.69 / Chapter 6.6.1. --- Reliability Problems of SIAS --- p.69 / Chapter 6.6.2. --- Our Solutions to the Problems --- p.70 / Chapter 6.6.3. --- Evaluation of the Reliable SIAS --- p.71 / Chapter Chapter 7. --- Conclusions and Future Work --- p.73 / Bibliography --- p.76

Thesis (Ph. D.)--Ohio State University, 2004. / Title from first page of PDF file. Document formatted into pages; contains xvii, 119 p.; also includes graphics. Includes abstract and vita. Advisor: Gerald Baumgartner, Dept. of Computer and Information Science. Includes bibliographical references (p. 111-119).

Thesis (M.Sc.)--Memorial University of Newfoundland, 2002. / Bibliography: leaves 105-112.

Computer networks used in Telecommunication, particularly the Internet, have been used to carry computer data only, but now they carry voice and/or video also. Because each type of this traffic has specific flow characteristics, each type has to be handled with a certain level of guaranteed quality. So based on that, IETF introduced a Quality of Service tool, called Differentiated Service. It offers different levels of service to different classes of traffic. Even then, the problem of congestion arises due to sharing of a finite bandwith. In the case of real time multi media traffic, congestion due to inadequate bandwith contributes heavily to the quality, whereas in non-real time traffic the effect of congestion is to make data transfer take a longer time. In contrast, real time data become become obsolete if they do not arrive on time. Therefore what is needed is some way of ensuring that during periods of congestion, real time traffic is not affected at all, or is at least given a higher priority than non-real time. / The motivation for the research that has been carried out was therefore to develop a rule based traffic management scheme for DiffServ networks with a view to introducing QoS (Quality of Service). This required definition of rules for congestion management/control based on the type and nature of IP traffic encountered, and then constructing and storing these rules to enable future access for application and enforcement. We first developed the required rule base and then developed the software based mobile agents using the Java (RMI) application package, for accessing these rules for application and enforcement. Consequently, these mobile agents act as smart traffic managers at nodes/routers in the computer based communication network and manage congestion. The rule base as well as the mobile agent software developed in Java (RMI), were validated using computer simulation. The contents of the research carried out have been presented in the thesis. / Thesis (PhD)--University of South Australia, 2006.

Thesis (M.C.S.) - Carleton University, 2002. / Includes bibliographical references (p. 114-122). Also available in electronic format on the Internet.