Mobile Ubiquitous Security Environment (MUSE)

Abstract

EXECUTIVE SUMMARYThis is the final report of the Mobile Ubiquitous Security Environment (MUSE) Critical Infrastructure Protection University Research Initiative (CIP/ URI) project. MUSE was proposed to research "understanding mobile code" in the context of Critical Infrastructure Protection (CIP). It made significant advances in this area. Mobile code differs from other software systems in that it uses networks to autonomously move code from one host to another.Many common CIP threats, such as Trojan horses and viruses, pre-date widespread use of the Internet and are not specific to mobile code. Issues such as insuring program correctness, enforcing security policies, avoiding buffer overflows, and detecting malicious code also exist for non-networked software. Our emphasis is on researching how code migration affects infrastructure protection.Viruses, worms, and Denial of Service (DoS) attacks are difficult to counteract in large part because they are highly distributed. Fortifying the defenses of individual processors, or even sub-nets, cannot sufficiently neutralize these threats. Our game theory analysis of DoS attacks contains examples of the limitations of firewalls for protecting distributed systems. Fortifying individual processors is in some ways similar to building a stronger Maginot line after World War II.MUSE studied both the threat posed by malicious mobile code, and the promise of mobile code to adapt when attacked and neutralize threats. Distributed adaptation can put attacked systems on an equal footing with their attackers. The project Statement of Work (SoW) consisted of four tasks: "* Develop a theoretical model "* Study the interface between mobile code and the host computer. "* Study system adaptation "* Create an adaptive network infrastructure. Significant results include:"* A theoretical model for mobile code was developed by integrating mobile agent and cellular automata concepts. Using a simulation tool (CANTOR), that we developed for this model, we found important behavioral differences among mobile code paradigms. "• CANTOR simulations were found to trend like other network simulators. The CANTOR models are simpler and contain fewer factors. They also execute more quickly than traditional approaches. "* A taxonomy of mobile code paradigms was created combining our theoretical model with an existing taxonomy of network attack vulnerabilities. "* Our existing mobile code daemons were integrated with peer-to-peer (P2P) indexing to create an initial adaptive infrastructure. Cryptographic key management has been integrated into this approach. "* We proved that cryptographic primitives can be used with a tamper-proof co-processor to verify bilateral trust between a host and a mobile code package. An application to multi-level security was given.