Verification caching: towards efficient and secure mobile code execution environments

  • Authors:

  • Nael B. Abu-Ghazaleh;Dhananjay S. Phatak

  • Affiliations:

  • Binghamton University, Binghamton, NY;University of Maryland Baltimore County, Baltimore, MD

  • Venue:
  • Proceedings of the 2002 ACM symposium on Applied computing
  • Year:
  • 2002

Quantified Score

Hi-index 0.00

Visualization

Abstract

In the mobile code paradigm for distributed systems (as well as in the active networks and agents frameworks), programs from possibly unknown hosts interact with the resources local to the host. While this model offers great potential, it also raises difficult security and performance issues. The mobile code unit should be guaranteed to be safe (not to abuse the resources of the host) in a limited time (since the acquisition of the code happens in real time --- e.g., a Java applet). Existing host security schemes can be classified as: (i) discretion based: accept certificate of authenticity at your discretion; and (ii) verification based: formally prove the safety. Verification provides the desired level of security; however, it comes at a large performance delay while discretion is efficient, but limited and relies on blind trust. We present an optimization, verification caching, for enhancing the performance of verification-based security methods. Secure indexing of previously encountered code units is established by using message digest algorithm (e.g., MD 5) to generate a fingerprint of the code. We characterize the performance and security of this scheme and investigate optimizations to lower the cost of generating the fingerprint (by indexing on small, partial, fingerprints and generating the full fingerprint only if there is a cache hit). In addition, we generalize the approach to allow multiple trusting nodes to distribute caching among them, sharing experiences and effectively increasing the cache size.