Skip to main content
SpringerLink
Log in
Book cover

Mobile Agents and Security pp 25–43Cite as

Language Issues in Mobile Program Security

  • Chapter
  • First Online:

Part of the book series: Lecture Notes in Computer Science ((LNCS,volume 1419))

Abstract

Many programming languages have been developed and implemented for mobile code environments. They are typically quite expressive. But while security is an important aspect of any mobile code technology, it is often treated after the fundamental design is complete, in ad hoc ways. In the end, it is unclear what security guarantees can be made for the system. We argue that mobile programming languages should be designed around certain security properties that hold for all well-formed programs. This requires a better understanding of the relationship between programming language design and security. Appropriate security properties must be identified. Some of these properties and related issues are explored.

This material is based upon activities supported by DARPA and the National Science Foundation under Agreement Nos. CCR-9612176 and CCR-9612345.

This is a preview of subscription content, log in via an institution.

Chapter
USD   29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD   39.99
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD   54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Learn about institutional subscriptions

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. James P. Anderson. Computer security technology planning study. Technical Report ESD-TR-73-51, Electronic Systems Division, Hanscom Field, Bedford, MA, 1972.

    Book  Google Scholar 

  2. Brian Bershad, et al. Extensibility, safety and performance in the SPIN operating system. In Proc. 15th Symposium on Operating Systems Principles, pages 267–284, December 1995.

    Google Scholar 

  3. K. Biba. Integrity considerations for secure computer systems. Technical Report ESD-TR-76-372, MITRE Corp., 1977.

    Google Scholar 

  4. Dorothy Denning. Secure Information Flow in Computer Systems. PhD thesis, Purdue University, West Lafayette, IN, May 1975.

    Google Scholar 

  5. Dorothy Denning. A lattice model of secure information flow. Communications of the ACM, 19(5):236–242, 1976.

    Article  MathSciNet  Google Scholar 

  6. Dorothy Denning and Peter Denning. Certification of programs for secure information flow. Communications of the ACM, 20(7):504–513, 1977.

    Article  Google Scholar 

  7. Steven T. Eckmann. Eliminating formal flows in automated information flow analysis. In Proceedings 1994 IEEE Symposium on Security and Privacy, Oakland, CA, May 1994.

    Google Scholar 

  8. D.R. Engler, et al. Exokernel: An operating system architecture for application-level resource management. In Proc. 15th Symposium on Operating Systems Principles, December 1995.

    Google Scholar 

  9. J. Fenton. Information Protection Systems. PhD thesis, University of Cambridge, 1973.

    Google Scholar 

  10. Todd Fine. A foundation for covert channel analysis. In Proc. 15th National Computer Security Conference, Baltimore, MD, October 1992.

    Google Scholar 

  11. Li Gong, Marianne Mueller, Hemma Prafullchandra, and Roland Schemers. Going beyond the sandbox: An overview of the new security architecture in the Java Development Kit 1.2. In Proceedings USENIX Symposium on Internet Technologies and Systems, Monterey, CA, December 1997.

    Google Scholar 

  12. James W. Gray, III. Probabilistic interference. In Proceedings 1990 IEEE Symposium on Security and Privacy, pages 170–179, Oakland, CA, May 1990.

    Google Scholar 

  13. James W. Gray, III. Toward a mathematical foundation for information flow security. In Proceedings 1991 IEEE Symposium on Security and Privacy, pages 21–34, Oakland, CA, May 1991.

    Google Scholar 

  14. James W. Gray, III and Paul F. Syverson. A logical approach to multilevel security of probabilistic systems. In Proceedings 1992 IEEE Symposium on Security and Privacy, pages 164–176, Oakland, CA, May 1992.

    Google Scholar 

  15. David Halls, John Bates, and Jean Bacon. Flexible distributed programming using mobile code. In Proc. 7th ACM SIGOPS European Workshop, Systems Support for Worldwide Applications, Connemara, Ireland, September 1996.

    Google Scholar 

  16. Robert Harper. A simplified account of polymorphic references. Information Processing Letters, 51:201–206, 1994.

    Article  MathSciNet  Google Scholar 

  17. Wilson C. Hsieh, et al. Language support for extensible operating systems. Unpublished manuscript. Available at http://www.spin.cs.washington.edu, 1996.

  18. Java Card 2.0 Language Subset and Virtual Machine Specification. Sun Microsystems, October 1997.

    Google Scholar 

  19. Cliff B. Jones. Some practical problems and their influence on semantics. In Proceedings of the 6th European Symposium on Programming, volume 1058 of Lecture Notes in Computer Science, pages 1–17, April 1996.

    Google Scholar 

  20. Paul Kocher. Timing attacks on implementations of Diffie-Hellman, RSA, DSS and other systems. In Proceedings 16th Annual Crypto Conference, August 1996.

    Google Scholar 

  21. Butler W. Lampson. A note on the confinement problem. Communications of the ACM, 16(10):613–615, 1973.

    Article  Google Scholar 

  22. Carl E. Landwehr. Formal models for computer security. Computing Surveys, 13(3):247–278, 1981.

    Article  Google Scholar 

  23. Leonard J. LaPadula and D. Elliot Bell. MITRE Technical Report 2547, Volume II. Journal of Computer Security, 4(2,3):239–263, 1996.

    Article  Google Scholar 

  24. X. Leroy and F. Rouaix. Security properties of typed applets. In Proceedings 25th Symposium on Principles of Programming Languages, pages 391–403, San Diego, CA, January 1998.

    Google Scholar 

  25. Catherine Meadows. Detecting attacks on mobile agents. In Proc. 1997 Foundations for Secure Mobile Code Workshop, pages 64–65, Monterey, CA, March 1997.

    Google Scholar 

  26. Yaron Minsky, Robbert van Renesse, Fred B. Schneider, and Scott Stoller. Cryptographic support for fault-tolerant distributed computing. In Proc. 7th ACM SIGOPS European Workshop, Systems Support for Worldwide Applications, Connemara, Ireland, September 1996.

    Google Scholar 

  27. George Necula and Peter Lee. Proof-carrying code. In Proceedings 24th Symposium on Principles of Programming Languages, Paris, France, 1997.

    Google Scholar 

  28. J.H. Saltzer. Case studies of protection system failures. Appendix 6-A, unpublished course notes on The Protection of Information in Computer Systems., 1975.

    Google Scholar 

  29. Vijay Saraswat. Java is not type-safe. Unpublished manuscript. Available at http://www.research.att.com/~vj/bug.html., 1997.

  30. Geoffrey Smith and Dennis Volpano. Towards an ML-style polymorphic type system for C. In Proceedings of the 6th European Symposium on Programming, volume 1058 of Lecture Notes in Computer Science, pages 341–355, April 1996.

    Google Scholar 

  31. Geoffrey Smith and Dennis Volpano. Secure information flow in a multi-threaded imperative language. In Proceedings 25th Symposium on Principles of Programming Languages, pages 355–364, San Diego, CA, January 1998.

    Google Scholar 

  32. Geoffrey Smith and Dennis Volpano. A sound polymorphic type system for a dialect of C. Science of Computer Programming, 32(2–3), 1998.

    Google Scholar 

  33. D.L. Tennenhouse, J.M. Smith, W.D. Sincoskie, D.J. Wetherall, and G.J. Minden. A survey of active network research. IEEE Communications, 35(1):80–86, January 1997.

    Article  Google Scholar 

  34. Tommy Thorn. Programming languages for mobile code. Computing Surveys, 29(3):213–239, 1997.

    Article  Google Scholar 

  35. Dennis Volpano and Geoffrey Smith. Eliminating covert flows with minimum typings. In Proc. 10th IEEE Computer Security Foundations Workshop, pages 156–168, June 1997.

    Google Scholar 

  36. Dennis Volpano and Geoffrey Smith. A type-based approach to program security. In Proc. Theory and Practice of Software Development, volume 1214 of Lecture Notes in Computer Science, pages 607–621, April 1997.

    Chapter  Google Scholar 

  37. Dennis Volpano, Geoffrey Smith, and Cynthia Irvine. A sound type system for secure flow analysis. Journal of Computer Security, 4(2,3):167–187, 1996.

    Article  Google Scholar 

  38. David J. Wetherall and David L. Tennenhouse. The ACTIVE IP option. In Proc. 7th ACM SIGOPS European Workshop, Systems Support for Worldwide Applications, Connemara, Ireland, September 1996.

    Google Scholar 

  39. J. Todd Wittbold and Dale M. Johnson. Information flow in nondeterministic systems. In Proceedings 1990 IEEE Symposium on Security and Privacy, pages 144–161, Oakland, CA, May 1990.

    Google Scholar 

  40. Bennet S. Yee. A sanctuary for mobile agents. In Proc. 1997 Foundations for Secure Mobile Code Workshop, pages 21–27, Monterey, CA, March 1997.

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Department of Computer Science, Naval Postgraduate School, Monterey, CA, 93943, USA

    Dennis Volpano

  2. School of Computer Science, Florida International University, Miami, FL, 33199, USA

    Geoffrey Smith

Authors
  1. Dennis Volpano
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Geoffrey Smith
    View author publications

    You can also search for this author in PubMed Google Scholar

Editor information

Editors and Affiliations

  1. Computer Science Department, University of California, Santa Barbara, CA, 93106-5110, USA

    Giovanni Vigna

Rights and permissions

Reprints and permissions

Copyright information

© 1998 Springer-Verlag Berlin Heidelberg

About this chapter

Cite this chapter

Volpano, D., Smith, G. (1998). Language Issues in Mobile Program Security. In: Vigna, G. (eds) Mobile Agents and Security. Lecture Notes in Computer Science, vol 1419. Springer, Berlin, Heidelberg. https://doi.org/10.1007/3-540-68671-1_3

Download citation

  • DOI: https://doi.org/10.1007/3-540-68671-1_3

  • Published:

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-540-64792-8

  • Online ISBN: 978-3-540-68671-2

  • eBook Packages: Springer Book Archive

Publish with us

Policies and ethics

Search

Navigation