\documentclass[letterpaper]{article}

\usepackage{varioref}
\usepackage{graphicx}
\usepackage{bm}
\usepackage{gensymb}
\usepackage{amsmath}

\title{Mobile-C Security Proposal}
\author{Najmus Saqib \\
        David Ko}
\date{\today}

\newcommand{\dif}{\mathrm{d}}
\newcommand{\lapl}{\mathcal{L}}
\newcommand{\mol}{\mathrm{mol}}


\begin{document}
\maketitle

\begin{abstract}
This document outlines the security requirements and applicable solution to
fulfill security requirements for the Mobile-C agency. The target applications
of mobile agents are embedded system, industrial and manafacturing plants. These 
systems are based on microcontroller, having low resources like memory and computional 
power. By keeping this in view, the document focuses on symmetric key cryptography.  
\end{abstract}

\section{Security Requirements}
\begin{enumerate}
\item Authentication: 
    Sender and receiver of mobile agent must be able to authenticate each other. The 
sender will not initiate mobile agent migration process if it fails to authenticate 
the receiver. Similarly, the receiver will not entertain the mobile agent from an 
un-authenticated sender.
\item Integrity:
    Ensures that the mobile agent is not modified during migration process.This 
modification includes injection of intelligent code for malicious intensions, non 
intelligent code for corruption purpose or deletion of any part of mobile agent so 
that it would not execute correctly as planned. If the integrity of mobile agent is
compromised, the receiver will simply delete the mobile agent and inform the sender.  


[ 2 options to proceed further:
\begin{itemize}
\item The sender then inform the previous sender and eventually the owner of mobile 
agent know that its mobile agent get corrupted, etc.  
\item The sender of mobile agent kept a copy of every mobile agent that it has send to 
other host. It delete copy of those mobile agents for which it receive a positive 
acknowledge from receiver and resend those which are found compromised at receiver side.]

\end{itemize}


\item Confidentiality:
    Ensures that the content of mobile agent is only readable to the intended receiver
\end{enumerate}

\section{Threat Model}
\begin{itemize}
\item An attacker can masquerade other agency as one of the legitimate agency. 
\item An attacker can inject malicious code to corrupt the mobile agent.
\item An attacker can try to acquire/compute the encryption key
\end{itemize}

\section{Applicable solution}
\subsection{White list}
The concept of white list is used to provide a list of legitimate agencies. It
specifies that any agency in the list can send and receive mobile agents from
only the agencies mentioned in the while list. White list is accessible to
every agency in the network. It is maintained by a trusted third party (TTP)
server. 

\subsection{Authentication}
TTP server is used to authenticate each entity before communication. The
following sequence of messages shows that how a receiver (B) and sender (A)verify each
 other: [edit DK: Is this protocol an existing protocol?]
\begin{eqnarray*}
Message 1 ~ A -> B &:&  A, N_a \\
Message 2 ~ B -> A &:&  B, N_b, \{ Na \}k_{BS} \\
Message 3 ~ A -> B &:&  \{ N_b \}k_{AS} \\
Message 4 ~ A -> S &:&  \{ B, \{ N_a \}k_{BS} \} k_{AS} \\
Message 5 ~ B -> S &:&  \{ A, \{ N_b \}k_{AS} \}k_{BS} \\
Message 6 ~ S -> A &:&  \{ B, N_a, k_{AB} \} k_{AS} \\
Message 7 ~ S -> B &:&  \{ A, N_b, k_{AB} \}k_{BS} \\
\end{eqnarray*}
where N$_a$ ,N$_b$ are nonce generated by A and B respectively. k$_{AS}$ is the 
secret key shared between A and TTP Server (S). k$_{AB}$ is the new secret key 
created by S that is shared between A and B.

\subsection{Integrity}
For integrity hash code of mobile agent is also encrypted and sends to a
receiver. SHA algorithm is used to calculate the hash code.

\subsection{Confidentiality}
Each agency maintains a secret key with every server in the network. In the
process of authentication, the two communicating agency get a secret key (shared
between them) from the server. For every transfer of mobile agent both entities 
(sender and receiver agency) update the secret key. After A successful verify 
the N$_a$ in message 6 and B in message 7, the following two message shows the encrypted
migration of mobile agent from A to B 
\begin{eqnarray*}
Message 8  ~ A -> B&:& \{ HC[MA], MA\}k_{AB} \\
Message 9  ~ B -> A&:& \{ack+\}k_{AB}
\end{eqnarray*}
where A is a sender and B is a receiver of mobile agent MA. k$_{AB}$ is a secret key
shared between A and B, which is send to them by S in message 6 and 7. This key is 
used only for one session .HC[MC] is the hash code of MA using SHA 512 algorithm. 
If any of the agencies in message 6 and 7 cannot verify its nonce then they simply 
ignore the key and don’t respond with the other entity. 

System Flow:
Each entity shares a secret key with TTP server. That means the number of secret keys 
maintained by a server is equal to the number of agency in a network. After 
authentication both communicating entities get a secret key from server, which they 
use to encrypt the mobile agent and its hash code. 
An administrator provides a secret key to every entity at the deployment phase. When 
a new agency is added in a network, the administrator requires updating the server 
with a secret key and provides that key to the new agency as well.\\

\textbf{Suggestion/Comments: }
\begin{itemize}
\item \textit{What if A has to send more than one mobile agents in sequence to the same 
host, should it use the same secret key or acquire a new from server.}\\
In message 8, a variable can be added that would tell the number of mobile agents that 
need to be migrated on B from A. So that B would receive the following messages from A 
and consider it. Other option would be to acquire a new secret key from server, but in 
that case it has to start from message 1.
\item \textit{We consider that each agency shared a secret key with a server and this 
key is supplied to server and agency at deployed time by the administrator. What is the 
way of providing secret keys to server and to each client? Using a file or smart cards}\\
A possible option is xml file that only this agency would read this file.
\end{itemize}

\end{document}
