A Software Based Approach for Trusted Agent Execution on Malicious Host
Sarosh Hashmi, John Brooke · 2009
Absolute protection of mobile agents from attacks by malicious hosts is an open research problem. We propose a software based paradigm whereby an agent is protected from various static and dynamic attacks from a malicious host of an unknown hardware configuration, for a specific period of time. This time interval is computed by restricting the maximum resources that may be available to the adversary and the time complexity of the critical static and dynamic attacks that it may launch. We employ the technique of oblivious hashing (OH) using overlapped instructions, with multilevel pointer aliasing to thwart static analysis and instant code modifications. The host is required to obtain the aggregate OH value of the whole agent by executing it in an unobtrusive environment and to send it back to the agent originator within the specified time interval. To provide unobtrusive environment, we employ external timing analysis to detect major dynamic attack tools such as debuggers, virtual machines and emulators. Experimental results are presented that demonstrate the viability of the timing analysis mechanism in detecting dynamic attack tools on a range of Intel based machines.