A Sanctuary for Mobile Agents
B. Yee, U. C. San Diego · 1997
ly, this is a circuit of the (complete) graph connecting the airline servers, and the originator may chose this circuit at the time of agent dispatch. At any honest server, the agent code and its read-only state is checked when the agent arrives, so if the malicious server tries to tamper with the agent code or the read-only state the malicious server can not successfully pass the modified agent to an honest server. (Alternatively, the agent code and the read-only state may be considered to be reloaded from the originator by every server.) Furthermore, we assume that the variable agent state is transmitted among servers using authenticated and encrypted channels, so that only the server that is the intended migration target can receive the agent, as long as the agent is starting from an honest server. Thus, the malicious server can not intercept an agent as it migrates from an honest server to another server. At any server, an agent may query the server's identity. At first glance, thi...