Mobile Agent Data Protection via Nested Cryptographic Structure
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting mobile agents in network systems are vulnerable to attacks, particularly 'cut-and-paste' attacks, where unauthorized servers can access and manipulate sensitive data carried by mobile agents, especially when using partial protection methods that do not provide comprehensive security against malicious hosts.
Innovation Solution
A method involving a nested structure for data protection, where a unique number and secret symmetric key are encoded with public keys using a wrapping function, forming a data authentication code, and then encrypted with the first server's private key, ensuring secure access only to authorized servers, thereby preventing unauthorized access and attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If partial protection methods are used for mobile agents, then ease of operation is improved, but security against malicious hosts deteriorates
Solution Approach 1:
The patent implements a nested protection structure where multiple encryption layers are applied to the mobile agent code and data. The mobile agent is encrypted with the destination server's public key, then the entire package is encrypted with the source server's private key, creating nested encryption layers that provide both ease of operation and strong security against malicious hosts.
Solution Approach 2:
The patent segments the protection mechanism into distinct cryptographic operations: key generation, asymmetric encryption with public/private key pairs, symmetric encryption for data protection, and digital signature verification. This segmentation allows each component to be optimized independently while maintaining overall security and operational simplicity.
2Reliability
If comprehensive encryption is applied to mobile agent data, then security is improved, but device complexity increases
Solution Approach 1:
The patent introduces cryptographic intermediaries (public key infrastructure, digital signatures, and encrypted tokens) that mediate between the mobile agent and servers. These intermediaries handle the complexity of security operations automatically, providing comprehensive encryption while keeping the actual mobile agent code and server implementations relatively simple.
Solution Approach 2:
The patent changes the cryptographic parameters dynamically based on the communication context: using asymmetric encryption for key exchange, symmetric encryption for data protection, and digital signatures for authentication. This parameter adaptation provides strong security without requiring the entire system to use the most complex cryptographic methods throughout.
3Adaptability or versatility
If mobile agents traverse multiple servers, then adaptability is improved, but vulnerability to attacks increases
Solution Approach 1:
The patent applies preliminary anti-action by pre-encrypting the mobile agent with the destination server's public key before traversal, and pre-signing with the source server's private key. This preliminary protection prevents intermediate servers from accessing or tampering with the agent's data during traversal, maintaining adaptability while reducing vulnerability to attacks.
Solution Approach 2:
The patent performs preliminary cryptographic actions (key pair generation, encryption, digital signing) before the mobile agent begins its traversal. This preliminary preparation ensures that the agent is protected from the outset, allowing it to adaptively traverse multiple servers without being vulnerable to attacks during execution.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The present invention refers to a method for protecting data of a mobile agent (MA) from a first server (A) which are intended for at least one second server (B) within a network system against an attack and an unauthorized access, wherein the first server (A) as well as the at least one second server (B) have a pair of a public key (KA, KB) and a private key (PKA, PKB) associated therewith, respectively, the method comprising, starting from the first server, at least the steps of choosing an unique number (r0) and assigning it to the mobile agent (MA), choosing a secret symmetric key (SKo) and assigning it to the data (mB) to be protected, encoding the secret key (SKo) with the public key (KB) of the second server (B), encrypting the secret key (SKo) and the public key (KA) of the first server via a cryptographic wrapping function (h), thus forming a data authentication code (h (KA, SKo)) , encoding the data (mB) with the secret key (SKo), and combining the unique number (r0), the encoded data ({mB}SKo) and the data authentication code (h(KA, SKo)) and encoding that combination with the private key (PKA) of the first server (A), thus forming a nested structure to be decoded successively for access to the data (mB). The present invention further relates to an appropriate network system and an appropriate mobile agent.