Protecting mobile Web-commerce agents with smartcards

Abstract

Mobile agents add a new communication paradigm to traditional network communication mechanisms. So far, the pervasiveness of publicly available mobile agent platforms is not given. Offering a seamless integration of mobile agents into the widespread and well-accepted WWW environment is crucial for the success of mobile agents. One of the growing fields of interest in the Web is the area of electronic commerce. Mobile Web-commerce agents could play a prominent role in future electronic commerce scenarios, if the malicious host problem could be solved. Our paper describes the integration of mobile agents into the Web and the use of Java cards to allow a mobile agent to store and securely transport data. This is achieved by allowing the agents to carry encrypted code parts, which can only be decrypted by the Java card attached to the target host of the next migration. Although today's Java cards seem to promise a cheap and secure way to realize a trusted computing base, we found that they introduce specific problems which currently renders them less useful for realizing a trusted computing base for mobile agents.