Formal Modeling and Verification of Secure Mobile Agent Systems
Mingyue Jiang
1
, Zuohua Ding
1
, Mengchu Zhou
2
, Yuan Zhou
1
Abstract— Security of a Mobile Agent System (MAS), which
has been a barrier to wider applications of a MAS, remains
a compelling problem. Formal methods have been applied to
this problem, and various formal models have recently been
studied. However, many of them either lack of mechanisms that
can protect a MAS or depend on simulation based analysis. In
this paper, we concentrate on one specific category of security
threats, namely, the agent-platform related security issues, and
present a new method for formally modeling and verifying
a secure MAS. To model a secure MAS, we equip the MAS
with secure mechanisms, and propose an extended logical agent
model (ELAM) for formally describing it. By transforming the
ELAM to the input model of model checker SPIN, the MAS is
further verified by using model checking technique. We apply
ELAM to the competing airline carriers system to check its
security, and our experimental results show that the proposed
method works well in modeling and verifying a secure MAS.
I. INTRODUCTION
Mobile agent system (MAS) has shown several particular
characteristics, i.e., the mobility of mobile agents and com-
munications between agents and platforms, and it represents
a new way of establishing large-scale, loosely-coupled dis-
tributed systems. Currently, MAS has been applied to various
areas, such as manufacturing, process control, telecommuni-
cation, traffic and transportation management, etc [8].
Although MAS exhibits several advantages, it still raises
potential security problems, which have become the bottle-
neck of the development and maintenance of a MAS. Re-
cently, various studies regarding MAS’s security have been
conducted, including investigation of fundamental elements
of MAS’s security [1] and security mechanisms [16], strate-
gies of modeling and analyzing a MAS [9] [12], methodolo-
gies of analyzing a MAS’s security [2] [3], etc. Among those
efforts dedicated to security issues of a MAS, formal model
based strategies provide a good basis for analyzing a MAS’s
security. However, existing strategies consider different cat-
egories of security problems [5] [10], furthermore, some of
them either lack of mechanisms protecting a MAS [15] or
depend on simulation based analysis [10].
This paper focuses on agent-platform related security
issues of a MAS. We present a new method to formally
model and verify a secure MAS, in order to facilitate the
construction of a secure MAS. A new formal model, which
is called extended logical agent model (ELAM), is proposed
to describe a secure MAS. ELAM extends a logical agent
1
Mingyue Jiang, Zuohua Ding and Yuan Zhou are with Laboratory
of Intelligent Computing and Software Engineering, Zhejiang Sci-Tech
University, Hangzhou, 310018, China.
2
Mengchu Zhou is with Department of Electrical and Computer Engi-
neering, New Jersey Institute of Technology, Newark, NJ 07102, USA.
model (LAM) [15] by adding security mechanisms address-
ing agent-platform security issues. To verify the security of
a MAS, we transform the ELAM into the input model of the
model checker SPIN. Finally, security properties regarding
agent-platform related security issues are verified by SPIN.
To illustrate the proposed method, we employ Competing
Airline Carriers (CAC) system as an example. Comparison
of verification results of CAC’s LAM and ELAM suggests
that ELAM can effectively protect a MAS and the model
checking technique works well in verifying a secure MAS.
The remainder of this paper is organized as follows.
Section II presents ELAM for modeling a secure MAS.
Section III explains how to check a secure MAS through
model checking technique. Section IV reports the details of
our experimentation, and Section V concludes the paper.
II. MODELING OF A SECURE MOBILE AGENT SYSTEM
In this section, we present a formal model, the extended
logical agent model (ELAM), for describing a secure mobile
agent system (MAS). ELAM consists of three parts: descrip-
tion of the mobility of agents (the main part adopted from
the logical agent model (LAM)), security mechanisms, and
mechanisms integrating previous two parts together.
A. The Logical Agent Model
At first, we give a brief introduction to the LAM. LAM
uses simplified predicate/transition (PrT) nets [6] to model
the mobility of mobile agents. A LAM [15] consists of
a set of components, connectors and agent nets. Each
component represents a location of a mobile agent, while
connectors specify interactions between different elements.
Mobile agents are modeled by agent nets, and it migrates
from one component to another by transition firing. We list
formal definitions of some elements of LAM below. For more
information of LAM, readers may refer to [15].
Definition 1: An agent net AN = (P , T , F , Σ, L, ϕ, P
in
,
P
out
, M
0
), where (P , T , F , Σ, L, ϕ, M
0
) is a PrT net, P
in
with
•
P
in
= φ and P
out
with P
•
out
= φ are input and output
predicates for incoming and outgoing messages respectively.
Definition 2: A system net SN = (P , T , F , Σ, L, ϕ,
P
ex−in
, P
ex−out
, P
in−in
, P
in−out
, M
0
) for component CM
is defined by a PrT net (P , T , F , Σ, L, ϕ, M
0
), external
input and output predicates: P
ex−in
and P
ex−out
, internal
input and output predicates: P
in−in
and P
in−out
, where
P
ex−in
with
•
P
ex−in
= φ and P
ex−out
with P
•
ex−out
= φ are
connected to other components through external connectors,
P
in−in
with
•
P
in−in
= φ and P
in−out
with P
•
in−out
= φ are
connected to mobile agents through an internal connector.
2015 IEEE International Conference on
Automation Science and Engineering (CASE)
Aug 24-28, 2015. Gothenburg, Sweden
978-1-4673-8183-3/15/$31.00 ©2015 IEEE 545