Mobile code security by Java bytecode dependence analysis

Security of mobile code is important because the code is transmitted and remotely executed. Existing protection mechanisms have not fully addressed the security problem. Current approaches tend to prevent the host from potential attacks by confining the mobile code, which leads to impair the function of mobile code. Java is widely used in mobile code systems. We propose a method that does less restriction to the Java mobile code while protecting the host. The approach is to analyze the Java bytecode security-relevant behavior prior to its execution, thus to ensure two major aspects of host security ntegrity and confidentiality. We extend bytecode dependence analysis technique to adapt information flow analysis. A prototype implementation is under development. This tool will be used to analyze Java class file, applet and mobile agent.