Risk analysis and Deployment Security Issues in a Multi-agent System - - PowerPoint PPT Presentation

▶

Nov 10, 2022 335 likes •959 views

Risk analysis and Deployment Security Issues in a Multi-agent System Ambra Molesini & Marco Prandini Elena Nardini & Enrico Denti { ambra.molesini, marco.prandini, elena.nardini, enrico.denti } @unibo.it Alma Mater Studiorum Universit`

SLIDE 1

Risk analysis and Deployment Security Issues in a Multi-agent System

Ambra Molesini & Marco Prandini Elena Nardini & Enrico Denti {ambra.molesini, marco.prandini, elena.nardini, enrico.denti}@unibo.it

Alma Mater Studiorum—Universit` a di Bologna

ICAART 2010, Valencia, Spain, 22nd January 2010

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 1 / 23

SLIDE 2

1

Case Study

2

Risk Analysis

3

Security Deployment Issues

4

Conclusions and Future Works

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 2 / 23

SLIDE 3

The objective of this paper

Our work is aimed at performing a security analysis of a selected case study – an access control system [Molesini et al., 2009] – for

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 3 / 23

SLIDE 4

The objective of this paper

Our work is aimed at performing a security analysis of a selected case study – an access control system [Molesini et al., 2009] – for

▶ identifying threats coming both from ★ the system domain ★ its MAS-based implementation Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 3 / 23

SLIDE 5

The objective of this paper

Our work is aimed at performing a security analysis of a selected case study – an access control system [Molesini et al., 2009] – for

▶ identifying threats coming both from ★ the system domain ★ its MAS-based implementation ▶ assessing risks Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 3 / 23

SLIDE 6

The objective of this paper

Our work is aimed at performing a security analysis of a selected case study – an access control system [Molesini et al., 2009] – for

▶ identifying threats coming both from ★ the system domain ★ its MAS-based implementation ▶ assessing risks ▶ discussing deployment strategies that could interfere with the

achievement of the application goal

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 3 / 23

SLIDE 7

The objective of this paper

Our work is aimed at performing a security analysis of a selected case study – an access control system [Molesini et al., 2009] – for

▶ identifying threats coming both from ★ the system domain ★ its MAS-based implementation ▶ assessing risks ▶ discussing deployment strategies that could interfere with the

achievement of the application goal

In order to do this we

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 3 / 23

SLIDE 8

The objective of this paper

Our work is aimed at performing a security analysis of a selected case study – an access control system [Molesini et al., 2009] – for

▶ identifying threats coming both from ★ the system domain ★ its MAS-based implementation ▶ assessing risks ▶ discussing deployment strategies that could interfere with the

achievement of the application goal

In order to do this we

▶ present our case study Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 3 / 23

SLIDE 9

The objective of this paper

Our work is aimed at performing a security analysis of a selected case study – an access control system [Molesini et al., 2009] – for

▶ identifying threats coming both from ★ the system domain ★ its MAS-based implementation ▶ assessing risks ▶ discussing deployment strategies that could interfere with the

achievement of the application goal

In order to do this we

▶ present our case study ▶ present the risk analysis phase Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 3 / 23

SLIDE 10

The objective of this paper

Our work is aimed at performing a security analysis of a selected case study – an access control system [Molesini et al., 2009] – for

▶ identifying threats coming both from ★ the system domain ★ its MAS-based implementation ▶ assessing risks ▶ discussing deployment strategies that could interfere with the

achievement of the application goal

In order to do this we

▶ present our case study ▶ present the risk analysis phase ▶ discuss about security deployment issues Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 3 / 23

SLIDE 11

Background

MASs should be conceived also as providers of security functionalities

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 4 / 23

SLIDE 12

Background

MASs should be conceived also as providers of security functionalities The flexibility of the agent paradigm proves very valuable in

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 4 / 23

SLIDE 13

Background

MASs should be conceived also as providers of security functionalities The flexibility of the agent paradigm proves very valuable in

▶ modelling the different aspects of security schemes Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 4 / 23

SLIDE 14

Background

MASs should be conceived also as providers of security functionalities The flexibility of the agent paradigm proves very valuable in

▶ modelling the different aspects of security schemes ▶ capturing the concepts needed for achieving a robust design at the

most appropriate abstraction levels

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 4 / 23

SLIDE 15

Background

MASs should be conceived also as providers of security functionalities The flexibility of the agent paradigm proves very valuable in

▶ modelling the different aspects of security schemes ▶ capturing the concepts needed for achieving a robust design at the

most appropriate abstraction levels

However, a MAS needs a complex underlying infrastructure, whose intrinsic security is fundamental for the correct

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 4 / 23

SLIDE 16

Background

MASs should be conceived also as providers of security functionalities The flexibility of the agent paradigm proves very valuable in

▶ modelling the different aspects of security schemes ▶ capturing the concepts needed for achieving a robust design at the

most appropriate abstraction levels

However, a MAS needs a complex underlying infrastructure, whose intrinsic security is fundamental for the correct

▶ behaviour of agents Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 4 / 23

SLIDE 17

Background

MASs should be conceived also as providers of security functionalities The flexibility of the agent paradigm proves very valuable in

▶ modelling the different aspects of security schemes ▶ capturing the concepts needed for achieving a robust design at the

most appropriate abstraction levels

However, a MAS needs a complex underlying infrastructure, whose intrinsic security is fundamental for the correct

▶ behaviour of agents ▶ implementation of the policy to be enforced Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 4 / 23

SLIDE 18

Background

MASs should be conceived also as providers of security functionalities The flexibility of the agent paradigm proves very valuable in

▶ modelling the different aspects of security schemes ▶ capturing the concepts needed for achieving a robust design at the

most appropriate abstraction levels

However, a MAS needs a complex underlying infrastructure, whose intrinsic security is fundamental for the correct

▶ behaviour of agents ▶ implementation of the policy to be enforced

Various solutions exist for the design of MAS-supporting platforms and for exploiting a MAS as a security provider [Yamazaki et al., 2004, Bordini et al., 2006, JADE, 2005] . . .

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 4 / 23

SLIDE 19

Background

MASs should be conceived also as providers of security functionalities The flexibility of the agent paradigm proves very valuable in

▶ modelling the different aspects of security schemes ▶ capturing the concepts needed for achieving a robust design at the

most appropriate abstraction levels

However, a MAS needs a complex underlying infrastructure, whose intrinsic security is fundamental for the correct

▶ behaviour of agents ▶ implementation of the policy to be enforced

Various solutions exist for the design of MAS-supporting platforms and for exploiting a MAS as a security provider [Yamazaki et al., 2004, Bordini et al., 2006, JADE, 2005] . . . . . . but the field of their security assessment is largely unexplored

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 4 / 23

SLIDE 20

Our case study

Reference domain: access control system Case study: management of the access control to a university building [Molesini et al., 2009] System’s scenario:

classroom library department Faculty building administration

ffice

dep-administration dep-library

ffice
ffice

a) b) c) d)

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 5 / 23

SLIDE 21

The developing methodology

The case study was analysed and designed [Molesini et al., 2009] according to SODA SODA is an agent-oriented methodology for the analysis and design

f agent-based systems

▶ . . . adopts agents and artifacts (A&A meta-model) as the main

building blocks for MAS development

★ agents model individual and social activities ★ artifacts are adopted for the environment engineering since they glue

agents together, as well as MAS and the environment

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 6 / 23

SLIDE 22

The system logical architecture [Molesini et al., 2009]

building room User Artifact

Interface Artifact

Building-State Artifact

User Manager Access Manager

Admin Artifact

Interface Artifact

R-Access Manager

User-room Artifact Appointment Artifact Room-Admin Artifact

Room Manager event event event event uses uses uses uses uses uses uses uses Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 7 / 23

SLIDE 23

Risk analysis

Risk analysis is a part of the more general process called “Security risk assessment and management” [Sommerville, 2007]

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 8 / 23

SLIDE 24

Risk analysis

Risk analysis is a part of the more general process called “Security risk assessment and management” [Sommerville, 2007] Risk analysis should start from the identification of the system’s

▶ assets – the system resources to be protected because of their value ▶ exposures – represent the possible loss or harm that results from a

successful attack

▶ threats – ★ fortuitous events – flooding, storms, etc. . . ★ deliberate attacks – sniffing, spoofing, etc. . . Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 8 / 23

SLIDE 25

System’s assets, values and exposures

Asset Value Exposure

Interface Artifact high medium Admin Artifact high high User Artifact high high Building-State Artifact low low Room-Admin Artifact high high User-room Artifact high high Appointment Artifact medium medium User Manager high high Access Manager high high R-Access Manager high high Room Manager high high Physical Device high high Infrastructure high high

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 9 / 23

SLIDE 26

System’s threats

Threat Probability

Stealing admin credential low Stealing user credential high Personifying user high Social Engineering high Introducing malicious agent medium - high Disappearing agent medium - high Agent bugs high Modifying agent code low - medium Tampering artifact data high - very high Sniffing artifact data high - very high Artifact bugs high Replacing artifact medium - high Men in the middle medium - high Sniffing communication medium - high Damaging physical device high

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 10 / 23

SLIDE 27

Threats for each asset

Threat Asset

Interface Artifact Admin Artifact User Artifact Building-State Artifact Room-Admin Artifact User-room Art. Appointment Artifact User Manager Access Manager R-Access Manager Room Manager Physical Device Infrastructure Stealing admin credential * * * Stealing user credential * * * * Personifying user * * * * * * Social Engineering * * * * * * * Introducing malicious agent * * * * * * * * * * * Disappearing agent * * * * Agent bugs * * * * Modifying agent code * * * * * * * * * * * Tampering artifact data * * * * * * * Sniffing artifact data * * * * * * * Artifact bugs * * * * * * * Replacing artifact * * * * * * * * * * * Men in the middle * * * * * * * * * * * * Sniffing communication * * * * * * * * * * * * Damaging physical device * * * Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 11 / 23

SLIDE 28

Security deployment issues

Assumption: all the infrastructures exhibit the same basic set of concepts

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 12 / 23

SLIDE 29

Security deployment issues

Assumption: all the infrastructures exhibit the same basic set of concepts Nodes — logical loci where agents and artifacts can be allocated

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 12 / 23

SLIDE 30

Security deployment issues

Assumption: all the infrastructures exhibit the same basic set of concepts Nodes — logical loci where agents and artifacts can be allocated Artifacts — passive components of the systems

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 12 / 23

SLIDE 31

Security deployment issues

Assumption: all the infrastructures exhibit the same basic set of concepts Nodes — logical loci where agents and artifacts can be allocated Artifacts — passive components of the systems

▶ resource artifacts – wrap external resources Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 12 / 23

SLIDE 32

Security deployment issues

Assumption: all the infrastructures exhibit the same basic set of concepts Nodes — logical loci where agents and artifacts can be allocated Artifacts — passive components of the systems

▶ resource artifacts – wrap external resources ▶ social artifacts – mediate between two or more agents in

a MAS

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 12 / 23

SLIDE 33

Security deployment issues

Assumption: all the infrastructures exhibit the same basic set of concepts Nodes — logical loci where agents and artifacts can be allocated Artifacts — passive components of the systems

▶ resource artifacts – wrap external resources ▶ social artifacts – mediate between two or more agents in

a MAS

▶ individual artifacts – mediate between an individual

agent and the environment

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 12 / 23

SLIDE 34

Security deployment issues

Assumption: all the infrastructures exhibit the same basic set of concepts Nodes — logical loci where agents and artifacts can be allocated Artifacts — passive components of the systems

▶ resource artifacts – wrap external resources ▶ social artifacts – mediate between two or more agents in

a MAS

▶ individual artifacts – mediate between an individual

agent and the environment

Agents — pro-active components of the systems

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 12 / 23

SLIDE 35

Artifacts security deployment issues

The artifacts deployment is critical from the security viewpoint

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 13 / 23

SLIDE 36

Artifacts security deployment issues

The artifacts deployment is critical from the security viewpoint

▶ resource artifacts abstract the functions and behaviours of devices Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 13 / 23

SLIDE 37

Artifacts security deployment issues

The artifacts deployment is critical from the security viewpoint

▶ resource artifacts abstract the functions and behaviours of devices ★ smart device = artifact + physical device Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 13 / 23

SLIDE 38

Artifacts security deployment issues

The artifacts deployment is critical from the security viewpoint

▶ resource artifacts abstract the functions and behaviours of devices ★ smart device = artifact + physical device ★ smart device should be protected in order to prevent possible artifact

tampering, replacement and sniffing

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 13 / 23

SLIDE 39

Artifacts security deployment issues

The artifacts deployment is critical from the security viewpoint

▶ resource artifacts abstract the functions and behaviours of devices ★ smart device = artifact + physical device ★ smart device should be protected in order to prevent possible artifact

tampering, replacement and sniffing

★ physical devices should be protected so that the “artifacts corruption”

does not damage the integrity and confidentiality of the devices

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 13 / 23

SLIDE 40

Artifacts security deployment issues

The artifacts deployment is critical from the security viewpoint

▶ resource artifacts abstract the functions and behaviours of devices ★ smart device = artifact + physical device ★ smart device should be protected in order to prevent possible artifact

tampering, replacement and sniffing

★ physical devices should be protected so that the “artifacts corruption”

does not damage the integrity and confidentiality of the devices

▶ social artifacts are the core of interactions Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 13 / 23

SLIDE 41

Artifacts security deployment issues

The artifacts deployment is critical from the security viewpoint

▶ resource artifacts abstract the functions and behaviours of devices ★ smart device = artifact + physical device ★ smart device should be protected in order to prevent possible artifact

tampering, replacement and sniffing

★ physical devices should be protected so that the “artifacts corruption”

does not damage the integrity and confidentiality of the devices

▶ social artifacts are the core of interactions ★ agents use them for communicating with each other Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 13 / 23

SLIDE 42

Artifacts security deployment issues

The artifacts deployment is critical from the security viewpoint

▶ resource artifacts abstract the functions and behaviours of devices ★ smart device = artifact + physical device ★ smart device should be protected in order to prevent possible artifact

tampering, replacement and sniffing

★ physical devices should be protected so that the “artifacts corruption”

does not damage the integrity and confidentiality of the devices

▶ social artifacts are the core of interactions ★ agents use them for communicating with each other ★ their deployment is critical and should take into account all the

measures to ensure that they remain trusted

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 13 / 23

SLIDE 43

Artifacts security deployment issues

The artifacts deployment is critical from the security viewpoint

▶ resource artifacts abstract the functions and behaviours of devices ★ smart device = artifact + physical device ★ smart device should be protected in order to prevent possible artifact

tampering, replacement and sniffing

★ physical devices should be protected so that the “artifacts corruption”

does not damage the integrity and confidentiality of the devices

▶ social artifacts are the core of interactions ★ agents use them for communicating with each other ★ their deployment is critical and should take into account all the

measures to ensure that they remain trusted

▶ individual artifacts equip agents with all the protocols they can adopt

for interacting

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 13 / 23

SLIDE 44

Artifacts security deployment issues

The artifacts deployment is critical from the security viewpoint

▶ resource artifacts abstract the functions and behaviours of devices ★ smart device = artifact + physical device ★ smart device should be protected in order to prevent possible artifact

tampering, replacement and sniffing

★ physical devices should be protected so that the “artifacts corruption”

does not damage the integrity and confidentiality of the devices

▶ social artifacts are the core of interactions ★ agents use them for communicating with each other ★ their deployment is critical and should take into account all the

measures to ensure that they remain trusted

▶ individual artifacts equip agents with all the protocols they can adopt

for interacting

★ their deployment is particularly critical, since the corruption of this kind

f artifact could allow a malicious agent to misbehave

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 13 / 23

SLIDE 45

Agent security deployment issues

In a system developed according to the A&A meta-model, only agents can take proactive security measures

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 14 / 23

SLIDE 46

Agent security deployment issues

In a system developed according to the A&A meta-model, only agents can take proactive security measures A smart device can be made even smarter by introducing a device manager agent to detect and promptly face dangerous situations

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 14 / 23

SLIDE 47

Agent security deployment issues

In a system developed according to the A&A meta-model, only agents can take proactive security measures A smart device can be made even smarter by introducing a device manager agent to detect and promptly face dangerous situations The agents present several vulnerabilities and are subject to different threats

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 14 / 23

SLIDE 48

Agent security deployment issues

In a system developed according to the A&A meta-model, only agents can take proactive security measures A smart device can be made even smarter by introducing a device manager agent to detect and promptly face dangerous situations The agents present several vulnerabilities and are subject to different threats In particular, autonomy, pro-activity and learning capabilities could act as drawbacks from the security view point

→ these properties restrict the designer’s control on the agent execution flow

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 14 / 23

SLIDE 49

Agent security deployment issues

In a system developed according to the A&A meta-model, only agents can take proactive security measures A smart device can be made even smarter by introducing a device manager agent to detect and promptly face dangerous situations The agents present several vulnerabilities and are subject to different threats In particular, autonomy, pro-activity and learning capabilities could act as drawbacks from the security view point

→ these properties restrict the designer’s control on the agent execution flow

Other malicious agents and corrupted artifacts can induce agent misbehaviour

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 14 / 23

SLIDE 50

Deployment configurations

Analysis of the “deployment requirements” coming from the physical world

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 15 / 23

SLIDE 51

Deployment configurations

Analysis of the “deployment requirements” coming from the physical world

▶ four logical nodes labelled Node 1, Node 2, Node 3, Node 4 Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 15 / 23

SLIDE 52

Deployment configurations

Analysis of the “deployment requirements” coming from the physical world

▶ four logical nodes labelled Node 1, Node 2, Node 3, Node 4 ▶ the physical resources are allocated respectively in ★ the device capturing the user credential → Node 2 ★ the administrator position → Node 3 ★ the database → Node 4 Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 15 / 23

SLIDE 53

Deployment configurations

Analysis of the “deployment requirements” coming from the physical world

▶ four logical nodes labelled Node 1, Node 2, Node 3, Node 4 ▶ the physical resources are allocated respectively in ★ the device capturing the user credential → Node 2 ★ the administrator position → Node 3 ★ the database → Node 4 ▶ assumption: the protection of these devices is realised at the

infrastructural level. . .

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 15 / 23

SLIDE 54

Deployment configurations

Analysis of the “deployment requirements” coming from the physical world

▶ four logical nodes labelled Node 1, Node 2, Node 3, Node 4 ▶ the physical resources are allocated respectively in ★ the device capturing the user credential → Node 2 ★ the administrator position → Node 3 ★ the database → Node 4 ▶ assumption: the protection of these devices is realised at the

infrastructural level. . .

▶ here we focalise only the MAS security deployment Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 15 / 23

SLIDE 55

Centralised and distributed deployments

a) b)

User Artifact Interface Artifact Building-State Artifact Access Manager Admin Artifact event event uses uses uses uses User Manager

Node 1 Node 2 Node 3 Node 4

DB

Node 2

Access Manager event User Artifact

Node 4

DB

uses

Node 1

Building-State Artifact uses Admin Artifact event User Manager

Node 3

uses uses Interface Artifact

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 16 / 23

SLIDE 56

Centralised deployment

User Artifact Interface Artifact Building-State Artifact Access Manager Admin Artifact event event uses uses uses uses User Manager

Node 1 Node 2 Node 3 Node 4 DB

It is sufficient to build a “secure boundary” around Node 1 to obtain a “secure” system The compromission of a single software entity means that the secure boundary of Node 1 is broken The threat probabilities regarding the assets increases

▶ an attacker will try to force Node 1 for

accessing the system

▶ the threat probabilities regarding the

intra-MAS communications decrease

The chosen protection mechanisms should be suitable for protecting the more valuable asset

→ the costly, effective countermeasures have to be sized to protect the whole Node 1, including less valuable assets

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 17 / 23

SLIDE 57

Distributed deployment

Node 2

Access Manager event User Artifact

Node 4 DB

uses

Node 1

Building-State Artifact uses Admin Artifact event User Manager

Node 3

uses uses Interface Artifact

All the system entities and the communication channels need to be protected Decoupling the exposures level of assets, choosing the most suitable protection mechanism for each Leading to reduce the inter-dependency between threat probabilities Presenting higher probability values associated with intra-MAS communication

→ the communications between entities always occur between network nodes

The compromission of one node does not automatically implies the compromission

f the whole system

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 18 / 23

SLIDE 58

Conclusions

In this paper we have

▶ explored the topic of security assessment in a MAS, taking a

MAS-based access control system as our reference

▶ performed a detailed risk analysis then, we studied how the deployment

choices can influence the opportunity for attacks and the effects of their success

Our deployment analysis can be situated at the end of the design phase in order to identify the “most adequate” deployment strategy in terms of security assessment Beyond the valuable context-specific results, the work hopefully provides an excellent opportunity for further, broader research

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 19 / 23

SLIDE 59

Future works

Our work is just the starting point of the story Much broader research is needed to

▶ devise a general model of the security requirements for MAS-based

systems → opening the way towards the integration of security aspects into a suitable agent-oriented design methodology

▶ further investigations concerning the security issues at the

infrastructural level → the role of the MAS infrastructures is becoming more and more relevant in the whole MAS development process

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 20 / 23

SLIDE 60

Bibliography I

Bordini, R., Braubach, L., et al. (2006). A survey of programming languages and platforms for multi-agent systems. Informatica, 30:33–44. JADE (2005). Jade.tilab.com/doc/tutorials/JADE Security.pdf. Molesini, A., Denti, E., and Omicini, A. (2009). RBAC-MAS & SODA: Experimenting RBAC in AOSE. In Engineering Societies in the Agents World IX, volume 5485 of

LNCS. Springer.

Sommerville, I. (2007). Software Engineering 8th Edition. Addison-Wesley.

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 21 / 23

SLIDE 61

Bibliography II

Yamazaki, W., Hiraishi, H., and Mizoguchi, F. (2004). Designing an agent-based rbac system for dynamic security policy. In Proc. 13th IEEE Int. Workshops on Enabling Technologies (WETICE’04), pages 199–204, Washington, DC, USA. IEEE CS.

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 22 / 23

SLIDE 62

Risk analysis and Deployment Security Issues in a Multi-agent System

Ambra Molesini & Marco Prandini Elena Nardini & Enrico Denti {ambra.molesini, marco.prandini, elena.nardini, enrico.denti}@unibo.it

Alma Mater Studiorum—Universit` a di Bologna

ICAART 2010, Valencia, Spain, 22nd January 2010

Molesini (Univ. Bologna) Risk analysis ICAART 2010, 22/01/2010 23 / 23