Secure Resource Sharing in Ad hoc Networks

Michaela Greiler, Peter SchartnerSystem Security, University Klagenfurt, Klagenfurt, Austria

Abstract Mobile and wireless devices become more pop-ular and their capabilities increase as well. At the sametime, most of the today’s PC power is unused, as a studyof the Gartner Group indicates. Grid computing and P2Psystems take advantage of this fact and provide unused re-sources to other nodes within the network, but mobile sce-narios or ad hoc networks are often left out. This paperpresents a concept for secure resource sharing in mobile adhoc networks, with a special focus on challenges and prob-lems with mostly unknown and potentially unreliable anduntrustworthy devices. Virtualization technologies will bepresented as a solution to grant application security, asthey are also used in grid and trusted computing. The se-cure resource sharing (SRS) system, that will be presentedin this paper as well, focuses on granting security aspectslike availability, privacy, confidentiality and trust estab-lishment in the area of resource sharing.

Keywords: secure resource sharing, security aspects, virtual-

ization, sandboxing, authentication, trust.

1 IntroductionToday everyone talks about local services. Separate ap-plications provide different services like information aboutrestaurants, traffic congestion, and tourist information.Normally all these services are obtained and managed froma central server and provide and distribute informationand data. Nowadays mobility is one of the most pressingtopics, and small, mobile devices become more popularevery day. Problems with these small devices like cellu-lar phones, personal digital assistants (PDAs) and smalllaptops are limited central processing unit (CPU) power,small disk space, little available random access memory(RAM) and limited communication bandwidth. Further-more many applications are not executable because ofhardware restrictions or incompatible operating systems.Gartner Group research results in the perception that over95% of today’s PC power is unused [5]. Many differentcommunication technologies are available, but coopera-tion abilities between them are constrained. For exam-ple, every type of network connection (e.g. Infrared –IrDA, Bluetooth, LAN, WLAN) within a Windows op-erating system has to be configured and updated sepa-rately. If someone wants to find communication partnersin range, every connection type requires a request or an

update. Moreover, communication is only possible if thehardware of both communication partners is supportingthe desired network connection. The main idea of the se-cure resource sharing (SRS) system is, to go one step upand abstract from different communication technologies toprovide a technology independent communication and ser-vice infrastructure. Services should provide resources tosmall and restricted devices. These services not only in-clude information and data services, but also provide CPUpower, applications, and disk space.At this, the main focus is set on the security aspects of re-source sharing, and the restrictions that come along withad hoc networks. Figure 1 shows a potential network inwhich resources can be shared. In this network, devicesof different power and abilities exist. For example thesmartphone can only communicate with the other devicesvia infrared. Only the PDA is able to communicate viainfrared and WLAN, and is used as a bridge to other de-vices like the laptop, which further allows to access theprinter or the Internet via the PC. Furthermore, the lap-top can request resources from other devices. For example,the laptop may outsource some costly calculations to themore powerful PC.Every user who wants to participate, has to download themiddleware from a central third party (generally a server).The middleware is responsible for network management,which includes opening and closing the network connec-tion as well as mediating between different types of com-munication technologies. Other tasks like creating andmaintaining service lists are covered by the middlewaretoo.Impartial from the underlying communication technology,a high level protocol (at application level) will be used forservice communication. Security tasks like authentication,assurance of integrity etc. are covered by the middlewareas well as by the services themselves. A service is inde-pendent from the middleware and can be seen as a plug-in. The middleware provides a framework for networkmanagement, communication and security. The servicesor plug-ins extend this framework and can be added adlibitum. This architecture provides a common basis forvarious services from different software producers. Themiddleware offers a well defined and open API. A similarapproach to split middleware and services is used by the

Figure 1: Potential resource sharing network

SMEPP project, that focuses on providing a middlewarefor P2P systems [8]. The concept of a shared middle-ware and the ability to integrate various different servicesshould lead to a consistent service environment. By now,services are grouped in four categories:Information Sharing: Information services, often imple-mented as mobile agents, offer the ability to drop searchqueries that return some information collected by otherdevices in range or from the Internet. Examples are get-ting weather forecasts, finding petrol stations, restaurants,books etc. Information services can not only be used toobtain information or data, but also to distribute it andtransfer it from one point to another implicitly, like it isuseful for emergency services. In addition, informationservices are thought to allow peers to work in a collabora-tive manner. Therefore white boards, instant messaging,and co-browsing can be realized.Storage Sharing: Services belonging to this category pro-vide free disk space from devices within range. For ex-ample someone wants to outsource data because the localdisk space is limited. Another device in range has enoughcapacity to store the data without any constrictions orobstructions. The service would mediate between thesetwo devices and allow the restricted one to save as manydata on the other device as possible and approved. Dataintegrity and confidentiality can be assured by the use ofencryption and data integrity mechanisms. But at one goencryption offers another problem: namely that the partthat saves the data does not know which data it is goingto save. This is known as data legitimacy problem.Computational Sharing: Using the computational powerof another device is critical and must be well-conceived.The idea of computational sharing is to use a conglom-erate of many idling devices in range, to which computa-tional tasks are outsourced. These devices compute thetasks and return the results to the applicant. In additionto transferring the data used for corporate computation,the algorithm itself can be transferred too. To warrantthe safeness of the calculating device, virtual machines orprocesses can be used (sandbox techniques). In that case,the whole computation will take place in a shielded envi-ronment.Application Sharing: This category includes all services of-fering applications from other devices to be used by appli-

cants. Similar to computational sharing, virtual machinescan provide safety for the service provider. An examplefor such a service is an export application. An export ser-vice could allow an applicant to send data, for examplea Word document, to the service provider which convertsthis into a PDF document and sends it back. Besides thehigh risks, which are caused by invocations of programs,legal and license regulations come into play.The paper is structured as the following: First the usage ofthe SRS system at a conference is exemplified. Then vir-tual machines (VMs) and sandboxes are explained, whichare thought to provide application security. Afterwardsthe use of VMs is motivated for application and computa-tional sharing. Finally pending questions and future workare presented.

2 Conference ScenarioAn appropriate scenario for the usage of the SRS systemis a scientific conference. Many people with similar inter-ests meet for the same goal - participation and knowledgetransfer. To come into contact and get to know each other,a special information service can be used. Let us call itbusiness card service. As its name implies, this serviceprovides business cards. Everybody having installed thisservice, distributes business cards to other conference par-ticipants and in return can receive business cards from theothers too, as illustrated in Figure 2 (left).Furthermore the service can also provide informationabout contacts of a person, like it is often used in so-cial networking sites (e.g. LinkedIn). Other informationsharing services allow participants to work in collabora-tion, like messaging services, services that provide a sharedwhite-board or enable co-browsing.In such an environment, business and computer collabo-ration can be extremely relevant. Authorization can beguaranteed through network access authorization, whichin particular means that every conferee has got a usernameand a password to gain access to the network. Simultane-ously, the possession of this access credentials can be usedas authorization for service usage.Using the capabilities and resources of many devices at aconference can provide great potential and the output ofthis computation assembly can be enhanced. Another po-tential scenario for the use of the SRS system is sharing adata projector, as Figure 2 (right) shows. Normally only

Figure 2: Exchange of business cards and Projecting data on a shared screen

one device, for example near to the speaker’s desk, is con-nected to a data projector. All conferees or speakers thatwant to provide some data have to carry their own deviceto the lectern and connect it to the data projector. A fur-ther possible solution would be to save the content on aportable hard disk (e.g. USB) and copy it to the connecteddevice. The SRS system can help to simplify this scenario.The content will be delivered (e.g. via streaming) to theconnected device. No carrying around of devices is nec-essary. The only requirement is that both the deliveringdevice and the receiving one share the same applicationsharing service. Further examples for resource sharing areknowledge sharing services, that allow conferees to accessinformation about research interests of other participantsor share research papers, and services that allow access toprinters, data projectors and other accessible devices.Storage sharing at a conference enhances the disk spaceof devices by using unused disk space of nodes in range.Often conference members do not want to take more thana smartphone or a PDA to a conference. Let us consider ause case where the conference participants have left theirlaptops at the hotel. Unfortunately, when they arrive atthe conference they notice that interesting research papersand prototypes are provided for downloading today. Astorage sharing service can be deployed to allow conferencemembers to store their data on different devices.The processing of statistical tests is a predestined examplefor outsourcing of data processing and the researchers usethe ability of the SRS system. During the conference, agroup of researchers presents its collision-free key genera-tion (CFNG) algorithm. The output of the key generatoris claimed to be unique and random. To test the random-ness of the generated key material, the researchers wantthe output to be tested by many statistical tests. Themore tests the output of the key generator passes, themore it can be deemed to be random. A particular sce-nario is illustrated in Figure 3. There researcher A sendsone algorithm for a special statistical test (e.g. one of theDiehard Statistical Test Suite) referred as suite1 to CPUproviders P1 and P2. Another test suite, named suite2that is known as resource-intensive and time-consumingis sent to P3. Then A distributes to every provider an-other part of the CFNG output. The providers start thestatistical test and after finishing they return their resultsto researcher A. The results of the test suite2 are not ex-

pected until next day. Therefore the researcher and alsothe provider will disconnect from the network with highprobability resulting in an availability problem. The basicidea to solve this situation is that providers having alreadyfinished the computation will store the results for a par-ticular period of time (e.g. one day) until researcher A isavailable again. If A is in range again, they will send theresults immediately. By the next day, the researchers canuse all the received results to present the randomness oftheir CFNG to the conferees. Beyond using the SRS sys-tem at a conference, other environments and situations,in which the SRS system can be useful, are bus stations,airports, office buildings etc.

3 Virtual Machines & SandboxesBesides all efforts to secure communication between nodesand to introduce authentication mechanisms for ad hoc en-vironments, it is crucial to concentrate on application se-curity. To allow applications and code from other, mostlyunknown, nodes to be executed, involves the risk that thecode that has been downloaded and installed is malicious.To download code only from sources that are fully trustedis not practical in many systems, and claims for full trustedsources trespass the ad hoc systems’ character. Further-more it is not possible to check if the code is malicious ornot prior execution. Securing the application execution isimportant, because willingness of the users to share theirresources will reduce drastically if the participation is as-sociated with a serious risk [5], [2]. As usual, programsthat will be invoked at the supplier’s device are executedwith all the privileges of the supplier. This means thatthe program may have write and read access to the user’sdisk, may be able to open network connections and cre-ate other processes. These privileges have to be restrictedfor programs invoked during resource sharing. It has tobe guaranteed that the state of the real machine of thesupplier will not be changed, the privacy of the supplieris protected and that no unwanted programs or processeswill be executed. Limitations of privileges and access to re-sources can help to prevent malicious code from harmingthe user’s system. The downloaded code has to be exe-cuted in such a way that it can be completely controlled.Therefore access to computer resources will be restrictedaccording to the trust level of the code. Restricted re-sources can be local disks (read and/or write permissions),

Figure 3: Distributed computation for testing randomness

network connections, process creations, and access controlfor dynamic libraries or native methods. Virtualizationtechnologies enable to run untrustworthy and unsafe ap-plications in a virtual environment that protect the realenvironment from permanent damage [6]. Therefore oneor multiple execution environments are created on a sin-gle physical machine, as Figure 4 illustrates. Each virtualmachine is a reproduction of the real physical machine.These virtual machines are distinct, isolated and do notinterfere with each other or the underlying physical ma-chine. The virtual environment can be analogue to thecurrent host environment, by copying the environment ofthe physical machine to the virtual machine.Different approaches exist to enforce application securityby restricting access and privileges. Security EnhancedLinux (SELinux) technology uses Access Control Lists tolimit system access. The User Mode Linux (UMLinux)and Virtual Server (VServer) technologies create differ-ent virtual servers for execution of unknown applications.UMLinux can be seen as a linux-inside-linux solution. Thevirtual machines protect the real machine from being dam-aged, because changes on the virtual machines do not in-fluence the real system. A drawback of this approach isthe decreased performance because of running multiple op-erating systems within one device. With the sandbox se-curity model, a much better performance can be achievedthan by creating complete virtual machines. The sandboxsecurity model tries to provide a restricted environment inwhich untrustworthy code can be run by separating pro-cesses and limiting access to the system resources (e.g filesystem). The Java architecture is well-known for the useof a sandbox model. In Java the sandbox security modeluses a security manager to determine the access rights.Code, remote or local, can be subject to security policies.Other examples for sandbox approaches are the chrootcommand, and jailing in Free-BSD (Berkeley Software Dis-tribution). The chroot command restricts the file systemoperation for a process. Jail is a combination of the chrootcommand and the sandbox approach. Many approaches,such as UMLinux and Jail, are restricted to particular op-erating systems. But in many cases such limitations arenot preferred. A heterogenic environment, such as in theSRS system, requires a technique that is independent fromthe underlying operating system and hardware. Further-

more combinations of the methods listed above have to beconsidered. The Java 2 Platform, Micro Edition (J2ME)gives a direction to secure applications but in addition fo-cuses on small and powerless devices like smartphones [7].Key security features of J2ME, assuring application secu-rity, are bytecode verification, code signing and sandboxmechanisms. Bytecode verification is an important fea-ture that restricts an application, in such a way, that itcan only access memory and resources within its domain.It prevents an application from overloading the Java lan-guage core libraries. Code signing is the next major pylonof the security architecture. Digital signatures are used tocheck the origin and the integrity of the data. Only appli-cations that pass the signature verification process can bedownloaded and executed. Furthermore, access permis-sions of the application depend on the trustworthiness ofthe application’s source. Hence read and write operationson the local storage or establishing a network connectioncan be forbidden. For network and data security, J2MEallows to use point-to-point secure connections. Protocolssuch as the Secure Socket Layer (SSL) and the TransportLayer Security (TLS) protocols are supported and the Se-cure Hypertext Transfer Protocol (HTTPS) is available inthe Generic Connection Framework. Data security can beachieved through the Record Management System (RMS),which allows encoding data.Virtualization is often reviled as heavy-weighted andclumsy, and sometimes for good reason. One of the prob-lems is that frequently VMs are complete operating en-vironments, although only a subsystem is needed. Theinitialization of virtual machines is an expensive task andleads to costly disk usage and invocation latency.Software virtualization technology is located between theoperating system and the applications. Applications ex-ecuted in the virtual machine can access all resources ofthe physical machine but are restricted in such a way, thatthey cannot tamper the real machine. The virtual machineshares the execution environment with the real machine.Deviations from the host environment are stored in theVM’s local state. These deviations, or a subpart of them,can be synchronized with the host machine if desired.Often the concept of namespaces is used for virtualizationand separation. Each VM acts in a distinct namespace andall resources are renamed to the new namespace of the VM

Figure 4: Two VMs running on one single device

they belong to. Namespace virtualization is used in manywell-known systems like FreeBSD Jail, Solaris Containersand Linux VServers. Yu et al use namespaces for creatingvirtual machines for windows applications too, and theycall their virtual machine feather-weight virtual machine(FVM).Other windows-based virtualizations are Progress Deploy-ment System (PDS) and Softgrid. Softgrid erstwhileSoftricity provides application virtualization and dynamicstreaming technologies [4], [6]. PDS creates separatedVMs with a subset of the Windows APIs. Other exist-ing virtualization technologies are VMware and virtualPC. In contrast to Softgrid they virtualize at the hard-ware abstraction layer. Bochs is an emulator projectthat runs on most popular platforms and can be foundat http://bochs.sourceforge.net/. The complete x86 PCemulator allows running operating systems and softwarewithin the emulator and therefore enables the user tohave a machine inside a machine. Virtualization tech-nologies can be differentiated by their level of abstrac-tion. Hardware abstraction layer virtualization, like usedby VMware, Virtual PC, Denali, Xen, and User ModeLinux abstract the hardware of the physical device, likememory, processor and peripheral I/O devices in such away that multiple instances of operating systems can beinstalled on a single machine. A major advantage of hard-ware layer virtualization is the complete separation andisolation of the different virtual machines and the hostmachine. Disadvantageous is the overload and bad per-formance of the technique because of the high resourceneeds.At the same time, virtualization can be done at theoperating system level. FreeBSD Jail, for example,uses multiple virtual execution environments to sep-arate resources that can be accessed by an applica-tion. These virtual environments are called jails. Thelinux-based VServer separates the user-space environ-ment into distinct virtual private servers. Other vir-tualization environments for the Linux platform areSphera and SWsoft’s Virtuozzo that can be found athttp://www.swsoft.com/en/products/virtuozzo/. In ad-dition to Linux, Virtuozzo supports the Microsoft Win-dows server operating system for virtualization. SolarisContainers offers virtualization technologies for the Solarisoperating system.Calder et al present in [1] a virtual machine for desktop

grids, named Entropia. Entropia is designed to safeguarddesktop PCs that offer their resources for grid computingfrom damage caused by malicious or malformed applica-tions. Additionally, this environment monitors the be-haviour of the applications and the usage of the resourcesto guarantee that the PC user will not be interrupted ordisturbed. Access control mechanisms restrict the gridapplication from modifying data on the device or gainingaccess to private data of the user. Entropia pledges thatthe system of the user will be in exactly the same stateafter the completion of a task as it was before, and thatthe user will not experience a performance decrease duringworking.Calder et al define requirements for a virtual machine usedfor securing the participation in grid computing, whichare:Integrity of the device: The data of the device should nei-ther be accessible nor writeable for the grid computingapplication. The integrity and confidentiality of the datahas to be guaranteed.No change of the state: The state of the real machinehas to be exactly the same after the execution of the gridapplication as it has been before.No performance decrease: The user should always be ableto use his or her device unhindered. If different processesdraw on the same resource, the grid application processeshave to be non aggressive and run with lower priority.Integrity of the grid computation: Not only the user canclaim protection of his or her device and the data, but alsothe integrity and confidentiality of the grid application andits results have to be considered.Entropia uses a desktop controller that monitors and con-trols the entire grid jobs running on the supplier’s ma-chine. This controller guarantees no performance de-creases for the user. It looks for the disk, the CPU, theinput and output and the memory usage and restricts theamount of processes that can be started by the grid ap-plication. If the grid application uses the resources tooheavily the desktop controller will throttle, pause or eventerminate the application. Moreover, Entropia wraps allthe grid applications by using binary modification technol-ogy. It wraps native binaries which leads to the advantagesthat the application can be written in any language thatcompiles to x86 and no source code is required. A detaildescription of the wrapping process can be found in [1].

Furthermore Entropia offers sandbox mechanisms thatmediate the complete grid application interaction with theoperating systems and guarantees integrity and confiden-tiality for the user’s data, the grid application and theaccording data.As it can be seen, much research has been done and willbe done in future on virtualization technologies. The over-head of running virtual machines can be reduced moreand more. As Yu et al show, their FVM has less than20% overhead while execution of command line programs.The potential of virtualization, especially for deploymentof mobile or untrustworthy code and applications, is enor-mous. Also in the SRS system sandboxing and virtual-ization technologies play a key role. Applications that auser runs in a normal system are allowed to invoke anysystem calls that the user is allowed to make, becausethe programs are executed with all the privileges of theuser that invokes it. Defining access policies can help toprevent some applications from deleting files, modifyingregistry entries, making a network connection and so on.The problem of this approach is the creation of the policyfiles. It is very likely that a ”good-natured” applicationis too restricted and it cannot conclude its work, but onthe other hand a malicious application sometimes has toomany privileges. As most commonly there is insufficientprior knowledge of access requirements, correctly definingwhich functions should be blocked is complicated and of-ten not successful.Virtualization in contrast to sandbox mechanisms offersthe ability to execute the untrusted application in an envi-ronment that seems to the application as the unrestrictedhost environment. In general, modifications of the physi-cal machine are not allowed, but can be selectively com-mitted and transferred to the host environment. Transferof state modifications to the host environment is one of themost challenging tasks. How can desired modifications bedistinguished from unwanted ones? This question takes aback seat in the SRS system, because most of the timesthe requirement for changes to the host environment is notgiven. In the case of sharing CPU cycles, no permanentmodification of the host environment is needed, only theexecution of the applicant’s desired application has to bedone. The only permanent modification of the host sys-tem that can be required from SRS services is to storedata on the disk. This data can be the results of the com-putation or naturally the data that should be stored forthe applicant. The type of data that has to be stored doesnot include executable data.After presenting technologies that are closely related toand useful for the SRS system in this chapter, the nextchapter focuses on how these concepts can be applied toapplication and computational sharing.

4 Application & CPU SharingThe major problem according to application sharing is theprocess of invoking programs on another device. How canthe supplier be sure that its device will not be damaged?Which programs are allowed to be invoked, and whichare not allowed? Invoking programs is a critical task, be-cause often through these programs security holes can beused to, for example, accessing private data of the sup-plier or even invoking some other programs that shouldnot be accessible to the applicant. We refer to securingthe invocation and execution of programs as applicationsecurity. A program that is invoked normally runs withall the privileges of the supplier, which means that the lo-cal disk can be accessed for reading and writing, processescan be created and network connections can be opened[3], [1]. Therefore the process of invoking has to be welldesigned and secured. It must be granted to the supplierthat the supplier’s device will be protected from unwantedaccess or data modification, that the supplier’s device willnot be harmed by malformed or malicious applications,and that the supplier can control the usage and behaviourof the service executed at all times, in such a way that theuser will not experience unwanted deterioration of perfor-mance.One important problem besides harming the provider’s de-vice is the submission of false results. How can an appli-cant be sure that the received results are correct? Can anapplicant recognize that the results have been tampered?Protecting the authenticity and integrity of the sharingapplication can increase the trustworthiness of the results.Therefore the supplier should not be able to manipulatethe sharing application and the results.Virtualization techniques can be used to hinder a providerfrom sending false results. The main idea is to use an en-closed, secure virtual machine that gets the input data inan encrypted way and provides the results encrypted too.Only during data processing the input and output willbe available in plaintext. Because the result is encryptedwhen it leaves the secure virtual environment, it is dif-ficult for the adversary to manipulate the cipher text insuch a way that it will be accepted as a valid result. Thecomplexity of manipulation depends on the applied en-cryption scheme and additionally the used hash function.This process is illustrated in Figure 5.In the case that an adversary gets access to the securevirtual machine or the data, and the algorithm is not en-crypted, an attacker can easily send false results.To make it more difficult for an adversary to submit falseresults the integrity and authenticity of the service appli-cation has to be protected too. This means that the serviceapplication should not be modified by a supplier and thesupplier should not be able to modify and read results andinput data. If results have to be stored they should onlybe stored encrypted on the device. The virtual machine

Figure 5: Secure Processing

is responsible for providing a secure environment that isnot accessible for the user. Furthermore the integrity ofthe service application has to be proven before execution.This proof can be based on encrypted checksums of thebinary data files of the application. Before execution ofthe application the checksum is validated and indicateswhether an application has been tampered or not. Thisprocedure for example is also used in Entropia [1]. Similarto computational sharing, virtual machines can be used toallow a secure and isolated invocation of programs. Theprocess is as follows:For all the services, a separate virtual machine will bestarted, and programs can only be invoked within thisvirtual environment. To make the virtual machines, theservice applications, the algorithms and the data nearlyinaccessible a trusted hardware, like a smart card or re-lated to trusted computing the trusted platform module,can be used. This module stores for example the secretkeys needed for the encryption of the input and outputdata, the application etc. The use of smart cards is prefer-able to the use of a built-in module because cards canbe exchanged easily, depending on the current applicationneeds. The virtual machine is furthermore responsible forrestricting and maintaining the access to local resourcesof the supplier’s device, like disk space, network connec-tions, and process creation. Also, no permanent changesare allowed to take place. The whole process of applica-tion sharing is temporary, and the status of the live systemwill not be changed. This means that neither the appli-cation sharing process will write data to the hard disk orchange registry entries, nor should private data of the userbe accessible. After completion of the application sharingprocess, the system of the supplier should be exactly thesame as it was before. Therefore the program that will beinvoked has to run with restricted privileges. Virtualiza-tion techniques, like the ones described before, are a mustand can grant beyond application security, confidentiality,and a higher trust in the authenticity of the results.

5 Resumee and Future WorkIn this paper we presented a concept for secure resourcesharing in ad hoc networks as a first step of a currentresearch topic. Concerning shareable resources, we haveidentified four resource classes by now: information, stor-age, CPU-power and applications. Technologies whichmight be useful to implement this concept include vir-

tualization and sandboxing. The next steps include a de-tailed analysis of special security needs and technologiesand mechanisms like trusted computing or anonymous au-thentication. Besides technical aspects, there are severallegal aspects which have to be investigated, too. Here wewill focus on techniques providing traceability of actions,non-repudiation and conservation of evidence, which maybe of importance when concerning fears of potential usersof the SRS system. After refining and elaborating the con-cept, we will implement a prototype, in order to performsome performance and security tests.

References[1] B. Calder, A.A. Chien, J. Wang, and D. Yang. The entropia

virtual machine for desktop grids. In VEE 05: Proceedingsof the 1st ACM/USENIX international conference on Vir-tual execution environments, pages 186-196, 2005.

[2] E. Dodonov, J.Q. Sousa, and H.C. Guardia. Gridbox: se-curing hosts from malicious and greedy applications. InMGC 04: Proceedings of the 2nd workshop on Middlewarefor grid computing, pages 17-22, 2004.

[3] J.Y. Levy, L. Demailly, J.K. Ousterhout, and B.B. Welch.The safe-tcl security model. In ATEC98: Proceedings of theAnnual Technical Conference on USENIX Annual Techni-cal Conference, pages 23-23, 1998.

[4] Microsoft. Microsoft completes acquisitionof softricity, last accessed 24.02.2008, 2006.http://www.microsoft.com/presspass/press/2006/jul06/07-17SoftricityPR.mspx.

[5] I. Taylor. From P2P to Web Services and Grids Peers in aClient/Server World. Springer, 2005.

[6] Y. Yu, F. Guo, S. Nanda, L.C. Lam, and T.C. Chiueh. Afeather-weight virtual machine for windows applications. InVEE 06: Proceedings of the 2nd international conferenceon Virtual execution environments, pages 24-34, 2006.

[7] M.J. Yuan and J. Long. Securing wireless j2me -security challenges and solutions for mobile commerce ap-plications. Technical report, IBM, University of Texas,2002. http://www.ibm.com/developerworks/wireless/library/wi-secj2me.html.

[8] M. Albano, A. Brogi, R. Popescu, M. Diaz, J. Dianes To-wards Secure Middleware for Embedded Peer-to-Peer Sys-tems: Objectives & Requirements. In proceedings of the6th International Workshop on the Foundations of Coordi-nation Languages and Software Architectures, Lisbon, Por-tugal, 2007.