Abstract
Mobile agents show promise as a new distributed programming paradigm in which locality plays a central role - programs that are able to move closer to their data can overcome limitations of connectivity, latency or bandwidth. Mobility also enables distributed systems to evolve; for instance, the deployment of a new service over a network can be programmed as part of the service itself. Of course, moving programs introduces new challenges. One of these is related to program structure: How much of a computation should be moved? Where are the boundaries between mobile and immobile entities drawn? A second challenge is to provide security guarantees: How can the actions of mobile agent be controlled? And what kinds of securty properties can we realistically expect to enforce? We answer these questions within the framework of the JavaSeal mobile agent system kernel. JavaSeal provides several abstractions for constructuring agent systems in Java. Our basic building block is the seal which is a nested encapsulated computation fragment with sharply delineated boundaries. Strands are sequential threads of computation bound to a seal. Capules transfer passive seals and objects over communication channels; Traffic over channels is regulated by portals. We argue that these abstractions are sufficient to program secure mobile agent systems. An electronic commerce application built over our kernel is used as a demonstrator.
