S3MS: Security of Software and Services for Mobile Systems
The objective of S3MS is to create a framework and a technological solution for trusted deployment and execution of communicating mobile applications in heterogeneous environments. S3MS would enable the opening of the software market of nomadic devices (from smart phones to PDA) to trusted third party applications beyond the sandbox model, without the burden of roaming trust infrastructure but without compromising security and privacy requirements.A contract-based security mechanism will lie at the core of the framework.The new paradigm will not replace, but enhance todays security mechanism, and will provide a flexible, simple and scalable security and privacy protection mechanism for future mobile systems. It will allow a network operator and a user to decide what an application is allowed to do, prevent bad code from running, and allow good code to be easily designed and deployed.The new paradigm of security-by-contract affects the entire life cycle of mobile applications and services: Contracts must be accommodated in high level design of security and privacy requirements of applications and mobile platforms, programming languages for the formulation of contracts must be developed, compilers must be modified to produce executable contracts for a piece of software, loaders must be aware of the static contract information that can be checked at load time, and runtime systems must be equipped with the mechanisms needed to ensure that the contracts are fulfilled during execution.