Insertion modeling is a technology for specification and verification of complex distributed systems based on the interactions of agents and environments. Agents and environments are models of some entities of real world or components of complex systems on different levels of abstraction that interact with one another by means of insertion functions. Also if the environment is considered as an agent it can also be inserted to other environments. In order to model complex systems those consist of a lot of components that have hierarchical structure, the notion of multilevel environments, with agents that are able to move from one environment to another is required. The notion of mobility of such mobile agents are based on the approach recently favored in declarative mobile language design is using mobile calculi that extend or modify the π-calculus [10] with new features, including mechanisms for encryption and security. Calculi of this kind include, among others, the Spi Calculus [6], and the Ambient Calculus [7]. In addition, there is a broader body of work favoring declarative approaches, including work in the field of coordination languages. There has also been a great expansion of the capabilities and security of agent-based languages such as OAA [10] and D'Agents [13].
According to the Ambient Calculus [7], devised by Luca Cardelli the main difficulty of mobile computations in Web is not in mobility itself but in handling of administrative domains. In the early days of the Internet one could rely on a flat name space given by IP addresses; knowing the IP address of a computer would very likely allow one to talk to that computer in some way. This is no longer the case: firewalls partition the Internet into administrative domains that are isolated from each other except for rigidly controlled pathways. System administrators enforce policies about what can move through firewalls and how.
The client-server model is the prevalent approach in computer networking. The model assigns one of two roles to the computers in a network: a client or a server. A server is a computer system that selectively shares its resources; a client is a computer or computer program that initiates contact with a server in order to make use of a resource. Data, CPUs, printers, and data storage devices are some examples of resources. This model can be represented as a set of administrative domains, with defined access rules, or as some architectural design pattern, like three-tier pattern. Both of these are presented in this paper in terms of the insertion modeling.
Insertion modeling system is an environment for the development of insertion machines and performing experiments with them. Insertion model of a system represent this system as a composition of environment and agents inserted into it, using the insertion function. Contrariwise the whole system as an agent can be inserted into another environment. In this case we speak about the internal and external environment of a system. Agents inserted into the internal environment of a system themselves can be environments with respect to their internal agents. In this case we speak about multilevel structure of agent or environment and about high level and low level environments.
Agent and environments have a set of action and a set of behaviors (processes), defined in behavior algebra. Two set of actions: a set of environment actions and a set of agent actions define the type of environment. If an agent is about to be inserted into the environment at least one of its actions must be allowed by this environment. So the set of agent actions define the type of environments it can be inserted in, as well as the environment's set of allowed agent actions define the type of agents that can be inserted into this environment. Such a relation between types of agents and environments is called compatibility relation [2], which defines a directed graph. When an agent is inserted into some environment, it is able to move to another environment if it is compatible with this environment. For example the rule(1) shows an agent u that moves to an external environment E, from environment R, it is currently inserted into.
Here e and r -are the names of environments, R[] -describes environment R that currently have no agents inserted into it. Insertion only occurs if a predicate P is true, and in general case it may depend only on the types of agents and environments. This example rule shows "one step" movement of an agent u, and if the new state of agent u has the same type as u, and types of environments E and R had not changed as well, rule (1) can be considered as commutative. Also"long range" movements can be defined recursively, for any set of environments between E and R.
Insertion Models of Client-Server Architecture
This model describes a client-server-architecture as a set of administrative domains that have certain access rules. Each of these domains is represented by an environment in IMS. Agents are messages that travel over these domains, trying to access certain protected area of some administrative domain of the server. As an example we take our website apsystem.or.ua. It is shown at picture below. The top-most environment E-represents some network (local-area network or internet), with environments of apsystem itself , and a set of clients C1, C2, … , Cn inserted into the network. Client environments create agents and send them over the network in order to gain access to some function of apsystem if they have certain permission, or to a domain of another client. One of the clients can represent a villain (Hacker), which goal is to find all possible security risks and ways of an attack to curtain security protocol.
In order to access administrative domain and to authorize on a server the client has to show that it knows some secret, which is only known to client and server (or two clients that want to exchange some data), and which is not transferred over the network. This key is used to encode messages (transferred by the agents), and when agents tries to move into the environment of administrative domain, this key is used to decode the message, if it is possible than agent inserts into the environment, and proceeds further. There are many ways for generating such secret. This model uses the standard Needham-Schroeder Public Key protocol [21]. Each client and server has a secret key, which is used to decode messages encoded with appropriate public key. When an agent gets inside the administrative domain (apsystem for example), it have to get a permissions to act inside it. The message transferred by this agent, contains the information about the access rights of the client who sent it. This data is used to move further. When an agent reaches some function ("download_paper" for example) it has a permission to, it is to be sent back by the server to the client. Account environments that are inserted into the clients and the top-most environment of the server store all information required to authorize at appropriate client or server. Tables below show all types of environments and agents.
Types of environments of clients and the top-most environment of the server, are identical. In general the client differs from the server only by the means of environments inside it, which require an action authorized_move. Interactions with agents:
In equation ( 2) send(A) Means that client C sends the message u, with an appropriate account AC, to the server A[], over the network E, where a -is the name of server A[]. The definition A[] means that there were no agents inserted into this environment.
An agent u tries to gain access to the server A[], A tries to authorize it, using the secret y, if the authorization succeeds, then u enters appropriate account on the server that is CA, and ca is its name.
An account environment CA creates a new agent named r, which type is t . It carries all data received from u, by the action get_data(x), x -is that data. This rule creates an agent of type authorized_agent , but it can create an agent of any type that is compatible with this environment.
The authorized agent u moves to the environment D[], that represent one of the server functions;
The agent u invokes the main function of D[], and depending on the result of check_permission u, the result of this invoke might be different.
When an agent comes back to the client that sent it, the client checks the message it carried, and it matches the required result then it is successful termination. These rules only work if both the client and the server share a secret, known only to them. In order to safely generate such secret the Needham-Schroeder public key algorithm is used. Usually the Needham-Schroeder protocol requires a second server that hosts all the public keys, but for simplicity we assume that all clients and servers know all the public keys. If the secret has already been created, than it is taken instead of public key and secret key for encoding and decoding of messages.
It runs as follows:
1. First we check if the secret exists for an account A, if not we send message to the server A[] by the rule (2), and set the value of an agent's attribute mb to N 1 that is a simple random number.
.if the secret is not created yet.
3. Then the server replies by the rule (2) to client C the value of mb is set to (N 1 ,N 2 ), N 1 -is the random number created by the client C, and N 2 -is the new random number. 4. If the first part of the mb is equal to the random number that was generated before, than C can take the pair (N 1 ,N 2 ), as a secret for the account A. 5. Then C sends a message to A[], that contains N2. When A will receive it, he will also take the pair (N 1 ,N 2 ), as a secret for account C.
In order to verify this protocol one of the clients has to take the role of a villain, its goal is to be authorized as another client from the network, using in this case a menin-middle attack. [22]
Unlike of the previous model this one focuses on the actual behavior of data-packages represented by agents, inside the server environment, divided basically to three layers according to the three-tier architecture. The example model of the server hosting two sites apsystem and unarea, is presented. Their frontends are located inside the presentation tier.
is the state of environment in such example. E -the top-most environment, Prthe presentation tier, aps -the apsystem frontend, un -the unarea frontend, App -the application tier, PHP\ PY -all sites developed in php and python accordingly, aps_l\un_l -the logic of apsystem\unarea, Data -the data tier, aps_d\un_d -the database of apsystem\unarea. The user only works with frontend. This means, that the incoming agent is compatible only with environments of the presentation layer. An agent inserted into one of the frontends carries one request. Interaction with environments: In the rule (9) u gets inside Pr using user_move pr, where pr is the name of the environment Pr, if P can allow this. (a simple one step insertion). The same way u gets inside the environment aps[], using in(aps). This shows how a user goes to some web-site (apsystem in our case), in order to download a page for example. In order to do so he has to load a web-page that has a required link to the paper he wants.
)) _ , (Pr,
The link to the paper is stored in the site's data base that is inside the Data tier, and the rules for extracting these data, and displaying them is inside the Application layer. So, the frontend part (environment of apsystem in our case) creates a new agent, that is compatible only with this environment, and with according environments of the Application layer:
Here we check if u is able to execute its request x if it succeeds than it is DELTA, if it is NOT able to, than we have to check if there any environments inside aps, that are compatible with u, go inside them, and again try the same rule. Q is put for simplicity; it describes all rest of environments that are not involved in the current rule. If there are no such environments or even after insertion to such environment u is still unable to solve(x), then we have to create a new agent r that will get necessary data from application tier.
)
Note: r has to be created inside that environment, which u is currently inserted in.
)
The agent r moves to that environment (APS_l). It should go first to the environment PHP, which is the top-environment of all sites based on PHP, and then moves to the environment APS_l. The rule for its movement is similar to the movement of a user request. The execution of script request is different:
If the execution succeeds, than r moves back to the environment, which created it. If not, then the environment APS_l, creates a new agent, which is the query for the data tier. The rules are similar.
The client-server model can be considered as a prevalent approach in computer networking, and is one of the best examples of complex distributed systems. Two examples of insertion models of client-server architecture are presented in this paper: the domain model -as a set of administrative domains with pre-defined access rules; and a three-tier architecture -a client-server architecture in which the presentation, the application processing, and the data management functions are logically separated. Both these insertion models with multilevel environments and mobile agents can be extended later for more complicated applications, such as the verification of crypto-graphic protocols, the problem solving, the constraint propagation, the cognitive architectures.