This
has moved to http://crypto.stanford.edu/~stinson/security-lunch.htm
Following
is an archive of security lunches in spring 2007:
Spring 2007
Date: 6 June 2007
Speaker: Maryanne McCormick
Title: Demand response
energy systems: security, privacy and
policy
Abstract:
In the
wake of the
Over the next years these meters may be replaced by digital meters that collect
data at frequent intervals, store it for many days, and transmit it wirelessly
to the utility. Meters likely to be installed are expected to contain a data
collection module that will enable hourly readings and wireless transmittal of
these readings to the utilities. The changes in the frequency, format,
contents, storage and transmission of data about electricity consumption that are integral to the planned demand response
infrastructure raise interesting questions about the ongoing viability of
maintaining, as a technical, practical and legal matter, the privacy of
activities occurring within the home.
Bio:
Maryanne McCormick is the Associate Director of Policy and Outreach, Senior
Attorney at the Samuelson Law, Technology and Public Policy Clinic,
Date: 30 May 2007
Speaker: Des Cahill
Title: Habeas,
Inc. a Reputation Service Provider for Email
Abstract:
Habeas is
a mid stage startup in
Bio:
Des Cahill
is CEO of Habeas, a member of the board of directors and is responsible for all
company operations. Cahill is a technology industry veteran and serial entrepeneur, bringing extensive executive-level experience
in marketing, sales and operations from some of America's best-known technology
companies — Apple Computer, America Online, Netscape — and from some successful
startups — Autonomy, BridgeSpan and eFax.com.
Date: 16 May 2007
Speaker: Ben Pfaff
Title: Extreme Paravirtualization
Abstract:
Since the
origin of virtual machine monitors in the 1960s, virtual hardware has often
been designed with an ``impure'' interface that differs from physical hardware.
Paravirtualization, as this is now termed, is often
used to simplify VMMs and boost VM performance.
This paper explores tradeoffs in a rarely seen form of paravirtual
interface, where the virtual interface operates at a higher level of
abstraction than the common hardware interface. We in particular examine the
effects of providing a BSD socket-like interface to a VM instead of an Ethernet
interface, and the effects of providing a file system interface instead of a
block device interface.
Our experiments show that higher-level (``extreme'') paravirtualization
has direct benefits for sharing, security, and modularity. Modularity, in turn,
has potential for indirect benefits of the same kinds often ascribed to modular
microkernel-based systems. We also show that our approach requires little
or no change to existing VMMs and operating systems.
Finally, given the availability of processor cores, it has minimal
performance cost: 3\% or less in every case for our paravirtual
network stack, and under 4\% for file system macro-benchmarks. In special
cases, we even demonstrate speed-ups.
Date: 9 May 2007
Speaker: Nickolai Zeldovich
Title: Information Flow
Control in a Distributed System
Abstract:
News of yet another
attacker compromising a web site and gaining access to thousands of social
security and credit card numbers does not surprise anyone today. This sad
state of affairs in part comes from poorly-tested and complex site-specific
application code being trusted to enforce security policies. This is
equivalent to trusting every Unix program to ensure
that each user can only access their own files, an unthinkable proposition that
has become the norm on the web.
One solution may be to enforce the security policy separately from the
application code. Recent work on operating systems, such as Asbestos and HiStar, has shown that it is practical to specify and
enforce an overall security policy in terms of what can happen to the data. For
example, a web site can protect private user information by by
ensuring that one user's private data cannot be sent to another user's browser.
However, an operating system can only enforce such an information flow
policy on a single physical machine. In contrast, web applications are
often distributed over many physical machines, making it difficult to enforce
an overall information flow policy.
This talk will discuss
the design of a distributed and decentralized system that can enforce an
overall information flow policy. A central problem we solve is deciding
whether it is safe to communicate with another machine, without any
fully-trusted central authority: any communication with that machine may in
itself reveal secret information to an attacker. Using our system, we
build a scalable distributed web server that minimizes the trust placed in any
single component. In most cases, even a
fully-compromised kernel on one web server machine cannot subvert the security
of all users.
Date: 2 May 2007
Speaker: Tal Garfinkel
Title: Compatibility is
Not Transparency: VMM Detection Myths and Realities
Abstract:
Work on
applications ranging from building realistic honeypots
to stealthy VMM rootkits has speculated about
building transparent VMMs
-- VMMs that are indistinguishable from native
hardware, even to a dedicated adversary. In this talk I will discuss anomalies
between real and virtual hardware and consider methods for detecting
such anomalies, as well as possible countermeasures. I will argue
that building a transparent VMM is fundamentally infeasible, as well as
impractical from a performance and engineering standpoint.
Date: 25 April 2007
Speaker: Dilys Thomas
Title: Algorithms and
Architectures for Data Privacy
Abstract:
The
explosive progress in networking, storage, and processor technologies has
resulted in an unprecedented volume of digital data. In concert with this
escalating increase in digital data, concerns about privacy of personal
information have emerged globally. The ease at which data can be collected
automatically, stored in databases and queried efficiently over the internet
has worsened the privacy situation, and has raised numerous ethical and legal
concerns. Problems arising from private data falling into malicious hands include
identity theft, spam and embarassment. Privacy
enforcement today is being handled primarily through legislation. We aim to
provide technological solutions to achieve a tradeoff between data privacy and
data utility. We focus on three problems in the area of database privacy
in this thesis.
The first problem is that of data sanitization before publication. There are
two main reasons for data sanitization before publication. Publishing health
and financial information for research purposes requires the data be anonymized so that the privacy of individuals in the
database is protected. This anonymized information
can be used as is or can be combined with another (anonymized)
dataset for analysis. We explore both these scenarios in this thesis. Another
reason for sanitization is to give the data to an out-sourced software
developer for software development without the out-sourced data handler
learning information about its client. We briefly explain such a tool in this
thesis.
The second part of the thesis is auditing query logs for privacy. Given certain
forbidden views of a database that must be kept confidential, a batch of SQL
queries that were posed over this database, and a definition of suspiciousness,
we study the problem to determine whether the batch of queries is suspicious
with respect to the forbidden views.
The third part of the thesis deals with distributed architectures for data
privacy. The advent of databases as an out-sourced service has resulted in
privacy concerns on the part of the client storing data with third party
database service providers. Previous approaches to enabling such a service have
been based on data encryption, causing a large overhead in query processing.
In this thesis we provide a distributed architecture for secure database
services as a solution to this problem. We then develop algorithms for
partitioning columns for these distributed architectures.
Date: 18 April 2007
Speaker: Gergei Bana
Title: Computational
Semantics for Basic Protocol Logic
Abstract:
We present
a new way of relating formal and computational models of cryptography in case
of active adversaries when formal security analysis is done with first order
logic. We present this via considering a simple example of such a formal model,
the Basic Protocol Logic by K. Hasebe and M. Okada,
but the technique is suitable for extensions to more complex situations. Our
idea is to make use of the usual mathematical treatment of stochastic
processes, hence be able to treat arbitrary probability distributions,
non-negligible probability of collision, causal dependence
or independence, and so on.
Bio:
Gergei Bana received his PhD in
mathematics from the
Date: 11 April 2007
Speaker: Collin Jackson
Title:
Abstract: