Computer Security Foundations

1. Computer Security Foundations COS 597B Prof David Walker

2. Welcome! • Computer Security Foundations is for • students interested in programming languages and how to apply them to solving systems security problems • students interested in systems security problems and how to use programming languages to solve them

3. Class Style • Some lectures given by me on technical topics • Some discussions of papers on security • class participation is important • Occasional 1-page writing assignment summarizing or critiquing a paper • You can take this course for software systems competency

4. Background • It will be useful to have some background in logic or language semantics • Appel’s theorem proving class • Programming languages (COS 510 or 441) • If you have never taken such courses I recommend • Benjamin Pierce “types and programming languages” • Chapters 1-9 (approx 100 pages of fairly easy reading) • I will try to fill in background as I go • Next Monday, we will have a tutorial on this background material

5. Topics of Interest: Foundations • what is security? • safety, liveness, secrecy, authenticity, integrity • what principles are available that help us build secure systems? • open design, economy of mechanism, minimal trusted computing base, etc

6. Topics of Interest: Language Mechanisms • dynamic program monitoring • theory: what kind of properties can we enforce? • practice: languages for writing program monitors • static program analysis • type systems for safe virtual machines • enforcing information flow properties

7. Topics of Interest: Logic and Security • specifying security properties logically • authentication logics • proof-carrying authorization • security for distributed logic programs

8. Topics of Interest:Cryptographic Protocols • Specification of cryptographic protocols • make assumptions about the power of cryptographic primitives • nothing about cryptography itself (see Ed’s course if you are interested in how cryptography works) • reasoning about cryptographic protocols using types

9. Topics of Interest:Current Techniques • Java security • class loaders, security managers, security policies for Java • stack inspection: what is it? How does it work? What kind of security does it really provide? • Program analysis and security • model checkers: how to analyze one million lines of code for security flaws! • language designs: CQual, Vault

10. Grading • Taking the course for a grade: • course project, final report: approx 50% • assignments, project progress reports, pop quizzes, class participation, class presentation: approx 50% • Not taking the course for grade: • reading and class participation • a presentation on a topic of interest

11. Course Project • A substantial project involving programming languages and security in some fashion • work in pairs • once you get started: work steadily every week of the term (5-10 hours/week, perhaps more) • note: I deleted the journal idea

12. Course Project: Milestones • Sept 24: Form groups & pick area • Oct 8: analysis of related work • ~ 5-page analysis of related work • minimum 2 papers/person (hand-in a joint summary) • Nov 1: Progress Report I • ~ 5-page description of one component of the project • idea summary and justification, a partial formalization, a proof, a tool description and performance evaluation, a language design and justification, a software design and explanation etc • Nov 22: Progress Report II • ~ 5-page description of a second element of the work • Last month of class: Presentation on research in your area • assign 1 or 2 papers to the class to read; give a lecture and discuss • Jan 11, Deans date: Final submission • submit final report which includes introduction, problem description, technical accomplishments, any code, performance evaluation, related work, and summary

13. Project Ideas • The course web site contains a list of project ideas and some papers you can read as starting points; • Feel free to choose an idea from the web site or try an idea of your own, possibly connected with other research in the department • Some of the projects mentioned on the web site are very open-ended. • identify small subgoals that can be accomplished each week or every two weeks • be sure to have multiple fall-back positions • plan realistically

14. Example Project • Cryptographic programming in Jif: • Jif is a programming language based on Java equipped with a type system for detecting information-flow. • Learn about how Jif works, its features and semantics • Use Jif: • Design an interface to a cryptographic library using Jif's decentralized label model. • Use the resulting library to implement the cryptographic protocols used in a secure client-server setting. • Evaluate: What did you learn? Jif pros and cons? • Starting points on the projects page: • eg: Jif Homepage  http://www.cs.cornell.edu/jif/

15. Example Final Project Outline • Abstract • Section I: Introduction • Motivation (argument that makes the contributions seem inevitable!)- Information security is important.- Cryptographic primitives are crucial for network-based security.- Language-based security is practical way to increase confidence in security - Current support for cryptographic primitives in languages is not good. • Contributions- Design of a cryptographic library in Jif- Show how type system can encode desirable invariants- Investigation of event driven vs. threaded programs with information flow- Implementation of a (reasonably) substantial system using Jif • Section II: Background material • Jif and Decentralized Label Model- Important features (label abstraction, first-class principals, declassification, endorsement), syntax, semantics • Cryptographic operations

16. Example Final Project Outline • Section III: Design of the Cryptographic Library • Problems: Keeping keys secret; Dependency between keys and encrypted values; Authentication information encoded in the types; Integrity Constraints in Jif • Solutions: Dynamic Principals; Label polymorphism; Fancy programming • Section IV: Evaluation of the Library • Description of the test case- Bank/ATM simulation with interesting authentication protocols- Taken from CSE331 course implementation • Implementation details/examples • Insights learned? Design choices you would have changed? • Section V: Related Work • Section VI: Conclusion • Summarize introduction • Reiterate contributions

17. Other Project Topics • secure distributed programming & PlanetLab • implement a service for PlanetLab using an interesting programming model • tuple spaces (see Klaim for Java) • join calculus (see JoCaml) • distributed logic programming (see SD3, Sophia) • consider the security threats and the mechanisms necessary to compensate • implement a security monitoring service (as opposed to an arbitrary service)

18. Other Project Topics • security monitors • a security monitor watches a program, virtual machine or distributed system and interrupts the system when it detects a security violation • consider security monitors based on transactions • theory of what is enforceable in the transactional model • practice of implementing the system • consider concurrent or distributed security monitors • consider hardware/compiler support for parallelizing execution of security monitors with the mainline application • consider type-system support for making security monitors compose with one another; implement it in the context of Polymer

19. Other Project Topics • Verifying availability properties • recently, researchers have a great progress verifying cryptographic protocols and establishing authenticity & secrecy properties • Multi-set writing protocols (Cervesato et al.) • Types for protocols (Gordon & Jeffrey) • can we do the same for availability properties and developing robust distributed algorithms? • eg: can we developed techniques for verifying consensus and other group communication protocols? Under what failure models?

20. Other Project Topics • Study the effectiveness of security analysis tools • How do we evaluate security analysis tools to determine how effective they are? • What properties should they have? • What metrics can we use to analyze tools? • Can we develop a benchmark for testing these tools? • Take two or more existing tools and analyze them.

21. Extend a programming language • Polymer is a compiler framework for extending Java • add some form of program monitors based on automata • add Cryptic-like support to Java for verifying cryptographic protocols • Binder is a logic-programming language with built-in secuiry • implement a linear-logic programming version of binder

22. Other Project Topics • information flow • consider tracking information flow in a unique programming model • tuple space model • distributed logic programming model • typed assembly language

23. Other Project Topics • Survey paper option • choose a relatively broad area and do an in-depth analysis of the research in the area • come up with a creative way to classify the work in the area • summarize the major contributions • determine the most important avenues for future research • focus on producing a particularly well-written report by working on multiple drafts • eg: software program monitors; hardware support for security; security in distributed programming models

24. Other Project Topics • Come up with a own topic related to your own research • Good topics may bridge gaps between areas • Networking & distributed programming • Algorithms for reliable computing and cryptography & languages to support their implementation or verification • Architecture or compilers to improve performance of security mechanisms

25. Your Job • In the next two weeks, figure out who you want to work with and what general topic you want to work on • work with someone who has the same level of commitment to the course • cross-area partnerships can be a great idea (eg: PL person with a systems person or algorithms person) • visit the course web page for ideas; talk with your friends or other people in the department; skim a couple of papers • meet with me 22-24th of September • set up an appointment by e-mail