1 / 57

Cyber Security Research at AUB

Imad H. Elhajj American University of Beirut Electrical and Computer Engineering ie05@aub.edu.lb ITU-T Study Group 17 February 2012. Cyber Security Research at AUB. Macro. Macro. Micro. Nano. Nano. Play. Offices & Lab. AUB (Founded in 1866). Electrical and Computer Engineering.

orly
Download Presentation

Cyber Security Research at AUB

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Imad H. Elhajj American University of Beirut Electrical and Computer Engineering ie05@aub.edu.lb ITU-T Study Group 17 February 2012 Cyber Security Research at AUB

  2. Macro

  3. Macro

  4. Micro

  5. Nano

  6. Nano

  7. Play Offices & Lab

  8. AUB (Founded in 1866)

  9. Electrical and Computer Engineering AUB • 7,500 students • 73-acre Campus ECE • 620 Undergraduate students • 50 Graduate students • 26 Full-time faculty members • Opportunities for graduate students and collaboration

  10. Security Group At AUB • Dr. Ayman Kayssi • Dr. Ali Chehab • Dr. Imad Elhajj • 3 PhD Students • 12 MS Students • 10Undergraduate Students

  11. Areas of Research • Wireless mobile networks • Energy aware • Internet • Industrial • Cloud • Misc: VANETs, RFID, wireless sensor networks, body sensor networks

  12. Research Relevance to ITU-T SG17 Questions

  13. Wireless Mobile Network Security

  14. Wireless Signaling: Vulnerabilities, Detection and Mitigation TELUS corporation funded research

  15. Signaling

  16. Signaling Research • Developing a detection algorithm for unusual signaling activities originating from a wireless device • Devising granular mitigation techniques • Effects of signaling on the backbone

  17. Energy Aware

  18. Security Using Mobile Devices • Security functions are energy consuming • Human perception limitations reduce security requirements • “the quick brown fox jumped over the lazy dog” requires 44 bytes of storage capacity in textual format • Same sentence requires 3000 bytes of data when it is spoken and encoded by G.729 encoder

  19. Audio Experiment

  20. G.711

  21. Internet Security

  22. IP Spoofing Detection Round Trip Time to Improve Hop Count Filtering

  23. Thwarting Cache Poisoning Attacks in DNS • Decrease the success probability of DNS spoofing and cache poisoning by preventing man-in-the-middle attacks • Provide a backward compatible and simple security solution with low computation and communication overhead • Target the different DNS query interaction models • Employ an efficient Identity-Based Encryption key management scheme that relieves the different DNS interacting entities from the burden and complexities of traditional public-key infrastructures

  24. Secure Delay-Tolerant Communications in the Presence of Oppressive Governments • Develop a secure delay-tolerant network system • Enable citizens to communicate freely in an environment where public communication methods, are intercepted and used by the authorities to monitor civilian activities. • The proposed system is composed of several disconnected zones • Data marshals between private key generators and normal nodes in different zones • Uses mobile gateway nodes that carry messages between the different zones

  25. DTN Network Model

  26. Industrial Security

  27. Automation and BMS • Stuxnet • PLC and SCADA vulnerabilities • BMS vulnerabilities • Industrial IDS

  28. Security in Cloud Computing

  29. Hardware-based Security for Ensuring Data Privacy in the Cloud • A set of hardware-based security mechanisms for ensuring the privacy, integrity, and legal compliance of customer data as it is stored and processed in the cloud. • Leverage the tamper-proof capabilities of cryptographic coprocessors to establish a secure execution domain in the computing cloud that is physically and logically protected from unauthorized access. • Provide a privacy feedback protocol to inform users of the different privacy operations applied on their data and to make them aware of any data leaks or risks that may jeopardize the confidentiality of their sensitive information.

  30. PasS system and interaction model

  31. Reputation as a Service • RaaS is a secure and accountable reputation system for ranking service providers in cloud computing architectures. • Secure audit logging provides a reputation reporting system whose results and recommendations can be published as a service and verified by trusted third parties or by the cloud service providers themselves. • Ranking criteria: • Performance • Quality of service measures • Security • Pricing • RaaS provides verifiable and accountable compliance with service-level agreements and regulatory policies • RaaSis implemented in a real cloud computing architecture using the VMware vSphere 4 cloud operating system. • Imposes minimal overhead on the overall system performance

  32. The Bulk Data Fetch Protocol

  33. SNUAGE • Platform-as-a-service security framework for building secure and scalable multi-layered services based on the cloud computing model. • SNUAGE ensures the authenticity, integrity, and confidentiality of data communication over the network links by creating a set of security associations between the data-bound components on the presentation layer and their respective data sources on the data persistence layer. • Implementation using Java and deployed and tested in a real cloud computing infrastructure using the Google App Engine service platform.

  34. BGP-Inspired Autonomic Service Routing for the Cloud • ServBGP: a service routing protocol for managing service collaboration among cloud providers in cloud computing. • Based on the policy-driven design of the well-known BGP Internet routing • Autonomously manage the different aspects of service interaction and collaboration among service providers from service discovery and advertisement to service consumption and revocation. • ServBGP routing decision engine is planned to operate by processing cost-bidding and QoS advertisement messages from the different cloud providers. • Implemented on Google, Amazon, and Microsoft clouds

  35. ServBGP System Architecture

  36. Mobile Cloud Computing • Set of policy-driven security protocols for ensuring the confidentiality and integrity of enterprise data in mobile cloud computing environments. • Offloading the intensive asymmetric key agreement mechanisms from the mobile • Designing a customizable policy-based security architecture that considers the sensitivity of cloud data to provide multi-level and fine-grained data protection methodologies that suit the energy-limited mobile devices and the low-bandwidth wireless networks characterizing current mobile cloud computing models. • The system is implemented in a real cloud computing environment and the savings in terms of energy consumption and execution time are analyzed.

  37. VANETs, RFID, wireless sensor networks, body sensor networks

  38. Keyless Authentication of Position and Velocity for VANETs

  39. A Privacy-Preserving Trust Model for VANETs • A trust-based privacy-preserving model for VANETs. • The model is unique in its ability to protect privacy while maintaining accurate reputation-based trust. • We use the notion of groups in order to make the VANET users anonymous within their groups and yet identifiable and accountable to their group managers. • The use of groups simplifies the task of building reputation and calculating trust in the received messages in order to provide better and more confident decisions. • Simulations verify correctness and reliability

  40. A PUF-Based Ultra-Lightweight Mutual-Authentication RFID Protocol • A novel approach to achieve mutual authentication for ultra-lightweight tags is proposed using Physically Unclonable Functions (PUFs). • Provide robust security properties as well as good performance for limited tags

  41. TRACE: A Centralized Trust and Competence-Based Energy-Efficient Routing Scheme for Wireless Sensor Networks • Protect wireless sensor networks from various attacks and misbehaving nodes. • TRACE identifies different types of bad nodes that can affect the correct routing operation and the reliability of the message delivery to the sink base station. • Sink BS processes and validates the information received from the sensor nodes and calculates the maliciousness, competence, and cooperation levels of each node. • The sink BS calculates trust values for each. • TRACE accounts for the energy requirements of the severely-constrained network nodes by detecting and isolating the bad nodes while eliminating the power-consuming reputation inquiries and computations required by each node in a distributed approach.

  42. A Decentralized Energy-Aware Key Management Scheme for Wireless Sensor Networks • WSN nodes are limited in terms of processing capabilities and battery life. • Encryption is usually avoided and the readings are sent in the clear. • Lightweight encryption techniques are proposed to overcome the limitations of sensor nodes. • Identity-based encryption (IBE) that uses elliptic curve cryptography (ECC) seems to be very promising in terms of energy efficiency. • We propose a novel decentralized IBE-based key management scheme that reduces the energy by using multiple base stations. • The keys are pre-distributed in the WSN and refreshed at specific time intervals. • The system ensures confidentiality of the messages and the availability of WSN service even when multiple nodes and base stations are compromised, at a significant reduction in overall system energy.

  43. Security and Privacy in Body Sensor Networks • Study two main challenges in the body sensor network security and privacy context • Achieving the correct balance between the complexity of the protocol security operations employed and the energy consumption they incur • Attaining the right tradeoff between privacy and safety by utilizing the patient’s vital signals and other context-related information to minimize the amount of private data released • We present a blueprint body sensor network security framework

  44. Typical Body Sensor Network Architecture

  45. Courses

  46. Graduate Courses Offered • Cryptography and Computer Security • Internet Security • Wireless Security • Information Security Management • Network and Computer Security Laboratory

  47. Laboratory Description This laboratory addresses advanced network and computer security topics. Experiments include the execution of attacks, the setup of intrusion detection and prevention, securing computers and wired and wireless networks, and digital forensics.

  48. Topics Covered • Section 1 — Networking Basics - How do networks work? • Lab 1: Security Lab Setup and Networking Basics • Section 2 — Vulnerabilities and Threats - How can networks be compromised? • Lab 2: Scanning and Enumerating the Network for Targets and Address Spoofing • Lab 3: Denial of Service Attacks and Network Applications Exploits • Lab 4: Malware Analysis and Botnets • Lab 5: Escalating Privilege – Sniffing, Keylogging, Password Cracking and Man in the Middle Attacks • Lab 6: Security in Wireless Systems • Section 3 — Prevention - How do we prevent harm to the networks? • Lab 7: Firewalls • Lab 8: Hardening the Host Computer and Securing Network Communications • Section 4 — Detection and Response – How do we detect and respond to attacks? • Lab 9: Preparing for and Detecting Attacks • Lab 10: Identify and Mitigate Network Attacks • Lab 11: Digital Forensics

  49. Lab Overall Diagram

  50. Lab Group Diagram

More Related