Authentication

The computer security community has long advocated the concept of building multiple layers of defense to protect a system. Unfortunately, it has been difficult to realize this vision in the practice of software development, and software often ships with inadequate defenses, typically developed in an ad hoc fashion.

Modern web and mobile applications increasingly rely on code and services from multiple parties, including services that provide security-critical functions like authentication, payments, and sharing. Developers often make mistakes in integrating these services into their applications that lead to serious security vulnerabilities. These integration failures are mainly due to failures to understand and ensure assumptions necessary for secure use of the external service.

Emerging intelligent automobiles will be able to harness advance on-car sensors to support new applications such as pollution detection, road condition monitoring, and traffic control. All these applications require the ability to verify both the location and the time of a reading. This project involves the design of verification methods that make use of environment factors, such as the presence of light and shadows and the measured wireless signal strength, instead of conventional public key infrastructure-based methods, in order to verify when and where data was collected.

Validating a user's identity is one of the fundamental security requirements in cyberspace. Current authentication approaches require people to create and remember secret credentials such as complex passwords, or to possess special hardware authentication tokens. Both are vulnerable to being compromised, or illegally shared. Even worse, authentication is typically supported solely at the start of a session.

Recent work has established the possibility of deriving auxiliary information from biometric data. For example, it has been shown that face images can be used to deduce the health, gender, age and race of a subject; further, face images have been used to link a pseudonymous profile in the Web with a true profile, thereby compromising the privacy of an individual. The objective of this work is to design and implement techniques for imparting privacy to biometric data such as face, fingerprint and iris images.