Scientific Foundations

group_project

Visible to the public TWC: Medium: Collaborative: Exposing and Mitigating Cross-Channel Attacks that Exploit the Convergence of Telephony and the Internet

Submitted by Mustaque Ahamad on Mon, 10/09/2017 - 5:09pm

Rapid advances in technology now enable simultaneous access to both telephony and Internet services from smart phone devices that people carry with them at all times. Although this convergence of telephony with the Internet offers many benefits, it also provides cyber criminals the ability to develop increasingly sophisticated attacks that combine resources from both the telephony and Internet channels.

group_project

Visible to the public CAREER: Exo-Core: An Architecture to Detect Malware as Computational Anomalies

Submitted by tiwari on Mon, 10/09/2017 - 4:36pm

Applications that run on billions of mobile devices backed by enormous datacenters hold the promise of personal, always-on healthcare; of intelligent vehicles and homes; and thus of a healthier, more efficient society. It is imperative to make such applications secure by protecting their integrity and keeping their data confidential. However, malicious programs (``malware'') today can subvert the best software-level defenses by impersonating benign processes on mobile devices or by attacking victim processes through the hardware on shared datacenter servers.

group_project

Visible to the public TWC: Small: Understanding Network Level Malicious Activities: Classification, Community Detection and Inference of Security Interdependence

Submitted by Mingyan Liu on Mon, 10/09/2017 - 4:20pm

This goal of this project is development of a formal method to quantitatively assess the security posture of large networks and assign them a numeric score. Large networks are made up of a collection of individual machines, which exhibit more stable behavior and features as a group than at the IP level, where each host is inspected separately. Networks at an aggregate level thus carry more predictive power, enabling a more robust and accurate policy design.

group_project

Visible to the public TWC: Small: Subversion-Resistant Cryptography

Submitted by Mihir Bellare on Mon, 10/09/2017 - 4:12pm

This work aims to effectively address security concerns while maintaining the privacy of individuals and corporations. The project analyzes subversive attacks, develops defenses and deterrents, creates privacy tools and software, and increases awareness and expertise through teaching, mentoring and involvement of students in research.

group_project

Visible to the public CRII: SaTC: Empirical and Analytical Models for the Deployment of Software Updates in Large Vulnerable Populations

Submitted by tdumitra on Mon, 10/09/2017 - 2:13pm

Software vulnerabilities are an important vector for malware delivery. The software updating mechanisms, responsible for deploying the vulnerability patches, are in a race with the cyber attackers seeking to exploit the vulnerabilities. Moreover, these updating mechanisms have multiple, potentially conflicting, design goals, as they must quickly deploy patches on millions of hosts worldwide, must not overburden the users, and must avoid breaking dependencies in the deployment environment.

group_project

Visible to the public CRII: SaTC: Analyzing and verifying the security of TCP stacks under multi-entity interactions

Submitted by Zhiyun Qian on Mon, 10/09/2017 - 2:10pm

The objective of this project is to strengthen the Transmission Control Protocol (TCP), a ubiquitous core Internet protocol, under emerging threat models to make it robust and secure enough to serve the needs of 'smart' technologies in communications, automobiles, medical devices, and other devices that touch our lives every day. It is terrifying to imagine that a smart car could fail to report an accident automatically due to a denial of service attack on its TCP connections, or a smart medical device could fail to report a patient's change in condition.

group_project

Visible to the public TWC: Medium: Scaling proof-based verifiable computation

Submitted by Michael Walfish on Mon, 10/09/2017 - 1:15pm

This research addresses a fundamental problem in systems security: how can a machine specify a computation to another one and then, without executing the computation, check that the other machine carried it out correctly? Over the last several years, a new approach to this problem has emerged, based on refining cryptographic and theoretical tools, and incorporating them into built systems. However, despite exciting advances, the resulting systems are still not practical in the normal sense.

group_project

Visible to the public CAREER: Getting the Most out of Secure Multi-Party Computation

Submitted by Michael Rosulek on Mon, 10/09/2017 - 12:42pm

Our society is becoming increasingly reliant on powerful and interconnected computing devices that store much of our personal information. These devices present an ever-growing tension between the desire for our personal information to be private, and the desire to put our personal information to good use for our own convenience. In cryptography, problems that involve requirements of useful computation and privacy are understood through the lens of secure multi-party computation (SMPC).

Outcomes Report URL: 
https://www.research.gov/research-portal/appmanager/base/desktop?_nfpb=true&_win...
group_project

Visible to the public TWC: Frontier: Collaborative: Rethinking Security in the Era of Cloud Computing

Submitted by reiter on Mon, 10/09/2017 - 12:29pm

There are at least two key features of the move to cloud computing that introduce the opportunity for significant leaps forward in computer security for tenant services. First, a compute cloud provides a common software, hardware and management basis for rolling out cross-cutting services en masse that have resisted incremental deployment in a one-service-at-a-time fashion. Second, compute clouds offer providers a broad view of activity across an unprecedented diversity of tenant services.

group_project

Visible to the public SaTC: STARSS: Hardware Authentication through High-Capacity PUF-Based Secret Key Generation and Lattice Coding

Submitted by Michael Orshansky on Mon, 10/09/2017 - 12:25pm

Hardware authentication is one of the critical needs in the emerging discipline of design for assurance and design for security. It is concerned with establishing the authenticity and provenance of Integrated Circuits (ICs) reliably and inexpensively at any point in a chip's life-time. Physical unclonable functions (PUFs) have significant promise as basic primitives for authentication since they can serve as intrinsically-generated hardware roots-of-trust within specific authentication protocols.