TRUST:Team for Research in Ubiquitous Secure Technologies Overview - PowerPoint PPT Presentation

Loading...

PPT – TRUST:Team for Research in Ubiquitous Secure Technologies Overview PowerPoint presentation | free to download - id: 7b220f-OTYxY



Loading


The Adobe Flash plugin is needed to view this content

Get the plugin now

View by Category
About This Presentation
Title:

TRUST:Team for Research in Ubiquitous Secure Technologies Overview

Description:

TRUST:Team for Research in Ubiquitous Secure Technologies Overview Shankar Sastry, PI and Dir. Ruzena Bajcsy, Outreach Dir. Sigurd Meldal, Education Co-Dir. – PowerPoint PPT presentation

Number of Views:32
Avg rating:3.0/5.0
Slides: 33
Provided by: sast2
Category:

less

Write a Comment
User Comments (0)
Transcript and Presenter's Notes

Title: TRUST:Team for Research in Ubiquitous Secure Technologies Overview


1
TRUSTTeam for Research in Ubiquitous Secure
TechnologiesOverview
  • Shankar Sastry, PI and Dir.
  • Ruzena Bajcsy, Outreach Dir.
  • Sigurd Meldal, Education Co-Dir.
  • John Mitchell, co-PI
  • Vijay Raghavan, Exec Dir
  • Mike Reiter, co-PI
  • Fred Schneider, Chief Sci.
  • Janos Sztipanovits, co-PI and Education Co-Dir
  • Steve Wicker, co-PI

2
Technology Generations of Information Assurance
1st Generation (Prevent Intrusions)
3
TRUST worthy Systems
  • More than an Information Technology issue
  • Complicated interdependencies and composition
    issues
  • Spans security, systems, and social, legal and
    economic sciences
  • Cyber security for computer networks
  • Critical infrastructure protection
  • Economic policy, privacy
  • TRUST holistic interdisciplinary systems view
    of security, software technology, analysis of
    complex interacting systems, economic, legal, and
    public policy issues
  • Trustworthiness problems invariably involve
    solutions with both technical and policy
    dimensions (theme of Schneiders talk)
  • Goals
  • Composition and computer security for component
    technologies
  • Integrate and evaluate on testbeds
  • Address societal objectives for stakeholders in
    real systems

4
Integrative Project Identity Theft
  • Faking
  • An e-mail that seems to be from a legitimate
    source
  • Spoofing
  • A Web site that appears to be official
  • Phishing
  • Luring users to provide sensitive data

From Aucsmith, Microsoft
5
PHISHING Impact Stats
  • Most people are spoofed
  • Over 60 have visited a fake or spoofed site
  • People are tricked
  • Over 15 admit to having provided personal data
  • 2780 phishing websites in March 2005 alone
  • Target for spoofing attacks
  • Banks, credit card companies, Web retailers,
    online auctions (E-bay) and mortgage companies.
  • Economic loss
  • 1.2 million U.S. adults have lost money
  • The total dollar impact in first 6 months of
    2005 929 million, in all of 2003 1.2B.

Source TRUSTe Gartner
6
SPYWARE Impact Stats
  • Software that
  • Collects personal information from you
  • Without your knowledge or permission
  • Privacy
  • 15 percent of enterprise PCs have a keylogger
  • Source Webroot's SpyAudit
  • Number of keyloggers jumped three-fold in 12
    months
  • Source Sophos
  • Reliability
  • Microsoft Watson
  • 50 of crashes caused by spyware
  • Support Costs
  • Dell, HP, IBM Spyware causes 30 of calls
  • Estimated support costs at 2.5m / year

7
ID Protection Client Side Tools
  • SpoofGuard Stanford (NDSS 04)
  • Alerts user when browser is viewing a spoofed web
    page.
  • Uses variety of heuristics to identify spoof
    pages.
  • A new type of anomaly detection problem.
  • Dynamic Security Skins Berkeley (SOUPS 05)
  • Allows a remote web server to prove its identity
    in a way that is easy for human to verify and
    hard for attacker to spoof uses a photograph to
    create trusted path
  • PwdHash Stanford (Usenix Sec 05)
  • Simple mechanism for strengthening password web
    auth.
  • SpyBlock Stanford (under development)
  • Prevent Spyware from capturing sensitive data.

8
Tech Transfer from Phishing Work
  • SpoofGuard
  • Some SpoofGuard heuristics now used in eBay
    toolbar and Earthlink ScamBlocker.
  • Very effective against basic phishing attacks.
  • PwdHash
  • Collaboration with RSA Security to implement
    PwdHash on one-time RSA SecurID passwords.
  • RSA SecurID passwords vulnerable to online
    phishing
  • PwdHash helps strengthen SecurID passwords

9
Coordinated Research Agenda
  • The TRUST center will develop and demonstrate
    science and technology in real-life testbeds.
  • NSF core funding over 5 years plus option 5 years
  • Possible support from US Air Force for IAS for
    GIG
  • Network of partnerships with industry,
    infrastructure stakeholders
  • NSF/US State Department would like to make
    partnerships with key international partners
  • Coordinated research eleven challenge areas
    across three key topics
  • Security Science
  • Systems Science
  • Social Science

10
TRUST Structure
Societal Challenges
Privacy
Critical
Computer and
Infrastructure
Network Security
  • Role
  • Connect societal challenges to technical
    agenda
  • Integrate component technologies
  • Measure progress in real-life context

Integrative
Testbeds -
Network Security
Testbed
Secure Networked
Power Grid
Embedded Systems
Testbed
Testbed
Technologies
System Science
Security Science
Social Science
Secure Info Mgt. Software Tools
Objective Information Assurance in a Systems
Context
11
Security Science (1)
  • Software Security (language based)
  • Static Code Verification
  • Dynamic Analysis
  • Multi-lingual Security
  • Software Design Trusted Platforms
  • Composition
  • Security and Vulnerability
  • Minimal Software and Hardware Configurations
  • Applied Cryptographic Protocols
  • Protocol design methods
  • Protocol analysis, testing, and verification

12
Security Science (2)
  • Network Security
  • Focused on making the Internet more secure
  • Challenges
  • Denial of service attacks
  • Spoofed source addresses
  • Routing security
  • Approaches
  • Structured overlay networks
  • Better infrastructure
  • Epidemic protocols
  • Simulation and Emulation on DETER testbed

13
Cyber Defense Technology and Experimental Reseach
Network DETER
  • Inadequate wide scale deployment of security
    technologies
  • Lack of experimental infrastructure
  • Testing and validation in small to medium-scale
    private research labs
  • Missing objective test data, traffic and metrics
  • Create reusable library of test technology for
    conducting realistic, rigorous, reproducible,
    impartial tests
  • For assessing attack impact and defense
    effectiveness
  • Test data, test configurations, analysis
    software, and experiment automation tools

14
Sample DETER Topologies
15
System Science (1)
  • Complex Interdependency Modeling and Analysis
  • Four-fold approach to reducing vulnerability of
    interdependent systems to disruptive failure
  • Modeling Strategies
  • Analysis Techniques
  • Design Technologies
  • Operational Tools
  • Secure Network Embedded Systems
  • Present unique security concerns
  • Conventional end-to-end approaches break down
  • New code must be propagated throughout the
    network
  • Focus areas
  • Automated design, verification, and validation
  • Secure, composable, and adaptive software
  • Emphasis on sensor networking technology as
    high-impact application

16
Mote Evolution
17
Secure Network Embedded System Testbed (577
nodes) at Berkeley
  • Software
  • TinyOS
  • Deluge
  • Network reprogramming
  • Drip and Drain (Routing Layer)
  • Drip disseminate commands
  • Drain collect data
  • DetectionEvent
  • Multi-moded event generator
  • Multi-sensor fusion and multiple-target tracking
    algorithms
  • Other testbeds at Cornell, Vanderbilt (Wickers
    talk)

18
System Science (2)
  • Model-Based Integration of Trusted Platforms
  • Supports system integration through embedded
    software
  • Model-based design
  • Model transformation technology
  • QoS-enabled component middle-wareSecure
    Information Management Software
  • Emphasis on new software tools for monitoring and
    controlling large sensor infrastructures
  • Combines peer-to-peer protocols with epidemic
    algorithms
  • Highly scalable
  • Rigorous semantics
  • User-friendly APIs

19
Sample ApplicationThe proposed DoD NCES/GIG
architecture
  • Basis is Web Services standard, although CORBA is
    likely to be used on server clusters
  • Primary application platform will be Microsoft
    Windows
  • NSA and DISA are playing key roles in mapping
    these components to military needs

20
Social Science
  • Economics, Public Policy and Societal Challenges
  • From privacy to personal security
  • Liability and insurance are critical concerns
  • What are the benefits and costs of security
    policies?
  • What are the nature and size of transaction costs
    associated with security?
  • Digital Forensics and Privacy
  • Privacy cuts across the trust/security issues
    that are the focus of TRUST
  • Common interfaces are needed for specifying
    privacy requirements
  • Emphasis on strong audit, selective revelation of
    information, and rule-processing technologies
  • Human Computer Interfaces and Security
  • Security problems may arise through the
    mis-configuration of complex systems
  • Generally, humans lack many computational
    abilities that are conducive to securing networks
    and systems
  • Strengthening standard passwords
  • Using biometric information
  • Using image recognition

21
Healthcare Information Technology
  • Rise in mature population
  • Population of age 65 and older with
  • Medicare was 35 million for 2003 and
  • 35.4 million for 2004
  • New types of technology
  • Sensors for elderly assisted living
  • Increased demand for health data
  • Health information technology
  • Commercial use of health data
  • Current Responses for Technology
  • Assisting Healthcare
  • Electronic Patient Records
  • Telemedicine
  • Remote Patient Monitoring

22
Patient Portal Project
  • Vanderbilt Patient Portal
  • Electronic healthcare records
  • Include real-time monitoring of congestive heart
    failure patients
  • Heterogeneous sensor network for monitoring
  • Data integrated into MyHealth_at_Vanderbilt patient
    portal
  • Berkeley ITALH Testbed seniors in Sonoma
  • Stationary sensors Motion detectors, Camera
    systems
  • Wearable sensor Fall sensors, Heart rate or
    pulse monitors

23
LARGE INTEGRATIVE PROJECTS
  • My Health Portals for Electronic Patient Records
    Vanderbilt, Berkeley, Cornell (Sztipanovits
    talk)
  • Phishing, Spyware, Identity Theft Stanford,
    Berkeley (Mitchells talk)
  • Secure Sensor Networks Berkeley, CMU, Cornell,
    Vanderbilt (Wickers talk)
  • DoD GIG IAS Cornell, Vanderbilt, Berkeley
    (Birmans talk)
  • Cybersecurity Educational Modules SJSU,
    Vanderbilt, Stanford (Meldals talk)

24
Healthcare Information Access Privacy and
Security Everywhere
25
Sensor Networks in Public Places
  • Protecting Infrastructure
  • Opportunities for embedding sensor networks
  • Transportation
  • Water and Fuel
  • Power Grid
  • TRUST is emphasizing development of supporting
    technology for randomly distributed sensors
  • Buildings
  • Combine surveillance with energy control
  • Integrate into building materials
  • Open Spaces (parks, plazas, etc.)
  • Combine surveillance with environmental
    monitoring
  • Line-of-sight surveillance technologies

26
EDUCATIONAL INITIATIVES
  • Meldal, Sztipanovits and Bajcsy will speak in
    detail about the repositories, course work
    development, summer school and other educational
    initiatives under way
  • Policy, Technology, Psychological Motivations of
    Terrorism Maurer (Berkeley), Lazowska
    (Washington), Savage (UCSD) and Microsoft, Fall
    05 http//www.cs.washington.edu/education/courses/
    csep590/05au/lectures/
  • Lampson, Accountability and Freedom
  • Varian Economics and Computer Security
  • Maurer The Third Wave of Terrorism
  • Aucsmith Crime on the Internet
  • Samuelson, Mulligan, Wicker, and Goldberg Video
    Privacy in Public Places?
  • Capacity Building program for HBCU, HIS Reiter
  • TRUST Summer School (TSS) in June 2006

27
Outreach Initiatives
  • BFOIT - Berkeley Foundation for Opportunities in
    Information Technologyhttp//www.bfoit.org/
  • SUPERB-IT - Summer Undergraduate Program in
    Engineering Research at Berkeley - Information
    Technologyhttp//www.eecs.berkeley.edu/Programs/u
    grad/superb/superb.html
  • SIPHER - Summer Internship Program in Hybrid and
    Embedded Software Researchhttp//fountain.isis.va
    nderbilt.edu/fountain/Teaching/
  • Pennsylvania Area HBCU Outreach - Historically
    Black Colleges and Universitieshttp//is.hss.cmu.
    edu/summer.html
  • Womens Institute in Summer Enrichment (WISE) to
    be kicked off in July 2006

28
SUMMARY
  • TRUST has been successfully launched research,
    education, outreach programs under way
  • Hallmark of TRUST Grand Challenge Projects
  • Large Integrative Projects
  • Identity Theft
  • Secure Network Embedded Systems
  • Secure Electronic Patient Records Portal
  • DoD Global Information Grid Security
  • Education Large Projects
  • Repositories Evaluation using Learning Theory
  • Modules for existing courses
  • TRUST Summer School
  • Outreach Comprehensive
  • BFOIT, SUPERB, SIPHER
  • Capacity Building Program for HBCU/HSI
  • WISE outreach to women researchers

29
BACKUPS
30
Project Structure
Systems Science Teams
Social Science Teams
Security Technology Teams
Integrative Projects
Education Program
System/Sec CoDesign BoeingRaytheon
Software Security
Complex Interdependency Modeling and Analysis
Economics, Public Policy and Societal Challenges
Summer School
Trusted Platforms
Sensor Networks ORNL
Curriculum
Secure Network Embedded Systems
Digital Forensics and Privacy
Applied Cryptographic Protocols
Patient Portals VUMC
Learning Science Technology Insertion
Human Computer Interfaces and Security
Model-based Integration of Trusted Components
Network Security
Repository
Secure Information Management Software
31
Example Experiment Bandwidth-limited Scanning
Worm Experiment
  • ICSI and PSU characterization, modeling and
    scale-down simulation of Slammer SQL worms
    propagation through the Internet ICSIPSU
    WORM04 paper.
  • Development of virtual nodes that model the
    response of sub-networks or whole Internet to a
    worm attack for the purposes of scale-down
    1/64th scale Internet
  • Near term activity
  • Other worm attack recreations in the near term
  • Collaborative defenses under test
  • Large-scale enterprise network simulation

32
NEST Final Experiment Demo
33
Overview of Agenda
  • Schneider Technology Policy
  • Sztipanovits Patient Medical Records Portals
  • Wicker Secure Sensor Networks and Network
    Embedded Systems
  • Mitchell PwdHash, Spoofguard, Spyware, Botnets
  • Birman Global Information Grid
  • POSTERS with 3 minute introductions
  • Meldal, Sztipanovits and Bajcsy, Education and
    Outreach Activities
  • Tygar, Technology Transition Strategy
About PowerShow.com