1. 余乐 <lewisyu24@gmail.com>
Network Security
Dr. Haojin Zhu
TA: Le Yu 余乐

2. About Instructor
Dr. Haojin Zhu, Associate Professor of Computer Science and Engineering Department
Office: SEIEE 3-509
Office hours:
by appointment

3. Course Objectives
Learn some fundamental and advanced issues, concepts, principles, and mechanisms in network security
Learn recent research advances in network security
Prepare for graduate research in network security

4. Text One referred textbook (not required)
Charles P. Pfleeger and Shari Lawrence Pfleeger, Security in Computing, 4th edition, Prentice-Hall, 2007, ISBN  
Research papers listed on the course website

5. Grading • Attendance (20%) In-class paper presentation (40%)
• Course research project (5~6 persons a group) (40%)
A survey on a topic (normally related to your presentation) (30%)
1~2 pages on your findings from this survey (10%)
Improvement of existing works (protocol/algorithm design)
Or System Implementation with a better performance

6. Grading (Cont’d)
The final grades are computed according to the following criteria:
In-class paper presentation: your score is determined by peer-evaluation (will be discussed later)
Survey (please indicate each person’s contribution in the survey paper)
Research findings (evaluation based on your novelty, and contribution)

7. Course Outline Topic 1: Network Security Basics
Topic 2: Link Layer security
Topic 3: Network Layer Security
Topic 4: Transport-layer security and privacy
Topic 5: Application-layer security and privacy
basic concepts of network security, network security primitives, authentication techniques, security and privacy issues in modern wireless systems, and vulnerability analysis of electric power grids.

8. Course Outline Topic 5: Emerging research topics Present later
basic concepts of network security, network security primitives, authentication techniques, security and privacy issues in modern wireless systems, and vulnerability analysis of electric power grids.

9. Research Paper Small team -- at most 6 students per group
Important Dates
Team Proposal due: May 11 (The first will have the priority)
Presentation Schedule fixed: May 11 (3rd week)
First Presentation: May 25 (5th week)
Report submission due: one week after last week’s class
The instructor will be available to discuss your topic via or face-to-face discussion (by appointment)
You should start thinking about team and topic now
How to select topic: introduce later

10. Paper Presentation
Each group presents 3 papers depending on the technical difficulty of the presented papers (two persons on a paper).
We have 6 papers to discuss.

11. Presenter’s Preparation
Please prepare your presentation slides.
You have minutes for your presentation. Please expect questions after one person’s presentation. Your presentation will be graded based on the criteria in the grading form, which can be downloaded from our course website.

12. Peer Evaluation Your participation in grading is required.
Your presentation score will be determined by the evaluations from the instructor (50%), the peer evaluation from the audience (50%)
Your participation in grading other students' presentations (Attendance 20%).
Please print the evaluation form and hand in the form after the class. All your evaluations will be kept as confidential.

13. Peer Evaluation (Cont’d)
The highest and lowest peer evaluation scores will be deleted and the average of the remaining scores will be used as your final peer evaluation score.
For example, if your peer evaluation scores from audience are 100, 99, 15, 87, 85, 77, 90. The highest score 100 is discarded and the lowest score 15 is also discarded. Your peer evaluation final score is the average of the remaining scores, which is 87.6
If you have multiple identical highest/lowest scores, only one will be deleted.

14. Security Conferences 1st tier (Big 4)
IEEE S&P(Oakland), ACM CCS, USENIX Security, NDSS
2nd tier
ACSAC, ESORICS, WiSec, AsiaCCS, CT-RSA, and etc

15. Cryto Conferences 1st Tier Crypto, EUROCRYPT 2nd Tier
ASIACRYPT, PKC, TCC, Financial Crypto and etc

16. Networking Conferences
1st Tier
SIGCOMM, MOBICOM
2nd Tier
INFOCOM, Mobihoc, SIGMETRICS, CONEXT, ICNP, ICDCS and etc

17. DATABASE and Data mining
1st Tier
SIGMOD, VLDB, WWW, and etc

18. Presentation Topic 1 Electrical Cash
Nakamoto, Satoshi. Bitcoin: A Peer-to-Peer Electronic Cash System. 24 May 2009
Two Bitcoins at the Price of One? Double-Spending Attacks on Fast Payments in Bitcoin, ACM CCS 2012.
PermaCoin: Repurposing Bitcoin Work for Data Preservation, Oadland’ 2014
Ian Miers, Christina Garman, Matthew Green, and Aviel D. Rubin, "Zerocoin: Anonymous Distributed E-Cash from Bitcoin", S&P 2013.

19. Presentation Topic 2 Smart Phone Security
Adrienne Porter Felt, Erika Chin, Android permissions demystified, Steve Hanna, Dawn Song, David Wagner. CCS 2011.
X. Zhou, S. Demetriou, D. He, N. Muhammad, X. Pan, X. Wang, C. Gunter and K. Nahrstedt, “Identity, Location, Disease and More: Inferring Your Secrets from Android Public Resources”. ACM CCS'13.
Eric Chen, Yutong Pei, Shuo Chen, Yuan Tian, Robert Kotcher and Patrick Tague, OAuth Demystified for Mobile Application Developers, CCS'14.
Tracking Mobile Web Users Through Motion Sensors:  Attacks and Defenses, NDSS’16
Life after App Uninstallation:  Are the Data Still Alive?  Data Residue Attacks on Android, NDSS’16

20. Presentation Topic 3 Location Privacy
Y.-A. de Montjoye, C. A. Hidalgo, M. Verleysen, and V. D. Blondel, “Unique in the crowd: The privacy bounds of human mobility,” Scientific reports, vol. 3, 2013.
All Your Location are Belong to Us: Breaking Mobile Social Networks for Automated User Location Tracking, ACM MobiHoc'14, 2014.
Kassem Fawaz and Kang Shin, "Location Privacy Protection for Smartphone Users", CCS 2014.
Inferring User Routes and Locations using Zero-Permission Mobile Sensors Sashank Narain, Triet Vo Huu, Kenneth Block, and Guevara Noubir (Northeastern University), IEEE S&P’16.
Where's Wally? Precise User Discovery Attacks in Location Proximity Services, ACM CCS’15

21. Presentation Topic 4 Anonymous and Pseudonymous Communication
Anonymous and Pseudonymous Communication, Untraceable electronic mail, return addresses, and digital pseudonyms, David Chaum, Communications of the ACM, 1981
Rob Jansen, Florian Tschorsch, Aaron Johnson, Bjorn Scheuermann, "The Sniper Attack: Anonymously Deanonymizing and Disabling the Tor Network", NDSS 2014.
CacheBrowser: Bypassing Chinese Censorship without Proxies Using Cached Content, ACM CCS’15

22. Presentation Topic 5 Social Network Security
Iasonas Polakis, Panagiotis Ilia, Federico Maggi, Marco Lancini, Georgios Kontaxis, Stefano Zanero, Sotiris Ioannidis and Angelos Keromytis, "Face in the Distorting Mirror: Revisiting Photo-based Social Authentication", CCS 2014.
Shirin Nilizadeh, Apu Kapadia and Yong-Yeol Ahn, Community-Enhanced De-anonymization of Online Social Networks, CCS'14.
Panagiotis Ilia and etc, Face/Off: Preventing Privacy Leakage From Photos in Social Networks, CCS’15

23. Presentation Topic 6 Mobile Advertisement Security
Alexey Reznichenko and Paul Francis, Private-by-Design Advertising Meets the Real World, CCS'14.
Are these Ads Safe:  Detecting Hidden Attacks through the Mobile App-Web Interfaces, NDSS 2016
The Price of Free:  Privacy Leakage in Personalized Mobile In-Apps Ads, NDSS’16
What Mobile Ads Know About Mobile Users, NDSS’16

24. Presentation Topic 7 Cloud Security
CryptDB: Protecting Confidentiality with Encrypted Query Processing. In Proceedings of the 23rd ACM Symposium on Operating Systems Principles (SOSP), 2011.
Düppel: Retrofitting Commodity Operating Systems to Mitigate Cache Side Channels in the Cloud, ACM CCS’13.
Resource-Freeing Attacks: Improve Your Cloud Performance (at Your Neighbor's Expense) ACM, CCS’12.
Hourglass Schemes: How to Prove that Cloud Files Are Encrypted. ACM CCS’12.
Erman Pattuk, Murat Kantarcioglu, Zhiqiang Lin, and Huseyin Ulusoy, "Preventing Cryptographic Key Leakage in Cloud Virtual Machines", USINEX Security 2014.

25. Presentation Topic 8 TLS/SSL security
Analyzing Forged SSL Certificates in the Wild , IEEE S&P 2014 Lin-Shung Huang (Carnegie Mellon University), Alex Rice and Erling Ellingsen (Facebook), and Collin Jackson (Carnegie Mellon University)
Triple Handshakes and Cookie Cutters: Breaking and Fixing Authentication over TLS  Karthikeyan Bhargavan and Antoine Delignat-Lavaud (INRIA Paris-Rocquencourt), Cédric Fournet (Microsoft Research), Alfredo Pironti (INRIA Paris-Rocquencourt), and Pierre-Yves Strub (IMDEA Software Institute)
Using Frankencerts for Automated Adversarial Testing of Certificate Validation in SSL/TLS Implementations  Chad Brubaker and Suman Jana (University of Texas at Austin), Baishakhi Ray (University Of California Davis), and Sarfraz Khurshid and Vitaly Shmatikov (University of Texas at Austin)

26. Presentation Topic 9 4G/LTE security
Breaking and Fixing VoLTE: Exploiting Hidden Data Channels and Mis-implementations, ACM CCS’15
Insecurity of Voice Solution VoLTE in LTE Mobile Networks, ACM CCS’15
Practical Attacks Against Privacy and Availability in 4G/LTE Mobile Communication Systems, NDSS’2016

27. Presentation Topic 10 Keystroke Inference via Side Channel
P. Marquardt, A. Verma, H. Carter, and P. Traynor, “(sp)iphone: Decoding vibrations from nearby keyboards using mobile phone accelerometers,” in ACM CCS’11, Chicago, IL, Nov
“Blind recognition of touched keys on mobile devices,” in AMC CCS’14, Scottsdale, AZ, Nov. 2014
D. Shukla, R. Kumar, A. Serwadda, and V. Phoha, “Beware, your hands reveal your secrets!” in AMC CCS’14, Scottsdale, AZ, Nov
VISIBLE: Video-Assisted Keystroke Inference from Tablet Backside Motion， NDSS'16

28. How to Determine Your Presentation Paper
Form Your Group First (5-6 persons)
Send your team member names and the preferred topics to through the Wechat public account:
Scan the QR code:
Reply “网络安全基础”, you will
see detailed instructions.

29. How to Determine Your Presentation Paper Cont’
Come first, choose first (if less than 4, I will merge the groups otherwise move on to the next topic)
If no suitable topics for you, please discuss with me for an alternative choice.

30. A Brief Review of Basic Security Concepts

31. Security Objectives Secrecy (Confidentiality) Availability Integrity
(Denial of Service)
Integrity

32. Security Objectives
Secrecy — Prevent/detect/deter improper disclosure of information
Integrity — Prevent/detect/deter improper modification of information
Availability — Prevent/detect/deter improper denial of access to services provided by the system

33. Commercial Example
Secrecy — An employee should not know the salary of his manager
Integrity — An employee should not be able to modify the employee's own salary
Availability — Paychecks should be printed on time as stipulated by law
1/29/2020

34. Military Example
Secrecy — The target coordinates of a missile should not be improperly disclosed
Integrity — The target coordinates of a missile should not be improperly modified
Availability — When the proper command is issued the missile should fire
1/29/2020

35. A Fourth Objective
Securing computing resources — Prevent/detect/deter improper use of computing resources including
Hardware Resources
Software resources
Data resources
Network resources

36. Security Mechanisms In general three types Prevention Detection
Tolerance
Good prevention and detection both require good authentication as a foundation
Byzantine agreement: even if some users report bad data, the control center can still get a correct result
1/29/2020

37. Security Services
Security functions are typically made available to users as a set of security services through APIs or integrated interfaces
Confidentiality: protection of any information from being exposed to unintended entities.
Information content.
Parties involved.
how they communicate, how often, etc.
Authentication: assurance that an entity of concern or the origin of a communication is authentic - it’s what it claims to be or from
Integrity: assurance that the information has not been tampered with
1/29/2020

38. Security Services (Cont’d)
Non-repudiation: offer of evidence that a party is indeed the sender or a receiver of certain information
Access control: facilities to determine and enforce who is allowed access to what resources, hosts, software, network connections
Monitor & response: facilities for monitoring security attacks, generating indications, surviving (tolerating) and recovering from attacks
1/29/2020

39. Security Assurance
How well your security mechanisms guarantee your security policy
Everyone wants high assurance
High assurance implies high cost
May not be possible
Trade-off is needed
1/29/2020

40. Security Tradeoffs
Security
Functionality
COST
Ease of Use
1/29/2020

41. Security by Obscurity Security by obscurity
If we hide the inner workings of a system it will be secure
More and more applications open their standards (e.g., TCP/IP, )
Widespread computer knowledge and expertise
1/29/2020

42. Security by Legislation
Security by legislation says that if we instruct our users on how to behave we can secure our systems
For example
Users should not share passwords
Users should not write down passwords
Users should not type in their password when someone is looking over their shoulder
User awareness and cooperation is important, but cannot be the principal focus for achieving security
1/29/2020

43. Threat-Vulnerability
Threats — Possible attacks on the system
Vulnerabilities — Weaknesses that may be exploited to cause loss or harm
1/29/2020

44. Threat Model and Attack Model
Threat model and attack model need to be clarified before any security mechanism is developed
Threat model
Assumptions about potential attackers
Describes the attacker’s capabilities
Attack model
Assumptions about the attacks
Describe how attacks are launched
1/29/2020