Lectures

[ Home ] [ Policies ] [ Lectures ] [ Homework ] [ Project ]

Lecture Schedule (Subject to Change)

Notice: Students are responsible for reading assigned materials prior to the lecture in which they will be discussed. Lecture slides are available via AFS in the /afs/cs.pitt.edu/usr0/adamlee/public/cs2530/lectures/ directory. As per the course policies, lecture slides are for your use only.

Lecture #	Date	Topics	Readings	Other
1	8/30 (Tue)	Administrivia and introduction	B 1	-
2	9/1 (Thu)	Introduction, cont.	B 13; [SS75]; [L04]; [BLR+04]	-
3	9/6 (Tue)	Why is security hard?	B 2-3.2; [HRU76]	-
4	9/8 (Thu)	The Take/Grant protection model	B 3.3	-
5	9/13 (Tue)	Policy Models I	B 4-5; [M85]	HW 1 due
6	9/15 (Thu)	Policy Models II	B 6-7	-
7	9/20 (Tue)	Access controls	B 15	HW 2 due
8	9/22 (Thu)	Advanced authorization	[BFL96]; [LMW02]	-
9	9/27 (Tue)	RBAC	[OSM00]	-
10	9/29 (Thu)	Formal analysis of access control schemes I	[CMD01]	Project proposal due
11	10/4 (Tue)	Formal analysis of access control schemes I (cont.)		-
12	10/6 (Thu)	Formal analysis of access control schemes II	[TL07]	-
13	10/11 (Tue)	Symmetric key cryptography	B 9.1-9.2, 9.4, 11.1-11.2; PP 2.1-2.6	HW 3 due
-	10/13 (Thu)	No class	-	-
-	10/18 (Tue)	No Class (Monday Schedule)		-
14	10/20 (Thu)	Public key cryptography and IBE	B 9.3; PP 2.7; [RSA78]; [S85]; [K07]	-
15	10/25 (Tue)	Threshold cryptography and secret sharing	[SZ05]; [S79]; [HJ+95]	-
16	10/27 (Thu)	Midterm (in class)	-	-
17	11/1 (Tue)	Authentication and identity	B 12, 14; [L81]	-
18	11/3 (Thu)	Authentication and key exchange protocols	B 10; [DH76]	Annotated reference list due
19	11/8 (Tue)	Operating system security	PP 4-5; [AO96]
20	11/10(Thu)	Network security	PP 7; B 26	-
21	11/15 (Tue)	Viruses and worms	B 22; [S89]; [SM+04]	HW4 Due
22	11/17 (Thu)	Data privacy I: Syntactic protections	[S02]; [MG+06]	-
23	11/22 (Tue)	Data privacy II: Querier privacy	[CG+95]; [FL+11]	-
-	11/24 (Thu)	No Class (Thanksgiving)		-
Note: All readings beyond this point are required! Prior to class, you are expected to read each paper. Then fill out a copy of the review form for the paper and submit it to the instructor before class. The presentation schedule and instructions are here.
24	11/29 (Tue)	Advanced topics: AI/ML and Security	[SB+16]	-
25	12/1 (Thu)	Advanced topics: Cloud	[SC+15]	-
26	12/6 (Tue)	Advanced topics: Privacy	[DMS04]	-
27	12/8 (Thu)	Advanced topics: Cryptocurrency	[RKS15]	HW 5 due
28	12/13 (Tue)	Project presentations	-	Project reports due
29	12/15 (Thu)	Project presentations	-	-

Readings

NOTE: In the reading assignments listed above, "B" refers to the Bishop book, "PP" refers to the Pfleeger and Pfleeger book, and other references refer to the papers below. For instance, "B 2-3.2" means to read all of chapter 2 and sections 3.1 and 3.2 of Bishop.

Other Readings:

[AO96] Aleph One, Smashing the Stack for Fun and Profit, Phrack Issue 49, Nov. 1996.
[BL76] D.E. Bell and L.J. La Padula, Secure Computer System: Unified Exposition and Multics Interpretation, MITRE Technical Report ESD-TR-75-306, March 1976.
[BLR+04] Bharat Bhargava, Leszek Lilien, Arnon Rosenthal, Marianne Winslett, Morris Sloman, Tharam S. Dillon, Elizabeth Chang, Farookh Khadeer Hussain, Wolfgang Nejdl, Daniel Olmedilla, and Vipul Kashyap, The Pudding of Trust, IEEE Intelligent Systems 19(5): 74-88, Sep.-Oct. 2004.
[BFL96] Matt Blaze, Joan Feigenbaum, and Jack Lacy, Decentralized Trust Management, IEEE Symposium on Security and Privacy, May 1996.
[CG+95] B. Chor, O. Goldreich, E. Kushilevitz, M. Sudan, Private information retrieval, FOCS 1995.
[CMD01] Ajay Chander, John C. Mitchell, Drew Dean: A State-Transition Model of Trust Management and Access Control. CSFW 2001: 27-43.
[DH76] Whitfield Diffie and Martin E. Hellman, New Directions in Cryptography, IEEE Transactions on Information Theory 22(6): 644-654, Nov. 1976.
[DMS04] Roger Dingledine, Nick Mathewson, Paul F. Syverson: Tor: The Second-Generation Onion Router. USENIX Security Symposium 2004: 303-320
[FL+11] Nicholas L. Farnan, Adam J. Lee, Panos K. Chrysanthis, and Ting Yu, Don't Reveal My Intension: Protecting User Privacy using Declarative Preferences during Distributed Query Processing, in Proceedings of the 16th European Symposium on Research in Computer Security (ESORICS), September 2011.
[HJ+95] Amir Herzberg, Stanislaw Jarecki, Hugo Krawczyk, and Moti Yung, Proactive Secret Sharing or: How to Cope with Perpetual Leakage, Proceedings of CRYPTO 1995.
[HRU76] Michael A. Harrison, Walter L. Ruzzo, and Jeffrey D. Ullman, Protection in Operating Systems, Communications of the ACM 19(8): 461-471, August 1976.
[K07] Neal Koblitz, The Uneasy Relationship Between Mathematics and Cryptography, Notices of the AMS 54(8): 972-979, Sep. 2007.
[L04] Butler Lampson, Computer Security in the Real World, IEEE Computer 37(6): 37-46, June 2004.
[L81] Leslie Lamport, Password Authentication with Insecure Communication, Communications of the ACM 24(11): 770-772, Nov. 1981.
[LMW02] Ninghui Li, John C. Mitchell, and William H. Winsborough, Design of a Role-based Trust-Management Framework, IEEE Symposium on Security and Privacy, May 2002.
[M85] John McLean, A Comment on the 'Basic Security Theorem' of Bell and LaPadula, Information Processing Letters 20(2): 67-70, Feb. 1985.
[MG+06] Ashwin Machanavajjhala, Johannes Gehrke, Daniel Kifer, Muthuramakrishnan Venkitasubramaniam, l-Diversity: Privacy Beyond k-Anonymity, ICDE 2006.
[OSM00] Sylvia Osborn, Ravi Sandhu, and Qamar Munawer, Configuring Role-Based Access Control to Enforce Mandatory and Discretionary Access Control Policies, ACM TISSEC 3(2): 85-106, 2000.
[RKS15]Tim Ruffing, Aniket Kate, Dominique Schroder: Liar, Liar, Coins on Fire!: Penalizing Equivocation By Loss of Bitcoins. ACM Conference on Computer and Communications Security 2015: 219-230
[RSA78] R.L. Rivest, A. Shamir, and L. Adleman, A Method for Obtaining Digital Signatures and Public-Key Cryptosystems, Communications of the ACM 21(2): 120-126, Feb. 1978.
[S02] Latanya Sweeney, k-Anonymity: A Model for Protecting Privacy, International Journal on Uncertainty, Fuzziness, and Knowledge-based Systems, 10(5):557-570, 2002.
[S79] Adi Shamir, How to Share a Secret, Communications of the ACM 22(11): 612-613, Nov. 1979.
[S85] Adi Shamir, Identity-Based Cryptosystems and Signature Schemes, Proceedings of CRYPTO 1984, pp. 47-53.
[S89] Eugene Spafford, The Internet Worm: Crisis and Aftermath, Communications of the ACM 32(6): 678-687, June 1989.
[SB+16] Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, Michael K. Reiter: Accessorize to a Crime: Real and Stealthy Attacks on State-of-the-Art Face Recognition. ACM Conference on Computer and Communications Security 2016: 1528-1540
[SC+15] Felix Schuster, Manuel Costa, Cedric Fournet, Christos Gkantsidis, Marcus Peinado, Gloria Mainar-Ruiz, Mark Russinovich: VC3: Trustworthy Data Analytics in the Cloud Using SGX. IEEE Symposium on Security and Privacy 2015: 38-54
[SM+04] Stuart Staniford, David Moore, Vern Paxson, and Nicholas Weaver, The Top Speed of Flash Worms, Proceedings of the ACM Workshop on Rapid Malcode (WORM), Oct. 2004.
[SS75] Jerome H. Saltzer and Michael D. Schroeder, The Protection of Information in Computer Systems, Proceedings of the IEEE 63(9): 1278-1308, Sep. 1975.
[SZ05] Fred B. Scheider and Lidong Zhou, Implementing Trustworthy Services Using Replicated State Machines, IEEE Security and Privacy 3(5): 34-43, Sep.-Oct. 2005.
[TL07] Mahesh V. Tripunitara, Ninghui Li: A theory for comparing the expressive power of access control models. Journal of Computer Security 15(2): 231-272 (2007).