Tutorials

Tutorial Chairs

Adam Lee University of Pittsburgh, USA
Yingjiu Li Singapore Management University, Singapore
Patrick Tague Carnegie Mellon University, USA

Tutorial Abstracts and Lecturer Resumes

Tutorial 1: Integrity, Consistency, and Verification of Remote Computation

Lecturer: Christian Cachin, IBM Research - Zurich

Date/Time: Tuesday, November 4th, 2014, 2PM (2 hrs)

Abstract:

With the advent of cloud computing, many clients have outsourcedcomputation and data storage to remote servers. This has led to prominent concerns about the privacy of the data and computation placed outside the control of the clients. On the other hand, the integrity of the responses from the remote servers has been addressed in-depth only recently. Violations of correctness are potentially more dangerous, however, in the sense that the safety of a service is in danger and that the clients rely on the responses. Incidental computation errors as well as deliberate and sophisticated manipulations on the server side are nearly impossible to discover with today’s technology. Over the last few years, there has been rising interest in technology to verify the results of a remote computation and to check the consistency of responses from a cloud service. These advances rely on recently introduced cryptographic techniques, including authenticated data types (ADT), probabilistically checkable proofs (PCPs), fully-homomorphic encryption (FHE), quadratic programs (QP), and more. With multiple clients accessing the remote service, a further dimension is added to the problem in the sense that clients isolated from each other need to guarantee that their verification operations relate to the same “version” of the server’s computation state.

This tutorial will survey the recent work in this area and provide a broad introduction to some of the key concepts underlying verifiable computation, towards single and multiple verifiers. The aim is to give a systematic survey of techniques in the realm of verifiable computation, remote data integrity, authenticated queries, and consistency verification.

The approaches rely on methods from cryptography and from distributed computing. The presentation will introduce the necessary background techniques from these fields, describe key results, and illustrate how they ensure integrity in selected cases.

The tutorial consists of three parts:

1. Verifiable computation
2. Authenticated data types
3. Distributed consistency enforcement

Bio:

Christian Cachin is a researcher in cryptography and security at IBM Research - Zurich. He graduated with a Ph.D. in Computer Science from ETH Zurich and has held visiting positions at MIT and at EPFL. Christian Cachin’s research focuses on cryptology and distributed systems. He has authored many peer-reviewed publications in these fields, holds several patents on secure protocols, and has been a frequent member of program committees of technical conferences, of which he chaired several. He is an ACM Distinguished Scientist (2009) and has received multiple IBM Outstanding Technical Achievement Awards. Since 1998 he has been a member of the board of directors of the International Association for Cryptologic Research (IACR), currently as acting as its President. He serves as an editor for international journals in the area of information security and is an author of the book “Introduction to Reliable and Secure Distributed Programming.” Furthermore, he contributed to the OASIS Key Management Interoperability Protocol (KMIP) standard, which debuted in 2010. His current research addresses the security of cloud computing, secure protocols for distributed systems, and cryptography.

 

Tutorial 2: Text Analytics for Security

Lecturers:

William Enck, North Carolina State University
Tao Xie, University of Illinois at Urbana-Champaign

Date/Time: Wednesday, November 5th, 2014, 2PM (1.5 hrs)

Abstract:

Computing systems that make security decisions often fail to take into account human expectations. This failure occurs because human expectations are typically drawn from in textual sources (e.g., mobile application description and requirements documents) and are hard to extract and codify. Recently, researchers in security and software engineering have begun using text analytics to create initial models of human expectation. In this tutorial, we will provide an introduction to popular techniques and tools of natural language processing (NLP) and text mining, and share our experiences in applying text analytics to security problems. We will also highlight the current challenges of applying these techniques and tools for addressing security problems. Finally, we will conclude with discussion of future research directions.

Bios:

William Enck is an Assistant Professor in the Department of Computer Science at North Carolina State University. William's research eorts centrally focus on systems security, addressing challenges in smartphones and mobile applications, operating systems, cloud services, telecommunications, and hardware architectures. In particular, his work in mobile application security has led to significant consumer awareness and changes within the space. William was awarded the National Science Foundation CAREER Award and has served on program committees for top conferences in security such as ACM CCS, IEEE Security and Privacy, NDSS, and USENIX Security. Prior joining North Carolina State University, William earned his Ph.D., M.S., and B.S in Computer Science and Engineering from the Pennsylvania State University in 2011, 2006, and 2004, respectively. William is a member of the ACM, IEEE, ISSA, and USENIX.

Tao Xie is an Associate Professor in the Department of Computer Science at University of Illinois at Urbana-Champaign, USA. He was a faculty member at North Carolina State University from 2005 till 2013. He has worked as a visiting researcher at Microsoft Research Redmond and Microsoft Research Asia. His research interests are in software engineering, focusing on software security, software testing, program analysis, and software analytics. He leads the Automated Software Engineering Research Group at Illinois, and is a member of the Programming Languages, Formal Methods, and Software Engineering (PL-FM-SE) area at Illinois. He received his Ph.D. in Computer Science from the University of Washington at Seattle in 2005. He co-presented a number of tutorials on mining software engineering data and software testing at top software engineering venues. He is a senior member of the ACM and IEEE.

Tutorial 3: Client-Controlled Cloud Encryption

Lecturer: Florian Kerschbaum, SAP, Germany

Date/Time: Thursday, November 6th, 2014, 2PM (1.5 hrs)

Abstract:

Customers of cloud service demand control over their data. Next to threats to intellectual property, legal requirements and risks, such as data protection compliance or the possibility of a subpoena of the cloud service provider, also pose restrictions. A commonly proposed and implemented solution is to encrypt the data on the client and retain the key at the client. In this tutorial we will review

• the available encryption methods, such deterministic, order-preserving, homomorphic, searchable (functional) encryption and secure multiparty computation,
• possible attacks on currently deployed systems like dictionary and frequency attacks,
• architectures integrating these solutions into SaaS and PaaS (DBaaS) applications.

Each possible solution offers a trade-off between security, performance or cost and functionality. Solutions existing in the market provide rather low security, but high performance at little implementation cost. There exist a number of research projects that provide much better security, but also at a higher cost – often realized in the effort to implement and deploy the solution in existing landscapes. Consider fully homomorphic encryption: it is highly secure, but extremely inefficient. Furthermore it does not support data sharing.

It is important to understand the trade-offs and implications provided by the different encryption schemes in order to be able to design systems that make the best use of them. When combining technologies cleverly interesting systems design can arise that can provide even break-through functionality or security. We will look at current options available on the market, but more importantly explore design choices currently foreshadowed by the security research community.

Bio:

Florian Kerschbaum is chief research expert at SAP in Karsruhe, Germany. In the academic year 2011/12 he was on leave as the deputy professor (Lehrstuhlvertreter) for the chair of privacy and data security at Dresden University of Technology. Before SAP he has worked for Siemens, the San Francisco-based startup Arxan, Intel and Digital Equipment in the job functions of project manager, software architect, and developer. He holds a Ph.D. in computer science from the Karlsruhe Institute of Technology, a master’s degree from Purdue University, and a bachelor’s degree from Berufsakademie Mannheim. At SAP he is the technical leader for a pre-development project on database and SaaS encryption. He and his team have developed a prototype for processing queries on encrypted data in the SAP HANA database. He also chairs the SAP internal crypto board overseeing the strategy for implementing cryptography. He has extensive experience in encrypted computation. In his dissertation he implemented an encrypted benchmarking service using homomorphic encryption. Later, he lead the EU research project SecureSCM for encrypted, collaborative supply chain management. He currently is the technical lead of the EU research project PRACTICE which investigates secure multi-party computation in general. He holds 40 patents and published 100 papers in academic conferences and journals. He serves as program co-chair of ACM SACMAT 2015 and on the program committees of several conferences including ACM CCS in 2013, 2014. He has been keynote speaker at a few academic conferences and co-organizes the Dagstuhl seminar on cryptography and programming languages.