Course Design Document. IS436: Data Security and Privacy. Version 1.0

Size: px

Start display at page:

Download "Course Design Document. IS436: Data Security and Privacy. Version 1.0"

Jemimah Thomas
5 years ago
Views:

1 Course Design Document IS436: Data Security and Privacy Version July 2014

2 Table of Content 1 Versions History Overview of Data Security and Privacy Course Synopsis Prerequisites Objectives Basic Modules Instructional Staff Output and Assessment Summary... 4 Class participation (10%)... 5 Projects (50%)... 5 Final Exam (40%; open book) in week Grades release schedule Group Allocation for Assignments Classroom Planning Course schedule summary Weekly plan List of Information Resources and References Tooling Learning Outcomes, Achievement Methods and Assessment...13 Course: Security and Trust Page 2

3 1 Versions History Version Description of Changes Author Date V 1.0 ingjiu Li Overview of Data Security and Privacy Course 2.1 Synopsis This course introduces undergraduate students to fundamental access control techniques that are essential to ensure data security and privacy. The focus of this course is on (A) access control on mobile platforms, and (B) access control on cloud. The topics to be covered in the area of access control on mobile platforms include mobile platform security model, Android overview, SELinux, and SEAndroid. The topics to be covered in the area of access control on cloud include an overview from PKI to ABE, math foundation and IBE, fuzzy IBE, KP- ABE, and CP-ABE. 2.2 Prerequisites Students should have a good grasp of the fundamentals of information security and privacy (e.g., IS302 Information Security and Trust or equivalent). In addition, students should have basic knowledge about algebra. 2.3 Objectives Upon finishing the course, students are expected to: Understand basic security models, policy language, policy configuration and policy application on SELinux and SEAndroid. Know how to customize security policies on Android so as to address common security problems on mobile platforms. Understand basic encryption techniques for protecting data on the cloud and enabling flexible access to the protected data. Be exposed to emerging and new topics in data security and privacy. Course: Security and Trust Page 3

4 2.4 Basic Modules Data security & privacy on mobile platforms (6 weeks) Mobile platform security model and Android overview (1 week) SELinux (3 weeks) Project 1 presentation (1 week) SEAndroid (1 week) Overview from PKI to ABE (1 week) Math foundatio n and IBE (1 week) Data security & privacy on cloud (6 weeks) Fuzzy IBE/Thres hold ABE (1 week) Project 2 presentation (1 week) KP ABE (1 week) CP ABE (1 week) 2.5 Instructional Staff Professor: ingjiu Li Instructional staff: TBD Teaching assistants: TBD 3 Output and Assessment Summary Week Date Output Weighting Group Remarks Assessments in % Weighting 1 project groups Project 1 25% (report 15%, presentatio Mobile security model and Android overview 2 n 10%) SELinux 3 SELinux 4 Project 2 SELinux 5 25% (report SEAndroid 6 15%, Overview from presentatio PKI to ABE 7 n 10%) Math and IBE Course: Security and Trust Page 4

5 8 (Recess) Final exam Work on project % Fuzzy IBE 10 KP-ABE 11 Class CP-ABE 12 Project 1 10 participatio Work on project presentation n 10% 2 13 Project 2 Presentation 10 Work on project reports 14 Project reports (Review) 15 Final exam % Total Class participation (10%) Evaluated by the lecturers based on students attendance and participation in classroom discussions Projects (50%) There are two group projects with each project 25% Teaming: each team consists of 2-3 members. References: course material and internet Grading: 25% Presentation15% Presentation organization 5% Technical description 5% Q&A 5% Project report 10% Breadth 5% Depth 5% The first group project is on SEAndroid Identify certain problems on existing Android platforms Design and implement SEAndroid policies to address the problems Instructions for the first group project: Identify a security problem on existing Android platforms. The problem must make sense. Design and implement SEAndroid policies to address the problem, and show the effectiveness of the proposed policies (both analytically and through a demo). Course: Security and Trust Page 5

6 Project presentation will be graded on (a) presentation organization, (b) technical description, and (c) questions and answers. The project report will be graded on (a) breadth/completeness (addressing all relevant issues), and (b) depth (providing in-depth analysis with technical details). The second group project is on encryption of data on cloud Identify a specific topic related to IBE, Fuzzy IBE, KP-ABE or CP- ABE Survey the recent advancements on the topic and discuss their applications Instructions for the second project: Read at least 2 published papers on the selected topic. Write a survey paper that covers the following: Introduction: motivation, application domain, problem definition Summaries of the techniques developed in each paper, clearly highlighting the strengths and weaknesses of each A taxonomy of the various techniques if possible Discussion on the applications of the techniques developed in each paper Project presentation will be graded on (a) presentation organization, (b) technical description, and (c) questions and answers. The report will be graded on (a) understanding of the chosen papers, and (b) critique of the papers. The presentations of project 1 are scheduled in week 12, and the presentations of project 2 are scheduled in week 13. The final reports are due on in week 14. Final Exam (40%; open book) in week 15 Cover all material taught in class Short answer questions Grades release schedule Participation Final exam Group projects at the end of term at the end of term at the end of term 4 Group Allocation for Assignments Course: Security and Trust Page 6

7 Each class is partitioned into multiple teams for project. Each team should consist of 2 or 3 members. The students may form their own teams or select teams randomly. 5 Classroom Planning Teaching session: 3 hours Review: 15 minutes Motivation: 30 minutes Security problems Motivating examples Technical solutions: 2 hours Settings and steps Discussions Summary: 15 minutes Note Learning Learning Learning effect 5.1 Course schedule summary Wk Topic (problem) Classroom: techniques (1.5 hours) 1 Overview Mobile platform security model and Android overview 2 SELinux (model) From DAC to MAC, SELinux architecture, security model After-class reading and exercise Group formation Work on project 1 3 SELinux (language) SELinux policy language Work on project 1 4 SELinux (application) SELinux policy application, configuration, customization 5 SEAndroid Challenges, implementation, and case analysis 6 Overview from Introduction to PKI, IBE, Fuzzy PKI to ABE IBE, KP-ABE, and CP-ABE Work on project 1 Work on project 1 Work on project 2 7 Math foundation and IBE Abstract algebra, bilinear maps, IBE setup, IBE encryption, IBE decryption Work on project 2 8 Recess No class Work on project 1 Course: Security and Trust Page 7

8 9 Fuzzy IBE/Threshold ABE Fuzzy IBE/threshold ABE setup, encryption, decryption, and application 10 KP-ABE KP-ABE setup, encryption, decryption, and application Work on project 2 Work on project 2 11 CP-ABE CP-ABE setup, encryption, Work on project 2 decryption, and application 12 Project 1 Presentations of all groups Work on project 2 presentation 13 Project 2 presentation Presentations of all groups Work on project reports 14 Review No class Review, Q&A 15 Final exam Final exam (open book) 5.2 Weekly plan Week: 1 Introduction to the course Mobile platform security model Android overview Project 1 and project team formation Asokan, et al.: Mobile Platform Security, Morgan & Claypool, Course material is available for download from the course web site Students form teams for projects Week: 2 Access control models: from DAC to MAC Linux architecture and security model Linux policy language: TE statements Stephen Smalley: Configuring the SELinux Policy, NSA Technical Report, Clarify the advantages and disadvantages of different security models Students know how to explain and compose TE statements in SELinux Week: 3 Course: Security and Trust Page 8

9 SELinux policy language: TE statements RBAC statements User declaration, constraint definition Security context specifications, file contexts configuration Stephen Smalley: Configuring the SELinux Policy, NSA Technical Report, 2005 Students know how to explain and compose SELinux policy Week: 4 Applying security policy Configuration files for security-aware apps Customizing policy Meeting security objectives Stephen Smalley: Configuring the SELinux Policy, NSA Technical Report, 2005 Students understand how to apply, configure, and customize SELinux security policy Students know how to design security policies to meet security objectives Week: 5 Challenges of using SELinux in Android SEAndroid implementation: Kernel support SEAndroid implementation: Userspace support SEAndroid implementation: policy configuration SEAndroid case analysis Stephen Smalley, Robert Craig: Security Enhanced (SE) Android: Bringing Flexible MAC to Android, NDSS Students understand the challenges of using SELinux in Android and know how to address the challenges in SEAndroid Students know how to implement SEAndroid Students understand how to use SEAndroid to achieve security objectives Week: 6 PKI issues Introduction to IBE Introduction to fuzzy IBE Introduction to ABE Project 2 Course: Security and Trust Page 9

10 Rong-Jaye Chen: Attribute-Based Encryption Understand the issues of PKI Know the basic ideas of IBE, fuzzy IBE, and ABE Week: 7 Abstract algebra: group, ring, field Bilinear maps IBE setup IBE encryption IBE decryption Sahai and Waters: IBE, Eurocrypt 2005 John Bethencourt: Intro to Bilinear Maps Understand the math foundations of abstract algebra and bilinear maps Understand the processes of IBE Week: 8 (Recess week: no class) Week: 9 Fuzzy IBE/threshold ABE motivation Fuzzy IBE setup, encryption, and decryption Security of fuzzy IBE Application of fuzzy IBE Understand the processes of fuzzy IBE Understand why fuzzy IBE is secure and how to apply it Week: 10 KP-ABE motivation KP-ABE setup KP-ABE encryption and decryption Course: Security and Trust Page 10

11 KP-ABE security and application Goyal, Pandey, Sahai, Waters: KP-ABE, CCS 2006 Understand the processes of KP-ABE Understand why KP-ABE is secure and how to apply it Week: 11 CP-ABE motivation CP-ABE setup CP-ABE encryption and decryption CP-ABE security and application Bethencourt, Sahai, Waters: CP-ABE, Oakland 2007 Understand the processes of CP-ABE Understand why CP-ABE is secure and how to apply it Week: 12 Presentation of project 1 Presentation of project 1 All groups present how to use SEAndroid to address security problems on Android platforms Week: 13 (project presentation and demo: teams 6-10) Presentation of project 2 Presentation of project 2 Be exposed to emerging and new topics in IBE, fuzzy IBE, KP-ABE and CP-ABE Week: 14 (review week: no class) Course: Security and Trust Page 11

12 Project report is due Week: 15 (exam week: no class) Final exam 6 List of Information Resources and References Asokan, et al.: Mobile Platform Security, Morgan & Claypool, Stephen Smalley: Configuring the SELinux Policy, NSA Technical Report, Peter Loscocco, Stephen Smalley: Meeting Critical Security Objectives with Security-Enhanced Linux, In proceedings of Ottawa Linux Symposium (2001) Stephen Smalley, Robert Craig: Security Enhanced (SE) Android: Bringing Flexible MAC to Android, NDSS Frank Mayer, Karl MacMillan, David Caplan: SELinux by Example, Prentice Hall, 2007 Rong-Jaye Chen: Attribute-Based Encryption Sahai and Waters: IBE, Eurocrypt 2005 John Bethencourt: Intro to Bilinear Maps Goyal, Pandey, Sahai, Waters: KP-ABE, CCS 2006 Bethencourt, Sahai, Waters: CP-ABE, Oakland 2007 Other reading material and reference websites are available in the course slides 7 Tooling Tool Description Remarks SEAndroid (include SEAndroid Emulator) A set of tools enabling the use of SELinux in Android Project 1 Course: Security and Trust Page 12

13 8 Learning Outcomes, Achievement Methods and Assessment 1 IS302 - Information Security and Trust Integration of business & technology in a sector context Course-specific core competencies which address the Outcomes Understand the advantages and disadvantages of different security models on mobile platforms and cloud Faculty Methods to Assess Outcomes Classroom interactions Grade and give feedback to group projects 1.1 Business IT value linkage skills Ability to understand & analyze the linkages between: a) Business strategy and business value creation b) Business strategy and information strategy c) Information strategy and technology strategy d) Business strategy and business processes e) Business processes or information strategy or technology strategy and IT solutions 1.2 Cost and benefits analysis skills Ability to understand and analyze: a) Costs and benefits analysis of the project 1.3 Business software solution impact analysis skills Be able to explain, configure, apply, customize, and compose security policies on SELinux and SEAndroid Design security policies to meet security objectives on mobile platforms Understand the processes of different encryption schemes on cloud Know how to choose appropriate encryption schemes in various cloud applications Course: Security and Trust Page 13

14 Ability to understand and analyze: a) How business software applications impact the enterprise within a particular industry sector. 2 IT architecture, design and development skills Identify the security requirements for mobile platforms and cloud applications Classroom interactions and projects 2.1 System requirements specification skills Design security policies to protect mobile platforms a) Elicit and understand functional requirements from customer b) Identify non functional requirements (performance, availability, reliability, security, usability etc ) c) Analyze and document business processes 2.2 Software and IT architecture analysis and design skills Choose appropriate encryption schemes to protect cloud data and enable flexible access control Analyze the security issues of mobile platforms and apply SEAndroid policy to address the security issues Analyze the security of different cloud encryption schemes Project 1 and project 2 a) Analyze functional and nonfunctional requirements to produce a system architecture that meets those requirements. b) Understand and apply process and methodology in building the application c) Create design models using known design principles (e.g. Choose and customize cloud encryption schemes in cloud applications Course: Security and Trust Page 14

15 layering) and from various view points (logical, physical etc ) d) Explain and justify all the design choices and tradeoffs done during the application's development 2.3 Implementation skills a) Realize coding from design and vice versa b) Learn / practice one programming language c) Integrate different applications (developed application, cots software, legacy application etc ) d) Use tools for testing, integration and deployment 2.4 Technology application skills a) Understand, select and use appropriate technology building blocks when developing an enterprise solution (security, middleware, network, IDE, ERP, CRM, SCM etc ) 3 Project management skills 3.1 Scope management skills a) Identify and manage trade-offs on scope/cost/quality/time b) Document and manage changing requirements 3.2 Risks management skills a) Identify, prioritize, mitigate and document project s risks b) Constantly monitor projects risks as part of project monitoring 3.3 Project integration and time management skills Use SEAndroid tools to design and implement security policies so as to meet specific security objectives Understand and know how to use Android security policy to meet security objectives, how to choose encryption schemes in cloud applications Project 1 Project 1 and project 2 Course: Security and Trust Page 15

16 a) Establish WBS, time & effort estimates, resource allocation, scheduling etc b) Practice in planning using methods and tools (Microsoft project, Gantt chart etc ) c) Develop / execute a project plan and maintain it 3.4 Configuration management skills a) Understand concepts of configuration mgt and change control 3.5 Quality management skills a) Understand the concepts of Quality Assurance and Quality control (Test plan, test cases ) 4 Learning to learn skills 4.1 Search skills a) Search for information efficiently and effectively 4.2 Skills for developing a methodology for learning a) Develop learning heuristics in order to acquire new knowledge skills (focus on HOW to learn versus WHAT to learn ). b) Abide by appropriate legal, professional and ethical practices for using and citing the intellectual property of others Identify a specific topic related to IBE, Fuzzy IBE, KP-ABE or CP-ABE; survey the recent advancements on the topic and discuss their applications Project 2 5 Collaboration (or team) skills: 5.1 Skills to improve the effectiveness of group processes Effectively communicate and resolve conflicts while working in a team Grade and give feedback to projects Course: Security and Trust Page 16

17 and work products Ability to develop: a) Leadership skills b) Communication skills c) Consensus and conflict resolution skills 6 7 Change management skills for enterprise systems 6.1 Skills to diagnose business changes a) Understand the organizational problem or need for change (e.g. Analyze existing business processes or as-is process ) 6.2 Skills to implement and sustain business changes a) implement the change (e.g. advertise / communicate the need for change etc..) and to sustain the change over time Skills for working across countries, cultures and borders 7.1 Cross-national awareness skills a) Develop cross-national understandings of culture, institutions (e.g. law), language etc 7.2 Business across countries facilitation skills a) Communicate across countries b) Adapt negotiation and conflict resolution techniques to a multicultural environment 8 Communication skills 8.1 Presentation skills Prepare and deliver effective Grade and give feedback Course: Security and Trust Page 17

18 a) Provide an effective and efficient presentation on a specified topic. 8.2 Writing skills a) Provide documentation understandable by users (Requirements specifications, risks management plan, assumptions, constraints, architecture choices, design choices etc ) presentations on two different projects. Write a survey report on the recent advancements of IBE, fuzzy IBE, KP-ABE, or CP-ABE. to projects Provide feedback and suggestions to students writings This sub-skill is covered partially by the course This sub-skill is a main focus for this course Course: Security and Trust Page 18

Course Design Document: IS202 Data Management. Version 4.5

Course Design Document: IS202 Data Management Version 4.5 Friday, October 1, 2010 Table of Content 1. Versions History... 4 2. Overview of the Data Management... 5 3. Output and Assessment Summary... 6