Operating System Security: Building Secure Distributed Systems
|
|
|
- Randolph Wilkerson
- 5 years ago
- Views:
Transcription
1 Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Operating System Security: Building Secure Distributed Systems Trent Jaeger Systems and Internet Infrastructure Security (SIIS) Lab Pennsylvania State University October 16, 2007
2 Trent Jaeger Past Projects/Results Linux Security Modules (source code analysis) Verify Complete Mediation of the Reference Monitor Interface Found and fixed six bugs [USENIX Sec 2002][ACM CCS 2002][ACM TISSEC 2004] SELinux Policy Analysis (policy analysis) Identify Low Integrity Flows to High Integrity Subjects Prove Integrity Protection of Apache, SSH, vsftp, and Linux TCB services [USENIX Sec 2003][ACM TISSEC 2003][NDSS 2006] Labeled IPsec (Linux kernel mechanism) Integration of IPsec and SELinux for Mandatory Network Control Accepted into mainline Linux kernel in [SecureComm 2006] applied to distribute systems access enforcement [ACSAC 2006] Lessons Learned Comprehensive Mandatory Access Control for Linux But Comprehensive MAC policies are complex And MAC is expanding to distributed systems Can We Provide Practical Integrity in Distributed System
3 Shared Reference Monitor (Shamon) Bad Appl (Jif) Appl Bad Appl (Jif) Appl TPM Monitor TPM Monitor Shared Reference Monitor (Shamon) Use virtual machines and remote attestation as basis for a distributed systems security architecture Sponsored by NSF (Cyber Trust) and IBM Research
4 Shamon Motivation Reference Monitor Goals Can be extended to distributed systems Tamperproofing: Remote Attestation Hardware-based integrity measurement Prove integrity to remote parties [USENIX Sec 2004][ACM CCS 2 Complete Mediation: Systems Coarse-grained Mandatory Access Control (Xen shype) Simplify MAC policies [ACSAC 2005] [ACSAC 2006] Comprehensive Verification: Information Flow Aware Software Development Generate secure code [IEEE S&P 2006][ICSE 2007][sub to ICSE 20 Verified MAC Policies [ACM TISSEC 2003][USENIX Sec 2003] Meet these requirements!
5 Shamon Systems Coalitions Properties Compatible Security Policies System 1 System 2 Attested Enforcement Alice Alice Isolated Workloads Secure Communication Promises to reduce the security-related complexity for distributed applications Alice Untrusted network Alice System 3 System 4
![Shamon Core Goal: Verifiable MAC Enforcement Core [ACSAC 2007] High integrity software and data System protects itself from runtime or boot](/docs-images/84/89655349/images/6-2.jpg "vulnerabilities Basis for Verification Root-of-Trust-Installer (ROTI) Systems and Internet Infrastructure Security (SIIS) Laboratory Page 6")
6 Shamon Core Goal: Verifiable MAC Enforcement Core [ACSAC 2007] High integrity software and data System protects itself from runtime or boot vulnerabilities Basis for Verification Root-of-Trust-Installer (ROTI) Systems and Internet Infrastructure Security (SIIS) Laboratory Page 6
![System Policy Compliance Goal: Ensure that systems can verify an application s MAC enforcement [USENIX Tech 2007] [SACMAT 2007] Lots of applications that are trusted (over 30 in SELinux)](/docs-images/84/89655349/images/7-2.jpg "Security-typed languages enable verification of enforcement Applied to real applications System services: logrotate Client programs: Email client and web browser DTO/IARPA Funded project policy")
7 System Policy Compliance Goal: Ensure that systems can verify an application s MAC enforcement [USENIX Tech 2007] [SACMAT 2007] Lots of applications that are trusted (over 30 in SELinux) Security-typed languages enable verification of enforcement Applied to real applications System services: logrotate Client programs: client and web browser DTO/IARPA Funded project policy Compliance Checker Allowed flows Shamon
8 High Integrity Systems Goal: Provide verifiable high integrity core in client systems Applied to cell phones Trusted software and random software SHIMA integrity measurement enables verification that trusted code is isolated from others Sponsored by Raytheon and Samsung Cell Platform Systems and Internet Infrastructure Security (SIIS) Laboratory Page 8
9 Summary Emerging Technology Enables Rethinking of Distributed MAC Enforcement Shared Reference Monitor Promote Correct Shamon Systems Root-of-Trust-Install (ROTI), Prescribed Software, Bootcycle Secrets Build Distributed Shamon Applications Coalition Repository Web Shamon Verifiable Integrity Cell Systems
10 Questions Shamon project Penn State SIIS Lab
Systems Security Research in SIIS Lab
Systems and Internet Infrastructure Security (SIIS) Laboratory 1 Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania
Advanced Systems Security: Principles
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Advanced Systems Security: Principles
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
SELinux Protected Paths Revisited
SELinux Protected Paths Revisited Trent Jaeger Department of Computer Science and Engineering Pennsylvania State University March 1, 2006 1 Talk Topics Mechanism for MAC enforcement between 2 machines
Topics in Systems and Program Security
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Topics in Systems and
Justifying Integrity Using a Virtual Machine Verifier
Justifying Integrity Using a Virtual Machine Verifier Joshua Schiffman, Thomas Moyer, Christopher Shal, Trent Jaeger, and Patrick McDaniel ACSAC 09 1 1 Cloudy Horizons Utility-based cloud computing is
Advanced Systems Security: Ordinary Operating Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Advanced Systems Security: Principles
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Topics in Systems and Program Security
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Topics in Systems and
Advanced Systems Security: Security-Enhanced Linux
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
CSE543 - Computer and Network Security Module: Virtualization
CSE543 - Computer and Network Security Module: Virtualization Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 1 Operating System Quandary Q: What is the primary goal of
Advanced Systems Security: Virtual Machine Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Advanced Systems Security: Virtual Machine Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
CSE543 - Computer and Network Security Module: Virtualization
CSE543 - Computer and Network Security Module: Virtualization Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 Operating System Quandary Q: What is the primary goal of system
Advanced Systems Security: Securing Commercial Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Establishing and Sustaining System Integrity via Root of Trust Installation
23rd Annual Computer Security Applications Conference Establishing and Sustaining System Integrity via Root of Trust Installation Luke St.Clair, Joshua Schiffman, Trent Jaeger, Patrick McDaniel Systems
Practical Verification of System Integrity in Cloud Computing Environments
Practical Verification of System Integrity in Cloud Computing Environments Trent Jaeger Penn State NSRC Industry Day April 27 th, 2012 1 Overview Cloud computing even replaces physical infrastructure Is
Shame on Trust in Distributed Systems
Shame on Trust in Distributed Systems Trent Jaeger, Patrick McDaniel, Luke St. Clair Pennsylvania State University Ramón Cáceres, Reiner Sailer IBM T. J. Watson Research Center 1 Introduction Approaches
Advanced Systems Security: Multics
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Advanced Systems Security: Future
Advanced Systems Security: Future Trent Jaeger Systems and Internet Infrastructure Security (SIIS) Lab Penn State University 1 Privilege Separation Has been promoted for some time Software-Fault Isolation
Module: Cloud Computing Security
Module: Computing Security Professor Trent Jaeger Penn State University Systems and Internet Infrastructure Security Laboratory (SIIS) 1 Computing Is Here Systems and Internet Infrastructure Security (SIIS)
IBM Research Report. Bridging Mandatory Access Control Across Machines
RC23778 (W0511-035) November 4, 2005 Computer Science IBM Research Report Bridging Mandatory Access Control Across Machines Jonathan M. McCune 1, Stefan Berger, Ramón Cáceres, Trent Jaeger 2, Reiner Sailer
Virtual Machine Security
Virtual Machine Security CSE443 - Spring 2012 Introduction to Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse443-s12/ 1 Operating System Quandary Q: What is the primary goal
Justifying Integrity Using a Virtual Machine Verifier
Justifying Integrity Using a Virtual Machine Verifier Abstract Emerging distributing computing architectures, such as grid and cloud computing, depend on the high integrity execution of each system in
Leveraging IPsec for Mandatory Access Control of Linux Network Communications
Leveraging for Mandatory of Linux Network Communications Trent Jaeger Department of Computer Science and Engineering Pennsylvania State University December 6, 2005 1 Mandatory 2 Mandatory File X 3 Network
Toward Automated Information-Flow Integrity Verification for Security-Critical Applications
CSE 598A - Spring 2007 - Sandra Rueda Page 1 Toward Automated Information-Flow Integrity Verification for Security-Critical Applications Umesh Shankar, Trent Jaeger and Reiner Sailer Presented by Sandra
Last time. Security Policies and Models. Trusted Operating System Design. Bell La-Padula and Biba Security Models Information Flow Control
Last time Security Policies and Models Bell La-Padula and Biba Security Models Information Flow Control Trusted Operating System Design Design Elements Security Features 10-1 This time Trusted Operating
CSE543 - Computer and Network Security Module: Virtualization
CSE543 - Computer and Network Security Module: Virtualization Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 Operating System Quandary Q: What is the primary goal of system
Advanced Systems Security: Putting It Together Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Security for the Xen Hypervisor Status Quo & Perspective 2006
Security for the Xen Hypervisor Status Quo & Perspective 2006 Reiner Sailer Xen Summit 2006 IBM T J Watson Research Center 1/17/2006 1. Access Control Module 2. Virtual Trusted Platform Module 2 IBM T
IBM Research Report. Trusted Mobile Computing
RC23752 (W0510-132) October 19, 2005 Computer Science IBM Research Report Trusted Mobile Computing Ramón Cáceres, Reiner Sailer IBM Research Division Thomas J. Watson Research Center P.O. Box 704 Yorktown
Module: Operating System Security. Professor Trent Jaeger. CSE543 - Introduction to Computer and Network Security
CSE543 - Introduction to Computer and Network Security Module: Operating System Security Professor Trent Jaeger 1 OS Security So, you have built an operating system that enables user-space processes to
Establishing and Sustaining System Integrity via Root of Trust Installation
Establishing and Sustaining System Integrity via Root of Trust Installation Abstract Integrity measurements provide a means by which distributed systems can assess the trustability of potentially compromised
Advanced Systems Security: Ordinary Operating Systems
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
The Evolution of Secure Operating Systems
The Evolution of Secure Operating Systems Trent Jaeger Systems and Internet Infrastructure Security (SIIS) Lab Computer Science and Engineering Department Pennsylvania State University 1 Operating Systems
CMPSC 497 Attack Surface
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA CMPSC 497 Attack Surface
Advanced Systems Security: Security Goals
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
CSE 544 Advanced Systems Security
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA CSE 544 Advanced Systems
PRIMA: Policy-Reduced Integrity Measurement Architecture
PRIMA: Policy-Reduced Integrity Measurement Architecture Trent Jaeger tjaeger@cse.psu.edu Pennsylvania State University University Park, PA 16802 Reiner Sailer sailer@us.ibm.com IBM T. J. Watson Research
Transforming Commodity Security Policies to Enforce Clark-Wilson Integrity
Transforming Commodity Security Policies to Enforce Clark-Wilson Integrity Divya Muthukumaran Pennsylvania State University muthukum@cse.psu.edu Hayawardh Vijayakumar Pennsylvania State University hvijay@cse.psu.edu
Advanced Systems Security: Cloud Computing Security
Advanced Systems Security: Cloud Computing Security Trent Jaeger Penn State University Systems and Internet Infrastructure Security Laboratory (SIIS) 1 Cloudy Foundations Can customers move their services
Integrating SELinux with Security-typed Languages
Integrating SELinux with Security-typed Languages Boniface Hicks, Sandra Rueda, Trent Jaeger and Patrick McDaniel Systems and Internet Infrastructure Security Laboratory (SIIS) Computer Science and Engineering,
BUILDING A FRAMEWORK FOR INFORMATION FLOW AWARE WEB APPLICATIONS
The Pennsylvania State University The Graduate School Department of Computer Science and Engineering BUILDING A FRAMEWORK FOR INFORMATION FLOW AWARE WEB APPLICATIONS A Thesis in Computer Science and Engineering
Lecture 3 MOBILE PLATFORM SECURITY
Lecture 3 MOBILE PLATFORM SECURITY You will be learning: What techniques are used in mobile software platform security? What techniques are used in mobile hardware platform security? Is there a common
Flicker: An Execution Infrastructure for TCB Minimization
Flicker: An Execution Infrastructure for TCB Minimization Jonathan McCune, Bryan Parno, Adrian Perrig, Michael Reiter, and Hiroshi Isozaki (EuroSys 08) Presented by: Tianyuan Liu Oct 31, 2017 Outline Motivation
Towards Multi Layer Trusted Virtual Domains
Towards Multi Layer Trusted Virtual Domains Yasuharu Katsuno Michiharu Kudo Ronald Perez Reiner Sailer Yuji Watanabe Sachiko Yoshihama Leendert van Doorn {katsuno, kudo, muew, sachikoy}@jp.ibm.com IBM
Attack Graphs. Systems and Internet Infrastructure Security
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Attack Graphs Systems
Advanced Systems Security: Security-Enhanced Linux
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Advanced Systems Security: Integrity
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Trusted Computing. William A. Arbaugh Department of Computer Science University of Maryland cs.umd.edu
Trusted Computing William A. Arbaugh Department of Computer Science University of Maryland waa @ cs.umd.edu http://www.cs.umd.edu/~waa Getting Started Would you like to know what software is running on
Barriers to Cloud Adoption and Research Opportunities
Barriers to Cloud Adoption and Research Opportunities Prashant Shenoy University of Massachusetts Amherst Cloud Economics Cloud platforms: lease hardware and software rather than own Argument: Leasing
CSE543 - Computer and Network Security Module: Trusted Computing
CSE543 - Computer and Network Security Module: Trusted Computing Professor Trent Jaeger CSE543 - Introduction to Computer and Network Security 1 What is Trust? 2 What is Trust? dictionary.com Firm reliance
Advanced Systems Security: Security-Enhanced Linux
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
CSE Computer Security
CSE 543 - Computer Security Lecture 25 - Virtual machine security December 6, 2007 URL: http://www.cse.psu.edu/~tjaeger/cse543-f07/ 1 Implementation and Results Experimental Platform Exact specification
ViryaOS RFC: Secure Containers for Embedded and IoT. A proposal for a new Xen Project sub-project
ViryaOS RFC: Secure Containers for Embedded and IoT A proposal for a new Xen Project sub-project Stefano Stabellini @stabellinist The problem Package applications for the target Contain all dependencies
CIS433/533 - Introduction to Computer and Network Security. Access Control
CIS433/533 - Introduction to Computer and Network Security Access Control Professor Butler Winter 2011 Computer and Information Science Trusted Computing Base The trusted computing base is the infrastructure
The Evolution of Secure Operating Systems
The Evolution of Secure Operating Systems Trent Jaeger Systems and Internet Infrastructure Security (SIIS) Lab Computer Science and Engineering Department Pennsylvania State University 1 Operating Systems
IBM Research Report. PRIMA: Policy-Reduced Integrity Measurement Architecture. Trent Jaeger Pennsylvania State University
RC23898 (W0603-030) March 3, 2006 Computer Science IBM Research Report PRIMA: Policy-Reduced Integrity Measurement Architecture Trent Jaeger Pennsylvania State University Reiner Sailer IBM Research Division
Wrapup. CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger.
Wrapup CSE497b - Spring 2007 Introduction Computer and Network Security Professor Jaeger www.cse.psu.edu/~tjaeger/cse497b-s07/ Final 2 The final is on Tuesday, May 8, 8:00 in 160 Willard (here) Be late
Configuring Cloud Deployments for Integrity
Configuring Cloud Deployments for Integrity Trent Jaeger, Nirupama Talele, Yuqiong Sun, Divya Muthukumaran, Hayawardh Vijayakumar, and Joshua Schiffman {tjaeger,nrt123,yus138,muthukumaran,hvivay,jschiffm}@cse.psu.edu
CSCI 420: Mobile Application Security. Lecture 7. Prof. Adwait Nadkarni. Derived from slides by William Enck, Patrick McDaniel and Trent Jaeger
CSCI 420: Mobile Application Security Lecture 7 Prof. Adwait Nadkarni Derived from slides by William Enck, Patrick McDaniel and Trent Jaeger 1 cryptography < security Cryptography isn't the solution to
Runtime Analysis. November 28, Systems and Internet Infrastructure Security Laboratory (SIIS) Page 1
Runtime Analysis November 28, 2011 Page 1 Analysis So Far Prove whether a property always holds May analysis Prove whether a property can hold Must analysis Key step: abstract interpretation to overapproximate
Advanced Systems Security: Integrity
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Seeding Clouds with Trust Anchors
Seeding Clouds with Trust Anchors Joshua Schiffman, Thomas Moyer, Hayawardh Vijayakumar Trent Jaeger and Patrick McDaniel Systems and Internet Infrastructure Security Laboratory Pennsylvania State University
Dawn Song
1 Virtual Machines & Security Dawn Song dawnsong@cs.berkeley.edu Virtual Machines VM: Execution environment that gives the illusion of a real machine VMM/Hypervisor: host software which provides this capability
Operating System Security, Continued CS 136 Computer Security Peter Reiher January 29, 2008
Operating System Security, Continued CS 136 Computer Security Peter Reiher January 29, 2008 Page 1 Outline Designing secure operating systems Assuring OS security TPM and trusted computing Page 2 Desired
ACCESSPROV: Tracking the Provenance of Access Control Decisions
ACCESSPROV: Tracking the Provenance of Access Control Decisions Frank Capobianco The Pennsylvania State University fnc110@cse.psu.edu Christian Skalka The University of Vermont skalka@cs.uvm.edu Trent
Towards Automated Authorization Policy Enforcement
Towards Automated Authorization Policy Enforcement Vinod Ganapathy Univ. of Wisconsin-Madison vg@cs.wisc.edu Trent Jaeger Pennsylvania State Univ. tjaeger@cse.psu.edu Somesh Jha Univ. of Wisconsin-Madison
Advanced Systems Security: Integrity
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
Laying a Secure Foundation for Mobile Devices. Stephen Smalley Trusted Systems Research National Security Agency
Laying a Secure Foundation for Mobile Devices Stephen Smalley Trusted Systems Research National Security Agency Trusted Systems Research Conduct and sponsor research to provide information assurance for
Unicorn: Two- Factor Attestation for Data Security
ACM CCS - Oct. 18, 2011 Unicorn: Two- Factor Attestation for Data Security M. Mannan Concordia University, Canada B. Kim, A. Ganjali & D. Lie University of Toronto, Canada 1 Unicorn target systems q High
Toward Automated Authorization Policy Enforcement
Toward Automated Authorization Policy Enforcement Vinod Ganapathy vg@cs.wisc.edu Trent Jaeger tjaeger@cse.psu.edu Somesh Jha jha@cs.wisc.edu March 1 st, 2006 Second Annual Security-enhanced Linux Symposium
Systems View -- Current. Trustworthy Computing. TC Advantages. Systems View -- Target. Bootstrapping a typical PC. Boot Guarantees
Trustworthy Computing s View -- Current Trent Jaeger February 18, 2004 Process 1 Web server Process 2 Mail server Process 3 Java VM Operating Hardware (CPU, MMU, I/O devices) s View -- Target TC Advantages
Automatic Placement of Authorization Hooks in the Linux Security Modules Framework
Automatic Placement of Authorization Hooks in the Linux Security Modules Framework Vinod Ganapathy vg@cs.wisc.edu University of Wisconsin, Madison Joint work with Trent Jaeger tjaeger@cse.psu.edu Pennsylvania
CMPSC 497: Static Analysis
CMPSC 497: Static Analysis Trent Jaeger Systems and Internet Infrastructure Security (SIIS) Lab Computer Science and Engineering Department Pennsylvania State University Page 1 Our Goal In this course,
STING: Finding Name Resolution Vulnerabilities in Programs
STING: Finding Name Resolution ulnerabilities in Programs Hayawardh ijayakumar, Joshua Schiffman, Trent Jaeger Systems and Internet Infrastructure Security (SIIS) Lab Computer Science and Engineering Department
Secure Sharing of an ICT Infrastructure Through Vinci
Secure Sharing of an ICT Infrastructure Through Vinci Fabrizio Baiardi 1 Daniele Sgandurra 2 1 Polo G. Marconi - La Spezia, University of Pisa, Italy 2 Department of Computer Science, University of Pisa,
HyperSafe: A Lightweight Approach to Provide Lifetime Hypervisor Control-Flow Integrity
31 st IEEE Symposium on Security & Privacy, Oakland CA, May 16-19 2010 HyperSafe: A Lightweight Approach to Provide Lifetime Hypervisor Control-Flow Integrity Zhi Wang, Xuxian Jiang North Carolina State
Applications of Attestation:
Lecture Secure, Trusted and Trustworthy Computing : IMA and TNC Prof. Dr. Ing. Ahmad Reza Sadeghi System Security Lab Technische Universität Darmstadt (CASED) Germany Winter Term 2011/2012 1 Roadmap: TC
Retrofitting Legacy Code for Authorization Policy Enforcement
Retrofitting Legacy Code for Authorization Policy Enforcement Vinod Ganapathy, Trent Jaeger, and Somesh Jha Presented by Kevin Butler CSE 544-13 February 2007 Systems and Internet Infrastructure Security
CMPSC 497 Buffer Overflow Vulnerabilities
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA CMPSC 497 Buffer Overflow
Operating Systems CMPSC 473. Introduction January 15, Lecture 1 Instructor: Trent Jaeger
Operating Systems CMPSC 473 Introduction January 15, 2008 - Lecture 1 Instructor: Trent Jaeger About Me Trent Jaeger (PhD, University of Michigan) Associate Professor, CSE -- after 9 years at IBM Research
Xen Security Modules (XSM)
Xen Security Modules (XSM) George Coker National Information Assurance Research Lab National Security Agency (NSA) gscoker@alpha.ncsc.mil National Information Assurance Research Lab UNCLASSIFIED 1 What
INF3510 Information Security. Lecture 6: Computer Security. Universitetet i Oslo Audun Jøsang
INF3510 Information Security Lecture 6: Computer Security Universitetet i Oslo Audun Jøsang Lecture Overview Secure computer architectures Virtualisation architectures Trusted computing Security Evaluation
IBM Research Report. Building a MAC-based Security Architecture for the Xen Opensource Hypervisor
RC23629 (W0506-051) June 8, 2005 Computer Science IBM Research Report Building a MAC-based Security Architecture for the Xen Opensource Hypervisor Reiner Sailer, Trent Jaeger, Enriquillo Valdez, Ronald
SE Linux Implementation LINUX20
SE Linux Implementation LINUX20 Russell Coker IBM eserver pseries, Linux, Grid Computing and Storage Technical University 7/7/2004 Licensed under the GPL Topic Objectives In this topic students will learn
OS Security IV: Virtualization and Trusted Computing
1 OS Security IV: Virtualization and Trusted Computing Chengyu Song Slides modified from Dawn Song 2 Administrivia Lab2 More questions? 3 Virtual machine monitor +-----------+----------------+-------------+
2 Lecture Embedded System Security A.-R. Darmstadt, Android Security Extensions
2 Lecture Embedded System Security A.-R. Sadeghi, @TU Darmstadt, 2011-2014 Android Security Extensions App A Perm. P 1 App B Perm. P 2 Perm. P 3 Kirin [2009] Reference Monitor Prevents the installation
CMPSC 497 Other Memory Vulnerabilities
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA CMPSC 497 Other Memory
Module: Future of Secure Programming
Module: Future of Secure Programming Professor Trent Jaeger Penn State University Systems and Internet Infrastructure Security Laboratory (SIIS) 1 Programmer s Little Survey Problem What does program for
Mobile Platform Security Architectures A perspective on their evolution
Mobile Platform Security Architectures A perspective on their evolution N. Asokan CARDIS 2012 Graz, Austria November 29, 2012 1 NA, KKo, JEE, Nokia Resarch Center 2011-2012 Introduction Recent interest
6.858 Quiz 2 Review. Android Security. Haogang Chen Nov 24, 2014
6.858 Quiz 2 Review Android Security Haogang Chen Nov 24, 2014 1 Security layers Layer Role Reference Monitor Mandatory Access Control (MAC) for RPC: enforce access control policy for shared resources
Advanced Systems Security: Confused Deputy
Advanced Systems Security: Confused Deputy Trent Jaeger Systems and Internet Infrastructure Security (SIIS) Lab Computer Science and Engineering Department Pennsylvania State University 1 Talk Outline
Isolation And Integrity Management In Dynamic Virtualized Environments
Isolation And Integrity Management In Dynamic Virtualized Environments Reiner Sailer Manager Security Services (GSAL) Team IBM Thomas J Watson Research Center, NY Joint work with: See next slide 2007
A new Distributed Security Model for Linux Clusters
A new Distributed Security Model for Linux Clusters Makan.Pourzandi@Ericsson.Com Open Systems Lab Montréal Canada June, 2004 Rev PA1 07/05/04 1 Outline Context Distributed Security Distributed Access Control
Decentralized Action Integrity for Trigger-Action IoT Platforms. Earlence Fernandes, Amir Rahmati, Jaeyeon Jung, Atul Prakash
Decentralized Action Integrity for Trigger-Action IoT Platforms Earlence Fernandes, Amir Rahmati, Jaeyeon Jung, Atul Prakash Creates an account Creates an account Creates an account Connects LG account
About Me. Office Hours: Tu 4-5, W 1-2, or by appointment Office: 346A IST Bldg
1 About Me Trent Jaeger (PhD, University of Michigan) Associate Professor, CSE -- after 9 years at IBM Research Research: Operating System Security Example Projects L4 Microkernel -- minimal, high performance
Advanced Systems Security: New Threats
Systems and Internet Infrastructure Security Network and Security Research Center Department of Computer Science and Engineering Pennsylvania State University, University Park PA Advanced Systems Security:
CSE Computer Security
CSE 543 - Computer Security Lecture 17 - Language-based security October 25, 2007 URL: http://www.cse.psu.edu/~tjaeger/cse543-f07/ 1 Engineering Disaster? Millions of Bots Compromised applications Programming
Trustworthy Whole-System Provenance for the Linux Kernel
Trustworthy Whole-System Provenance for the Linux Kernel Adam Bates, Dave (Jing) Tian, Thomas Moyer, and Kevin R. B. Butler In association with USENIX Security Symposium, Washington D.C., USA 13 August,