A Security Architecture for Survivable Systems

Page Content

Chenxi Wang

Nov 14, 2000

Abstract

In survivability management systems, some management entities reside on application hosts that are not necessarily trustworthy. The integrity of these software entities is essential to the security of the network management scheme. In this talk, I present a novel framework to facilitate software security against malicious execution environments. The approach consists of two fundamental techniques:
Incorporating diversity in the deployment and the design of the program such that impersonation or intelligent tampering attacks require extensive analysis of the program; and
One important aspect of program analysis, namely static analysis, is deterred by the incorporation of aliasing and further degeneration of the program control flow.


It is shown that analyzing the transformed programs statically is an NP-hard problem. Theoretic bounds on approximate analysis methods are also provided. The transformations are implemented in a C compiler. Program performance results are presented. Empirical experiments with existing analysis tools showed that static analysis for the transformed programs are hindered to a significant degree.


About the Speaker

Dr. Chenxi Wang received her Ph.D. in Computer Science at the University of Virginia in October, 2000. Chenxi's research interests include security solutions for large-scale, distributed systems, and security issues with respect to software engineering. Chenxi held a research associate position at the Corporate Information Security Office at Citibank from June 1996 to December 1997. She is the recipient of ACM DC Chapter's 1999 Samuel Alexander award for Doctoral Candidates and the 1999 outstanding student research award from the Department of Computer Science at the University of Virginia. Her dissertation project was nominated for IBM's university partner research award in 1999. Chenxi was a member of the program committee for ACM's New Security Paradigm's workshop from 1997 to 1999. In 1998, she served as the workshop's local chair.


Unless otherwise noted, the security seminar is held on Wednesdays at 4:30P.M. STEW G52, West Lafayette Campus. More information...

© 1999-2013 Purdue University. All rights reserved.

Use/Reuse Guidelines

CERIAS Seminar materials are intended for educational, non-commercial use only and any or all commercial use is prohibited. Any use must attribute "The CERIAS Seminar at Purdue University." Opinions expressed in the recordings are not necessarily representative of the views of CERIAS or of Purdue University.