A Security Architecture for Survivable Systems
Chenxi Wang - University of Virginia
Nov 14, 2000
AbstractIn survivability management systems, some management entities reside on application hosts that are not necessarily trustworthy. The integrity of these software entities is essential to the security of the network management scheme. In this talk, I present a novel framework to facilitate software security against malicious execution environments. The approach consists of two fundamental techniques:
Incorporating diversity in the deployment and the design of the program such that impersonation or intelligent tampering attacks require extensive analysis of the program; and
One important aspect of program analysis, namely static analysis, is deterred by the incorporation of aliasing and further degeneration of the program control flow.
It is shown that analyzing the transformed programs statically is an NP-hard problem. Theoretic bounds on approximate analysis methods are also provided. The transformations are implemented in a C compiler. Program performance results are presented. Empirical experiments with existing analysis tools showed that static analysis for the transformed programs are hindered to a significant degree.
About the SpeakerDr. Chenxi Wang received her Ph.D. in Computer Science at the University of Virginia in October, 2000. Chenxi's research interests include security solutions for large-scale, distributed systems, and security issues with respect to software engineering. Chenxi held a research associate position at the Corporate Information Security Office at Citibank from June 1996 to December 1997. She is the recipient of ACM DC Chapter's 1999 Samuel Alexander award for Doctoral Candidates and the 1999 outstanding student research award from the Department of Computer Science at the University of Virginia. Her dissertation project was nominated for IBM's university partner research award in 1999. Chenxi was a member of the program committee for ACM's New Security Paradigm's workshop from 1997 to 1999. In 1998, she served as the workshop's local chair.
The views, opinions and assumptions expressed in these videos are those of the presenter and do not necessarily reflect the official policy or position of CERIAS or Purdue University. All content included in these videos, are the property of Purdue University, the presenter and/or the presenter’s organization, and protected by U.S. and international copyright laws. The collection, arrangement and assembly of all content in these videos and on the hosting website exclusive property of Purdue University. You may not copy, reproduce, distribute, publish, display, perform, modify, create derivative works, transmit, or in any other way exploit any part of copyrighted material without permission from CERIAS, Purdue University.