‘Polifonia’ Thematic Network for Music Budapest, Friday 18 May 2007.
Friday December 7, 2007 SoBeNeT project 5 th User group meeting 07/12/2007.
-
Upload
trevor-mccormick -
Category
Documents
-
view
214 -
download
1
Transcript of Friday December 7, 2007 SoBeNeT project 5 th User group meeting 07/12/2007.
2
Frid
ay D
ecem
ber
7, 2
007
Agenda
16:00h Welcoming
16:10h Project overview and status
16:40h CLASP, SDL and TouchPoints compared
17:00h SoProTo – A software protection tool
17:20h Run-time enforcement of security policies on the .NET framework
17:40h Discussion and wrap-up
18:00h Drink
3
Frid
ay D
ecem
ber
7, 2
007
Overview
1. Project context
2. Overview of main results
3. Valorization program
4. Outlook on finalization
4
Frid
ay D
ecem
ber
7, 2
007
I. Context: project in a nutshell
IWT SBO project (2003-2007) Extended until April 2008
Context: availability of security components (still evolving but relatively mature)
Goal: to enable the development of secure software applications
4 Research tracks: Programming and Composition Technology Software engineering – “full life cycle” Tamper and analysis resistance Shielding and interception
5
Frid
ay D
ecem
ber
7, 2
007
The project’s user group
3E Agfa Alcatel Application Engineers Cryptomatic EMC2
Inno.com Johan Peeters bvba
Microsoft L-SEC NBB OWASP-Belgium Philips PWC Siemens UZ Gasthuisberg Zetes
User group Channel for direct feedback on the execution of
the project Primary audience for dissemination Possible channel for validation and valorization
Composition:
7
Frid
ay D
ecem
ber
7, 2
007
II. Project status@End of fourth project year
Significant amount of results Academic:
• scientific publications at all levels• several completed PhD’s • involvement in national and international events
Broader dissemination: workshops and courses Project execution is on schedule
Taking into account the project extension Priorities were fine-tuned during execution
Industrial validation: Spin-off projects Opportunities for feedback Continuous interest in practical validation !
8
Frid
ay D
ecem
ber
7, 2
007
Looking Back… Year 1
Project support activitiesVulnerability study and classification Inception of case studies
Feasibility study of engineering application-level security with AOSD
Study of techniques for tamper and analysis resistance
Study of interception techniques
9
Frid
ay D
ecem
ber
7, 2
007
Headlines of Year 2
Model for addressing code injection vulnerabilities Interrelations between point solutions in track I
(Languages and composition) E.g., security contracts as a language extension and a
vehicle for reasoning on composition Focus on component frameworks
Activating the software engineering track Study activities (incl. workshops)
Architecture for management and monitoring Survey of attack methods and options in application
protocols
First industrial validations
10
Frid
ay D
ecem
ber
7, 2
007
Headlines of Year 3
Release of dnmalloc Support for different types of security contracts
CAS, data dependencies, concurrency Fine-tuning of modularized access control Study of AOP security implications Refinement of secure development process activities
(leveraged, among others, by results of other tracks) Improved techniques for tamper and analysis
resistance Security management and monitoring applied to
the .Net platform
11
Frid
ay D
ecem
ber
7, 2
007
Headlines Y4: Track 1
General model for security contracts (PhD)
Language specification and static verification based on Spec#
Access Control Interfaces (PhD)
Security-tuned composition mechanism based on AOSD technology
AOPS, a permission system for dealing with AOP risks
Security architecture for third-party applications on mobile devices
12
Frid
ay D
ecem
ber
7, 2
007
Headlines Y4: Track 2
In-depth study and comparison of SDL, CLASP and Touchpoints has resulted in the activity matrix
Analysis and systematic support for security principles in process activities
Towards automated transition from requirements -> architecture
Survey of security patterns
13
Frid
ay D
ecem
ber
7, 2
007
Headlines Y4: Track 3
New techniques and attacks Cryptanalysis of White-Box DES Implementations
with Arbitrary External Encodings [SAC 2007] Remote attestation on legacy operating systems
with trusted platform modules [REM 2007]
Software Security Through Targeted Diversification [CoBaSSA 2007]
SoProTo - Software Protection Tool White-box cryptography Obfuscation transformations
14
Frid
ay D
ecem
ber
7, 2
007
Headlines Y4: Track 4
Application protocol checkerIntegration of protocol checker in
application-level firewall
15
Frid
ay D
ecem
ber
7, 2
007
Some numbers
Over 100 publications in 4 years (>10 researchers involved)
3 PhD’s completed, more coming up (Co-)organization of >10 dissemination
events Project specific workshops International conferences and workshops
>5 spin-off projects with industrial partners Intensive contacts with >10 partners from user
group
16
Frid
ay D
ecem
ber
7, 2
007
III. Valorization
A number of results are applicable in practical settings C/C++ memory allocator Protocol checking for web applications SSE process comparison Library of analysis / tamper resistance techniques
National and international contact networksSeveral spin-of projects have been created
17
Frid
ay D
ecem
ber
7, 2
007
Some of the spin-off projects
Pecman BcryptEHIP II (possibly starting in 2008)
18
Frid
ay D
ecem
ber
7, 2
007
Pecman: Personal Content Management
Project summary A user-centric solution enabling uniform
storage and manipulation of personal data as well as universal access to this data
Security-specific expectations Security service bus: an
architectural approach for crosscutting security enforcement
User-level policies, and their translation to system-level policies
http://projects.ibbt.be/pecman
19
Frid
ay D
ecem
ber
7, 2
007
BCRYPT: Belgian Fundamental Research on Cryptology and Information Security
Project summary Interuniversity Attraction Pole (IAP)
Concrete expectations Fundamental research: discrete mathematics,
cryptographic algorithms and protocols, watermarking, secure software, and secure hardware.
Application areas: secure documents, ultra low power crypto for sensor networks, ambient intelligence and RFID, mobile terminals, DRM and trusted computing
https://www.cosic.esat.kuleuven.be/bcrypt/
20
Frid
ay D
ecem
ber
7, 2
007
Industry segments
System Integrators and consultants (software development on a project base)
Product development companies Traditional Embedded systems Telecom Other (boundaries are vague)
Other stakeholders in software applications: business owner, system manager
21
Frid
ay D
ecem
ber
7, 2
007
Upcoming events
December 18-19, 2007 Remote EnTrusting by RUn-time Software auThentication (RE-TRUST) - Workshop, Leuven
March 3-7, 2008 Secure Application Development course, Leuven
July 22, 2008 Advanced Applications for the Electronic Identity Card (ADAPID) – Workshop, Leuven
July 23-25, 2008 The 8th Privacy Enhancing Technologies Symposium (PETS 2008), Leuven
To be announced OWASP event on secure software development processes
22
Frid
ay D
ecem
ber
7, 2
007
IV. Outlook
Finalization headlinesProvably correct inliner Improvement of verification techniquesValidation of AOP permission systemSoProTo
• Extended analysis front-end• Self-encrypting code module
Opportunities for validation ?Incubation of SoBeNeT II (SEC SODA)
23
Frid
ay D
ecem
ber
7, 2
007
SECSODA
Stands for SECure of SOftware in Distributed Applications …
IWT SBO ProposalDue January 2008Project: 2008-2012
24
Frid
ay D
ecem
ber
7, 2
007
Research Themes
Programming and Composition TechnologySoftware Engineering 4 SecurityTamper and Analysis ResistanceVerification
Application case studiesExtensions of practical technologies and
methodologies (WS, SOA, .NET, …)mailto: {bartd, wouter}@cs.kuleuven.be