Bio: Michael Reiter is the Lawrence M. Slifkin Distinguished Professor in the Department of Computer Science at the University of North Carolina at Chapel Hill. His research interests include all areas of computer and communications security and distributed computing. His professional responsibilities during his career so far have included Director of Secure Systems Research at Bell Labs; founding Technical Director of CyLab at Carnegie Mellon University; program chair for the the flagship computer security conferences of the IEEE, the ACM, and the Internet Society; and Editor-in-Chief of ACM Transactions on Information and System Security, among others. Dr. Reiter was named an ACM Fellow in 2008 and an IEEE Fellow in 2014.

TITLE: Side-Channels in Multi-Tenant Environments

Abstract:
Due to the massive adoption of computing platforms that consolidate potentially distrustful tenants' applications on common hardware --- both large (public clouds) and small (smartphones) --- the security provided by these platforms to their tenants is increasingly being scrutinized. In this talk we review highlights from the last several years of research on a long-suspected but, until recently, largely hypothetical attack vector on such platforms, namely "side-channel attacks". In these attacks, one tenant learns sensitive information about another tenant simply by running on the same hardware with it, but without violating the logical access control enforced by the platform's isolation software (virtual machine monitor or operating system). We will then summarize various strategies we have explored to defend against side-channel attacks in their various forms, both inexpensive defenses against specific attacks and more holistic but expensive protections.

Bio: Gene Tsudik is a Chancellor's Professor of Computer Science at the University of California, Irvine (UCI). He obtained his PhD in Computer Science from USC in 1991. Before coming to UCI in 2000, he was at IBM Zurich Research Laboratory (1991-1996) and USC/ISI (1996-2000). Over the years, his research interests included many topics in security and applied cryptography. He is the Director of Secure Computing and Networking Center (SCONCE) at UCI. Gene Tsudik is a former Fulbright Scholar and a fellow of the ACM and the IEEE. From 2009 to 2015 he served as the Editor-in-Chief of ACM Transactions on Information and Systems Security (TISSEC).

TITLE: Secure and Private Proximity-Based Discovery of Common Factors in Social Networks

Abstract:
The recent decade has witnessed a rapid increase in popularity of mobile personal devices (notably, smartphones) that function as all-purpose personal communication portals. Concurrently, On-line Social Networks (OSNs) have continued their impressive proliferation. Meanwhile, the notion of "OSN privacy" remains elusive and even self-contradictory. Centralized nature of prominent OSNs is unlikely to change, which does not bode well for OSN users' privacy. However, some user privacy can be gained from making certain OSN functionality available off-line, such as discovering common contacts and other features, as well as establishing affinity-based connections. OSNs stand to gain from this, since users could avail themselves of OSN functionality in scenarios where none currently exists, e.g., whenever Internet connectivity is unavailable, expensive or insufficient. At the same time, OSN users benefit from increased privacy because off-line interactions are invisible to OSN providers.

This talk will explore off-line private proximity-based use of OSNs and will present a working system (called UnLinked) that is grafted atop a popular OSN -- LinkedIn. One key challenge is how to ensure integrity, authenticity and privacy of users' profile information when they engage in off-line interactions. This can be addressed via specialized privacy-agile cryptographic protocols. This talk will overview the design, architecture and functionality of UnLinked and will highlight important outstanding issues.

Bio: Steven M. Bellovin is the Percy K. and Vidal L. W. Hudson Professor of computer science at Columbia University, where he does research on networks, security, and especially why the two don't get along, as well as related public policy issues. In his spare professional time, he does some work on the history of cryptography. He joined the faculty in 2005 after many years at Bell Labs and AT&T Labs Research, where he was an AT&T Fellow. He received a BA degree from Columbia University, and an MS and PhD in Computer Science from the University of North Carolina at Chapel Hill. While a graduate student, he helped create Netnews; for this, he and the other perpetrators were given the 1995 Usenix Lifetime Achievement Award (The Flame). Bellovin has served as Chief Technologist of the Federal Trade Commission. He is a member of the National Academy of Engineering and is serving on the Computer Science and Telecommunications Board of the National Academies, the Department of Homeland Security's Science and Technology Advisory Committee, and the Technical Guidelines Development Committee of the Election Assistance Commission; he has also received the 2007 NIST/NSA National Computer Systems Security Award and has been elected to the Cybersecurity Hall of Fame.

TITLE: Thinking Security

Abstract:
Many computer applications are bound to a particular point in time; more precisely, to a given set of technologies and costs. The same is true of computer security. Unfortunately, once something becomes possible people become wedded to it, and never look back at the environment and assumptions that made it possible or even necessary. This is especially serious for security, since it causes us to endure the costs and annoyances of marginally useful (or even harmful) mechanisms while blinding us to newer threats. What can be done? How can we recognize the implicit assumptions in what we're doing? Can we do better in the future? How do differing threat models affect the question?