0CI01(01712720): Information Security Engineering(Fall 2017)

Time: Wednesday 14:00-17:00

Location: 3305 , Teaching Builing, DaXing

Class web site: https://huipingsun.github.io/ise2017

Instructor: Huiping Sun (sunhp(at)ss.pku.edu.cn)

TA: Haotian Hao (hht(at)pku.edu.cn)

Course Description

Although most of traditional cryptography and security techology are relatively well understood, the knowledge and practice of how to apply user's economical, psychological and social factor into security is insufficient.

The course covers the basics of economics, psychology and socialology of security, and introduces password, biometrics, CAPTCHA, fingerprinting, physical protection, reputation, privacy and others technology, in the meantime, analyses how to implement information security engineering in some critical information systems and applications such as payment, crowdsource, and smartphone.

Course Textbook

Textbook: Ross Anderson. Security Engineering: A Guide to Building Dependable Distributed Systems. Second Edition. Wiely. 2008.

Course Schedule

Date	Topics	Readings
September 13	01. Introduction [Slides]	Ross Anderson. Security Engineering (Second Edition). Chapter 1: What Is Security Engineering? [Homework] Ross Anderson. Why Information Security is Hard - An Emconmics Perspective. In Proc. ACSAC'2001.
September 20	02. Usable Security [Slides]	Ross Anderson. Security Engineering (Second Edition). Chapter 2: Usability and Psychology. [Homework] Alma Whitten and J.D.Tygar. Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0. In Proc. USENIX Security'1999. Anne Adams and Martina Angela Sasses. Users Are Not The Enemy. Communications of ACM. 1999. Lorrie Faith Cranor. A Framework for Reasoning About the Human in the Loop. In Proc. UPSEC'2008. Bruce Schneier. The Psychology of Security. 2008. Huiping Sun et al. SlidePIN: Slide-Based PIN Entry Mechanism on a Smartphone. In PASSWORDS'2014.
September 27	03. Graphical Password [Slides]	Robert Biddle et al. Graphical Passwords: Learning from the First Twelve Years. ACM Computing Surveys. 2012. Florian Schaub et al. Exploring the Design Space of Graphical Passwords on Smartphones. In Proc. SOUPS'2013. [Homework] Huiping Sun et al. PassApp: My App is My Password! In Proc. MobileHCI'2015.
October 11	04. Text Password [Slides]	Ross Anderson. Security Engineering (Second Edition). Chapter 2.4: Passwords Cormac Herley and Paul van Oorschot. A Research Agenda Acknowledging the Persistence of Passwords. IEEE Security & Privacy Magazine. 2012. Joseph Bonneau et al. Passwords and The Evolution of Imperfect Authentication. Communications of ACM. 2015. Ari Juels and Ronald L. Rivest. Honeywords-Making Password-Cracking Detectable. In Proc. CCS'2013. [Homework]
October 18	05. Biometrics [Slides]	Ross Anderson. Security Engineering (Second Edition). Chapter 15: Biometrics John D.Woodward Jr. et al. Biometrics: Identity Assurance in the Information Age. McGraw-Hill/Osborne. 2003. Weizhi Meng et al. Surveying the Development of Biometric User Authentication on Mobile Phones. IEEE Communication Survey & Tutorials. 2014. Addulaziz Alzubaidi and Jugal Kalita. Authentication of Smartphone Users Using Behavioral Biometrics. In IEEE Communication Survey & Tutorials. 2015. Yan Li et al. Seeing Your Face Is Not Enough: An Inertial Sensor-Based Liveness Detection for Face Authentication. In Proc. CCS'2015. Zahid Akhtar et al. Biometric Liveness Detection: Challenges and Research Opportunities. IEEE Security & Privacy Magazine. 2015. [Homework]
October 25	06. Project Proposal 01-04 [Slides]	Hristo Bojinov et al. Neuroscience Meets Cryptography-Crypto Primitives Secure Against Rubber Hose Attacks. Communications of ACM. 2014. [Homework]
November 01	07. Project Proposal 05-09 [Slides]	Jay Aikat et al. Rethinking Security in the Era of Cloud Computing. IEEE Security & Privacy Magazine. 2017. [Homework]
November 08	08. Human Computation [Slides] & CAPTCHA [Slides]	Edith law and Luis von Ahn. Human Computation. Synthesis Lectures on Artificial Intelligence and Machine Learning 2011. [Homework: Part II Design] Alexander J. Quinn and Benjamin B. Bederson Human Computation: A Survey and Taxonomy of a Growing Field. In Proc. CHI'2011. Gerardo Reynaga. The Usability of CAPTCHAs on Mobile Devices. Chapter 2: Backgrounds. PhD. Dissertation. Carleton University. 2015. Suphannee Sivakorn et al. I Am Robot- (Deep) Learning to Break Semantic Image CAPTCHAs. In Proc.EuroSP 2016.
November 15	09. Physical Security [Slides]	Ross Anderson. Security Engineering (Second Edition). Chapter 11: Physical Protection Ross Anderson. Security Engineering (Second Edition). Chapter 14: Security Printing and Seals Ross Anderson. Security Engineering (Second Edition). Chapter 16: Physical Tamper Resistance Ross Anderson. Security Engineering (Second Edition). Chapter 17: Emission Security Refael Veras et al. Fingerprinting Web Users through Font Metrics. In Proc. FC'2015. Saranga Komanduri et al. Device Fingerprinting for Augmenting Web Authentication: Classification and Analysis of Methods. In Proc. ACSAC'2016. Jeremiah Blocki et al. Beauty and the Beast: Diverting Modern Web Browsers to Build Unique Browser Fingerprints. In Proc. IEEE SP'2016. [Homework]
November 22	10. Reputation [Slides]	Paul Resnick et al. Reputation System. In Communications of the ACM. 2000. Lik Mui et al. A Computational Model of Trust and Reputation. In Proc. HICSS'2002. Audun Josang et al. A Survey of Trust and Reputation Systems for Online Service Provision. In Decision Support Systems. 2007. Steven Tadelis. The Economics of Reputation and Feedback Systems in E-Commerce Marketplaces. In IEEE Internet Computing Magazine. 2016. [Homework]
November 29	19. Access Control [Slides]	Ross Anderson. Security Engineering (Second Edition). Chapter 4: Access Control Ross Anderson. Security Engineering (Second Edition). Chapter 8: Multilevel Security Ross Anderson. Security Engineering (Second Edition). Chapter 9: Multilateral Security Audun Jøsang et al. User Centric Identity Management. In Proc. AusCERT'2005. Phillip Windley. Digital Identity: Unmasking Identity Management Architecture (IMA). O'Reilly Media,2008. Gaurav Misra et al. PACMAN: Personal Agent for Access Control in Social Media. In IEEE Internet Computing 2017. [Homework]
December 06	12. Privacy [Slides] & Bitcoin I [Slides]	Ross Anderson. Security Engineering (Second Edition). Chapter 23: The Bleeding Edge Arvind Narayanan et al. Bitcoin and Cryptocurrency Technologies. Chapter 1: Introduction to Cryptography & Cryptocurrencies. 2016. Ashwin Machanavajjhala et al. Designing Statistical Privacy for Your Data. Communications of ACM. 2015. [Homework]
December 13	13. Bitcoin II [Slides]	Arvind Narayanan et al. Bitcoin and Cryptocurrency Technologies. Chapter 2: How Bitcoin Achieves Decentralization. 2016. Arvind Narayanan et al. Bitcoin and Cryptocurrency Technologies. Chapter 3: Mechanics of Bitcoin. 2016. Arvind Narayanan et al. Bitcoin and Cryptocurrency Technologies. Chapter 4: How to Store and Use Bitcoin. 2016. Aviv Zohar. Bitcoin: Under the Hood. Communications of ACM. 2015. [Homework]
December 20	14. Bitcoin III [Slides]	Arvind Narayanan et al. Bitcoin and Cryptocurrency Technologies. Chapter 5: Bitcoin Mining.2016. Arvind Narayanan et al. Bitcoin and Cryptocurrency Technologies. Chapter 6: Bitcoin and Anonymity. 2016. Nethanel Gelernter et al. The Password Reset MitM Attack. In Proc. IEEE Symposium on Security and Privacy. 2017. [Homework]
December 27	15. Final Project Presentations I [Slides]	No
January 03	16. Final Project Presentations II [Slides]	No

Course Grading

The grading scheme is as follows:

60%: Readings + Quizzers + Presentations
40%: Project

Course Projects

Voice authentication
Face authentication
Slide-based PIN
Chinese-based Graphical Password
Public WIFI Security
Attack on Text-based CAPTCHA
Image-Based CAPTCHA

0CI01(01712720): Information Security Engineering(Fall 2017)

Course Description

Course Textbook

Course Schedule

Date

Topics

Readings

Course Grading

Course Projects

Course References