CS 252r: Advanced Topics in Programming Languages

NOTE: Schedule is subject to change.

Lec.	Date	Topic	Readings	Notes
Science of CyberSecurity
1	Tue 3-Sep	Introduction	Blueprint for a Science of Cybersecurity by Fred B. Schneider. The Next Wave. Vol 19, No. 2 (2012), 47-57.	Steve
2	Thu 5-Sep	Noninterference	Language-based Information-Flow Security by Sabelfeld and Myers. IEEE Journal on Selected Areas in Communications, 2003 Learning is Change in Knowledge: Knowledge-based Security for Dynamic Policies, by Askarov and Chong, CSF 2012	Steve
3	Tue 10-Sep	Limits of models	The Limits of Formal Security Models by Dorothy E. Denning, National Computer Systems Security Award Acceptance Speech. 20 years of covert channel modeling and analysis by Jon Millen, IEEE S&P, 1999. Noninterference, who needs it? Peter Ryan, John McLean, Jon Millen, Virgil Gligor (Panel from CSF 2001)	Steve
4	Thu 12-Sep	Hyperproperties	Hyperproperties by Clarkson and Schneider, Journal of Computer Security, 18(6):1157-1210, 2010.	Steve
5	Tue 17-Sep	Models for Cryptographic Security		Steve
Language-based Capabilities and Access Control
6	Thu 19-Sep	Protection	Protection by B.W. Lampson (Operating Systems Review 8:1) A Note on Confinement by B.W. Lampson (CACM 16:10) Protection in Operating Systems by M.A. Harrison et al. (CACM 19:8) Protection: principles and Practice by G.S. Graham and P.J. Denning (AFIPS 1972) The Confused Deputy (or Why Capabilities Might Have Been Invented) by N. Hardy (Operating Systems Review 22:4, 1988) The protection of information in computer systems by J.H Saltzer and M.D. Schroeder (Proceedings of the IEEE 63:9, 1975)	Christos
7	Tue 24-Sep	Bell-LaPadula and PSOS	Looking Back at the Bell-LaPadula Model by D.E. Bell (ACSAC 2005) PSOS Revisited by P.G. Neumann and R.J. Feiertag (ACSAC 2003)	Christos
8	Thu 26-Sep	KeyKOS	KeyKos Architecture by N. Hardy (Operating Systems Review 19:4, 1985) On Security in Capability-Based Systems by L. Gong (Operating Systems Review 23:2, 1989) Security in a Secure Capability-Based System by C.R. Landau (Operating Systems Review 23:4, 1989)	Steve
9	Tue 1-Oct	Eros	EROS: A Fast Capability System by Shapiro, Smith, and Farber (SOSP 1999) Verifying the EROS Confinement Mechanism by J.S. Shapiro and S. Weber (S&P 2000)	Jao-ke Project proposals due.
10	Thu 3-Oct	Capsicum	Capsicum: Practical Capabilities for UNIX by Watson, Anderson, Laurie, and Kennaway (USENIX Security 2010) Declarative, Temporal, and Practical Programming with Capabilities by Harris, Jha, Reps, Anderson, and Watson (S&P 2013)	Dan B.
11	Tue 8-Oct	Object Capabilities	Paradigm Regained: Abstraction Mechanisms for Access Control by M.S. Miller and J.S. Shapiro (ASIAN 2003) The Structure of Authority: Why Security is not a Separate Concern by Miller, Tulloh, and Shapiro (MOZ 2004) Delegating Responsibility in Digital Systems: Horton's "Who Done It?" by Miller, Donnelley, and Karp (HotSec 2007) Capability Myths Demolished by Miller, Yee, and Shapiro (Tech Report SRL2003-02)	Christos
12	Thu 10-Oct	Capability Safe Programming Languages	Joe-E: A Security-Oriented Subset of Java by Mettler, Wagner, and Close (NDSS 2010) Caja: Safe Active Content in Sanitized JavaScript by Miller, Samuel, Laurie, Awad, and Stay (Google white paper, 2007) Object Capabilities and Isolation of Untrusted Web Applications by Maffeis, Mitchell, and Taly (S&P 2010)	Scott
13	Tue 15-Oct	Stack-Based Access Control	Understanding Stack Inspection by D.S. Wallach and E.W. Felten (S&P 1998) Stack Inspection: Theory and Variants by C. Fournet and A. Gordon (TOPLAS 25:3, 2003)	Lucas
14	Thu 17-Oct	History and Role-Based Access Control	Access Control Based on Execution History by M. Abadi and C. Fournet (NDSS 2003) Role-Based Access Control by D.F. Ferraiolo and D.R. Kuhn (NCSC 1992) (Alternative download site during govt. shutdown)	Louis
15	Tue 22-Oct	Practical Extensible Access Control Frameworks	Practical Domain and Type Enforcement for UNIX by Badger, Sterne, Sherman, Walker, and Haghighat (S&P 1995) Design and implementation of the Trusted BSD MAC framework by Watson, Feldman, Migus, and Vance (DARPA Information Survivability Conference and Exposition, 2003) (See also A Decade of OS Access-Control Extensibility by Robert N. M. Watson, CACM 56:2)	Dan K. slides
Quantitative Information-Flow and Anonymity
16	Thu 24-Oct	Quantitative Information Flow	On the Foundations of Quantitative Information Flow by G. Smith (FOSSACS 2009) Automatic Discovery and Quantification of Information Leaks by M. Backes, B. Kopf, and A. Rybalchenko (S&P 2009)	Aslan
17	Tue 29-Oct	Quantitative Information Flow	Quantifying Information Flow with Beliefs by M. Clarkson, A.C. Myers, and F.B. Schneider (JCS 2009) Dynamic Enforcement of Knowledge-based Security Policies using Probabilistic Abstract Interpretation by Mardziel, Magill, Hicks, and Srivatsa (JCS 2013)	Jao-ke
18	Thu 31-Oct	Quantitative Information Flow	Measuring Information Leakage using Generalized Gain Functions by Alvim, Chatzikokolakis, Palamidessi, and Smith (CSF 2012) Abstract channels, gain functions and the information order by Espinoza, McIver, Meinicke, Morgan, and Smith (FCS 2013). Slightly longer version Contact Steve for an updated unpublished version of this paper.	Scott
19	Tue 5-Nov	Side channels	Preventing Side-Channel Leaks in Web Traffic: A Formal Approach by M. Backes, G. Doychev, and B. Kopf. (NDSS 2013)	Lucas
20	Thu 7-Nov	Bitcoin	Bitcoin: A Peer-to-Peer Electronic Cash System by Nakamoto	Aslan
21	Tue 12-Nov	Privacy	Robust De-anonymization of Large Sparse Datasets by A. Narayanan and V. Shmatikov (S&P 2008)	Dan K.
22	Thu 14-Nov	Anonymous communication	A Survey of Anonymous Communication Channels by G. Danezis and C. Diaz (Microsoft Research TR 2008) Why I'm not an Entropist by P. Syverson. (SPW 2009)	Louis
23	Tue 19-Nov	Onion Routing	Tor: The Second-Generation Onion Router by R. Dingledine, N. Mathewson, and P. Syverson (USENIX Security 2004) A formal treatment of onion routing by J. Camenisch and A. Lysyanskaya (CRYPTO 2005)	Aslan
24	Thu 21-Nov	Anonymity	Dissent: Accountable Group Anonymity by H. Corrigan-Gibbs and B. Ford (CCS 2010)	Dan B.
25	Tue 26-Nov	Anonymity	AnoA: A Framework For Analyzing Anonymous Communication Protocols by Backes, Kate, Manoharan, Meiser, and Mohammadi (CSF 2013)
Thanksgiving
26	Tue 3-Dec	Project presentations
	Wed 11-Dec	Projects due