Frank Stajano Presented by Patrick Davis 1

 Ubiquitous Computing ◦ Exact concept inception date is unknown ◦ Basically background computing in life  Pervasive Computing  Invisible / Disappearing Computing  Sentient Computing  Ambient Intelligence  Calm computing ◦ Different things to different people  Security ◦ A virus broke my toaster and now my freezer won’t work! 2

 Security is Risk Management  Defender thinks about ◦ I have gold in my house - Asset ◦ Someone can steal my gold - Threats ◦ I leave the front door unlocked - Vulnerabilities ◦ A thief can walk into the front door - Attacks ◦ It costs a lot of money to replace the gold -Risks ◦ Get a few dogs – Safeguards ◦ Release the hounds - Countermeasure 3

 Not a complete list but traditionally… ◦ Confidentiality ◦ Integrity ◦ Availability  To mitigate these risks ◦ Authentication  Identification  Verification ◦ Authorization 4

 Mobile Phone ◦ What do you lose if some one steals the device  Cost of the device  Information On the device  Availability of the device  Your Identification (if the phone is used as a credit card) ◦ What if the phone is hacked. (How do you know it isn’t)  Information on the phone is compromised  Components on the phone are compromised  Microphone  Your current location  Your current soundings 5

 How important does it seem to be?  How important is it?  Think like the enemy… 6

 What happens when you record every aspect of your life. ◦ What if I wore one?  What kind of things would you be ok with sharing  How much do you want protect these ◦ From your own memory loss ◦ From hackers  How close are we to this already 7

 Phones are sending location back almost 24 hours a day  One of the ways to get maintain privacy is to make each location marker anonymous  Another way is to have the interested parties broad cast their services and the users pickup or disregard those services as needed  The author disregards the situation where the location of any user (anonymous or not) is a security risk 8

 Basically barcodes that can remotely identify themselves  Can be powered by the request to read the tag  Economics of scale should bring down the price of RFIDs  Can be used as machine vision where as the vision is basically viewed as positions of the RFIDs  Are limited in processing ability meaning cryptology is limited 9

 Some Safe Guards are ◦ Killing the Tag ◦ Hash-based access control ◦ Randomized Access Control ◦ Silent tree walking ◦ Blocker-tag ◦ Anti-Counterfeiting using PUFs ◦ Distance bounding protocols ◦ Multi-Factor Access Control in e-passports 10

 In UbiComp the server authenticates the client and if it is allowed does the requested actions.  A couple principles in authentication ◦ Big Stick ◦ Resurrecting Duckling ◦ Multi Channel Protocols 11

 The mother duck is the master and the duckling is the slave  Based on a set of four principles ◦ Two State principle ◦ Imprinting Principle ◦ Death Principle ◦ Assassination Principle 12

 Data Origin Authenticity  DiffieHellman key exchange  Man in the middle attack  Have two channels ◦ A high capacity Channel for “long” messages ◦ A low capacity Channel for Data-Origin authentication 13

 Do you really like entering your password for every site?  Why do we have single sign on or Identity Management (Face book sign on)  How do we get around password ◦ Tokens ◦ Biometrics 14

 Security is only to prevent dishonest people from performing bad Actions  This often gets in the way of honest user’s activities  Tax on the honest 15

 We must view though someone else's eyes ◦ The attacker ◦ The user  Quote: ◦ Security cannot depend upon the user’s ability to read a message from the computer and act in an informed and sensible manner […] a machine must be secure out of the factory if given to a user who cannot read ◦ Meaning the security glove must fit the user comfortably but still stop the attacker 16

 Systems are sold on the basis of features.  Customers really only care about security in terms of particular scenarios  Security features cost money to implement clients see security as an extra or just another feature that they never see.  Again how important is privacy… ◦ Client must have a bad experience with security in order to see the importance of good security 17

18 QUESTIONS?