1. The School of Electrical Engineering and Computer Science (EECS) CS/ECE Advanced Network Security Dr. Attila Altay Yavuz Topic 1.0 Big Picture, Vision Advanced Network Security Dr. Attila Altay Yavuz1Fall 2014

2. OSU EECS Dr. Attila Altay Yavuz 2 Outline (next 3 lectures) Self-introduction –Background and common interest areas Big Picture –Grand-vision, problems and challenges Course Objectives ( overview) –Touching important problems and tools (name & functionality) –Grading Overview of Project Topics (2 lectures, discussions) –Discover problem landscape, important techniques and crypto tools –Decision on your topic, assess your background/commitment

3. OSU EECS Dr. Attila Altay Yavuz 3 Self-Intro Assistant Professor, EECS at Oregon State University Adjunct Faculty, University of Pittsburgh (Jan. 2013 - now) Research Scientist, Bosch Research Center (Dec. 2011- Aug. 2014) –Develop security and privacy research programs –Privacy-preserving Big Data Technologies (~1M) –Secure Internet-of Things and Systems (~250K) Ph.D., North Carolina State University (Jan. 2007- Aug. 2011) –Compromise Resilient and Compact Crypto for Digital Forensics MS, Bogazici University (2004-2006) –Efficient Crypto Mechanisms for Military Ad-hoc Networks

4. OSU EECS Dr. Attila Altay Yavuz 4 Self-Intro (Cont’) Research Interests: Applied cryptography, network security, privacy Academic Collaborations: Upitt, UNC, UCI, Purdue-CIT, CMU Industry Collaborations: Bosch, Oracle, Cisco, SEI-CMU, ISE Some Impact Examples: ECU Privacy-Preserving Medical Databases (HCTM, 2016) Secure Intra-car Networks (OEMs, 2018)

5. OSU EECS Medium term Long term Near term Big Picture: Technology Trends & Vision Smart-infrastructures and distributed systems Big Data Technologies Cloud-based Applications Smart Home Inter vehicular networks Smart-grid Smart-city Digitalized Healthcare Inf. Sys. 5

6. Challenges of Security and Privacy in IoTS Requirements and Challenges Cloud-based Services Smart-home and WSNs Heterogeneity Vehicular networks (e.g., Car-2-X) High Performance/Scalability Data Availability Interconnectivity 6 SOMETHING MISSING?

7. Need for Privacy Enhancing Technologies 7 Privacy Breaches: Big Data and IoTS

8. OSU EECS Cyber Physical Systems - Vulnerabilities Reliable Cyber-Physical Systems (e.g., smart-grid) are vital – Susceptible: Northeast blackout (2003), 50 million people, $10 billion cost – Attacks: False data injection [Yao CCS09’], over 200 cyber-attacks in 2013 Vulnerability: Commands and measurements are not authenticated Requirements for a security method – Real-time  Extremely fast processing (a few ms) – Limited bandwidth  Compact – Several components  Scalability Limitations of Existing Methods – PKC is not yet feasible (computation, storage, tag size) – Symmetric crypto is not scalable (key management ) 8

9. OSU EECS Security Challenges for Smart-Infrastructures (II) 9 Internet ECU Vulnerability: Commands and measurements are not authenticated Security for Inter-car Networks – Manipulate direction/velocity, crashes Security for Intra-car Networks – Large attack surface [Usenix '11] – ECUs of break/acceleration, airbag Challenges – Strict safety requirements – Limited bandwidth, real-time processing The state-of-art cannot address (as discussed) Inter-car and Intra-car Networks

10. OSU EECS Heterogeneity: Resource-Constraints vs. Efficiency Requirements –Designing efficient cryptographic primitives for resource-constrained systems –Code-size, battery issues, transmission range, cost Scalability: Key Distribution vs. Efficiency Requirements –Symmetric crypto, O(n^2) key distribution, very fast but not scalable –Public key, how to distribute certificates? Outsourcing vs. Privacy/Integrity Dilemma –How to operate on the encrypted data efficiently? How to ensure the integrity? Usability vs. Security –Authenticate users in a friendly manner, friendly policies Interconnectivity and increased attack surface –Design new threat and security models capturing IoTS applications 10 Some Challenges – About This Course