DIKU Security Research Workshop 2019

More info about David Basin, Professor and Department Head, Department of Computer Science, ETH Zurich.

Title
Security Protocols: Model Checking Standards

Abstract
The design of security protocols is typically approached as an art, rather than a science, and often with disastrous consequences. But this need not be so! I have been working for ca. 20 years on foundations, methods, and tools, both for developing protocols that are correct by construction and for the post-hoc verification of existing designs. In this talk I will introduce my work in this area and describe my experience analyzing, improving, and contributing to different industry standards, both existing and upcoming.

More info about Alejandro Russo, Professor, Chalmers University of Technology.

Title
DPella: A Programming Framework for Differential Privacy with Accuracy

Abstract
Differential privacy offers a formal framework for reasoning about privacy and accuracy of computations on private data like those collected by IoT devices. It also offers a rich set of building blocks for constructing data analyses. When carefully calibrated, these analyses simultaneously guarantee privacy of the individuals contributing their data and accuracy of their results for inferring useful properties about the population. One important building block for differential privacy are composition theorems, which allow multiple differentially private data analyses to be composed together with a graceful degradation of the privacy and accuracy parameters. The compositional nature of differential privacy has motivated the design and implementation of several programming languages aimed at helping a data analyst in programming differentially private data analyses. However, most of the programming languages for differential privacy proposed so far provide support for reasoning about privacy but not for reasoning about accuracy of data analyses. To overcome this limitation, in this work we present DPella, a programming framework providing data analysts with support for reasoning about privacy, accuracy and their trade-offs. DPella is implemented as a domain specific language in the functional programming language Haskell. The distinguished feature of DPella is a novel component which statically tracks the accuracy of different data analyses. In order to make tighter accuracy estimations, this component leverages information-flow control techniques, in the form of taint analysis, for automatically inferring statistical independence of the different noise quantities added for guaranteeing privacy. We show the flexibility of our approach by implementing classical counting queries (e.g., CDFs) found in the literature and how DPella exposes the trade-offs between privacy and accuracy. Furthermore, we use DPella to analyze hierarchical counting queries (like those done by Census Bureaus), where accuracy have different constrains per level and data analysts should figure out the best manner to trade-off privacy to meet the accuracy requirements.

This talk is based on a joint work with Elisabet Lobo-Vesga, Marco Gaboardi, and Gilles Barthe.

More info about Ken Friis Larsen, Associate Professor, Department of Computer Science, University of Copenhagen.

Title
WebAssembly in the Linux Kernel

Abstract
TBA

More info about Thomas Hildebrandt, Professor, Department of Computer Science, University of Copenhagen.

Title
Security Policies, Processes and Workflows as Dynamic Condition Response (DCR) Graphs

Abstract
Most formal approaches to verification and enforcement of security policies goes through an initial step of formalisation from natural text to formal model, e.g. as a variant of temporal logic or automata. As in any translation, the meaning may change during the formalisation process, and it may be required to analyse the interplay between the policy and other processes, such as workflows, and subsequently revise the formalisation. The talk presents the Dynamic Condition Response (DCR) Graphs notation and tools from DCRSolutions.net for iterative formalisation of security policies and workflows, which have been developed through the last 10 years in joint research and innovation projects.

More info about Boris Düdder, Assistant Professor, Department of Computer Science, University of Copenhagen

Title
Production Infrastructure and Cybersecurity: Potentials and risks in sensor applications

Abstract
Industrial production systems make the transition from digitally supported to (smart) digitally connected in the Industry 4.0 paradigm. The connection allows for automation and data exchange between production units and control following the four design principles of (1) interconnection, (2) information transparency, (3) technical assistance, and (4) decentralized decisions. The smart manufacturing builds on IT-based components, e.g., cyber-physical systems or IoT. Such a smart manufacturing system is embedded in supporting infrastructure as a smart factory. The talk will focus on the security challenges of the supporting infrastructure, especially on facilities.