Invited Speakers

Michael Gerard Hinchey is an Irish computer scientist and Director at the Irish Software Engineering Research Centre (Lero), a multi-university research centre headquartered at the University of Limerick, Ireland, former Director of the NASA Software Engineering Laboratory at NASA Goddard Space Flight Center and is the founding editor-in-chief of the NASA journal Innovations in Systems and Software Engineering.

Building Resilient Space Exploration Systems (Video of the presentation)

Andrei Sabelfeld is a Professor in the Department of Computer Science and Engineering Chalmers University of Technology in Gothenburg, Sweden and in the Gothenburg University, Sweden.

Taint Tracking without Tracking Taints (Video of the presentation)

Taint tracking has been successfully deployed in a range of security applications to track data dependencies in hardware and machine-, binary-, and high-level code. Precision of taint tracking is key for its success in practice: being a vulnerability analysis, false positives must be low for the analysis to be practical. This talk presents an approach to taint tracking, which does not involve tracking taints throughout computation. Instead, we include shadow memories in the execution context, so that a single run of a program has the effect of computing on both tainted and untainted data. On the theoretical side, we present a general framework and establish its soundness with respect to explicit secrecy, a policy for preventing insecure data leaks, and its precision showing that runs of secure programs are never modified. We show that the technique can be used for attack detection with no false positives. On the practical side, we present DroidFace, leveraging the approach by a source-to-source transform, and benchmark its precision and performance with respect to state-of-the-art static and dynamic taint trackers for Android apps. The results indicate that the performance penalty is tolerable, while achieving no false positives/negatives on the standard benchmarks.

Joint work with with Daniel Schoepe, Musard Balliu, and Frank Piessens.

Sriram Rajamani - Managing Director of Microsoft Research India.

Trusted Cloud: How to make the cloud more secure (Video of the presentation)

Cloud computing is growing because of cost advantages and convenience it offers to customers. However, security and privacy continue to be major concerns. We wish to guard against a powerful adversary who can compromise the CloudOS, and uses all privileges of the CloudOS to compromise the integrity and confidentiality of user applications. Secure hardware and/or small trusted hypervisors are the main weapons in our arsenal to guard against such powerful adversaries. Secure hardware (such as Intel SGX) enables user mode applications to package code and data into regions that are isolated from all other software running on the machine. Isolated regions can also be implemented with a small trusted hypervisor. However, it is an open research question as to how entire cloud services can be built using trusted hardware as a primitive, while maintaining a small TCB, providing good performance and end-to-end security guarantees. The Trusted Cloud project at Microsoft Research explores ways to answer this question, and it builds on techniques spanning hardware, OS, compilers and verification tools. In this talk, I will describe our efforts on architecting trusted and more secure cloud services using these principles.