Security and Privacy of High Impact Computer Applications

点击翻译按钮获取中文摘要

This research explores security and privacy problems in several high-impact, widely-used computer applications and cloud-based services. The use of any security-sensitive applications currently requires a leap of faith as users have no easy way of verifying that a computer system is malware-free, and that users are not being fooled by a phishing/spoofing attack. Most security tools are implicitly designed for expert users, require user diligence, and at best can provide only limited protection against even common malware threats, let alone advanced, state-sponsored attacks. On the other hand, participation of everyday users on the Internet in recent years has seen phenomenal growth, mostly facilitated by 'free' web services from for-profit corporations -- with the expectation that businesses can generate money from their unrestrained access to user data. What has been sharply lost in this process is, users' privacy, or even the expectation of privacy. CEOs of Sun Micorsystems, Google and Facebook remarked at various time to the effect that "privacy is dead." From a research perspective, designing privacy-preserving techniques for web services is complicated by the requirement of balancing security and ease-of-use needs of everyday users. The proposed research focuses on three goals: (a) leverage existing and newly introduced hardware security features to enhance the foundation of low-level system software layers to better support security-critical applications; (b) design privacy-preserving architectures and techniques given that users will continue exchanging data through cloud-based services; (c) deal with the "unmotivated user" problem by integrating security/privacy mechanisms with the functioning of the system itself. Overall, the proposed research addresses important privacy concerns of today's digital citizens, offers high-assurance techniques for businesses and government agencies, and helps increase trustworthiness of computing systems.