Endeavour Security and assurance

1
EndeavourSecurity and assurance

• Doug Tygar
• tygar_at_cs.berkeley.edu
• UC Berkeley
• 25 May 1999

2
ChallengesProtocols and Mobile Applications

• Two sides for mobile applications
• protecting the remote host from the mobile code
• protecting the mobile code from the remote host!
• Automatic generation of best security protocol
• Ad hoc and temporal access control
• Access control/security negotiation
• Use of cryptographic hardware tokens
• How to evaluate, build, break tamper-resistant
  boundaries
• Differential power analysis

3
Wider challenges

• Microauctions/economics for resource control
• Rights management tagging
• Design for survivability
• All of this with privacy

4
Plan

• One year
• Synthesis of code for optimal security protocols
• Toolkit for cryptographic key management for
  mobile code
• Design of ad hoc and temporal access control
• Little TEMPEST protection for hardware tokens
• Three year
• Integration with applications across Endeavour
• Privacy analysis for high assurance mechanisms
• Automatic or semi-automatic resource allocation
  using micro-auctions.
• High survivability mechanisms

5
(No Transcript)
6
Latest wrinkle -- power analysis attacks

• Publicized by Paul Kocher et al.
• Use current drawn by device to read off
  cryptographic key
• Typical MOS Transistor

7
Simple Power Analysis
8
Differential Power Analysis
9
(No Transcript)