Untitled Document

CmpE 297

Software Security Technologies

Spring 2005

Instructor

Richard Sinn
Email: richardsinn@yahoo.com
Office Hours: Before / After class, by appointment or email only

Richard Sinn has been in the pure software industry for over 10 years both as manager and lead developer for projects ranging from IBM operating systems, kernel file system, network computer, Java desktop, IT secure development framework, IBM DB2 database, security and provisioning services.

In 2001, Richard led the development of the first dynamic workflow enabled PKI Certificate Management System (CMS) in the industry. It is a joint project between VeriSign and a Silicon Valley security startup company. There are currently eight patents (six in security technologies, and two in database technologies) pending under Richard’s name.

Richard has also been a part-time professor for the past five years teaching at San Jose State University (both Computer Science and Computer Engineering departments) and University of Minnesota.

Announcements

Update: Classroom is moved to ENG 335 !!!

Class time:

Tuesday, 7:30pm to 9:15pm

Class room:

This is Section 4

ENG 335

Initial creation.

Environment

Please consider how you set up your evaluation environments - be it homework, on-campus quizzes and exams, to minimize chances of (temptations to) cheating.

In particular:

During tests:

- Make sure there is plenty of space between students.

- Always proctor exams and tests, and preferably by sitting at the back of the room rather than at the front. Do not leave the testing room during the test. If you cannot proctor the class yourself, contact me and I will endeavor to find a proctor for you.

- If the test is closed-book, require all backpacks to be zipped shut, all PDAs, computers and phones to be handed in, and any access to either without explicit proctor permission should be an immediate F in the class.

For homework: We have started using on-line support systems to catch cheaters. So I would very strongly urge you:

- For code assignments: Run them all through MOSS

- For essays etc: Run them all through turnitin.com (SJSU has a site subscription, I have been told.)

- Make sure individual contributions are ensured in team projects. This can be done through various means: Sign-offs, quizzes on the content of common work, etc.

Remember: A grade reflects an evaluation of the individual student's achievements. Your evaluation system has to reflect that objective.

Course Information

Objectives

Latest corporation challenge is managing software security threats on high speed, high volume mission critical software infrastructure. Building secure software in both the Internet and enterprise network becomes a must in today's world. The objective of this course is to teach you the essentials to build and deploy secure software. Learn how to design and administrate a complete, consistent, correct, and adequate security program.

Topics include:

Public Key Infrastructure Overview
Certificate lifecycle
CRL and CRL DP
OCSP
SSL
XKMS
Using LDAP for security
Access Control
Trust Model
Internet AAA (Authentication, Authorization, Audit)
Java Security Programming Model
Web Service Security
Various Security Model in Application Servers

Grading

Apart from big term project(s) and presentation, there are homework assignments, a mid-term exam and a final exam. Some exams might be take-home. The weightings for grading are: Term Project(s) 40%, Homework 20%, Midterm 10%, Final Exam 10%, Team Research Presentation 10%, and Term Presentation 10%.

No Late Assignment Submission

Class Material

Lecture Notes

Reading material will be online on this web site before every lecture. Please email sinn@openloop.com if you experience any download problem.

Reference

RSA Security's Official Guide to Cryptography by Steve Burnett, Stephen Paine (Paperback)
PKI: Implementing & Managing E-Security by Andrew Nash, Bill Duane, Derek Brink, Celia Joseph. McGraw-Hill Osborne Media; ISBN: 0072131233; (March 27, 2001).
IPSec: Securing VPNs by Carlton Davis (Paperback)
Security Architecture: Design, Deployment and Operations by Christopher King, et al (Paperback)
Understanding the Public-Key Infrastructure: Concepts, Standards, and Deployment Considerations by Carlisle Adams, et al (Hardcover)
Planning for PKI: Best Practices Guide for Deploying Public Key Infrastructure by Russ Housley, Tim Polk (Hardcover)
Openloop.com (http://www.openloop.com)

More will be added as the semester goes

Schedule

Introduction

Feb 1, 2005-Tue

Course discussion
Security Introduction

Preparation for project
- OpenSSL project
- Java PKI System: Use this as the basis of PKI system for your project
- Microsoft CA: Research this if your group want to use a Microsoft CA
- iPlanet LDAP: Download directory server for storing security info in LDAP
- IBM DB2: Download DB2 for storing security info in database
Homework 0: Class pulling information

Security and PKI

Feb 8, 2005-Tue:

Homework Group: Form a team to work on project
Public-Key Cryptography
- Symmetric Versus Asymmetric Ciphers
- Algorithms: RSA, DSA, DH, ECDSA/ECDH and SHA-A
LDAP Introduction (http://www.sun.com, Directory Server 5.x)

February 14 Last Day to Drop Courses Without an Entry on Student's Permanent Record
February 21 Last Day to Add Courses & Register Late

Feb 15, 2005-Tue:

PKI components:
- Concept of an Infrastructure
- CA,
- Certificate Repository,
- Cert Revocation,
- Key Backup and Recovery,
- Automatic Key update,
- Key history
- Cross-Certification
- Support for Non-Repudiation
- Time Stamping
- Client Software
OpenSSL introduction

Feb 22, 2005-Tue:

PKI Services
- Core PKI Services: Authentication, Integrity, and Confidentiality
- PKI-Enabled Services
  - Notarization
  - Non-Repudiation
  - Privilege Management
  - Mechanisms Required
  - PKI Practice
Homework 1
Sample Makefile
Research Paper Schedule

Mar 1, 2005-Tue:

The common problem: Certificate Revocation
- CRL / CRL DP
- OCSP
Homework 2

Mar 8, 2005-Tue:

Trust Model
Homework 1 Due

Mar 15, 2005-Tue:

Authentication (pdf from other source)
Project Part I
Template Project UI
Homework 2 Due
Research Paper Group I

Mar 22, 2005-Tue:

Mid-term

March 28 - April 1: Spring Break

Apr 5, 2005-Tue:

Mid-term Due
Project Part I Due
Java Security Introduction
- Language-Level Security
- Invalid Memory Access
- Garbage Collection
- Other Language Features
- JavaTM Virtual Machine-level Security1
- Java Byte Codes
- Byte Code Verification
- Class Loading
- Runtime Checking
- Managing Security
- Access Controller and Permission

Apr 12, 2005-Tue:

E-Commerce with Web Services

Apr 19, 2005-Tue:

Homework 3
Java signature generation and verification
- Signing
- Verifying
Web SSO
Research Paper Group III

Apr 26, 2005-Tue:

Topics: Identity Management Part I
Research Paper Group IV

May 3, 2005-Tue:

Homework 3 Due
Topics: Identity Management Part II
IdM notes
Final Project Info (MUST READ)
Misc Topics

Final and Presentation

May 10, 2005-Tue:

Group Presentation
Bubble Evaulation
Presentation Schedule
Project Final Part Due

May 17, 2005-Tue:

Final Exam
Last Day of Instruction for the whole university.

Term Project

PKIMS Project

UI Template

Team Research Presentation

Each team will be given a topics to research and present during the semester. The team needs to prepare the following:

PowerPoint Presentantion of the topic
A 5 to 10 page short-paper with detail reference on the topic
Perform face-to-face presentation in class (15 min)
The following are the topics:
- PGP trust model
- Software Engineering and Security
- Network Intrusion Detection
- Identity Management
- Data Security (File, database, etc)
- XML and Security

Overflow Topic

PKI

Certificates and Certification
- Structure
- Validation
- Policies
- CA vs RA
Key and Certificate Management

Java

A Quick Look at policytool
API-Level Security Features
java.security
java.security.acl
java.security.interfaces
java.security.cert
java.security.spec
Using the Security Packages
Message Digests
Digital Signatures
Public Key Cryptography
Signing Data
Verifying Data
Authentication and Certificates
Browser-level Security
Executable Content

Applet Security Managers
Extending Browser Privileges
Extending HotJava Privileges
Extending JDK 1.2 Applet Privileges
Netscape Capabilities Classes
Using Internet Explorer's Permission Scoping
Signing Java Programs
Signing Applets for HotJava, Java Plug-in, and appletviewer
Signing Applets for Netscape Communicator
Signing Applets for Internet Explorer
Conclusion and Resources

Web Services

SOAP
UDDI
SOAP EAR
XML Support
XKMS
Security Model:
- Security Components
- Security Administration Model
- Authentication Model
- Authorization Model
- Delegation Model
- Security and Operating Systems

Grade

Email sinn@openloop.com to check your grade if necessary.

General Policy

The university and departmental policies and deadlines for course drop will be applied. Makeup exams cannot be offered, except under exceptional conditions, such as documented serious illness/accident, etc., and only at the professor's discretion.

Each student is responsible for his/her individual assignment, and must not copy anyone else's work. Students who borrow solutions from others will find themselves unable to pass the course. The minimum penalty for every student involved in the duplication of individual assignments or exams will be receiving a zero score on the submitted work.

For group project, all the work has to be done by your OWN group. Do not try to download "free code" from the Internet and hand in as a project. WE WILL FIND OUT. Do not share your work with others. So DO YOUR OWN WORK and EARN your grade.