Security and Privacy in the IoT

Professor Elisa Bertino
Purdue University

1:00-2:00 pm Friday, 20 November 2020

Participate via Webex

Phone +1-202-860-2110; code: 120 706 1902

The Internet of Things (IoT) paradigm refers to the network of physical objects or”things” embedded with electronics, software, sensors, and connectivity to enable objects to exchange data with servers, centralized systems, and/or other connected devices based on a variety of communication infrastructures. IoT makes it possible to sense and control objects creating opportunities for more direct integration between the physical world and computer-based systems. IoT will usher automation in a large number of application domains, ranging from manufacturing and energy management (e.g., Smart Grid), to healthcare management and urban life (e.g. Smart City). However, because of its fine-grained, continuous, and pervasive data acquisition and control capabilities, IoT raises concerns about security and privacy. Deploying existing security solutions to IoT is not straightforward because of device heterogeneity, highly dynamic and possibly unprotected environments, and large scale. In this talk, after outlining key challenges in IoT security and privacy, we present initial approaches to securing IoT data and then focus on our recent work on security analysis for cellular network protocols and edge-based anomaly detection.

Elisa Bertino is a professor of Computer Science at Purdue University. Prior to joining Purdue, she was a professor and department head at the Department of Computer Science and Communication of the University of Milan. She has been a visiting researcher at the IBM Research Laboratory (now Almaden) in San Jose, at the Microelectronics and Computer Technology Corporation, at Rutgers University, and at Telcordia Technologies. Her main research interests include security, privacy, database systems, distributed systems, and sensor networks. Her research focuses on digital identity management, biometrics, IoT security, security of 4G and 5G cellular network protocols, and policy infrastructures for managing distributed systems. Prof. Bertino has published more than 700 papers in all major refereed journals, and in proceedings of international conferences and symposia. She has given keynotes, tutorials, and invited presentations at conferences and other events. She is a Fellow member of ACM, IEEE, and AAAS. She received the 2002 IEEE Computer Society Technical Achievement Award “For outstanding contributions to database systems and database security and advanced data management systems”, the 2005 IEEE Computer Society Tsutomu Kanai Award for “Pioneering and innovative research contributions to secure distributed systems”, and the ACM 2019-2020 Athena Lecturer Award.

Cybersecurity and Local Government: Findings from a Nationwide Survey

Donald Norris & Laura Mateczun

11:00-12:00 EST, Thursday, Nov 19, 2020

register to get the webinar link

This talk will discuss data and results from the first nationwide survey of cybersecurity among local or grassroots governments in the United States, examines how these governments manage this important function. As we have shown elsewhere, cybersecurity among local governments is increasingly important because these governments are under constant or nearly constant cyberattack. Due to the frequency of cyberattacks, as well as the probability that at least some attacks will succeed and cause damage to local government information systems, these governments have a great responsibility to protect their information assets. This, in turn, requires these governments to manage cybersecurity effectively, something our data show is largely absent at the American grassroots. That is, on average, local governments fail to manage cybersecurity well. After discussing our findings, we conclude and make recommendations for ways of improving local government cybersecurity management.

Donald F. Norris is Professor Emeritus, School of Public Policy, University of Maryland, Baltimore County. His principal field of study is public management, specifically information technology in governmental organizations, including electronic government and cybersecurity. He has published extensively in refereed journals in these areas. He received a B.S. in history from the University of Memphis and an M.A. and a Ph. D. in political science from the University of Virginia.

Laura Mateczun is a graduate of the University of Maryland Francis King Carey School of Law, and a member of the Maryland Bar. She is currently a Ph.D. student at the University of Maryland, Baltimore County School of Public Policy studying public management. Her research interests involve local government cybersecurity, criminal justice, and the importance of equity in

Alan Sherman and collaborators develop VoteXX with new strategies for secure online voting

Over the past several months, the topic of online voting has been at the top of the minds of millions of Americans and has been widely debated. Supporters often highlight how it would increase voter turnout through improved accessibility and convenience. Privacy and election integrity are among the top concerns about implementing an online voting system.

Researchers from UMBC and xx.network have been working to design an online voting system that is resistant to coercion and would provide a secure way for people to cast their ballots from computers, tablets, and smartphones in the future. Alan Sherman, professor of computer science and electrical engineering, is developing the system, VoteXX, with David Chaum, a cryptographer known for his work on privacy-centered technology, and Richard Carback ‘05, M.S. ‘08, Ph.D. ‘10, computer science, who has spent his career deflecting would-be hackers.

The security of devices that voters might use to cast their ballot is a significant concern, notes Sherman. He explains that malware on the devices that voters use might change the votes or spy on the voter.

Alan Sherman, right, talking with Rick Forno on campus in 2018. Photo by Marlayna Demond ’11 for UMBC.

As described in a press release and the researchers’ new whitepaper, VoteXX allows voters to confirm that their ballots were accurately cast, collected, and counted. This system uses ideas from an earlier system, Remotegrity, that the collaborators developed and used in a municipal election in Takoma Park, Maryland, in 2011. Voters received secret vote codes on a scratch-off card via traditional mail, which they used to hide their votes from the software and hardware. Remotegrity was based on Scantegrity, an earlier in-person verifiable voting that was also used in binding elections in Takoma Park, Maryland.

VoteXX uses a combination of simple strategies and complex cryptography to create a more secure online voting scheme. For example, to address the issues of coercion and vote selling, VoteXX allows voters to cancel or change their vote up to a certain deadline. David Chalm explains how this simple capability undermines vote selling. “You make it possible to flip (change or cancel) that vote outside the voting process. Because a vote buyer cannot be sure you didn’t or won’t flip your vote, they can’t be sure that a voter has been honest with them, making it useless to buy votes.”

This “vote flipping” approach provides a subversively simple yet powerful tool to voters. It’s accomplished by creating a “flip code” during the registration process that allows the voter to flip their vote after casting.

You can read more about this research in a UMBC News article by Megan Hanks.

UMBC Cyber Defense Lab presents

Secure Computation: From Theory to Practice

Jonathan Katz

Computer Science Department
University of Maryland, College Park

12:00–1:00 pm EDT, Friday, 30 October 2020
Online via Webex

Protocols for secure multi-party computation (MPC) allow a collection of mutually distrusting parties to compute a function of their private inputs without revealing anything else about their inputs to each other. Secure computation was shown to be feasible 35 years ago, but only in the past decade has its efficiency been improved to the point where it has been implemented and, more recently, begun to be used. This real-world deployment of secure computation suggests new applications and raises new questions.

This talk will survey some recent work at the intersection of the theory and practice of MPC, focusing on a surprising application to the construction of Picnic, a “post-quantum” signature scheme currently under consideration by NIST for standardization.

Jonathan Katz is a faculty member in the department of computer science at the University of Maryland, College Park, where he formerly served as director of the Maryland Cybersecurity Center for over five years. He is an IACR Fellow, was named a University of Maryland distinguished scholar-teacher in 2017-2018, and received the ACM SIGSAC Outstanding Contribution Award in 2019.

Host: Alan T. Sherman, *protected email* Support for this event was provided in part by the National Science Foundation under SFS grant DGE-1753681. The UMBC Cyber Defense Lab meets biweekly Fridays 12-1pm. All meetings are open to the public.

Upcoming CDL Meetings: Nov. 13, TBA, [possibly: David R Imbordino (NSA), Security of the 2020 presidential election]; Dec. 11, TBA, [possibly: Peter A. H. Peterson (Univ. of Minnesota Duluth), Adversarial Thinking]

Earn full tuition, fees, and stipends $25,000 – $34,000 annual scholarships for up to 3 years

(government employment required for every year of scholarship)

For BS (rising juniors or seniors), MS, MPS, or PhD in CS, CE, IS, Cyber or related fields

USA citizenship or permanent residency required

MINIMUM GPA of 3.25

Contact: Dr. Alan Sherman *protected email*

For more information: www.sfs.opm.gov                                                                                              or                                                                                               https://cybersecurity.umbc.edu/scholarship-for-service-sfs/

APPLY THROUGH SCHOLARSHIP RETRIEVER:https://scholarships.umbc.edu/retriever/

UMBC’s Jack Suess to receive 2020 EDUCAUSE Leadership Award

UMBC Vice President for Information Technology Jack Suess will soon receive one of the highest national recognitions offered to professionals in his field: the EDUCAUSE Leadership Award. 

EDUCAUSE is a nonprofit association that focuses on information technology (IT) in higher education and includes more than 2,300 member colleges, universities, and groups. Suess ‘81, mathematics, M.S. ‘94, information systems, will receive the award during the EDUCAUSE Annual Conference, which will be held virtually this month. 

“This is a tremendous honor for me. Given that my entire career has been at UMBC, it also is testament to the innovative and collaborative culture of the UMBC community,” Suess says. “In particular, I want to highlight the technology leadership of my Division of Information Technology colleagues. Through all of their efforts, UMBC is looked at as a model for the use of technology in higher education.”

Read more information on this UMBC News article by Megan Hanks.

Where: https://umbc.webex.com/

This is the second in a series of events that aim to build community among students from groups traditionally underrepresented in the field of computing.

Join us for an opportunity to meet, chat with, and engage fellow CSEE students, faculty, staff, and alumni.

Panelists will discuss life beyond the undergraduate years.

Let’s Do This! Be Social- Virtually

Welcome Remarks– Dr. Freeman Hrabowski

Alumni Speakers

Dr. Jeff Avery, Northrup Grumman

Federico Cifuentes-Urtubey, Ph.D. student, UIUC

Dr. Patti Ordóñez, Associate Prof., UP-RP

Dr. Nwokedi Idika, Google

Kerry Luke, Northrop Grumman

CSEE Faculty Speakers

Mr. Ivan Sekyonda                          Dr. Marcella Wilson

Dr. Dmitri Perkins                             Dr. David Chapman

UMBC Cyber Defense Lab

BVOT: Self-Tallying Boardroom Voting with Oblivious Transfer

Farid Javani, CSEE, UMBC

12:00–1:00pm, Friday, 6 November 2020

http://umbc.webex.com/meet/sherman

(Joint work with Alan T. Sherman)

A boardroom election is an election with a small number of voters carried out with public communications. We present BVOT, a self-tallying boardroom voting protocol with ballot secrecy, fairness (no tally information is available before the polls close), and dispute-freeness (voters can observe that all voters correctly followed the protocol).

BVOT works by using a multiparty threshold homomorphic encryption system in which each candidate is associated with a masked unique prime. Each voter engages in an oblivious transfer with an untrusted distributor: the voter selects the index of a prime associated with a candidate and receives the selected prime in a masked form. The voter then casts their vote by encrypting their masked prime and broadcasting it to everyone. The distributor does not learn the voter’s choice, and no one learns the mapping between primes and candidates until the audit phase. By hiding the mapping between primes and candidates, BVOT provides voters with insufficient information to carry out effective cheating. The threshold feature prevents anyone from computing any partial tally—until everyone has voted. Multiplying all votes, their decryption shares, and the unmasking factor yields a product of the primes each raised to the number of votes received.

In contrast to some existing boardroom voting protocols, BVOT does not rely on any zero-knowledge proof; instead, it uses oblivious transfer to assure ballot secrecy and correct vote casting. Also, BVOT can handle multiple candidates in one election. BVOT prevents cheating by hiding crucial information: an attempt to increase the tally of one candidate might increase the tally of another candidate. After all votes are cast, any party can tally the votes.

Farid Javani is a Ph.D. candidate in computer science at UMBC, working with Alan Sherman. His research interests include algorithms, security, applied cryptography, and distributed systems. He is the manager of the Enterprise Architecture team at CCC Information Services in Chicago. email: *protected email*

Host: Alan T. Sherman, *protected email* Support for this event was provided in part by the National Science Foundation under SFS grant DGE-1753681. The UMBC Cyber Defense Lab meets biweekly Fridays 12-1:00 pm. All meetings are open to the public. Upcoming CDL Meetings: Oct. 30, Jonathan Katz (UMCP), [possibly on secure distributed computation]; Nov. 13, TBA, [possibly: David R Imbordino (NSA), Security of the 2020 presidential election]; and Dec. 11, TBA, [possibly: Peter A. H. Peterson (Univ. of Minnesota Duluth), Adversarial Thinking]

UMBC Data Science Meetup Talk

Exploding Blockchain Myths

Maria Vachino and Dr. James P. Howard

5:30-7:00pm Tuesday, 13 October 2020

In this talk, Maria Vachino from Easy Dynamics and Dr. James P. Howard from APL will provide an overview of what blockchain is and isn’t, focusing on non-cryptocurrency use cases, will explain the results of their research for the DHS S&T Cybersecurity Directorate, and will provide insight into the value (or lack therefore) of the technology.

References:
• https://ieeexplore.ieee.org/document/8965252/
• http://jitm.ubalt.edu/XXX-3/article3.pdf

Maria Vachino is the Director of Digital Identity at Easy Dynamics where she is focused on Identity Credential & Access Management (ICAM) technologies, policies, & standards, Cybersecurity, and IT modernization for the US Federal Government. She started investigating applications for blockchain technology in 2015 as the Technical and Government Engagement Lead for the DHS S&T Cyber Security Directorate’s Identity Management Research & Development Program while a member of the Senior Professional Staff at the Johns Hopkins Applied Physics Lab. Maria has a BS in Computer Science from UMBC and an MS in Cybersecurity.

Dr. James P. Howard, II (UMBC Ph.D. ’14) is a scientist at the Johns Hopkins Applied Physics Laboratory. Previously, he was a consultant to numerous government agencies, including the Securities and Exchange Commission, the Executive Office of the President, and the United States Department of Homeland Security, and worked for the Board of Governors of the Federal Reserve System as an internal consultant on scientific computing. He is a passionate educator, teaching mathematics and statistics at the University of Maryland Global Campus since 2010 and has taught public management at Central Michigan University, Penn State, and the University of Baltimore. His most recent work has modeled the spread of infectious respiratory diseases and Ebolavirus, predicted global disruptive events, researched using blockchain for government services, and created devices for rescuing victims of building collapse. He is the author of two books.