Course Description - CSCI 530, Spring 2004

• Describe and assess a broad range of security systems.
• Understand the fundamental mathematics and engineering underlying security systems.
• Judge the suitability of security systems for various applications.
• Know how to develop new security systems and features.

• C. Kaufman, R. Perlman, and M. Speciner, Network Security: Private Communication in a Public World, 2nd Edition, Prentice Hall, 2002.
• R. E. Smith, Authentication: From Passwords to Public Keys, Addison-Wesley, 2001.
• Selected Technical Papers

• B. Schneier, Applied Cryptography: Protocols, Algorithms, and Source Code in C, 2nd Edition, John Wiley & Sons, 1995.

1. The Security Problem (Smith, Chapter 1)
   • A working definition of security
   • Evaluating and denoting security
   • Systems security vs network security vs data security

2. Cryptography (Kaufman et al, Chapters 2-6)
   • Secret key cryptography
   • Public key cryptography
   • Hashes and message digests
   • Steganography

3. Key management (Kaufman et al, Chapter 9; various papers)
   • Peer-to-peer
   • Group key management

4. Authentication (Smith, Chapters 2-5, 7, 12; Kaufman et al, Chapters 10, 11)
   • Password-based authentication
   • Unix vs Windows
   • Kerberos
   • X.500
   • Hardware authentication
   • Biometrics

5. Authorization (Applicable papers--e.g., Barkley, "Comparing Simple Role Based Access Control Models and Access Control Lists"; GAA-API specification)
   • ACLs
   • GAA-API

6. Intrusion prevention, detection, and response (Applicable papers--e.g., Aslam et al, "A Taxonomy of Security Faults"; Ko et al, "Automated Detection of Vulnerabilities in Privileged Programs by Execution Monitoring"; Anderson et al, NIDES paper; etc.)
   • Firewalls
   • Virus checkers
   • Commercial IDS
   • Research IDS
   • Response systems

7. Wireless technologies and implications for security (Applicable papers--e.g., Xydis, "Security Comparison: Bluetooth Communications vs 802.11")
   • 802.11b
   • Bluetooth

• The security problem - slides
• Cryptography - slides
• Key management - slides part 1, part 2
• Authentication - slides part 1, part 2, part 3
• Authorization - slides part 1, part 2
• Intrusion prevention, detection, and response - slides part 1, part 2, part 3
• Wireless technologies and implications for security - slides

Some problems will be based on readings and class discussions. Written assignments should be in typed or computer-generated output, with the exception of formulas, drawings, tables etc., which you are free to do by hand so long as they are neat and legible.

The date of the final examination is firm and it is also listed near the top of the class home page. There will be no separate final exams given for students with schedule conflicts.

Homeworks:		20%
Term Paper:		20%
Midterm Exam:		25%
Final Exam:		35%

Pleaes also note the following:

• The above percentages will be used to calculate your total score. Final grades (A,B,C,D,or F) will be determined using a modified curve (i.e., we won't necessarily assign an equal number of failing grades as passing grades) based on this total score. No other methods will be considered. (So, please do not ask the instructor to take how much you have improved since the beginning of the semester into account. You are expected to try your best from the beginning and not to slack off!)

• We will assign grades of C and below to individuals who do not perform satisfactorily in the above areas. (i.e., you should not assume a B- or even C if you perform unsatisfactorily.) However, we hope that everyone will perform well.

• Your assignments are your own work! No group assignments are allowed or will be tolerated. You are free to talk to other students about assignments but no actual material (files, photocopies etc.) should be shared. We will act harshly at any sign of copying.

• We will not assign incompletes unless it is for a documented medical reason (in accordance with USC policy).

Written homeworks are to be turned in at the end (when the instructor leaves) of specified classes. You may also leave written homeworks in the instructor's mailbox (in SAL 349) by the end of specified classes at your own risk.

If you are unable to complete a homework or a programming assignment due to illness or family emergency, please see the instructor as soon as possible to get an extension. A doctor's note is required as proof of illness or emergency.

You are always welcome to make an appointment (and reserve a timeslot) to see the instructor. So, if you plan to show up after 15 minutes into the office hour, you are better off making an appointment.

The instructor and the TA do not normally read this newsgroup. Please do not post questions for them here.

Please make sure that you have read the Academic Integrity Policy of this course.

This policy also holds for  programming assignments. In this class, we will use sophisticated automated program checkers to detect cheating. Be aware that the program checkers have demonstrated very good results and are widely used within the academic community. Any student caught cheating will be given zero credit and will be disciplined.

It is the students responsibility to submit their assignments to the TA in time. 

For students who satisfied the CSci402 prerequisite at other universities or through work experience, this course assumes that you are familiar with programming on the UNIX platform. You should be able to write programs in C/C++ and be familiar with the UNIX development environment (vi/pico/emacs, cc/gcc or g++/CC, make, etc.) No special assistance or consideration will be offered if your background is inadequate.

You are expected to read all the papers in detail. Not all details will be covered in class.  We will assume knowledge of material covered in EE450 and a C language programming proficiency from CSci402 or its equivalent. If you covered the introductory material at some other school it is YOUR responsibility to fill in any missing background. Feel free to ask me for advice on appropriate introductory readings if you feel your background is insufficient.

We expect you to attend every class meeting. If you do happen to miss a session, you are responsible for finding out what material was covered and if any administrative announcements were made. You must do so BEFORE the next session (e.g., if there is an assignment given during the missed session, you are still responsible for completing it by the next week along with the other students).  You are advised to read the papers for a particular lecture before attending the lecture. This will greatly enhance your understanding of the subject matter.

• OpenSSL
• Handbook of Applied Cryptography (Please only read this online and don't print them.)
• Differential cryptanalysis - includes survey papers and tutorials on linear and differential cryptanalysis