Workshop Details

Secure Multi-Party Computation, or MPC, is the study of protocols that allow a group of communicating parties to collaborate to compute a function while keeping their own inputs private. An abundance of published results over the last 30+ years has shown how different security guarantees can be realized for MPC in various adversary models, with varying levels of computational and communication complexity. MPC results seem ripe for application to real-world problems, but adoption has been slow relative to some other cryptographic technologies. Perhaps part of the problem is the difficulty of making sense of all these results. This talk will give an introduction to MPC and describe efforts to produce a systematic classification of MPC protocols that could bring new insights and aid in application.

Based on joint work with Joan Feigenbaum, Debayan Gupta and Rebecca Wright.

Governments around the world are asking whether the increasing use of encryption is a problem or essential to meeting growing security threats. On the one hand, law-enforcement and security agencies complain about "going dark." On the other hand, computer-security experts warn that forcing "exceptional-access" features into devices or protocols would create unacceptable security risks. In this talk, I will briefly summarize some of the arguments that have been made for and against "exceptional-access," explain why I believe that "exceptional-access" features should not be mandated at this time, and then explain why I think that the question deserves further study.

Differential privacy has rightly taken pride of place among privacy definitions, but practical implementations have focused on counts and histograms. One application domain in which privacy is a key concern for ethical and legal reasons is human health research. Many research groups studying a the same condition (e.g. schizophrenia) have already joined research consortia. Consortium members commit to collaborate, but the instantiation of that collaboration is rarely specified. Differential privacy offers a framework in which consortium members can share aggregated data derivatives to provide quantifiable privacy and utility guarantees. The COINSTAC project seeks to do just this for studies on mental health using neuroimaging data. This talk will describe the COINTAC system and some research questions and solutions that arise from trying to apply differential privacy to common tasks in neuroimaging research.

We will explore some of the gaps between technical and legal conceptions of privacy and argue for the development of rigorous paradigms for bridging these concepts. We will present strategies and first results towards doing so considering an example from the GDPR and differential privacy.

"Accountability" is used often in describing computer-security mechanisms that complement preventive security, but it lacks a precise, agreed-upon definition.  Here, we categorize some of the many ways in which this term is used and argue for a punishment-focused view of "accountability."  We formalize our view in a utility-theoretic way and then use this to reason about accountability in computing systems.  We also survey mechanisms providing various senses of accountability as well as other approaches to reasoning about accountability-related properties. 

This is joint work with Joan Feigenbaum and Rebecca Wright.

Algorithmic complexity theory measures the performance of an algorithm principally by its worst-case asymptotic running time, whereas practitioners tend to assess an algorithm by its observed performance on typical instances.  These two approaches often yield similar conclusions, but striking differences can occur. After reviewing the theoretical background of NP-completeness and hardness of approximation, we will compare and contrast the approaches in some important cases: propositional satisfiability, linear programming, integer programming, the traveling-salesman problem and bin packing.

Cybersecurity Education and Research have to go hand in hand. In this talk we will discuss challenges, opportunities, and some (recent) developments of doing the (W)right thing.

The proliferation of communication services that we depend on every day makes managing computer networks more important than ever. The increasing security, availability, and performance demands of these services suggest that these network-management problems must be solved in real time---and inside the network.  In this new era, network management requires a fundamentally new approach.  Instead of anomaly-detection algorithms that perform offline analysis of network traces, future networks need to make real-time, closed-loop decisions---to block unwanted traffic, to reroute traffic to avoid congestion, and more.  This talk explores how to bring together network measurement, analysis, and control, by leveraging recent advances in programmable network devices.  We present several example in-network "apps” (written in the P4 programming language) that detect and fix security and performance problems, while still processing packets at line rate in high-speed switches with limited memory. The resource constraints in modern programmable switches create new opportunities for research in streaming algorithms and compact data structures.

The three example “apps” presented in the talk are described in the following papers:

• Scalable load balancing (HULA)
• Heavy-hitter detection (HashPipe)
• Microburst diagnosis (Snappy)

MANY YEARS AGO Rebecca Wright explained in her PhD thesis how a group of people can distribute cryptographic key in such a way that later, when the group was divided into teams, each team could establish---over open channels---key that only the team members shared.

We'll give (one side of) the story of how this came about, and how, generally, it became known that even without computational assumptions, shared secrets can be created over an open channel.