In this body of work we describe preliminary work implementing a Berkely Packet Filter, in its original conception, in an FPGA. The purpose is packet filtering and ingress traffic shaping in security-relevant applications in distributed embedded nodes. We specifically target PROFINET nodes in hard real-time applications where network security is an open issue. We describe the motivation, implementation and verification including performance characteristics. We conclude that such a filter can be used to not only for protection against simple denial-of-service attacks but also for ingress protocol management and potentially for the implementation of system-wide security policies.

The deployment of encrypted transport protocols imposes new challenges for network operations. Key in-network functions such as those implemented by firewalls and passive measurement devices currently rely on information exposed by the transport layer. Encryption, in addition to improving privacy, helps to address ossification of network protocols caused by middleboxes that assume certain information to be present in the clear. However, “encrypting it all” risks diminishing the utility of these middleboxes for the traffic management tasks for which they were designed. A middlebox cannot use what it cannot see. We propose an architectural solution to this issue, by introducing a new “path layer” for transport-independent, in-band signaling between Internet endpoints and network elements on the paths between them, and using this layer to reinforce the boundary between the hop-by-hop network layer and the end-to-end transport layer. We define a path layer header on top of UDP to provide a common wire image for new, encrypted transports. This path layer header provides information to a transportindependent on-path state machine that replaces stateful handling currently based on exposed header flags and fields in TCP; it enables explicit measurability of transport layer performance; and offers extensibility by sender-to-path and path-to-receiver communications for diagnostics and management. This provides not only a replacement for signals that are not available with encrypted traffic, but also allows integrity-protected, enhanced signaling under endpoint control. We present an implementation of this wire image integrated with the QUIC protocol, as well as a basic stateful middlebox built on Vector Packet Processing (VPP) provided by FD.io.

Using personal mobile devices for work gave rise to a trend called "bring your own device", or BYOD. BYOD brings a productivity boost for employees, but also headaches for employers: on the one hand, the business has a legitimate interest in monitoring the device, in order to prevent security breaches by employees; but on the other hand, employees have a reasonable expectation of privacy when they use their devices for private functions. This poster presents our project called Privacy-Preserving Accountability for peRsonal Devices (PriPARD, pronounced "prepared"). PriPARD addresses the tension described above by designing and evaluating concrete privacy mechanisms for mobile devices used in a corporate environment. Instead of imposing a "privacy firewall" between users and the Internet, in PriPARD the aim is protecting user privacy within the corporate network and non-disclosure outside this network. PriPARD's vision is to gather practical experience with the tradeoffs between monitoring and privacy needs, to help both mobile device users and managers of corporate networks.

Many security job ads mention that security certificates are regarded as assets, giving the candidate an advantage. For some high-profile jobs, certification may even be required.No matter where one stands on the subject of certification, the assumption is that the imparted knowledge is at least factually correct. We examine the cryptography section in the Common Body of Knowledge (CBK) underlying the most sought-after certification, the CISSP, issued by the International Information Systems Security Certification Consortium, Inc., or "ISC^2".

Most networking performance enhancements occur through specific static solutions, where the structure of the protocol stack remains unchanged. Instead, we focus on a flexible software and hardware co-design for the entire protocol stack. In this paper, we present EmbedNet, a System-on-Chip implementation of a flexible network architecture for the Future Internet, where parts of the protocol stack can be moved between software and hardware at runtime. This enables the construction of dynamic protocol stacks that use available resources optimally.

We study the vulnerability reports in the Common Vulnerability and Exposures (CVE) database by using topic models on their description texts to find prevalent vulnerability types and new trends semi-automatically. In our study of the 39,393 unique CVEs until the end of 2009, we identify the following trends, given here in the form of a weather forecast: PHP: declining, with occasional SQL injection. Buffer Overflows: flattening out after decline. Format Strings: in steep decline. SQL Injection and XSS: remaining strong, and rising. Cross-Site Request Forgery: a sleeping giant perhaps, stirring. Application Servers: rising steeply.

Where do most vulnerabilities occur in software? Our Vulture tool automatically mines existing vulnerability databases and version archives to map past vulnerabilities to components. The resulting ranking of the most vulnerable components is a perfect base for further investigations on what makes components vulnerable.