National Science Foundation Yale University耶鲁大学国家科学基金会.pptVIP

NSF Cyber Trust PI MeetingMark Seiden, Yahoo!Tomas Sander, HP LabsMoti Yung, GoogleEvelyne Viegas, Microsoft What are Underfunded Areas in Information Security and Privacy that Would (most) Benefit Industry? Methodology First, enumerate unsolved problems of Industry. + bits of wish lists from colleagues = Corpus of Unsolved Problems Make sure these are research-worthy, and require Science versus “just” engineering. To be fair, filter out those which should properly be the responsibility of industrial research organizations (not the taxpayer) = Big Unsolved Industry Problems needing NSF-funded Research Then calculate the set of NSF funded research areas…. Start with what’s being funded now Measure funding adequacy wrt hardness of problem being solved = Underfunded research areas Then simply match up the two sets and now we can talk about the common elements! Why are so many problems in industry woefully unsolved? Industry is unaware of relevant research Research papers are often not industrial-strength recipes for building anything Industry does not highly value findings without implementation and examples Legacy, complicated context, scaling problems, user expectations prevents change Hard to make business cases for disruptive change or bleeding edge technology Sometimes research is not applied skilfully Static authenticators (a source of chronic pain and suffering) … have facilitated an entire set of plagues: Identity theft (phishing, keylogging, bribery, etc) Dictionary-based/Brute force cracking which requires CAPTCHA and distributed abuse detection for defense Password reuse means the damage is often widespread. Not just passwords! We need A replacement for Social Security Number with finer grained credentials that can convey one’s limited rights (e.g. right to vote, right to drink, right to drive, right to borrow books, etc.) but not all details of identity on a single card Desirable technologies for research? R