Computer/Network Security

CS-402: Fall 2003

Home
Syllabus
Schedule
Papers
Projects
Contact Information

Final Projects

The final projects in this class are intended to allow a great deal of flexibility for the individual student (or small group of students) to define a research or programming area that most interests them.  As such, we define the two very broad categories of final projects as research projects and programming projects.  One could also imagine hybrid projects that are part research but also have a programming or implementation component.  Even the projects that are mostly programming based will have a paper to be written, albeit shorter than the paper that is the outcome of a research project.

Students may work individually, or in a group of 2 or 3, depending on the scope.  A group project should have a substantially more ambitious scope than an individual project.

Recall that the final project is 25% of your final grade calculation in this class.

Project milestones

bulletproject proposal: November 17, 10:30 am
bulletproject presentation: December 10 and 12, 2003
bulletproject due:  December 18, 2003

Project Proposal

The project proposal needs to define the scope of what you are trying to accomplish.  It should be one to two (single spaced) pages long.  The core of the project proposal is the project description.  Use two to four paragraphs to describe the goal(s) of your project.  There should be no ambiguity about whether this project includes a programming/implementation component.

The remainder of the project proposal depends on what type of project is being proposed.  For a research project, this should include an initial literature search and annotated bibliography on the topic.  For a programming project, this should include a set of well-defined milestones to be met at weekly intervals.  In addition, a programming project should specify any required resources so that we can make sure they are met early on.

Project Presentation

Plan on presenting the basic ideas of your project to the rest of the class in one of the last two sessions of the class.  While your project may not be complete, it should be well on its way by this time frame.  These presentations are relatively short (you should target about 15 minutes).

Presentations should be self-contained, and should be clear and precise. Briefly introduce the topic including any background information, describe the investigation, development, or experimentation that was conducted (either complete or still planned), and provide any demonstrations developed as part of the project, or describe the results of the investigation or experimentation. The following format is suggested:

bullet

Title. Name the project and all the team members.

bullet

Introduction. Introduce the purpose and goals of the project. Provide any background material necessary to understand the presentation.

bullet

Investigation, development, or experimentation conducted. Describe the actual work performed during the project.

bullet

Results. Show any demonstrations developed or results achieved during the project.

bullet

Conclusion.

Research Project

The research category of project is a 10 to 12 page research paper. The paper should be in postscript (or pdf) or html. The paper should examine issues or technologies in computer or network security. Typically, your report might be organized as follows:

  1. abstract
  2. introduction -- background information, literature search, scope and limitations of project
  3. body -- methods used
  4. analysis and conclusions
  5. recommendations -- future work, unsolved problems
  6. references -- journals, WWW references

If a research project is done as a team project, the results should be more significant and the paper to cover those results appropriately longer.

Also be very careful about citing your sources.  Plagiarism is stealing or passing off the ideas or words of another as one's own -- using material without crediting the source. This is prohibited behavior and will not be tolerated. Take the time to properly cite material written by someone else -- include references, put verbatim quotes in quotation marks, and do not paraphrase excessively. If you have questions about this, ask me.

Programming Project

As mentioned above, a programming project must also include a shorter (4-5 page) paper detailing the related work and ideas behind the programming project.  In addition, you will need to provide me with a hard-copy of well documented code and a CD-R with your code.  You will also need to schedule a demonstration of your software.  I will post the schedule of demonstrations to this web page so that other classmates may attend as well.

Final Comments

The research and the programming projects will be graded on quality of research, quality of presentation, and strength of references. Original research counts more than a critical review which counts more than a mere survey paper. Actually implementing and testing things counts more than reporting on someone else's experiments/results.

I have already given you a list of project ideas from Stallings.  A link to that can be found here.

A list of additional possible topics follow.  These were pulled from a class page out of the University of Tennessee.

bullettrust analysis: PGP web of trust vs. trust hierarchy
bullettechniques for generating crypto random numbers and survey of what various crtypo packages use to generate random numbers
bulletNSA's FORTEZZA card and key escrow issues
bulletsecurity features of various software packages: data bases, OS's (Windows 2000, NT, Mac OS 9, Plan 9,...) or various free UNIX: linux, freebsd,openbsd
bulletvulnerabilities revealed by traffic analysis
bulletsecure OS technologies (EROS, TMACH, CMWs)
bulletsecure linux (bastille, others?), OpenBSD
bulletsecuring NT ( or UNIX)
bulletcomputer architectures for security
bulletdigital steganography (ascii text, mail headers, ps, html)
bulletdigital watermarks and copyrights
bulletvulnerabilities of Java, javascript, ActiveX
bulletJava 1.2 security and crypto services
bulletapplets or interactive web thingees to illustrate/teach crypto concepts
bullettechniques/algorithms for hi-speed crypto (parallel)
bulletDNS security
bulletdetecting sniffers
bulletdisk encryption products/algorithms (cfs, scramdisk, ppdd, tcfs, ...)
bulletcompare v1 to v2 of ssh (or old PGP vs new PGP)
bulletPublic-key for authentication: ssh, globus, kerberos, safetp
bulletcryptographic hashes
bulletbacktracking denial-of-service attacks (spoofed source address)
bulletISP IP-spoof tester (use Trinux/ bootable floppy)
bulletinformation warfare/ cyber terrorism
bulletIPsec key mgt: photuris, skip, isakmp, skeme, IKE
bulletkey distribution for multicast sessions
bulletATM (asyncrhonous transfer) security
bulletwireless security (wap's wtls), 802.11 WEP, mobile IP
bulletcell phone security (gsm, cdpd, ...)
bulletbluetooth security (wireless)
bulletdata over cable (docsis)
bulletencryption in banking or e-commerce
bulletwin2000 security (kerberos, efs, pki)
bulletsecurity in globus
bulletsecurity of DVD's and/or MP3 follow-on
bulletelectronic payment schemes (ikp, ecash, ...)
bulletmicropayment schemes
bulletsecurity of snmp (v1 vs v3)
bulletelliptic curves in security
bulletcompare 3 of the AES candidates
bulletchaotic functions as one-time pads
bulletsecure time services (timeofday/ntp, timestamps)
bulletcompare firewall products
bulletauthorization models (capabilities, ACLs)
bulletvirtual private networks VPNs (Windows 2000?)
bulletcompare UNIX scanners (ISS, COPS, SPI)
bulletimmutable executables (signed applets, ?)
bulletX.509 certificates and CA's
bulletSDSI or SPKI or X.509 hierarchies
bullethttps/SSL performance
bulletsurvey of tests for randomness
bulletcontrast various tests for primality
bulletcompare secure file transfers (scp, sftp, ?)
bulletelectronics (tempest, wiretaps, EMP guns, biometrics)
bulletsecurity in distributed computing (DCE, DCOM, CORBA, RMI)
bulletcrypto API's (GSS, CAPI, Java JCE, others ?)

Programming Projects

bulletimplement 64-bit block ciphers (on Alpha)
bulletperformance comparison of: ciphers, hashes, public key
bulletC++ or Java class library for crypto
bulletperformance comparison of Java crypto vs C/C++
bulletperformance comparison of AES ciphers
bulletanalyze performance compression before encryption
bulletautomatic cryptanalysis of some hand cipher
bulletimplement and analyze of TEA or RC5 or ?
bulletweb based electronic voting
bulletadd intel hardware RNG to /dev/random
bulletSSL chat program
bulletsetup secure Apache web server and certificates
bulletinternet poker with session keys, public/private keys
bulletdigital cash

 

Home | Syllabus | Schedule | Papers | Projects | Contact Information

 All rights reserved, Thomas C. Bressoud and Denison University.
For problems or questions regarding this web contact bressoud@denison.edu.
Last updated: 11/10/03.