Syllabus for |
|
| TDA602 - Language-based security |
| |
| Syllabus adopted 2015-02-10 by Head of Programme (or corresponding) |
| Owner: MPALG |
|
|
7,5 Credits |
| Grading: TH - Five, Four, Three, Not passed |
| Education cycle: Second-cycle |
|
Major subject: Computer Science and Engineering, Information Technology
|
|
Department: 37 - COMPUTER SCIENCE AND ENGINEERING
|
Teaching language: English
Open for exchange students
Block schedule:
A
| Course module |
|
Credit distribution |
|
Examination dates |
|
Sp1 |
Sp2 |
Sp3 |
Sp4 |
Summer course |
No Sp |
| 0112 |
Project |
4,5 c |
Grading: TH |
|
|
|
|
4,5 c
|
|
|
|
|
| 0212 |
Laboratory |
3,0 c |
Grading: UG |
|
|
|
|
3,0 c
|
|
|
|
|
In programs
MPCSN COMPUTER SYSTEMS AND NETWORKS, MSC PROGR, Year 1 (elective)
TKITE SOFTWARE ENGINEERING, Year 3 (elective)
MPALG COMPUTER SCIENCE - ALGORITHMS, LANGUAGES AND LOGIC, MSC PROGR, Year 1 (compulsory elective)
MPALG COMPUTER SCIENCE - ALGORITHMS, LANGUAGES AND LOGIC, MSC PROGR, Year 2 (elective)
MPSOF SOFTWARE ENGINEERING, MSC PROGR, Year 2 (elective)
Examiner:
Professor
Andrei Sabelfeld
Replaces
TDA600
Language-based security TDA601
Language-based security
Eligibility:
In order to be eligible for a second cycle course the applicant needs to fulfil the general and specific entry requirements of the programme that owns the course. (If the second cycle course is owned by a first cycle programme, second cycle entry requirements apply.)
Exemption from the eligibility requirement:
Applicants enrolled in a programme at Chalmers where the course is included in the study programme are exempted from fulfilling these requirements.
Course specific prerequisites
The entry requirement for the course is to have successfully completed two year studies within the subject Computer Science or equivalent.
The knowledge of the material covered in the courses DAT151 Programming language technology and EDA263 Computer security is recommended but not required as a prerequisite.
Aim
Modern attacks often succeed at circumventing standard security mechanisms. While operating-system security policies are low-level (such as access control policies, protecting particular files), many attacks are high-level, or application-level (such as email worms that pass by access controls pretending to be executed on behalf of a mailer application). Because applications are typically specified and implemented in programming languages, application-level security is a part of the more general area of language-based security. A direct benefit of language-based security is the ability to naturally express security policies and enforcement mechanisms using the techniques of the well-developed area of programming languages.
Learning outcomes (after completion of the course the student should be able to)
After the course, you should be able to apply practical knowledge of security for modern programming languages. This includes the ability to identify application- and language-level security threats, design and argue for application- and language-level security policies, and design and argue for the security, clarity, usability, and efficiency of solutions, as well as implement such solutions in expressive programming languages.
You should be able to demonstrate the critical knowledge of:
principles behind application-level attacks (such as Trojan horses,worms, buffer overrun attacks, web application attacks, covert channels, and malicious code)
and
language-based protection mechanisms (such as static security analysis, reference monitoring, program transformation, and stack inspection).
You should gain experience in technical writing.
Content
This course combines practical and cutting-edge research material. For the latter part, the courses particular emphasis is on the use of formal, or semantic, models of program behavior for specifying and enforcing security properties.
The dual perspective of attack vs. protection is threaded through the lectures, laboratory assignments, and projects.
Organisation
The course consists of lectures, group meetings and project presentations.
Literature
See separate literature list.
Examination
To pass the course, the students must pass the laboratory assignments and the exam. In order to pass the exam, the students need to make a presentation of the project in class and pass the requirements on a written report/position paper that documents the project.