Advanced Computer Security

This course is available for registered PhD students or equivalent at a university.

This course teaches advanced principles, algorithms, and protocols in computer security. Topics include mandatory access-control systems, information-flow control, side-channel vulnerabilities, provenance analysis, fuzz testing and verification tools.

PhD students or holders of a Norwegian master´s degree of five years or 3+ 2 years (or equivalent) may be admitted. PhD students must upload a document from their university stating that there are registered PhD students. This group of applicants does not have to prove English proficiency and are exempt from semester fee. Holders of a Master´s degree must upload a Master´s Diploma with Diploma Supplement / English PhD students at UiT The Arctic University of Norway register for the course through StudentWeb. External applicants apply for admission through SøknadsWeb.

Application code 9301.

All external applicants have to attach a confirmation of their status as a PhD student from their home institution. Students who hold a Master of Science degree, but are not yet enrolled as a PhD-student have to attach a copy of their master's degree diploma. These students are also required to pay the semester fee.

Knowledge - The candidate has knowledge of

• mandatory access control and information flow systems (Bell-LaPadula);
• side-channel attacks (e.g., Spectre attck);
• provenance analyses at different software abstraction layers;
• the functionality of fuzz testing and verification tools (e.g., Dafny);
• principles of and research advancements in model checking.

Skills - The candidate can

• reason about how information flows within a computer system;
• use information flow control tools;
• identify and prevent side channel vulnerabilities;
• apply provenance analysis;
• use fuzz testing and verification tools to increase assurance of code correctness;
• apply model checking techniques to verify correctness of a realistic prototype system.

General competence - The candidate can

• develop and extend own competence and expertise;
• participate actively in professional discussions (oral or written);
• read and analyze scientific articles;
• write scientific and technical reports;
• develop and test robust and secure software systems; and
• apply security-by-design principles.

Recommended prerequisites

INF-2310 Computer Security

If you pass the examination in this course, you will get an reduction in credits (as stated below), if you previously have passed the following courses:

• INF-3310 Computer Security 8 ects
• INF-3310 Advanced Computer Security 8 ects

Language of instruction and examination

Schedule

More info about the coursework requirements

The coursework includes 4 written assignments individually graded approved / not approved.

For the 4th assignment the ph.d. students are asked to implement a realistic prototype system, transform it into a model, formalize the security policy that this system should satisfy, and use a model checker to verify that the system indeed satisfies that policy. The students will then write a scientific report explaining the design and implementation choices, as well as, literature sources that justify these choices.

More info about the oral exam

Re-sit examination