Browsing by Author "Cox, Landon P"

Many law professors and scholars think of the Supreme Court as a black box--issues and arguments go in to the Court, and decisions come out. The almost mystical nature that these researchers impute to the Court seems to be a function of the lack of hard data and statistics about the Court's decisions. Without a robust dataset from which to draw proper conclusions, legal scholars are often left only with intuition and conjecture.

Explaining the inner workings of one of the most important institutions in the United States using such a subjective approach is obviously flawed. And, indeed, data is available that can provide researchers with a better understanding of the Court's actions, but scholars have been slow in adopting a methodology based on data and statistical analysis. The sheer quantity of available data is overwhelming and might provide one reason why such an analysis has not yet been undertaken.

Relevant data for these studies is available from a variety of sources, but two in particular are of note. First, legal database provider LexisNexis provides a huge amount of information about how the Court's opinions are treated by subsequent opinions; thus, if the Court later overrules one of its earlier opinions, that information is captured by LexisNexis. Second, researchers at Washington University in St. Louis have compiled a database that provides detailed information about each Supreme Court decision. Combining these two sources into a coherent database will provide a treasure trove of results for future researchers to study, use, and build upon.

This thesis will explore a first-of-its-kind attempt to parse these massive datasets to provide a powerful tool for future researchers. It will also provide a window to help the average citizen understand Supreme Court behavior more clearly. By utilizing traditional data extraction and dataset analysis methods, many informative conclusions can be reached to help explain why the Court acts the way it does. For example, the results show that decisions decided by a narrow margin (i.e., by a 5 to 4 vote) are almost 4x more likely to be overruled than unanimous decisions by the Court. Many more results like these can be synthesized from the dataset and will be presented in this thesis. Possibly of higher importance, this thesis presents a framework to predict the outcomes of future and pending Supreme Court cases using statistical analysis of the data gleaned from the dataset.

In the end, this thesis strives to provide input data as well as results data for future researchers to use in studying Supreme Court behavior. It also provides a framework that researchers can use to analyze the input data to create even more results data.

As more services have come to rely on sensor data such as photos and audio collected by mobile phone users, verifying the authenticity of this data has become critical for service correctness. At the same time, contributors require the flexibility to modify data for resource efficiency, presentation, or privacy before the data is submitted. This dissertation presents two approaches for resolving the tension between data authenticity and user choice. YouProve is a partnership between a mobile device's trusted hardware and software that allows untrusted client applications to directly control the fidelity of data and enables services to verify that the meaning of source data is preserved. The key to YouProve's approach is trusted analysis of derived data, which generates statements comparing the content of a derived data item to its source.

To address certain cases where YouProve's approach is insufficient for evaluating modifications to photos, we introduce an alternative approach called pixel tracking. Pixel tracking uses dynamic taint analysis, or taint tracking, to monitor the execution of untrusted image processing code and track the history of operations performed on individual pixels. Pixel tracking is built on TaintDroid, a collaborative work that enables taint tracking in the Android operating system. This dissertation presents two key enhancements to TaintDroid to improve its efficiency and precision which are critical for enabling pixel tracking and other follow-on work.

Experiments with prototype implementations of YouProve and pixel tracking for Android demonstrate that the approaches are feasible. YouProve's photo analyzer is over 99% accurate at identifying regions changed only through meaning-preserving modifications such as cropping, compression, and scaling. Pixel tracking complements YouProve's analysis and can provide valuable information in several important cases where the photo analyzer falls short. YouProve's audio analyzer is similarly accurate at detecting which sub-clips of a source audio clip are present in a derived version, even in the face of compression, normalization, splicing, and other modifications. Finally, performance and power costs are reasonable, with YouProve's analyzers having little noticeable effect on interactive applications and CPU-intensive analysis completing asynchronously in under 30 seconds for 5-megapixel photos and under 70 seconds for 5-minute audio clips. Pixel tracking incurs slowdowns of only 21% to 43% for fine-grained tracking of image processing code.

Our work on YouProve and pixel tracking demonstrates that it is possible to provide guarantees about data authenticity while preserving users' control over the data they contribute.

Online Social Network (OSN) services such as Facebook and Google+ are fun and useful. Hundreds of millions of users rely on these services and third-party applications to process and share personal data such as friends lists, photos, and geographic location histories. The primary drawback of today's popular OSNs is that users must fully trust a centralized service provider to properly handle their data.

This dissertation explores the feasibility of building feature-rich, privacy-preserving OSNs by shifting the bases for trust away from centralized service providers and third-party application developers and toward infrastructure providers and OSN users themselves.

We propose limiting the trust users place in service providers through two decentralized OSNs: Vis-a-Vis and Confidant. In Vis-a-Vis, privacy-sensitive data is only accessed by user-controlled code executing on ``infrastructure as a service" platforms such as EC2. In Confidant this data may only be accessed by code running on desktop PCs controlled by a user's close friends. To reduce

the risks posed by third-party OSN applications, we also developed a Multi-User Taint Tracker (MUTT). MUTT is a secure ``platform as a service" that ensures that third-party applications adhere to access policies defined by service providers and users.

Vis-a-Vis is a decentralized framework for location-based OSN services based on the

privacy-preserving notion of a Virtual Individual Server (VIS). A VIS is a personal virtual machine running within a paid compute utility. In Vis-a-Vis, a person stores her data on her own VIS, which arbitrates access to that data by others. VISs self-organize into overlay networks corresponding to social groups with whom their owners wish to share location information. Vis-a-Vis uses distributed location trees to provide efficient and scalable operations for creating, joining, leaving, searching, and publishing location data to these groups.

Confidant is a decentralized OSN platform designed to support a scalable application framework for OSN data without compromising users' privacy. Confidant replicates a user's data on servers controlled by her friends. Because data is stored on trusted servers, Confidant allows application code to run directly on these storage servers. To manage access-control policies under weakly-consistent replication, Confidant eliminates write conflicts through a lightweight cloud-based state manager and through a simple mechanism for updating the bindings between access policies and replicated data.

For securing risks from third-party OSN applications, this thesis proposes a Multi-User Taint Tracker (MUTT) -- a secure ``platform as a service'' designed to ensure that third-party applications adhere to access policies defined by service providers and users. Mutt's design is informed by a careful analysis of 170 Facebook apps, which allows us to characterize the requirements and risks posed by several classes of apps. Our MUTT prototype has been integrated into the AppScale cloud system, and experiments show that the additional data-confidentiality guarantees of running an app on MUTT come at a reasonable performance cost.

Sleek and powerful touchscreen devices with continuous access to high-bandwidth wireless data networks have transformed mobile into a first-class development platform. Many applications (i.e., "apps") written for these platforms rely on remote services such as Dropbox, Facebook, and Twitter, and require users to provide one or more passwords upon installation. Unfortunately, today's mobile platforms provide no protection for users' passwords, even as mobile devices have become attractive targets for password-stealing malware and other phishing attacks.

This dissertation explores the feasibility of providing strong protections for passwords input on mobile devices without requiring large changes to existing apps.

We propose two approaches to secure password entry on mobile devices: ScreenPass and VeriUI. ScreenPass is integrated with a device's operating system and continuously monitors the device's screen to prevent malicious apps from spoofing the system's trusted software keyboard. The trusted keyboard ensures that ScreenPass always knows when a password is input, which allows it to prevent apps from sending password data to the untrusted servers. VeriUI relies on trusted hardware to isolate password handling from a device's operating system and apps. This approach allows VeriUI to prove to remote services that a relatively small and well-known code base directly handled a user's password data.

Advances in mobile hardware and operating systems have made mobile a first-class development platform. Activities such as web browsing, casual game play, media playback, and document reading are now as common on mobile devices as on full-sized desktop systems. However, developers are still constrained by the inherent resource limitations of mobile devices. Unlike desktop systems, mobile devices must sacrifice performance to accomodate smaller form factors and battery-backed operation. Opportunistic offloading of computation from a mobile device to remote server infrastructure (i.e., "code offload") offers a promising way to overcome these constraints and to expand the set of applications

(i.e., "apps") that can run on devices.

Deciding to offload requires a careful consideration of the costs and benefits of a range of possible program partitions. This cost-benefit analysis depends on external factors, such as network conditions and the resources availability, as well as internal app properties, such as component dependencies, data representations, and code complexity. Thus, benefiting from offload requires some assistance from developers, but requiring developers to adopt arcane or unnatural programming models will hinder adoption of regardless of the potential benefits.

In this dissertation we characterize two frameworks that reduce the amount of developer effort required to improve the performance of mobile apps through code offload. The first, MAUI, is designed for computationally intensive general-purpose apps such as speech

and facial recognition. The second, Kahawai, is designed for graphics-intensive apps like fast-action video games.

MAUI continuously monitors the device, network, and app, and uses its measurements to compute an energy-efficient program partition. MAUI reduces the burden on developers by taking advantage of core features of the managed code environments common to mobile

platforms: code portability, serialization, reflection, and type safety. These features allows MAUI to automatically instrument and potentially offload methods that the developer has tagged as suitable for offload. MAUI is particularly effective on applications composed by operations whose computational cost is large compared to the transfer cost of their input parameters and their output results.

Kahawai is designed for graphics-intensive apps such as console-style games and takes advantage of two features of today's mobile gaming platforms: capable mobile GPUs and reusable game engines. Even though today's mobile devices cannot duplicate the sophisticated graphical detail provided by gaming consoles and high-end desktop GPUs, devices have seen rapid improvements in their GPU processing capabilities. Kahawai leverages a device's GPU to provide collaborative rendering. Collaborative rendering relies on a mobile GPU to generate low-fidelity output, which when combined with server-side GPU output allows a mobile device to display a high-fidelity result. The benefits of collaborative rendering are substantial: mobile clients can experience high-quality graphical output using relatively little bandwidth. Fortunately, because most modern games are built on top of reusable game engines, developers only have to identify the sources of non-determinism

in the game logic to take advantage collaborative rendering.

Together, MAUI and Kahawai demonstrate that code offload can provide substantial benefits for mobile apps without overburdening app developers.

A process can voluntarily set memory protections to different portions of its address space. As threads in a process share the same address space, they are equally bound to its protections. In this dissertation, we explore the concept of parallel memory permissions, a powerful technique that allows multiple threads to execute in parallel while having different permissions to the same address space, and we show how it may be implemented on commodity hardware without requiring special hardware primitives. Parallel memory permissions makes it practical and easy to apply various tools and protection schemes in multi-threaded applications; practical because it does not hinder threads from executing in parallel and easy because by virtue of not segmenting a process’s address space, applications require only slight modifications (if any) to benefit from it.

We demonstrate this first with SandTrap, a Dynamic Information-Flow Tracking (DIFT) tool for machine code on Android. SandTrap complements TaintDroid and addresses its key limitation: the inability to track information flows when an app calls third-party native functions. The key to SandTrap is on-demand DIFT, where DIFT is performed only when threads access data that needs to be tracked. Otherwise, they run unmodified without any DIFT overhead. As Android apps are inherently multi-threaded, on-demand DIFT in SandTrap is possible because of parallel memory permissions. It allows SandTrap to set different sets of memory protections on a thread depending on whether it is running third-party native code, and it does so without hindering the parallelism of the app. The current prototype of SandTrap runs on a real smartphone device with unmodified apps downloaded from the Google Play Store, such as Instagram.

Next, we present DoubleVision, a system that addresses the problem of stray memory accesses in which a thread might accidentally read or write to memory-mapped application resources. These stray accesses often occur because of bugs in the application code and they can violate the integrity or confidentiality of resources in memory. We show how DoubleVision uses parallel memory permissions to restrict a thread from inadvertently accessing such resources, without requiring significant refactoring of the application.

Crowdsourced live video streaming from users is on the rise. Several factors such as social networks, streaming applications, smartphones with high-quality cameras, and ubiquitous wireless connectivity are contributing to this phenomenon. Unlike isolated professional videos, live streams emerge at an unprecedented scale, poorly captured, unorganized, and lack user context. To utilize the full potential of this medium and enable new services on top, immediate addressing of open challenges is required. Smartphones are resource constrained -- battery power is limited, bandwidth is scarce, on-board computing power and storage is insufficient to meet real-time demand. Therefore, mobile cloud computing is cited as an obvious alternative where cloud does the heavy-lifting for the smartphone. But, cloud resources are not cheap and real-time processing demands more than what the cloud can deliver.

This dissertation argues that throwing cloud resources at these problems and blindly offloading computation, while seemingly necessary, may not be sufficient. Opportunities need to be identified to streamline big-scale problems by leveraging in device capabilities, thereby making them amenable to a given cloud infrastructure. One of the key opportunities, we find, is the cross-correlation between different streams of information available in the cloud. We observe that inferences on a single information stream may often be difficult, but when viewed in conjunction with other information dimensions, the same problem often becomes tractable.

Today's consumer mobile platforms such as Android and iOS manage large ecosystems of untrusted third-party applications. It is common for an application to request one or more types of sensitive data. Unfortunately, users have no insight into how their data is used. Given the sensitivity of the data accessible by these applications, it is paramount that mobile operating systems prevent apps from leaking it.

This dissertation shows that it is possible to improve the soundness of dynamic information-flow tracking on a mobile device without sacrificing precision, performance, or transparency. We extend the state of the art in dynamic information-flow tracking on Android and address two major limitations: quantifying implicit flow leaks in Dalvik bytecode and tracking explicit flows in native code. Our goal is to deliver seamless end-to-end taint tracking across Dalvik bytecode and native code.

We propose SpanDex, a system that quantifies implicit flow leaks in Dalvik bytecode for apps handling password data. SpanDex computes a bound of revealed tainted data by recording the control-flow dependencies and for each password character, keeps track of the possible set of values that have been inferred. We also propose TaintTrap, a taint tracking system for native code in third party apps. We explore native taint tracking performance bottlenecks and hardware acceleration techniques to improve instrumentation performance.

Cameras are pervasive and multiplying. A device’s camera allows users to capture and share important moments, and programmatic camera access provides apps with a rich interface for digitizing information about the physical world. At the same time, cameras create new privacy challenges for mobile operating systems. Apps can often access both essential (e.g., a QR code) and inessential (e.g., text) data within the same camera view. This co-mingling of essential and inessential data could leak information to apps that a user prefers to keep secret. Unfortunately, users have no insights into how the images captured by the apps are being used. Given the sensitivity of the data captured by the camera apps, it is important that the mobile operating system provides mechanisms to prevent apps from inadvertent visual leaks.

Existing mobile platforms provide only coarse-grained access controls for the camera (i.e., an app can access all of a camera's view or none of it), whereas, a finer-grained access control is needed to protect against visual leaks. Designing fine-grained access control for cameras in the mobile operating system is not a trivial task and opportunities need to be identified to handle different apps designed for different use cases.

In this dissertation, we first highlight the visual privacy risks to the users of camera apps and the bystanders. Then, we show that the recent proposed solutions are either inadequate for mitigating these risks or not suitable for real-time apps. The key insight of this dissertation is that if we can infer the least amount of visual information a camera app needs to function then we can design practical fine-grained access control for the camera app. To demonstrate the efficacy of our ideas, we design and implement two frameworks, CamForensics and PrivateEye.

CamForensics is designed to detect if an app performs image manipulation which is not expected by the user of the app. Specifically, CamForensics monitors if a known image processing is applied to the incoming camera data. CamForensics performs dynamic binary instrumentation to track the sequence of functions from an image processing library applied on a camera data. Later it matches the obtained function call sequences with prerecorded signatures of all the known image processing. This information can be reported to the user and she can make an informed decision about the usage of the app.

PrivateEye is a privacy-marker system that helps users mark visually non-sensitive two-dimensional regions in a camera's view and deliver only content within the marked regions to the apps. PrivateEye is designed as an efficient computer vision pipeline which is integrated with the trusted camera service to handle the camera data. We extend PrivateEye and design ePrivateEye where we offload the computation-intensive task to a local server and achieve high scalability and real-time performance.

This dissertation shows that it is possible to design efficient and scalable visual privacy mechanisms to provide better control over the information captured by the apps.

With the proliferation of embedded sensors within smartphone and Internet-of-Things devices, applications have programmatic access to more data processing than ever before. At the same time, advances in computer vision and deep learning have fostered methodology for performing complex, yet powerful operations on spatial and temporal data. Capitalizing on this union, applications are capable of providing advanced functionality to their users through features such as augmented reality and image classification. However, the devices responsible for running these libraries often lack the sufficient hardware to replicate the parallelization and straight-line speed of high-end servers. For image processing applications, this means that realtime performance is difficult without compromising functionality.

To detail this emerging paradigm, this work presents and examines two image processing applications which offer advanced functionality. The first, DarNet, utilizes the TensorFlow library to perform distracted driving classification based on image data using a Convolutional Neural Network (CNN). The second, PrivateEye, uses the OpenCV library to provide a camera based access-control privacy framework for Android users. While this advanced processing allows for enhanced functionality, the computationally expensive operations impose limitations on the realtime performance of these applications due to the lack of sufficient hardware.

This work posits that realtime image processing applications running on resource constrained devices require the external use of edge servers. To this extent, this work presents ePrivateEye, an extension to PrivateEye which provides code offloading to an edge server. The results of this work shows that offloading video-frame analysis to the edge at a metro-scale distance allows ePrivateEye to analyze more frames than PrivateEye's local processing over the same period, and achieve realtime performance of 30 fps with perfect precision and negligible impact on energy efficiency.

In recent years, as mobile devices started to become an essential part of everyday computing, virtualization on mobile devices has begun to emerge as a solution for supporting multiple profiles on the same device. However, virtualization on mobile and embedded systems, and to a greater extent, on systems with limited hardware support for virtualization, often face different hardware environment than x86 platforms.

First of all, these platforms were usually equipped with CPUs that did not have hardware virtualization support. We propose a transparent and portable CPU virtualization solution for all types of CPUs that have hardware breakpoint functionality. We use a combination of the hardware breakpoint support and guest kernel control flow graph analysis to trap and emulate sensitive instructions.

Second, the traditional way of implementing record and replay which is an important feature of virtualization, cannot be implemented the same way on CPUs without hardware branch counters. We propose a record and replay implementation without using hardware branch counters on paravirtualized guests. We inspect guest virtual machine internal states to carefully rearrange recorded instructions during replay to achieve the same end result without having to literally repeat the same stream of instructions.

Third, these platforms are often equipped with storage systems with distinct I/O characteristics. SD card, for example, is a prevalent storage media on smartphones. We discuss the mismatch of I/O characteristics between SD card write speed characteristics and guest virtual machine workload characteristics using VMware Mobile Virtualization Platform as an example. We then propose a solution to bridge the gap and achieve efficient guest I/O when storing guest virtual disk images on SD cards.

This dissertation shows that it is possible to efficiently virtualize and provide advanced virtualization functionality to a range of systems without relying on x86 and PC specific virtualization technologies.