Cornell Systems Lunch

Every few months there’s another article: "The system" labels a 12-year old as a terrorist or credit agencies ruin someone’s life due to a mixup. These problems all occur because data management as we know it is designed for perfect data. Huge amounts of time, effort, and money are spent on what has come to be known as "Wrangling," or fine-tuning data cleaning pipelines to preserve this illusion of perfection. In this talk, I propose a different strategy: Let the database guess. I’ll introduce a system we’re building called Mimir, which takes a principled approach to heuristic guesswork. Mimir combines techniques from provenance, probabilistic query processing, and compilers to provide a lightweight, easy-to-use, backwards-compatible framework for helping users understand the impact of heuristic guesses on query results and reports. In particular, I will focus on one of Mimir’s query evaluation strategies, which implements a taint-based approximation of probabilistic query processing that we call annotated-best-guess (ABG) semantics. I’ll sketch some of our formal results about the tightness of the ABG approximation, show how this approach outperforms classical probabilistic query processing techniques, and finally outline some of the other projects being developed as part of Mimir. (This work is supported by NSF Award ACI-1640864, NPS Award #N00244-16-1-0022, and gifts from Oracle)

Bio: Oliver Kennedy has been an assistant professor at the University at Buffalo, SUNY since 2012. He earned his PhD from Cornell University in 2011 and now leads the Online Data Interactions (ODIn) lab, which operates at the intersection of databases and programming languages. Oliver is the recipient of the UB SEAS Early Career Teacher of the Year Award, and UB CSE’s Outstanding Funding Award, and has several papers invited to "Best of" compilations from SIGMOD and VLDB. Oliver’s ODIn lab is currently exploring uncertain data management, just-in-time data structure design, and "small data" management.

Securing highly complex networked computing systems is a challenging task. This can be observed from the fact that despite significant efforts from government, industry and academia, new vulnerabilities continue to be discovered every day. As computing systems become more integrated with the society, there is an urgent need for trustworthy systems.

In this talk, I will describe my research efforts to build trustworthy computer systems. I will begin by briefly discussing my understanding of computer security from both the industry and academic perspectives, then summarize several challenges and opportunities in secure systems. I will then detail my work on realizing trusted execution environment that can defend against advanced attackers launching multi-vector attacks on embedded devices. These efforts lead to not only the design and implementation of the cache-assisted secure execution system on ARM processors, but also studies on the fundamental limitations of these security mechanisms. By addressing the key challenges in embedded devices, my works pave the way for the further proliferation of trusted execution environments for mission critical applications. To conclude the talk, I will briefly present my research vision for computer security in the future.

Businesses and governments are increasingly using sophisticated monitoring technologies to mine sensitive user information and perform mass surveillance. Anonymity systems such as the Tor network aim to protect user identity in online communications. Anonymity enables freedom of speech and communications on the Internet, which is an essential tool for our democratic society.

In this talk, I will consider the unique perspective of network level adversaries, such as Internet service providers, and their impact on the security of anonymity systems including Tor. First, I will present Raptor attacks (USENIX Security 2015), a suite of attacks that exploit structural properties of Internet routing and vulnerabilities in inter-domain routing (BGP) to compromise the privacy of Tor clients. Second, I will discuss Counter-Raptor defenses (IEEE S&P 2017), our proposed defenses for mitigating the threat of active routing attacks on Tor. Overall, the talk motivates rethinking our communication systems to mitigate network-level adversaries that can exploit and manipulate Internet routing.

For the last several years, Google has been leading the development and real-world deployment of state-of-the-art, practical techniques for learning statistics and ML models with strong privacy guarantees for the data involved. (For example, this includes the RAPPOR and Prochlo mechanisms for learning statistics in the Chromium and Fuschia OSS projects.) In this talk, he will start by presenting a new, easy-to-apply "exposure" metric which allows estimating the magnitude of problems that result when such protective techniques are *not* applied—and which can be utilized to extract individual secrets, such as social security numbers (see https://arxiv.org/abs/1802.08232).

To protect users’ privacy in the age of mass-surveillance, there have been many works on secure communication that use end-to-end encryption to protect the content of the communication, like Signal and Let’s Encrypt. Unfortunately, encryption does little to hide the metadata of the communication (such as when and with whom a user is communicating) and provides virtually no privacy when one of the end points is compromised. In this talk, I will describe our efforts to design scalable anonymous communication networks to address this issue. I will first present Atom, a scalable anonymous communication network with strong anonymity properties. Atom allows its users to anonymously send messages, and protects the senders’ identities against powerful adversaries. At the same time, Atom is able to scale easily to more users by simply adding more servers to the network, unlike most existing systems with similar security properties. Then, I will describe some limitations of Atom, and present Quark, our ongoing effort. By using much more efficient crypto and a new routing protocol, Quark that can provide similar guarantees to Atom with significantly less overhead.

Atom is joint work with Albert Kwon, Bryan Ford and Henry Corrigan-Gibbs. Quark is joint with Albert Kwon.

Biography: Srini Devadas is the Webster Professor of EECS at MIT where he has been on the faculty since 1988. His current research interests are in computer security, computer architecture and applied cryptography. Devadas received the 2017 IEEE Wallace McDowell award for his research in secure hardware. He is the author of "Programming for the Puzzled" (MIT Press, 2017), a book that builds a bridge between the recreational world of algorithmic puzzles and the pragmatic world of computer programming, teaching readers to program while solving puzzles. Devadas is a MacVicar Faculty Fellow and an Everett Moore Baker teaching award recipient, considered MIT’s two highest undergraduate teaching honors.

Electronic exchanges play an important role in the world’s financial system, acting as focal points where actors from across the world meet to trade with each other. But building an exchange is a difficult technical challenge, requiring high transaction rates, low, determinstic response times, and serious reliability. We’ll look at the question of how to design an exchange through the lens of Concord, a system for building exchange-like systems that was developed at Jane Street. Concord is designed from the ground up around state machine replication, a classic distributed systems technique. This choice has profound affects on the resulting system, providing a simple framework for building a reliable platform, while at the same time requiring very careful performance engineering to make it work effectively. We’ll discuss the pros and cons of the design, and consider the lessons it provides for other transaction processing systems.

For partitioned tables, maintaining good clustering properties for frequently accessed dimensions is critical for partition pruning performance. Naive methods of clustering maintenance could be expensive, especially when the clustering dimensions are different from the dimensions with which the data is loaded. On the other hand, approximate clustering is cheaper to maintain while still resulting in good pruning performance. In this talk, I will present Snowflake’s clustering capabilities, including our algorithm for incremental maintenance of approximate clustering of partitioned tables, as well as our infrastructure to perform such maintenance automatically. I will also cover some real-world problems we run into and our solutions.