Fred B. Schneider's research while affiliated with Cornell University and other places

... For ∀∃ our automata formulation (in Sect. 7) shows that to prove a ∀∃-spec R ∃ ≈> S, instead of explicitly constructing a positive witness of the existential [11,38] one can instead filter out the non-witnesses on the right, so what's left satisfies the corresponding ∀∀-spec R ≈> S. All for some! In practice, many verification tools work directly with verification conditions, although some interactive tools are directly based on a HL (e.g., [16]). ...

... Here, as in most frameworks regarding insider threat, it is the user, their psychology and their actions which are the focus of attention rather than the technology -all the surveys referenced here with the exception of Salem at al. [31] consider psychological drivers for at least malicious behaviour, and for some work [18,42] it is the primary focus. Recently, work [19] has also looked at various methods of ingraining mitigation strategies into corporate culture, such as double-checking work and pair programming, but this obviously comes at a larger cost in human resources. ...

... Pucella and Schneider [174] investigate the effectiveness of defenses based on software diversity, in the context of memory safety. Their main result is to characterize such defenses as to be probabilistically equivalent to strong typing which would guarantee memory safety for buffers, thus reducing the security of the defense mechanism to the strength of strong typing. ...

... To precisely describe a dynamic policy, RIF [36], [35] uses reclassification relation to associate label changes with proram outputs. While this approach is highly expressive, writing down the correct relation with regards to numerous possible outputs is arguably a time-consuming and error-prone task. ...

... To protect against this, more data can be abstracted, i.e., the AP locations can be anonymized as well (while retaining category, floor, and relative information). Yet, it still needs to be established who has the privileges to query for information and what the queries can be [68]. Moreover, campuses can adapt existing access policies for student records to protect student collocation patterns. ...

... To support label introspection securely, our calculi protect each label with the label itself. Kozyri et al. (2019) generalizes this mechanism to chains of labels of arbitrary length (where each label defines the sensitivity of its predecessor) and study the tradeoffs between permissiveness and storage. ...

... It has several mechanisms, such as access control and information flow control, to prevent untrusted nodes from violating integrity and confidentiality. Other language-based information flow control approaches [56,86,108] have also been proposed. ...

... Such carbon footprint inflation can also be achieved by violating the integrity of the sustainability metrics (e.g., code or data) [19], [52] or by manipulating the system traces and logs-the evidence trail of carbon consumption [45] by the compromised VMs or malicious processes in data centers. Similarly, compromised data center providers may report false carbon footprints to the regulators [14] to evade high CO2 taxes or regulations. ...

... As a brand-new data storage, distribution, and management mechanism, blockchain allows users to participate in the calculation and storage of data and verify the authenticity of data with each other, to achieve reliable and reliable transfer of data and value in a decentralized and untrusted manner. With the continuous exploration and application of blockchain technology in various industries, its application model has become more and more mature, and a typical blockchain technology application architecture composed of storage layer, protocol layer, extension layer, and application layer has gradually formed consensus, as shown in Fig. 1 [6,7]. ...

... Computer scientist Fred Schneider describes the practical, political, and economic reasons why available state of the art technologies to defend against cyberattacks have not been, and are unlikely to be fully deployed. 4 He raises the very interesting question of trade-offs between the state's interest in protecting citizens and corporations against cyberattacks and the state's interest in surveillance of the same citizens, as well as others for national security reasons. 5 We (Johns and Riles), professors of law and Far East legal studies respectively, describe the limits of two key modalities of thinking about cybersecurity, which we term the "bunker" and the "vaccine." ...