Purdue University, Fall 2026.
Data security and privacy are essential components of information security. This course introduces the fundamental principles and techniques for protecting data security and privacy. The course covers foundational access control models, including discretionary access control, mandatory access control, and role-based access control. It also covers key topics in data privacy, including data anonymization, re-identification attacks, (local) differential privacy, membership inference, and cryptographic techniques for privacy protection.
| Instructor | Yuntao Du ([email protected]) |
|---|---|
| Term | Aug 24 to Dec 12, 2026. Final exams Dec 14 to 19. |
| Format | Fully online, a new module is released each Monday |
| Office hours | By appointment |
| Discussion and submission | Brightspace |
| Component | Weight | Notes |
|---|---|---|
| Homeworks | 50% | About 4 assignments, either written assignments or small projects that require programming |
| Quizzes | 8% | 4 quizzes, in weeks 4, 9, 15 and 16 |
| Midterm exam | 18% | Week 12, covering weeks 1 to 11 |
| Final exam | 24% | Finals week, covering weeks 9 to 15 |
What information security means when the adversary is intelligent, and the operating system mechanisms that enforce protection.
Access control fundamentals, from subjects, objects and the access matrix to Unix file permissions and the process user-ID model.
Why discretionary access control fails against malicious software, and how mandatory access control responds.
The Bell-LaPadula model and multi-level security, together with covert channels and the assurance criteria built around them.
Integrity models from Biba to Clark-Wilson, and information flow security.
Role-based access control and its attribute-based successors.
Syntactic anonymization and the attacks that defeat it.
Differential privacy: the definition, how privacy budget composes, and the Laplace mechanism.
The exponential mechanism, and the settings in which differential privacy gets applied.
Differential privacy in the local model, where each record is perturbed before it is ever collected.
Publishing histograms and marginals under differential privacy, and membership privacy as a general framework.
Privacy auditing via membership inference: history, current state, and future directions.
Symmetric cryptography, from perfect secrecy to practical ciphers and hash functions.
Hash functions, message authentication codes, and the move to public-key cryptography.
Public-key cryptography, digital signatures, and secure multiparty computation.
Final review and Q&A in the last week of classes.
Final exam, released Monday Dec 14 with one week to complete.
No required textbook. All materials will be posted on Brightspace.
It is allowed to discuss homework problems. However, if you look at another student's program code or written or typed answers, or let another student look at your program code or answers, that is considered cheating. If caught for the first time, you receive a 0 on the assignment. For the second time, you receive a failing grade in the class.
Quizzes and both exams are individual work, with no collaboration of any kind.
You may use LLMs to help you understand the concepts. Copying answers from an LLM is not allowed and is treated as academic dishonesty. When an LLM materially shaped your solution, say so and describe how you used it.
You have three extension days for the term, to be used at your discretion across homeworks. The following conditions apply:
Academic honesty and ethical behavior are required in this course, as they are in all courses at Purdue University. The class will be conducted according to the policy written by Professor Gene Spafford. Please take the time to read it carefully. This will be followed unless the instructor provides written documentation of exceptions.
Students who need accommodations should contact the Disability Resource Center and share their accommodation letter with me as early in the term as possible.