IARPA: ADVANCED CYBER RESEARCH IN A CONNECTED WORLD DR. STACEY DIXON

Transcription

1 IARPA: ADVANCED CYBER RESEARCH IN A CONNECTED WORLD DR. STACEY DIXON 25 October 2016

2 Intelligence Advanced Research Projects Activity

3 The Intelligence Community Central Intelligence Agency Defense Intelligence Agency Department of State National Security Agency Department of Energy National Geospatial-Intelligence Agency Department of the Treasury National Reconnaissance Office Drug Enforcement Administration Army Federal Bureau of Investigation Navy Department of Homeland Security Air Force Coast Guard Marine Corps

4 IARPA s mission is to invest in high-risk/high-payoff research to provide the U.S. with an overwhelming intelligence advantage IARPA Mission and Method Bring the best minds to bear on our problems Full and open competition to the greatest possible extent World-class, rotational Program Managers Define and execute research programs that: Have goals that are clear, measureable, ambitious and credible Employ independent and rigorous Test & Evaluation Involve Intelligence Community (IC) partners from start to finish Run from three to five years Publish peer-reviewed results and data, to the greatest possible extent Transition relevant, successful capabilities to IC partners

5 User Application Operating System Firmware Hardware

6 User Application Operating System Hypervisor Firmware Hardware

7 IARPA Cybersecurity research alignment SPAR User CAUSE SCITE STONESOUP Application Operating System VirtUE Hypervisor Firmware CAT Hardware TIC 7

8 Security and Privacy Assurance Research (SPAR) 8

9 What do you do when a query is too sensitive to share, and bulk ingestion of the data raises privacy issues?

10 What do you do when a query is too sensitive to share, and bulk ingestion of the data raises privacy issues? Query Client Server Database, Policy Client learns: Response Query policy Other record contents Other clients queries Server learns: Query structure Query contents Query response Cross-query trends

11 SPAR Program Aims to create systems that guarantee privacy while also maintaining certain security characteristics Gives assurance to a data owner that only relevant information is shared Supports a practical set of query types and scales to realistic database sizes Enables collaboration between non-traditional/occasional partners, and administration without access to content

12 Ideal Sharing Architecture Query Client Server DB, Policy Third Party Encrypted (DB) Third Party learns limited information about DB and Queries Third Party management jointly decided by Client/Server Client learns: Response Query policy Other record contents Other clients queries Third party learns: Query structure Cross-query trends # of records returned Query contents Record contents Server learns: Query structure Query contents Query response Cross-query trends

13 SPAR Technical Accomplishments SPAR explored trade-offs among query complexity, security guarantees, processing time and memory requirements Approaches included: Oblivious Pseudorandom functions, Bloom Filters, Garbled RAMs, Private B-trees, and Shared input/shared output secure computation Program Status Program ended in 2015

14 Scientific advances to Continuous Insider Threat Evaluation (SCITE) 14

15 How can we advance the science and practice of insider threat detection?

16 SCITE Program Goals Model and forecast the performance of existing and proposed insider threat detection enterprises Develop a new class of active indicators and associated automated detection tools

17 SCITE Technical Accomplishments To be revealed Program Status Kick-off held in 2016 Program ongoing

18 Securely Taking on Executable Software of Uncertain Provenance (STONESOUP) Is this SOUP safe? 18

19 How can we benefit from highly functional software produced by a globalized industry without putting the enterprise at risk?

20 STONESOUP Program Protects systems by automatically preventing software weaknesses from being exploited STONESOUP Technology Automatically finds and mitigates exploitable security vulnerabilities in software Analyzes programs, not the data processed by programs Finds flaws that lead to insecure program conditions, rather than looking for known attack patterns

21 STONESOUP Technology Works with software as-built requires no software supplier input Starts secure/stays secure has a built-in conservative security policy with adaptive tuning to relax unneeded checks Mitigations are automatically applied requires no end user security decisions Benefit: Protected programs launch and run as expected

22 STONESOUP Technical Accomplishments Automatically hardens COTS software applications for higher assurance Linux binary executables with no access to source code required, C non-gui software applications up 100k lines of code, Java source code or bytecode applications Protects against embedded system exploits Measures the effectiveness of vulnerability mitigation tools and techniques Generates test data for cybersecurity research Program Status Program ended in 2015.

23 Circuit Analysis Tools (CAT) 23

24 Microelectronics designs are advancing faster than our capacity to analyze them. How do we keep up with microelectronics when next generation circuits are 10,000x smaller than a human hair?

25 CAT Program Develop tools for integrated circuit analysis at future technology nodes, specifically the 22 nm node and beyond. Analysis tools capable of working with advanced packages including but stacked die. Tools and techniques must address analysis and imaging challenges for which there are currently no solutions.

26 CAT Program Technical Thrusts Thrust 1: Circuit Edit Thrust 2: Fault Isolation Sample Preparation need Thrust 3: Logic Analysis Thrust 4: Fast Imaging

27 CAT Technical Accomplishments Developed a high brightness Gas Field Ion Source capable of delivering He, Ne, and Ar ions to mill at higher rates. Developed 2-photon laser technique that allows IR wavelengths to be used for Si transmission producing half wavelength imaging for higher resolution.

28 CAT Technical Accomplishments Developed a logic analysis tool capable of probing on 22nm SOI ICs. Developed a superconducting nanowire single-photon detector for higher efficiency and resolution. Developed a prototype hybrid laser/mechanical back-side silicon preparation tool Developed methods for thick and think dies.

29 Program Status Program complete. Several commercial products are in the marketplace.

30 Trusted Integrated Chips (TIC) 30

31 Over 90% of the world s integrated circuit foundry capacity is controlled by non-us companies. How can we leverage this global infrastructure while protecting intellectual property and ensuring security?

32 TIC Program Ensure the U.S. Intelligence Community can obtain the highest performance possible in integrated circuits. Obtain assurance that designs are safe and secure not compromised with malicious circuitry. Ensure security of designs, capability, and performance while simultaneously protecting intellectual property. Realize secure systems combining advanced CMOS with higher value chips.

33 TIC Program Develop new IC obfuscation layout strategies to protect both functional capability and performance. Demonstrate the concept of split-manufacturing of integrated circuits using a state-of-the-art untrusted FEOL (Front End of Line) foundry and a trusted BEOL (Back End of Line) foundry. Fabricate chips at the 130nm, 65nm and 28nm manufacturing nodes.

34 Secure Split-Manufacturing and Integration Wires MtM: MEMS, Photonics, Add l chips (US company) BEOL: Metallizations Trusted Foundry Transistors FEOL: CMOS Transistors + Metal 1 Untrusted Foundry

35 Technical Accomplishments Demonstrated split-manufacturing of integrated circuits at the 130nm and 65nm production nodes and is completing evaluation at 28nm. Both Single- and Split-fab wafers delivered; chips are now undergoing testing. Program Status Program is in its final phase. Findings are being shared with government and industry.

36 Cyber-attack Automated Unconventional Sensor Environment (CAUSE) 36

37 How can we forecast cyber-attack events, hours to weeks earlier than existing methods?

38 CAUSE Program goals Develop and validate unconventional multi-disciplinary sensor technology that will forecast cyber-attacks and complement existing advanced intrusion detection capabilities.

39 CAUSE Technical Accomplishments To be revealed Program Status Kick-off held in 2016 Program ongoing

40 Virtuous User Environment (VirtUE) 40

41 How can we develop user environments that are more dynamic, secure, auditable, transferrable, and efficient than the current offerings provided by traditional physical workstations and commercial Virtual desktop infrastructure?

42 VirtUE Program goals Develop new user environments. Develop innovative, dynamic analytics and infrastructures that can leverage these newly developed user environments to both automatically detect and deter security threats that IC user environments will be subject to in the new cloud infrastructure.

43 Let s Build a Better Environment A Virtue a virtual appliance built specifically for the purpose of safe, user-interactive computing tasks

44 Make the Virtue Role Focused Current User Environment Virtue User Environment 1 desktop environment = multiple user roles 1 Virtue environment = one user role

45 Build Dynamic Analytic Logic That Leverages Virtues

46 VirtUE Technical Accomplishments To be revealed Program Status Broad Area Announcement released on 18 October 2016 See iarpa.gov or Fed Biz Ops

47 IARPA Cybersecurity research alignment SPAR User CAUSE SCITE STONESOUP Application Operating System VirtUE Hypervisor Firmware CAT Hardware TIC 47

48 How to Engage with IARPA Research Program Broad Agency Announcement (BAA) Seedlings through IARPA-wide BAA Requests For Information (RFIs) Workshops Prize Challenges Or join us as a Program Manager for 3-5 years!

49 How to Contact IARPA