Self-proclaimed “technogeeks” at the Defense Advanced Research Projects Agency, after determining the nature of the cybersecurity threat, have devised programs to tackle the problem and, most importantly, surprise their adversaries, DARPA’s deputy director said.
Kaigham Gabriel spoke here at the Dec. 16 Cyber Security Forum and said the agency’s sole mission since its inception in 1958 has been to prevent and create technology surprises.
Two of the agency’s recent cybersecurity programs, called CRASH and PROCEED, were created for that purpose.
CRASH, the Clean-slate Design of Resilient, Adaptive, Secure Hosts program, seeks to build new computer systems that resist cyberattacks. After successful attacks they would adapt, learn from the attack and repair themselves, Mr. Gabriel said.
CRASH evolved from a workshop DARPA held earlier this year where they pulled together cybersecurity and operating-system experts and infectious-disease biologists, he said.
“The first couple of hours, someone who was there described it as being like a junior high school dance,” he added. “All the biologists were on one side of the room, the computer scientists on the other. Finally one of them walked over and began talking, and they all started mixing.”
Some interesting ideas came out of the workshop, Mr. Gabriel said. One was that biology starts from the supposition that attackers — bacteria or viruses — will get through the body’s defenses. The body doesn’t even try to stop them; biology just deals with it.
The body doesn’t care how many times things get in, he added. And bodies are genetically diverse; viruses or bacteria that infect one body won’t necessarily infect all the others, or infect them in the same way.
This concept applies to computer vulnerabilities because most computer hardware is built the same way, Mr. Gabriel said.
“The idea is to look at the structure of computers, which are identical and have no security in the hardware … because performance was king 15 or 20 years ago,” he said. “Transistors and computer performance were precious, and you didn’t give up any of it to security. Now, the world is different.”
Today, security could be added to computer hardware, giving computers a sort of genetic diversity that would make them less vulnerable to cyber infections.
Getting such new, more robust hardware architecture into the market will take some time, Mr. Gabriel said, noting that the reason for programs like CRASH is to create something he calls convergence between cyberthreats and cybersecurity.
To analyze the problem of convergence, DARPA engineers compared the number of lines of source code written over 20 years in security software and the number of lines of code in malware written over the same period.
Over 20 years, he said, the lines of code in security software increased from about 10,000 to 10 million lines. The number of lines of code in malware was surprisingly constant at about 125 lines.
This analysis and others “led us to understand that many of the things we’re doing are useful, but they’re not convergent with the problem,” Mr. Gabriel said. “We’re never going to catch up [with malware], so how do we change the game? How do we essentially create surprise for our adversaries in this challenge area?”
Along with CRASH, another way is PROCEED, or Programming Computation on Encrypted Data, he said.
“Encryption is one way of protecting things, but if you want to operate on encrypted data — process it, do something with it — you have to decrypt it first. You operate on it while it’s in a decrypted state, then take your result, encrypt that again, and send it on,” Gabriel said.
For the past several years, people have been debating about whether it’s possible to do operations on encrypted data without decrypting it first.
“It was considered to be such a difficult problem that people were mathematically trying to prove it couldn’t be done,” he said. “Then, about a year and a half ago, someone proved that it could be done. That’s the good news. The bad news is, it’s very inefficient right now — 12 orders of magnitude less efficient than it needs to be.”
PROCEED is working to improve that efficiency, he said.
“If we were able to do relevant sorts of operations without ever having to decrypt, that would be a tremendous gain because … whenever you decrypt into the open, you create vulnerability,” Mr. Gabriel said.
Convergence is the objective of both programs, he added. “They are aggressive programs; they may or may not be successful. That’s the nature of DARPA. But we have high hopes.”
