Loading...

powered by co-ment®
 

National Cyber Leap Year Summit 2009:  

Exploring Paths to New Cyber Security Paradigms  

Draft Report 

 

August 24, 2009

 

The following unedited ideas were contributed by participants at the National Cyber Leap Year Summit as additional ideas for consideration and comment. The Summit is managed by QinetiQ North America at the request of the NITRD Program, Office of the Assistant Secretary of Defense Networks and Information Integration, and the White House Office of Science and Technology Policy.

 

Please provide your comments, if any, by September 3, 2009 for utilization by the Summit’s program co-chairs. To add a comment, select the “Add” tab in the left navigation menu, select (highlight) the portion of the document you are commenting on, and provide your comment.  If commenting on an entire section, you may select the section heading to anchor your comment.

 

If you have any further questions or comments, please visit the National Cyber Leap Year Web site at the following address: http://www.nitrd.gov/NCLYSummit.aspx, or send email to leapyear@nitrd.gov.

 

 

A new virtualisable network architecture

Authors (Alphabetical Order): Benjamin GITTINS (Synaptic Laboratories Limited), Larry D WAGONER (NSA)  

A new virtualisable network architecture (VNA) that rides on the current Internet that offers advanced identity management including but not limited to: authentication, non-repudiation, attribution and network introspection. Access to the VNA may be limited to hardened thin client running on a hardened hyper-visor complemented by a hardware token.  

To enter an accountable virtual network domain, a multiple-attested federated id will be employed. The ID would be issued by a nation-state or other recognised entity (equivalent to and maybe leveraging passports ID's). For example this issuance of the electronic id could possibly be managed by the US Postal Service and/or US State Department in the United States.  

There could exist multiple sub-domains for different sectors such as one for the medical establishment, defense industry, financial industry, e-commerce, etc. Each sub-domain could potentially have unique policies appropriate for that environment. For example a sub-domain could create a strictly accountable universe for all transactions.

This would largely eliminate Spam, Phishing, Identity Fraud/Spoofing, significantly raise the risks of hacking attacks by having authentication and attribution.  

For particular applications, sub-domains could exist on a purpose built communications substrate based on a semi-regular lattice/mesh based communications infrastructure to create to increase availability, performance and security.  

The new network architecture should be built using modern security and safety techniques so that it is fit for purpose in critical industrial systems, financial, medical, nuclear, mining, Government, e-commerce.  

 

A global electronic identity management system

Author: Benjamin GITTINS (Synaptic Laboratories Limited)  

A new robust (post quantum secure) global electronic identity management system that more accurately reflects the way human's reason about trust relationships. The proposed GEID system would implement a multiple-attested federated id, that combines the best features of centrally managed certificate authorities, with the ability to have more than one entity attest to an identity. It should also be possible to electronically aggregate multiple issued id tokens to attest a single entity.  

The hardware token managing an identity could be issued by a nation-state or other recognised entity. For example this issuance of the electronic ID could possibly be managed by the US Postal Service and/or US State Department in the United States.  

More than one party can attest to the identity managed by that token, including Governments, large organisations or other individuals such as friends and family members. The information used to reason about an identity assertion should be managed in a distributed decentralised federated system. The system should ensure interactivity, data minimization, privacy, least privilege, confidentiality, integrity, authenticity and have the ability to be audited by all stake holders. Any enrolled user should be able to request appropriate levels of information to authenticate an identity, however each such request must be audited and in some cases require authorisation by identity being queried.  

The system should support "composite" identities, such as Corporations and Organisations, allowing operations to be attested to by an organisation that is seperate from the individuals. For example "Authorised by 3 out of 5 directors of company X". See work by NRL.  

The system should be designed to protect against collusions of 'assertion' failure, and provide increased transparency into how an identity has been asserted. The system should include soft and hard reasoning ("I believe this is my child", "I have established this is my child using DNA tests").  

Furthermore the system can be adapted so that when a high value transaction takes place, the identity of the actors and the transaction must be attested to by mulitple entites, where the entities are held legally accountable for attesting to that identity/transaction. The accountability is limited only to matters of identity, and knowledge of the transaction, but not the transaction itself.  

 

Global post quantum secure cryptography based on Identity

Author: Benjamin Gittins (Synaptic Laboratories Limited)  

Global cryptographic services (authenticated key exchange, digital signatures, etc) based on identity that is robust and secure against both classical and quantum computer attacks. The system exploits a federated architecture, where at least one organisation from each of the federations participates in identifying users, assisting with key exchange operations and other related functions. This proposal describes an infrastructure suitable to IMPLEMENT the core functionality required on desktops and supporting public infrastructure.  

 

Evaluating the effectiveness of data depersonalization techniques and it's impact on the community

Author: Benjamin GITTINS (Synaptic Laboratories Limited)  

Measuring the wider impacts of unauthorised information disclosure

Author: Benjamin GITTINS (Synaptic Laboratories Limited)  

Large scale field studies are required to establish the value of information loss with respect to different classes of data including financial, medical, intellectual property, relationship information and geolocation of time for different groups including Enterprises, SME, and individuals. Such studies could be extended to assess the financial and emotional impact of down-time or availability of access to services.  

A greater understanding of the value of information managed by others, and its management, by the stake holders can better inform organisations on how to manage their IT infrastructure and risks.

 

Semiconductor Intellectual Property Protection

Author: Benjamin GITTINS (Synaptic Laboratories Limited)  

Synaptic Laboratories has proposed a method of designing semiconductor devices with improved trust characteristics that protect the Intellectual Property rights and profits of the fabless semiconductor design house.  

Combinatorial locks can be implemented in a hardware circuit by inserting or replacing hard-wired logic with programmable logic. The logic for the look up table is locked away in a private database such as a smart card until it is used to unlock the device. An attacker must select the correct value to unlock the programmable logic that ensures correct and reliable operation of the device. This value can be remotely programmed using symmetric cryptographic techniques. To improve the utility of combinatorial locks we propose splitting the circuit design across at least two teams (Yellow and Orange) such that each team is responsible for managing independent locks in their respective modules. The remaining unlocked source code can be exposed to all teams enabling more efficient development practices over other existing more restrictive approaches. This process allows global placement and routing of performance sensitive code without risk of chip over manufacture due to unauthorised disclosure. Simulation of the chip design is efficiently achieved using an enhanced distributed chip simulator of two or more machines. The yellow and orange teams are responsible for ensuring their portions of locked code are simulated at full speed by machines they trust will not expose their locked logic. After a circuit is finalised traditional risk management techniques are recommended to prevent modification of the circuits before and/or during manufacture of the wafer masks, there by providing assurance against a wide range of attacks. Each team is responsible for securely loading their portion of the locked circuit behaviour into each manufactured chip from a remote location or a tamper proof module.

 

 

Dynamic Distributed Key Infrastructures (DDKI) – a topology

 

Dynamic Distributed Key Infrastructures (DDKI) – a topology & Dynamic Identity Verification and Authentication (DIVA) – a process & Whitenoise – a cryptographic algorithm

Authors: Andre Brisson & Stephen Boren

For 35-40 years we have relied on Public Key Infrastructures (PKI). They have always been vulnerable to man-in-the-middle attacks. They do not scale well. They are very expensive. It is a given that they will not be post quantum computing secure (PQCS). DDKI provides a complete, new generation identity-based, cryptosystem that incorporates: Complete federated and distributed key and identity management configuration, for example:

Horizontal implementation example

The architect of the future must be elastic enough that it inherently can adjust to historical context in terms of the appropriate balancing of privacy and security. For example, during times of war security may require greater latitude (by legislation) and during times of peace there are degrees of greater privacy. This is the inherent democratic challenge of balancing privacy and security in technology.

Note: for stakeholders frightened of “growing government” this structure can be condensed into one department for efficiencies with the same kind of mandate as Department of Homeland Security whose task is to integrate all elements of law enforcement and military.

Vertical implementation example
Complete identity can be parsed, federated and distributed vertically between government/law enforcement/military and industry and citizenry. For example:

Note: at the ends of the liability/responsibility spectrum we have one of two realities:

1. The private commercial sector shares equal responsibility with the criminal private citizenry sector.

2. The government sector shares equal responsibility/liability with the private criminal sector and the private commercial sector has no responsibility/liability at all.

In between, degrees of liability/responsibility are directly proportional to the degree of anonymity that the commercial private sector can monetize.

DDKI and DIVA technically provides:

DDKI and DIVA and Whitenoise also:

-- Note on BOTS – As we move over to a identity based network system BOTS will be able to be controlled and managed in a more effective way. In situations where they are not warranted they can be precluded.

joint testing and certification

joint development and deployment

trial and measurement of the implementation

implement a DIVA/Whitenoise enabled FPGA

 

Removing barriers to entry for crypto products into Federal Use

Author: Unknown  

 

REAL-TIME INTERNET “MRI” (ORTHOGONAL VIEW)

Author: Peter Canestaro (Northrop Grumman)  

Organizations such as the Cooperative Association for Internet Data Analysis (CAIDA) take great pains to measure aspects of the internet, such as internet topology, traffic flow and Autonomous System (AS) interactions. The data retrieved and analyzed by CAIDA and similar organizations are invaluable in attempting to understand the nature and complexities of the internet. However, the collection tools at our disposal are constrained by the internet itself. There is currently no “orthogonal view” of activity on the internet. Unlike tools within the medical profession where an outside observer can take an x-ray or MRI to see a global view of the situation, our view of the internet is very constrained. We are using the internet to observe itself, from an “inside the tube” view. It is as if we are attempting to map the human nervous system from the perspective of the synapse.  

If a real-time orthogonal view of the internet were observable by all, then many benefits to global cyber health are enabled, in terms of diagnosis, prediction and defense.  

An orthogonal view of the internet is possible with a simple innovation. Placing information flow sensors at each AS could capture distilled information (such as number of packets per protocol sent to its neighboring AS’s). This information would be continually collected and sent outside of normal channels (perhaps via satellite communications) to a common collection point for consolidation and dissemination. A number of new possibilities are enabled:

 - Real-time traffic pattern and “weather” data would be viewable by all;

 - Turbulence, anomalies and emerging problems could be observed and perhaps rectified;

 - If the collection mechanisms were real-time configurable, they could be commanded (by some national authority) to “drill-down” to provide more specific information concerning a particular attack pattern, tracking that particular threat.

 - An “over the horizon” threat detection could utilize this ability to see activity numerous “hops” away, before malicious activity arrived;

 - It would be virtually impossible for a coordinated attack to spoof information from all collection mechanisms to hide his activity. Network outages between and among AS elements would not affect the data collected and disseminated; it would be fault tolerant.

This has been done before, on small scales. “Back channels” of communication are a common means of segregating communication for different purposes. Diagnostics or configuration control messages can be segregated from normal network activity in a test/development network. However, this technique has not been attempted an anything as massive as the internet, or significant portions of the internet, because:  

 - No one takes ownership for the internet (or significant portions of it)

 - There is an initial investment to be made that cannot be done by any single commercial or government entity.

There are a few forces that would be natural impediments to implementing the idea:  

 - Funding:  There would be an up-front cost associated with building the infrastructure to collect, integrate and disseminate this data.  Additional hardware resources (including perhaps satellite resources) would be needed.

 - Corporate Acceptance: Additional cost and effort to install and maintain the collection equipment would be a deterrent, unless there was demonstrable offsetting benefit.

 - Consumer Suspicion: The idea that government may be involved with viewing internet traffic may not be accepted with enthusiasm by a suspicious public, unless done in a transparent manner.

Technologically, this is already feasible. All needed components exist and could be aggregated for this purpose. Environmentally, the political and economic will may be at a tipping point to where bold, demonstrable action may be welcome, if that action seems to aide internet security  

 - Create a of a community of interest to devise specifications and implementation plan

 - Specific funding requirements will arise from the implementation plan

 - Enact legislation to subsidize the cost of the collection equipment, to improve chances of widespread (national) adoption.

 - Momentum:  As the number of adopters grows, the benefits of the system increase non-linearly.  If a small core group of adopters shows early success, the number of later adopters will accelerate.

 - Patriotism:  A campaign to contribute to the national cause to help secure the infrastructure within the US could encourage ISPs to participate.  Similar campaigns could exist in other countries

 - Create a of a community of interest to devise specifications and implementation plan

 - Announce X-Prize for best specifications and implementation plan