Host-based Firewall with Dynamic Encryption Capability Kurt Sherman, Principal Investigator Problems:
There exists a Federal agency which supports hundreds of individual offices with absolute local autonomy and independence. The local authorities at each location consider the content and purpose of their network activity restricted and confidential. The wide area network which connects these enclaves does not provide end-to-end management in response to this privacy requirement. The resulting lack of robust network management makes it challenging, if not impossible, to deploy converged services such as VoIP throughout the agency enterprise.
Objectives:
This research effort will develop a transparent mechanism for ensuring that the payload of all network traffic is encrypted using government-accepted protocols and standards. This capability will be combined with host-based firewalls to secure the endpoints. Such a security model would provide confidentiality and eliminate the local authorities' privacy concerns associated with end-to-end network management.
Activities:
Key activities include the development of a system using open source software (OpenVPN) to dynamically encrypt traffic between hosts if the traffic is not natively encrypted. We will also develop a policy server capable of distributing appropriate rules and any necessary patches to client systems. This system will function with third party or original equipment manufacturer firewalls.
Impact:
The system will ensure the confidentiality of traffic content within the domain and mitigate insider threats. Deploying this system in conjunction with host-based firewalls will establish an additional layer to the "defense-in-depth" model that protects data both in transit and at rest. This additional security will benefit IPv6 networks where the elimination of Network Address Translation barriers will expose previously hidden hosts and systems.
Approved for Public Release: 08-0654 Presentation [PDF]
Information Sharing via Trusted Intermediaries Vipin Swarup, Principal Investigator Problems:
A first responder arrives at a medical emergency scene. Data such as terrorist warnings (from DHS) and infectious diseases data (CDC) may be relevant to what he faces, but today he is often not told. This cross-boundary information sharing problem is faced in many environments, e.g., by soldiers, marines, policemen, and border guards.
Objectives:
Our research hypothesis is that a new class of trusted intermediaries with adaptive sharing policies will enable enhanced cross-boundary information sharing. We will develop a secure infrastructure for sharing via trusted intermediaries, and will develop fine-grained, adaptive sharing policy mechanisms for trusted intermediaries.
Activities:
We will design a language for specifying sharing transactions and a sharing decision capability for authorizing transactions. This will include techniques to find appropriate trusted intermediaries when necessary. We will develop fine-grained, adaptive sharing policy mechanisms that trusted intermediaries can use to share information further. Finally, we will build an infrastructure to execute and enforce sharing transactions and policies.
Impact:
Inadequate information sharing is recognized as a critical problem across government agencies. Our proposed solutions, based on trusted intermediaries and risk-adaptive policies, will solve many pressing sharing policy problems. We will impact government agencies via papers that describe our concepts and techniques, and software that demonstrates the feasibility and benefits of our novel approach.
Approved for Public Release: 05-1203 Presentation [PDF]
Low-Cost Anti-Tamper Technology Brian Faull, Principal Investigator Problems:
Tamper resistant (anti-tamper or AT) technology is mandated for all DoD systems with sensitive components and information. Emerging DoD and civilian operations include new, diverse devices with low per-unit cost thresholds and ubiquitous deployment. These systems increasingly depend on COTS technology. Often, the AT methods used provide insufficient protection or inadequate scalability.
Objectives:
This project intends to develop and validate low-cost anti-tamper methods for emerging applications. These include applications in communications, munitions, identification, signal processing, and other hardware and software systems built on FPGAs, SmartCards, RFIDs, Microprocessors, and DSPs.
Activities:
Initially we will develop mechanisms to verify tamper resistance. We will then implement conventional and novel AT techniques, use our verification mechanisms to demonstrate and quantify improvements in tamper resistance, and apply these techniques to a variety of hardware and software systems. Throughout, we will seek dialog and transition opportunities with a variety of sponsors.
Impact:
Our research will provide better protection and assurance for low-cost technologies already in use. We will improve assurance and AT characteristics of critical applications, including for handheld and embedded systems, weapon systems, high assurance platforms and trusted computing, radio frequency and communication systems, identification, and border security, for a variety of sponsors.
Approved for Public Release: 08-0028 Presentation [PDF]
Malware Phylogenetics Melissa Chase, Principal Investigator Problems:
The nature of malware threats has evolved from widespread outbreaks for the sake of notoriety to large numbers of targeted attacks motivated by economic gain. In this environment it is critical for end-users, researchers, investigators, and security tool vendors to have a better understanding of the relationships between malware families and variants in order to improve detection, protection, and response.
Objectives:
We will seek to understand the evolutionary relationships among malware threats by applying phylogenetic modeling algorithms to malware.
Activities:
We will create a data set of malware samples, extract features from these samples, use these features to create phylogenetic models, develop an experimental workbench, and run experiments with this workbench. We will initially focus on features extracted from malware samples, first from variants of a single family and then from multiple families. Later, we will consider incident-based features.
Impact:
Understanding the evolutionary relationships among malware threats may provide improved prediction and protection for end-users. It may suggest attribution leads and facilitate the reuse of previous analyses by malware analysts and criminal investigators. It could provide a more rigorous basis for naming malware by security vendors, thereby reducing confusion during malware outbreaks and promoting correlation across security tools.
Approved for Public Release: 06-1158 Presentation [PDF]
Mission Assurance via Resilient Systems Dave Keppler, Principal Investigator Problems:
The ability for information services to continue operating despite attacks is a core enabler of mission assurance goals. Existing security techniques lack this concept of resilience and are inadequate for protecting critical services and data against targeted attacks by sophisticated adversaries. Widely implemented signature and anomaly-based detection techniques fail to keep pace with the advancement of attacker sophistication.
Objectives:
Our objective is to develop and prototype resilience techniques that make applications impervious to the damaging effects of attacks without relying on identifying and filtering specific attacks. We will employ effects-based countermeasures to impart resilience to applications, creating an environment inhospitable to attack goals, and countering previously unknown attacks on service utility, in particular, code injection and data subversion.
Activities:
We will first characterize the common damaging effects of code injection and data subversion attacks. We will then leverage and expand upon the body of survivability techniques developed by the research community to tailor generalized resilience countermeasures against common attack effects. Finally, we will develop prototype resilience countermeasures, apply them to selected sponsor applications, and empirically evaluate their effectiveness against attacks.
Impact:
Resilient systems are a fundamental requirement for mission success in the net-centric warfare vision. Achieving data resilience is of particular importance. The problem of novel, sophisticated threats against critical services directly affects a wide variety of sponsors and nationally important infrastructure. This project will advance the state of the art of resilient system design, and impart crucial mission assurance properties to critical services.
Approved for Public Release: 07-1322 Presentation [PDF]
Mission Aware Reporting of Information Assurance for Airborne Networks (MARIAAN) Rosalie McQuaid, Principal Investigator Problems:
The extension of Internet Protocol to airborne platforms introduces new cyber-threat entry points into the Global Information Grid (GIG), increasing the threat to our infrastructure. Although the Air Force is implementing IA capabilities for airborne networks, these techniques do not produce threat information that connects to real-world missions; this correlation is necessary for mission success and enhanced situational awareness.
Objectives:
Our objective is to research, develop, and prototype a solution that leverages and enhances existing and planned Air Force Airborne Network (AN) IA capabilities. We will implement a service for correlating and sharing IA and mission-relevant information at the tactical edge. The prototype implementation will enhance airborne mission survivability and information awareness by linking mission events to IA events.
Activities:
MARIAAN will produce a prototype that synthesizes AN mission and IA event data by correlating and sharing local and remote event data. AN mission profiles will be developed for highlighting critical mission details. Additionally, a common event expression (CEE) will be developed to ease event correlation and provide an efficient communication technique between AN enclaves and the central monitoring facility.
Impact:
MARIANN will improve GIG situational awareness by connecting airborne IA events to real-world mission information and reporting actionable results. In addition, it will influence event standards development between the Air Force and the vendor community. Solid transition and integration opportunities exist within the Joint Airborne Network, the Air Force AN IA research community, and with current NATO and vendor partners.
Approved for Public Release: 07-1418 Presentation [PDF]
TRIDENT (Trust Research in Distributed & Emerging Network Technology) Brian Sniffen, Principal Investigator Problems:
The DoD has committed to an increasingly net-centric approach to warfare. The many systems on our networks are interdependent in critical ways, but are unable to determine when a peer that they are relying upon is compromised or vulnerable. In the context of determined and capable adversaries, this is a critical gap.
Objectives:
We will demonstrate that it is possible and worthwhile to invest successfully in methods for resilient networks. We will develop methods for enabling trust decisions that help hosts to interact only with "good" peers. Our combined approach will take advantage of emerging COTS capabilities, of MITRE's experience in protocol and trust engineering, and of MITRE's understanding of web services.
Activities:
We will build an experimentation platform using Trusted Computing (TC) components. On this, we will implement an architecture that uses virtualization to enable web services to execute and, simultaneously, makes useful measurements of the services available to their peers. We will also develop a web-services-based scheme to communicate this evidence among measured services, their appraisers, and their peers.
Impact:
Our work should demonstrate the value of TC components in building attestable systems, show that attestable systems are possible, and illustrate some useful methods for building such systems. We also intend to demonstrate that attestation and appraisal indicate an approach to making distributed systems more resilient. This may also point to worthwhile technology areas in which sponsors might invest.
Approved for Public Release: 06-1435
Last Updated:05/05/2008 | ^TOP | 
