Leading America’s National Cybersecurity Effort at Carnegie   
by: Francis C. Assisi

Boston, 13 June -- For securing the nation’s critical infrastructure, America is turning to brainpower born and bred in India but soaring in the United States.

Not only are they developing technologies and protocols that could save lives, they’re also making a play for billions of dollars in government and private sector spending.

Consider this. For leading the national effort towards securing its cyber infrastructure, the ongoing “CyLab” effort at Carnegie Mellon University involves Professor Pradeep Khosla and ten other Indian Americans – all of them faculty members or researchers at CMU.

Khosla, a Carnegie alumnus as well as an IITian, is the Philip and Marsha Dowd Professor of Electrical and Computer Engineering and Robotics at CMU where he has just been appointed Dean of Engineering.

Besides Khosla, the Indian American faculty involved in the CyLab effort from various departments at CMU are: Ashish Arora, Vijayakumar Bhagavatula, Ramayya Krishnan, Tridas Mukhopadhyay, Priya Narasimhan, Rohit Negi, Raj Rajkumar, Srinivasan Seshan, Kannan Srinivasan, and Sanjay Srivastava.

The CyLab security supergroup came into being when the university created a cooperative effort between several Carnegie Mellon schools, including the College of Engineering, the School of Computer Science, and the School of Public Policy and Management.

Working with government and industry, CyLab is developing cutting-edge tools, technologies and practices to secure the Internet and telecommunications systems, eliminate computer viruses, and protect one’s personal privacy and identity. CyLab will work to ensure safety for every computer user, from individuals at home to small businesses and large corporations.

"We will ensure privacy and security by tackling cybersecurity issues from a variety of angles," Khosla said. "In cyberspace, threats move very quickly. This is not just a national security issue, but it is a national economy issue too." Carnegie Mellon´s new CyLab will help stimulate cooperation between government and business to protect information networks.

The need for cybersecurity professionals is so acute that the Department of Homeland Security, the U.S. Secret Service, the Federal Aviation Administration and other key security agencies are queuing to hire Khosla’s students. That’s because he is leading the CyLab effort at creating an immune system for cyberspace, or for the electronic medium of computer networks that make up the Internet.

Khosla’s nightmare is a denial-of-service attack, which would bring the U.S. national infrastructure down. It may not sound as grim as a bio bomb. What’s scary is, it may be going on right now. That’s because the incredibly complex networks that carry data are under constant attack from hackers, crackers and, very likely, terrorists.

CMU’s Computer Emergency Response Team logged a record 82,094 assaults on worldwide networks in 2002. For 2003 the numbers are startling. Over 114,000 computer virus attacks and computer breaches; more than $140 billion in damages worldwide, double the previous year. The likelihood that some were terror-related is “very high,” says Khosla, who is also head of CMU’s new Center for Computer and Communications Security, or C3S. “The real attack on the U.S. is going to be the attack on its economy,” he adds.

The potential damage is even worse. Cascading infrastructure collapses, from communications, to utilities, to emergency response networks, could cripple large regions of the country.

Post 9/11,the Defense Department entrusted CMU and Khosla with $35.5 million to develop tools and tactics for fighting electronic terrorism. The inventions to be researched and engineered at the top computer science school would serve equally well in battling crackers and Internet crooks.

The center is already researching ways to engineer artificial intelligence into hardware so that components such as disk drives could take countermeasures in an attack. Such components would shut down and even automatically report an incident to network administrators.

Khosla is already famous for creating matchbox-size millibots using off-the-shelf components that employ a combination of ultrasonic sensing and sonar to navigate uncharted territory. Millibots are small, specialized, adaptable robots that are able to work together as a team to provide critical mission support such as search and rescue, hostage reconnaissance, covert surveillance, and military and firefighting assistance.

For his wide-ranging contributions to research and education, Khosla is considered a “superman” at CMU. That’s why he was given a Superman outfit by his colleagues when he was honored several years ago with a prestigious endowed professorship at CMU.

Among other things, CyLab researchers are studying how to use signatures, fingerprints, iris patterns, face recognition technology and voice scans to confirm the identity of computer users. Khosla believes some combination of those technologies will likely be used in the future.

CyLab was conceived last year as a university-level multidisciplinary research center that focuses on technology, policy and management issues in national security. "We wanted this to be a university wide strategy and put our stake in the ground saying, ´Cybersecurity is where we´re going to make a difference,´" says Khosla, co-director of CyLab. Under his watchful eye more than 30 researchers and 80 students from a variety of disciplines are engaged in creating new information security technologies and practices. Carnegie Mellon´s Information Networking Institute (which Khosla also heads) will function as CyLab´s education arm, providing opportunities for students to focus on cutting-edge information security.

CyLab funding has come through a combination of public and private money. Congress recently granted the organization US$6 million for security research. In return, the U.S. government will receive rights to use CyLab research for national security efforts.

“The vision I have is making Pittsburgh the cyber-security capital of the country,” says Khosla. The network-security industry is expected to grow from $17 billion a year to $46 billion by 2006, according to C3S’s research. Khosla is putting together a panel of local venture capitalists to evaluate and, it is hoped, fund the companies that C3S spins out.

CyLab is trying to improve computer security through research and development, education and response and prediction. Within three years, Khosla said, the center wants to educate 10 million computer users and 100,000 security professionals worldwide about network security threats.

“These problems have always existed," said Khosla. "Terrorism only increased the visibility of these problems."

With the world´s electronic infrastructure expanding by leaps and bounds, it´s essential to commerce, not just homeland security, that Internet users be able to verify that people on the Net are who they say they are and that computers and other components resist attacks by hackers, whether they are terrorists or pranksters, Khosla said.

Khosla and his colleagues at CMU have been working for two years to establish the CyLab computer security center. "We want Carnegie Mellon to be the top player in this arena," Khosla said.

Research under way at CyLab includes efforts to design artificial intelligence into individual computer components, such as disk drives or network cards, so that the components can sense if they are under attack and take countermeasures, such as shutting down or reporting the incident.

The ability to verify the identity of users and the veracity of information also is a major focus of the center, Khosla said. Biometric measures, such as fingerprints, iris patterns, signatures, face recognition and voice scans, have all been studied as possible means of verifying identity, but the ultimate solution likely will involve some combination of those measures.

"You may wear a mask so you look like me, but it´s not likely that you´re going to look like me, sign like me and sound like me," Khosla said. As the electronic network expands, such computer security measures could encompass many aspects of modern life, he said.

For example, the identity of airline pilots could be verified every five minutes in flight, and if the pilot seemed to be absent, the plane could be automatically placed on autopilot, he said.

The advent of "smart" buildings, which have sensors for detecting fires, intruders or other disruptions, will increase the need for computer security. "Sensor spoofing" -- tricking a sensor -- could become a major problem if the computer infrastructure is not designed so that each sensor can authenticate itself, he said.

The meat of CyLab´s work will be its R&D operation. The lab´s research will be funded partially by industry, with the goal of getting new technology to market as quickly as possible. Companies that provide high levels of funding will have rights to the intellectual property the lab develops. The group already has signed on 50 companies as funding partners, including Microsoft Corp., Symantec, General Motors Corp., Hewlett-Packard Co. and Intel Corp.

"The technology has to have a fast track to the marketplace through industry," Khosla said. "In the security business, we can´t deal with local politics. We´re concerned with the security of the country."

Among the projects that CyLab researchers are already working on are multi-modal biometric authentication systems capable of using a combination of voice prints, fingerprints and other biometrics to authenticate users. There is also a team looking at a way to tag IP packets so that they can be traced back to the machine that generated them. This would have broad applications in the security world, especially in identifying the people behind distributed denial-of-service attacks and other crimes in which attackers spoof the IP addresses on packets to cover their tracks.

Khosla envisions a system in which users, who have positively authenticated on a PC via the advanced biometric technology, can be proved to be responsible for an attack via the packet-tracing function. The group hopes to have some of this technology in the hands of vendors within 12 months, Khosla said.

francisassisi@hotmail.com


Science researchers interested in profiling their work in this column are encouraged to submit their biodata and relevant publications to INDOlink at: editor@indolink.com