The NCSC research problem book
Page 3 of 21
CC1 - How can we build systems we can trust?
How can we build systems we can trust when we can't trust any of the individual components within them?
Hardware is becoming more complex all the time and it’s difficult to gain confidence in long global supply chains. This in turn means diminished confidence in individual computers, circuit boards and microchips. But to protect our critical national infrastructure (CNI), defence and intelligence systems and more besides, we need to build computer systems we can rely on.
Addressing this problem requires a combination of techniques that touch on many different aspects of cyber security, technology and risk.
Strands or sub-problems
-
Compute foundations
Researchers need to build a deep understanding of the security properties and trustworthiness of components at the hardware/firmware level and use it to identify or design ‘safe places to stand’ – that is, to run code or carry out a cryptographic function, with high confidence in its integrity. Are there certain compute element architectures in which we could have higher confidence? Are there new ways to gain confidence in the integrity of integrated circuits, both in design and manufacture? And for new classes of compute elements, such as artificial intelligence co-processors, how can we have equivalent or better forms of separation between tenants if we want to allow multiple users to share a single chip?
-
Security architecture
Using system security architectures to address the diminishing trust in underlying component supply chains, can we design system architecture patterns that are resilient to high degrees of failure or a high percentage of hostile components, while still functioning as an overall system with high integrity? Or can we design a system with high levels of redundancy and then seek to automatically detect and eradicate components which appear to be operating outside of the expected behaviour? Is it possible to build such architectures cost efficiently? Other research in this area could explore the concept of ‘anti-fragility’ and how it applies to system architecture design.
-
Security engineering
Through new engineering practices, standards, tools, languages and architectures, can we find new ways to eliminate entire classes of vulnerabilities from software supply chains? CHERI2 and Rust are great examples of new developments that, if widely adopted, could eliminate classes of memory corruption vulnerabilities. So what equivalent innovations could eliminate other classes of vulnerability? If we apply security engineering in a different way, to improve how we understand the software which forms part of an overall computer system, can we also help solve the overarching problem by reducing complexity and increasing confidence in its quality and integrity?
-
Cryptography
Can we explore how cryptographic techniques, such as multi-party computation, can help design system security architectures that are tolerant to a level of component compromise?
-
Monitoring
Supporting the security architecture strand, can we explore whether there are new techniques which could detect compromised individual components or supply chains within an overall system architecture, or improve accuracy in existing techniques?
Why this is important
“Today's commodity hardware has a complex supply chain. A CPU that is 'designed in the UK' can incorporate IP from multiple sources in different countries. It could be manufactured in Taiwan, packaged somewhere else and assembled onto a server motherboard in yet another location, along with many other complex components. The motherboard may end up in a server installed in a rack in a shared data centre, operated by a managed services provider. It will then have software installed with a similarly complex supply chain of code from individuals and organisations.
Gaining independent confidence that the result doesn’t contain anything malicious is infeasible, and at the moment risk owners need to trust that manufacturers are managing supply chain security well. Top-tier threat actors have identified the complexity of supply chains as a prime attack vector for gaining access to high-value customers, and we need to counter the successes they're having. This research challenge directly addresses our ongoing ability to build resilient systems in future.”
Paul W, NCSC Head of Technology Resilience