• News >
  • Announcements >
  • Galois Awarded $4.5 Million DARPA Contract To Strengthen Hardware Security

Categories

Galois Awarded $4.5 Million DARPA Contract To Strengthen Hardware Security

Technical Area

Computer Security

Project award by DARPA Microsystems Technology Office (MTO) re-imagines approach to security for design and development of CPUs, smartphone chips, other hardware

Galois today announced that it has been awarded a multi-year contract by the Defense Advanced Research Projects Agency (DARPA) Microsystems Technology Office (MTO) to develop tools and methodologies that enable provable security for hardware used in a broad range of consumer, business, and government products. Phase I of the award will amount up to $4.5 million, dependent on successful completion of milestones.

The Galois-led project falls under the DARPA MTO System Security Integrated through Hardware and Firmware (SSITH) program. The goal of SSITH is to develop hardware design tools that provide security against hardware vulnerabilities that are exploited through software in DoD and commercial electronic systems.

To measure the effectiveness of such hardware security protection, Galois’s BESSPIN (Balancing Evaluation of System Security Properties with Industrial Needs) project aims to develop a set of security metrics, a framework for expressing and reasoning about hardware security, and a methodology in which metrics drive decision making during the design of secure systems.

“While there is so much focus today on developing secure software, even the most hardened software becomes flawed if wrapped around vulnerable hardware,” said Joe Kiniry, Principal Scientist, Galois. “BESSPIN aims to re-imagine traditional security approaches so that organizations can make evidence-based hardware and firmware design trade-offs between security and other characteristics such as performance, power, and area.”

BESSPIN seeks to generates powerful new hardware security assurance capabilities for CPU and semiconductor vendors, hardware manufacturers, and the DoD. For example, a company might state that they have thought hard about memory errors such as buffer overflow, and that their new hardware architecture has been designed to prevent them. BESSPIN aims to enable the objective evaluation of that claim against the company’s actual product.

DARPA MTO is focused on creating and preventing  strategic surprise through investments in compact microelectronic components such as microprocessors, microelectromechanical systems (MEMS), and photonic devices. BESSPIN’s salient contributions for this DARPA MTO project aim to be:

  • a set of quantitative metrics that would support practical measurement of security property compliance, enabling objective trade-offs between security and other system properties;
  • a framework in which security architectures and their properties could be expressed and reasoned about, both at the abstract (model) level and the concrete (product) level
  • a methodology in which metrics drive decision-making during the design of secure systems; and
  • a tools suite that would permit hardware designers in industry to specify and reason about hardware architectures and their correctness and security properties as a part of their normal design flow.

The team selected for this project, which includes Galois and partners Bluespec and Reduced Energy Microsystems (REM), includes experts in formal methods, programming and hardware design languages, hardware design and EDA tooling, and system architecture.

As a part of the SSITH program, it is the goal of the BESSPIN team to reason about the correctness and security of three different RISC-V secure CPUs from up to eight different SSITH teams through three releases—potentially adding up to 72 CPUs in all. These CPUs would use a wide variety of techniques to ensure system security, and aim to be written in multiple hardware design languages including System Verilog, Bluespec, and Chisel. The BESSPIN tools that Galois develops must accommodate this enormous range of techniques and technologies.

For additional information on this project, visit https://galois.com/project/besspin/

About Galois

Galois has been performing computer science research and development since 1999. With many of the world’s foremost experts in computer science and mathematics and a world-class team of programmers and engineers, Galois is uniquely positioned to take on the world’s most difficult challenges in computer science. Galois is a trusted partner in the defense and intelligence industries, proving the feasibility of cutting edge research as it applies to critical systems. Technology companies turn to Galois to build reliability, safety, and security into their product development efforts from day one. For additional information, visit http://www.galois.com.