Computer Security

Galois provided cybersecurity and rigorous digital engineering expertise to Space-Based Adaptive Communications Node (Space-BACN), a DARPA program that aims to advance satellite communications by developing low-cost, high-speed reconfigurable optical datalinks to connect various low-earth orbit (LEO) constellations. Galois was a subcontractor for a company that built the optical modem for the system. Galois aimed to ensure that both the modem and the Space-BACN platform as a whole were secure-by-design. This means that security was built into the project from its inception, rather than an afterthought. A “secure-by-design” system means decreasing program risk, lowering overall costs, and helping shrink project timelines, all while increasing the system’s measurable correctness and security.

  OPPORTUNITY: New Tech, Higher Risk U.S. government agencies, including the DoD, are using 5G and software-defined networking (SDN) to enhance network resilience, adaptability, and communication capabilities. As network orchestration becomes more complex, there is an opportunity to apply automated threat detection technologies to assist network operators in detecting and mitigating vulnerabilities that can compromise […]

The High Integrity, Performant, Efficient Realization of a SPAceborne Cryptographic Engine (HIPERSPACE) project focuses on the creation of high-assurance, high-performance implementations of cryptographic functions for deployment in low earth orbit. This is Galois’s first project for the U.S. Space Development Agency (SDA).

Isolation Technology

Model-based Toolset and Contract Language for Code Generation and Verification

Model Format: AADL

CyberSecurity Vulnerabilty Detection in Complex Systems

DETECT, part of DARPA’s HARDEN program, aims to create tools that help programmers identify and reason about design and implementation choices that increase the exploitability of their systems.

This project, part of DARPA’s RACE program, seeks to hide critical data within network traffic through sophisticated cryptographic methods and advanced machine learning techniques – delivering a knock-out for privacy protection.

This project, part of DARPA’s Artificial Intelligence Mitigations of Emergent Execution (AIMEE) program, is designed to identify unexpectedly programmable behaviors of systems that could be manipulated by bad actors. The goal of SEEC is to create a reusable framework that helps designers build systems that are resilient to these emergent computations.

Fromager is a research project in producing zero-knowledge (ZK) proofs about diverse properties of real-scale software.

As part of TA5 of DARPA’s I2O Cyber Assured Systems Engineering (CASE) program, this joint project between Galois and Tangram Flex seeks to develop software tools that can be seamlessly integrated with the tool suites of its commercial partners. The ultimate goal is to create stable, cyber-secure systems with built-in assurance and analysis – from the ground up.

Pirate aims to build a set of technologies for making it easier to develop, configure, and maintain real-time secure interconnected applications.

VADD aims to build a toolset that enables new ways of customizing and improving software even after development is complete.

Funded by DARPA’s SafeDocs program, this project aims to achieve three major goals: design a novel language for precisely describing practical formats, design a framework for learning formal descriptions from extant documents, and enable the generation of correct and performant format parsers.

Part of DARPA’s CHESS program, MATE takes a human-machine hybrid approach to enable the discovery of highly application-specific vulnerabilities using code property graphs. MATE aims to enable novices and experts to quickly understand security-relevant code and apply automated analyses to find vulnerabilities.

Network security analysis is currently hampered by the need for human inspection and diagnosis of traffic patterns, and the pace at which human operators can gather and disperse knowledge of threats. Our software automatically detects traffic anomalies and shares the information using a distributed, peer-to-peer (P2P) infrastructure that is resilient to attacks and outages. The result is an automation of the early stages of network threat analysis, allowing administrators to much more quickly respond to emerging problems.

Funded by DARPA’s SSITH program, BESSPIN aims to develop tools and methodologies that enable provable hardware security

The Software Fault Encouragement (SFE) project aims to improve the security of legacy cyber systems by turning exploitable software errors into fail-stop conditions while imposing minimal run-time overhead.  Turning errors into fail-stop conditions prevents large classes of cyber attacks and minimizes the exploit window available to attackers.  In systems with built-in fault tolerance, this cyber […]

prattle, v: : to talk for very long about something that is not important or interesting The Prattle project generates traffic that misleads an attacker that has penetrated a network: making them doubt what they have learned, or to cause them to make mistakes that increase their likelihood of being detected sooner. To generate this […]

ADAPT, funded by DARPA’s Transparent Computing program, aims to address the growing challenge posed by Advanced Persistent Threats (APTs) in enterprise networks by identifying subtle but potentially malicious activities through observing long-term behavior patterns and causality in system activity.

RADSS, funded by DARPA’s Cyber Fault-tolerant Attack Recovery (CFAR) program, aims to automatically provide hardened software defenses and detect intrusions as they happen in both current and legacy systems, without requiring vendor cooperation.

Modern Distributed Denial of Service (DDoS) attacks are too big for medium-sized organizations to handle, as the amount of traffic generated is sufficient to saturate their Internet connections. Once an organization’s network connection is saturated, local mitigation is no longer possible. This class of attack thus threatens critical infrastructure, such as financial institutions, news organizations, […]

One of the first steps in a cyberattack is identification of the target system or systems: correct identification of what is on a network allows the attacker to make better decisions about what to attack and what tools to use. Ditto interferes with this phase of the attack by misleading attackers about what operating system hosts are running.

In the armed forces, chaff is a cloud of material spread behind a target, designed to confuse either detection or attack. With the DARPA-funded CyberChaff™ project, we use this same basic concept to address cyber-attack.

The increasing prevalence of unmanned aerial vehicles (UAVs) in both military and civilian applications has made them an attractive target for cyber attacks. ADIDRUS is our solution to the growing necessity to secure these systems in a proactive manner.

In this Phase I and II SBIR (Small Business Innovation Research) project, our work had two goals: 1) reduce the cost of developing for and deploying high assurance, separation kernel-based systems, and 2) improve the assurance level achievable by separation kernel implementations.

Technologies such as wikis, social networks, and ubiquitous networking make collaboration more effective. However, an inherent tension exists between security requirements and the need to share information. The goal of Galois’ cross-domain projects is to lesson this tension and to expand collaboration without sacrificing security requirements,

We founded Tozny, a Galois spin-off company, to solve the password conundrum. Your phone is the key: Easier and more secure than passwords, Tozny replaces passwords with an easy-to-use cryptographic key on your mobile phone.

Through a series of projects funded by the Department of Energy, the Department of Homeland Security, and the Air Force Research Laboratory, Galois’ team of identity, authentication, and authorization experts have developed a set of technologies that alleviate the problems and risks associated with password overwhelm.