Against the rising tide of virus writers, online burglars and missile-secret misappropriators, teachers at the University of California, Davis, Davis are fighting to keep "computer security" from becoming an oxymoron.
In the UC Davis Department of Computer Science, professor Matt Bishop teaches students how to identify the holes in a system and plug them. Professor Karl Levitt tries to give computers the ability to recognize an intrusion and stop it. Professor Philip Rogaway wants to thwart the intruder by scrambling the information.
Their accomplishments are being recognized. On May 25, at a national conference on information security, the U.S. National Security Agency will name UC Davis as one of seven new Centers of Academic Excellence in Information Assurance Education.
The goal of this outreach program is to reduce vulnerability in the national information infrastructure by promoting education in information assurance and increasing the number of professionals with security expertise.
"We are one of the few schools to offer an array of computer-security courses and research opportunities to undergraduates as well as graduate students," says Biswanath Mukherjee, chair of the computer science department. "We believe that security issues are central to a thorough computer-science education and students should receive early exposure to this important subject."
Graduates will find no shortage of work. National review panels say the nation's information infrastructure -- including computer systems controlling power grids, air traffic, military weapons and financial networks -- is dangerously vulnerable. In the private sector, attacks from outside and inside are increasingly costly.
"No one is exempt from attack," says Mukherjee. "If you are connected to the Internet, your machine may be vulnerable."
Working in the UC Davis Computer Security Research Laboratory with Bishop, Rogaway and Levitt are Mukherjee; two new faculty members, Michael Gertz and Premkumar Devanbu; two permanent staff researchers, Jeff Rowe and Chris Wee; a staff administrator; and 13 graduate students and five undergraduates.
All three professors employ complex mathematical methods to define tenets of privacy and security and to construct the elaborate programs needed to give a computer system selective self-defense. Rogaway, a cryptographer, is the purest mathematician of the three; Bishop and Levitt mix the math with a large measure of hacker psychology.
Bishop teaches vulnerability analysis as a tactical struggle against conventional thinking. He has assigned undergraduate students in his security class to read Machiavelli and "The Art of War" by Sun Tzu. "Understanding the attacker philosophy is fundamental to understanding computer security," Bishop says. "That philosophy is: Attack the power structure using its own tools in ways that it never expected."
Bishop wants to teach computer designers and programmers to make new systems more secure. And he's writing a computer language that can describe attack tools and their distinguishing features; it could form the basis of an improved computer defense program.
Karl Levitt works in the fast-growing field of smart intrusion detectors. The programs, which constantly survey a system for attacks, are in great demand.
One tactic of intrusion detectors, called "signature detection," compares the code in an incoming packet to a library of known attacks, like Bishop's database. Another tactic, "anomaly detection," watches for computing activity that's inconsistent with the profile of an authorized user, such as an 8-to-5 worker sending e-mail at 3 a.m. or a human-resources employee searching for files named "Missile."
But the current detectors can only recognize known attacks and record suspicious events for later review. "We're trying to build programs that can recognize known or unknown intrusions and report where damage is occurring, where the attack came from and whether it is spreading," Levitt says. The programs could even sever the connection or divert the intruder into a fabricated region of the system, called a fishbowl, for observation.
The UC Davis security group was the first to tackle such responsive detectors, Levitt says, and interest is high from government agencies, aircraft makers, semiconductor firms and banks. "For example, we're funded by the Department of Defense" -- where hackers try to break in 80 to 100 times daily. "The defense department is also concerned about information getting out. That's hard to stop when the users have legitimate access," Levitt says. The majority of the security laboratory's $1.3 million in external funding this year comes from the Department of Defense.
Phil Rogaway aims at protecting information not just when it's socked away in storage, but when it's making the trip from one user to another over the Internet, as in e-mail, automatic-teller bank deposits and online credit purchases.
Rogaway is a cryptographer -- a scientist who makes or attacks mathematical gadgets for protecting communication. He uses a modern cryptographic approach called "provable security," in which a mechanism is trusted because of the belief in its underlying assumptions -- for instance, the belief that it takes a tremendous amount of computing time to factor certain very large numbers. If the assumption is true, then what is built on it is known to be good.
Last summer, the firm RSA Data Security announced that an ATT research scientist had cracked part of its "Public Key Encryption Standard #1," which had become a de facto standard for digital communications. It would be replaced by a provable mechanism designed by Rogaway and a research colleague at UC San Diego, Mihir Bellare. Called optimal asymmetric encryption padding (OAEP), the new scheme is "very strong," Rogaway says. "We know this by virtue of having proofs that tell us so."
"Mihir and I, we're very happy. Our scheme is getting into the standards and our approach is catching on," Rogaway says. "We've done what we wanted to do" -- that is, as Sun Tzu said, subdue the enemy without fighting.
Media contacts:
-
-- Matt Bishop, Computer Science, 530-752-8060, bishop@cs.ucdavis.edu
-- Karl Levitt, Computer Science, 530-752-1287, levitt@cs.ucdavis.edu
-- Philip Rogaway, Computer Science, 530-752-7583, rogaway@cs.ucdavis.edu
-- Sylvia Wright, News Service, 530-752-7704, swright@ucdavis.edu