Research

Cross-disciplinary research on medical, cyber-physical, and IoT security and usability, including authentication, authorization, access control, ease of use, and education are among the areas of interest of Dr. Vasserman and the SyNeSec Lab. The lab has produced results in Byzantine interoperability failure detection through the use of "smart" functional alarms in medical systems, non-intrusive black- and gray-box software integrity checking using power consumption and electromagnetic emissions of integrated circuits (which can detect changes as subtle as single instructions and/or operands). The SyNeSec lab has tackled security usability, risk perception (with Gary Brase in the Department of Psychological Sciences), cybersecurity education (with Eleanor Sayre and the Department of Physics), and just-in-time intervention for novice users.

An integrated safety-security co-design program, and software analysis and development tools to assist safety engineers in designing secure systems have been developed jointly by the SyNeSec and the SAnToS high-assurance software labs, and are intended to work even when safety engineers may not have extensive (or any) security training.

The analysis of cyber-physical systems from the perspective of their security against stealthy attacks has been the focus of Dr. Amariucai and the Probabilistic and Information Theoretic Security (PITS) Laboratory. Their work makes it possible to quantify the impact of stealthy attacks on control systems when only imperfect system information is available to attackers, as well as enhancing control system resilience against such attackers via design changes that navigate the tradeoff between security and performance.

Security and privacy in intelligent transportation systems are the major issues explored by Dr. Munir and the Intelligent Systems, Computer Architecture, Analytics, and Security (ISCAAS) Laboratory. They have also been working on identifying security vulnerabilities in situational awareness, particularly, in context of command, control, communications, computers, intelligence, surveillance and reconnaissance (C4ISR) systems as well as developing approaches to mitigate these security vulnerabilities.

Researchers in the SAnToS Laboratory - Dr. Hatcliff, Dr. Amtoft, and Dr. Robby develop compositional contract-based approaches for certifying secure information flow requirements. We collaborate with researchers from Rockwell Collins Advanced Technology Center (RC ATC) to develop compositional contract-based approaches for certifying secure information flow requirements in military information assurance products. Rockwell Collins is a leading manufacturer of avionics and communications solutions, both for commercial aviation and the military. Rockwell Collins Advanced Technology Center is Rockwell Collins' research and development center and supports the company by developing, acquiring, and transitioning technology into our product groups. Many Rockwell Collins product groups are currently developing products, or expect soon to develop products, that communicate with more than one security domain. Rockwell Collins markets products in a broad range of markets of interest to the DoD and U.S. Air Force, including communication, avionics, navigation systems, and displays offerings. The need to process information from diverse security domains with Multiple Levels of Security (MLS) is an increasingly common requirement across many of Rockwell Collins' diverse military businesses.

Learn more about this research

Projects targeting hardware-based security and trust, in particular, secure and dependable electronic control unit (ECU) architectures, elliptic curve cryptosystem (ECC) processors, true random number generators (TRNGs), and physically unclonable functions (PUFs) have been the focus of Dr. Munir and the Intelligent Systems, Computer Architecture, Analytics, and Security (ISCAAS) Laboratory. They have designed and tested a secure and dependable ECC processor that is resistant to timing analysis, power analysis, and fault analysis attacks. They have also developed secure and dependable ECU architectures for autonomous vehicles. Dr. Munir and ISCAAS lab have also proposed TRNGs that can generate random numbers with high bit-entropy at a high data rate, and that are also robust against process,voltage, and temperature (PVT) variations. They have also proposed PUF-based lightweight, highly reliable authentication and key establishment schemes.

Non-traditional key establishment schemes for wireless networks were developed and evaluated by Dr. Amariucai and the Probabilistic and Information Theoretic Security (PITS) Laboratory. These protocols are based on common randomness harvested from networking metadata in ad-hoc wireless networks. They have published work on perfectly secure key establishment, physically-unclonable functions (PUFs), procedural-bias-enhanced biometric user authentication. The lab exposed the discharge inversion effect (DIE) in SRAM-based PUFs, which has the potential to cause catastrophic failure in authentication or randomness generation.

Cryptographic security of the Internet of Medical Things (IoMT) has been a major successful research venture by Dr. Vasserman and the SyNeSec lab. In addition to developing cryptographic security mechanisms for retrofitting into existing devices and systems, the SyNeSec lab has also developed deniable group off-the-record (GOTR) messaging and new models for secure and privacy-preserving computation in precision agriculture, the latter in collaboration with Dr. Welch and the Department of Agronomy.

Artificial intelligence (AI) safety and security are being explored by Dr. Munir and the Intelligent Systems, Computer Architecture, Analytics, and Security (ISCAAS) Laboratory. They have shown security vulnerabilities in deep reinforcement learning and both the ISCAAS and SyNeSec labs have been developing approaches to enhance the safety and security of deep learning.

The development of privacy metrics and privacy-utility negotiation algorithms for situations in which private information and context alike are time-varying in non-deterministic ways, and statistical information is only partially available to external actors have been investigated by Dr. Amariucai and the Probabilistic and Information Theoretic Security (PITS) Laboratory for applications varying from social network participation to industrial control systems and IoT deployments. The lab has produced new information-theoretic metrics for privacy, like subjective and objective information leakages, and various optimization algorithms for planning the disclosure of sensitive information in multiple contexts.

The application of privacy preserving mechanisms to online social network participation, where utility is based on the user's perception, and the sensitive information relates directly to the user's vulnerability to manipulation has been one of the main areas of interest of the PITS lab. This cross-disciplinary effort has produced various solutions, based on stochastic models of user behavior and of user interaction that were learned from real-world data collected from the most prominent online social networking platforms.

Identifying privacy vulnerabilities in intelligent transportation systems (ITS) and developing approaches to address these issues has been a key research direction for Dr. Munir and the Intelligent Systems, Computer Architecture, Analytics, and Security (ISCAAS) Laboratory. They have also developed physically unclonable functions (PUFs)-based authentication protocols that preserve the identity and privacy of the PUFs and the devices incorporating those PUFs.

Deniable group off-the-record (GOTR) messaging and new models for secure and privacy-preserving computation in precision agriculture are just some of the results from recent work by Dr. Vasserman and the SyNeSec lab, the latter in collaboration with Dr. Welch and the Department of Agronomy.