“Play my afternoon playlist!” It’s a harmless request you might often use in the familiar and increasingly networked surroundings of your own four walls. Living spaces are now kitted out with more and more smart devices connected to the internet, and the automotive sector, the health service, banks and industry are likewise becoming increasingly networked.
Too often, we know little about who sees and uses the data that we inevitably generate. But we put our faith in them. We believe that devices are protected against disruption and unauthorised access, and that our data are only seen by people who have the necessary authorisation. That intruders cannot access highly personal aspects of our lives or critical infrastructure.
“But the reality is different. Once data are stored on an international server in the cloud, you lose control over them,” explains Christian Rechberger of the Institute of Applied Information Processing and Communications at TU Graz. “We look at it differently from the technological side – it’s certainly possible that users can keep control over their data and still benefit from full functionality and cloud services.”
Secure System Architecture
The more interconnected our world becomes, the more important it is that such connections are secure. Academic research has only just begun to address the idea of cybersecurity over the past few years. And over the last couple of years this topic has come under greater public scrutiny. The discovery of the Meltdown and Spectre security vulnerabilities by an international team which included Daniel Gruss, Moritz Lipp, Michael Schwarz and TU Graz professor Stefan Mangard stoked people’s awareness of security.
“At the end of the day, we’ll never be able to make things absolutely secure,” says Stefan Mangard, who also heads the Secure Systems Working Group at the Institute of Applied Information Processing and Communications. “But we can take security to new levels by focusing on the way we build computer systems.” At the moment, security researchers are in a race against attackers – once a security flaw appears, it needs to be patched up as quickly as possible. “Besides playing cat and mouse, which is due to the way current systems are set up, we’re also working on new types of system architecture. Our goal is to make them immune to a particular type of attack in the first place.”
Our goal is to ensure that security is a given without having to constantly take care of it as a user. – Stefan Mangard
As part of the Sophia project, which is funded by the European Research Council (ERC), Mangard and his team are looking at ways to make computer processors secure, as well as analysing unintended opportunities for access and closing off any back doors they find. “It’s always a bit of a balancing act – improved security usually goes hand in hand with poorer performance,” Mangard explains. The Meltdown and Spectre vulnerabilities were discovered in the course of this project. Cyberattackers take advantage of the fact that a processor pre-empts and prepares processing steps, such as accessing certain data, before access rights have even been verified, for instance. If the user does not have the necessary rights, the prepared data are discarded. A computer does this so that it can work more quickly. But it also has side effects, like time lags, which attackers can take advantage of under certain circumstances in order to identify confidential information. Although the patches released at the same time as details of the two vulnerabilities made computers more secure, they also made them slower.
“One of the biggest problems with security is that it’s so hard to quantify,” Stefan Mangard points out. “If my PC starts running more quickly or slowly, I notice it straight away. But when I invest in security, subjectively speaking I don’t notice any difference to begin with, or at most a drop in speed.”
Cybersecurity Campus Graz
This is where the new Cybersecurity Campus Graz comes into play. Over the next few years, TU Graz will build a cybersecurity research, teaching and certification centre at Campus Inffeldgasse in collaboration with well-known international certification company SGS. Stefan Mangard will be responsible for the centre’s academic focus and is currently looking at topics and projects that will be included on the facility’s research agenda. “The Cybersecurity Campus should serve as an interface between basic research and industrial application.”
IoT: Mini-Computers
Cybersecurity Campus Graz will focus on future challenges – primarily the Internet of Things (IoT), which is posing new questions for security research due to the miniature computers it comprises. “We’re talking about billions of computers worldwide that you can’t even see – in light switches, light bulbs and smartwatches,” comments Professor Christian Rechberger, head of the Cryptography Working Group at TU Graz’s Institute of Applied Information Processing and Communications. In computers the size of a fingertip, like those built into smartwatches, every last millimetre of storage space is hotly contested, and also pricey – who would want to wear a smartwatch that is a few centimetres thick? “The challenge is guaranteeing security, but at the same time it has to cost next to nothing,” Rechberger explains.
Cryptography is the basis, the foundation of all forms of security. – Christian Rechberger
He is addressing this challenge by means of new approaches to cryptography – one of the most powerful tools around when it comes to making computer systems secure. Using mathematical methods, data are encrypted and protected so that they cannot be intercepted or tampered with during transmission. “Cryptography is the basis for all forms of security,” Rechberger explains. “If the basis isn’t secure, anything built on it won’t be secure either.”
Another international success has just been achieved in the field of cryptography: a team including Maria Eichlseder, a postdoctoral researcher in the field of cryptography, won an international competition with ASCON, a bundle of algorithms that was recommended as the top solution in the lightweight applications category. Lightweight algorithms are processes that run with the minimum possible resources. In the video, the researcher explains how the algorithm works.
Security means that it is not a question of luck whether a system works as expected, but that you can rely on it. – Maria Eichlseder
Speaking of this approach, Rechberger comments: “On the scientific side, we ask ourselves what is the smallest number of calculations that we can just about work with and combine intelligently to make the chips secure.”
Artificial Intelligence and Quantum Computers
Besides the Internet of Things – which both Mangard and Rechberger believe will be the focus of attention in years to come – other new developments are posing challenges: artificial intelligence and quantum computers.
“From a research perspective, artificial intelligence is a tough nut to crack,” Mangard points out. “Learning algorithms are getting better and better, but even the slightest manipulation of the data can throw them totally off-kilter. When artificial intelligence becomes much more widespread than it is today, that could be a big problem.” Rechberger gives us the dataprotection viewpoint: “Artificial intelligence needs to be fed masses of data. But is it really safe? And does it safeguard privacy? We’re now working on a way of providing learning algorithms with encrypted data effectively, and without affecting their learning capabilities.”
Reinhard Posch oversees the Institute of Applied Information Processing and Communications. An expert on security, he is Chief Information Officer for the Austrian federal government and sits on a committee that coordinates the IT plans of the country’s federal provinces and ministries. He played a central role in the digital signature project and other initiatives related to e-government. The institute’s working groups focus on core security (head: Daniel Gruss), cryptography (head: Christian Rechberger), e-government (head: Arne Tauber), Java security (head: Peter Lipp), secure systems (head: Stefan Mangard), systematic construction of correct systems (head: Roderick Bloem)
Quantum computers still only exist in theory – but many people predict they will have a bright future. Thanks to their revolutionary means of processing, they will be significantly more powerful than all known types of computer system. The major benefits they generate for users could cause even bigger headaches in terms of security. “The methods we are using now are based on the fact that although they can be cracked using current forms of computing, it would take several billion years to do so,” Rechberger explains. “But quantum computers could manage that fairly quickly.”
His team submitted two entries for the post-quantum cryptography competition currently being run by US certification body NIST. This competition aims to single out signature, key exchange and encryption procedures that can withstand attacks from quantum computers. Both of the signature procedures, Picnic and SPHINCS+, were named as candidates for the second round in February 2019.
At the Munich Security Conference in early 2018, nine organisations signed the Charter of Trust – a declaration of their intent to carry out more detailed research on cybersecurity. By 2019, the group had grown to 16 members. This year also saw TU Graz become the first university partner of this international initiative to enhance security in the digital age.
Security and Safety
“The topic of security takes on a new dimension if you introduce safety aspects,” says Stefan Mangard. Security is all about protecting systems against attackers. Safety, though, is a matter of safeguarding people’s health against the consequences of defective computer systems. Safety is a core competence of the Institute of Technical Informatics. The Working Group Industrial Informatics under Georg Macher focuses primarily on safety in industrial applications. Here, too, cybersecurity – from cryptography to side-channel attacks and authentication, and combinations of all three – is an increasingly important topic. Researchers are devising a holistic development approach and engineering processes.
The automotive sector provides an interesting example. “Today, vehicles are already highly networked, which means they offer more and more points of attack. There is virtually no other sector where the importance of the interplay between safety and security is becoming so clear,” explains senior scientist Macher. The most striking example of this is electronic steering locks. “If the locking system is not sure whether to activate the lock or not, there are two ways of looking at it: in terms of system security, it’s better to lock the steering wheel as a precaution. If the system doesn’t do this, the car could become a target for thieves and will be left virtually unprotected in the parking space. From a passenger safety point of view, it’s better not to lock the steering wheel. Someone could be driving the car at that moment and a malfunction could be the reason for the uncertainty in the locking system. So in this case, the steering wheel has to work normally.”
Nothing is 100% secure. We make it as difficult as possible for attackers. – Georg Macher
In order to create fully functional, secure systems for everyday driving situations and day-to-day factory operations, Macher and his colleagues are focusing on systematic dependability-by-design approaches, which deliver both safety and security. These approaches are partly based on cryptographic primitives that Mangard and Rechberger developed in the neighbouring institute. “Our focus is on devising a secure, comprehensive design and development process for critical industrial systems. Safety and security are important aspects of the overall development, and we’ve incorporated them into two projects, HyUnify for hydropower plants and MEMCONS for the automotive sector. The system’s reliability is not just a matter of developing new technologies, but applying them correctly, a critical mindset among the developers when it comes to security, and the availability of a corresponding development process. Safety and security engineering isn’t all about technology, it’s a way of life.”
In addition to developing systems that can be implemented in practice, Macher is also thinking about the future of the automotive industry. Launched in 2018, researchers on the Drives project are coming up with visions of what the industry will look like in 2030, as well as outlining new, additional fields of activity and the qualifications and training required by tomorrow’s professionals. “One new occupation that will definitely emerge is that of automotive cybersecurity engineer, and that’s something we need to prepare our students for. Knowledge of security or the industry alone isn’t the key. We need ‘T-shaped’ developers who have both in-depth general know-how and extensive detailed knowledge,” Macher explains.
When security is no longer a concern
So the future will pose more and more challenges, each one different from the last, for the security of computer systems and for the people who use them. Stefan Mangard sums up the aim of current research efforts: “Our goal is to ensure that security is a given without having to constantly take care of it, by installing updates for example. But as long as we still have to do that, our solutions aren’t good enough. This isn’t the time to rest on our laurels. In fact, our work is only just beginning.”
