Small defense project might change the world of networking

The end of 2009 saw $2.3 billion in awards flow from seemingly every nook and cranny of the Defense Department. But of 32 awards, some topping $300 million, it’s a five-year, $2.9 million Air Force Research Laboratory award that could change the way DOD — perhaps the world — approaches information security.

Think that sounds like media hype? Listen to this from the chief scientist on the project: “We don’t care if an attack succeeds if it doesn’t have any detrimental effect.”

Or this: “We’re not doing the forensics, and we’re not spending time on new security measures; we’re just using what’s there.”

Lest you think this is some random crank scamming DOD out of retirement money, you should know that Jim Loyall, who is not only chief scientist but also program manager on the project, works for BBN Technologies, the company that developed ARPAnet, which helped create the technologies that helped it grow into the Internet.

Under the Air Force Research Laboratory award, Loyall and four other BBN scientists are developing new approaches to better protect DOD service-oriented architectures (SOA) against malicious attacks. The Advanced Protected Services (APS) program is under the AFRL Information Directorate at Rome, N.Y., and “we hope application of our work will be DOD-wide,” Loyall said.

The target for the APS project is “to create networks that work in a variety of environments, that can face hostile attacks in unknown conditions and still survive and function,” he said.

Intelligence and military networks are susceptible to failure, whether from a simple software fault or hostile attacks. Although “these networks may be protected, some attackers will always get in,” he said.

“What we’re working for is not to completely prevent attacks but to make attacks survivable," he said.

That can’t be done using only conventional security procedures and technologies, he said. “The current state of security is the lockdown, which runs counter to the whole concept of openness and reuse, and it not only can make a network less useful, there are some military systems that can’t be deployed at all.” For example, “you can completely kill performance on a PDA network if you load on multiple layers of encryption.”

BBN researchers are using password protection, authentication and other security techniques that the federal government has adopted, though they weren’t designed to be used in SOA, Loyall said. “When you try to use them together to protect one area, they may leave gaping wide vulnerabilities elsewhere.”

Instead, the team is building extensions to the middleware stacks in SOA, and using strategies such as creating “crumple zones.” A proxy layer between the service and users allows different users to share the same services. “Users go into this initial buffer area, where much of the service functionality is repeated,” he said. “If an attack succeeds, it’ll get some initial success, but it won’t go past that proxy layer to the service itself, and other users will be uncompromised by the attack.”

The work also builds on the work of others, such as BBN partners and the Office of Naval Research, and applies novel concepts, such as virtual private groups and containment regions, Loyall said.

BBN’s work on the program is “really at the confluence of fault tolerance and IT security,” he said.

The company is a unit of Raytheon Co., which completed its $350 million acquisition of BBN, based in Cambridge, Mass., at the end of October. BBN employs 700 employees in seven U.S. locations.