Slashdot Mirror
NSF Awards $10 Million To Protect America's Processors
aarondubrow writes "The National Science Foundation and the Semiconductor Research Corporation announced nine research awards to 10 universities totaling nearly $4 million under a joint program focused on secure, trustworthy, assured and resilient semiconductors and systems. The awards support the development of new strategies, methods and tools at the circuit, architecture and system levels, to decrease the likelihood of unintended behavior or access; increase resistance and resilience to tampering; and improve the ability to provide authentication throughout the supply chain and in the field. "The processes and tools used to design and manufacture semiconductors ensure that the resulting product does what it is supposed to do. However, a key question that must also be addressed is whether the product does anything else, such as behaving in ways that are unintended or malicious," said Keith Marzullo, division director of NSF's Computer and Network Systems Division.
http://redmondmag.com/articles...
Make of these what you will.
If you keep throwing chairs, one day you'll break windows....
Conversely it can be done in the US by 1H-B visa holders from India.
Or it could be done by IBM in Zurich or India. If IBM gets a piece of the action, it could be done anywhere. Remember, they no longer report employment by country, so no matter where they say the work was done, big chunks of it cold be done anywhere on the planet.
Remember that Zuckerberg and Microsoft are threatening to move to Canada because the US only produces second rate computer talent, so clearly there is no one in the US capable of doing the job right. (Look up the recent Slashdot post about this, I'm too lazy.)
I know that the money is actually going to universities, not corporations. I'm just pulling your leg. Even so, given the ties between academic institutions and big corporations, who knows where the data from this will end up, or who will have input into the process. Inquiring minds want to know...
Why is Snark Required?
Is in outsourcing.... nothing bad can happen if you have everything made in China....
Do not look at laser with remaining good eye.
We probably have to assume all chips have Chinese or NSA backdoors. Choose your poison.
See his blog post on the War on General Computing. (warning: video lasts more than five minutes, but it is worth seeing.)
Just another "build me a device that can do anything, except for (<insert feature here>)" action.
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
"However, a key question that must also be addressed is whether the product does anything else, such as behaving in ways that are unintended or malicious,"
Like "off label" usage of prescriptions, using a frozen leg of lamb as a murder weapon, or spending money to fund all things evil and destructive? My point is that a product can and will do anything else, such as behaving in ways that people decide and control, be it malicious or mundane. Nobel invented dynamite, should he get his own prize for breakthroughs in bank vaults? This really sounds like a load of toad.
Face it, friends. We're pwnz0rs.
A short calculation:
$4m in funding
- 50% of overhead (overhead varies between 40% and 67%)
= $2m of effective funding
This is available for at least 10 professors (though it's for sure more than 1 professor per institution), thus, it's $200,000 per university team. From this you have to remove summer salaries for each year for the professor(s), so it' maybe $140k-$160k. Running for 3 years, this means funding for 10 students at most across all projects.
Read a little further down in the article and you'll see that NSF allocated $73 for cybersecurity alone. Now that's a number that already gets more things moving. But $4m in the current system with overheads, summer salaries, and project meetings is nothing.
I remember watching some show on a river in Africa that never makes it to the coast. Every spring it starts as a rushing torrent, but as the thaw ends and the water spreads out it evaporates and sinks into the land, leaving a huge inland river delta.
On can construct a similar imaginary money river for this story. $10 million? It will never see hardware, that money will disappear into the bureaucracy like water into the African plains.
To put this in perspective, $10 million is what, one hour of iPhone sales? That's how important the NSF considers this?
Does four million get even one item on this list?
(from the article)
Combating integrated circuit counterfeiting using secure chip odometers--Carnegie Mellon University
Intellectual Property (IP) Trust-A comprehensive framework for IP integrity validation--Case Western Reserve University and University of Florida
Design of low-cost, memory-based security primitives and techniques for high-volume products--University of Connecticut
Trojan detection and diagnosis in mixed-signal systems using on-the-fly learned, pre-computed and side channel tests--Georgia Institute of Technology
Metric and CAD for differential power analysis (DPA) resistance--Iowa State University
Design of secure and anti-counterfeit integrated circuits--University of Minnesota
Hardware authentication through high-capacity, physical unclonable functions (PUF)-based secret key generation and lattice coding--University of Texas at Austin
Fault-attack awareness using microprocessor enhancements--Virginia Tec
Invariant carrying machine for hardware assurance--Northwestern University
So of course this whole project will need to attract international support from all those other governments grateful that the US role protects the integrity of critical hardware worldwide.
After all, those same governments will probably send their very brightest and most dedicated graduate students and post-docs to the institutions conducting the research.
Maybe they're already supporting it and working on it.
... what with the state of education in the US, not only do we not have people with computer talent, we no longer have computer people capable of hacking.
The good news is that all Americans have been removed from the no-fly list.
The bad news is that we're screwed.
It little behooves the best of us to comment on the rest of us.
One of the first things they are going to research is how to properly add numbers.
Dr. Evil would be proud.
Do you guys realize how minor this money is? Do you know how much research costs? Basically, this is an amount that would run one decent sized lab at a research university for maybe a year. If these are the grants we're crowing about... well, I guess it's a start.
$10M a year for five years might be reasonable to get some traction on the problem. All this will do is fund a few papers which will probably disappear. That grad students and post docs will survive another year, I guess, so that might be good.
That is all.
NSx working against NSx
How do I know that some microcode hasn't been added to the CPU/GPU I've got plugged into my motherboard? Is there some sort of independant auditing process in place? Not that this would do any good. Customers of components like FPGAs have demanded methods to secure their device code from illicit inspection and copying. And any audit process would be indistinguishable from such inspection. So that isn' going to happen.
If you buy a router, how can you be sure that a back door hasn't been installed, either by the manufacturer or at some point in the unit's transit? And I suspect tht any attempt to secure such a device from tampering by those evil Chinese would trip over NSA requirements to provide exactly the same kind of access.
Have gnu, will travel.
America also pushes the gov. to buy this and help restart the industry.
I prefer the "u" in honour as it seems to be missing these days.
Do the research here then send the details so they can be subverted... Oops I meant manufactured in China. That'll do a lot of good.
You really must have zero concept of how universities do research.
Do you know anything about research funding? These grants are to support graduate research work for a certain amount of time. Most of these things don't *HAVE* hardware as their outcome. Most likely, they are doing theoretical research into algorithms for detecting bugs and protecting hardware that can then be integrated into future hardware. Do you think that universities just spit out 14nm Xeons made by graduate students?
Jesus, this Slashdot discussion is just idiotic. What the hell happened to this place?
there will never be a processor available to the general public that doesn't have a backdoor. now if your a government or corporation with a big and i mean really big wallet... .