Cyber securityProtecting information systems from malicious activity

Introduction

Research at the University of Birmingham leads to new inventions and fuels innovation and business growth. We produce 6,000 talented and highly employable graduates every year. We play an integral role in the economic, social, and cultural growth of our nation and our region. We generate over £1 billion of regional economic activity each year and support nearly 12,000 jobs.

The Security and Privacy Group is a team of academic staff based in the School of Computer Science at the University of Birmingham. For over a decade the Group has remained committed to its ethos of tackling cyber security problems that are important to society. Working in collaboration with academia, industry and government, the Group consistently produces internationally leading research on key issues that has led to recognition by GCHQ as an Academic Centre of Excellence in Cyber Security Research. Building on an established strength in the analysis of security systems, the Group’s research is concerned with all aspects of security and privacy for society.

Working flexibly and sustainably with industrial partners ranging from HP Labs to L-3 TRL to Jaguar Land Rover, the research at Birmingham is having real-world impact on products and services, safeguarding the security and privacy of businesses, governments and individuals.Cyber security and privacy are issues that concern everyone living in this technologically dependent world. The work within our Security and Privacy Group is underpinned by consideration of critical issues for industry, government and society, ensuring we have the capacity to adapt and address new areas as the field evolves.

2

systems through which devices are accessed and information is shared to the analysis of vulnerabilities in specific devices. We work with industrial partners to establish secure protocols and procedures as well as to fix security weaknesses when they are identified.

Automotive Security

Modern automotive vehicles can have several wireless interfaces, and be interconnected with various devices and the internet. From immobilisers and wireless locks to GPS and internet enabled devices, this connectivity adds great functionality but it also introduces a number of security and privacy threats. This area of expertise focuses on improving the security of next generation electronic vehicles. We undertake research in conjunction with industry leaders in order to ensure the security of vehicles both now and in the future.

covers a broad range of wireless devices, protocols and systems, from mobile phone networks to embedded devices communicating with one another or even vast systems of clouds, servers, products and users. With applications in conjunction with our other areas of expertise, this research topic focuses on ensuring wireless communication can occur securely while maintaining the functionality necessary for individuals and organisations to operate effectively.

Industrial Control Systems Industrial Control Systems underpin almost all aspects of everyday life, from power networks to transport systems. Our researchers work with national organisations in the Energy and Railway sectors to perform a detailed security analysis of their systems. We are searching for possible points of cyber attack and building a better understanding of the impact of possible failures. This leads to better security for these systems of critical infrastructure. Based on this research, we work alongside industrial partners to generalise our methods into business processes that other owners of industrial control systems can use to help ensure their systems are also safe from cyber attacks.

Internet of Things

Devices such as cars, thermostats, door locks, traffic lights, trains, power plants, TVs, and dialysis machines are rapidly becoming internet-enabled, resulting in cyber-physical systems that blend the digital and physical worlds. Confidential data will be collected by these devices and processed on an unprecedented scale, for multiple purposes. This revolution carries risks for all the stakeholders involved. Our research examines all levels of IoT security issues, from the architectures and

Applied Cryptography Cryptography is the study of mathematical techniques that secure and protect information in a digital format and it is used for securely sending and receiving messages. Cryptography underpins cyber security research and its application. This research area builds upon a firm theoretical grasp of cryptography and its many uses in the specific technologies that are explored in other research areas. The Group focuses on both the design and analysis of cryptographic protocols, testing current tools and devising new and improved methods of protecting data, devices, communications and systems.

The security aspects covered in this area of research include confidentiality, integrity, authentication and nonrepudiation. Applications of cryptography include electronic voting, e-passports and RFIDs.

Formal Protocol Verification Security protocols are notoriously difficult to design and extremely error-prone. Therefore, formal verification is crucial to assess their security. This involves analysing systems with respect to a formal specification using mathematics, helping to identify flaws within electronic systems and develop solutions to resolve those problems. Research in this area focuses on proving that systems are secure or, when they are not, assessing the vulnerabilities of specific technologies and finding solutions in practical applications. Wireless Security Technologies today are increasingly operating wirelessly, enabling communication to occur further, faster and more flexibly. Our research

3

Our expertise

Electronic Voting

Electronic voting promises the possibility of a convenient, efficient and secure election whilst avoiding human errors in recording and tallying votes. It can be used for a variety of elections from small-scale online communities to full-scale national elections. However, the possibility of large-scale abuse and fraud is intrinsic to electronic voting. Our research into secure electronic voting focuses on creating procedures that will detect fraud and coercion that may take place. This includes breakthroughs in security technologies for online voting that enable secure systems even when using infected computers, allowing for the detection of electoral fraud even if the entire system is compromised.

Cloud Security

Cloud computing means entrusting data to information systems that are managed by external parties on remote servers, collectively known as the Cloud. Cloud security raises privacy and confidentiality concerns, because the service provider has access to all data and could accidentally or deliberately disclose it. Linking to automotive security, Internet of Things and wireless security issues, the research in this area is concerned with ensuring users’ privacy in an ever more connected world.

Security and Privacy for Society

All aspects of our research are underpinned by a commitment to tackling challenging issues that are important to society. Working between the need for security and individuals’ right to privacy, our research consistently displays a sensitivity to its social impact, particularly when dealing with the often controversial issues in cyber security for current and future society.

4

Educationat which security must be considered, from low-level attacks on hardware and software implementations, through to more abstract design principles underlying secure systems, to strategies for management of processes and people.

Our curriculum has been developed with the involvement of key stakeholders in the cyber security industry. As well as advising us on the skills they seek when recruiting graduates, they also contribute directly to the MSc programme through guest lectures and project supervision. In recent years, we have welcomed speakers from Microsoft, Vodafone, Siemens, IBM and Hewlett Packard to talk directly to our students.

Provisional GCHQ Accreditation

The programme has received provisional GCHQ accreditation as an academic centre of excellence that provides high quality cyber security education. This is an exciting

MSc Cyber Security Our MSc in Cyber Security concerns the design of systems that resist attack. As computers and IT systems become ever more prevalent and ever more connected with each other, the opportunities for attackers become even greater, and the need to resist them becomes more urgent. Computing infrastructure is now vital for communication, government, commerce, and control of our physical environment, and is a potential target for terrorist and criminal attacks. Graduates who understand the technologies that underpin products and practices to secure it will be in great demand.

The MSc prepares students to engage with complex, challenging problems and real-world issues, teaching students the intellectual and technical skills they need to deal with current and future cyber security threats. The degree programme evaluates all the layers

development for us and this accolade is a testament to the first rate research and teaching taking place in our School.

Case study

Hot Chip

The Trusted Computing Group (TCG) is an industry consortium including AMD, Intel and Microsoft consisting of around 100 companies. The group’s hardware chip, Trusted Platform Module (TPM), is present in over 500 million laptops, desktops and servers globally. The TPM enables a level of security that cannot be obtained from software alone, is supported by major operating systems (including Windows and Linux) and is increasingly likely to be utilised for the protection of those operating systems.

In 2008, Professor Mark Ryan from the School of Computer Science at the University of Birmingham discovered two attacks targeting TPMv1.2, and presented the findings to the TCG. The results showed how attackers might try to access confidential information protected by TPMv1.2. The attacks on TPMv1.2 that were discovered by Professor Ryan are amongst the most wide-ranging found so far, and applied to about 100 of the TPMv1.2’s 120 commands. The TCG consortium adapted the revised protocols that Professor Ryan and his colleague Liqun Chen at HP had created in order to fit them into the new command structure and have incorporated them into the new specification – TPMv 2.0.

The primary beneficiaries are professional computer users worldwide, from having systems that are more secure. The TCG consortium and its 100 member companies also benefit, by having more secure TPMs in their products, and software manufacturers benefit by being able to leverage greater security from the TPM.

TPMv 2.0 began shipping in October 2013 and hundreds of millions are expected to ship over the coming years.

Mark Schiller, Executive Director, Trusted Computing Group

‘Next generation personal computers and servers will include protocols that were inspired by Mark Ryan. Those protocols will help increase the level of protection of software and data in those platforms.’

5

Secure Infrastructure

Industrial Control Systems underpin almost all aspects of life in the UK. The power network, operated by the National Grid, and the rail network, which is overseen by the Rail Safety and Standards Board (RSSB) are two key examples of this.

An ongoing area of focus for the Security and Privacy Group is ‘A SystematiC Evaluation Process for Threats to Industrial Control Systems’ (SCEPTICS). This project is based on performing a detailed security analysis of these critical systems, looking for possible points of cyber attack and building an understanding of the impact of possible failure.

Dr Tom Chothia and Professor Mark Ryan are working alongside academic colleagues in the Schools of Engineering and Computer Science to not only identify weaknesses in current systems but build on this analysis to enable better security for systems of important national infrastructure.

In order to apply the findings of the analytical part of the project, the University is not only working with the National Grid and RSSB but is also engaging directly with industry partners L-3 TRL and Parsons Brinckerhoff. The methods developed are being generalised into business processes that operators of industrial control systems can use to help ensure their systems are protected from cyber attacks.

Professor Mark Ryan, Security and Privacy Group, University of Birmingham

‘Cyber Security underpins many innovations in Industrial Control Systems. The University of Birmingham is working closely with industrial partners in order to identify threats, develop practical solutions and help businesses to become more informed, more efficient and more effective.’

6

Case study

7

n Licensing and intellectual property n Consultancy n Spin-out companies n Contract research n Equipment, testing and analysis n Access to funding n Knowledge Transfer Partnerships (KTPs) n Student internships, placements,

graduate recruitment n Business accommodation n Conferencing facilitiesn Professional development

Services for business to access

1207

2 ©

Uni

vers

ity o

f Birm

ingh

am 2

016.

Prin

ted

on a

recy

cled

gra

de p

aper

con

tain

ing

100%

pos

t-co

nsum

er w

aste

.

Business Engagement Edgbaston, Birmingham, B15 2TT, United Kingdom

www.birmingham.ac.uk

We want to work with you

Contact us Richard Fox Business Engagement Partner College of Engineering and Physical Sciences Tel: 0121 414 8921 or email our Business Engagement Team: businessteam@bham.ac.uk