NASA image of future space-based communications architectures,
now under development in the agency's High Rate Data Delivery research
program
Representative FY 2002 agency activities
NSF: Scientific principles for construction of high-confidence
systems; innovative research in trusted computing: safety, security,
and privacy for Internet-enabled systems; foundations for real-time
distributed and embedded systems; software and modeling technologies
for hybrid discrete and continuous systems; innovative fault-tolerance
approaches for critical infrastructure protection
DARPA: Research in high- confidence control systems; design for robust,
coordinated hybrid control; applications of formal reasoning to system
and software certification to reduce test effort; management of assurance
evidence; robust management of authority; safe semi-autonomous cooperating
systems; coherent and manageable control by human operators and decision
makers
NASA: Develop methods and technologies to assure reliability and security
in high-performance software and systems
NSA: Expand research in high-assurance computing platforms, security
management infrastructures, cryptography, active network defense,
and secure communications and network management
NIST: Promulgate advanced encryption standard selected by NIST to
replace previous data encryption standard; develop reference data
and guidelines for face-recognition technologies; with NSA, support
the National Information Assurance Partnership to promote cost-effective
international standards for software evaluation, testing, and certification
ODUSD (S&T): Support defense-related university research in assurance
foundations and technologies, information security, survivability
technologies, software control systems, and public key infrastructures
|
The 1999 report of the President's Information Technology
Advisory Committee argued that fundamental software research must
be "an absolute national priority" in Federal networking
and IT research. The Committee highlighted a reality of the Information
Age: The software running today's computing systems and networks is
a vast patchwork of often idiosyncratically designed, insecure, and
non-interoperable code whose fragility manifests itself daily in unreliability,
security breaches, performance lapses, errors, and difficulties in
upgrading.
Unlike the design of bridges and airplanes, for example, there exists
today no framework of formal scientific and engineering principles
governing software development. At the same time, the demand for software
currently exceeds our capacity to produce it, and the software that
is developed is very costly and increasingly complex, with many programs
running to millions of lines of code. That is far too many to be effectively
validated or made secure from attack with today's technology.
If all that were at stake were the frustrations of home computer users,
perhaps we could leave software development as a cottage craft rather
than a formal scientific discipline. But with software already managing
such large-scale and mission-critical systems as aircraft and air
traffic, medical devices including life-support systems, electrical
power grids, international financial networks, and advanced weaponry,
funding for research in software development methods must be continued.
The Federal NITRD agencies are undertaking the research necessary
to develop software governed by formal principles and methods and
structured so that its security and reliability can be assured through
automated testing and validation. Mission-critical systems must be
able to withstand hacker, criminal, and enemy attacks as well as unanticipated
system interactions; "self-healing" so they can continue
to function after an attack or system failure; and designed to guarantee
predictably high levels of data integrity and security.
In FY 2002, the agencies will fund research to develop and demonstrate
revolutionary high-confidence software and systems development and
assurance capabilities that balance risk, cost, and effort to achieve
systems that behave in predictable and robust ways. The goals of this
research effort are to:
- Provide a sound theoretical, scientific, and technological
basis for assured construction of safe, secure systems
- Develop hardware, software, and system engineering tools
that incorporate ubiquitous, application-based, domain-based,
and risk-based assurance
- Reduce the time, effort, and cost of assurance and certification
processes
- Provide a technological base of public domain, advanced
prototype implementations of high-confidence technologies
to enable rapid adoption
|
- Foundations of assurance and composition:
|
- Rigorous modeling and reasoning about high-confidence
properties
- Interoperable methods and tools
- System composition and decomposition
- Specification
- Safety and security foundations
|
- Scalable fault prevention, detection, analysis, and recovery:
|
- Robust system architectures
- Monitoring, detection, and adaptive response
|
- Correct-by-construction software technologies:
|
- Programming languages, tools, and environments
- Systems software, middleware, and networking, including
reusable middleware services such as efficient, predictable,
scalable, dependable protocols for timing, consensus,
synchronization, and replication for large-scale distributed
embedded applications and domain-specific services
|
- Evidence technologies for verification and validation
- Experimentation and reference implementations:
|
- Assured reference implementations and assurance cases,
such as Public Key Infrastructure (PKI) for advanced networks,
software control of physical systems, and mobile networked
devices
- Domain-specific certification technologies, such as
technologies for cost-effective verification and validation
and verified hardware/software co-design technologies
|
- Forensic and diagnostic tools
|
|
