guirong hao/iStock

DARPA Funds Hardware Cybersecurity that Turns Circuits into Unsolvable Puzzles

Jan. 8, 2019
Cybersecurity should focus on hardware and not software.

By turning computer circuits into unsolvable puzzles, a team of engineers at University of Michigan team aims to create unhackable computers with a $3.6 million DARPA grant.

Todd Austin, a UM professor of computer science and engineering, leads the project known as Morpheus. Its cybersecurity approach differs dramatically from today’s, which rely on software patches on vulnerabilities that have already been identified. It’s been called the “patch and pray” model, and it’s less than ideal.

“Instead of relying on software patches to hardware-based security issues, we want to remove those hardware vulnerabilities and disarm a large proportion of today’s software attacks,” says Linton Salmon, manager of DARPA’s System Security Integrated Through Hardware and Firmware program.

Under Morpheus, hardware would randomly move and destroy information to protect hardware and software.

“We are making the computer an unsolvable puzzle,” Austin says. “It’s as if you’re solving a Rubik’s Cube and every time you blink, it gets rearranged.”

In this way, it could protect against future threats that have yet to be identified, a possibility the security industry called a “zero-day exploit.”

“What’s exciting about the project is that it will fix tomorrow’s vulnerabilities,” Austin says. “I’ve never known any security system that could be future proof.”

Austin believes his approach would have protected against the Heartbleed bug discovered in 2014. Heartbleed lets hackers read passwords and other critical information on machines.

“Typically, the location of this data never changes, so once hackers solve the know where the bug is and where to find the data, it’s ‘game over,’” Austin explains.

Under Morpheus, the bug’s location and those of passwords would constantly change. And even if an attacker were quick enough to locate the data, secondary defenses in the form of encryption and domain enforcement would throw up additional roadblocks. The bug would still be there, but it wouldn’t matter. The attacker won’t have the time or the resources to exploit it.

“These protections don’t exist today because they are too expensive to implement in software, but with DARPA’s support we can take the offensive against attackers with new defenses in hardware and implement them with virtually no impact on software,” Austin says.

More than 40% of the “software doors” hackers have access to would be closed if researchers could eliminate seven classes of hardware weaknesses, according to DARPA. The hardware weakness classes are: permissions and privileges, buffer errors, resource management, information leakage, numeric errors, crypto errors, and code injection. DARPA is aiming to render these attacks impossible within five years. If developed, Morpheus could do it now, according to Austin. Although the complexity required might sound expensive, Austin is confident his team could make it possible at low cost.

Sponsored Recommendations

Pumps Push the Boundaries of Low Temperature Technology

June 14, 2024
As an integral part of cryotechnology, KNF pumps facilitate scientific advances in cryostats, allowing them to push temperature boundaries and approach absolute zero.

The entire spectrum of drive technology

June 5, 2024
Read exciting stories about all aspects of maxon drive technology in our magazine.


May 15, 2024
Production equipment is expensive and needs to be protected against input abnormalities such as voltage, current, frequency, and phase to stay online and in operation for the ...

Solenoid Valve Mechanics: Understanding Force Balance Equations

May 13, 2024
When evaluating a solenoid valve for a particular application, it is important to ensure that the valve can both remain in state and transition between its de-energized and fully...

Voice your opinion!

To join the conversation, and become an exclusive member of Machine Design, create an account today!