Cyberattack defense on U.S. Navy ships with RHIMES system
NewsSeptember 21, 2015
ARLINGTON, Va. The U.S. Navy is developing a Resilient Hull, Mechanical, and Electrical Security (RHIMES) system in response to cyber security threats such as the 2012 breach of the Navy-Marine Corps Intranet. The system is designed to make its shipboard mechanical and electrical control systems resilient to cyber attacks.
“The purpose of RHIMES is to enable us to fight through a cyber attack,” says Chief of Naval Research Rear Adm. Mat Winter. “This technology will help the Navy protect its shipboard physical systems, but it may also have important applications to protecting our nation’s physical infrastructure.”
RHIMES is designed to prevent an attacker from disabling or taking control of programmable logic controllers, according to Dr. Ryan Craven, a program officer of the Cyber Security and Complex Software Systems Program in the Mathematics Computer and Information Sciences Division of the Office of Naval Research.
“Some examples of the types of shipboard systems that RHIMES is looking to protect include damage control and firefighting, anchoring, climate control, electric power, hydraulics, steering, and engine control,” explains Craven.
“Another powerful example is the hacking of a German steel mill in 2014,” Craven says. “The hackers reportedly got in and overheated a blast furnace, and even made it so that the plant workers couldn’t properly shut down the furnace, causing massive damage to the system.”
Computer security systems are traditionally designed to protect against previously identified malicious code. “Instead, RHIMES relies on advanced cyber resiliency techniques to introduce diversity and stop entire classes of attacks at once,” Craven says. Most physical controllers have redundant backups with the same core programming, allowing the system to remain operational in the event of failure, Craven continued. However, without diversity they all get hacked.
“Functionally, all of the controllers do the same thing, but RHIMES introduces diversity via a slightly different implementation for each controller’s program,” Craven explains. “In the event of a cyber attack, RHIMES makes it so that a different hack is required to exploit each controller. The same exact exploit can’t be used against more than one controller.”
The RHIMES system aligns with the U.S. Navy’s “Cyber Power 2020,” with benefits in the commercial world as well.
Read more on cyber:
On DARPA's cybersecurity radar: Algorithmic and side-channel attacks
Raytheon and SMU form a partnership for cyber research
Defending DoD from cyberattacks, getting to the left of the boom
