The computer that cannot by infected with viruses was created by Russian scientists. It is a single-board computer supporting a wide range of functions nonetheless. It is expected to be used for the protection against hackers targeting critical information infrastructure (CII), including ATMs and NPP control rooms. Speaking to Izvestia, the Digital Ministry expressed their interest in such technologies. Opinions of independent experts divided over the new product. Some think that developers found an effective solution for the protection against targeted cyberattacks. Others doubt whether the invention can provide protection against all types of hackers’ break-ins.
Mental transformation
The unique microcomputer designed to protect computer systems and devices from break-ins was developed by researchers at Moscow Institute of Physics and Technology (MIPT). The product was called m-TrusT. It is a single-board computer that serves as a filter of some sort by acting as a mediator between the device it is connected to and the outside world full of dangerous viruses. Special interface makes the product compatible with various types of devices, which means that it can basically be embedded in and connected to any kind of equipment, including computers, ATMs, and even nuclear power plant control room systems.
Regular computers are vulnerable. It is impossible to securely protect them against break-ins by using solely specialized software. To fix the flaw, MIPT researchers created a microcomputer with changeable architecture.
When turned on, the device can only read information, without storing it. Since data recording is not available, viruses cannot sneak into the memory of m-TrusT, which makes the device almost invulnerable.
“First we need to remove the data recording function. Then the only thing the computer can do is check itself. Are there any new viruses? Has anything been supplanted? Have there been any break-ins? Once it checked itself and made sure everything was okay, it brings back the function we had removed in the first place and once again becomes a universal computing machine,” said Valery Konyavsky, Head of the Department of Information Security at MIPT.
All of this enables the protection of computing devices against viruses sneaking in or encryption keys being stolen.
The m-TrusT device aims primarily at protecting the objects of so-called critical information infrastructure. This term was first introduced in a federal law and applies to all information systems and networks that are vital in terms of national security. These include the databases supporting the operation of the industrial, energy, transport, financial field, and other fields of great importance.
CII supports uninterrupted proper operation of numerous devices that we use daily, including the aforementioned ATMs, gas meters installed in residential buildings, rail traffic management systems and control room systems of the biggest energy facilities. Since all elements of such structures are organized into networks, hacking each one of the elements can make the whole system vulnerable. Yet it would take years to build devices to protect every single type of equipment and especially certify them.
Instead, researchers at MIPT came up with the idea to separate the core with security functions from the interface used for connecting the device to the outside world and set up to match a specific object of CII. This computer should undergo certification only once and can be used for every kind of infrastructure.
According to the estimates of the developers, the production cost incurred to create one device will be 50 to 100 thousand rubles. To protect all objects of CII in the country, up to 2 million items will have to be produced each year.
Domestic solutions
Speaking to Izvestia, the Digital Ministry expressed their interest in developing information security technology that could be used for critical information infrastructure protection and highlighted the importance of creating Russian solutions in particular.
“The Digital Ministry supports the development of domestic solutions aimed at protecting the subjects of critical information infrastructure. According to the Executive Order of 1 May 2022, starting from January 1, 2025, subjects of critical information infrastructure are prohibited from using information security products created in unfriendly countries or by organizations under their jurisdiction,” the ministry told Izvestia in response to a request for comment.
Opinions of independent information security experts divided over m-TrusT reliability.
“These are interesting, viable and valid devices. They are basically single-board computers that can be embedded in ATMs and other types of equipment. They meet the requirements of CII. However, it is important to assemble them from Russian components or else we will possibly face the foreign components problem,” said Vladimir Makarov, chief specialist of the information security audit department at T.Hunter.
Indeed, according to Taras Tatarinov, an information security expert, the proposed architecture provides protection against certain types of hackers’ break-ins, the ones that involve hackers’ attempts to insert their own commands into the victim’s computer. That does not mean though that the architecture will be immune to all malwares. The expert believes that the problem needs further study.
“Today all major corporate and industrial solutions take the form of thin clients—devices that only support the user interface allowing them to connect to a server. User devices do not perform any calculations or store data. This is what servers are used for. Using client devices to store or process data, as proposed by the creators of the device, is a poor practice in terms of information security,” Mr. Tatarinov said.
According to m-TrusT developers, their brainchild is already being used for information security purposes in major public organizations.
