Cybersecurity in India

Securing cyberspace today involves in-depth defense, which in turn requires taking a multilayered view of the systems in play. All layers must be secured, from the hardware processor and platform to the peripherals, firmware, operating system, network, protocols, crypto-algorithms, applications, services and microservices, APIs, virtualization, and cloud distribution. Cybersecurity also involves threat modeling; vulnerability assessment; risk analysis; and risk-driven, best-effort security controls. Further, based on the use of computing and networking, we have information-technology (IT) and operational-technology (OT) systems at various industrial-control and critical-infrastructure systems.

In India, several academic institutes have chartered course work in cryptography and security. The earliest steps trace back to the launch of the Cryptology Research Society of India (CRSI)¹⁴ by multiple academic institutes, such as the Indian Statistical Institute (ISI), Indian Institute of Science (IISc), Institute of Mathematical Sciences (IMSc) Chennai, and the Indian Institute of Technology (IIT) Madras/Kanpur/Kharagpur. To extend the theoretical foundations of cryptology to information security and cybersecurity, special initiatives were taken by various academic partners.

ISI Kolkata has been one of the forerunners in paving the path of academic research in the world of cryptography, focusing on varied areas, including symmetric key cryptography and various research topics in the domain of cryptology and security.³² IIT Kharagpur developed expertise in a state-of-the-art research laboratory called Secured Embedded Architecture Laboratory (SEAL), focusing on hardware security.³⁸ IIT Kanpur, along with partners at IIT Kharagpur, IIIT Allahabad (IIITA), and IISc, runs a technology innovation hub (TIH)⁶ for cyber-physical systems (CPS) security, where IIT Kanpur mainly focuses on industrial control system (ICS)/supervisory control and data acquisition (SCADA) security while IIT Kharagpur focuses on hardware security, Trojan detection, and automotive security.³⁹ IIT Kanpur is also involved in the security of unmanned aerial vehicles (UAVs). IIITA focuses on IoT security, while IISc focuses on multiparty computation. IIT Madras has a leading research group in foundational aspects of cybersecurity,¹³ and IIT Bombay, which fosters a strong group in theoretical cryptography, has also made pioneering contributions in secure computation, specifically in the domain of secure multiparty computations.

This article looks at some of the major research accomplishments resulting from these efforts. Further, we discuss significant government initiatives that have helped to develop India’s discourse around cryptology and research.

Back to Top

Cryptology Research

The Cryptology Research Society of India was set up in 2000 as a scientific assembly comprising academics, researchers, specialists, students, and institutions interested in promoting the science and technology of cryptology, data security, and allied disciplines in India. The society’s mission was to support and promote Indian research activities in cryptology and security. CRSI generated a nationwide awareness of crypto through its creation of the Indocrypt Conference³⁵ and other promotional activities. To cite some examples, ISI Kolkata’s initial work on Boolean functions in cryptology²⁵ and multiparty computations from IIT Madras⁴⁰ were pioneering instances of cryptography’s growth in India. The stellar work in developing a deterministic polynomial algorithm to determine whether an input is prime or composite originated from IIT Kanpur.¹ Subsequently, several schools around the country started developing pedagogical materials on cryptography, and free educational materials were distributed via the National Program on Technology Enhanced Learning (NPTEL).

ISI Kolkata. ISI Kolkata has been one of India’s torchbearers in cryptology research. Their work includes topics such as Boolean functions,²⁵ foundational analysis of stream ciphers like RC4,²⁰ design of tweakable encryptions,³⁷ authenticated encryptions,⁹ and more.

IISc Bangalore, and IIT Madras and Bombay. IISc Bangalore has leading cryptography and security research groups, producing state-of-the-art research in multiparty computations³¹ and virtualization security.¹² Different security groups at IISc also delve into topics such as security, privacy, and system security.¹⁰ The research group at IIT Madras has been one of the forerunners of cryptology in India. Starting with foundational work on reliable message transmission in unreliable networks,³ the group has produced fundamental research on post-quantum cryptography.⁷ The research groups are contributing world-class research to construct cryptographic schemes, such as efficient identity-based encryptions, primarily based on the hardness of lattice problems.² Subsequently, several novel constructions, including signature schemes, functional encryptions, and fully homomorphic encryptions, have been designed by the research group, which has appeared in the top international cryptography forums.

The crypto team at IIT Bombay has solved fundamental problems in studying the complexity of securely evaluating arithmetic circuits.¹⁸ One of their works focused on two-party protocols with security against malicious parties using standard cryptographic primitives, minimizing associated communication overheads.²⁶ Subsequently, in another interesting work, they extended the theory of private circuits to protect cryptographic hardware by proposing circuits that hide their internal states from adversaries that can modify an unbounded number of wires anywhere in a circuit.²²

Back to Top

Hardware Security Research

Thanks to the tremendous development of cryptographic algorithms, most standard ciphers are defiant against traditional cryptanalysis, which tries to obtain the secret keys by analyzing the plain-text and cipher-text mathematical relationships. However, with Paul Kocher’s seminal paper,²⁴ it became evident that despite the mathematical robustness of crypto algorithms, there may be implementation weaknesses which attackers can exploit.²⁹ To foster research on applied aspects in cryptology and security, the Security, Privacy, and Applied Cryptography Engineering (SPACE)²³ conference was set up in 2011 in association with the International Association of Cryptology Research (IACR). It has been an annual event ever since.

SEAL, IIT Kharagpur. The SEAL lab at IIT Kharagpur is nationally and internationally recognized by cryptographic engineering domain experts. It supports experiments on both non-invasive attacks, like electromagnetic/power attacks, and invasive attacks, like electromagnetic/laser-based fault attacks (Figure 1). The SEAL lab, IIT Kharagpur has focused on fundamental research in hardware-security and cryptographic engineering, leading to highly impactful indigenous works in fault tolerance for cryptography, side-channel analysis, design automation, and very large-scale integration (VLSI) of cryptosystems, physically unclonable functions, and microarchitectural attacks. SEAL has worked with several Indian and foreign industries, such as NTT Labs Japan, Wipro, Synopsys, Intel, Qualcomm, HAL, and DRDO. A notable instance was on research about usages of PUFs for IoT authentication being transferred to Wipro.⁴¹

Figure 1. Hardware security infrastructure at SEAL, IIT Kharagpur.

Back to Top

Key Research Highlights of SEAL Include:

Side channels, faults, and microarchitectural attacks. One of SEAL’s key contributions has been to show that faults can be catastrophic for security. To bring out the key idea, imagine a cipher state being inflicted with a random fault (Figure 2). Because of the cipher’s state transformations, the fault value also undergoes transformations and starts to exhibit interrelations. Can these relations be exploited? The team unearthed a strategy to determine a differential fault attack that can leak the Advanced Encryption Standard (AES) key with a single random fault.^27,42 Recent findings show powerful avatars of such attacks using faults to break all known counter-measures against fault attacks, thus obviating special attention in realizing the cryptosystems.^28,36 The laboratory is equipped with fault-injection tools, such as electromagnetic guns, to demonstrate that crypto on embedded systems can be threatened by such attacks. Notably, the group demonstrated that such fault attacks can also be triggered through the micro-architecture via software by exploiting rowhammers, which are reliability vulnerabilities in modern-day DRAM chips.⁵ The work has been the first to show that fault attacks on an AES can be triggered by software mechanisms. This has been cited in several recent attacks, such as Plundervolt, which retrieves AES keys using the single-fault attack developed by SEAL. This was one of the primary reasons for Intel dropping Intel SGX from its family of 11^th-generation processors.¹⁹

Figure 2. Diffusion of faults in ciphers.

Developed tools are also open sourced to the international community,^a maintained by the University of Florida in the U.S., and have been transferred to major CAD companies. The lab also commercializes Anweshak, an in-house tool for performing side-channel and fault analysis through an incubation called ESP (Figure 3).¹⁷

Microarchitectural attacks. Computer systems have evolved in a fascinating way, and the primary driving force has been performance. Modern-day processors are powerful workhorses that can handle intensive computations, including complex crypto algorithms. However, there is a catch: The same hardware artifacts that enable modern-day crypto to efficiently execute also clears the way for leakages, which are fundamental to the microarchitectures of these computers. One of the central areas of the SEAL lab’s work has been on microarchitectural attacks; they have been among the leaders in showing the various aspects of modern-day computer architectures responsible for side-channel leakage of cipher keys.³³

SEAL has strived to develop sound mathematical models to formalize leakage due to architectural artifacts, one of them due to hardware prefetchers.³⁴ The group also exposed security threats due to performance counters, which initially could be accessed with user privileges, to successfully extract secret keys even from protected public-key crypto suites.²¹

C3i Hub at IIT Kanpur. While cryptography and crypto engineering are the starting points of the overall effort to secure the cyberworld, creating tangible and usable solutions requires a humongous effort in the fields of network security and CPS security. The Cyber Security and Cyber Security for Cyber-Physical Systems (C3i) Innovation Hub has been set up at IIT Kanpur to address the issue of the cybersecurity of cyber-physical systems in their entirety. The C3i Hub has developed solutions for CPS intrusion detection, which monitors sensor and actuator data at ICS controllers and OT host, and detects intrusion. The C3i Hub focuses on analyzing security vulnerabilities and developing tools to address them at various levels of system architecture as well as translating those tools into deployment-ready software. The hub’s main goals are to nucleate start-ups developing these tools at scale, from partnering with industries in this domain, to co-developing and transferring these technologies and training the next generation of cybersecurity researchers and professionals. A major example of such an incubation is CRUBN,¹¹ which was started under the aegis of the National Blockchain Project at IIT Kanpur and exclusively designed and adapted for Indian e-governance scenarios.

Figure 3. Anweshak, a slide-channel/fault-attack evaluator tool.

Government initiatives and entrepreneurship. The cybersecurity regulatory ecosystem garnered some real attention when the IT Act was amended in 2008. This expanded and established the definitions of cybercrime, introduced the concept of privacy (Section 43A) that led to the formation of privacy rules, recognized the role of digital evidence, and underlined the importance of digital signatures. It also empowered CERT-In⁸ for incident emergency response and set up the National Critical Information Infrastructure Protection Centre (NCIIPC) for critical infrastructure protection under the National Cyber Security Policy, ratified in 2013.³⁰ It was the first national strategy-level intervention that underlined the importance of secure and resilient cyberspace for citizens, businesses, and government. It emphasized creating a secure ecosystem, setting up an assurance framework, strengthening the regulatory framework, setting up a national-level crises management plan, developing indigenous cybersecurity technology, testing and validating products, creating a workforce, incentivizing cybersecurity investment, establishing an effective cybercrime investigation system, developing public/private partnerships, and fostering global cooperation.

---

To foster research on applied aspects in cryptology and security, the Security, Privacy, and Applied Cryptography Engineering (SPACE) conference was set up in 2011.

---

The national cybersecurity machinery, which has been in the works since 2008, received a major lift after the creation of the National Cyber Security Coordinator’s office. This role, which reports to the Prime Minister’s Office (PMO), is charged with showcasing the impact of cybersecurity on national security and coordinates with national efforts in cybersecurity preparedness and capability building. This is further strengthened through the establishment of the National Cyber Coordination Centre (NCC) to generate the situational awareness needed to handle existing and potential cybersecurity threats and to enable timely information-sharing for proactive, preventive, and protective actions by individual entities.¹⁶ On sectorial regulation, the Reserve Bank of India is leading the regulation of the banking industry for competent, proactive, and responsive security. Other regulators, such as IRDA, are taking the Reserve Bank’s lead. In 2021, the Ministry of Power issued the Central Electricity Authority (CEA) Cyber Security in Power Sector guidelines, which demanded specific actions from organizations in the power sector to enhance the security of IT and operational environments.

Increasing regulatory actions, advancing threats, and efforts for structuring national security affairs are providing significant opportunities for cybersecurity research and product entrepreneurship. Academic research is expanding due to rising funding commitments from the government. The Information Security Education & Awareness (ISEA) project by the Ministry of Electronics & Information Technology (MeitY) was implemented between 2005–2014 at 39 academic institutions and MeitY organizations, resulting in capacity building, awareness, and cybersecurity best practices (cyber-hygiene) on a national scale. In 2014, ISEA Project Phase-II was approved with the objectives of capacity building in information security to address human resource requirements; training of government officials; and scaling up of mass information-security awareness targeted toward academic, government, and general users.

Start-ups. The ecosystem for cybersecurity start-ups is also shaping up thanks to partnerships between government and industry through initiatives such as the Data Security Council of India.¹⁵ With more than 250 start-ups in cybersecurity, the ecosystem is large. The Indian cybersecurity industry, with its ability to cultivate skills, is growing quickly. It currently stands at around $10 billion and is likely to grow.²¹ Many global players are moving their security operations, engineering, and even R&D work to India, and leading global digital players are setting up their product security work in India. The National Cyber Security Coordinator’s office is working to define the national cybersecurity strategy, which would not only strengthen cybersecurity preparedness but also would unleash many new opportunities for research, innovation, and product entrepreneurship.

Back to Top

Conclusion

As India quickly adopts technologies such as IoT and CPS to govern and disseminate various services to its citizens, front-end research on cryptography, cryptographic engineering, hardware security, CPS security, and more grows in importance. Research in India is quickly making progress in this direction, germinating from academia in collaboration with the international research community and suitably complemented by several national and international industrial counterparts. The government’s support is also instrumental in taking this step forward. While the path ahead needs to tackle more challenges in this emerging field, the initial journey shows promise, and we hope to develop our inherent capability to secure cyber-India.

Acknowledgment and disclaimer. Thanks to Sandeep Shukla for early discussions and input in writing the article. Special thanks to Chandan Sharma, CDAC Hyderabad, for crucial input on ISEA; and to Vinayak Godse, DSCI, for feedback on start-ups and government initiatives. This article presents a representational overview, and despite best efforts, can miss important references.