FEDERAL CYBERSECURITY RESEARCH AND DEVELOPMENT STRATEGIC PLAN (2019) paradigms, and the full range of mobile devices and mobile network layers. Enable secure ad hoc establishment, management, and disposal of tailored trust domains within a larger generalpurpose infrastructure. Develop software assurance solutions for virtualized radio access networking and for security of software-defined networking for the core network. Design analog and mixed-signal solutions at the wireless end points, where radio frequency components play critical roles, to assure secure and reliable autonomous transceiver reconfiguration, antenna beamforming, and dynamic spectrum utilization. • Develop technologies to sustain autonomous management of security across the communication infrastructure in ways that balance strength of security services with performance requirements of availability, latency, processing, and storage capacity. Develop data-centric security solutions based on the protection requirements of the data across all networking paradigms: cloud, fog, and edge computing. Devise privacy protection mechanisms that can be tailored to the location and role of a node in a combined sensing/communication/computing paradigm—from the sensor where raw data lack context, to more robust protections as the aggregation of data increases in volume and source diversity. • Develop end-to-end security and key management capabilities that will allow highly secure, highly resourced nodes to interoperate with resource-limited edge and IoT devices. This includes devising effective access control, authentication, cryptography, and key management techniques for limited-resource nodes. Develop technologies to attest and verify devices and systems at varying levels of computational capabilities. • As CPS systems (e.g., cars, medical devices, and utilities) scale in the number of devices they connect and the volume of data they process, develop approaches to assure that they remain resilient to adverse cyber activities. This includes developing accurate models of CPS environments to reduce vulnerabilities and mitigate the impacts of incidents and failures. Develop methods and technologies that will successfully integrate human decision-making with cybersecurity technologies and process control technologies. Advance formal methods to validate high-assurance, fault-tolerant, adaptive subsystems that can operate in contested and degraded conditions for long periods without human interaction. Privacy Privacy is a confluence of multiple values such as solitude, confidentiality, and autonomy that define an individual’s control of personal information, identity, or the boundaries of personal spaces. Privacy comprises a multitude of disciplines: ethics and philosophy, sociology and psychology, law and government, economics, and technology. Broad recommendations for R&D in privacy have been presented in the 2016 National Privacy Research Strategy.21 In the context of cybersecurity R&D, this Plan focuses primarily on privacy aspects that involve collection, disclosure, and use of an individual’s private information, including identity; patterns of behavior; and economic, social, or other discriminators. Confidentiality and integrity principles necessitate controls that limit unauthorized access, use, and disclosure of data. Security can be the mechanism by which privacy risk is prevented, reduced, or mitigated when the data or system to be secured implicates privacy interests and values. However, secure systems might be in tension with privacy, especially when considering the security principle of availability. This is manifested when users’ desires to control privacy-relevant data run up against the needs of system stakeholders to control that same data for authorization, attribution, and/or monitoring for situational awareness, 21 https://www.nitrd.gov/PUBS/NationalPrivacyResearchStrategy.pdf – 17 –