SVIP_Blockchain_Industry_Day_Slides_12_11_18.pdf

WELCOME

INDUSTRY DAY | Blockchain and DLT Call

Silicon Valley Innovation Program December 11, 2018

Attending Remotely?

Use #AskSciTechSVIP to ask questions!

Agenda

• Welcome and Introductions

• Silicon Valley Innovation Program Overview

• Preventing Forgery & Counterfeiting of Certificates and Licenses Use Case(s) Panel

• Technical Overview and Q&A

• Intellectual Property (IP) Overview

• Program and Intellectual Property Q&A

• Wrap Up – Interested? How to Apply?

• OPTIONAL Office Hour

SVIP Overview by

Melissa Oh Managing Director, SVIP

SVIP Team

Angela Carter Mike Reagan CJ Penso Contractor Support

Melissa Oh Managing Director

West Coast

Jennifer Mekis Contractor Support

East Coast

Doug Maughan Senior Executive

Anil John Technical Director

Ron McNeal Transition Manager

Not Pictured: Chi Hickey, Sheryl Rakestraw

What We Do

To keep pace with the innovation community and tackle the hardest problems faced by DHS’s operational missions, we:

EDUCATE

Help investors and entrepreneurs understand DHS’s hard problems

FUND

Provide accelerated non-dilutive funding (up to $800K US) for product development to address DHS’s needs

TEST

Provide test environments and pilot opportunities

• Leverage early stage startup tech receiving accelerator/seed/angel investments (generally through Series B)

• Intersection of commercial investment and DHS/HSE application

• DHS funds product development – dual-use features applicable to homeland security

• Do NOT want startups trying to pivot;

must be able to maintain commercial roadmap

• Not taking equity, not taking IP (except in form of technical data/reports)

How We Partner

How We Fund

Performance-based funding steps

Phase 1 $50-200K 3-6 months Proof of concept demo

Phase 2 $50-200K 3-6 months Demo pilot-ready prototype

Phase 3 $50-200K 3-6 months Pilot test prototype in operations

Phase 4 $50-200K 3-6 months Test in various operational scenarios

Potential for $800K; Up to 24 months

• Topic “Calls” released and open for 6 - 12 months describe problem set

• 10-page Applications reviewed monthly or quarterly, topic-dependent

• If invited to pitch (15 mins oral), funding decision made within 24 hours

Decision >>> ~45 Days >>> Award

Equity-Free This is a performance-based award. Up to $800K available for every company.

Mentorship Learn from the best. We have a deep bench of government and private sector partners who can offer guidance and introductions.

Network Instant access to DHS public private partnerships and the greater homeland security enterprise, a $544B marketplace.

Amplify Your Reach Demo your product to government, industry and investors from across the world.

Market Validation Find market fit through prototype testing and pilot opportunities.

Follow-On Funding Our alumni have received follow-on funding by venture capital investors.

Value Proposition to Startups

K9 Wearables

Big Data

Drones/sUAS

Fintech Cybersecurity

First Responder Tech

Identity and Anti-Spoofing

Our Current Portfolio

Seamless Travel

Aviation SecurityInternet of Things Security

Blockchain

Successful Transitions

Funded Topics

Phase I Pitches

Phase IV Awards

$13M+ Awarded Funding

Startups Funded

370+ Phase I

Applications

What We Have Done

Future SVIP Calls?

Learn About Future SVIP Calls (Funding Opportunities)

Request to be Added to our low-volume Notification List by emailing DHS-Silicon-Valley@hq.dhs.gov https://www.dhs.gov/science-and-technology/svip mailto:DHS-Silicon-Valley@hq.dhs.gov

Use Case(s) Panel

Use Case(s) Panel

• Moderator

• Anil John Technical Director, SVIP

• U.S. Customs and Border Protection

• Vincent Annunziato

Office of Trade

• Transportation Security Administration

• Ted Sobel

Requirements and Capabilities Analysis

• U.S. Citizenship and Immigration Services

• Jared Goodwin

Office of Intake and Document Production

Setting the Stage

• DHS Operational Components (CBP, TSA, USCIS) have different missions; As such their Use Cases and Needs are different

• Current Use Cases span Identity for Travel, Citizenship and Immigration Status, Employment Eligibility, Organizational Identity and Supply Chain Security

• Operational Components here today are both Issuers of Credentials (USCIS) and Validators and Verifiers of Credentials (CBP, TSA)

• Current credentials are paper-based and are susceptible to loss, destruction, forgery, and counterfeiting.

• Common needs for digital credentials that are highly secure, interoperable, and which prevent forgery & counterfeiting

USCIS administers the nation’s lawful immigration system and is responsible for the issuance of documentary evidence of citizenship, immigration, and employment authorization. The application of technologies sought in this topic call could potentially enhance those capabilities by enabling digital representations of those documents that:

• Provide identity protections that allow for disclosure of information under the control of the owner of the credential

• Provide the ability to remotely mange the lifecycle of the credential (electronic document)

• Integrate with the current secure issuance processes

Citizenship, Immigration & Employment Authorization

TSA has a responsibility to confirm the identity of each passenger at the TSA security checkpoint and ensure that the identity presented on the digital document matches the identity associated on a confirmed travel reservation […] TSA is moving towards electronic authentication capabilities to strengthen this process in support of TSOs. The application of technologies sought in the topic call could potentially enhance the TSA capabilities to

• Prove the authenticity and provenance of identity documentation at speed

• Ensure that the digital document has counter-fraud protections

• Direct Passengers to certain screening lanes by applicable risk-based screening protocol (e.g., trusted traveler program participant, standard traveler, etc.)

Identity Documents for Travel

Tribal jurisdictions within the United States have the authority to issue identity documents that TSA may accept for domestic air travel and USCIS may for other uses […] TSA and USCIS have an interest in how the technical implementation of a tribal identity document using the technologies sought in this call could meet the following technical criteria:

• The digital document has counter-fraud protections that are equivalent to the security protections required of physical documents.

• The digital document allows the reliant party to distinguish among tribal documents based on pre-determined criteria (e.g., Federal recognition of the tribe, issuance practices, etc.).

• The implementation has the ability to integrate with the current issuance and validation processes

Tribal Identity Documents for Travel

CBP and other DHS Operational Components have various responsibilities regarding supply chain security and intellectual property rights enforcement. These needs require knowing the identity of organizations that are part of a supply chain and understanding who has been delegated to perform a particular function on behalf of an organization. The application of technologies sought in the topic call could potentially enhance the capabilities available to DHS to ensure the ability to:

• Validate the identity of an Organization

• Validate affiliation of a person to a legitimate Organization

• Ensure that the delegated entity is the actual Person performing the actions on behalf of the Organization

Identity of Organizations & Organizational Delegates

Crude oil and oil products crossing the US-Canadian border rely on estimation of pipeline flows for admission and charging of appropriate duties. The same pipeline may be used for different types of oil, with different duties. Additionally, oil imported to Canada may be comingled with Canadian oil for export. The current process for capturing this transaction flow is manual and complex. The application of technologies sought in the topic call could potentially enhance the CBP capabilities to accurate admit oil under USMCA and apply appropriate duties by:

• Accurately tracking the evidence of the flow of oil through pipeline and refinement between the US and Canada

• Attribute oil imports with the accurate composition and country of origin

Cross-Border Oil Import Tracking

CBP relies on country of origin data from importer documentation. Validating the point of origin for raw materials (ex. timber, diamonds, and precious metals) by CBP requires costly inspection and cannot be implemented at scale. Transit through a nation with a preferential trade agreement could be used to confound the true country of origin, resulting in lost duty revenue and support of illicit activities. The application of technologies sought in the topic call could potentially enhance the CBP capabilities to:

• Track the documentary evidence of the flow of raw materials from the point of extraction

• Enable the application of appropriate duties

• Ensure goods imported to the United States do not come from force labor or fund criminal or terrorist organizations

Origin of Raw Material Imports

Technical Overview by

Anil John Technical Director, SVIP

• Confidentiality, Integrity, Availability …

• Pseudonymous Operations, Selective Disclosure …

Security and Privacy

• Data Sharing Implications, On Chain vs. Off-Chain

• Storage of Information vs.

Validation of Information

Integration Approaches &

Gain/Pain

• Anonymous Currencies

• Anonymous Networks

Digital Currency Forensics

Investments via S&T R&D Programs

• Celerity Government Solutions, LLC

• Digital Bazaar, Inc.

• Narf Industries, LLC

• Respect Network Corporation > Evernym, Inc.

• SecureKey Technologies, Inc.

Investments via S&T Silicon Valley Innovation Program

• Factom, Inc.

3+ Years Ago – Is Blockchain Relevant to DHS?

Lessons Learned …

• Architecture and design cannot be hand-waved away (but often is in the race for market share!)

• There is no one-size-fits-all ledger data format, and standards for how to create the “data payload” that is written to a ledger are critical to interoperability across Blockchain implementations

• Distributed key management is not a solved problem, but needs to be for scalable deployment

• Immutability of records combined with encryption as a privacy tool is gated by the reality that encryption has a time to live which will eventually run out; this has real privacy and design implications

AND MORE …

Decentralized Identifiers

• Globally Unique Identifier without the need for a central registration authority

• Immutable

• Resolvable

• Cryptographically Verifiable

• Path to Standardization via W3C

Verifiable Credentials

• Data Interoperability across issuers holders and verifiers

• Standardization of data formats

• Standardization of digital signature schemes

• Digital version of physical credentials/attestations

• Driver’s Licenses

• Passports

• Training Certificates

• Educational Certificates

• More …

• Path to Standardization via W3C

Championing Globally Interoperable Specifications

Multi-Party Distributed Key Management

• Tackling the hard challenge of distributed key management

• Provisioning

• Revocation

• Re-Issuance

• Based on NIST Special Publication 800-130: A Framework for Cryptographic Key Management Systems

• Path to Standardization TBD

Interoperability Standards and U.S. Customs

Interoperability Guidance (2.1) As such, this call will require any proposed solution to incorporate the lessons learned from DHS investments in R&D, specifications/standards, and proof-of-concepts that has resulted in our support for existing and emerging standards-based protocols, data exchange formats and security policy frameworks to ensure interoperable integration with enterprise systems.

The International Organization for Standardization (ISO) uses specific verbal forms to convey clarity on what is a requirement and what is a recommendation or other type of statement.

This Topic Call adopts and uses the following ISO document conventions:

• Requirements - SHALL, SHALL NOT

• Recommendations - SHOULD, SHOULD NOT

• Permission - MAY, MAY NOT

• Possibility and Capability - CAN, CANNOT

Scope of Work (2.2)

Issuer Verifier Holder

Credential

Blockchain / DLT

Register Proof of Credential Integrity & Provenance

{ API }

Issue Credential

{ API }

Validate Credential Integrity & Provenance

{ API }

Present Credential > < Verify Ownership

{ API }

Three Technical Topic Areas (TTAs)

DHS is seeking technologies and solutions that address this need via one or more of the following TTAs.

While DHS is interested in meeting the goals of all the TTAs, we want to make it clear that is not a requirement and as such you are encouraged to apply even if your prototype project meets only one TTA:

1. Issuance and Verification of Certificates, Licenses and Attestations

2. Storage and Management of Certificates, Licenses and Attestations

3. Decentralized and Derived PIV Credentials

TTA #1 Issuance and Verification … (3.1)

Issuer Verifier Holder

Credential

Register Proof of Credential Integrity & Provenance

{ API }

Issue Credential

{ API }

Validate Credential Integrity & Provenance

{ API }

Present Credential > < Verify Ownership

Blockchain / DLT

TTA #2 Storage and Management … (3.2)

Issuer Verifier Holder

Credential

Blockchain / DLT

Register Proof of Credential Integrity & Provenance

{ API }

Issue Credential

{ API }

Validate Credential Integrity & Provenance

{ API }

Present Credential >

TTA #3 Decentralized & Derived PIV … (3.3)

Issuer Verifier Holder

Credential

Blockchain / DLT

Register Proof of Credential Integrity & Provenance

{ API }

Issue Credential

{ API }

Validate Credential Integrity & Provenance

{ API }

Present Credential >

The SHALLs Applicable to ALL the TTAs …

• All APIs that are presented to the Issuer and the Verifier SHALL be publicly documented, patent free, royalty free, non-discriminatory, available to all, and free to implement using widely available and supported programming languages.

• The solution SHALL incorporate, if appropriate to the particular use case, the following emerging and/or mature specifications for interoperability that have been funded, tested and/or championed by DHS:

• Decentralized Identifiers (Standards Development Organization - World Wide Web

Consortium / W3C)

• Verifiable Credentials (Standards Development Organization - W3C)

• JavaScript Object Notation for Linked Data / JSON-LD (Standards Development

Organization - W3C)

The SHALLs Applicable to ALL the TTAs …

• The Holder SHALL have control over and be accountable for the release of their data (credentials) to the Verifier

• The solution SHALL provide very high resistance to data deletion, modification, masking or tampering e.g. Show equivalency or better between the digital solution and physical security features currently required official licenses and certificates.

• The solution SHALL NOT have a dependency on a single Blockchain or DLT implementation.

• The Identity Verification component i.e. Present Credential / Verify Ownership aspect in the graphic above, SHALL use standardized, strong authentication technologies (e.g. FIDO, OIDC etc.) that is at least Authenticator Assurance Level 2 (AAL2) compliant as documented in NIST Special Publication 800-63 Revision 3 (or later).

The SHOULDs Applicable to ALL the TTAs …

• The Holder SHOULD have the ability to selectively disclose credential information with consent

• The solution SHOULD support online and offline presentation of Credentials to the Verifier

• The solution SHOULD support non-Certificate Revocation List (Non-CRL) based revocation methods (Issuer initiated, Person Initiated, Multi-Sig based and others) that removes Issuer dependencies i.e. “Phone Home Problem”.

• The solution SHOULD support Federal Information Processing Standard (FIPS) compliant cryptographic algorithms for hashing, encryption, digital signatures, random number generation and any other relevant cryptographic operations that are performed as part of the solution.

Objectives for Phase I (4.0) Minimum Viable Product that demonstrates proof-of-concept and supporting documentation inclusive of verifiable test evidence, technical drawings, software or other proof that the technical approach is sound.

Objectives of this phase are to:

• Validate the proposed architecture and design to incorporate interoperability specifications

• Validate digital security criteria equivalency to existing paper based security features.

• Evaluate the design of the APIs

• Articulate a go-to-market commercialization strategy

Phase II

A working prototype with clearly documented APIs, integrated with a multi-factor authentication mechanism that can be reviewed and evaluated.

Objectives of this phase are:

Phase III

Production ready prototype able to demonstrate all features and functions of the technology and can be tested in realistic deployment environment with an existing issuer and validator infrastructure.

Objectives of this phase are:

Objectives for Phase II - IV (4.0)

Phase IV

At this phase, technologies would be fully completed.

Designs provide all proposed features and functionality.

Objectives of this phase are:

Intellectual Property Overview by Sheryl Rakestraw

DHS Office of the General Counsel

What DHS wants:

• To find innovative companies to help solve challenging homeland security (HS) technological use cases

• To lower the barrier of entry for non-traditional companies that may already have viable HS technologies

• To match viable HS technologies with a specific DHS or government customer base

What DHS does NOT want:

• Your core Intellectual Property (IP)

• All of your proprietary information

• To scare off your future investors by tying up your IP

• To impede future commercialization of your product(s) or acquisition of your business

OT Agreement & Information Access by Parties

•Confidential Agreement

•Intellectual Property

•Sale of Your Business or Business Line

Exchange & Handling of Confidential Information

• Limit disclosure of Confidential Information to the amount necessary to carry out work under this Agreement

• Confidentiality or proprietary notices must be prominently placed for all such information

• Each Party agrees to use reasonable efforts to maintain the confidentiality of Confidential Information

• The obligation to maintain confidentiality expires when the information is no longer deemed Confidential Information

Protecting Your Intellectual Property

•We want to protect your core IP

•We don’t want to infringe third party IP rights

• In the process of working with DHS, you may share/create several different types of protectable IP, such as:

• Trade Secret Information/Data

• Copyrighted material

• Inventions and/or patented technology

IP Architecture

• We want to know what you’re bringing to the table

• DHS understands that applications often involve systems, projects, and software previously developed by applicants, whether at private expense or funded through other contracts. If it relates to the proposed project, applicants should diagram what they’ve previously created and what they’re proposing to create under this effort

For instance, if an applicant proposes to create a software module prototype specific to DHS’ needs, the applicant could show that the base software package that was previously developed at the applicant’s expense.

It may also show that software libraries used in that base software package are subject to open source software licenses, like BSD or GPL. And it may show that the DHS-specific module/prototype is delivered under this agreement and subject to terms and conditions negotiated in this agreement.

IP Rights

• You retain Ownership of all IP you bring to the project

• You gain Ownership of all IP created under the OT Agreement

DHS requires all Data to be marked, as is feasible, to ensure appropriate handling

IP License

By submitting the project deliverables, OT Recipient grants to DHS the following:

1. A paid-up, non-exclusive, irrevocable, royalty-free, worldwide license to use, reproduce, distribute, sublicense, and create derivative works of any reports provided to DHS, its partners, and those working on its behalf.

2. Reasonable assistance and additional information concerning Work Product/Milestones/Deliverables during the period of performance and up to 3 years after the end of the period of performance.

IP License

In the case where the OT Recipient is demonstrating or otherwise sharing work product, related materials, and know how in connection with the Agreement (including for testing by DHS as may be described in the Statement of Work), OT Recipient grants to DHS the following during the period of performance or as otherwise stated in the Agreement:

• A nonexclusive, nontransferable, irrevocable, paid-up license to use or practice all work product and related materials by or on behalf of the Government as described in the Statement of Work or as otherwise agreed to in the Agreement

Deliverables

• The “Deliverables” are the information, items, and materials (Data) that are specified in the OT Agreement for delivery to the Government

•Please DO NOT deliver to the Government any proprietary information, item, or material not specified in the OT Agreement.

Event: Acquisition of your business or business line

• The Government wants sixty (60) days notice prior to an acquisition of the entirety of your business or the business line which is responsible for performance of the OT Agreement

• You must provide information about the specified Deliverables in the OT Agreement and how the Government’s IP in such Deliverables will be protected

• No specific action is required other than the above

How To Apply

• DHS Operational Components (CBP, TSA, USCIS etc.) need to issue, validate and verify entitlements, attestations and certificates

• Travel

• Citizenship and Immigration Status

• Employment Eligibility

• More …

• Current issuance processes are paper based, non-interoperable and susceptible to loss, destruction, forgery, and counterfeiting

• Seeking digital solutions for:

• Issuance, Validation and Verification of

Certificates, Licenses and Attestations

• Storage and Management of Certificates, Licenses and Attestations

• Consolidating Decentralized and Derived PIV

Credentials

Open Call – Blockchain (CBP, TSA & USCIS)

Preventing Forgery & Counterfeiting of Certificates and Licenses

SVIP Call # 70RSAT19R00000002 Application Deadline (1st): 11 Jan, 2019 https://go.usa.gov/xPGsr https://go.usa.gov/xPGsr

How Startups Apply to our Program

• Review the topic call and decide whether your solution applies

• Submit application via email using provided application form (available under each call on fbo.gov) DHS-Silicon-Valley@hq.dhs.gov

• If application is selected, (1) Prepare 15 minute oral pitch (via Adobe Connect)

(2) Register in sam.gov; this is how we can pay you

• If selected for funding, notified same day and Awards will contact you

• Award timeframe estimate is 45 days from date of notification

54https://www.dhs.gov/science-and-technology/svip mailto:DHS-Silicon-Valley@hq.dhs.gov

Am I Eligible to Apply?

55https://www.dhs.gov/science-and-technology/svip

• Your company has a DUNS number

• Your company as less than 200 employees

• You have not been a party to any US Federal Acquisition Regulation (FAR) based contracts and/or federally awarded grants totaling more than $1,000,000 in the past 12 months, whether as a prime contractor or subcontractor. This total includes SBIRs.

• You do not have any Cost Accounting Standards Contracts with the US Federal government

Silicon Valley Innovation Program

DHS-Silicon-Valley@hq.dhs.gov https://www.dhs.gov/science-and-technology/svip