BAA-RQKS-2015-0008-Atch2.pdf

BAA-RQKS-2015-0008 Attachment 2

STATEMENT OF OBJECTIVES

TASK ORDER 0001

Avionics Software Protection Technologies 5-19-2015

1.0 BACKGROUND

The ability to protect avionics systems, associated Intelligence, Surveillance and Reconnaissance

(ISR) systems, as well as protect support and maintenance equipment that interface with those systems is essential to achieve mission assurance. Given the complexity and interconnectedness of these systems there are numerous attack vectors that need to be eliminated or mitigated. The goal of this task is to develop techniques and solutions that prevent the introduction of malware into the avionics system, deny access of malicious individuals/groups to critical avionics components, and develop solutions that “fight through” cyber-attacks in real-time during mission operations. Given the vast attack surface of avionics systems and the increasing use of commercial off-the-shelf

(COTS) parts with an unknown or untrusted pedigree, any solution that focuses exclusively on preventing malware from entering the avionics system boundary is unlikely to be fully effective. As a result, protection solutions that sense, learn, respond, and adapt to threats in real-time are essential to a defense-in-depth strategy. A further consideration is that detection mechanisms may not be completely effective in keeping malware out of the system or detecting its execution in real-time, particularly with regard to hardware-based malware. Cyber-resilient architectures that provide a means to ensure mission operations in the presence of the threat without the need for direct detection of the malware should be considered and investigated as part of the spectrum of potential protection solutions.

The goal of this research is to develop highly innovative solutions to meet the above requirements.

The following technical areas are of particular importance: (1) malware/exploit sensing and understanding tools that can operate both offline to prevent the introduction of malware into the avionics system and in real-time on-board the avionics system to “fight through” attacks in the event malware penetrates first-line defenses, (2) automated malware and exploit intent inferencing and reasoning tools to determine the adversaries overall strategy as well as specific tactics with regard to avionics cyber-attacks, (3) adaptable self-optimizing software and hardware systems that can autonomously self-protect to thwart never-before-seen attacks, (4) dynamic machine learning to incorporate information gathered from on-going attacks into the protection system to optimize attack responses and adapt to changing threats and circumstances, and (5) novel hardware architectures, designs, and implementations that can be dynamically reconfigured or instantiated in near real-time based upon cyber sensory information gathered both internally and externally to the air platform. In an ideal design, sensing, learning and adaptation should be tightly coupled and not independent characteristics of agents or algorithms serially executed. Revolutionary concepts in hardware design, including, but not limited to, neurologically-inspired processing and communication mechanisms, are sought to provide rapid cyber-attack pattern recognition and near-term cyber-attack prediction capability.

2.0 SCOPE

This Statement of Objectives (SOO) covers research and development of avionics cyber security protection against tampering, exploitation, reverse engineering, and piracy of critical software, firmware and data by nation-state adversaries. This task supports the following detailed objectives in the Basic SOO: (1) Automated Software Analysis and Assurance Techniques, (2) Real-time Cyber

Threat Detection and Response for Avionics Systems, (3) Dynamic Learning and Adaptation for

Avionics Protections, (4) Cyber-Resilient Avionics Systems, and (5) Test and Integration.

Innovative software-only and hardware-assisted protection solutions are sought to sense, learn, respond, and adapt to never-before-seen (0-day) malware and system exploitations. These attacks may occur via a compromised software and hardware supply chain, insider threat, and remote (wired or wireless) access. The ability to provide avionics mission assurance during a cyber-attack is the primary focus of this task.

3.0 OBJECTIVES

The objectives of this task are to research, develop, and demonstrate avionics protection solutions to provide mission assurance to the warfighter during a cyber-attack. Target platforms of interest include, but are not limited to, processors and operating systems associated with real-time embedded systems, ISR platforms associated with the avionics system that are used to support the mission, support and maintenance equipment used to transfer software and data to/from the avionics system, and mobile devices that interface to the avionics system. This effort will provide avionics platforms with the necessary protection mechanisms to thwart cyber-attacks targeting both legacy systems and future avionics platforms.

3.1 THREAT AND SUSCEPTIBILITY ANALYSIS

This portion of the avionics protections research involves studies and analysis to understand and assess the threat associated with avionics systems. This includes, but is not limited to, a study to understand both the adversaries’ overarching strategy and tactics that could potentially be used to compromise an avionics mission. This information can be obtained from intelligence reports and other sources, including real-time operational information. It is critical to understand known avionics susceptibilities and security flaws, the access paths to those susceptibilities/flaws, and the ability of the threat to exploit those flaws (including an understanding of their skills, available tools, resources, and their overall attack objective). These susceptibilities, flaws, and weaknesses can exist in software, firmware, hardware, or the interfaces between the various components. Close cooperation with the government is necessary to develop a comprehensive understanding of known attack vectors, postulate and theorize about never-before-seen attacks, and prioritize the likelihood of each attack vector based on our knowledge of the threat and projection of likely adversarial strategies.

3.2 PROTOTYPE DESIGN & DEVELOPMENT

The objective of this task is to identify and prioritize the protection solution options for each attack vector identified above and consider the security, cost, performance, and maintenance trade-offs associated with each option. Both near-term and long-term solutions are needed to address the spectrum of threat vectors. The flexibility of each solution to reduce impact and protect against unknown or unforeseen attacks (i.e., minimize surprise) should be a strong consideration in the analysis of alternatives. Exploration of applicability and leveraging of existing avionics security approaches, methodologies and solutions is expected. Factors other than technical (e.g., cost) may be part of this trade-space.

Given the wide-variety of target platforms and potential constraints/limitations on the part of the end-user, a number of different protection solutions are sought to address the threat. The threat includes supply chain attacks, insider physical access attacks, and remote (wired or wireless) attacks.

The following subtasks represent general categories of protection solutions that can be proposed independently or together:

3.2.1 Software-only Protection Solutions

The objective of this subtask is to research, develop, test, evaluate, and demonstrate software-only protection techniques and solutions that mitigate threats to avionics and ISR systems. Possible approaches include, but are not limited to, compile-time, kernel, hypervisor, and/or firmware-based protections. These solutions will provide a means to reduce susceptibilities, reduce access by the adversary to critical software and data, detect and intelligently respond and adapt to the threat, both offline and in real-time during mission operations. These solutions could utilize existing hardware features that are commercially available and already exist on the targeted platform (e.g., Intel VT-d), but not require the addition of custom hardware. These solutions will provide the end-user with deployable solutions that do not require additional hardware.

3.2.2 Hardware-assisted Protection Solutions

The objective of this subtask is to research, develop, test, evaluate, and demonstrate hardware-assisted protection techniques and solutions that mitigate threats to avionics and ISR systems.

Possible approaches include, but are not limited to, utilization of COTS hardware devices/boards

(e.g., Trusted Platform Modules), custom co-processor and/or Field Programmable Gate Array

(FPGA)-based devices/boards that can perform on-board software execution, critical data storage, monitoring/injection/disruption of host bus traffic and communication data links for the purposes of malware/exploit detection, and execution monitoring for enforcing control flow integrity. The purpose of these solutions is to prevent the malicious alteration, piracy, and reverse engineering of critical software and data that reside on avionics and/or ISR systems. Additional hardware will allow for more robust on-board security features with minimal impact on the performance of the host.

3.2.3 Next-Generation Protection Solutions

The objective of this subtask is to research and develop revolutionary concepts and prototype solutions that address the long-term requirements of the Air Force Research Laboratory (AFRL).

These requirements include, but are not limited to, the ability to (1) rapidly sense never-before-seen

(i.e., zero-day) threats in real-time or develop systems that are resilient to those threats; (2) perform online learning of novel threats and circumstances; and (3) adapt protections (both software and hardware based) to threats in real-time. The ultimate goal is to integrate these solutions with more near-to-midterm solutions developed in paragraphs 3.2.1-3.2.2.

3.2.4. Integration of Software and Hardware-assisted Protections

The objective of this subtask is to integrate protection techniques and solutions (developed under paragraphs 3.2.1-3.2.3) into AFRL’s facilities; test, evaluate, and demonstrate the solutions to address different threat vectors to achieve an optimal protection solution for a given use-case.

Additionally, developed solutions may be targeted to other platforms and systems of interest to

AFRL.

Furthermore, this research involves working closely with the government to develop long-term strategic roadmaps and schedules for the chosen protection solution(s), to include associated near-term deliverables of technical reports, periodic prototype solutions and other milestones that demonstrate progress toward the end-goal.

3.3 TECHNOLOGY ASSESSMENT

The objective of this task is to test developed protection solutions, document and report the results of those tests to meet the threat mitigation objectives described above. As required, this task may involve support for the validation, verification, and security assessment of the protection solution by a government organization or independent Department of Defense (DoD) contractor who specializes in vulnerability assessments (in this eventuality, non-disclosure agreements between the respective organizations will be signed). Special test equipment may be required to perform security assessment of protection solutions.

4.0 PERIOD OF PERFORMANCE: The period of performance for this task order (TO) will not exceed 39 months, consisting of 36 months for the technical effort and 3 months for the final report.

5.0 FUNDING PROFILE:

Fiscal Year FY15 FY16 FY17 FY18 TOTAL

3600 funds $100K $2100K $2100K $1500K $5800K

6.0 REPORTING REQUIREMENTS AND DELIVERABLES: All data items: A001 through

A011 for TO 0001 effort will be required. The contractor may propose additional deliverables as appropriate to the TO.

Contract Data Requirements List (CDRL):

CDRL

Data Item

Description Delivery Schedule

A001 DI-MISC-80711A/T, Scientific and Technical Reports, Final Report

End of Tech Effort

A002 DI-FNCL-80912/T, Performance and Cost Report Monthly A003 DI-FNCL-80331A/T, Funds and Man-Hour Expenditure Report Monthly A004 DI-MISC-80711A/T Spend Plan Monthly A005 DI-MGMT-81468/T, Contract Funds Status Report (CFSR) Quarterly A006 DI-MGMT-80368A/T, Status Report Monthly A007 DI-ADMN-81373/T, Presentation Material As Required A008 DI-IPSC-81488A/T, Source Code 1 Time A009 DI-MGMT-80507C/T, Project Planning Chart As Generated A010 DI-IPSC-81443A/T, Software User Manual End of Tech Effort A011 DI-MISC-80711A/T Hardware User Manual End of Tech Effort

In addition, software (firmware, libraries, executables, and related software for project implementation) and hardware (items such as specially modified equipment) should be delivered under this TO.

7.0 BASE SUPPORT: The Avionics Vulnerability Assessment, Mitigations and Protections

(AVAMP) Laboratory is available to the contractor for on-site research. These facilities are state-of-the-art and provide the infrastructure needed to meet government requirements. It consists of space in Building 620, Sensors Directorate, Area B, Wright-Patterson AFB OH.

8.0 GOVERNMENT FURNISHED PROPERTY (GFP): Contractor should identify any GFP needed to perform the research.

9.0 CONTRACTOR ACQUIRED PROPERTY (CAP): Contractor should identify any CAP needed to perform the research.

10.0 SECURITY CLASSIFICATION: Top Secret / Special Compartmented Information (TS/SCI) and Special Access Programs. See DD Form 254.

11.0 EXPORT CONTROL: The contractor will be required to generate or require access to export-controlled items.

12.0 OPERATIONAL SECURITY (OPSEC): General OPSEC procedures, policies and awareness are required in an effort to reduce program vulnerability from successful adversary collection and exploitation of critical information. OPSEC will be applied throughout the lifecycle of the contract. The Critical Information List will be provided upon request by the AFRL Sensors

Directorate Information Protection and Intelligence Office. While working on the government installation, OPSEC will be provided by the AFRL Sensors Directorate Information Protection and

Intelligence Office.

13.0 SAFETY: The contractor must comply with all federal, state, and local safety and environmental regulations.

Requires an approved Safety Plan IAW AFI 91-202 AFRL Supplement 1 before any experiment may be conducted. The contractor must comply with all Air Force safety and environmental regulations.

The contractor must comply with system safety requirements contained in MIL-STD 882D, Section

4 “General Requirements,” for any deliverable systems or hardware. The contractor must identify safety-critical components of those systems or hardware, and software interfaces with those components. Must test and verify the safety-critical hardware and software for safety acceptance.