(CUI) BA Inc2 RFI2 v2_22AUG2024.docx

(U) United States Air Force BlackArrow Increment 2 Request for Information (RFI) #2

(U) Version 1.0 August 2024 Prepared by:

Cryptologic and Cyber Systems Division

(AFLCMC/HNCA)

250 Hall Blvd., Suite 122 Joint Base San Antonio-Lackland, TX 78243k

DISTRIBUTION STATEMENT F: Further dissemination only as directed by AFLCMC/HNCAM (August 2024) or higher DoD authority.

WARNING: This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C. Sec 2751 et seq.) or the Export Administration Act of 1979, as amended (Title 50 U.S.C. App. 2401 et seq.). Violations of these export-control laws are subject to severe criminal penalties. Dissemination of this document is controlled under DoD Directive 5230.25.

DESTRUCTION NOTICE: Destroy by any method that will prevent disclosure of contents or reconstruction of the document.

Controlled by: AFLCMC HNCAM CUI Category: OPSEC Distribution/Limited Dissemination Control: FEDCON

CONTROLLED UNCLASSIFIED INFORMATION

POC: Dan Garber, AFLCMC/HNCAM

THIS PAGE IS INTENTIONALLY BLANK

Contents

1. (U) Scope/Introduction

1.1. (U) Program Background

1.2. (U) CM2

1.3. (U) BlackArrow Capabilities

2. (U) Request for Information

2.1. (U) General

2.2. (U) Information Requests

3. (U) Submissions

List of Figures

Figure 1: (U) CM2 ICD Requirement Gaps Figure 2: (U) BlackArrow Operational View (OV-1) Figure 3: (U) BlackArrow System Architecture

List of Tables

Table 1: (U) Information Requests Table 2: (U) Acronyms

THIS PAGE IS INTENTIONALLY BLANK

CONTROLLED UNCLASSIFIED INFORMATION

1. (U) Scope/Introduction

1.1 (U) Program Background (CUI) The current Remote Re-Key (RRK) system is being modernized in accordance with the National Security Agency (NSA) Cryptographic Modernization 2 (CM2) Initial Capabilities Document (ICD) requirements. The Remote Re-Key NexGen (hereinafter referred to as “BlackArrow”) system is being developed as a modernization for the currently operating RRK system. The Air Force is in the development phase for BlackArrow.

(U) The RRK system is an NSA Type 1 key distribution and key management system that supports the North American Aerospace Defense Command (NORAD) Tactical Air Defense mission as well as the Federal Aviation Administration air traffic control mission. RRK delivers National Security Agency cryptographic key material to End Cryptographic Units (ECUs) such as the KIV-77 (IFF Mode 5) when it is deployed to the Air Defense Sectors (ADS)—Eastern, Western, Hawaiian and Alaskan ADS—and their associated Long Range Radar sites. The CI-13 remote rekey legacy system that was deployed to NORAD sites in 1995 was replaced by the RRK system. RRK is also used to deliver key material and remotely rekey end cryptographic units at the Alaskan (Alaska Air Combat Maneuvering Instrumentation), Nellis Air Force Base (AFB) (Nevada Test and Training Range), and Hill AFB (Utah test and Training Range). Features of the RRK system also allow network control, ECU device control and status reporting.

(CUI) The RRK system and BlackArrow provide the following capabilities:

· (CUI) Remote ECU configuration, control, and monitoring

· (CUI) Black and Red Key Management (load, store, and distribute)

· (CUI) Centralized RRK network configuration and status monitoring

· (CUI) Communication Set subsystem configuration and management

· (CUI) RRK network and component diagnostics and trouble shooting

· (CUI) Role Based Access Control (RBAC) and Identity and Authentication (I&A) management

· (CUI) Intrusion Detection System/Attack, Sensing, Warning, and Response system security monitoring and management

· (CUI) Audit data collection and reporting for security related events

· (CUI) Event data collection and reporting for non-security related events

(CUI) BlackArrow will be given consideration as a remote re-key solution for not just the ADS, but also as a solution to remotely re-key autonomous unmanned craft from other military branches.

1.2. (U) CM2

(CUI) The NSA CM2 ICD identifies six major gap categories, which contain 42 total gaps. BlackArrow will address the 42 gaps as applicable.

(CUI) These 6 gap categories contain 42 total gaps to be addressed by BlackArrow.

Figure 1: (U) CM2 ICD Requirement Gaps

1.3. (U) BlackArrow Capabilities

(CUI) BlackArrow will adhere to Modular Open Systems Architecture (MOSA)/Sensors Open Systems Architecture (SOSA) initiatives and provide the following capabilities:

· (CUI) Remote ECU configuration, control, and monitoring

· (CUI) Remotely reprogram Trust Anchors (TA)

· (CUI) Key Management (load, store, and distribute)

· (CUI) Red Key Encryption Key (KEK)/Black Traffic Encryption Key (TEK) Key Transfer

· (CUI) Support for future Over The Network Keying (OTNK) capabilities

· (CUI) Key Management Infrastructure (KMI) Aware Product Distribution Enclave (PDE) Enabled

· (CUI) Centralized BlackArrow network configuration and status monitoring

· (CUI) Communication Set subsystem configuration and management

· (CUI) BlackArrow network and component diagnostics and trouble shooting

· (CUI) RBAC and I&A management

· (CUI) Intrusion Detection System/Attack, Sensing, Warning, and Response system security monitoring and management

· (CUI) Audit data collection and reporting for security related events

· (CUI) Event data collection and reporting for non-security related events

· (CUI) Open-systems approach, maintaining the ability to upgrade or exchange subsystems in the future to address new requirements and use cases.

Figure 2: (U) BlackArrow Operational View (OV-1)

Figure 3: (U) BlackArrow System Architecture

2. (U) Request for Information

2.1. (U) General (CUI) Cryptologic and Cyber Systems Division (CCSD) and BlackArrow have divided the effort into two increments. This RFI is specific to Increment 2 of BlackArrow, as the BlackArrow system – Increment 1 is currently in development phase.

(CUI) Increment 1 (platform/hardware-focused)

· KMI Aware (registered, initialized, endorsed)

· Schedule and Automate Remote Key Fill

· FMS Releasable (upon certification)

· MOSA/SOSA Compliant

· Support for future Over The Network Key (OTNK) capabilities

(CUI) Increment 2 (software-focused)

· Build upon the foundational system by developing and implementing a Cloud Application to enhance and replace the existing Operator Workstation’s capabilities

· Leverage existing Cloud Service Providers to:

· Provide a Distributed Edge Cloud environment for the Cloud App

· Implement a Parent-Child relationship with automatic failover between the Core Cloud and Edge Cloud deployments of the Cloud App

· Ensure the Security and Management of the underlying Infrastructure

· Leverage existing DevSecOps Software Factories to:

· Enable rapid development of continuous updates and improvements to the Cloud App

· Provide well-defined processes in order to gain near immediate Certificate to Field (CTF)

· Provide integrated Hardware in the Loop (HWIL) testing environments to ensure compatibility with Existing Hardware

· The Cloud App will be expected to improve upon the Operator Workstation in multiple ways, including:

· Converging data flows into “single pane of glass” GUI for BlackArrow operators

· Use extrapolation techniques on collected data sources (telemetry, logs) to supply operators with more relevant information

· Adopt Next Gen HAIPE management specifications

· Enhanced support for future Over The Network Key (OTNK) capabilities

· Provide a platform for management of more types of cryptographic devices as they are developed

(CUI) As the BlackArrow design matures in each increment, CCSD would like to increase the variety of Platforms (NEW, Pocket J, LAK etc.) that BlackArrow can support. Thus, an open systems approach (MOSA/SOSA), which minimizes the system boundary while maximizing the connectable systems, is necessary to avoid over-constraining the design. The BlackArrow software capabilities provided in Increment 2 will permit continuous maturation of the software, allowing the ecosystem to grow, expand, adjust, and forge the way for the long-term evolution of the program.

2.2. (U) Information Requests

(U) Please respond to the information requests outlined in Table 1.

Table 1: (U) Information Requests

(CUI)

3. (U) Submissions

(U) Responses are to be 8.5 X 11 inch, single-sided pages, 10 pages maximum. Contractors who submit information for review do so with the understanding that U.S. Government personnel as well as support contractors will review their material and data. Respondents will not be contacted regarding their submission or information gathered as a result of this notice nor the outcome of the Government's review of the solicited information unless the Government desires further information. Submitted information packages will be retained by the Government and not returned to the contractor.

(U) All interested, capable and responsible sources that wish to respond to this RFI are required to electronically supply their responses (.doc or .pdf format) in the order and format in which they are presented, to brooke.carpino@us.af.mil and ethan.hardin@us.af.mil, no later than 0900 hrs CDT, 9 September 2024. "Black Arrow Increment 2 RFI #2 Response" must be included in the subject line. Telephonic responses will not be accepted. Electronic media can be mailed to:

Cryptologic Systems Division Contracting Division/AFLCMC/HNCKA (Attn: Brooke Carpino) 130 Norton St, San Antonio, TX 78226-1810

Contracting Officer: Brooke Carpino, brooke.carpino@us.af.mil Contracting Specialist: Ethan Hardin, ethan.hardin@us.af.mil

Table 2: (U) Acronyms

Interoperability

Flexible and Robust Security

Sustainability

Operational Management

Key Management

Standardization

(U) The ability of systems to provide information services to, and accept information services from, other systems.

(U) The ability to provide security for crypto systems and equipment through assured control of NSS networks with the aim of countering modern threats such a CRQC.

(U) The ability to ensure crypto systems meet the operational mission needs of protected systems.

(U) The ability to provide secure situational awareness, oversight, planning, management, and control of cryptographic solutions to enable access to those resources by authorized users

(U) The ability to provide and accept electronic key management services to and from NSA/CSS-approved public key or key management infrastructures.

(U) The ability to use standardized cryptographic form factors, human-machine interfaces and machine-to-machine interfaces across multiple vendors image1.png image14.png image15.png image2.png image11.svg image12.png image13.svg image3.svg image4.png image5.svg image6.png image7.svg image8.png image9.svg image10.png