EGS_Cloud_Solutions_RFI.pdf

Page | 1

Cloud-based Application Delivery Controller/Application Traffic Management (ADC/ATM) and API gateway as-a-Service Market Research

Introduction The U.S. Patent and Trademark Office (USPTO) is launching the Cloud-based Application Delivery Controller/Application Traffic Management (ADC/ATM) and API gateway as-a-service Market Research effort as an opportunity to engage Industry technology companies in an intentional, innovative, and insightful way. The USPTO is at the cutting edge of the nation's technological progress and achievement and information technology underpins every action and workflow process within the USPTO. An important component of the USPTO agenda is leveraging information technology to improve and enhance granting U.S. patents and registering trademarks, enable the USPTO to maintain current business production, and meet legislative and legal requirements.

NOTE: Industry engagement/responses shall not contain ANY proprietary or Trade Secret information in response to this market research request. Assume all information provided will be used and discussed with other industry partners and public, and additionally, may be used in refining the Agency's requirements or future market research efforts. This is not a request for proposals.

Cloud-based Application Delivery Controller/Application Traffic Management (ADC/ATM) and API gateway as-a-service is an emerging discipline in enterprise operations. Cloud-based Application Delivery Controller/Application Traffic Management and API gateway as-a-service will offer the enterprise near real-time awareness of incoming external traffic as well as inter-cloud traffic in our hybrid cloud model. USPTO is conducting market research for Cloud-based Application Delivery Controller/Application Traffic Management and API gateway services that are conformant with FedRAMP (Moderate) and FISMA.

Overview

1. The USPTO is seeking information from potential vendors who can provide solutions that meet or exceed the capabilities, offerings, and suitability as listed below in Table (1) and Table (2).

Objective

1. To gather detailed information about available cloud-based services for Application Delivery

Controller/Application Traffic Management.

2. To understand the features and functionalities of cloud-based API gateway solutions.

3. To understand the pricing models, implementation strategies, scalability options and support services offered by potential vendors.

4. To evaluate the feasibility of migration to a cloud-based solution in terms of cost, time and technical requirements.

5. To identify potential technical challenges, migration challenges and mitigation strategies.

6. To evaluate vendor expertise in deploying and managing such solutions.

Scope of Information Requested

1. Solution Overview:

a) Provide a comprehensive description of your cloud-based traffic management solution, including core features, architecture, and integration capabilities with existing systems.

b) Describe your cloud-based API gateway solution.

c) Explain how your solution adapts to changing workload.

d) Highlight key features, including authentication, rate limiting, caching and monitoring.

Page | 2

2. Scalability and High Availability:

a) Describe how does your solution handles scalability requirements.

b) What mechanism ensure high availability and fault tolerance?

c) Describe the current reliability of your solution, including historical uptime metrics.

3. Security and Compliance:

a) Detail the security measures and compliance standards your solution adheres to.

b) Detail encryption protocols and compliance certifications.

c) Explain how your solution protects against DDoS attacks and other threats.

d) Describe your ACLs – fast and dynamics.

e) Explain how your solution protects against common API security threats (e.g. OWASP Top Ten).

f) Describe your solution’s compliance with Federal Information Security Modernization Act (FISMA) requirements, and the FedRAMP Authorization status for any cloud-based Infrastructure as a Service (IaaS) and Software as a Service (SaaS). FedRAMP Authorization status can include FedRAMP Marketplace designations (FedRAMP Ready, FedRAMP in Process, FedRAMP Authorized, etc.) or a willingness to work with USPTO toward FedRAMP Authorization.

g) Describe your solution’s compliance with the Federal Section 508 technical standards for accessibility.

4. Performance Metrics:

a) Share performance benchmarks or case studies demonstrating the effectiveness of your service.

5. Integration and mitigation:

a) How seamless is the migration process from on-premise to cloud?

b) Provide examples of successful ADC/ATM migrations you’ve facilitated.

c) Provide examples successful API gateway migrations you’ve facilitated.

6. Monitoring, Observability and Telemetry:

a) Describe your cloud-based monitoring, observability and telemetry.

b) List the features and functionalities of your cloud-based monitoring, observability and telemetry.

c) Explain how your solution adapts to dynamic workloads and multi-cloud environments.

d) Highlight key features, including metrics collection, log aggregation, and distributed tracing.

e) Provide examples of real-time insights and anomaly detection capabilities and resulting mitigations.

7. Migration Support and SLAs:

a) Describe the support and resources available for migration from on-prem application traffic management to your cloud-based solution.

b) Describe the support and resources available for migration from on-prem API gateway to your cloud-based solution.

c) What support services do you offer during migration and post-deployment?

d) Please specify service level agreements (SLAs) for uptime and response times and observed compliance.

8. License Structure:

a) Outline your licensing model.

9. Vendor Experience:

a) Provide information about your company’s experience in deploying cloud-based services, particularly for organizations transitioning from on-prem traffic management devices and API gateway devices.

10. References:

a) Include references from current customers or any federal agencies who have successfully implemented your solution.

b) Share case studies from clients who have implemented your solution.

https://csrc.nist.gov/projects/risk-management/fisma-background https://csrc.nist.gov/projects/risk-management/fisma-background https://www.fedramp.gov/ https://www.fedramp.gov/assets/resources/documents/FedRAMP_Marketplace_Designations_for_Cloud_Service_Providers.pdf https://www.fedramp.gov/assets/resources/documents/FedRAMP_Marketplace_Designations_for_Cloud_Service_Providers.pdf https://www.section508.gov/

Page | 3

Table (1)

Table 1 Application Delivery Controller/Application Traffic Management

1 Virtual Servers (VIPs) used as reverse proxies 2 TLS Certificate Profile 3 Pools load-balanced with various algorithms 4 Enforce HTTP Strict Transport Security (HSTS) headers across the enterprise 5 Customize script for Microservices (pool select based on context) 6 Automated Outage Pages (when all servers are down) 7 Vulnerability Mitigation 8 Redirects to maintain Fully Qualified Domain Name (FQDN) (including HSTS header) 9 Customize script for Centralized CORS and Browser Security

10 Caching under certain conditions 11 Rewrite URL path without redirection 12 TLS decryption for RCA investigations 13 Automated Blue/Green environments flips 14 Whitelists to limit access 15 Perform special logging such as IP Geolocation, JSESSIONID, and other DevOps requests 16 HTTP Header injections to assist with application logic 17 Block traffic at various context roots 18 OneConnect (solves issues with B/G flips, persistence, microservices, AWS ALB source port problem) 19 Profiles to accommodate HTTPS (and cipher enforcement), HTTP, ICAP, Persistence, UDP, SIP and other protocols 20 Monitors that look for receive strings to validate services 21 Monitors that validate services on adjacent ports, such as HTTP health check on MYSQL servers 22 Monitors that validate ICAP services on Antivirus servers 23 Address translation via SNAT that prevent clients from learning the IPs of individual servers 24 Policies for HTTP to HTTPS redirects 25 VLAN Segmentation 26 Policies to block Log4J and other attack signatures 27 Profiles to block DDOS attacks 28 Profiles for Bot Defense 29 Profiles to throttle aggressive traffic

Use of machine learning to evaluate incoming traffic and detect anomalous and threatening behavior and provide countermeasures.

31 Authentication for mobile devices 32 DNS listener IPs on port 53 (respond to DNS requests) 33 Wide-IPs: colocation of VIPs across data centers (active/active, active/standby, topography/geolocation) 34 Data Center objects that Wide-IPs can include 35 Global Traffic Manager Servers: High Availability Local Traffic Manager pairs hosting Virtual Servers

Prober Pools: used when alternative Global Traffic Manager health check network paths are desired rather than the local data center default

37 DNSSEC Zone

Page | 4

Table (2)

Table 2 API gateway

1 Request / Response Inspection 2 Certificate Management for SSL 3 Mutual TLS between USPTO and IP5/ WIPO 4 Header Inspection / Add / Rewrites 5 Rate Limiting (Use both throttling and Shaping depending on case) 6 Customized Error Response and Error code based on requirement 7 URI Rewrite 8 TLS 1.2 Outbound Connection and Cipher Suites 9 TLS 1.2/ 1.3 Inbound Connection and Cipher Suites

10 Customized Traffic Audits / Logs 11 SQL Attack Protection for URL message body

12 SOAP / REST API

13 Reverse Proxy 14 Header Rewrite 15 Automated Email Response 16 Custom Connection Timeout 17 Custom Read Timeout 18 Custom backend response inspection 19 ICAP Respmod/ReqMod 20 Code Injection Protection URL Path, Query, and Body 21 Port forwarding 22 HTTP/S Protocol

23 IP ACL

24 CORS (Cross-origin resource sharing) 25 SSL/TLS Transport Requirement 26 Customize max message size 27 Custom IP Whitelist 28 XML Document Structure Threat protection 29 SAML Federation V2 -for USPTO OKTA and EPO Azure

30 SSO

31 Base64 Encode/Decode 32 SAML Token Creation 33 SAML Roles Inspection and modification 34 Session Cache

Submission Guidelines:

• Response to this RFI should be submitted by July 9, 2024.

• Response should be limited to 8 pages.

• Preferred document format: PDF

• Submissions should be sent to:

Page | 5 o MCATMresearch@uspto.gov with Subject Line: “Cloud-based ADC/ATM and API Gateway as-a-Service Market Research Response [Company Name]”.

o Cc: Victor.Martinez@uspto.gov; Suyeon.Kim@uspto.gov

We appreciate your time and effort in providing the requested information. The USPTO is committed to finding the best possible solution to enhance our infrastructure and looks forward to your response.

mailto:MCATMresearch@uspto.gov mailto:Victor.Martinez@uspto.gov mailto:Suyeon.Kim@uspto.gov