TNE RFI_191224.pdf

Distribution Statement A. Approved for public release: distribution is unlimited.

TRANSFORMATIONAL CAPABILITIES OFFICE

TRUSTED NETWORK ENTRY (TNE)

SOURCES SOUGHT SYNOPSIS/REQUEST FOR INFORMATION (RFI)

19 DEC 2024

1. NOTICE

This Sources Sought Synopsis/Request for Information (RFI) is issued for informational purposes only and does not constitute a solicitation or commit the government to award a contract now or in the future. Submitting information for this RFI is voluntary, and participants will not be compensated. Your response to this RFI will be treated as information only. No entitlement to payment of direct or indirect costs or charges by the Government will arise as a result of contractor submission of responses to this announcement or the Government’s use of such information. This request does not constitute a solicitation for proposals or the authority to enter into negotiations to award a contract. No funds have been authorized, appropriated, or received for this effort. The information provided may be used by the AF in developing its acquisition strategy, statement of work/statement of objectives, and performance specifications.

Interested parties are responsible for adequately marking proprietary or competition sensitive information contained within their response as instructed later in this posting.

2. BACKGROUND

The Air Force Research Laboratory (AFRL), Transformational Capabilities Office (TCO), Wright-Patterson AFB, OH, is conducting market research to identify potential sources to provide faster, individualized, distributed, more-trusted communication and network entry solutions for airborne and space-based platforms that meet future DAF needs. The Trusted Network Entry (TNE) project aims to increase trust at the lowest layers of communication and networking open systems with emphasis on the edge.

3. OPERATIONAL CHALLENGE

This project’s operational challenge is to increase trust at the hardware, link, and network layers via Trusted Network Nodes (TNNs - starting at hardware root(s) of trust), Network Trusted Tokens (NTTs), and an Assured Network Infrastructure (ANI). Products will need to be low C- SWaP.

Future warfighting scenarios will include operations that require information exchanges that are not rigorously prepared, necessitating the ability for a mission element to uniquely and quickly identify itself with a very high level of trust. For instance, forward deployed assets may need to find and exchange information with an available coalition effector to opportunistically engage a high value target within a small vulnerability window, but neither party may be able to reach back to ‘check with higher.’ For example, a satellite with a software-defined radio might load a particular waveform configured for a specific region, join other nodes in that region for a short time, join one or more networks accessible by those nodes, share mission-essential data, quit, and start the whole process over again. In a less extreme instance, this concept could also apply to an office worker’s laptop computer reaching into a secure, private data collection that requires more than just a Common Access Card.

Trust is required in the hardware and software within one’s system before trust may be shared with others. Trust is also required at the link layer for each waveform/radio configuration and cryptography level, as well as at the network layer to join each network/domain/data-sharing-group (including overlay networks).

Figure 1: This is both a 20-year-old and 20-years-from-now problem. As this 2004 netcentric graphic depicts, a huge number of diverse nodes sought to security communicate with each other. In 2044 the diversity and number of nodes, connections, communication paths, networks, and overlay networks will be far, far greater and more complex. How should the DoD share trust among so many players? Source:

https://apps.dtic.mil/sti/tr/pdf/ADA465907.pdf 2004 Command and Control Research and Technology Symposium, The C2 Constellation A US Air Force Network Centric Warfare Program, Col Norman Sweet. Page 7, figure1.2 C2

Constellation – C4ISR Systems

Networks will consist of a mix of commercial and DoD components, old and new devices, and space and terrestrial locations. Networks will also be public, unclassified, gray, or classified, just as they are today, but with more complexity and variance.

DoD networks are expected to be fragile (subject to loss of node or links), highly dynamic (continuous topology changes, and partitioning anticipated for highly mobile networks), very difficult to plan (unavailable and unpredictable participants and resource management), and attacked by multiple, near-peer threats.

The challenge is to affordably increase trust within a very difficult environment. Our objective is to demonstrate links and connections between initial, zero-trust, DoD-specific, Open Communication Systems.

4. NEAR-TERM OBJECTIVES

The information provided via this RFI aims to support the below near-term objectives:

https://apps.dtic.mil/sti/tr/pdf/ADA465907.pdf

• Form a picture of a 20-years-from-now network environment and create a framework to increase trust in that environment

• Expand the breadth, depth, and rigor of the above ideas

• Bring forward experts and organizations in these fields

• Explore current/forthcoming commercial solutions

• Better understand future, forward-edge environments and threats

• Define how available solutions need to be modified/applied to solve problems

• Demonstrate potential solutions at the conclusion of the effort

• Inform requirements for acquisition

5. LINES OF EFFORT (LoE)

This RFI seeks information on the below three lines of effort. Though these are the technical areas that are being considered, even if a specific solution is mentioned within the RFI, the TCO is not bound to the solutions mentioned. The suggestion of alternate ideas is strongly encouraged.

Additionally, insight into how the proposed hardware and software would work in an air and ground end-to-end network entry scenario is desired.

LoE1: Trusted Network Node (TNN)

• Hardware "root of trust” and “chain of trust” within an Open Mission System and Open Communications System (OMS-OCS) to establish trust across all hardware devices, and through the system’s OSI Layers.

• Includes a system-level means to gather/refer each device/card/component of the hardware root of trust (HRoT).

• Must sync with and guide OCS-OMS standards.

• Must enable connecting or tunneling higher-classification/more-sensitive networks. The Open Compute Project Security group released specifications for Root of Trust, but a DoD version would be a TBD ‘platinum’ rating.

• A dynamic root of trust measurement should also be considered. Similar commercial solutions are Win11 that uses TPM 2.0 and Apple devices with Boot ROM.

• Has a less-sensitive, verifiable, hardware Globally Unique Identifier (similar to IMEI).

LoE2: Network Tokens of Trust (NTT)

• Like a smartcard, SIM, eSIM, or iSIM, this portable, secure microcontroller and storage provides configuration, identity, and authentication to join a particular waveform (link), or network owned by someone else.

• May split into Link Tokens and Network Tokens.

• Has a Globally Unique Identifier similar to IMEI.

LoE3: Assured Network Infrastructure (ANI)

• Everything else off-platform; the entire database, digital, administrative, policy, issue/revocation, cybersecurity, and related off-platform elements to enable TNE across the DoD.

• Everything else off-platform; the entire database, digital, administrative, policy, issue/revocation, cybersecurity, and related off-platform elements to enable TNE across the DoD.

• Includes protocols within a node, between peer nodes, and the cloud.

• Enables Zero Trust across the enterprise.

• Similar to 1) a cellular providers’ approved devices + SIMs that synch with subscription systems, 2) DoD-built laptops + SDC + CAC that sync with DoD-PKI, and 3) ABMS DDIv1 with ICAM and ZTA.

• Likely to leverage similar elements within ABMS Digital Infrastructure.

6. SCOPE

Technologies that integrate the principles of globally unique identifiers, trusted network nodes, link trust tokens, network trust tokens, protocol exchanges, and infrastructures required to enable ad-hoc network entry in a combat environment are of interest for the purpose of this RFI. Three lines of effort (LOEs) have been identified to capture these principles: Trusted Network Node (TNN), Network Trusted Tokens (NTTs), and an Assured Network Infrastructure (ANI). The Air Force requires advancements in robust, low SWaP-C, affordable, rapidly scalable, Identity, Credential, and Access Management (ICAM) capabilities in ground, air and space platforms. The focus is on demonstrating the TNNs and NTTs, and defining their supporting needs, within ANI.

TCO wants to demonstrate some of these solutions at the end of the awarded effort.

Products for encryption, Cross Domain Solutions, multi-level computing, secure mesh waveform, software defined radio, and software-defined networking, are outside the scope of this effort; although, they are and will be a very important part of networks. For example, today a KG-255 provides Type 1, Layer 2 encryption and Type 1, Layer 3 HAIPE encryption, and has a vast, NSA and Air Force COMSEC infrastructure. KG-255s would likely be used within a large demonstration but are not an area for this applied research.

A secondary intent of this RFI is to help limit the TCO’s scope to technical areas where time, talent, and treasure resources will lead to a demonstration within a few years. The government is seeking knowledge on how best to utilize this 6.2 (budget activity for applied research) investment and does not expect to spend more than $6M across all three LOEs stated within this RFI through demonstration conclusion.

At technology conclusion, this system would be demonstrated with representative air or space systems or subsystems. Contract performance will be primarily in support of the TCO located at Wright Patterson Air Force Base, OH, but may include support to activities relevant for demonstration and testing.

7. INSTRUCTIONS TO POTENTIAL RESPONDENTS

Interested parties who desire to participate in this SSS/RFI are encouraged to submit responses that clearly demonstrate an ability to meet the stated requirements, or a portion of the requirements if interested as a sub-contractor. Responses shall include the following information and address the questions below:

Company/Institute Name:

Address:

Point of Contact (to include phone number and email address):

CAGE Code:

Web Page URL:

Size of business pursuant to NAICS Code 541715. Based on the above NAICS Code, state whether your company is:

Small Business (Yes / No) Self-Certified or Third Party Certified

Women-Owned Small Business (Yes / No) Self-Certified or Third Party Certified

Economically Disadvantaged Women-

Owned Small Business (Yes / No) Self-Certified or Third Party Certified

HUBZone Certified (Yes / No) Self-Certified or Third Party Certified

Veteran Owned Small Business (Yes / No) Self-Certified or Third Party Certified

Service Disabled Veteran Owned

Small Business (Yes / No) Self-Certified or Third Party Certified

8(a) Certified (Yes / No) Self-Certified or Third Party Certified

SBA Certification Date: ____________ SBA Graduation Date: ______________

The NAICS code for this requirement, if applicable to the company’s capabilities, should be included in the company’s NAICS code listing in SAM.

State whether the company is domestically or foreign owned (if foreign, please indicate the country of ownership).

State whether the respondents are interested in being a prime or subcontractor for this requirement.

8. RESPONDER TASKS

a) Respondents can address zero, one, two, or all three of the operational challenges stated within this RFI.

i. If zero, Respondents should address how they may become the prime who integrates others’ solutions.

b) Respondents should be willing to integrate with other respondents if not addressing all three operational challenges within this RFI.

c) Please provide a description of your current capabilities as they relate to the operational challenge(s) and scope.

d) Please provide an explanation for how your current capabilities would fit into an end-to-end ad hoc network entry scenario.

e) Please provide any questions and comments.

f) Provide a rough cost estimate (i.e. rough order of magnitude (ROM)) based on the tasks chosen as an annual re-occurring cost over a 24-month period, and the assumptions (manpower and materials) driving contract costs. If preferred, a verbal response may be given via telecom.

g) Please provide specific details and rationale as to how compliance with FAR 52.219-14, Limitations on Subcontracting, would be achieved in the event the Government sets this requirement aside for small business. Include specific details regarding teaming arrangements, etc. If subcontractors are to be used, provide the anticipated percentage of effort to be subcontracted and whether small or large businesses will be used. If this effort is not set-aside for small business, small business utilization will be considered. Large and small businesses should provide a reasonable expectation for small business utilization as a percent of total contract value as well as supporting rationale for the recommended percentage.

h) Indicate whether the company is currently preforming this type of work/whether the capability can be obtained under an existing Government contract. Provide the contract number(s) and Government points of contact accordingly.

i) Optional: Please provide a general description of the data rights that the Government may receive regarding the technologies described.

j) Optional: If the company was or is currently preforming this type of work/whether the capability can be obtained outside Government contracts or channels, we request points of contact accordingly.

9. RESPONSES, COMMUNICATION, AND ADDITIONAL CONSIDERATIONS:

a. The government may contact respondents to obtain additional information or clarification in order to fully understand a company’s response. This may include discussions, site visits, demonstrations, etc. to further the Government’s understanding of a proposed solution, as well as a company’s understanding of the Government’s requirements.

b. Respondents shall limit submissions to 20 pages or less and should include technical and descriptive text to provide sufficient detail on how they would satisfy the requirements outlined within the LOEs. More succinct responses preferred. The submitted documentation becomes the property of the U.S. Government and will not be returned.

c. Responses will be unclassified but may be CUI, sensitive, and/or proprietary and if so, properly marked.

d. Manage all program data in accordance with Air Force data protection standards (i.e., provide and implement satisfactory operational security (OPSEC) plan.

e. Respondents who submit proprietary data shall clearly mark the data with appropriate markings on the cover sheet and on each applicable page. Any proprietary data submitted may be handled by contract support services personnel who have signed Non-Disclosure Agreements (NDA). Any proprietary information received in response to this request will be properly protected from any unauthorized disclosure. The Government will not use proprietary information submitted from any one firm to establish the capability and requirements for any future systems acquisition, so as to not inadvertently restrict competition. Any material that is not marked proprietary will be considered publicly-releasable.

f. The Government does not intend to award a contract on the basis of this RFI. A determination not to compete this action based on responses received is solely within the discretion of the Government.

g. An example shown or mentioning a specific product, image, term, or description herein should not be construed as Government recommendation, support, or requirement to use.

h. Broad industry participation for this Sources Sought is encouraged. U.S. and non-U.S. firms are permitted to respond to this SSS/RFI.

i. Responses to questions from interested parties will be promptly answered and posted on Sam.gov, unless some release of proprietary information is involved, or the answer addresses a question peculiar to a company or that company’s response.

j. This RFI document may come with other documents such PowerPoint slides. Please check the Sam.gov site for additional files.

k. A Driving Factors and Project Discussion Supplemental Document is available upon request and will be provided at the Government’s discretion.

l. This notice may be updated as additional information becomes available. Please check the Sam.gov site for updates to this announcement and register to receive e-mail notices of any updates to the Sam.gov announcement. For more information on this Sources Sought, please contact the AF POCs below. E-mail communications are preferred.

m. Please note that all prospective contractors must be registered in System for Award Management (SAM) database to be awarded a Department of Defense contract. To learn more about this SAM requirement and how to register, please visit the SAM internet website at https://www.sam.gov/portal/SAM/#1#1.

n. Responses shall be accepted by e-mail of the paper submittal in either Microsoft Word or Adobe PDF formats. Responses shall be received by 16:00 EST, on 31 January 2025.

o. This notice may be updated as additional information becomes available. Please check the Sam.gov site for updates to this announcement. For more information on this RFI, please contact the point of contact identified below. E-mail communication is preferred.

Ms. Brooke Burtis

Explore Campaign Manager

AFRL/RSTE, (937) 255-6022

brooke.burtis@us.af.mil https://www.sam.gov/portal/SAM/#1 mailto:brooke.burtis@us.af.mil 1400942621C Highlight