SHARE_Proposers_Day_Brief_for_release.pptx

Secure Handhelds on Assured Resilient networks at the tactical Edge

(SHARE)

Dr. Joseph B. Evans Program Manager, DARPA/STO Briefing Prepared for Proposers’ Day 31 January 2017 Approved for public release; distribution unlimited case 27384.

2/28/2017

BAA HR001117S0009 – Secure Handhelds on Assured Resilient networks at the tactical Edge

Announcements BAA was posted to www.fbo.gov on January 23, 2017

Schedule BAA Released – January 23, 2017 Proposal Due Date – March 15, 2017

Administrative, technical or contractual questions should be sent via e-mail to HR001117S0009@darpa.mil

BAA-HR001117S0009 and associated amendments, will be the official documents for the proposals. They supersede statements made here.

BAA Overview and Schedule

Program Overview

SHARE

Objective: Secure data sharing between coalitions across mobile tactical networks

Current limitations Computers and infrastructure to manage multiple levels of classified coalition information are too bulky for tactical use Technology used to secure networks and devices fails in today’s high error rate tactical networks Deploying custom computers and networks for coalitions takes months to years

Approach Distributed multilevel security management based on secure mobile devices Resilient secure networks that are stable in challenging environments Software to rapidly configure security across the network

SHARE creates the capability to share tactical information between operators Demonstrate the exchange of multilevel secure information over commercial and military networks using a heterogeneous mix of devices

Tactical Information Sharing Using Mobile Handheld Devices Multilevel Secure Data Unclassified Only Remote Advise and Assist Handheld Devices

Deployment time: Current approaches to deploy a coalition network are manually configured static installations that take months to years to deploy Current limitations: Multilevel security only supported by enterprise level computing & networks

Enterprise Level Data Center

VPN, e.g. HAIPE Router

S//ISAF

S//NF

TS//SCI

VPN

Multiple Laptops, 1 per Trusted Group Multiple VPNs, 1 per Trusted Group Bulky infrastructure: Security management to share data across trusted groups (coalitions) requires reach back to bulky enterprise capabilities that are not practical at the tactical edge

Tactical network error rate: Current secure networks that rely on VPN connections result in unacceptable overhead and are unreliable in tactical environments

TS//SCI

Multiple VPNs, 1 per Trusted Group

TS//SCI

Multiple VPNs, 1 per Trusted Group Bulky infrastructure: Security management to share data across trusted groups (coalitions) requires reach back to bulky enterprise capabilities that are not practical at the tactical edge

Tactical network error rate: Current secure networks that rely on VPN connections result in unacceptable overhead and are unreliable in tactical environments

TS//SCI

Multiple VPNs, 1 per Trusted Group

VPN = Virtual Private Network ISAF = International Security Assistance Force HAIPE = High Assurance Internet Protocol Encryptor Bulky infrastructure: Security management to share data across trusted groups (coalitions) requires reach back to bulky enterprise capabilities that are not practical at the tactical edge

Tactical network error rate: Current secure networks that rely on VPN connections result in unacceptable overhead and are unreliable in tactical environments

Distributed Tactical Security Management: Develop software to distribute multilevel security management from data centers to trusted, handheld devices Opportunities exist such as NSA developed Security Enhanced Linux (SELinux) and software based crypto engines (NSA Suite B)

Resilient Secure Networks: Leverage new assured resilient networking technology from academic testbeds that tolerates greater packet loss than VPNs and has built-in encryption and key distribution Build on ARPANET fundamentals – individually signed and encrypted packets are more resilient than dedicated end-to-end connections Security can be provided at the packet level instead of the pipe level

Security Configuration Automation: Exploit commercially available hardware and develop software to automate management of sharing rules and users Software networking and system technology solutions enable tactical information sharing

Three phases

Phase 1: Technology Development Focus Area 1: Distributed Tactical Security Management Focus Area 2: Resilient Secure Networks Focus Area 3: Security Configuration Automation Phase 2: Prototype Development Integration of Focus Areas 1 and 2 Focus Area 3 Phase 3: Integration Integration of all focus areas

BAA Phase Plan Overview

Overview of SHARE Programmatics

Integration

Deliverable: Controlled field experiment on handheld devices Objective: Fully integrated handheld, network, and management system

Deliverable: Final software on existing hardware and field experimentation and demonstration Focus Area 2: Resilient Secure Networks Objective: Resilient networking architecture for the tactical edge Deliverable: Lab experiment under tactical edge conditions

Deliverable: CDR-level design of system architecture

At the end of each phase, the SHARE Government Team will help assess each performer’s solution and will inform the Program Manager regarding the downselects

Tests and demonstrations towards the end of each Phase are intended to (a) assess system performance, (b) determine which performers and their technologies from each technical focus area successfully achieved program objectives and technical milestones, and (c) engage with a variety of key stakeholders to obtain feedback that can influence program direction Program Metrics

> 50% effective bandwidth with 5% PER Security Packet-level security (equivalent to NIST SP 800-77 for IPsec VPNs)

Final demonstration will coincide with completion of Phase 3 and will demonstrate an integrated SHARE system with the security configuration automation software at TRL 6 that includes security management with rapid deployment capabilities that meets program metrics

Performers should assume that the final demonstration will be held on military facilities in conjunction with a EUCOM or PACOM coalition exercise

Anticipate 2 weeks of travel (1 week setup, 1 week execution)

Proposals should identify potential venues, but it is anticipated that the Government support team will work closely with performers to finalize event identification and coordinate the inclusion of SHARE technologies SHARE Final Demonstration

SHARE Final Demonstration MANET = Mobile Ad-Hoc Network ISAF = International Security Assistance Force

UNCLASS

S//NF

S//NF

UNCLASS

S//ISAF

U.S. Military

MANET

Commercial based tactical network

Commercial network Using at least 50 devices and any supporting commercial network and server equipment, demonstrate exchange of multilevel secure information over commercial and military networks using a heterogeneous mix of devices

BAA Technical Details and Focus Areas

SHARE

Technology insight: New technology changes security approach for tactical networks ftsGRcczRMIrGXNpHiql1wVKG7zyWoBxz7po9azYhSvZI9H+ wwSPrmLQMc6uxc9CNR pJk8Uwc+rWNm GRHjZNlOj+aYWnhoREv

Information being shared between end points is protected by the “outer shell” of the VPN encryption Provide security at the packet level, so each piece of information is authenticated, encrypted, and can transit the network safely on its own Tactical information exchange: TODAY Versus TOMORROW Once the VPN is established, when errors occur, it has to be torn down and re-established

Tactical Edge Data is pushed one hop at a time

A link failure results in storage of the encrypted data X Time When link is restored data pushes forward

IP VPNs require uninterrupted end to end reachback links Use interruptible store and forward Simple recovery – retransmit as little as one packet

Tactical Edge Gateway Rear-area Gateway

HDR(A,0) SAi1 Kei Noncei HDR(A,B) SAr1 Ker Noncer [CERTREQ] HDR(A,0) N<cookie> HDR(A,0) N<cookie> SAi1 Kei Noncei HDR(A,B) SK {IDr [CERT] AUTH SAr2 TSi TSr} HDR(A,B) SK {IDi [CERT] [CERTREQ] IDr AUTH SAi2 TSi TSr}

Technology insight: New technologies allow distribution of security management to the edge

Security Management: TODAY Versus TOMORROW

Crossing Domains Check identity Check authorities Authorize

Secure Enterprise Level Data Center

Unpack data Normalize Inspect Filter Repack data

Check identity Check authorities Authorize Unpack data Normalize Inspect Filter Repack data

Increase in cell phone computing power has made this idea possible

GFLOPS 3GS (2009) 4 (2010) 4S (2011) 5 (2012) 5S (2013) 6 (2014) 6S (2015) 1.2 1.6 12.8 25.5 115 115 172.8 Memory (GB) 3GS (2009) 4 (2010) 4S (2011) 5 (2012) 5S (2013) 6 (2014) 6S (2015) 0.25600000000000001 0.51200000000000001 0.51200000000000001 1 1 1 2 iPhone Model (Year)

Processing Power (GFLOPS)

Memory (GB)

Challenges Distributing and synchronizing application security rules and user privileges Securing handheld mobile devices with sufficient trust to host distributed security

Approach Develop data labeling and ruleset technologies, integrated onto handheld devices to cross information between trusted groups Build upon handheld operating system with security and software based encryption foundations for tactical edge use

Focus Area 1 – Distributed Tactical Security Management Develop multilevel secure software for wireless handhelds

Security Filter App 1 App 2 Policies for Crossing Trusted Groups

Lack of resilience in secure tactical networks Tactical applications currently designed for these unreliable network architectures

Approach Adapt packet-level secure network technology for tactical coalition networks Modify tactical applications to work with new network architectures Collaborate with stakeholders to develop or extend applications

Focus Area 2 – Resilient Secure Networks Adapt/extend networks, protocols, & applications from academic testbeds

Application Examples

Tactical Operations Support Imagery Distribution

Resilient Secure Internetworking New Assured Resilient Network Architectures Single Packet with Information plus Encryption and Signing

> 50% effective bandwidth with 5% PLR Security IPsec VPN standard (NIST SP 800-77) Packet-level security (equivalent to NIST SP 800-77)

PLR = Packet Loss Rate NIST = National Institute of Standards and Technology Today’s Brittle Secure Networks

Managing complexity of users, groups, rules, and authorities across multiple security enclaves Rapidly configuring system for new coalitions

Approach Develop algorithms and systems to automate and streamline management of Information sharing rules User authorities Demonstrate and field an operationally capable system using tactical and commercial networks Ensure open and lasting solutions

Focus Area 3 – Security Configuration Automation Integrate and field an operationally capable multilevel secure system Demonstrate Integration of mobile U.S. and Coalition Assets

BAA Programmatic Details

SHARE

Total amount of funding available for program: $30,500,000

Multiple awards are anticipated for Phase 1

Each Phase is a 12 month effort

Phase 1 is to be proposed as the base effort with Phases 2 and 3 as options

Funding

SHARE Program Plan

FY17 FY18 FY19 FY20

Phase 1 – Technology Development Distributed Tactical Security Management Resilient Secure Networks Security Configuration Automation Phase 2 – Prototype Development Integrated multilevel handheld software and networking architecture Security Configuration Automation Phase 3 – Integration Integration and Transition Coalition Exercise Government Test and Evaluation Red Team and Testing

Final Demo

Kickoff

Experiments

Phase 1 Assess

Exercise Option (s)

Phase 2 Assess

BAA

Exercise Option(s)

Organization Name Schedule/Cost

Government-Furnished Information, Equipment, Support

The following equipment and resources will be provided/funded by the Government for use during the final assessment and demonstration of Phase 3

If any additional Government Furnished Equipment or resources are requested by the performer, these should explicitly be described in the proposal along with a rough order of magnitude of expected costs SHARE Government Furnished Equipment, Information, and Resources

Evaluation of Proposals

Proposals will be evaluated on the following criteria:

Overall Scientific and Technical Merit Potential Contribution and Relevance to the DARPA Mission Cost and Schedule Realism Evaluation Criteria

The proposed technical approach is innovative, feasible, achievable, and complete.

Task descriptions and associated technical elements provided are complete and in a logical sequence with all proposed deliverables clearly defined such that a final product that achieves the goal can be expected as a result of award. The proposal clearly identifies major technical risks and clearly defines feasible planned mitigation strategies and efforts to address those risks. The proposal clearly explains the technical approach(es) that will be employed to meet or exceed each program goal and system metric listed in Section 1.2 and provides ample justification as to why the approach(es) is feasible. The Government will also consider the structure, clarity, and responsiveness to the statement of work; the quality of proposed deliverables; and the linkage of the statement of work, technical approach(es), risk mitigation plans, costs, and deliverables of the prime contractor and all subcontractors through a logical, well structured, and traceable technical plan.

Overall Scientific and Technical Merit

The potential contributions of the proposed effort are relevant to the national technology base. Specifically, DARPA’s mission is to make pivotal early technology investments that create or prevent strategic surprise for U.S. National Security.

The proposer clearly demonstrates its capability to transition the technology to the research, industrial, and/or operational military communities in such a way as to enhance U.S. defense. In addition, the evaluation will take into consideration the extent to which the proposed intellectual property (IP) rights will potentially impact the Government’s ability to transition technology. The Government encourage proposals that, to the greatest extent possible, are free of IP and data rights restrictions as this will allow for future extensibility and an easier transition at the conclusion of the program. Proposals that use and offer Government or open source code are preferred.

Potential Contribution and Relevance to the DARPA Mission

The proposed costs are realistic for the technical and management approach and accurately reflect the technical goals and objectives of the solicitation. The proposed costs are consistent with the proposer's Statement of Work and reflect a sufficient understanding of the costs and level of effort needed to successfully accomplish the proposed technical approach. The costs for the prime proposer and proposed subawardees are substantiated by the details provided in the proposal (e.g., the type and number of labor hours proposed per task, the types and quantities of materials, equipment and fabrication costs, travel and any other applicable costs and the basis for the estimates).

It is expected that the effort will leverage all available relevant prior research in order to obtain the maximum benefit from the available funding. For efforts with a likelihood of commercial application, appropriate direct cost sharing may be a positive factor in the evaluation. The evaluation criterion recognizes that undue emphasis on cost may motivate proposers to offer low-risk ideas with minimum uncertainty and to staff the effort with junior personnel in order to be in a more competitive posture. DARPA discourages such cost strategies.

The proposed schedule aggressively pursues performance metrics in the shortest timeframe and accurately accounts for that timeframe. The proposed schedule identifies and mitigates any potential schedule risk.

Cost and Schedule Realism

Conclusion Thank you for your interest in SHARE

Dr. Joseph Evans joseph.evans@darpa.mil 571-218-4446 www.darpa.mil image1.png image2.png image3.png image6.png image7.png image8.png image9.jpeg image10.png image11.jpeg image12.png image13.png image14.png image15.png image22.png image16.png image17.png image18.png image19.jpeg image20.png image21.png image23.jpeg image24.png image25.png image26.png image27.jpeg image28.png image29.png image30.jpeg image31.jpeg image32.png image39.png image33.png image34.jpg image35.jpeg image36.png image37.png image38.jpeg image4.png image5.png