Secure, Internet Web & Messaging Server Assessment Event (AE)

Challenge Summary

Description

The Army requires the ability to rapidly provision formally verified, provably secure computer systems that provide services or enable secure data exchange between a perpetually growing number of regional partners in a contested environment.

Additional Information

Submission Deadline:

02/26/2023 at 11:59 AM EST

Purpose

Provably secure systems provide a root of trust to build Zero Trust (ZT) architectures upon and would accelerate the Army’s ability to exchange sensitive data with regional and theater partners in competition and during combat. The existence of software defects in many client and server applications results in the application of highly complex, costly, security controls including logical or physical separation of systems to gain a measure of confidentiality, integrity, and availability. To address the needs for a root of trust for ZT implementations and for provably secure computing and data exchange, the Army needs rapidly deployable, provably secure systems that enable key services such as routing, firewall, authentication, web and messaging functions. These systems also need to operate in contested networks that are proven to be unsusceptible to remote network exploitation using zero day or N-day exploitation methods that are often used to compromise systems and gain unauthorized access. Formally verified software is a potential solution to this problem and recent advances in provably secure computing technologies make this concept testable by building, testing and auditing prototypes that could be used during exercises and experimentation events to facilitate low-cost, secure communications with partners throughout the operational region.

Proposed Solution

Employ formal verification or provably secure technology to design and implement a provably secure web and messaging server prototype that is not vulnerable to remote network exploitation using zero day or N-Day type exploits enabling the secure exchange of near real time messages between authenticated web clients over an encrypted network transport. The prototype should be designed for persistent exposure to a contested network and prevent unauthorized egress of the server’s data (e.g., messages, web pages, encryption keys and configuration data). Any internal fault conditions should result in the server to safely abort all processing and stop servicing new connections (fail closed). The prototype design must be documented and explainable so it can be used as a root of trust for broad ZT implementations and a model for future computer system design for all servers persistently exposed to contested environments.

Technical Requirements

Partner builds a provably secure Web and Messaging Server prototype that is not vulnerable to remote network exploitation via typical zero days or N-Days exploitation verified via Formal Methods.

Basic requirements (required) capabilities:

The web/messaging server component is not vulnerable to remote network exploitation using zero days or NDays resulting in server compromise, unauthorized egress of server data or unauthorized access
The Web Server component must be able to employ TLS encrypted connections by default.
The Web Server component must be able to support MFA, cryptographically secure authentication
Must Support IPV4 transport
Must enable static web page rendering
Must enable multiple http routes to segment content for requesting clients
Must generate access, error and authentication logs
Must enable properly authenticated HTTP Client to send and receive text messages at least 500 characters long (Web messaging) and view static web pages
Must make messages available to clients based on user identity via a basic role-based access system
Must be able to sustain 250 Concurrent Web Client static web page or messaging connections
Supports HTTP/1.1 Protocol (minimum)
Must redirect HTTP connections to HTTPS (TLS) by default
Must be securely configurable either by command line interface or configuration file

Optional Desired Capabilities:

Enable multiple routes based on authenticated user identity/role
Uses DNS to support granular multi domain support (Virtual Hosts)
Implement Server Name Indication protocol (supporting multisite hosting)
IPV4 and IPV6 Support
Support For HTTP Compression (e.g. GZIP)
Supports HTTP/1.1 and HTTP/2.0
Support 2000 concurrent web and or web messaging connections
Able to limit request sizes/bodies to configurable threshold
Able to implement socket timeouts to configurable threshold
Enable HTTP Clients to send and receive Text and Binary messages (images) 1000 chars/2MB size
Enable basic searching of messages by user or datetime

Event Overview

What is an Assessment Event (AE)?

ARCYBER submits specific problems to solve and CFIC utilizes its ecosystem and market research to attract best-of-breed submissions to solve the problem. ARCYBER subsequently reviews and selects participants with the highest value to present and/or demonstrate their capability in a one-on-one session with Government Stakeholders.

Event Overview:

Phase 1 – 6 February 2023 to 26 February 2023 Submissions Open: Interested respondents who could potentially provide solutions that meet the needs of the Stakeholders are encouraged to submit their solutions per the instructions below NLT 26 February 2023, 11:59 PM ET.

Phase 2 – 28 February 2023 to 8 March 2023 Down-selects: ARCYBER will downselect those respondents/submissions they feel have the highest potential to satisfy their capability needs. Companies with favorably evaluated submissions will receive an invitation to the Assessment Event (Phase 3) o/a 8 March.

Phase 3 – 21 March 2023 to 22 March 2023 Assessment Event (AE): During the AE, invited participants will be allotted a one-on-one session with the Government evaluation panel to pitch, demonstrate, and/or discuss their solutions. The forum will include a Q&A portion and discussions may continue outside of the event to determine who (if anyone) proceeds to Phase 4 follow-on efforts.

Phase 4 – Follow-On: The Government has several acquisition/contract vehicles (i.e., various IDIQ contracts, purchase orders, etc.) to potentially purchase the final solution if operationally viable. The Government may elect to purchase all, some, and/or none of the solutions from Phase 3 for further projects.

How You Can Participate

Additional details can be found in the Vulcan Call HERE. Submissions are due NLT 26 February 2023, 11:59 PM ET

Review Vulcan Submission Instructions HERE

Review White Paper Submission Instructions HERE

Questions:

Please contact Brandon Sizemore (bsizemore@cyberfic.org) or Tim Hill (thill@cyberfic.org)

Disclaimers:

An award under 10 U. S. Code, Section 2371b may result in award of a follow-on production in accordance with 10.U.S.C. 2371(f). Upon a determination that the competitively awarded prototype project(s) have been successfully completed, and subject to the availability of funds, the prototype project(s) may result in the award of a follow-on production contract or transaction without the use of competitive procedures. Such awards may include multiple phases.

Non-Government advisors may be used in the evaluation of submissions and will have signed Non-Disclosure Agreements (NDAs) with the Government. The Government understands the information provided in this announcement is presented in confidence and may contain trade secret or commercial or financial information and agrees to protect such information from unauthorized disclosure to the maximum extent permitted and as required by law. An Organization’s participation in any part of the selection process under this the announcement indicates concurrence with the aforementioned use of contractor support personnel.

Event Website URL

https://vulcan-sof.com/login/ng2/collection/53cde0ee-abfd-4c43-a800-58b0d434bc6c

Challenge Details

More Challenges