N112-168 TITLE: Security Strategies for Mixed Use Mobile Computing Devices

TECHNOLOGY AREAS: Information Systems, Battlespace

ACQUISITION PROGRAM: JPEO JTRS ACAT 1

RESTRICTION ON PERFORMANCE BY FOREIGN CITIZENS (i.e., those holding non-U.S. Passports):  This topic is "ITAR Restricted."  The information and materials provided pursuant to or resulting from this topic are restricted under the International Traffic in Arms Regulations (ITAR), 22 CFR Parts 120 - 130, which control the export of defense-related material and services, including the export of sensitive technical data.  Foreign Citizens may perform work under an award resulting from this topic only if they hold the "Permanent Resident Card", or are designated as "Protected Individuals" as defined by 8 U.S.C. 1324b(a)(3). If a proposal for this topic contains participation by a foreign citizen who is not in one of the above two categories, the proposal will be rejected.

OBJECTIVE: Investigate the use of sandboxing techniques to speed certification and accreditation of COTS smartphones for SBU military mission usage. Develop a software-only solution that may be fielded on COTS smartphones without specialized hardware to host SBU military-only apps capable of communicating with tethered military radios for the purpose of sharing/collecting/transmitting/storing sensitive military information, even when the COTS phone is compromised by malware and/or rootkits.

DESCRIPTION: Military personnel are increasingly using their personal smartphones in their daily duties. Sometimes these devices are used as part of mission operations. Smartphones can contain data that may be mission sensitive, including photos, geolocation information, contact information such as names, phone numbers, and so on. In some cases, these devices may have applications that are military-only purposed apps. This data, while unclassified, may be sensitive and can result in OPSEC breaches [HIG10]. Both the sensitive data at rest, as well as the military-purpose apps, may be subject to compromise from malware that could reside on these devices, or may be inadvertently shared across an untrusted domain.

There is currently much research ongoing in the area of virtualization and hardware assisted partitioning to separate trusted and untrusted applications [BAR10]. However, none of these features are available in current smartphones, and may not appear as a standard option in COTS smartphones in the near future. Furthermore, commercial sector solutions will not address the stringent requirements of the DoD. All Army wireless devices must meet the policy guidance in DOD Directive 81000.02 and use CAC PKI capabilities as outlined in DOD Instruction 8520.2, "Public Key Infrastructure and Public Key Enabling." DARPA and the NSA have started looking at software solutions addressing the issues related to integrating smartphones with DoD networks but viable, cost effiective, elegant solutions have yet to emerge. In order to address OPSEC needs for immediate fielding of smartphone apps, a software-only solution to protect SBU data and military-use-only apps is needed for current COTS smartphones.

Under this topic, a framework of applications and services for commercial smartphones must be presented that protects data-at-rest and sandboxes military-use applications from untrusted applications[LG10], providing separation between trusted and untrusted applications, and simplifying the OPSEC concerns raised by dual use of the smartphone in an operational setting. This framework must support open source development of apps and operate on current COTS smartphone platforms in common use today. This framework should be designed to support extensions to the supported apps and services in a convenient and secure manner.

PHASE I: Design a concept that can be readily deployed on smartphones that would provide separation between trusted and untrusted applications and services, and protect sensitive data-at-rest in trusted applications. The submission must address techniques to prevent inadvertent sharing of information between trusted and untrusted applications, leakage of data to untrusted applications, and strong protections for data-at-rest on the smartphone platform. The large scope of the problem dictates that solutions identified in Phase I will be carefully defined and the scope sufficiently limited to identify achievable tasks for Phase II.

The outcome of Phase I will be architecture descriptions and a preliminary prototype description demonstrating the feasibility of the design on a single smartphone development platform.

PHASE II: Demonstrate application and data protection capabilities on two or more commercial smartphone platforms, showing resilience against malware and protections of data-at-rest using the proposed framework. The framework will be capable of identifying attempts by malware to access protected data and applications and notifying the user. The software framework will create virtual partitions and be capable of purging data of OPSEC sensitive information before releasing it outside the sandbox. The outcome of Phase II will be a full implementation of the design and prototype delivered in Phase I, providing technology that can be tested in a real-life environment.

PHASE III: The integration of COTS equipment with military communications systems will require new security policies that meet stringent DoD standards. Security will be of paramount importance in order to successfully integrate commercial handsets into military networks and communication systems. Transition opportunities will be focused on tactical wireless communications system such as JTRS.

PRIVATE SECTOR COMMERCIAL POTENTIAL/DUAL-USE APPLICATIONS: Commercial smartphones and social networks are becoming part of our daily culture. New security risks and vulnerabilities are revealed almost daily. The proposed technology will enable communities of interest to develop dual-use handsets for handling sensitive business information along with personal-use applications. A robust security system for personal movile devices would be of value to corporate, government and military customers.

REFERENCES:
(1) [OCP10] "Social Media Roundoup: Geotags and Location-Based Social Networking", US Army Office of the Chief of Public Affairs, Pentagon, [email protected], 2010

(2) [MUL06] "Using Labeling to Prevent Cross-Service Attacks Against Smartphones", Proceedings of the Conference on Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA), pp. 91-108, Springer, Berlin, Germany, July 2006

(3) [HIG10] Kelly Jackson Higgins, "Google Issuing Fix for Latest Android Vulnerability Disclosure", Dark Reading, Nov. 16, 2010. Referencing work by Jon Oberheide and Zach Lanier of Scio Security and Intrepidus respectively.

(4) [BAR10] Ken Barr, Prashanth Bungale, Stephen Deasy, Viktor Gyuris, Perry Hung, Craig Newell, Harvey Tuch, and Bruno Zoppis. 2010. The VMware mobile virtualization platform: is that a hypervisor in your pocket?. SIGOPS Oper. Syst. Rev. 44, 4 (December 2010), 124-135.

(5) [LG10] http://www.androidcentral.com/lg-vmware-bringing-corporate-sandbox-android

(6) Want, Roy; Pering, Trevor, System Challenges for Ubiquitous & Pervasive Computing, ICSE 05, May 15-21 2005

(7) Want, Roy, You are Your Cell Phone, IEEE Pervasive Computing, April � June 2008

KEYWORDS: Smartphone; security; mobile ad-hoc networks; dual use; JTRS, Information Security

** TOPIC AUTHOR (TPOC) **

DoD Notice:   Between April 26 and May 25, 2011, you may talk directly with the Topic Authors to ask technical questions about the topics. Their contact information is listed above. For reasons of competitive fairness, direct communication between proposers and topic authors is not allowed starting May 26, 2011, when DoD begins accepting proposals for this solicitation.

However, proposers may still submit written questions about solicitation topics through the DoD's SBIR/STTR Interactive Topic Information System (SITIS), in which the questioner and respondent remain anonymous and all questions and answers are posted electronically for general viewing until the solicitation closes. All proposers are advised to monitor SITIS (11.2 Q&A) during the solicitation period for questions and answers, and other significant information, relevant to the SBIR 11.2 topic under which they are proposing.

If you have general questions about DoD SBIR program, please contact the DoD SBIR Help Desk at (866) 724-7457 or email weblink.