Department of the navy (don) 17. 1 Small Business Innovation Research (sbir) Proposal Submission Instructions introduction

The Phase II effort will likely require secure access, and NAVSEA will process the DD254 to support the contractor for personnel and facility certification for secure access.  The Phase I effort will not require access to classified information.  If need be, data of the same level of complexity as secured data will be provided to support Phase I work.

PHASE I: The company will develop a concept for Cyber Threat Insertion and Evaluation Technology for Naval Applications that meet the requirements described above. The company will demonstrate the feasibility of the concept in meeting Navy needs and will establish that the concept can be developed into a useful product for the Navy. Feasibility will be established by prototyping and analytical modeling. The Phase I Option, if awarded, will include the initial design specifications and capabilities description to build a prototype in Phase II; will address technical risk reduction; and will provide performance goals and key technical milestones.

PHASE II: Based on the results of Phase I and the Phase II Statement of Work (SOW), the small business will develop and deliver a Cyber Threat Insertion and Evaluation Technology for Navy Ship Control Systems prototype for evaluation. The prototype will be evaluated to determine its capability in meeting the performance goals defined in the Phase II SOW for Cyber Threat Insertion and Evaluation Technology. System performance will be demonstrated through prototype evaluation over the required range of parameters to be defined in the Phase II SOW. Evaluation results will be used to refine the prototype into an initial design that will meet Navy requirements. The small business will assess integration and risk and develop a Software Development Plan (SDP). The company will prepare a Phase III development plan to transition the technology to Navy use in current and future navy shipboard machinery control systems and also potential commercial use.

PHASE III DUAL USE APPLICATIONS: The company will be expected to support the Navy in transitioning the technology for Navy use in current and future navy shipboard machinery control systems. The company will further refine Cyber Threat Insertion and Evaluation Technology according to the Phase II SOW for evaluation to determine its effectiveness in an operationally relevant environment. The company will support the Navy for test and validation to certify and qualify the system for Navy use. Private Sector Commercial Potential: This topic will be applicable across all government control systems on any platform. Cyber defense technologies are universally applicable within the designed technical framework and will benefit industry, government, and academia alike.

REFERENCES:

1. Kumar, Raghavan; Jovanovic, Philipp; Burleson, Wayne; Polian, Ilia “Parametric Trojans for Fault-Injection Attacks on Cryptographic Hardware”. Cryptology ePrint Archive, 2014 University of Massachusetts Amherst, 01002, USA, University of Passau, 94032,

2. Dunning, JP “.ronin”, “Building Trojan Hardware at Home” BlackHat Asia 2014 https://www.blackhat.com/docs/asia-14/materials/Dunning/Asia-14-Dunning-Building-Trojan-Hardware-At-Home.pdf

3. Sreedhar, Aswin, Kundu, Sandip, and Koren, Israel, “On Reliability Trojan Injection and Detection”, Journal of Low Power Electronics, Vol. 8, 1–10, 2012, Department of Electrical and Computer Engineering, University of Massachusetts, Amherst, MA, 01003, USA http://euler.ecs.umass.edu/research/skk-jolpe-2012.pdf-

KEYWORDS: Cyber threat; cyber intrusion; Cyber virus injection; firmware security; host based protection; operating system security; software code security; protection against Trojan viruses.

Questions may also be submitted through DoD SBIR/STTR SITIS website.

N171-055

TITLE: Methods for Measuring an Acoustic Array’s Straightness and for Autonomous Mechanical Straightening to Avoid Contact with Sea Bottom Under All Operational Conditions

TECHNOLOGY AREA(S): Battlespace, Electronics, Sensors

ACQUISITION PROGRAM: PMS 485, Maritime Surveillance Systems Program Office

The technology within this topic is restricted under the International Traffic in Arms Regulation (ITAR), 22 CFR Parts 120-130, which controls the export and import of defense-related material and services, including export of sensitive technical data, or the Export Administration Regulation (EAR), 15 CFR Parts 730-774, which controls dual use items. Offerors must disclose any proposed use of foreign nationals (FNs), their country(ies) of origin, the type of visa or work permit possessed, and the statement of work (SOW) tasks intended for accomplishment by the FN(s) in accordance with section 5.4.c.(8) of the Announcement. Offerors are advised foreign nationals proposed to perform on this topic may be restricted due to the technical data under US Export Control Laws.

OBJECTIVE: Develop methods for measuring an acoustic array’s straightness and enabling the array to autonomously straighten itself mechanically while avoiding contact with the sea bottom under all operational conditions.

DESCRIPTION: The Navy towed arrays, such as those used by Surveillance Towed Array Sensor System (SURTASS) ships, are flexible, neutrally buoyant tubes with a length of approximately 1500 feet. Similarly, ocean researchers and oil explorers use towed arrays to collect acoustic data needed in their science fields. Arrays are not directly attached to the ship, but are towed at the end of cables that are thousands of feet long. The depth of an array is mechanically adjustable in order to situate it optimally for acoustic surveillance performance, typically 150 to 300 feet deep. However, the array is subject to “drooping “on the far end as ship velocities decrease and to bending and turning due to currents. Consequently, the array’s acoustic performance is degraded, since array sensors are not in a perfectly straight line. Additionally, it is possible for the array to be inadvertently dragged on the ocean bottom when being towed at slow speeds (or halted completely), which can cause physical damage. A persistent performance shortfall is caused by the fact that a purely passively operated towed array that is thousands of feet long and deployed in the open ocean is not going to be as linear as is required to achieve the expected performance from beamforming and acoustic data processing. The prevention of array entanglement and severe damage in shallow water could save up to $8M per incident.

The innovation needed is a concept for a next-generation array to autonomously straighten linearly to within +/- two feet of center on each axis and protect itself from bottom damage (due to an unplanned stoppage in tow operations or ship navigation into shallow water) without intervention from an operator. In principle, to accomplish this functionality, it will be necessary for the array to have positional sensors distributed throughout its length and one or more mechanical devices capable of forming the array into a straight position. The implementation of this function must not significantly decrease the acoustic performance of the array (such as add self-noise or insert mechanical sounds while operating) nor increase physical vulnerabilities to fishing nets or long-lines. The array will need to be autonomously aware of its closest distance from the bottom and have mechanical devices capable of reducing its depth (by increasing buoyancy) when it is close to a collision with the seabed. Technologies needed include sensors for measuring straightness and proximity to the ocean bottom; a straightening algorithm (potentially utilizing artificial intelligence); electro-mechanical devices capable of steering the moving array; and mechanical devices capable of making the array (or portions of the array) positively buoyant. The transition of the resulting technology will be in the form of hardware modules, software, and/or intellectual property that will be integrated into the current or next-generation SURTASS array production line by the prime contractor.

PHASE I: The company will develop a concept and demonstrate feasibility for a preliminary design to implement array straightening and bottom avoidance functionality, including mechanical, electronic, and software components. Modeling tools will be utilized to develop initial algorithms for straightening and bottom avoidance, in accordance with the specifications cited in the “DESCRIPTION” section above. The operation of the system will be demonstrated in a variety of potential ocean environments and for ship movements using modeling tools. The company will build and demonstrate components or sub-components of the system if needed to validate the accuracy of the model. The Phase I Option, if awarded, will include the initial design specifications and capabilities description to build a prototype in Phase II.

PHASE II: Based on the Phase I results and the Phase II Statement of Work (SOW), the company will refine the Phase I design and algorithms. The company will develop and construct a working model of a surrogate array (without acoustic sensors) and validate that it operates in accordance with the model in a laboratory environment. The prototype will be demonstrated in water. The company will document the hardware and software design. A prototype will be delivered at the end of Phase II. The company will prepare a Phase III development plan to transition the technology for Navy and potential commercial use.

PHASE III DUAL USE APPLICATIONS: The company will be expected to support the Navy in transitioning the technology to Navy use. It will be expected to further refine a complete next-generation acoustic array for SURTASS ships and support the transition of the technology and design to another firm engaged as the prime contractor for the complete array. The company will implement the developed hardware and software to suit the operation of the acoustic array and support testing in laboratory and ocean environments to meet requirements for functionality, environmental extremes, reliability, safety, and other requirements to certify the system for Navy use. Operational testing will be supported by the Navy Fleet. The company can be expected to produce the complete array, array sub-system, or array components to support production of five arrays for the SURTASS fleet. Private Sector Commercial Potential: Other Navy platforms (ships and submarines), the oil exploration industry, and ocean scientists use similar acoustic arrays. Successful execution of the described capabilities would benefit all of these other users for similar reasons.

REFERENCES:

1. Kitchens, J. P. “Acoustic Vector-Sensor Array Processing.” PHD Thesis, MIT 2010. URL last accessed 29 February 2016: http://www.rle.mit.edu/dspg/documents/kitchens_phd_eecs_2010.pdf.

2. Fidanboylu, K.A and Efendioglu, H. S. “Fiber Optic Sensors and Their Applications.” 5th International Advanced Technologies Symposium (IATS ’09), May 13-15, 2009. pp: 1-6. URL last accessed 29 February 2016: http://iats09.karabuk.edu.tr/press/pro/02_KeynoteAddress.pdf.

3. Rand, R.H. and Ramani, D.V. “Theoretical Study of a Submarine Towed-Array Lifting Device.” URL last accessed 29 February 2016: http://audiophile.tam.cornell.edu/randpdf/qdmathu1.pdf.-

KEYWORDS: Towed array; sonar; undersea acoustics; acoustic surveillance; ocean systems; buoyancy.

Questions may also be submitted through DoD SBIR/STTR SITIS website.

TECHNOLOGY AREA(S): Information Systems

ACQUISITION PROGRAM: Program Executive Office Integrated Warfare Systems (PEO IWS) 1.0 – AEGIS Combat System; PEO IWS 10.0 – Ship Self Defense System (SSDS) Integrated Combat System

The technology within this topic is restricted under the International Traffic in Arms Regulation (ITAR), 22 CFR Parts 120-130, which controls the export and import of defense-related material and services, including export of sensitive technical data, or the Export Administration Regulation (EAR), 15 CFR Parts 730-774, which controls dual use items. Offerors must disclose any proposed use of foreign nationals (FNs), their country(ies) of origin, the type of visa or work permit possessed, and the statement of work (SOW) tasks intended for accomplishment by the FN(s) in accordance with section 5.4.c.(8) of the Announcement. Offerors are advised foreign nationals proposed to perform on this topic may be restricted due to the technical data under US Export Control Laws.

OBJECTIVE: Develop a system to monitor software applications’ memory space for the AEGIS and Ship Self Defense System (SSDS) Combat Systems to determine if a cyber-attack is occurring.

DESCRIPTION: Today’s systems are susceptible to countless types of cyber-attacks. The first step in defending a system from these attacks is the ability to detect them. There are various existing capabilities (for example, Address Space Layout Randomization (ASLR) and Canaries) which are able to prevent and detect specific types of attacks, but one area lacking is an applications memory space. One main reason for this is the difficulty for an external capability to know what is considered a normal application behavior and what is not.

A major component of the combat systems cybersecurity Defense-in-Depth (DiD) strategy is the assurance of system integrity. DiD is an approach to defend systems by implementing multiple capabilities that detect and protect against multiple cyberattacks. One area susceptible to integrity attack is memory space. An application’s memory is one of many areas that can be exploited by a cyber-attack. The ability to monitor the overall integrity of the combat system is necessary to its ability to detect and respond to a cyber-attack. Combat system and computing memory is divided into the operating systems’ kernel memory space and the application’s memory space. There are current capabilities that make memory integrity cyber-attacks more difficult. There is an additional capability that monitors and detects kernel memory integrity violations. No capability exists that passively monitors and detects individual applications memory integrity violations. The combat systems environment is defined as a real-time UNIX operating system with high availability requirements. The ability to monitor the integrity of an applications memory space would provide the combat system the ability to detect memory integrity attacks and respond to them. The innovative technology must have the ability to understand an application’s normal memory space, to detect with minimal false positives when it is exploited via a cyber-attack against it, and to report those detections without impact to running the real-time applications being monitored. Developing this monitoring capability for use within a combat system environment with little or no impact to the combat system will help ensure a more effective cybersecurity DiD strategy. The benefits of this capability will enable surface navy combat systems to field systems that are in a better position to endure a cyber-attack against an applications memory space.

The Phase II effort will likely require secure access, and NAVSEA will process the DD254 to support the contractor for personnel and facility certification for secure access. The Phase I effort will not require access to classified information. If need be, data of the same level of complexity as secured data will be provided to support Phase I work.

PHASE I: The company shall define and develop an approach to monitor software applications’ memory space to implement an open, passive cybersecurity capability that addresses attributes identified in the description section of this topic. The company shall also develop a Plan of Action and Milestones (POA&M) to design, develop, test, and integrate the proposed architecture into combat system environments. Feasibility for the development of the Application Memory Space Integrity Monitor will be determined by the demonstration of the proposed solution’s ability to detect various applications memory cyber-attacks (for example, buffer overflows), its false positive rate and ability to adjust its sensitivity to affect the false positive ratio, and its impact on the application’s ability to perform its primary mission. For the purpose of Phase I, the combat systems environment is defined as a real-time UNIX operating system with a high availability requirement requiring no impact to the running real-time applications being monitored. In the Phase I Option, if awarded, the company will develop a Plan of Action and Milestones (POA&M) to design, develop, test, and integrate the proposed architecture into combat system environments in Phase II. The capabilities of the proposed software will need to be defined.

PHASE II: Based upon the results of Phase I and the Phase II Statement of Work (SOW), a software-based prototype of the application memory integrity monitor will be developed. The prototype must demonstrate the ability to monitor multiple applications memory space using an agreed-to set of application memory cyber-attacks; and to detect and report any integrity violations. This capability should be able to execute with little to no impact to the performance of the monitored applications. The capabilities goal is to have a false positive rate as close to zero as possible and have the ability to adjust its detection sensitivity such that its false positive rate can be adjusted to an acceptable rate based on its environment. The company will provide requirements and architecture documentation, test plans and procedures, and threats to demonstrate that the Application Memory Space Integrity Monitor meets the attributes described in the description section of this document. The company will prepare a Phase III development plan to transition the technology for Navy and potential commercial use.

PHASE III DUAL USE APPLICATIONS: The company will support both PEO IWS 1.0 and 10.0 in the transition of Application Memory Space Integrity Monitoring software and or hardware/software solutions. This will be done by the incorporation and integration of the solutions into the combat systems baseline modernization process. This will consist of integrating the solutions into a combat system baseline hardware/software configuration, working with combat system developers to integrate it into the combat system, and supporting the combat system’s validation testing which will be performed at a Land Base Test Site (LBTS) used to test the combat system. Private Sector Commercial Potential: The ability to define and monitor an application’s memory integrity should be able to support any computing environment. In the commercial sector, just the like in the combat system environment, companies are seeking development of cybersecurity Defense-in-Depth (DiD) strategies to defend their systems against cyber-attacks. These systems consist of various components including networks, operating systems, and applications. There are various types of cyber-attacks that target the memory space used by applications. Just as the combat systems DiD will benefit from the ability to monitor its application memory’s cyber health, so would commercial sector systems.

REFERENCES:

1. Suh, G. Edward; Clarke, Dwaine; Gassend, Blaise; van Dijk, Marten; and Devadas, Srinivas. “Efficient Memory Integrity Verification and Encryption for Secure Processors.” MIT Computer Science and Artificial Intelligence Laboratory. URL last accessed 18

2. Yuh, Hin. “An Efficient Scheme to Provide Real-time Memory Integrity Protection.” May 2009. URL last accessed 18 April 2016. https://www.wpi.edu/Pubs/ETD/Available/etd-043009-183003/unrestricted/YHu.pdf.-

KEYWORDS: Cybersecurity; Applications Memory Space; Kernel Memory Space; Application Memory Integrity; Cyber Integrity Attacks; Buffer Overflow

Questions may also be submitted through DoD SBIR/STTR SITIS website.

TECHNOLOGY AREA(S): Battlespace, Electronics, Sensors

ACQUISITION PROGRAM: Air and Missile Defense Radar (AMDR) Program; AN/SPY-6 Radar

The technology within this topic is restricted under the International Traffic in Arms Regulation (ITAR), 22 CFR Parts 120-130, which controls the export and import of defense-related material and services, including export of sensitive technical data, or the Export Administration Regulation (EAR), 15 CFR Parts 730-774, which controls dual use items. Offerors must disclose any proposed use of foreign nationals (FNs), their country(ies) of origin, the type of visa or work permit possessed, and the statement of work (SOW) tasks intended for accomplishment by the FN(s) in accordance with section 5.4.c.(8) of the Announcement. Offerors are advised foreign nationals proposed to perform on this topic may be restricted due to the technical data under US Export Control Laws.

OBJECTIVE: Develop circulator technology for full integration at the MMIC level, compatible with Gallium Nitride (GaN) technology, for cost reduction and performance enhancement.

DESCRIPTION: Modern radar and electronic warfare (EW) transmitters are based on transmit and receive (T/R) modules as the fundamental building block. At the front end, these T/R modules contain both the radio frequency (RF) solid-state transmitter and receiver circuitry. Microwave circulators are typically used to separate the T/R channels, as well as provide protection to the sensitive receiver circuits during transmission of the high power radar pulse. Conventional microwave circulators are passive, but non-reciprocal, three-port devices that employ a ferrite material in the transmission path and an external permanent magnet to bias the ferrite. The non-reciprocal nature of the device allows signals to propagate freely in the forward direction, but presents a high insertion loss to signals travelling in the reverse direction – hence the ability to separate T/R channels. Circulators can be realized in virtually any transmission line family and are commonly built in waveguide, coax, and planar (especially microstrip and stripline) configurations.

When employed in T/R modules, circulators are typically bought as separate components and carefully mated to the active GaN high power amplifier (HPA) and receiver MMIC(s) during the T/R module assembly process. This not only adds to assembly, it creates junctions between the separate components that inevitably introduce reflection loss into the overall circuit. Matching, differences in substrate (i.e., RF) loss, and differing coefficients of thermal expansion (CTE) complicate design and restrict potential performance enhancements in deference to manufacturing and component compatibility considerations. The circulator itself occupies significant space in the T/R module, which is typically tightly packed. Finally, the circulator-biasing magnet itself, when totaled over many thousands of T/R modules present in a modern radar, contributes to weight and cost. Consequently, the ability to integrate the circulator with the HPA and receiver at the MMIC level would present a major step forward in microwave integrated circuit technology, reducing cost and opening the door to enhanced performance and completely new design possibilities.

Full (chip-level) integration of the circulator function has been proposed in only a couple of realizations. Active circuits that affect the circulator function have been demonstrated. However, active circulators consume power and degrade noise performance. In addition, given a strong enough return signal, active circuits are subject to saturation and potential damage. A quasi-passive approach proposes actively driven ring resonators mimic the magnetic dipoles of a ferrite. Although not employing active circuits directly in the transmission path, the technique still requires additional active elements to drive the ring resonators, takes up considerable space, and exhibits excessive insertion loss as compared to a truly passive circulator. Another proposed technique embeds ferromagnetic “nanowire” in the substrate, forming a magnet-free (self-biasing) and truly passive circulator. Unfortunately, this technique also presents high insertion loss and is difficult to realize in other than easily workable (e.g., organic) substrates. To date, only the purely active circulator technique appears to have been actually integrated at the chip level.