OverKey: NIAP Validated Mesh VPN Product

Mesh networks are being adopted across the DAF – from the Space Surveillance Network and ABMS to radios for TACP Airmen. Mesh architectures are more resilient, more dynamic, and more scalable than traditional hub-and-spoke networks. Critically, there are no single points of failure in a mesh network. In a war of attrition, a peer adversary would need to expend ten times the resources – or more – to disable a mesh network.Today’s virtual private network (VPN) technology is ill-equipped to secure tomorrow’s mesh networks. Most VPNs adopt a client-server model wherein secure tunnels are created between clients (spoke) and a centralized server (hub). When a mesh network is secured with a hub-and-spoke VPN, it loses its resilience. The loss of a single node – the hub – can compromise the security posture of the entire network. VPN gateway nodes are therefore high-value targets.At Caliola, we built OverKey to radically simplify the deployment of end-to-end encryption in challenging environments. OverKey is a mesh VPN product that replaces the traditional hub-and-spoke VPN architecture with a distributed, self-configuring mesh that enables secure peer-to-peer communications over mesh networks and large-scale heterogeneous networks. We have deployed OverKey on top of mesh radios from Silvus, TrellisWare, and goTenna; on top of 5G cellular networks; on top of Starlink; and on top of the Internet.Caliola’s OverKey mesh VPN product is unique among functional alternatives because it was built specifically to satisfy statutory and regulatory requirements for use in DOD networks. OverKey is built on top of the same IPsec protocol stack that is used in hub-and-spoke VPN products from Cisco and Aruba. Moreover, OverKey only implements CNSA 2.0 algorithms for encryption, authentication, and key establishment.For OverKey to be procured for use in US National Security Systems, it must be evaluated by the National Information Assurance Partnership (NIAP). In this Direct-to-Phase II SBIR effort, Caliola will work with Gossamer Laboratories to take OverKey through NIAP validation. Following a successful NAIP evaluation, OverKey will be posted to the NIAP Product Compliant List and the NSA CSfC Component List. This will allow our non-defense commercial solution to be used in DOD networks with minimal approval and integration burden.The proposed Direct-to-Phase II SBIR effort will culminate with two demonstrations that show how OverKey could contribute to future mission-need fulfillment. In the first, we will demonstrate OverKey on top of a network comprising heterogeneous transports – e.g., wired, 5G cellular, and SATCOM – connecting mobile and fixed sites. This will prove the utility of OverKey in the Air Force DCGS Next Generation architecture to our DAF End-User. In the second, we will demonstrate OverKey in a layered CSfC Tactical Capability Package configuration. This will prove the utility of our product to a wider range of organizations.