Secure Handling, Inspection, and Evaluation for Device Access

To address the Army’s need to determine the level of risk when a person uses a personal device to access Army resources (i.e., bring your own device (BYOD)) in accordance with zero trust principles, in Phase II Intellisense Systems, Inc. (Intellisense) proposes to advance the development of a new Secure Handling, Inspection, and Evaluation for Device Access (SHIELD) solution which was proven feasible in Phase I. SHIELD is based on a unique combination of the design guidelines set forth in National Institute of Standards and Technology Special Publication 800-207, advanced machine learning, and zero trust architecture. Specifically, the innovation in zero trust architecture with supporting machine learning components determines the level of trustworthiness (i.e., level of risk) when a person uses a personal device to access Army resources. In Phase I, Intellisense implemented the SHIELD zero trust software along with Docker containment for secure system access. We built upon this with our graph neural network component to analyze captured packet capture network access files. The SHIELD Phase I prototype was installed on Amazon Web Services (AWS), and we verified BYOD functionality by accessing a Python threat detection service located on AWS from a smartphone over the internet. Based on the solid Phase I results and feasibility demonstration, Intellisense will, in Phase II, complete the construction of a full-scale SHIELD prototype. The Phase II prototype will implement a set of guiding principles for workflow, system design, and operations to improve the security posture of Army resources. A policy engine and policy administrator will combine to form the policy decision point for user access. SHIELD will significantly lessen uncertainties by focusing on authentication, authorization, and restricting implicit trust zones. This will be accomplished without installing software on the personal device. The SHIELD solution will quantify the technical challenges, the risks and how they will be mitigated, and any resultant dependencies. The approach will be designed with a focus on open architecture and industry standards and protocols, which directly addresses the Army’s requirements. At the end of Phase II, a demonstration of SHIELD determining the trustworthiness of a personal device will be performed (specific device information will be provided by the Army after award). The demonstration will include the ability for observers to determine how the level of trustworthiness for a given device was measured (e.g., what specific device factors were used to determine the level of trustworthiness of the device, any configuration data used in the decision, and how that data was mapped to a level of trustworthiness).