PKI-free, Zero Trust Workload Identity Trust Verification as Scale

OMB-M-22-09 mandates "continual verification of each user, device, application, and transaction,"Ā but todays' automated machine identity solutionsĀissueĀPKI certificatesĀupon request without trust verification. The trustworthiness of the workload is assumed and trust is sacrificed in the pursuit of speed and scale needed for cloud operations. Automated PKI identities depend on multiple centralized services that add complexity andĀcost. And they create identity trust boundaries that constrain workload connections and data sharing across all environments. Other shortcomings such asĀloss of workload trustĀhistory when certificates are replaced, andĀuncertain PKI survival due to theĀarrival of practical quantum computing are also of concern. As EO 14028 stated: ōIncremental improvements will not give us the security we need; instead, the Federal Government needs to make bold changes..." A new generation of machine identity credentials capable of meeting the "high bar" of trust verification of every transaction that was mandated by the OMBĀis needed to achieve cyber resiliency.???????ĀHopr has invented a bold commercial solution that uses decentralized identity and secrets management capabilitiesĀto meetĀthe OMB Zero Trust mandate. Workloads hold and manage their own Zero TrustĀidentities and secrets without any use of automated PKI, secrets storage, TLS key exchanges, or tokenized authentication. And the identity trust of each workload is verified at every communication session with other workloads. Current Federal guidance, such asĀNIST SP 800 207A ōZero Trust Cloud Architecture Model for Access Control in Cloud-Native Applications in Multi-Cloud Environmentsö endorses a model that relies on automated PKI and suggests trust assertions are adequateĀ¢ the model lacks trust verification and does not meet the Zero Trust mandate. It unintentionally misleads many organizations into believing it is a NIST standard and that automated PKI is Zero Trust. Hopr's PKI-free,Ādecentralized identity and secrets management approach is the only known solution to meeting the OMB Zero Trust mandate for identity trust verification at every transaction. Hopr's innovative solution augments the USAF investments in digital transformation for asymmetric cyber defense, assured communications, and cyber resilience in all cloud environments. The goals of this Phase I effort are: 1) to demonstrate the efficacy of HoprÆs commercial innovations for full Zero Trust capabilities to Air Force cyber and information security stakeholders that require Zero Trust resilient information sharing and assured communications. 2) obtain a USAF customer and MOU for Phase II award to implement a Defense-modified version of the commercial identity and secrets management capabilities, andĀ3) To influence Federal agencies, such as NISTĀand CISA, to consider/accept bold new identity trust capabilities to comply with the OMB mandate.