The Department of Defense (DoD) is seeking proposals for a Phase I Small Business Innovation Research (SBIR) project titled "Secure Virtual SCIF within a SCIF for Agile and Distributed Operations Needing Enhanced Information Security." The objective is to design and demonstrate the technical feasibility of a software architecture that enables a virtual multi-layered Sensitive Compartmented Information Facility (SCIF), allowing secure data sharing within the Earth 616 platform's environment. This innovative approach aims to enhance information security by embedding a secondary SCIF within a primary SCIF, facilitating decentralized permissioning and secure data access for warfighters and decision-makers. Interested parties must submit their proposals by May 21, 2025, with further details available at the provided source link.

TECHNOLOGY AREAS: Trusted AI and Autonomy; Advanced Computing and Software; Hypersonics; Quantum Science; Integrated Network System-of-Systems; Sustainment & Logistics; Mission Readiness & Disaster Preparedness; Advanced Infrastructure & Advanced Manufacturing OBJECTIVE: The objective of this Phase I STTR project is to design and demonstrate the technical feasibility of a software architecture that realizes a virtual multi-layered SCIF or a “SCIF within a SCIF” capability for secure data sharing within the Earth 616 platform's environment. The focus of Phase I is to demonstrate the technical merit and feasibility of solutions in which data in a virtual SCIF embeds and obfuscates another SCIF, also containing data. In particular, the goal of this phase is to design and validate a mechanism where data in SCIF 2 is hidden in SCIF 1. Earth 616 digital credentialing capabilities are used to enable decentralized permissioning to data in SCIF 1, while SCIF 2 data is protected by a hidden gateway within SCIF 1. Access to the SCIF 2 gateway will require a complex set of steps involving a combination of secrets and deterministic key generation. SCIF 2 data access will further require Earth 616 digitally signed credentials and data decryption. The capability will enable numerous use cases and extend the state of the art in decentralized permissioning to data for use in secure multi-level data packaging and will provide a simple and secure compartmentalized data strategy for warfighters and decision makers who are most reliant on private, secure, critical and timely data to carry out the department's mission. A successful Phase I project will demonstrate that data can be held in a SCIF, with access to further data in a secondary SCIF secured within the primary SCIF, using cryptographic and other appropriate techniques will be used to obfuscate the secondary SCIF and provide its own layer of access and protection. The foundational work provided in Phase I can be further extended and validated in Phase II and applied to real-world use cases such as the KC-46 platform and its DIB supply chain. In the longer term, this project will be integrated into the Earth 616 framework and underpin an analytics platform that can ingest and analyze high volumes of heterogeneous data from multiple diverse sources, including participants from the DIB and open source feeds, while maintaining data integrity, traceability, and information security. The adoption of a multi-layer “SCIF within a SCIF” will provide unprecedented levels of information security and protection, allowing data to be securely shared among collaborating parties without compromise. DESCRIPTION: In the physical world, a Sensitive Compartmented Information Facility (SCIF) provides a secure environment for accessing confidential information. Inspired by the SCIF, a software-based virtual SCIF platform provides a secure online environment for accessing confidential data, such as that exchanged between DoD and vetted manufacturers in the Defense Industrial Base (DIB). The notion of a multi-layer “SCIF within a SCIF” seeks to create a hidden SCIF environment within a software SCIF so that a second set of data can be hidden within the first set, with its own levels of access control. This STTR project aims to provide novel software architectures and components that will allow the DoD to create and deploy an SCIF within an SCIF, securely protect data, and share data with appropriate authorized entities across the DIB and other multi-party collaborations. The work proposed to meet these objectives is as follows: Define requirements for securing SCIF within a SCIF data ● Conduct a domain analysis through collaboration with domain experts and outline representative use cases that can be used to drive requirements. ● Collaborate with industry experts and the POC to identify and define broad cryptography and obfuscation techniques ● Create a set of requirements with agreement among the stakeholders, including functional requirements, quality requirements, platform requirements, and process requirements. ● Perform a risk assessment of the cryptographic techniques and processes, including security, assessing quantum resistance, flexibility, scalability, and reusability. Define the Architecture and Design ● Create a software architecture focusing on developing the skeleton and high-level infrastructure that meet the defined requirements. Formalize this architecture using a UML/SysML diagram. ● Develop a design plan that sets expectations with customers and stakeholders and defines the different elements of the system, showing how they work together to fulfill the requirements. This will involve defining processes and specific cryptographic techniques, such as steganography, hashcodes, and symmetric key encryption, relevant to each stage in the design. Formalize this design using a UML/SysML diagram. An initial POC to demonstrate the viability of the approach ● Define the scope of the POC to demonstrate the viability of the system. ● Create a POC demonstration that conceptually shows how the system works. ● Demonstrate how the architecture and design meet the stakeholder’s requirements and apply this to the defined use cases to show how the system would function in practice. PHASE I: DAF requires a robust multi-layer data sharing solution, operating on decentralized principles, to securely share data across global ecosystems composed of multiple collaborating organizations, including operational support and vetted DIB members. The primary focus of the Phase I efforts will be to develop and demonstrate the feasibility of providing a virtual multi-layer SCIF within a SCIF environment. This will allow data to be hidden inside a SCIF, with further data held in an obfuscated secondary SCIF. This will become an essential component of a viable future AI-based supply chain predictive analytics platform operating in an ecosystem with the DIB. The Phase I project will lay the groundwork by thoroughly assessing current systems, identifying gaps, evaluating technological solutions, and developing a preliminary design and architecture to feed into a focused roadmap for implementation in Phase II. The analysis provided in Phase I will identify inefficiencies, bottlenecks, and areas for improvement and will engage with stakeholders to gather specific requirements and align the program's objectives with operational goals. Conducting small-scale tests during Phase I will help to test the feasibility and scalability of the proposed solutions. It is vital to identify and address technological and operational challenges early. An initial security assessment is vital to ensure that data permissions and compliance are met. A preliminary cost-benefit analysis will provide insights into the potential efficiency gains, cost savings, and return on investment. To this end, this Phase 1 project is designed to create an architecture that provides virtual multi-layer SCIF capabilities for secure data sharing among collaborators. The objective of this effort therefore is to identify information security and decentralized access protection approaches to facilitate SCIF operations. To accomplish this, Phase I focuses on three main tasks: Level 1 Data Access: Identify and validate an approach using decentralized technologies and cryptography to create a virtual SCIF environment, with access controls around the data it contains. A Gateway Between Level 1 and Level 2: Identify and validate the use of technologies including cryptography, hashes and steganography to embed an obfuscated gateway to a secondary “Level 2” SCIF within the primary “Level 1” SCIF. Level 2 Data Access: Provide an architecture that allows collaborators with appropriate access credentials and encryption keys to access the hidden Level 2 SCIF through an obfuscated gateway. The expected outcome of Phase I is a solution that is ready to develop to provide the underlying infrastructural requirement greatly needed to provide secure multi-layer data sharing across multi-actor ecosystems. Phase I deliverables shall include: ● Comprehensive system design documentation for a Virtual SCIF. ● Architecture and design documentation demonstrate how to achieve the required multi-layer virtual “SCIF within a SCIF” capabilities. ● Regular progress reports and technical documentation. ● Final architecture to include the following features: (1) virtual SCIF capabilities; (2) nested, obfuscated secondary SCIF capabilities; (3) Access control to SCIF and embedded SCIF via decentralized DID & VC-based approaches. ● Phase II Planning: A detailed roadmap for the Phase II research and development effort Identifying key milestones, deliverables, and resource requirements for Phase II. Throughout the duration of the project, the provider will work in close partnership with the DAF technical point of contact (TPOC), ensuring regular communication through scheduled meetings and comprehensive technical reports. These collective efforts will result in a robust, scalable, and secure virtual SCIF system, poised to revolutionize multi-party information and data sharing. The success criteria for Phase I are: 1. Demonstrated approach to providing a Virtual SCIF 2. Documentation of the approach to providing an obfuscated Gateway within a SCIF 3. Documentation of the approach to access mediation to the level 2 SCIF via the Gateway 4. Positive feedback from DAF stakeholders on proposed designs and concepts 5. Delivery of a comprehensive and actionable plan for Phase II development PHASE II: Building upon a successful outcome to Phase I which demonstrates the technical feasibility of approaches to securely sharing data within a multi-layer virtual SCIF within a SCIF environment, the Phase II will extend the work to implement the architecture and design created in Phase I, advancing the capabilities of a secure multi-party data sharing platform for participants across the DAF supply chain. The Phase II project will build on the current state of the art to advance the Technology Readiness Level (TRL) in all technology areas by implementing the solution. Phase II will build on the current state of the art to advance the Technology Readiness Level (TRL) in all technology areas by delivering designs and physical prototypes that demonstrate the concept. Phase II will focus on research, development, Quality Assurance and Testing, along with refinement based on regular meetings and technical reports coordinated with the technical point of contact (TPOC). The outcome will be a well-defined prototype that meets the specified requirements and expectations, and that is ready to integrate within the Earth 616 platform. Period of performance is 18 months to achieve key tasks, milestones and tangible results. The objectives are as follows: Objective 1: Virtual SCIF. Performers shall design and develop a Virtual SCIF data environment and demonstrate that data can be uploaded and protected by access policies that require parties to present proof that they hold the necessary credentials, issued to them by appropriate authorities. Objective 2: SCIF Gateway. Performers will demonstrate how parties with the correct credentials are able to locate an obfuscated Gateway within the data in the SCIF. Objective 3: Accessing Level 2 SCIF via Gateway. Performers will demonstrate how parties with sufficient credentials and knowledge of the Gateway would be able to access the Gateway. This involves presenting credentials and appropriate keys to access data secreted within the Level 2 embedded SCIF. Objective 4: System Integration. Performers should demonstrate how the Virtual SCIF would integrate with existing DAF systems, ensuring seamless data flow, configuration and interoperability. Performers must conduct end-to-end testing to validate the integrated system’s functionality, performance, and reliability. Objective 5: User Training and Support. Performers need to develop comprehensive training materials to equip users with the skills to use these new capabilities, along with hands-on training sessions and workshops. Objective 6: QA Testing and Evaluation. Performers should implement a comprehensive test plan and build QA tools to automate testing, as well as collecting feedback to identify areas for improvement. The evaluation of the pilot results against predefined success criteria should be undertaken, making necessary adjustments before full-scale deployment. Objective 7: Ongoing Performance Metrics. Performers should define key performance indicators (KPIs) to measure the effectiveness and impact of the system. A successful Phase II effort will develop the Virtual SCIF with a SCIF system and meet the scientific, technical, and commercial merits. By focusing on robust development, comprehensive QA testing, user training, and improvement, this phase aims to deliver a well-defined, operational prototype that offers the Air Force innovative new capabilities that enable it to securely and flexibly share data critical to support supply chain operations across a multi-tiered DIB. A successful Phase II effort will deliver the following: Level 1 Virtual SCIF: A secure SCIF environment for sharing sensitive data and information with collaborators Access to data protected by attribute-based access control and verifiable credentials Level 1 to Level 2 SCIF Gateway: Hidden within the data of a SCIF will be a Gateway which provides secured access to a further corpus of data, within an embedded SCIF. The Gateway will only be visible to actors with the correct credentials and knowledge of how to access it. Level 2 Embedded SCIF: An embedded SCIF held within the primary SCIF, and accessed through a secure Gateway. Data access will further require credentials and data decryption keys. Evaluation: QA testing should provide automated testing of the implemented system Customer feedback should be addressed in the final prototype The system must meet the requirements of the TPOC Example Project Timeline and Milestones Months 1-2: Requirement refinements and Updated Architecture and Design Documents Months 2-9: Implement the Virtual SCIF environment, design the SCIF Gateway and the Layer 2 embedded SCIF Months 10-12: QA Testing of initial system implementation and gather customer feedback about approach and gaps in the approach Months 13-17: Full-Scale Deployment of final system, user training and support and performance evaluation Months 18-20: QA testing and demonstration of the final system and project review PHASE III DUAL USE APPLICATIONS: In Phase III, the Virtual SCIF project will focus on scaling and fully deploying the technology across Department of the Air Force (DAF) environments, ensuring it meets operational requirements and integrates with existing systems. Key elements of the Phase III effort will include: ● System Integration: Integrating the Virtual SCIF solution with existing DAF command and control (C2) systems, cybersecurity infrastructures, and communication networks to ensure interoperability with other defense IT systems. ● Scalability and Performance Optimization: Enhancing the solution’s scalability to support varied mission demands and optimizing the performance of blockchain, DID, and VC elements to handle high volumes of classified data in real time. ● Training and Documentation: Providing comprehensive training programs and detailed documentation to enable DAF personnel to effectively manage, access, and operate within the Virtual SCIF environment. ● Cybersecurity Stress Testing and Evaluation: Conduct extensive cybersecurity assessments and penetration testing to validate the Virtual SCIF’s resilience and security against advanced adversarial threats. Expected Technology Readiness Level (TRL) at Phase III Entry The expected Technology Readiness Level (TRL) at the start of Phase III is TRL 7, indicating that the Virtual SCIF will have been demonstrated in an operational environment, proving its effectiveness in controlled DAF field tests and supporting real-time operations. Transition Planning and Known Government Approvals The Virtual SCIF project will require the following approvals and transition planning steps: ● DAF Cybersecurity and Information Assurance Approval: Compliance with the DAF cybersecurity division’s requirements, including successful completion of assessments under the DoD’s Risk Management Framework (RMF). ● DoD Authority to Operate (ATO): The project must secure an ATO with Earth 616 for operational deployment and demonstrate compliance with DoD cybersecurity policies and controls. ● Coordination with the Air Force Research Laboratory (AFRL): Close collaboration with AFRL to ensure alignment with ongoing DAF modernization initiatives and technology goals. ● Interagency and Cross-Department Communication: Coordination with other DoD branches, including Army and Navy cybersecurity and intelligence programs, to prepare for cross-departmental collaboration in future joint operations. Additional DAF Customer Opportunities Further applications of the Virtual SCIF solution within the DAF include: ● Advanced Battle Management System (ABMS): Serving as a secure data-sharing platform for ABMS, enhancing real-time command and control across joint forces. ● Agile Combat Employment (ACE): Supporting rapid deployment and secure data access in dispersed and contested environments critical to ACE initiatives. ● DAF Intelligence, Surveillance, and Reconnaissance (ISR): Enabling secure, distributed access to classified ISR data for mission planning and operational decision-making. ● Collaboration with Coalition Partners: Facilitating secure, blockchain-based data sharing with trusted coalition partners, enhancing multi-national defense operations. This Phase III plan ensures that the Virtual SCIF will be fully operational, secure, and strategically valuable to the DAF, supporting modernization efforts and boosting mission readiness and flexibility. REFERENCES: 1. Crosby, M., et al. "Blockchain Technology: Principles and applications." University of California Berkeley, 2016; 2. Kshetri, N. "Blockchain’s roles in meeting key supply chain management objectives." International Journal of Information Management, 2018; 3. Agrafiotis, I., Nurse, J.R., Goldsmith, M., Creese, S., Upton, D. "A taxonomy of cyber-harms: Defining the impacts of cyber-attacks and understanding how they propagate." Journal of Cybersecurity, 2018; 4. Sporny, M., et al. "Decentralized Identifiers (DIDs) v1.0: Core architecture, data model, and representations." W3C Recommendation, 2021; 5. Hardman, D., et al. "Verifiable Credentials Data Model 1.0." W3C Recommendation, 2019; 6. NSA. "NSA/CSS Policy Manual 3-16: Protective Distribution Systems." National Security Agency (NSA), 2018; 7. NIST. "Security and Privacy Controls for Federal Information Systems and Organizations." NIST Special Publication 800-53 Rev. 4, 2013; 8. DoD Instruction 5200.01: "DoD Information Security Program and Protection of Sensitive Compartmented Information." Department of Defense (DoD), 2018; 9. Office of the Director of National Intelligence (ODNI). "Sensitive Compartmented Information Facilities (SCIF) Standards." ODNI Tech Spec, 2020. KEYWORDS: Virtual SCIF, Blockchain Technology, Decentralized Identifiers (DIDs), Verifiable Credentials (VCs), Secure Information Sharing, Identity Management, Data Integrity, Cybersecurity, Access Control, Command and Control (C2), Air Force Modernization, Agile Combat Employment (ACE), Advanced Battle Management System (ABMS), Distributed Operations, Digital Transformation, Information Assurance, Resilient Infrastructure, Secure Access Management, Data Governance, Mission-Critical Security

Topic

Agency

Program

Topic Link

Additional Information