The Department of Defense, specifically the Navy, is seeking innovative solutions through the Small Business Innovation Research (SBIR) program to enhance resilience against supply chain cyber vulnerabilities in shipboard computing infrastructure. The objective is to develop technology that ensures the trustworthiness and cybersecurity of computing hardware integrated into future combat systems, addressing the complexities and security challenges posed by advanced multi-die systems and the Universal Chiplet Interconnect Express (UCIe) standard. This initiative is critical for maintaining operational integrity and security in military environments, with a focus on creating a comprehensive, multi-layered approach to computing infrastructure resilience (CIR). Interested parties should note that the solicitation is set to open on January 8, 2025, with applications due by February 5, 2025, and can find more information at the official SBIR website.

## Description

Shipboard computing infrastructure has evolved to over 3,000 Central Processor Unit (CPU) Cores that are distributed across multiple military grade cabinets. The cabinets can be in multiple spaces within a ship to ensure survivability if a set of cabinets are disabled or destroyed. Current CPUs within the cabinets are on Advanced Telecommunications Computing Architecture (ATCA) standard single board computer (i.e., blades). The distributed nature of shipboard computing poses significant challenges in ensuring security, robustness, trustworthiness, and performance of computing infrastructure. Infrastructure resilience is the ability of a computer infrastructure to adapt, mitigate, and respond to stresses within the Information Technology (IT) environment via the integration of software and applications. The IT system can transform itself to ensure that essential business functions and processes are maintained. In today&rsquo;s environment, cyber security is managed using a security information and event management (SIEM) embedded within the computing infrastructure (i.e., NIST SP 800-145 Infrastructure as a Service (IaaS)) or application services (e.g., NIST SP 800-145 Platform as a Service (PaaS)). Computer research in the area of advanced multi-die systems is achieving previously unheard-of levels of performance. Instead of one-size-fits-all monolithic silicon, multi-die systems are comprised of an array of heterogeneous dies (or &ldquo;chiplets&rdquo;), optimized for each functional component. Given the increase in performance and evolutionary trend of shipboard computing hardware over the past 30 years, it&rsquo;s fair to predict that eventually chiplets will find their way onto surface ships to meet evolving surface ship warfighting requirements (e.g., AI/ML, decision support, weapons coordination). While multi-die systems offer new levels of flexibility and achievement in system power and performance, they also introduce a high degree of design complexity and new security challenges. The Universal Chiplet Interconnect Express (UCIe) standard was introduced in March of 2022 to help standardize die-to-die connectivity in multi-die systems. UCIe can streamline interoperability between dies on different process technologies from various suppliers. But while a UCIe-compliant multi-die system may work great through development, testing, and manufacturing, can the system&rsquo;s die-to-die connectivity be ensured to continue&mdash;robust, secure, and tested&mdash; even while it&rsquo;s operating in the field? Having a mix of suppliers in a supply chain from various countries introduces security challenges within a chiplet-based architecture. Solving these challenges is of utmost importance for stakeholders. A comprehensive, multi-layered approach to address computing infrastructure resilience (CIR) and enhance the overall reliability and efficiency of edge computing environments is sought. There is no current commercial solution to address the approach needed. A solution needs to protect all surfaces beyond the trusted computing base (e.g., processor chip) as data moves around the system. It must ensure zero trust by always verifying data and sources within the computing infrastructure (attestation). It must also ensure least privilege by software and hardware components only having access to what they need to complete work (access control). This research needs to demonstrate the ability to modify settings and controls to ensure CIR under various conditions. Work produced in Phase II may become classified. Note: The prospective contractor(s) must be U.S. owned and operated with no foreign influence as defined by 32 U.S.C. &sect; 2004.20 et seq., National Industrial Security Program Executive Agent and Operating Manual, unless acceptable mitigating procedures can and have been implemented and approved by the Defense Counterintelligence and Security Agency (DCSA) formerly Defense Security Service (DSS). The selected contractor must be able to acquire and maintain a secret level facility and Personnel Security Clearances. This will allow contractor personnel to perform on advanced phases of this project as set forth by DCSA and NAVSEA in order to gain access to classified information pertaining to the national defense of the United States and its allies; this will be an inherent requirement. The selected company will be required to safeguard classified material during the advanced phases of this contract IAW the National Industrial Security Program Operating Manual (NISPOM), which can be found at Title 32, Part 2004.20 of the Code of Federal Regulations.

## Objective

Develop a technology that ensures computing hardware technologies integrated into future combat systems are trustworthy and cyber secure.

## Phase I

Develop a concept for CIR that meets the requirements stated in the Description. Demonstrate the feasibility of the concept in meeting the Navy&rsquo;s need through a combination of analysis, modeling, and simulation. The Phase I Option, if exercised, will include initial design specifications and capabilities description to build a prototype solution in Phase II.

## Phase II

Develop and deliver a prototype CIR based upon the results of Phase I. Demonstrate the prototype&rsquo;s functionality through various cybersecurity use cases that demonstrate that it meets the requirements of the Description. It is probable that the work under this effort will be classified under Phase II (see Description section for details).

## Phase III: Dual Use Applications

Support the Navy in transitioning the technology to Navy use. Provide a final CIR product that includes a set of design patterns, code examples, and compliance tests that provide guidance for CIR compliant implementations. Provide necessary product-level objective quality evidence to support product certification for use. It is anticipated that this CIR can become a standard industry and DoD computing infrastructure implementation. Commercial cloud environments (e.g., Amazon, Microsoft Azure) can benefit from this CIR as well as computing environments located within industry facilities.

Resilience against Supply Chain Cyber Vulnerabilities

SBIR Opportunity Analysis

SBIR Documents

Related SBIR/STTR Opportunities

Opportunity Snapshot

Key Dates