81_FR_86161 81 FR 85932 - National Cybersecurity Center of Excellence (NCCoE) Mobile Application Single Sign On (SSO) for the Public Safety & First Responder Sector

81 FR 85932 - National Cybersecurity Center of Excellence (NCCoE) Mobile Application Single Sign On (SSO) for the Public Safety & First Responder Sector

DEPARTMENT OF COMMERCE
National Institute of Standards and Technology

Federal Register Volume 81, Issue 229 (November 29, 2016)

Page Range85932-85934
FR Document2016-28627

The National Institute of Standards and Technology (NIST) invites organizations to provide products and technical expertise to support and demonstrate security platforms for Mobile Application Single Sign On (SSO) for the Public Safety & First Responder sector. This notice is the initial step for the National Cybersecurity Center of Excellence (NCCoE) in collaborating with technology companies to address cybersecurity challenges identified under the Public Safety & First Responder sector program. Participation in the use case is open to all interested organizations.

Federal Register, Volume 81 Issue 229 (Tuesday, November 29, 2016)
[Federal Register Volume 81, Number 229 (Tuesday, November 29, 2016)]
[Notices]
[Pages 85932-85934]
From the Federal Register Online  [www.thefederalregister.org]
[FR Doc No: 2016-28627]


-----------------------------------------------------------------------

DEPARTMENT OF COMMERCE

National Institute of Standards and Technology

[Docket No.: 160830797-6797-01]


National Cybersecurity Center of Excellence (NCCoE) Mobile 
Application Single Sign On (SSO) for the Public Safety & First 
Responder Sector

AGENCY: National Institute of Standards and Technology, Department of 
Commerce.

ACTION: Notice.

-----------------------------------------------------------------------

SUMMARY: The National Institute of Standards and Technology (NIST) 
invites organizations to provide products and technical expertise to 
support and demonstrate security platforms for Mobile Application 
Single Sign On (SSO) for the Public Safety & First Responder sector. 
This notice is the initial step for the National Cybersecurity Center 
of Excellence (NCCoE) in collaborating with technology companies to 
address cybersecurity challenges identified under the Public Safety & 
First Responder sector program. Participation in the use case is open 
to all interested organizations.

DATES: Interested parties must contact NIST to request a letter of 
interest template to be completed and submitted to NIST. Letters of 
interest will be accepted on a first come, first served basis. 
Collaborative activities will commence as soon as enough completed and 
signed letters of interest have been returned to address all the 
necessary components and capabilities, but no earlier than December 29, 
2016. When the use case has been completed, NIST will post a notice on 
the NCCoE Public Safety & First Responder sector program Web site at 
https://nccoe.nist.gov/projects/building_blocks/mobile-sso announcing 
the completion of the use case and informing the public that it will no 
longer accept letters of interest for this use case.

ADDRESSES: The NCCoE is located at 9700 Great Seneca Highway, 
Rockville, MD 20850. Letters of interest must be submitted to [email protected] or via hardcopy to National Institute of Standards and 
Technology, 100 Bureau Drive Mail Stop 2002, Gaithersburg, MD 20899. 
Organizations whose letters of interest are accepted in accordance with 
the process set forth in the SUPPLEMENTARY INFORMATION section of this 
notice will be asked to sign a Cooperative Research and Development 
Agreement (CRADA) with NIST. A

[[Page 85933]]

CRADA template can be found at: http://nccoe.nist.gov/node/138.

FOR FURTHER INFORMATION CONTACT: Paul Grassi or William Fisher via 
email to [email protected]; by telephone 301-975-0200; or by mail to 
National Institute of Standards and Technology, NCCoE; 100 Bureau Drive 
Mail Stop 2002, Gaithersburg, MD 20899. Additional details about the 
Public Safety & First Responder sector program are available at https://nccoe.nist.gov/projects/building_blocks/mobile-sso.

SUPPLEMENTARY INFORMATION:
    Background: The NCCoE, part of NIST, is a public-private 
collaboration for accelerating the widespread adoption of integrated 
cybersecurity tools and technologies. The NCCoE brings together experts 
from industry, government, and academia under one roof to develop 
practical, interoperable cybersecurity approaches that address the 
real-world needs of complex Information Technology (IT) systems. By 
accelerating dissemination and use of these integrated tools and 
technologies for protecting IT assets, the NCCoE will enhance trust in 
U.S. IT communications, data, and storage systems; reduce risk for 
companies and individuals using IT systems; and encourage development 
of innovative, job-creating cybersecurity products and services.
    Process: NIST is soliciting responses from all sources of relevant 
security capabilities (see below) to enter into a Cooperative Research 
and Development Agreement (CRADA) to provide products and technical 
expertise to support and demonstrate security platforms for the Mobile 
Application Single Sign On (SSO) for the Public Safety & First 
Responder Sector. The full use case can be viewed at: https://nccoe.nist.gov/projects/building_blocks/mobile-sso.
    Interested parties should contact NIST using the information 
provided in the FOR FURTHER INFORMATION CONTACT section of this notice. 
NIST will then provide each interested party with a letter of interest 
template, which the party must complete, certify that it is accurate, 
and submit to NIST. NIST will contact interested parties if there are 
questions regarding the responsiveness of the letters of interest to 
the use case objective or requirements identified below. NIST will 
select participants who have submitted complete letters of interest on 
a first come, first served basis within each category of product 
components or capabilities listed below up to the number of 
participants in each category necessary to carry out this use case. 
However, there may be continuing opportunity to participate even after 
initial activity commences. Selected participants will be required to 
enter into a consortium CRADA with NIST (for reference, see ADDRESSES 
section above). NIST published a notice in the Federal Register on 
October 19, 2012 (77 FR 64314) inviting U.S. companies to enter into 
National Cybersecurity Excellence Partnerships (NCEPs) in furtherance 
of the NCCoE. For this demonstration project, NCEP partners will not be 
given priority for participation.

Use Case Objective

    When responding to an emergency, public safety personnel require 
on-demand access to data. The ability to quickly and securely 
authenticate in order to access public safety data is critical to 
ensuring that first responders can deliver the proper care and support 
during an emergency. In order to adequately meet the need of diverse 
public safety personnel, missions, and operational environments, 
authentication mechanisms need to support deployments where devices may 
be shared amongst personnel and authentication factors have usability 
constraints.
    The challenge that first responders face in authenticating quickly 
and securely to public safety systems is compounded when a first 
responder is forced to authenticate individually to multiple mobile 
applications. In addition, when authorizing application access to 
shared resources, first responders may be subjected to an additional 
authentication step at the resource provider. To address the challenge 
identified by the public safety community, the National Cybersecurity 
Center of Excellence (NCCoE) plans to develop a Mobile Application 
Single Sign On (SSO) reference design and implementation that meets 
these unique authentication requirements and allows first responders to 
take advantage of the latest mobile authentication technology and best 
practices.
    A detailed description of the Mobile Application Single Sign On 
(SSO) is available at: https://nccoe.nist.gov/projects/building_blocks/mobile-sso.
    Requirements: Each responding organization's letter of interest 
should identify which security platform component(s) or capability(ies) 
it is offering. Letters of interest should not include company 
proprietary information, and all components and capabilities must be 
commercially available. Components are listed in section 3 of the 
Mobile Application Single Sign On (SSO) for the Public Safety & First 
Responder use case (for reference, please see the link in the PROCESS 
section above) and include, but are not limited to:

     Mobile devices
     Mobile platforms for biometric authentication
 Hardware based authenticators that interoperate with mobile 
platforms
 Software Development Kit (SDK) or platform that enables mobile 
single sign on capabilities

    Each responding organization's letter of interest should identify 
how their products address one or more of the following desired 
solution characteristics in section 3 of the Mobile Application Single 
Sign On (SSO) for the Public Safety & First Responder use case (for 
reference, please see the link in the PROCESS section above):
    1. A standards-based approach and a solution architecture that 
selects the most effective and secure approach to implement mobile SSO 
leveraging native capabilities of the mobile OS.
    2. Support mobile SSO both for authentication and delegated 
authorization (as in OAuth Client Applications).
    3. Ensure that mobile applications do not have access to user 
credentials.
    4. Support multiple authenticators taking into account unique 
environmental constraints faced by first responders in emergency 
medical services, law enforcement, and the fire service such as:

a. Gloved, one-handed, or hands-free operation
b. Use of smoke hoods, fire hoods or gas masks that may prevent facial 
or iris recognition
c. Proximity based authenticators (new yubikeys)
d. Biometric based continuous authentication mechanisms that meet the 
requirements of draft NIST Special Publication 800-63B

    5. Allow multi-user operation of shared mobile devices.
    6. Support for multiple authentication protocols. If appropriate, 
public sector agencies must be able to leverage multifactor 
authentication. This may be accomplished by adopting Fast IDentity 
Online (FIDO 2.0) Universal Authentication Framework (UAF), Universal 
2nd Factor (U2F), PKI, or some other means.
    7. Support a spectrum of BYOD (Bring Your Own Device) and COPE 
(Corporate Owned, Personally Enabled) scenarios.
    Responding organizations need to understand and, in their letters 
of interest, commit to provide:

1. Access for all participants' project teams to component interfaces 
and the organization's experts necessary

[[Page 85934]]

to make functional connections among security platform components
2. Support for development and demonstration of the Mobile Application 
Single Sign On (SSO) for the Public Safety & First Responder use case 
in NCCoE facilities which will be conducted in a manner consistent with 
Federal requirements (e.g., FIPS 200, FIPS 201, SP 800-53, and SP 800-
63)

    Additional details about the Mobile Application Single Sign On 
(SSO) for the Public Safety & First Responder sector use case are 
available at: https://nccoe.nist.gov/projects/building_blocks/mobile-sso.
    NIST cannot guarantee that all of the products proposed by 
respondents will be used in the demonstration. Each prospective 
participant will be expected to work collaboratively with NIST staff 
and other project participants under the terms of the consortium CRADA 
in the development of the Mobile Application Single Sign On (SSO) for 
the Public Safety & First Responder sector capability. Prospective 
participants' contribution to the collaborative effort will include 
assistance in establishing the necessary interface functionality, 
connection and set-up capabilities and procedures, demonstration 
harnesses, environmental and safety conditions for use, integrated 
platform user instructions, and demonstration plans and scripts 
necessary to demonstrate the desired capabilities. Each participant 
will train NIST personnel, as necessary, to operate its product in 
capability demonstrations to the Public Safety & First Responder 
community. Following successful demonstrations, NIST will publish a 
description of the security platform and its performance 
characteristics sufficient to permit other organizations to develop and 
deploy security platforms that meet the security objectives of the 
Mobile Application Single Sign On (SSO) for the Public Safety & First 
Responder sector use case. These descriptions will be public 
information.
    Under the terms of the consortium CRADA, NIST will support 
development of interfaces among participants' products by providing IT 
infrastructure, laboratory facilities, office facilities, collaboration 
facilities, and staff support to component composition, security 
platform documentation, and demonstration activities.
    The dates of the demonstration of the Mobile Application Single 
Sign On (SSO) for the Public Safety & First Responder sector capability 
will be announced on the NCCoE Web site at least two weeks in advance 
at http://nccoe.nist.gov/. The expected outcome of the demonstration is 
to improve mobile application single sign-on across an entire Public 
Safety & First Responder sector enterprise. Participating organizations 
will gain from the knowledge that their products are interoperable with 
other participants' offerings.
    For additional information on the NCCoE governance, business 
processes, and NCCoE operational structure, visit the NCCoE Web site 
http://nccoe.nist.gov/.

Kent Rochford,
Associate Director for Laboratory Programs.
[FR Doc. 2016-28627 Filed 11-28-16; 8:45 am]
 BILLING CODE 3510-13-P



                                                    85932                      Federal Register / Vol. 81, No. 229 / Tuesday, November 29, 2016 / Notices

                                                       (b) With a Brinell hardness measured in all             • Nickel 3.0–3.5,                                  DEPARTMENT OF COMMERCE
                                                    parts of the product including mid thickness               • Sulfur not greater than 0.010,
                                                    falling within one of the following ranges:                • Phosphorus not greater than 0.020,               National Institute of Standards and
                                                       (i) 270–300 HBW,                                        • Chromium 1.0–1.5,                                Technology
                                                       (ii) 290–320 HBW, or                                    • Molybdenum 0.6–0.9,
                                                       (iii) 320–350 HBW;                                                                                         [Docket No.: 160830797–6797–01]
                                                                                                               • Vanadium 0.08 to 0.12
                                                       (c) Having cleanliness in accordance with
                                                    ASTM E45 method A (Thin and Heavy): A                      • Boron 0.002–0.004,
                                                                                                                                                                  National Cybersecurity Center of
                                                    not exceeding 1.5, B not exceeding 1.0, C not              • Oxygen not greater than 20 ppm,
                                                                                                                                                                  Excellence (NCCoE) Mobile
                                                    exceeding 0.5, D not exceeding 1.5; and                    • Hydrogen not greater than 2 ppm, and
                                                                                                               • Nitrogen not greater than 60 ppm.
                                                                                                                                                                  Application Single Sign On (SSO) for
                                                       (d) Conforming to ASTM A578–S9
                                                    ultrasonic testing requirements with                       (b) Having cleanliness in accordance with
                                                                                                                                                                  the Public Safety & First Responder
                                                    acceptance criteria 2 mm flat bottom hole;              ASTM E45 method A (Thin and Heavy): A
                                                                                                                                                                  Sector
                                                       (6) Alloy forged and rolled steel CTL plate          not exceeding 1.0(t) and 0.5(h), B not                AGENCY: National Institute of Standards
                                                    over 407 mm in actual thickness and meeting             exceeding 1.5(t) and 1.0(h), C not exceeding
                                                    the following requirements:                                                                                   and Technology, Department of
                                                                                                            1.0(t) and 0.5(h), and D not exceeding 1.5(t)         Commerce.
                                                       (a) Made from Electric Arc Furnace melted,
                                                                                                            and 1.0(h);
                                                    Ladle refined & vacuum degassed, alloy steel                                                                  ACTION: Notice.
                                                    with the following chemical composition                    (c) Having the following mechanical
                                                    (expressed in weight percentages):                      properties: A Brinell hardness not less than          SUMMARY:    The National Institute of
                                                       • Carbon 0.23–0.28,                                  350 HBW measured in all parts of the                  Standards and Technology (NIST)
                                                       • Silicon 0.05–0.15,                                 product including mid thickness; and having           invites organizations to provide
                                                       • Manganese 1.20–1.50,                               a Yield Strength of 145 ksi or more and UTS           products and technical expertise to
                                                       • Nickel not greater than 0.4,                       160 ksi or more, Elongation of 15% or more            support and demonstrate security
                                                       • Sulfur not greater than 0.010,                     and Reduction of area 35% or more; having
                                                       • Phosphorus not greater than 0.020,                                                                       platforms for Mobile Application Single
                                                                                                            charpy V at ¥40 degrees F in the transverse           Sign On (SSO) for the Public Safety &
                                                       • Chromium 1.20–1.50,                                direction equal or greater than 20 ft. lbs
                                                       • Molybdenum 0.35–0.55,                                                                                    First Responder sector. This notice is
                                                                                                            (single value) and equal or greater than 25 ft.
                                                       • Boron 0.002–0.004,                                                                                       the initial step for the National
                                                                                                            lbs (average of 3 specimens);
                                                       • Oxygen not greater than 20 ppm,                                                                          Cybersecurity Center of Excellence
                                                       • Hydrogen not greater than 2 ppm, and                  (d) Conforming to ASTM A578–S9
                                                                                                                                                                  (NCCoE) in collaborating with
                                                       • Nitrogen not greater than 60 ppm;                  ultrasonic testing requirements with
                                                                                                                                                                  technology companies to address
                                                       (b) Having cleanliness in accordance with            acceptance criteria 3.2 mm flat bottom hole;
                                                                                                                                                                  cybersecurity challenges identified
                                                    ASTM E45 method A (Thin and Heavy): A                   and
                                                                                                                                                                  under the Public Safety & First
                                                    not exceeding 1.5, B not exceeding 1.5, C not              (e) Conforming to magnetic particle
                                                    exceeding 1.0, D not exceeding 1.5;                                                                           Responder sector program. Participation
                                                                                                            inspection in accordance with AMS 2301.
                                                       (c) Having the following mechanical                     The products subject to the investigation
                                                                                                                                                                  in the use case is open to all interested
                                                    properties:                                             are currently classified in the Harmonized
                                                                                                                                                                  organizations.
                                                       (i) With a Brinell hardness not more than            Tariff Schedule of the United States (HTSUS)          DATES: Interested parties must contact
                                                    237 HBW measured in all parts of the                    under item numbers: 7208.40.3030,                     NIST to request a letter of interest
                                                    product including mid thickness; and having                                                                   template to be completed and submitted
                                                                                                            7208.40.3060, 7208.51.0030, 7208.51.0045,
                                                    a Yield Strength of 75 ksi min and UTS 95
                                                                                                            7208.51.0060, 7208.52.0000, 7211.13.0000,             to NIST. Letters of interest will be
                                                    ksi or more, Elongation of 18% or more and
                                                    Reduction of area 35% or more; having                   7211.14.0030, 7211.14.0045, 7225.40.1110,             accepted on a first come, first served
                                                    charpy V at ¥75 degrees F in the                        7225.40.1180, 7225.40.3005, 7225.40.3050,             basis. Collaborative activities will
                                                    longitudinal direction equal or greater than            7226.20.0000, and 7226.91.5000.                       commence as soon as enough completed
                                                    15 ft. lbs (single value) and equal or greater             The products subject to the investigation          and signed letters of interest have been
                                                    than 20 ft. lbs (average of 3 specimens) and            may also enter under the following HTSUS              returned to address all the necessary
                                                    conforming to the requirements of NACE                  item numbers: 7208.40.6060, 7208.53.0000,             components and capabilities, but no
                                                    MR01–75; or                                             7208.90.0000, 7210.70.3000, 7210.90.9000,             earlier than December 29, 2016. When
                                                       (ii) With a Brinell hardness not less than           7211.19.1500, 7211.19.2000, 7211.19.4500,             the use case has been completed, NIST
                                                    240 HBW measured in all parts of the                    7211.19.6000, 7211.19.7590, 7211.90.0000,             will post a notice on the NCCoE Public
                                                    product including mid thickness; and having
                                                    a Yield Strength of 90 ksi min and UTS 110
                                                                                                            7212.40.1000, 7212.40.5000, 7212.50.0000,             Safety & First Responder sector program
                                                    ksi or more, Elongation of 15% or more and              7214.10.0000, 7214.30.0010, 7214.30.0080,             Web site at https://nccoe.nist.gov/
                                                    Reduction of area 30% or more; having                   7214.91.0015, 7214.91.0060, 7214.91.0090,             projects/building_blocks/mobile-sso
                                                    charpy V at ¥40 degrees F in the                        7225.11.0000, 7225.19.0000, 7225.40.5110,             announcing the completion of the use
                                                    longitudinal direction equal or greater than            7225.40.5130, 7225.40.5160, 7225.40.7000,             case and informing the public that it
                                                    21 ft. lbs (single value) and equal or greater          7225.99.0010, 7225.99.0090, 7226.11.1000,             will no longer accept letters of interest
                                                    than 31 ft. lbs (average of 3 specimens);               7226.11.9060, 7226.19.1000, 7226.19.9000,             for this use case.
                                                       (d) Conforming to ASTM A578–S9                       7226.91.0500, 7226.91.1530, 7226.91.1560,
                                                                                                                                                                  ADDRESSES: The NCCoE is located at
                                                    ultrasonic testing requirements with                    7226.91.2530, 7226.91.2560, 7226.91.7000,
                                                    acceptance criteria 3.2 mm flat bottom hole;                                                                  9700 Great Seneca Highway, Rockville,
                                                                                                            7226.91.8000, and 7226.99.0180.
                                                    and                                                                                                           MD 20850. Letters of interest must be
                                                                                                               The HTSUS subheadings above are
                                                       (e) Conforming to magnetic particle                                                                        submitted to PSFR–NCCoE@nist.gov or
                                                                                                            provided for convenience and customs
                                                    inspection in accordance with AMS 2301;                                                                       via hardcopy to National Institute of
                                                       (7) Alloy forged and rolled steel CTL plate          purposes only. The written description of the
                                                                                                                                                                  Standards and Technology, 100 Bureau
asabaliauskas on DSK3SPTVN1PROD with NOTICES




                                                    over 407 mm in actual thickness and meeting             scope of the investigation is dispositive.
                                                                                                                                                                  Drive Mail Stop 2002, Gaithersburg, MD
                                                    the following requirements:                             [FR Doc. 2016–28703 Filed 11–28–16; 8:45 am]          20899. Organizations whose letters of
                                                       (a) Made from Electric Arc Furnace melted,           BILLING CODE 3510–DS–P                                interest are accepted in accordance with
                                                    ladle refined & vacuum degassed, alloy steel
                                                    with the following chemical composition                                                                       the process set forth in the
                                                    (expressed in weight percentages):                                                                            SUPPLEMENTARY INFORMATION section of
                                                       • Carbon 0.25–0.30,                                                                                        this notice will be asked to sign a
                                                       • Silicon not greater than 0.25,                                                                           Cooperative Research and Development
                                                       • Manganese not greater than 0.50,                                                                         Agreement (CRADA) with NIST. A


                                               VerDate Sep<11>2014   17:48 Nov 28, 2016   Jkt 241001   PO 00000   Frm 00013   Fmt 4703   Sfmt 4703   E:\FR\FM\29NON1.SGM   29NON1


                                                                               Federal Register / Vol. 81, No. 229 / Tuesday, November 29, 2016 / Notices                                            85933

                                                    CRADA template can be found at:                         opportunity to participate even after                 reference, please see the link in the
                                                    http://nccoe.nist.gov/node/138.                         initial activity commences. Selected                  PROCESS section above) and include,
                                                    FOR FURTHER INFORMATION CONTACT:      Paul              participants will be required to enter                but are not limited to:
                                                    Grassi or William Fisher via email to                   into a consortium CRADA with NIST                        • Mobile devices
                                                    PSFR–NCCoE@nist.gov; by telephone                       (for reference, see ADDRESSES section                    • Mobile platforms for biometric
                                                    301–975–0200; or by mail to National                    above). NIST published a notice in the                authentication
                                                    Institute of Standards and Technology,                  Federal Register on October 19, 2012                  • Hardware based authenticators that
                                                    NCCoE; 100 Bureau Drive Mail Stop                       (77 FR 64314) inviting U.S. companies                    interoperate with mobile platforms
                                                    2002, Gaithersburg, MD 20899.                           to enter into National Cybersecurity                  • Software Development Kit (SDK) or
                                                    Additional details about the Public                     Excellence Partnerships (NCEPs) in                       platform that enables mobile single
                                                    Safety & First Responder sector program                 furtherance of the NCCoE. For this                       sign on capabilities
                                                    are available at https://nccoe.nist.gov/                demonstration project, NCEP partners                     Each responding organization’s letter
                                                    projects/building_blocks/mobile-sso.                    will not be given priority for                        of interest should identify how their
                                                    SUPPLEMENTARY INFORMATION:
                                                                                                            participation.                                        products address one or more of the
                                                       Background: The NCCoE, part of                       Use Case Objective                                    following desired solution
                                                    NIST, is a public-private collaboration                                                                       characteristics in section 3 of the Mobile
                                                                                                               When responding to an emergency,
                                                    for accelerating the widespread                                                                               Application Single Sign On (SSO) for
                                                                                                            public safety personnel require on-
                                                    adoption of integrated cybersecurity                                                                          the Public Safety & First Responder use
                                                                                                            demand access to data. The ability to
                                                    tools and technologies. The NCCoE                                                                             case (for reference, please see the link in
                                                                                                            quickly and securely authenticate in
                                                    brings together experts from industry,                                                                        the PROCESS section above):
                                                                                                            order to access public safety data is
                                                    government, and academia under one                                                                               1. A standards-based approach and a
                                                                                                            critical to ensuring that first responders
                                                    roof to develop practical, interoperable                                                                      solution architecture that selects the
                                                                                                            can deliver the proper care and support
                                                    cybersecurity approaches that address                                                                         most effective and secure approach to
                                                                                                            during an emergency. In order to
                                                    the real-world needs of complex                                                                               implement mobile SSO leveraging
                                                                                                            adequately meet the need of diverse
                                                    Information Technology (IT) systems.                                                                          native capabilities of the mobile OS.
                                                                                                            public safety personnel, missions, and
                                                    By accelerating dissemination and use                                                                            2. Support mobile SSO both for
                                                                                                            operational environments,
                                                    of these integrated tools and                                                                                 authentication and delegated
                                                                                                            authentication mechanisms need to
                                                    technologies for protecting IT assets, the                                                                    authorization (as in OAuth Client
                                                                                                            support deployments where devices
                                                    NCCoE will enhance trust in U.S. IT                                                                           Applications).
                                                                                                            may be shared amongst personnel and
                                                    communications, data, and storage                                                                                3. Ensure that mobile applications do
                                                                                                            authentication factors have usability
                                                    systems; reduce risk for companies and                                                                        not have access to user credentials.
                                                                                                            constraints.                                             4. Support multiple authenticators
                                                    individuals using IT systems; and                          The challenge that first responders
                                                    encourage development of innovative,                                                                          taking into account unique
                                                                                                            face in authenticating quickly and
                                                    job-creating cybersecurity products and                                                                       environmental constraints faced by first
                                                                                                            securely to public safety systems is
                                                    services.                                                                                                     responders in emergency medical
                                                                                                            compounded when a first responder is
                                                       Process: NIST is soliciting responses                forced to authenticate individually to                services, law enforcement, and the fire
                                                    from all sources of relevant security                   multiple mobile applications. In                      service such as:
                                                    capabilities (see below) to enter into a                addition, when authorizing application                a. Gloved, one-handed, or hands-free
                                                    Cooperative Research and Development                    access to shared resources, first                           operation
                                                    Agreement (CRADA) to provide                            responders may be subjected to an                     b. Use of smoke hoods, fire hoods or gas
                                                    products and technical expertise to                     additional authentication step at the                       masks that may prevent facial or iris
                                                    support and demonstrate security                        resource provider. To address the                           recognition
                                                    platforms for the Mobile Application                    challenge identified by the public safety             c. Proximity based authenticators (new
                                                    Single Sign On (SSO) for the Public                     community, the National Cybersecurity                       yubikeys)
                                                    Safety & First Responder Sector. The                    Center of Excellence (NCCoE) plans to                 d. Biometric based continuous
                                                    full use case can be viewed at: https://                develop a Mobile Application Single                         authentication mechanisms that
                                                    nccoe.nist.gov/projects/building_blocks/                Sign On (SSO) reference design and                          meet the requirements of draft NIST
                                                    mobile-sso.                                             implementation that meets these unique                      Special Publication 800–63B
                                                      Interested parties should contact NIST                authentication requirements and allows                   5. Allow multi-user operation of
                                                    using the information provided in the                   first responders to take advantage of the             shared mobile devices.
                                                    FOR FURTHER INFORMATION CONTACT                         latest mobile authentication technology                  6. Support for multiple authentication
                                                    section of this notice. NIST will then                  and best practices.                                   protocols. If appropriate, public sector
                                                    provide each interested party with a                       A detailed description of the Mobile               agencies must be able to leverage
                                                    letter of interest template, which the                  Application Single Sign On (SSO) is                   multifactor authentication. This may be
                                                    party must complete, certify that it is                 available at: https://nccoe.nist.gov/                 accomplished by adopting Fast IDentity
                                                    accurate, and submit to NIST. NIST will                 projects/building_blocks/mobile-sso.                  Online (FIDO 2.0) Universal
                                                    contact interested parties if there are                    Requirements: Each responding                      Authentication Framework (UAF),
                                                    questions regarding the responsiveness                  organization’s letter of interest should              Universal 2nd Factor (U2F), PKI, or
                                                    of the letters of interest to the use case              identify which security platform                      some other means.
                                                    objective or requirements identified                    component(s) or capability(ies) it is                    7. Support a spectrum of BYOD (Bring
asabaliauskas on DSK3SPTVN1PROD with NOTICES




                                                    below. NIST will select participants                    offering. Letters of interest should not              Your Own Device) and COPE (Corporate
                                                    who have submitted complete letters of                  include company proprietary                           Owned, Personally Enabled) scenarios.
                                                    interest on a first come, first served                  information, and all components and                      Responding organizations need to
                                                    basis within each category of product                   capabilities must be commercially                     understand and, in their letters of
                                                    components or capabilities listed below                 available. Components are listed in                   interest, commit to provide:
                                                    up to the number of participants in each                section 3 of the Mobile Application                   1. Access for all participants’ project
                                                    category necessary to carry out this use                Single Sign On (SSO) for the Public                         teams to component interfaces and
                                                    case. However, there may be continuing                  Safety & First Responder use case (for                      the organization’s experts necessary


                                               VerDate Sep<11>2014   17:48 Nov 28, 2016   Jkt 241001   PO 00000   Frm 00014   Fmt 4703   Sfmt 4703   E:\FR\FM\29NON1.SGM   29NON1


                                                    85934                      Federal Register / Vol. 81, No. 229 / Tuesday, November 29, 2016 / Notices

                                                         to make functional connections                     announced on the NCCoE Web site at                    email, telephones, fax); (2) a short
                                                         among security platform                            least two weeks in advance at http://                 description of his/her qualifications
                                                         components                                         nccoe.nist.gov/. The expected outcome                 relative to data science and
                                                    2. Support for development and                          of the demonstration is to improve                    management, and at least one other area
                                                         demonstration of the Mobile                        mobile application single sign-on across              of expertise related to ocean
                                                         Application Single Sign On (SSO)                   an entire Public Safety & First                       exploration; (3) a resume or curriculum
                                                         for the Public Safety & First                      Responder sector enterprise.                          vitae (maximum length 4 pages); and (4)
                                                         Responder use case in NCCoE                        Participating organizations will gain                 A cover letter stating their interest in
                                                         facilities which will be conducted                 from the knowledge that their products                serving on the OEAB and highlighting
                                                         in a manner consistent with Federal                are interoperable with other                          specific areas of expertise relevant to the
                                                         requirements (e.g., FIPS 200, FIPS                 participants’ offerings.                              purpose of the OEAB.
                                                         201, SP 800–53, and SP 800–63)                        For additional information on the                  DATES: Application materials should be
                                                       Additional details about the Mobile                  NCCoE governance, business processes,                 sent to the mailing or email address
                                                    Application Single Sign On (SSO) for                    and NCCoE operational structure, visit                specified below and must be received
                                                    the Public Safety & First Responder                     the NCCoE Web site http://                            no later than 15 days after publication
                                                    sector use case are available at: https://              nccoe.nist.gov/.                                      of this Federal Register Notice.
                                                    nccoe.nist.gov/projects/building_blocks/                Kent Rochford,                                        ADDRESSES: Submit resume and
                                                    mobile-sso.                                             Associate Director for Laboratory Programs.           application materials to Yvette Jefferson
                                                       NIST cannot guarantee that all of the                [FR Doc. 2016–28627 Filed 11–28–16; 8:45 am]          via mail or email. Mail: NOAA, 1315
                                                    products proposed by respondents will                   BILLING CODE 3510–13–P                                East West Highway, SSMC3 Rm 10315,
                                                    be used in the demonstration. Each                                                                            Silver Spring, MD 20910; Email:
                                                    prospective participant will be expected                                                                      Yvette.Jefferson@noaa.gov.
                                                    to work collaboratively with NIST staff                 DEPARTMENT OF COMMERCE                                FOR FURTHER INFORMATION CONTACT:
                                                    and other project participants under the                                                                      David McKinnie, OEAB Designated
                                                    terms of the consortium CRADA in the                    National Oceanic and Atmospheric                      Federal Officer, NOAA/OER, 7600 Sand
                                                    development of the Mobile Application                   Administration                                        Point Way NE., Seattle, WA 98115; 206–
                                                    Single Sign On (SSO) for the Public                                                                           526–6950; david.mckinnie@noaa.gov.
                                                    Safety & First Responder sector                         Ocean Exploration Advisory Board
                                                                                                            (OEAB)                                                SUPPLEMENTARY INFORMATION: The OEAB
                                                    capability. Prospective participants’                                                                         functions as an advisory body in
                                                    contribution to the collaborative effort                AGENCY:   Office of Oceanic and                       accordance with the Federal Advisory
                                                    will include assistance in establishing                 Atmospheric Research (OER) National                   Committee Act (FACA), as amended, 5
                                                    the necessary interface functionality,                  Oceanic and Atmospheric                               U.S.C. App., with the exception of
                                                    connection and set-up capabilities and                  Administration (NOAA) Department of                   section 14. It reports to the Under
                                                    procedures, demonstration harnesses,                    Commerce (DOC).                                       Secretary, as directed by 33 U.S.C. 3405.
                                                    environmental and safety conditions for                 ACTION: Notice of Membership                             The OEAB consists of approximately
                                                    use, integrated platform user                           Solicitation for the OEAB.                            ten members including a Chair and Co-
                                                    instructions, and demonstration plans                                                                         chair(s), designated by the Under
                                                    and scripts necessary to demonstrate the                SUMMARY:     OAR publishes this notice to             Secretary in accordance with FACA
                                                    desired capabilities. Each participant                  solicit applications to fill a single                 requirements and the terms of the
                                                    will train NIST personnel, as necessary,                membership vacancy on the Ocean                       approved OEAB Charter.
                                                    to operate its product in capability                    Exploration Advisory Board (OEAB)                        The OEAB:
                                                    demonstrations to the Public Safety &                   with an individual demonstrating                         a. advises the Under Secretary on all
                                                    First Responder community. Following                    expertise in data science and                         aspects of ocean exploration including
                                                    successful demonstrations, NIST will                    management and one other area of                      areas, features, and phenomena that
                                                    publish a description of the security                   expertise relevant to ocean exploration,              warrant exploration; and other areas of
                                                    platform and its performance                            such as seafloor mapping. The new                     program operation, including
                                                    characteristics sufficient to permit other              OEAB member will serve an initial                     development and enhancement of
                                                    organizations to develop and deploy                     three-year term, renewable once.                      technologies for exploring the ocean,
                                                    security platforms that meet the security                  The purpose of the OEAB is to advise               managing ocean exploration data and
                                                    objectives of the Mobile Application                    the Under Secretary of Commerce for                   information, and disseminating the
                                                    Single Sign On (SSO) for the Public                     Oceans and Atmosphere on matters                      results to the public, scientists, and
                                                    Safety & First Responder sector use case.               pertaining to ocean exploration                       educators;
                                                    These descriptions will be public                       including: The identification of priority                b. assists the program in the
                                                    information.                                            areas that warrant exploration; the                   development of a 5-year strategic plan
                                                       Under the terms of the consortium                    development and enhancement of                        for the fields of ocean, marine, and
                                                    CRADA, NIST will support                                technologies for exploring the oceans;                Great Lakes science, exploration, and
                                                    development of interfaces among                         managing the data and information; and                discovery, as well as makes
                                                    participants’ products by providing IT                  disseminating the results. The OEAB                   recommendations to NOAA on the
                                                    infrastructure, laboratory facilities,                  also provides advice on the relevance of              evolution of the plan based on results
                                                    office facilities, collaboration facilities,            the program with regard to the NOAA
asabaliauskas on DSK3SPTVN1PROD with NOTICES




                                                                                                                                                                  and achievements;
                                                    and staff support to component                          Strategic Plan, the National Ocean                       c. annually reviews the quality and
                                                    composition, security platform                          Policy Implementation Plan, and other                 effectiveness of the proposal review
                                                    documentation, and demonstration                        appropriate guidance documents.                       process established under [correct]; and
                                                    activities.                                             APPLICATIONS: An application is required                 d. provides other assistance and
                                                       The dates of the demonstration of the                to be considered for OEAB membership.                 advice as requested by the Under
                                                    Mobile Application Single Sign On                       To apply, please submit (1) full name,                Secretary.
                                                    (SSO) for the Public Safety & First                     title, institutional affiliation, and                    OEAB members are appointed as
                                                    Responder sector capability will be                     contact information (mailing address,                 special government employees (SGEs)


                                               VerDate Sep<11>2014   17:48 Nov 28, 2016   Jkt 241001   PO 00000   Frm 00015   Fmt 4703   Sfmt 4703   E:\FR\FM\29NON1.SGM   29NON1



Document Created: 2016-11-29 00:33:21
Document Modified: 2016-11-29 00:33:21
CategoryRegulatory Information
CollectionFederal Register
sudoc ClassAE 2.7:
GS 4.107:
AE 2.106:
PublisherOffice of the Federal Register, National Archives and Records Administration
SectionNotices
ActionNotice.
DatesInterested parties must contact NIST to request a letter of interest template to be completed and submitted to NIST. Letters of interest will be accepted on a first come, first served basis. Collaborative activities will commence as soon as enough completed and
ContactPaul Grassi or William Fisher via email to [email protected]; by telephone 301-975-0200; or by mail to National Institute of Standards and Technology, NCCoE; 100 Bureau Drive Mail Stop 2002, Gaithersburg, MD 20899. Additional details about the Public Safety & First Responder sector program are available at https:/ /nccoe.nist.gov/projects/building_blocks/mobile-sso.
FR Citation81 FR 85932 

2025 Federal Register | Disclaimer | Privacy Policy
USC | CFR | eCFR