81_FR_89301 81 FR 89064 - National Cybersecurity Center of Excellence (NCCoE) Privacy-Enhancing Identity Federation Building Block

81 FR 89064 - National Cybersecurity Center of Excellence (NCCoE) Privacy-Enhancing Identity Federation Building Block

DEPARTMENT OF COMMERCE
National Institute of Standards and Technology

Federal Register Volume 81, Issue 237 (December 9, 2016)

Page Range89064-89065
FR Document2016-29482

The National Institute of Standards and Technology (NIST) invites organizations to provide products and technical expertise to support and demonstrate technology platforms for the Privacy-Enhancing Identity Federation Building Block. This notice is the initial step for the National Cybersecurity Center of Excellence (NCCoE) in collaborating with technology companies to address cybersecurity challenges identified under the Privacy-Enhancing Identity Federation Building Block. Participation in the building block is open to all interested organizations.

Federal Register, Volume 81 Issue 237 (Friday, December 9, 2016) 
[Federal Register Volume 81, Number 237 (Friday, December 9, 2016)]
[Notices]
[Pages 89064-89065]
From the Federal Register Online  [www.thefederalregister.org]
[FR Doc No: 2016-29482]


-----------------------------------------------------------------------

DEPARTMENT OF COMMERCE

National Institute of Standards and Technology

[Docket No.: 161115999-6999-01]


National Cybersecurity Center of Excellence (NCCoE) Privacy-
Enhancing Identity Federation Building Block

AGENCY: National Institute of Standards and Technology, Department of 
Commerce.

ACTION: Notice.

-----------------------------------------------------------------------

SUMMARY: The National Institute of Standards and Technology (NIST) 
invites organizations to provide products and technical expertise to 
support and demonstrate technology platforms for the Privacy-Enhancing 
Identity Federation Building Block. This notice is the initial step for 
the National Cybersecurity Center of Excellence (NCCoE) in 
collaborating with technology companies to address cybersecurity 
challenges identified under the Privacy-Enhancing Identity Federation 
Building Block. Participation in the building block is open to all 
interested organizations.

DATES: Interested parties must contact NIST to request a letter of 
interest template to be completed and submitted to NIST. Letters of 
interest will be accepted on a first come, first served basis. 
Collaborative activities will commence as soon as enough completed and 
signed letters of interest have been returned to address all the 
necessary components and capabilities, but no earlier than January 9, 
2017. When the building block has been completed, NIST will post a 
notice on the NCCoE Web site at https://nccoe.nist.gov/projects/building_blocks/privacy-enhanced-identity-brokers announcing the 
completion of the building block and informing the public that it will 
no longer accept letters of interest for this project.

ADDRESSES: The NCCoE is located at 9700 Great Seneca Highway, 
Rockville, MD 20850. Letters of interest must be submitted to [email protected]; or via mail to National Institute of Standards and 
Technology, NCCoE; 100 Bureau Drive, M/S 2002 Gaithersburg, MD 20899. 
Organizations whose letters of interest are accepted in accordance with 
the process set forth in the SUPPLEMENTARY INFORMATION section of this 
notice will be asked to sign a Cooperative Research and Development 
Agreement (CRADA) with NIST. A CRADA template can be found at: https://nccoe.nist.gov/library/nccoe-consortium-crada-example.

FOR FURTHER INFORMATION CONTACT: Paul Grassi via email at [email protected]; by telephone 240-614-3686; or by mail to National 
Institute of Standards and Technology, NCCoE; 100 Bureau Drive, M/S 
2002 Gaithersburg, MD 20899. Additional details about the Privacy-
Enhancing Federation Building Block are available at https://nccoe.nist.gov/projects/building_blocks.

SUPPLEMENTARY INFORMATION: 
    Background: The NCCoE, part of NIST, is a public-private 
collaboration for accelerating the widespread adoption of integrated 
cybersecurity tools and technologies. The NCCoE brings together experts 
from industry, government, and academia under one roof to develop 
practical, interoperable cybersecurity approaches that address the 
real-world needs of complex Information Technology (IT) systems. By 
accelerating dissemination and use of these integrated tools and 
technologies for protecting IT assets, the NCCoE will enhance trust in 
U.S. IT communications, data, and storage systems; reduce risk for 
companies and individuals using IT systems; and encourage development 
of innovative, job-creating cybersecurity products and services.
    Process: NIST is soliciting responses from all sources of relevant 
security capabilities (see below) to enter into a Cooperative Research 
and Development Agreement (CRADA) to provide products and technical 
expertise to support and demonstrate security platforms for the 
Privacy-Enhancing Identity Federation Building Block. The full building 
block can be viewed at: https://nccoe.nist.gov/projects/building_blocks/privacy-enhanced-identity-brokers.
    Interested parties should contact NIST using the information 
provided in the FOR FURTHER INFORMATION CONTACT section of this notice. 
NIST will then provide each interested party with a letter of interest 
template, which the party must complete, certify that it is accurate, 
and submit to NIST. NIST will contact interested parties if there are 
questions regarding the responsiveness of the letters of interest to 
the building block objective or requirements identified below. NIST 
will select participants who have submitted complete letters of 
interest on a first come, first served basis within each category of 
product components or capabilities listed below up to the number of 
participants in each category necessary to carry out this building 
block. However, there may be continuing opportunity to participate even 
after initial activity commences. Selected participants will be 
required to enter into a consortium CRADA with NIST (for reference, see 
ADDRESSES section above). NIST published a notice in the Federal 
Register on October 19, 2012 (77 FR 64314), inviting U.S. companies to 
enter into National Cybersecurity Excellence Partnerships (NCEPs) in 
furtherance of the NCCoE. For this demonstration project, NCEP partners 
will not be given priority for participation.
    Building Block Objective: The primary objective of this building 
block is to demonstrate how federated identity services, leveraging 
market dominant standards, can include privacy enhancements for 
individuals and organizations that are not widely available in market 
available identity solutions. More specifically, this project seeks 
innovative ways to protect user attributes in order to prevent 
intermediaries in federated identity transactions from gaining access 
to personal information. Additionally, it seeks architectures in which 
organizations and identity brokers do not know each other's 
organizational identities, so that neither entity can track or link 
user activities beyond what is known from their direct relationship 
with the user. Any approach utilized to achieve this goal must be able 
to mitigate common online attacks, such as a man-in-the-middle attack.
    This project will result in a freely available NIST Cybersecurity 
Practice Guide, describing in depth the technical decisions, trade-
offs, lessons-learned, and build instructions, based on market dominant 
standards, such that organizations can accelerate the deployment of a 
similar privacy enhancing federated identity architectures.
    A detailed description of the Privacy-Enhancing Identity Federation 
Building Block is available at https://nccoe.nist.gov/projects/building_blocks/privacy-enhanced-identity-brokers.

Requirements

    Each responding organization's letter of interest should identify 
which security platform component(s) or capability(ies) it is offering. 
Letters of interest should not include company

[[Page 89065]]

proprietary information, and all components and capabilities must be 
commercially available. Components are listed in section ten of the 
Privacy-Enhancing Identity Federation Building Block (for reference, 
please see the link in the PROCESS section above) and include, but are 
not limited to:

1. Relying Party Host(s)
2. Identity Provider Host(s)
3. Identity Federation Manager
4. Multi-factor credentials
5. Attribute Provider Host(s)
6. Cryptographic Module(s) to include key management (if required by 
commercial product)
7. Network, Compute, and Storage

    Each responding organization's letter of interest should identify 
how their products address one or more of the following desired 
solution characteristics in Chapter 6--Desired Solution Objectives, of 
the Privacy-Enhancing Identity Federation Building Block (for 
reference, please see the link in the PROCESS section above): 
Responding organizations need to understand and, in their letters of 
interest, commit to provide:

1. Access for all participants' project teams to component interfaces 
and the organization's experts necessary to make functional connections 
among security platform components
2. Support for development and demonstration of the Privacy-Enhancing 
Identity Federation Building Block in NCCoE facilities which will be 
conducted in a manner consistent with Federal requirements (e.g., FIPS 
200, FIPS 201, SP 800-53, and SP 800-63)

    Additional details about the Privacy-Enhancing Identity Federation 
Building Block are available at https://nccoe.nist.gov/projects/building_blocks/privacy-enhanced-identity-brokers.
    NIST cannot guarantee that all of the products proposed by 
respondents will be used in the demonstration. Each prospective 
participant will be expected to work collaboratively with NIST staff 
and other project participants under the terms of the consortium CRADA 
in the development of the Privacy-Enhancing Identity Federation 
Building Block. Prospective participants' contribution to the 
collaborative effort will include assistance in establishing the 
necessary interface functionality, connection and set-up capabilities 
and procedures, demonstration harnesses, environmental and safety 
conditions for use, integrated platform user instructions, and 
demonstration plans and scripts necessary to demonstrate the desired 
capabilities. Each participant will train NIST personnel, as necessary, 
to operate its product in capability demonstrations. Following 
successful demonstrations, NIST will publish a description of the 
security platform and its performance characteristics sufficient to 
permit other organizations to develop and deploy technology platforms 
that meet the security and privacy objectives of the Privacy-Enhancing 
Identity Federation Building Block. These descriptions will be public 
information.
    Under the terms of the consortium CRADA, NIST will support 
development of interfaces among participants' products by providing IT 
infrastructure, laboratory facilities, office facilities, collaboration 
facilities, and staff support to component composition, security 
platform documentation, and demonstration activities.
    The dates of the demonstration of the Privacy-Enhancing Identity 
Federation Building Block capability will be announced on the NCCoE Web 
site at least two weeks in advance at http://nccoe.nist.gov/. The 
expected outcome of the demonstration is to improve privacy-enhancing 
identity federation within the enterprise. Participating organizations 
will gain from the knowledge that their products are interoperable with 
other participants' offerings.
    For additional information on the NCCoE governance, business 
processes, and NCCoE operational structure, visit the NCCoE Web site 
http://nccoe.nist.gov/.

Kevin Kimball,
NIST Chief of Staff.
[FR Doc. 2016-29482 Filed 12-8-16; 8:45 am]
 BILLING CODE 3510-13-P

89064 Federal Register / Vol. 81, No. 237 / Friday, December 9, 2016 / Notices 751(a)(1) and 777(i)(1) of the Act, and 19 Bureau Drive, M/S 2002 Gaithersburg, identified below. NIST will select CFR 351.213(h). MD 20899. Organizations whose letters participants who have submitted Dated: December 5, 2016. of interest are accepted in accordance complete letters of interest on a first Paul Piquado, with the process set forth in the come, first served basis within each SUPPLEMENTARY INFORMATION section of category of product components or Assistant Secretary for Enforcement and this notice will be asked to sign a capabilities listed below up to the Compliance. Cooperative Research and Development number of participants in each category [FR Doc. 2016–29564 Filed 12–8–16; 8:45 am] Agreement (CRADA) with NIST. A necessary to carry out this building BILLING CODE 3510–DS–P CRADA template can be found at: block. However, there may be https://nccoe.nist.gov/library/nccoe- continuing opportunity to participate consortium-crada-example. even after initial activity commences. DEPARTMENT OF COMMERCE FOR FURTHER INFORMATION CONTACT: Paul Selected participants will be required to National Institute of Standards and Grassi via email at petid-nccoe@nist.gov; enter into a consortium CRADA with Technology by telephone 240–614–3686; or by mail NIST (for reference, see ADDRESSES to National Institute of Standards and section above). NIST published a notice [Docket No.: 161115999–6999–01] in the Federal Register on October 19, Technology, NCCoE; 100 Bureau Drive, M/S 2002 Gaithersburg, MD 20899. 2012 (77 FR 64314), inviting U.S. National Cybersecurity Center of companies to enter into National Excellence (NCCoE) Privacy- Additional details about the Privacy- Enhancing Federation Building Block Cybersecurity Excellence Partnerships Enhancing Identity Federation Building (NCEPs) in furtherance of the NCCoE. Block are available at https://nccoe.nist.gov/ projects/building_blocks. For this demonstration project, NCEP AGENCY: National Institute of Standards partners will not be given priority for SUPPLEMENTARY INFORMATION: and Technology, Department of participation. Background: The NCCoE, part of Building Block Objective: The primary Commerce. NIST, is a public-private collaboration objective of this building block is to ACTION: Notice. for accelerating the widespread demonstrate how federated identity adoption of integrated cybersecurity services, leveraging market dominant SUMMARY: The National Institute of tools and technologies. The NCCoE Standards and Technology (NIST) standards, can include privacy brings together experts from industry, enhancements for individuals and invites organizations to provide government, and academia under one products and technical expertise to organizations that are not widely roof to develop practical, interoperable available in market available identity support and demonstrate technology cybersecurity approaches that address platforms for the Privacy-Enhancing solutions. More specifically, this project the real-world needs of complex seeks innovative ways to protect user Identity Federation Building Block. This Information Technology (IT) systems. notice is the initial step for the National attributes in order to prevent By accelerating dissemination and use intermediaries in federated identity Cybersecurity Center of Excellence of these integrated tools and (NCCoE) in collaborating with transactions from gaining access to technologies for protecting IT assets, the personal information. Additionally, it technology companies to address NCCoE will enhance trust in U.S. IT cybersecurity challenges identified seeks architectures in which communications, data, and storage organizations and identity brokers do under the Privacy-Enhancing Identity systems; reduce risk for companies and Federation Building Block. Participation not know each other’s organizational individuals using IT systems; and identities, so that neither entity can in the building block is open to all encourage development of innovative, interested organizations. track or link user activities beyond what job-creating cybersecurity products and is known from their direct relationship DATES: Interested parties must contact services. with the user. Any approach utilized to NIST to request a letter of interest Process: NIST is soliciting responses achieve this goal must be able to template to be completed and submitted from all sources of relevant security mitigate common online attacks, such as to NIST. Letters of interest will be capabilities (see below) to enter into a a man-in-the-middle attack. accepted on a first come, first served Cooperative Research and Development This project will result in a freely basis. Collaborative activities will Agreement (CRADA) to provide available NIST Cybersecurity Practice commence as soon as enough completed products and technical expertise to Guide, describing in depth the technical and signed letters of interest have been support and demonstrate security decisions, trade-offs, lessons-learned, returned to address all the necessary platforms for the Privacy-Enhancing and build instructions, based on market components and capabilities, but no Identity Federation Building Block. The dominant standards, such that earlier than January 9, 2017. When the full building block can be viewed at: organizations can accelerate the building block has been completed, https://nccoe.nist.gov/projects/building_ deployment of a similar privacy NIST will post a notice on the NCCoE blocks/privacy-enhanced-identity- enhancing federated identity Web site at https://nccoe.nist.gov/ brokers. architectures. projects/building_blocks/privacy- Interested parties should contact NIST A detailed description of the Privacy- enhanced-identity-brokers announcing using the information provided in the Enhancing Identity Federation Building the completion of the building block FOR FURTHER INFORMATION CONTACT Block is available at https:// and informing the public that it will no section of this notice. NIST will then nccoe.nist.gov/projects/building_blocks/ longer accept letters of interest for this provide each interested party with a mstockstill on DSK3G9T082PROD with NOTICES privacy-enhanced-identity-brokers. project. letter of interest template, which the ADDRESSES: The NCCoE is located at party must complete, certify that it is Requirements 9700 Great Seneca Highway, Rockville, accurate, and submit to NIST. NIST will Each responding organization’s letter MD 20850. Letters of interest must be contact interested parties if there are of interest should identify which submitted to petid-nccoe@nist.gov; or questions regarding the responsiveness security platform component(s) or via mail to National Institute of of the letters of interest to the building capability(ies) it is offering. Letters of Standards and Technology, NCCoE; 100 block objective or requirements interest should not include company VerDate Sep<11>2014 18:13 Dec 08, 2016 Jkt 241001 PO 00000 Frm 00023 Fmt 4703 Sfmt 4703 E:\FR\FM\09DEN1.SGM 09DEN1

Federal Register / Vol. 81, No. 237 / Friday, December 9, 2016 / Notices 89065 proprietary information, and all NIST personnel, as necessary, to operate sectors in fishing years 2017 and 2018. components and capabilities must be its product in capability Regulations implementing the Northeast commercially available. Components are demonstrations. Following successful Multispecies Fishery Management Plan listed in section ten of the Privacy- demonstrations, NIST will publish a require at-sea monitoring companies to Enhancing Identity Federation Building description of the security platform and apply to, and be approved by, NMFS in Block (for reference, please see the link its performance characteristics sufficient order to be eligible to provide at-sea in the PROCESS section above) and to permit other organizations to develop monitoring services to sectors. This include, but are not limited to: and deploy technology platforms that action will allow sectors to contract at- 1. Relying Party Host(s) meet the security and privacy objectives sea monitoring services with any of the 2. Identity Provider Host(s) of the Privacy-Enhancing Identity approver providers for fishing years 3. Identity Federation Manager Federation Building Block. These 2017 and 2018. 4. Multi-factor credentials descriptions will be public information. ADDRESSES: The list of NMFS-approved 5. Attribute Provider Host(s) Under the terms of the consortium sector monitoring service providers are 6. Cryptographic Module(s) to include CRADA, NIST will support available at: http:// key management (if required by development of interfaces among www.greateratlantic.fisheries.noaa.gov/ commercial product) participants’ products by providing IT sustainable/species/multispecies/, or by 7. Network, Compute, and Storage infrastructure, laboratory facilities, sending a written request to: 55 Great Each responding organization’s letter office facilities, collaboration facilities, Republic Drive, Gloucester, MA 01930, of interest should identify how their and staff support to component Attn: Kyle Molton. products address one or more of the composition, security platform FOR FURTHER INFORMATION CONTACT: Kyle following desired solution documentation, and demonstration Molton, Fishery Management Specialist, characteristics in Chapter 6—Desired activities. (978) 281–9236, fax (978) 281–9135, Solution Objectives, of the Privacy- The dates of the demonstration of the email Kyle.Molton@noaa.gov. Enhancing Identity Federation Building Privacy-Enhancing Identity Federation SUPPLEMENTARY INFORMATION: Block (for reference, please see the link Building Block capability will be Amendment 16 (75 FR 18262; April 9, in the PROCESS section above): announced on the NCCoE Web site at 2010) to the Northeast Multispecies Responding organizations need to least two weeks in advance at http:// Fishery Management Plan (FMP) understand and, in their letters of nccoe.nist.gov/. The expected outcome expanded the sector management interest, commit to provide: of the demonstration is to improve program, including a requirement for 1. Access for all participants’ project privacy-enhancing identity federation industry-funded monitoring of catch by teams to component interfaces and within the enterprise. Participating sector vessels. Framework Adjustment the organization’s experts necessary organizations will gain from the 48 to the FMP (78 FR 26118; May 3, to make functional connections knowledge that their products are 2013) revised the goals and objectives among security platform interoperable with other participants’ for sector monitoring programs. Sectors components offerings. must employ approved independent 2. Support for development and For additional information on the third-party monitoring companies to demonstration of the Privacy- NCCoE governance, business processes, provide at-sea monitoring services to Enhancing Identity Federation and NCCoE operational structure, visit their vessels. Building Block in NCCoE facilities the NCCoE Web site http:// which will be conducted in a nccoe.nist.gov/. Standards for Approving At-Sea manner consistent with Federal Monitoring Service Providers Kevin Kimball, requirements (e.g., FIPS 200, FIPS We are transitioning from an annual NIST Chief of Staff. 201, SP 800–53, and SP 800–63) approval process to biennial approval to [FR Doc. 2016–29482 Filed 12–8–16; 8:45 am] Additional details about the Privacy- provide sectors additional stability and BILLING CODE 3510–13–P Enhancing Identity Federation Building flexibility in negotiating contracts with Block are available at https:// monitoring companies. Applications nccoe.nist.gov/projects/building_blocks/ DEPARTMENT OF COMMERCE approved this year will cover both privacy-enhanced-identity-brokers. fishing year 2017 and fishing year 2018 NIST cannot guarantee that all of the National Oceanic and Atmospheric (May 1, 2017, through April 30, 2019). products proposed by respondents will Administration There will be an opportunity in 2017 for be used in the demonstration. Each additional monitoring companies to prospective participant will be expected RIN 0648–XF026 apply for approval to provide services in to work collaboratively with NIST staff fishing year 2018. Magnuson-Stevens Act Provisions; and other project participants under the The regulations at 50 CFR 648.87(b)(4) Fisheries of the Northeastern United terms of the consortium CRADA in the describe the criteria for approval of at- States; Northeast Multispecies development of the Privacy-Enhancing sea monitoring service providers. We Fishery; Approved Monitoring Service Identity Federation Building Block. approve service providers based on: (1) Providers Prospective participants’ contribution to Completeness and sufficiency of the collaborative effort will include AGENCY: National Marine Fisheries applications; (2) determination of the assistance in establishing the necessary Service (NMFS), National Oceanic and applicant’s ability to meet the interface functionality, connection and Atmospheric Administration (NOAA), performance requirements of a sector mstockstill on DSK3G9T082PROD with NOTICES set-up capabilities and procedures, Commerce. monitoring service provider; and (3) demonstration harnesses, environmental ACTION: Notice of approved monitoring documented successful performance in and safety conditions for use, integrated service providers. the prior fishing year. We can platform user instructions, and disapprove any previously approved demonstration plans and scripts SUMMARY: NMFS has approved five service provider during the fishing year necessary to demonstrate the desired companies to provide at-sea monitoring if the provider fails to meet the capabilities. Each participant will train services to Northeast multispecies performance standards, including VerDate Sep<11>2014 18:13 Dec 08, 2016 Jkt 241001 PO 00000 Frm 00024 Fmt 4703 Sfmt 4703 E:\FR\FM\09DEN1.SGM 09DEN1


Document Created: 2018-02-14 09:03:29
Document Modified: 2018-02-14 09:03:29
CategoryRegulatory Information
CollectionFederal Register
sudoc ClassAE 2.7:
GS 4.107:
AE 2.106:
PublisherOffice of the Federal Register, National Archives and Records Administration
SectionNotices
ActionNotice.
DatesInterested parties must contact NIST to request a letter of interest template to be completed and submitted to NIST. Letters of interest will be accepted on a first come, first served basis. Collaborative activities will commence as soon as enough completed and
ContactPaul Grassi via email at petid- [email protected]; by telephone 240-614-3686; or by mail to National Institute of Standards and Technology, NCCoE; 100 Bureau Drive, M/S 2002 Gaithersburg, MD 20899. Additional details about the Privacy- Enhancing Federation Building Block are available at https:// nccoe.nist.gov/projects/building_blocks.
FR Citation81 FR 89064 
2025 Federal Register | Disclaimer | Privacy Policy
USC | CFR | eCFR