ID validation on the fly for emergency response

A new solution aims to speed incident response by  dynamically vetting and authorizing first responders and their devices so they can  access and share information when they are participating in incidents outside their home jurisdiction.

The Homeland Security Department’s Small Business Innovation Research program awarded a contract to Waverley Labs, a provider of digital risk management software and services, to facilitate responders’ Identity Credential Access Management. Called Dynamic AccessID Network, it is the first commercial ICAM infrastructure that lets incident responders dynamically associate disparate credentials and devices with first responder systems.

One of the issues DHS wanted to solve was validating responders on the fly, said Juanita Koilpillai, the company’s founder. "How do we help these varying entities -- paramedics or doctors or cops -- [who] show up with their various identities and help them be onboarded" so they can securely work  to on an incident?

It is currently difficult to onboard systems that use federated credentials from untrusted parties. AccessID allows emergency managers to standup ad hoc networks, dynamically federate participants and onboard privately-owned systems  on-the-fly.

Waverley's open-source specification validates both the IDs -- such as personal identity verification (PIV) or Real ID cards and driver’s licenses -- and the devices that those IDs are used on.

 “At the local level, they know each other, they hang out with each other and it’s easy to vet people, but at a state level, it’s much harder,” Koilpillai said. For instance, if Virginia sends responders to Louisiana, the differences in driver’s licenses could impede identity verification, she said.

Additionally, many systems that responders need to access don’t belong to the state or jurisdictions, but rather to local businesses  -- for example, a security camera at a privately owned building. “These systems need to be also onboarded [to Dynamic AccessID Network] during an incident" without  being compromised, while ensuring access to certain pieces of information remains fully under the control of the system owner, Koilpillai said.

Waverley provides an app incident managers can download to their computers or smart mobile devices. During an emergency that requires responders from multiple jurisdictions to access networked information, the manager opens the app and scans responders' ID cards or manually enters data from them to start the vetting process.

“The whole idea is to have these specifications for clients and devices to be onboarded and make it open so that we are [able] to onboard vendors who have any kind of ID management – PIV cards, driver’s licenses,” Koilpillai said.

She compared Dynamic AccessID Network to ATMs in that a Bank of America machine will accept a Wells Fargo card by vetting it on-the-fly and verifying it with a personal identification number.

“Underlying all of this is an architecture called a software-defined perimeter (SDP) that we’ve been working on and evangelizing for the past few years to make sure that these networks can be set up on-the-fly, be completely hidden when they are running on public infrastructures like the cloud or other public internet,” she said.

Waverley pioneered the open-source SDP network architecture for the Cloud Security Alliance. SDPs make application infrastructure an effectively invisible or “black cloud” environment that shows no Domain Name System information or IP addresses. SDPs align with the zero-trust approach to cybersecurity because they enforce authorization of users on validated devices before connecting to servers or services hidden behind a closed dynamic firewall, according to a May whitepaper published by the company.

“It brings together ID management, device management, communication and connection protocols, and your firewall protocols … to provide this very secure, zero-trust kind of connection,” Koilpillai said of SDPs.

Waverley’s agreements with responders and vendors are consented to before an emergency so that when one occurs, an incident manager can download the app and secure information sharing can begin.

Koilpillai said she expects the first version of the network to be completed by year’s end. The next step is to evaluate how it works, and the company is working to sign memorandums of understanding with several states for testing.

She also plans to give first responders apps so they can vet and onboard themselves to the network. In that case, the incident manager would just have to determine what data they are authorized to access.

Additionally, Koilpillai said  wants to work with the General Services Administration to create a program akin to the Federal Information Processing Standard 201 Evaluation Program that would let vendors vet themselves to be able to share data based on on-the-fly ICAM capabilities.