Securing Training Objects and Records Management Navy SBIR FY2005.2 Sol No.: Navy SBIR FY2005.2 Topic No.: N05-113 Topic Title: Securing Training Objects and Records Management Proposal No.: N052-113-0177 Firm: Technology Service Corporation 1900 S. Sepulveda Blvd Suite 300 Los Angeles, California 90025-5659 Contact: Geoffrey McKim Phone: (812) 336-7576 Web Site: www.tsc.com Abstract: Delivery of training materials via the Web is rapidly becoming an essential method of delivering training in an efficient and cost-effective manner, both in the military and civilian environments. Widely dispersed training audiences, however, require various levels of access control to training materials, particularly with respect to sensitive training materials or high-stakes testing/training scenarios. Although authentication tokens such as smart cards and biometrics can provide stronger authentication, access control, and audit trail logging, at this point there is no standardized way to integrate strong authentication tokens with the Learning Management Systems that are used to manage, track, and deliver Web-based distributed training. This proposal addresses two challenges of securing Web-based distributed training content: The first is to determine the feasibility of integrating strong authentication and access-control tokens, in a standardized manner, to SCORM-compliant training packages, as launched and tracked by a Learning Management System (LMS). The second challenge is to assess the strong access-control needs of current Department of Defense distributed training programs and thereby determine the access-control requirements for current and future advanced distributed training activities. Benefits: Distance learning technologies are destined to underutilization without accountability, both for the security of the training object and for the integrity of the training record. On one hand, we must be sure both that only the right personnel are able to access training materials. Many training materials not only involve sensitive content, unauthorized disclosure of which may harm national security, but also content which, if not presented in the proper context, may cause harm to the individual or to military assets. On the other hand, we must also have confidence in the integrity of the training record. The record of who participated in what training, how they performed, what assessments they passed, and what certifications they attained has an impact both on the career of the individual sailor and on the safety of others who depend on Navy systems functioning properly. Without this level of accountability, distributed Web-based training is not acceptable for sensitive or high-stakes training activities. The opportunity represented by this SBIR is to determine the feasibility of, and ultimately develop, a method and set of techniques ensuring confidence in both the security of the training content and the integrity of the training record. The needs for such assurance, and, therefore, the potential for commercialization of the technologies proposed by this SBIR, however, go far beyond military applications. TSC's extensive experience in consulting for public land management agencies on learning technologies has revealed these technologies to present an opportunity for these agencies to lower a significant barrier to the widespread deployment of Web-based distance learning. Many industries - in particular, those becoming most critical to the 21st century economy, including pharmaceuticals, medical manufacturing, banking and financial services, and information technology are both increasingly dependent upon e-learning and have heavy security needs for sensitive content. Many additional sectors have the critical need to verify the integrity of training, assessments, and certifications delivered and granted via Web-based learning technologies, including government agencies (e.g., for certifications for high-risk activities), professional societies (e.g., for licensing assessments), and educational organizations (for high-stakes testing, college board exams, comprehensive exams, etc.). Through the technologies and techniques proposed by this SBIR, we can make distance-learning technologies more practical, efficient, and affordable in a wide variety of sensitive and high-stakes training scenarios. Return