Description
Global Access-controlled Transfer e-frame (GATe) •1. Description : Global Access-controlled Transfer e-frame (GATe) was designed to take advantage of the patterns that occur during an electronic record transfer process. The e-frame (or electronic framework or platform) is the foundation for developing secure information transfer to meet classified and unclassified business processes and is particularly useful when there is a need to share information with various entities in a controlled and secure environment. It can share, search, upload, download and retrieve sensitive information, as well as provides reporting capabilities. GATe provides two-factor authentication, full encryption, https transfer, and uses AES-256 on the data at rest. It manages user authentication through active directory and role-based authorization implemented at the application level. It is completely web-based and does not require the client to install any software to be operational. GATe uses cutting-edge technologies to accomplish all of this functionality. It uses an encrypted SQL Server 2008 database for the backend; ASP.NET 4.0 for the web application; Language Integrated Query (LINQ) to Entities for data access and data modeling; jQuery and Asynchronouse Javascript and XML (AJAX) for a more seamless and user-friendly feel on the various web pages. The GATe has been used to develop the Secure Electronic Records Transfer (SERT) system. The SERT system is a seamless and secure web-based application that searches, retrieves, uploads, downloads, transfers, and protects Official Use Only (OUO)/Personally Identifiable Information (PII)/Privacy Act (PA) data contained in Energy Employees Occupational Illness Compensation Act Program (EEOICPA) claims, following agency protection requirements, the Health Insurance Portability and Accountability Act (HIPAA) of 1996 and the Federal Information Processing Standards (FIPS) 199 - Standards for Security Categorization of Federal Information and Information Systems. The SERT system provides the Department of Energy (DOE), Department of Labor, and the National Institute for Occupational Safety and Health with a secure, efficient means of transferring various occupational history records (e.g., personnel, medical, exposure, etc.) that need protection, in support of the EEOICPA. GATe is currently of interest to other DOE programs such as the Russian Reactor Research Fuel Return (RRRFR) program. This program includes DOE, as well as, other foreign governments. GATe may be of interest in a stand-alone capacity to share sensitive or classified information for private or municipal entities (e.g., within the same hospital group, physician's group, financial institution, attorney's group, emergency services company, and insurance company, etc.). From a broader perspective and with increased benefits, it can also be used across entity lines (e.g., banking with collections, attorneys with courts, collections, and financial institutions, doctors with hospitals and patients, etc.) . In both cases, they can interact with each other in a secure environment (e.g., share, search, upload, download and retrieve sensitive or classified information). Finally, GATe provides an avenue to share sensitive and classified information at a fraction of the cost of developing a secure system from scratch. Any company with a need to protect OUO, PII, PA, and classified information and/or meet HIPAA or FIPS standards may have an interest in GATe . Hardware Requirements : Server with additional storage based on size of the application use, Two Factor Authentication (RSA or HSPD-12) Operating System : 2008 R2 windows server Programming Language(s) Used : ASP.Net 4.0 and Telerik Limitations/Special Requirements : none Related and Auxiliary Software : SQL Server with full encryption Unique Features of the Software : GATe provides an avenue to share sensitive and classified information at a fraction of the cost of developing a secure system from scratch. . Export Control/Classification Review : GATe software is considered to be controlled under the Export Control Classification Number (ECCN) 5E992 "Information Security" "technology" according to the General Technology Note, not controlled by 5E002, Sub paragraph b. "Technology", n.e.s. (not elsewhere specified), for the "use" of mass market "software" controlled by 5D992.c. Items under this ECCN number are controlled for Anti-Terrorism reasons (AT). All parties will need to be screened prior to distribution or access.