HomeDocumentationSecurity

Security Documentation

Comprehensive security documentation for Peregrine Platform, covering architecture, compliance, and implementation details for federal healthcare environments.

Last updated: January 27, 2025

Security Overview

Security First Design

Peregrine Platform is built from the ground up with security as a core principle. Every component is designed to meet or exceed federal security requirements, including FedRAMP High, HIPAA, and NIST 800-53 standards.

Core Security Principles

  • Zero Trust Architecture: Never trust, always verify. Every request is authenticated and authorized regardless of source.
  • Defense in Depth: Multiple layers of security controls ensure resilience against various attack vectors.
  • Least Privilege: Users and services are granted only the minimum permissions necessary to perform their functions.
  • Continuous Monitoring: Real-time security monitoring and automated threat detection across all systems.

Security Architecture

Network Architecture

┌─────────────────────────────────────────────────┐
│              AWS GovCloud                        │
└─────────────────┬───────────────────────────────┘
                  │
        ┌─────────▼──────────┐
        │ Application Load   │ ◄── Cognito Integration
        │ Balancer (ALB)     │ ◄── SSL/TLS Termination
        │                    │ ◄── Health Checks
        └─────────┬──────────┘
                  │
        ┌─────────▼──────────┐
        │  ECS Fargate       │ ◄── Container Security
        │  Cluster           │ ◄── Task Isolation
        │                    │ ◄── IAM Task Roles
        └─────────┬──────────┘
                  │
    ┌─────────────┴─────────────┐
    │                           │
┌───▼────────┐         ┌────────▼──────┐
│ Public     │         │ Private       │
│ Subnet     │         │ Subnet        │
│            │         │               │
│ ┌────────┐ │         │ ┌──────────┐ │
│ │  NAT   │ │◄────────┤ │ Services │ │
│ │Gateway │ │         │ │ (Lambda) │ │
│ └────────┘ │         │ └──────────┘ │
└────────────┘         │               │
                       │ ┌──────────┐ │
                       │ │ DynamoDB │ │
                       │ │ Tables   │ │
                       │ └──────────┘ │
                       └───────────────┘

Security Layers

GovCloud Security

  • • AWS GovCloud for FedRAMP compliance
  • • ALB with Cognito authentication
  • • ECS Fargate for container isolation

Network Security

  • • VPC with private subnets
  • • Security groups with least privilege rules
  • • Network ACLs for additional protection

Application Security

  • • mTLS for service-to-service communication
  • • JWT tokens with short TTL from Cognito
  • • Input validation and sanitization
  • • Container image scanning in ECR

Infrastructure Services

  • • ECS Fargate for serverless containers
  • • Lambda functions for event processing
  • • DynamoDB for multi-tenant data storage
  • • API Gateway for model management

FedMCP Implementation

Cryptographic Accountability

FedMCP (Federal Model Card Protocol) ensures every AI decision is cryptographically signed and auditable, providing complete accountability for semi-autonomous agents in federal environments.

Implementation Details

Signature Algorithm

// ECDSA P-256 Signature Generation
const crypto = require('crypto');

function signAIDecision(decision, privateKey) {
  const sign = crypto.createSign('SHA256');
  sign.update(JSON.stringify(decision));
  sign.end();
  
  return sign.sign(privateKey, 'hex');
}

// Example Decision Object
const decision = {
  timestamp: '2025-01-27T14:32:47Z',
  agent: 'clinical_ai_assistant',
  action: 'patient_risk_assessment',
  result: 'high_risk',
  confidence: 0.92,
  context: {
    patientId: 'hash:7f3a2b1c',
    factors: ['diabetes', 'hypertension', 'age>65']
  }
};

Audit Log Structure

{
  "entryId": "550e8400-e29b-41d4-a716-446655440000",
  "timestamp": "2025-01-27T14:32:47.123Z",
  "signature": {
    "algorithm": "ECDSA-P256",
    "publicKey": "04a9b1c2d3e4f5...",
    "value": "3045022100a7b2c9..."
  },
  "decision": {
    "agent": "clinical_ai_assistant",
    "action": "patient_risk_assessment",
    "result": "high_risk",
    "confidence": 0.92
  },
  "metadata": {
    "userId": "dr.smith@va.gov",
    "sessionId": "sess_2a3b4c5d",
    "requestId": "req_9f8e7d6c"
  }
}

Verification Process

  1. 1
    Request Received: AI agent receives request with user context
  2. 2
    Decision Made: AI processes request and generates decision
  3. 3
    Signature Generated: Decision is signed with ECDSA P-256
  4. 4
    Audit Log Created: Signed decision stored in immutable audit log
  5. 5
    Verification Available: Any party can verify signature authenticity

Data Encryption

Encryption Standards

Data at Rest

  • AES-256-GCM encryption
  • AWS KMS managed keys
  • Automatic key rotation (90 days)
  • Encrypted EBS volumes

Data in Transit

  • TLS 1.3 minimum
  • Certificate pinning
  • Perfect Forward Secrecy
  • mTLS for internal services

Key Management

AWS KMS Integration

All encryption keys are managed through AWS Key Management Service (KMS) in GovCloud with:

  • • Customer Master Keys (CMKs) with strict access policies
  • • Automatic key rotation every 90 days
  • • CloudTrail logging for all key usage
  • • Separate keys per tenant for data isolation
  • • FIPS 140-2 Level 2 validated hardware security modules

Access Control

Authentication

Multi-Factor Authentication (MFA)

All user accounts require MFA using one of the following methods:

  • • TOTP (Time-based One-Time Password)
  • • SMS verification (backup only)
  • • Hardware security keys (FIDO2/WebAuthn)
  • • Biometric authentication (where supported)

Authorization Model

// RBAC + ABAC Authorization Model
{
  "user": {
    "id": "usr_123456",
    "email": "dr.smith@va.gov",
    "roles": ["physician", "researcher"],
    "attributes": {
      "department": "cardiology",
      "clearanceLevel": "secret",
      "location": "va-hospital-west"
    }
  },
  "resource": {
    "type": "patient_record",
    "id": "pat_789012",
    "attributes": {
      "department": "cardiology",
      "sensitivity": "high",
      "location": "va-hospital-west"
    }
  },
  "action": "read",
  "decision": "allow",
  "reason": "User has physician role and matching department"
}

Permission Types

Role-Based (RBAC)

Predefined roles with specific permissions (Admin, Physician, Nurse, etc.)

Attribute-Based (ABAC)

Dynamic permissions based on user and resource attributes

Time-Based

Temporary access grants with automatic expiration

Compliance & Certifications

FedRAMP High (In Progress)

Working towards FedRAMP High authorization for federal agencies.

  • • 421 security controls implemented
  • • Continuous monitoring in place
  • • 3PAO assessment scheduled Q2 2025

HIPAA Compliant

Full HIPAA compliance for healthcare data protection.

  • • Administrative safeguards
  • • Physical safeguards
  • • Technical safeguards
  • • BAA available

Additional Certifications

SOC 2 Type II

Annual audit of security controls

Compliant

NIST 800-53

Security and privacy controls

Compliant

IL5 Ready

DoD Impact Level 5 requirements

Compliant

Security Monitoring

Continuous Monitoring

Our Security Operations Center (SOC) provides 24/7 monitoring of all systems:

  • Real-time threat detection
  • Automated incident response
  • Log aggregation and analysis
  • Vulnerability scanning
  • Security metrics dashboard
  • Compliance reporting

Security Tools

AWS CloudTrail

Complete audit trail of all API calls and user activities in GovCloud

CloudWatch Logs

Centralized log collection from ECS, Lambda, and application services

Container Insights

Performance monitoring and anomaly detection for ECS Fargate tasks

Cognito Advanced Security

Adaptive authentication and compromised credential detection

Incident Response

24/7 Incident Response Team

Our dedicated incident response team is available 24/7 to handle security incidents with defined SLAs for different severity levels.

Response Process

1

Detection & Analysis

Automated detection systems identify potential incidents and alert the response team

2

Containment

Immediate action to prevent incident spread and minimize impact

3

Eradication & Recovery

Remove threat vectors and restore systems to normal operation

4

Post-Incident Review

Comprehensive review to improve security posture and prevent recurrence

Contact Information

Security Incident Reporting:

Email: security@peregrinetec.com
Phone: 1-800-SECURE-1 (24/7)
Response Time: <15 minutes for critical incidents

Additional Resources

API Security Guide