Military Communications and Information Technology: A Trusted ...

Identity and Access Services in NATO
Federation Scenarios
Robert Malewicz, Rui Fiske, Graeme Lunt
Core Enterprise Services, NATO C3 Agency, The Hague, The Netherlands,
robert.malewicz@ncia.nato.int
Abstract: This paper describes an approach for the effective implementation of a standards-based
solution for authentication and authorization services across user realms in NATO.
Keywords: component: identity and access management, federation, SAML, XACML
I. Introduction
A. Background
Identity and Access Management (I&AM) has gained a significant attention
in NATO recently. NATO engages in missions that involve different types of partners
ranging from NATO and Non-NATO nations through to international organizations
and industry.
The diversity of data sharing scenarios makes the boundaries of user and asset
governance realms less obvious. Therefore, much more stress is put nowadays on
trusted mechanisms to control access authorization, going beyond “local” domains,
and even beyond the enterprise. The simultaneous application, in a balanced way,
of two contradictory (by nature) concepts is required on a large scale in a multisecurity
classification information processing environment, i.e. the Need-to-Share
operational requirement and the Need-to-Know security principle.
The problem itself is not new in classified computing environments. The Biba
Model (from 70s), the Bell-LaPadula Model (from 90s) are just two examples of existing
access control enforcement mechanisms. However, the scale of the required
integration in the NATO scenario is what poses a new challenge for communities
of Information Assurance (IA), Information Services (IS) and Information and
Knowledge Management (IKM).
In this context, a NATO-wide I&AM framework, coherent across both network
and organizational boundaries, becomes a key enabler for extensive information
sharing in different NATO federation scenarios.