Military Communications and Information Technology: A Trusted ...

372 Military Communications and Information Technology...
Figure 4. Directory Services Topology in Secret Environment
NEDS is not meant to interconnect with any identity store operating in a different
security zone and/or governance realm. In the NEDS project, the role of directory
data synchronization repository for external parties is assigned to a (not
yet deployed) Alliance Replication Hub (ARH). It will be deployed in the NS
demilitarized zone (DMZ).
It is recommended to use the ARH as an identity data store for the federation
proxy component (Figure 2) in support of SAML-token issuance processes and
controlling functions.
An option of the NEDS project will be executed in the future, aimed to deploy
the directory data synchronization mechanism at the NU/NR level.
3) Data (Attribute) types:
Identity data can be categorized in the following way:
• Biometrics,
• Personally Identifiable Information,
• Qualifications,
• Tokens,
• Roles,
• Privileges.
NATO specified the Allied Communications Publications (ACP) 133 directory
services standard. It provides foundations for NEDS directory schema definition.
However, ACP 133 is not capable to support all the categories listed above. Therefore,
extensions of the ACP 133 standard may be required.