Military Communications and Information Technology: A Trusted ...

374 Military Communications and Information Technology...
it is recommended for NATO to address the following categories of the federation
standardization aspects:
• Federated authentication standards, to provide an input on which standards
should be used for authentication among federated domains;
• Attribute exchange standards, to provide an input on which standards
should be used to conduct and control attribute exchange among federated
domains;
• Security standards, to provide an input on the coherent protection mechanisms
to be applied in order to achieve the same protection level in the whole
federation;
• Federation-specific profiles, to provide an input on what a federation profile
should specify;
Depending on which NATO scenario is considered (NATO Enterprise vs.
Alliance), the specific decisions in all the four identified areas may vary.
Under the ACT Program of Work, several service interface profiles (SIP) have
been proposed that should be utilized in the NATO federated identity and access
service architecture specification.
IV. Conclusions
Achieving a successful implementation of the federation capability is strongly
dependent on the IdM governance, currently missing in NATO, so that centralized
administration of I&AM will be capable to overcome a lot of ad hoc solutions on
the present. The IdM governance must include rigidly defined processes, supported
by appropriate regulations in the NATO policy.
The approach for cross-organizational authentication and authorization solution,
proposed in this paper, provides foundations for a technical implementation
of federation capabilities in NATO NII. It is not meant to replace the main authentication
mechanism, based on Kerberos, being in use in NATO systems currently.
Federation solutions are only meant to enhance a local authentication mechanism
in user’s governance realm in support of information sharing capability across
network and organizational boundaries.
This enhancement aspect (instead of replacement) is very important to properly
understand how the federation capability should be utilized in NATO. In this
context, it should be also noted that the authentication method used in a user
“local” environment does not have any impact on the overall approach presented
in this paper. Therefore, there is no contradiction between having the federation
capability built-in the NATO systems core functionality package and for example
the strong authentication capability required by the IA community through the Cyber
Defence Action Plan [9].
It should be noted that the strong authentication capability in the NATO
Enterprise is desired but insufficient to meet collaboration requirements in com-