Military Communications and Information Technology: A Trusted ...

378 Military Communications and Information Technology...
Information security domains can be implemented as both physically separated
network domains or as virtual domains, using same network infrastructure
and relying on cryptographic separation. Cryptographic separation means here
encryption of all information belonging to particular information domain, making
it inaccessible from other information security domains. In a simple scenario, which
is analogous to the scenario addressed in [1], the guard separates two information
security domains located in two physically separated network domains. In such
scenario, one network enclave is typically denoted as high and the other as low. It is
important to stress that in some of the HAAG usage scenarios the concepts of high
and low information security domain may not mean high and low classification
levels, as in many cases no order function can easily be defined between the classification
levels (and thus information security domains) belonging to different
organizations or nations.
In a simple HAAG implementation scenario it can be further assumed that
the guard is connected to the low and the high information security domains (and
thus low and high network enclaves) using separate physical network interfaces.
However, this limiting assumption will not be necessary true in a more general
case, where the information security domains can be virtualized.
The HAAG limits the data flow between information security domains through
enforcement of mandatory security policies. These security policies include information
flow control policy, access control policy, and information protection
policy. The set of these security policies is collectively called as Content-based
Protection and Release (CPR) policy [2]. The CPR policy is being currently specified
at the NCIA as a part of 2012 Allied Command Transformation (ACT) Scientific
Program of Work (SPoW).
A cross-domain information exchange introduces two major threats to security
of involved information security domains: (1) leakage of confidential information
from one information security domain to another information security domain;
and (2) degradation of the integrity or availability of resources in one information
security domain as a result of actions originating from another information security
domain. The purpose of the HAAG is to enable, together with other components
in the IEG, an effective and efficient cross-domain information exchange, while
offering sufficient protection against the threats mentioned above and enforcing
an appropriate information flow control policy.
II. Use cases
Classical use cases for information sharing between NATO Secret systems
and non-NATO partners and unclassified networks involve document and email
release. The capability to reliably and timely share information across the security
domains is one of the desirable operational requirement in the current NATO operations,
e.g., need for information sharing between NATO forces and non-NATO