Military Communications and Information Technology: A Trusted ...

Chapter 4: Information Assurance & Cyber Defence
381
Figure 2. Passive missile defence information exchange scenario
III. Security requirements
The security requirements introduced by the HAAG have been captured
in a form of protection profile (PP) compliant with the Common Criteria (CC)
Version 3.1 Release 3 framework [9]. This approach has been taken by the authors
already earlier, when designing the medium assurance XML-Labelling Guard
(XLG) [1].
Although the HAAG PP is based on the XLG PP, the HAAG introduces
several new functional and assurance requirements when compared to the XLG.
New functional security requirements are related, e.g., to need for authentication
of originators or requestors of mediated information flows, in order to provide
stronger accountability when compared to XLG. Other new security functional
requirements are related to integration with the cyber defence framework and to
use of more complex CPR security policies.
When compared to [1], most of the new security assurance requirements
(SARs) are related to the need to assure secure lifecycle for the HAAG. The approach
taken in the HAAG PP in order to assure the trustworthiness of the HAAG throughout
its lifecycle is largely compatible with the U.S. Government Protection Profile
for Separation Kernels in Environments Requiring High Robustness (SKPP) [10].
The main conceptual difference is that SKPP focuses on operating system and does
not address trustworthiness of the application software running on top of the operating
system. The HAAG PP applies the paradigms adapted from the SKPP to
the application layer. In the HAAG PP, the assumption is that underlying operating
system can be trusted (e.g., because it was evaluated according to the SKPP) and
the focus is on providing sufficient evidence that functionality implemented on top
of the OS, i.e. the HAAG application, configuration and other TOE components,
can be also trusted to a level commensurate with the value of protected resources.
In addition to this conceptual difference, the formal differences are related mainly
to the fact that SKPP v 1.03 was based on the CC v. 2.3 and the HAAG PP is based
on the CC v. 3.1 R3. Some of the SARs, which were predefined in the CC v. 2.3 and
used within the SKPP, were removed in the CC v. 3.1 [9].