Military Communications and Information Technology: A Trusted ...

Chapter 4: Information Assurance & Cyber Defence
383
B. Phase 1: High assurance automated guard as a gateway
A logical evolution of the Phase 0 design is to replace the cascade with a single
high assurance guard used as a gateway, an architecture shown in Figure 4.
Figure 4. High assurance automated guard (HAAG) as a gateway
This architecture uses the HAAG as a dedicated information flow control
device between the domain with a lower and a higher trustworthiness. In addition,
the HAAG must be accompanied by, and usually collocated with, additional
security tools, such as firewalls and malware detection software.
Compared to the Phase 0 architecture, there are two important differences. First,
the HAAG authenticates users from both low and high domains, whereas only network
interfaces were authenticated in Phase 0. The authentication is mainly for auditing and
accountability purposes, but can also constitute an input for an authorization of access
to the data (e.g. basic enforcement of need-to-know principle). Second, the required
assurance level for the HAAG design and implementation is significantly higher.
Phase 1 improves the assurance and information flow capabilities in a short
to medium time-frame. It relies on support for cross-domain authentication, e.g.
by implementing a claims-based identity and access control [11]. This architecture
allows also a gradual introduction of elements of the CPR security policies. The CPR
security model is envisaged to replace in the long term an inflexible Bell-LaPadula
security model, which is not suitable for a modern dynamic and federated coalition
environment.
C. Phase 2: High assurance automated guard as a separation service
In Phase 2 of the HAAG development a more radical approach is taken toward
solving the information sharing challenges. This approach is based on a complete
rethinking of the security model used within NATO and utilizing implementation
of advanced cryptographic mechanisms. In this architecture, depicted in Figure 5,
the concept of security domains is abandoned, and the information flow is controlled
through a HAAG service implemented in a distributed fashion.