Military Communications and Information Technology: A Trusted ...

Chapter 4: Information Assurance & Cyber Defence
389
• Interfaces between the CIPEF and the content filters
• Proxy Interfaces
The main element of the CIPE Service included in the HAAG TOE is the CI-
PEF. The CIPEF is responsible for the management and scheduling of data objects
as they are routed through the content filters. The route through the content filters
depends on the identified data object(s) and any embedded data objects and is adjusted
dynamically. The CIPEF provides interfaces for data objects to be input into
the CIPEF and output from the CIPEF. Any suspect, malicious or unsupported
data objects are quarantined for further investigation and appropriate authorised
handling.
The Identification, Verification and Transformation capabilities are implemented
in CIPE Service by means of the Content Filters. The Content Filters constitute
a part of the HAAG operational environment and are discussed in section
dealing with external supporting services.
A Proxy Interface is the boundary between the CIPE Service and the HAAG and
can handle protocol and content mediation between the data source and the CIPEF.
4) Local Security Policy Repository Service
The Local Security Policy Repository Service provides access to all security
policies, which are enforced within the HAAG. It provides a management interface
enabling configuration of the policies, including possible synchronization with
centralized security policy repository. The policies stored within the local repository
include both IFP enforced by the HAAG on the mediated data and an access
control policy for the HAAG users. The IFP is provided by so-called Content-based
Protection and Release Policy (CPR). The CPR policy consists of two specific policies:
Content-based Protection Policy and Content-based Release Policy. The Contentbased
Protection Policy defines the technical protection measures, which have to
be enforced by the user’s operational environment (i.e. network and user’s host)
in order for the information to be securely released. The Content-based Release
Policy defines the required user’s attributes, such as security clearance and associated
security domain for allowing an information release.
D. External Supporting Services
This section briefly introduces the services, which are provided by the operational
environment in support of the HAAG capability. These services are not part
of the HAAG target of evaluation, and as such their assurance level and functionality
will not be evaluated during the HAAG evaluation. However, it is recommended
that their implementation should provide a level of assurance equal or higher to
the level provided by the HAAG.