Military Communications and Information Technology: A Trusted ...

On Multi-Level Secure Structured Content:
A Cryptographic Key Management
– Independent XML Schema for MLS Content
Mikko Kiviharju
Electronics and Information Technology Division,
Finnish Defence Forces Technical Research Centre, Riihimäki, Finland,
mikko.kiviharju@mil.fi
Abstract: Multi-Level Security, MLS, refers to handling information from different levels of security
classification securely by people from different levels of clearance. We propose a structured document
format to host data from different classification levels (e.g. RESTRICTED and SECRET) in the same,
modifiable document. The document access control is enforced cryptographically – content and access
control information is encrypted and digitally signed, but the document structure itself is independent
of the adjoining key management architecture. We detail the different security-related metadata and
sanitization procedures needed for passing data from a common storage to a user with lower clearance.
Keywords: MLS; CBIS; XML; cryptography; key management
I. Introduction
Handling classified information in today’s networked world with conflicting
needs to hide and to share both in homeland and in coalitions with dynamically
shifting boundaries is becoming increasingly more cumbersome.
Large information leaks from classified networks (e.g. the one described in [22])
are partly possible only because the concept of system-high networks has been
stretched to its limits: it makes no sense to classify data (to e.g. MISSION SECRET),
if most of the personnel are cleared to the highest level anyway. This is, however,
currently the only economical solution dictated by the existing technology in use.
Technologies that take full use of the security classification spectrum without
trivial physical separation (and duplication) in hardware are called Multi-Level Secure
(MLS). There have been a number of solutions aspiring to be MLS in the past,
and the work is still ongoing.
Our work concerns the cryptographic approach to enforce MLS. We envision
structured documents (i.e. XML), with content from multiple different classifications,
which is then encrypted, signed, and eventually filtered from the most
sensitive items before given to the end user. We propose an XML schema based on