Military Communications and Information Technology: A Trusted ...

Chapter 4: Information Assurance & Cyber Defence
443
In our approach, the subject policy is assumed to be encoded in the cryptographic
metadata and handled by key management, without the need of a separate subjectowner
negotiation.
Embedding access control information in the XML-document itself has a number
of possibilities, such as the policy-tag in [5] and specific XML-derivative languages
[4]. The responsibility to enforce this information lies, however, with the data
storage, and is usually insufficient with MLS. Of the XML-derivative languages it is
stated in [21] that the whole concept of RBAC for XML is still immature.
The XML framework is originally not designed to be used for MLS [20]. MLS
in XML is somewhat tied to the data management systems available, but our work
is independent from this.
III. Environment assumptions
A. Cryptographic Access Control
Our work attempts to solve parts of the cryptographic access control (CAC)
paradigm, in which traditional access control enforcement method with (implicitly
trusted) reference monitors are replaced by cryptography. This shift is motivated
by the high assurance demands on the enforcement method and the inherent lack
of high assurance in the majority of the real-life reference monitors (such as commercial
OSs) as well as by cloud computing.
The CAC-paradigm benefits include more solid theory (and thus assurance)
behind the actual implementations, and easier distributability of encrypted content
into the cloud. Especially from the perspective of MLS, standardized encryption
algorithms provide an accepted means of protecting classified data [10] and enforcing
the isolation of different classes.
Enforcing access control cryptographically requires a shift in the mindset
as well: cryptography is not by itself able to enforce much anything. It has mainly
two premises (in this context):
• Cryptography can disable the READ-permission by making the material
incomprehensible (it can not permit viewing per sé)
• Cryptography can disable WRITE-permission by making it possible to
detect unauthorized changes; it can not prevent bit-flips or deletions /
insertions as such.
Thus anything enforcable cryptographically should be able to be reduced to
a set of read- and write-operations.
B. Publish-Subscribe model
We adopt the model depicted in [5] for third-party distribution of XMLdocuments,
and introduce a “smart edge” acting in between the user and the cloud.
The architecture is shown in Fig. 2.