Military Communications and Information Technology: A Trusted ...

Chapter 4: Information Assurance & Cyber Defence
445
versioning and storage functions. Storage does not perform high-assurance
authentication of document requests, so it is assumed to be easy to bypass
the Filter-edge of the cloud.
• Filters form the “smart edge” of the cloud. They relay the functions between
Users, Owners and Storage. Filters are semi-trusted in that they are
allowed to perform administrative functions inside a document, but they
are not trusted to see or alter the actual content or the security policy. Filters’
primary objective is to exercise RTK-level control to the content, and
remove those parts of the document the User is not cleared to. User must
be able to check the completeness of the document, so Filter must provide
her with sufficient verification information.
IV. Schema design principles
A. Previous work
The definition work on CBIS, [12], identified some necessary elements and their
interrelations on the structured document. However, these were purely motivated
from the CBIS needs, and not very detailed or standard-oriented.
The actual structured format was canonized and integrated into other data
models in an internal work together with Finnish defence industry [14]. This
resulted in an actual schema, but too heavily tied to existing PKI and referencemonitor-based
thinking (it could not enforce actual CAC). Furthermore, the first
version of the schema did not elaborate the effect of dynamic compound signatures
resulting from the need to restructure the document passing an MLS-filter (which
removes classified parts exceeding the User’s clearance).
B. Design principles: key managent architecture independency
The main motivation for this work was to establish a concrete and canonized
specification for the CBIS document structure that would last over the different
developmental phases and public-key management architectures. Thus there
is a type of cryptographic interface the schema should comply to. This interface
is constructed based on the least common denominator (of the PKMAs):
• Content is enciphered with a block cipher and the block cipher key (block
key) itself is encrypted. The schema should not make more reservations
than this to the key management.
• Content can be represented by the output of a secure hash-function
• The content integrity is enforced by signatures (but their exact type is not
specified)
• If the permission type is WRITE, the space occupied by the block key is used
to host the public key needed for verification. Note that the User Agent