6th European Conference - Academic Conferences

Harm Schotanus et al.
2.3.1 Secure labelled release
Meta-information can also be used to protect, i.e. ensure that information is not shared. For example
do not share objects for which the meta-information says that the creation date is the current month.
Or do not share videos with a resolution higher than 640x480. Or do not share presentation files
which are classified ‘NATO CONFIDENTIAL’ or higher. We address a specific case where criteria that
are suitable for determining the releasability to another domain are carried in meta-information bound
to an information object as secure labelled release.
2.3.2 Dissemination of release information
Somewhere in the middle of duty-to-share and duty-to-protect is the usage to include metainformation
to inform the recipient about any restrictions or responsibilities when processing or resharing
the information. We address this by the moniker disseminating release information.
These developments are not without consequences or certain security challenges. Especially in the
areas of binding meta-information to information and protecting the integrity of (a) this binding, (b) the
information and (c) the meta-information has to be carefully designed. When meta-information is used
in a sharing mechanism and a user on a local workstation can create meta-information, then the
(integrity of the) workstation and its components become critical because an insecure or untrusted
operating system might trick a user into sharing the wrong information. The required level of
assurance depends largely on the level of security that needs to be attained but is also affected by the
specific application of meta-data.
There must also be a fundament to build the meta-information on, such as a system to store and
manage meta-information, retrieve the meta-information given the information itself or vice versa. And
there are many other related challenges in handling data, e.g. how to handle to conflicting sets of
meta-information, how can meta-information be revoked or changed, and so on. These issues need to
be addressed in an information management system 1 .
3. Labelling: An incremental approach
In the previous section we have seen that labelling has manifold purposes. The emphasis has mostly
been on secure labelled release for exchanging information across different security domains. We
propose an incremental approach in which partially related developments are tied together so that
functionality enabled by labelling can be realised step-by-step. This has two main advantages. One, it
will make the development process better organised and hence can be more efficient and costeffective.
Second, users and organisations can benefit from labelling directly because the new
functionality can be used as soon as the step is completed. This is also beneficial for the userexperience.
To achieve this incremental approach, a clear overview is needed of which steps must be taken to
realise each of the intermediate functionality whilst ensuring that the ultimate goal, which is also the
most complex, can still be reached. In this section we propose a plan to achieve the secure labelled
release in a series of smaller, incremental steps that add useful functionality to existing or new
processes. We distinguish four phases:
1. Information lifecycle management
2. Disseminating cross-domain information
3. Integrity protection
4. Secure labelled release.
3.1 Information lifecycle management
In this context, labelling functionality is used to improve information management within a single
information domain. A user may add additional meta-information to an information object, such as the
author, title, publication date, classification – the possibilities are virtually endless. This enables
various management functionality to be used on the document as discussed in Section 2, including
archiving, searching, and deleting information.
1
An information management system comprises more aspects than a content management system that is merely a container
to store and share information within a single domain.
231