6th European Conference - Academic Conferences

Harm Schotanus et al.
In this setup we add a third element, namely the release mechanism. Essentially, the other elements
stay the same. This release mechanism has a two-fold purpose. The first is to verify that a suitable
label accompanies the information and if not, try to retrieve the label from the information
management system. The suitability is established by validating that all the necessary information is
present. The second purpose is the ability to translate an internal label to an external label. For
example certain elements may be removed from the document (such as the name of the author) or
other information may be added (e.g. the date of information exchange), or a different labelling
structure may be used for internal and external purposes 2 .
3.3 Integrity protection
The third step in extending the labelling architecture is to realise integrity protection of information.
Integrity protection refers to the means to establish whether a document is authentic or has been
changed. And as a secondary benefit, it may be established who assessed the authenticity.
The label has to be extended to include a secure binding to link the information and the label together,
in such a way that it can always be detected if an existing label is attached to other (different or
altered) information, or if the label content has been changed. Making a change to an information
object can be detected because that would result in a different object.
For the binding to be secure we need cryptographic support. A method, amongst others, of realising
this is through a PKI. A user has to use a private key to sign the binding in the label, which links the
binding also directly to the user. That is, it can easily be determined who created the label. To validate
the integrity of the document, the public key of the user that created the binding can be used to verify
the binding in the label. In case any changes have been made, the verification will fail.
Certificates
and CRL
Labelling
application
Trusted OS
Workstation
Labels and
documents
PKI
Document
Information
management
system
Label
Release
mechanism
and IEG
Figure 4: Labelling for integrity protection
For a high assurance environment 3 , we also need to ensure that the labelling process works correctly.
In other words we must have a level of assurance that the information the user actually labelled is the
correct information and has not been modified unbeknownst to the user during the process. We
cannot attain that level of assurance on a normal platform (operating system); therefore we need an
operating system or platform that can provide us the needed assurance. This has been named a
trusted operating system. Essentially, each step in the process of labelling must be carried out under
2 Note that the release mechanism does not comprise the entire interconnection here, there may be other elements needed too,
for instance cryptographic units or firewalls to ensure a secure connection.
3 For instance information domains which process highly classified information.
233