6th European Conference - Academic Conferences

Harm Schotanus et al.
conditions that are guaranteed by the operating system, but on the other hand a user must also be
capable of performing his regular tasks on the same platform. We see opportunities to establish this
based on a virtualisation layer on top of a minimal, but trusted core operating system. One virtual
machine will comprise normal functionality and a second will form the labelling application with strict
limitations, this concept is further elaborated upon in (Verkoelen 2010).
An architecture of a workstation that is suitable for creating labels in a trusted manner, is shown in
Figure 5 (Hartog 2010). In essence, this is a virtualisation platform with two virtual machines. One is
used as a workstation with the common applications. The other is used specifically for labelling which
is focussed on binding a label to a given information object in such a way that the process cannot be
disrupted and assurance can be given that only the provided information object is labelled and
nothing else. The information to be labelled has to be exported from the generic to the specific virtual
machine where a label can be created. Then the label can be transferred back to the workstation.
Workstation
Desktop
Labelling
High Assurance
Platform
Hardware
Figure 5: Architecture of a workstation for trusted labelling
The needed level of assurance is created by a high assurance platform. The core component
therefore can be a separation kernel (Rushby 1981)(Information Assurance Directorate 2007), which
is in control of all resources in the system and all communication between the virtual machines. The
virtualisation is layered on top of the HAP. In certain cases with high assurance requirements, specific
hardware requirements may have to be used, but mostly it can be based on generic hardware.
3.4 Secure labelled release
The final objective of this incremental approach is the secure labelled release. The label can then be
used to validate the suitability of exchanging a document across different security domains where the
security policies of the domains may be different. The suitability is determined by different metainformation
stored in a protected label. This could for example refer to the classification of the
information in the document, but may also refer to capabilities of the source of the information
(Smulders 2010),such as the quality of the camera used to take an aerial photograph, or the range of
radar. And of course combinations are also possible. The validation takes place at the border of the
information domain. The label is intended for internal usage, and does not have to be included after
the information has been released. However, it is also a possibility to translate the label to use as in
the case of “Disseminating release information”.
To extend the integrity protection set-up to a full secure labelled release setup we have to add an
extended release mechanism. This extension is twofold. In the first place the release mechanism
must be capable of integrating with the PKI to validate the authenticity of the label and match it
against the document. The release mechanism has to validate the certificate of the user that created
234