2007 Issue 2 - Raytheon

Feature
Col. Roger Shell was
the deputy director of
the National Security
Agency’s (NSA)
National Computer
Security Center (NCSC)
as it was formed in the
early 1980s. Dr. Kenneth
Kung joined NCSC in
1984 as one of the
system evaluators using
the famous Orange
Book. He learned his
information assurance
techniques from
Dr. Shell and other
early pioneers in this
field (e.g., Steve Walker,
David Bell, Marv
Schaefer, Earl Boebert,
etc.). Dr. Kung is the
co-author and
contributor to several
other Rainbow Series of
guidelines, while NSA
remains the premier
organization to learn
the latest information
system and weapon
system protection
techniques.
8 2007 ISSUE 2 RAYTHEON TECHNOLOGY TODAY
The Benefits of
Multi-Level Security
Multi-level security (MLS)
has been a holy grail ever
since the early days of
applying computer systems to meet
the automation needs of military
and intelligence systems. In the
1970s, MITRE published a series of
papers (by Bell and LaPadua) that
describe the issues and rules of
determining access rights of individual
users to information, based on
their credentials. In fact, in 1971,
Dr. Roger Schell (then a U.S. Air
Force major) conducted his Ph.D.
research at MIT on the Multics OS
protection rings.
Although multiple initiatives in the
1980s and ‘90s were launched to
tackle the MLS “problem,” the issue
is still with us today. This article
addresses the background of the
issues involved in solving the general
MLS problem. It also describes
both the security functionality and
the assurance needs of the
Department of Defense (DoD) community
of users and possible solutions
to address those needs.
The DoD has a goal of fielding
systems that provide the right information
at the right time to the
right person. In many cases, this
goal is difficult to achieve due to
the security classification of
the data. To properly safeguard
information today, many DoD information
systems are separated in
domains at the highest classification
level of any data in the
domain. They are commonly
referred to as “system high”
domains. If an individual does not
possess a security clearance to
access a domain, they are denied
access to all information within the
domain, even though some of the
information may have originated at
a lower classification and thus
should be accessible to the individual.
To ameliorate this problem,
high-speed guards requiring additional
hardware and processing
overhead, or labor intensive procedures
such as manually reviewing
data, are commonly used when
moving data between domains.
The single-level security domain
paradigm is not compatible with
this time-sensitive collaborative processing
environment needed to
support net-centric operations and
the systems of element approach
where information is first published,
then later subscribed. The concept
of using single-level security
domains results in over-clearing personnel,
over-classifying data and
creating system inefficiencies and
redundancies. To minimize or eliminate
these problems, the concept
of MLS systems was developed.
MLS eliminates the need for these
separate domains. MLS systems
reduce the total cost of ownership
by eliminating hardware and software
redundancies. Top secret,
Unclassified
Domain
secret, confidential and unclassified
data all can reside in a single MLS
domain. MLS provides the ability to
simultaneously receive, process,
store and disseminate data of multiple
classifications within a domain
where not all users have the security
clearance to access all the data
within the domain. MLS needs to
permeate into the computing environment
(workstations, servers and
operating systems), the network,
the database and the mission applications
— all must work together
to maintain trust. MLS systems
must assure that users are granted
access to all the data, systems and
services for which they are authorized,
while denying them access if
they are not authorized.
Figure 1 illustrates a traditional
configuration using guards between
security domains on the left and an
MLS enclave on the right.
Multinational
Information Systems
The next major research milestone
is to tackle the issue of multination-
Traditional: one domain per
security classification Multi-level security (MLS)
Secret
Domain
Data Store
High Speed Guard
Data Store
High Speed Guard
Computing
Environment
Switch/Router
Computing
Environment
Switch/Router
Data Store
Top
Secret
Domain Computing
Environment
Switch/Router
Figure 1. Traditional vs. MLS Enclaves
Top Secret
Data Store
MLS Domain
with
Unclassified
through
Top Secret
Secret
Data Store
Switch/Router
Unclassified
Data Store
Computing
Environment