2007 Issue 2 - Raytheon

al information systems (MNIS).
MNIS are inherent in battle command
to ensure the timely
exchange of information across all
coalition member domains and
government agencies. Raytheon is
doing research with the DoD to
identify the issues and potential
solutions under a study contract.
With the proliferation of coalition
operations and joint operations, the
issue of information separation
becomes even more challenging.
Not only must the information be
separated by clearance levels with
each country’s security policy, but
well-defined information must be
shared across multiple countries,
where agreements to share are on
a bilateral basis. Information
releasable to certain countries is
not releasable to other coalition
partners. This complicated set of
access control rules makes the Bell-
LaPadula hierarchical security model
of “write up, read down” traditionally
used in MLS systems look simple.
Raytheon is currently working
to solve this demanding challenge
of sharing information in the presence
of multiple compartments
within single security levels.
Trusted Operating Systems
There are several common
approaches when attempting to
provide MLS capability. One is to
use a trusted operating system that
attaches sensitivity labels to all
objects within the domain. (Sun’s
Trusted SolarisTM is an example of a
trusted operating system.)
Sensitivity labels identify security
classification and handling restrictions
of the object. The sensitivity
labels are compared to the user’s
security clearance and privileges to
determine if access to the object is
allowed. These operating systems
are proprietary, tend to be very
difficult to administer, and are at
times extremely cumbersome to
use. Because of their size and complexity,
they have typically been
evaluated only to a medium level of
robustness. Due to administrative
difficulties, customers often prefer
less trustworthy operating systems
such as Windows.
Multiple Independent Levels
of Security
Another approach being developed
to provide MLS capability is called
Multiple Independent Levels of
Security (MILS). Raytheon has been
working with the Air Force Research
Laboratory Information Directorate,
the Cryptographic Modernization
Program and the National Security
Agency for several years on the
foundational components for this
high assurance architecture to support
systems with MLS requirements
and/or Multiple Single Levels
of Security (MSLS).
The goal of the MILS program is to
establish a viable commercial market
for high assurance, standardsbased
commercial off-the-shelf
(COTS) products that can be used
to produce NSA-accredited systems.
By leveraging COTS products that
conform to the DO-178B safety
standard, it is anticipated that the
wider customer base for these products
will result in a lower cost to
DoD security customers.
MILS have a layered architecture
that enforces an information flow
and data isolation security policy.
At the bottom layer of the architecture
is a small but highly trusted
separation kernel. A separation kernel
executes on processors such as
Pentiums and PowerPCs to provide
a virtual machine upon which a
variety of COTS operating systems
(e.g., Windows, Lynux, Solaris, etc.)
can be hosted. The separation kernel
provides a high robustness reference
monitor 1 to enable this separation
and to control communication
between untrusted applications
and data objects at various
levels of classification/caveats on a
single processor. It also enables
trusted applications to execute on
the same processor as untrusted
applications, while ensuring that
the trusted applications will not be
compromised or interfered with in
any way by the untrusted applications,
(see Figure 2). Security policy
enforcement mediated by the separation
kernel is non-bypassable,
always invoked and tamper-proof,
because it is the only software that
runs in privileged mode on the
processor. Thus, systems with applications
at different security
levels/caveats require fewer processing
resources.
The separation kernel’s security
requirements are specified in the
NSA’s U.S. Government Protection
Profile for Separation Kernels in
Environments Requiring High
Robustness, now in its final draft. A
separation kernel can be evaluated
to a high level of assurance
(Evaluation Assurance Level (EAL
6+), because it is very small — on
the order of 4,000 lines of
C-Language code. Although originally
targeted to real-time, embedded
systems, the Separation Kernel
Protection Profile (SKPP) has been
generalized to provide the security
requirements for a high assurance
virtual machine on which operating
systems with medium or no assurance,
such as Windows, can execute
in separate partitions without
degrading the assurance of the
overall system.
The Green Hills Software (GHS)
Integrity Separation Kernel is available
commercially and is currently
undergoing evaluation at a high
robustness level by a National
Information Assurance Partnership
(NIAP) accredited Common Criteria
Testing Laboratory. It is targeted for
embedded and server applications
running on PowerPC and Intel ®
processors. The Integrity Separation
Kernel is being used in the
Raytheon’s Space and Airborne
Systems NETSecure internal research
Continued on page 10
1 IAEC 3285, NSA Infosec Design Course,
High Robustness Reference Monitors version 3,
Michael Dransfield, W. Mark Vanfleet.
Raytheon is fielding a
product called CHAIN
(Compartmented High
Assurance Information
Network). CHAIN
permits the separation
of the information by
compartments (as the
name implies). Until
the true MLS system is
available, Raytheon is
fielding CHAIN in
multiple systems to
separate information
from different
domains using the
compartments
enforcement
mechanism. There are
multiple commercial
operating systems that
allow this enforcement.
To upgrade from
compartments to
multi-level security, the
underlying operating
system must meet the
functionality and trust
discussed in this article.
RAYTHEON TECHNOLOGY TODAY 2007 ISSUE 2 9