Information Sharing and Security in Dynamic Coalitions Steven A. Demurjian Computer Science & Engineering Department 371 Fairfield Road, Box U-2155 The University of Connecticut Storrs, Connecticut 06269-2155 http://www.engr.uconn.edu/~steve email@example.com
Overview of Presentation • The Dynamic Coalition Problem • Civilian Organizations • Military Involvement/GCCS • Information Sharing and Security • Federating Resources • Data Integrity • Access Control (DAC and MAC) • Other Critical Security Issues • Stepping Back • Security Issues for Distributed and Component-Based Applications • Conclusions and Future Work
Crisis and Coalitions • A Crisis is Any Situation Requiring National or International Attention as Determined by the President of the United States or UN • A Coalition is an Alliance of Organizations: Military, Civilian, International or any Combination • A Dynamic Coalition is Formed in a Crisis and Changes as Crisis Develops, with the Key Concern Being the Most Effective way to Solve the Crisis • Dynamic Coalition Problem (DCP) is the Inherent Security, Resource, and/or Information Sharing Risks that Occur as a Result of the Coalition Being Formed Quickly
Near Simultaneous Crises Crisis Point BOSNIA (NATO) NATO Hq KOSOVO (US,UK) Olympic Games Earthquake (United Nations) Ship Wreck (UK,SP)
Crises in 2005 • Tidal Wave in Southeast Asia • Hurricanes in US • Katrina – Louisiana and Mississippi • Rita – Texas and Louisiana • Mudslides in Guatemala • Earthquake in Pakistan/India • Key Questions • How do we React to Such Crises? • What is Potential Role for Computer Scientists and Engineers in Process? • Can we Automate the Interactions Required for the Critical Computing Infrastructure?
Emergent Need for Coalitions • “Coalitions must be flexible and no one coalition is or has the answer to all situations.” • Secretary of Defense, Donald Rumsfeld • “Whenever possible we must seek to operate alongside alliance or coalition forces, integrating their capabilities and capitalizing on their strengths.” • U.S. National Security Strategy • “Currently, there is no automated capability for passing command and control information and situational awareness information between nations except by liaison officer, fax, telephone, or loaning equipment.” • Undersecretary of Defense for Advanced Technology
The Dynamic Coalition Problem (DCP) • Dynamic Coalition Problem (DCP) is the Inherent Security, Resource, and/or Information Sharing Risks that Occur as a Result of the Coalition Being Formed Quickly • Private Organizations (PVO) • Doctors Without Boarders • Red Cross • Non-Government Organizations (NGO) • State and Local Government • Press Corps • Government Agencies • FBI, CIA, FEMA, CDC, etc. • Military
Supporting Advanced ApplicationsDCP Objectives for Crisis • Federate Users Quickly and Dynamically • Bring Together Resources (Legacy, COTs, GOTs, DBs, etc.) Without Modification • Dynamically Realize/Manage Simultaneous Crises • Identify Users by Roles to Finely Tune Access • Authorize, Authenticate, and Enforce a Scalable Security Policy that is Flexible in Response to Collation Needs • Provide a Security Solution that is Portable, Extensible, and Redundant for Survivability • Include Management/Introspection Capabilities to Track and Monitor System Behavior
DCP: Coalition Architecture Clients Using Services Resources Provide Services NATO SYS Federal Agencies (FEMA, FBI, CIA, etc.) Client COTS U.S. Army LFCS (Canada) Client U.S. Navy SICF (France) Client French Air Force Client HEROS (Germany) U.S. Legacy System SIACCON (Italy) NATO Database Client NGO/PVO Resource German NGO/PVO (Red Cross, NYPD, etc.) Client GCCS (US) COTS Client
DCPJoint and Combined Information Flow GCCS GCCS-A CORPS ABCS MCS XX DIV FAADC2I MCS CSSCS AFATDS ASAS X BDE BSA TOC MCS X X | | | | BN BN | | MCS MCS CO FBCB2 Common Operating Environment Combined: Many Countries ARMY Joint Task Force Adjacent Marines Navy Coalition Partners Air Force GCCS-M GCCS-N GCCS-AF NATO Systems TCO JMCIS TBMCS Coalition Systems Joint - Marines, Navy, Air Force, Army
DCP: Combined Information Flow Logistics GCCS - Joint/Coalition - Maneuver Air Defense/Air Operations Fire Support Combined Database Intelligence Network and Resource Management
DCP: Coalition Artifacts and Information Flow – Military Engagement U.S. Global C2 Systems Air Force Navy Joint Command System Battle Management System NGO/ PVO GCCS U.N. Army Battle Command System Combat Operations System NATO U.S.A Army Marine Corps Dynamic Coalition AFATDS FADD GOAL: Leverage information in a fluid, dynamic environment ASAS GCCS-A ABCS CSSCS MCS Other Army C2
DCP: Coalition Artifacts and Information Flow – Civilian Engagement Red Cross Pharma. Companies Govt. MDs w/o Borders EMTs RNs MDs State Health Other Transportation Military Medics Govt. Local Health Care CDC ISSUES: Privacy vs. Availability in Medical Records Support Life-Threatening Situations via Availability of Patient Data on Demand
DCP: Global Command and Control System GCCS Provides: - Horizontal and Vertical Integration of Information to Produce a Common Picture of the Battlefield - 20 separate automated systems - 625 locations worldwide - private network Situational Awareness GLOBAL C2 SYSTEMS MOBILE SUBSCRIBER EQUIPMENT DATA RADIO SATELLITE MISSION PLANNING MET SUPPORT INTEL SATCOM MANEUVER CONTROL X X AIR DEFENCE ARTY TOPO Client/Server MET MISSION PLANNING AIR DEFENCE SUPPORT INTEL X MANEUVER CONTROL Client/Server SATCOM ARTY TOPO Company AIR DEFENCE FBCB2 /EBC SUPPORT INTEL Platoon Client/Server ARTY Tactical Internet MANEUVER CONTROL BATTLEFIELD C2 SYSTEM EMBEDDED BATTLE COMMAND SATCOM FBCB2 /EBC Squad MOBILE SUBSCRIBER EQUIPMENT
DCP:Global Command and Control System Joint Services : a.k.a Weather METOC Video Teleconference TLCF Joint Operations Planning and Execution System JOPES Common Operational Picture COP Transportation Flow Analysis JFAST Logistics Planning Tool LOGSAFE Defense Message System DMS NATO Message System CRONOS Component Services : Army Battle Command System ABCS Air Force Battle Management System TBMCS Marine Combat Operations System TCO JMCIS Navy Command System
DCP:Global Command and Control System Common Picture Common Operational Picture
DCP: Critical Requirements • Difficult to Establish Roles • Requires Host Administrator • Not Separate Roles • No Time Controllable Access • Time Limits on Users • Time Limits on Resource Availability • Time Limits on Roles • No Value Constraints • Unlimited Common Operational Picture • Unlimited Access to Movement Information • Difficult to Federate Users and Resources • U.S. Only system • Private Network (Not Multi-Level Secure)
GCCS Shortfalls: User Roles • Currently, GCCS Users have Static Profile Based on Position/Supervisor/Clearance Level • Granularity Gives “Too Much Access” • Profile Changes are Difficult to Make - Changes Done by System Admin. Not Security Officer • What Can User Roles Offer to GCCS? • User Roles are Valuable Since They Allow Privileges to be Based on Responsibilities • Security Officer Controls Requirements • Support for Dynamic Changes in Privileges • Towards Least Privilege
Non-Military Crisis: User Roles • Emergent Crisis (Katrina) Requires a Response • Some Critical Issues • Who’s in Charge? • Who is Allowed to do What? • Who can Mobilize Governmental Resources? • Roles can Help: • Role for Crisis Commander • Roles for Crisis Participants • Roles Dictate Control over Resources • For Katrina: Lack of Leadership & Defined Roles • Army Corps of Engineers Only Allowed to Repair Levees – Not Upgrade and Change
GCCS Shortfalls: Time Controlled Access • Currently, in GCCS, User Profiles are Indefinite with Respect to Time • Longer than a Single Crisis • Difficult to Distinguish in Multiple Crises • No Time Controllable Access on Users or GCCS Resources • What can Time Constrained Access offer GCCS? • Junior Planners - Air Movements of Equipment Weeks before Deployment • Senior Planners - Adjustment in Air Movements Near and During Deployment • Similar Actions are Constrained by Time Based on Role
Non-Military Crisis: Time Controlled Access • Multiple Crisis Require Ability to Distinguish Between Roles Based on Time and Crisis • Occurrence of Rita (one Crisis) Impacted the Ongoing Crisis (Katrina) • Need to Manage Simultaneous Crisis w.r.t. Time • Different Roles Available at Different Times within Different Crises • Role Might be “Finishing” in one Crisis (e.g., First Response Role) and “Starting” in Another • Individual May Play Different Roles in Different Crisis • Individual May Play Same Role with Different Duration in Time w.r.t. its Activation
GCCS Shortfalls: Value Based Access • Currently, in GCCS, Controlled Access Based on Information Values Difficult to Achieve • Unlimited Viewing of Common Operational Picture (COP) • Unlimited Access to Movement Information • Attempts to Constrain would have to be Programmatic - which is Problematic! • What can Value-Based Access Offer to GCCS? • In COP • Constrain Display of Friendly and Enemy Positions • Limit Map Coordinates Displayed • Limit Tier of Display (Deployment, Weather, etc.)
Non-Military Crisis: Value Based Access • In Katrina/Rita, What People can See and Do May be Limited Based on Role • Katrina Responders Limited to Katrina Data • Rita Responders Limited to Rita Data • Some Responders (Army Corps Engineers) May Need Both to Coordinate Activities • Within Each Crisis, Information Also Limited • Some Katrina Roles (Commander, Emergency Responders, etc.) see All Data • Other Katrina Roles Limited (Security Deployment Plans Not Available to All • Again – Customization is Critical
GCCS Shortfalls: Federation Needs • Currently, GCCS is Difficult to Use for DCP • Difficult to Federate Users and Resources • U.S. Only system • Incompatibility in Joint and Common Contexts • Private Network (Not Multi-Level Secure) • What are Security/Federation Needs for GCCS? • Quick Admin. While Still Constraining US and Non-US Access • Employ Middleware for Flexibility/Robustness • Security Definition/Enforcement Framework • Extend GCCS for Coalition Compatibility that Respects Coalition and US Security Policies
Non-Military Crisis: Federation Needs • Crisis May Dictate Federation Capabilities • Katrina • Devastated Basic Communication at All Levels • There was No Need to Federate Computing Systems at Crisis Location with No Power, etc. • Rita • Crisis Known Well in Advance • However, Didn’t Prevent • Disorganized Evacuation • 10+ Hour Highway Waits • Running out of Fuel • Federation Myst Coordinate Critical Resources
Information Sharing and SecurityFederated Resources RESOURCES Command&Control Vehicles Army Airborne Command & Control System Army Battle Command System Embedded Command System JSTARS Unmanned Aerial Vehicle Satellites INTEL FUSION Embedded Battle Command FIELD ARTILLERY Embedded Battle Command AIR DEFENCE Embedded Battle Command MANEUVER CONTROL Embedded Battle Command ABCS Common Picture PERSONNEL AND LOGISTICS Embedded Battle Command Bradley / EBC Embedded Battle Command Fwd Support Element Ammo/Fuel Refit
Information Sharing and SecuritySyntactic Considerations • Syntax is Structure and Format of the Information That is Needed to Support a Coalition • Incorrect Structure or Format Could Result in Simple Error Message to Catastrophic Event • For Sharing, Strict Formats Need to be Maintained • In US Military, Message Formats Include • Heading and Ending Section • United States Message Text Formats (USMTF) • 128 Different Message Formats • Text Body of Actual Message • Problem: Formats Non-Standard Across Different Branches of Military and Countries
Information Sharing and SecuritySemantics Concerns • Semantics (Meaning and Interpretation) • USMTF - Different Format, Different Meaning • Each of 128 Messages has Semantic Interpretation • Communicate Logistical, Intelligence, and Operational Information • Semantic Problems • NATO and US - Different Message Formats • Different Interpretation of Values • Distances (Miles vs. Kilometers) • Grid Coordinates (Mils, Degrees) • Maps (Grid, True, and Magnetic North)
Information Sharing and SecuritySyntactic & Semantic Considerations • What’s Available to Support Information Sharing? • How do we Insure that Information can be Accurately and Precisely Exchanged? • How do we Associate Semantics with the Information to be Exchanged? • What Can we Do to Verify the Syntactic Exchange and that Semantics are Maintained? • Can Information Exchange Facilitate Federation? • How do we Deal with Exchange to/from Legacy Applications? • Can this be Handled Dynamically? • Or, Must we Statically Solve Information Sharing in Advance?
Information Sharing and SecurityPragmatics Issues • Pragmatics Require that we Totally Understand Information Usage and Information Meaning • Key Questions Include: • What are the Critical Information Sources? • How will Information Flow Among Them? • What Systems Need Access to these Sources? • How will that Access be Delivered? • Who (People/Roles) will Need to See What When? • How will What a Person Sees Impact Other Sources?
Information Sharing and SecurityPragmatics Issues • Pragmatics - Way that Information is Utilized and Understood in its Specific Context • For Example, in GCCS
Information Sharing and Security Pragmatics Issues GBS DSCS DR DR DR Node Estimate Current FDD laydown has 53 autonomous Command Post/TOCs (i.e., nodes) For a full Corps >200 nodes 299ENG DR GBS GBS CMDRBCV TAC DR SEN GBS SEN DISCOM DR DR GBS DR DR VTel DIV REAR BVTC 1st BDE MVR BN SINCGARS (FS) EPLRS (AD) Info/Intel/Plans GBS BVTC BVTC GBS Sustainment DR DR SEN BVTC XX GBS DR DR GBS MVR BN Mobility GBS BVTC 204FSB Relay GBS DR SEN GBS TGT/Fires DR DR BVTC 704MSB GBS GBS DR DR MVR BN SINCGARS (FS) EPLRS (AD) GBS 4-42FA SEN LEN XXX X DR SEN DR DR GBS DIVARTY DR 588ENG GBS DR BVTC GBS CMDRBCV TAC SINCGARS (FS) EPLRS (AD) HCLOS • Basic Distribution Requirement • Distribution Polices • Automation & Notification • User Controls • Transport Mechanisms • System and Process Monitors • Security, Logs, and Archives SEN DR DR GBS DR DR XX Division Slice 2nd BDE MVR BN GBS BVTC DR GBS DR DR DR GBS SEN 124th SIG BN GBS DR DR C2V MVR BN GBS 4 FSB Relay HCLOS DIV CDR DR DR Theater Injection Point (TIP) DR GBS DR DR MVR BN GBS GBS A2C2S 3-16FA XXX SEN SEN X GBS GBS VTel DIV CDR DMAIN DR DR DR BVTC SINCGARS (FS) EPLRS (AD) 4ENG DR DR GBS CMDRBCV GBS TAC SEN GBS DR DR 404 ASB SEN DR DR GBS MVR BN GBS 3rd BDE BVTC XX DR DR DR DR SEN SEN GBS GBS DR DR 4th BDE DTAC 1 Distribution Policy SEN MVR BN GBS DR DR GBS BVTC BVTC SINCGARS (FS) EPLRS (AD) SINCGARS (FS) EPLRS (AD) 64 FSB Relay DR DR • What • When • Where • How • - Prioritized • - Encrypted • - Network MVR BN GBS GBS DR DR GBS DR DR DR DR GBS GBS 3-29FA SEN 1/4 AVN BN 2/4 AVN BN 9-1FA DR DR GBS 1/10CAV 1/10 CAV Sqdn CMDRBCV Note: 3rd BDE not part of 1DD in Sep 2000. • Pragmatics in GCCS
Information Sharing and SecurityData Integrity • Concerns: Consistency, Accuracy, Reliability • Accidental Errors • Crashes, Concurrent Access, Logical Errors • Actions: • Integrity Constraints • GUIs • Redundancy • Malicious Errors • Not Totally Preventable • Actions: • Authorization, Authentication, Enforcement Policy • Concurrent Updates to Backup DBs • Dual Homing
Information Sharing and Security Discretionary Access Control • What is Discretionary Access Control (DAC)? • Restricts Access to Objects Based on the Identity of Group and /or Subject • Discretion with Access Permissions Supports the Ability to “Pass-on” Permissions • DAC and DCP • Pass on from Subject to Subject is a Problem • Information Could be Passed from Subject (Owner) to Subject to Party Who Should be Restricted • For Example, • Local Commanders Can’t Release Information • Rely on Discretion by Foreign Disclosure Officer • Pass on of DAC Must be Carefully Controlled!
Information Sharing and Security Role Based Access Control • What is Role Based Access Control (RBAC)? • Roles Provide Means for Permissions to Objects, Resources, Based on Responsibilities • Users May have Multiple Roles Each with Different Set of Permissions • Role-Based Security Policy Flexible in both Management and Usage • Issues for RBAC and DCP • Who Creates the Roles? • Who Determines Permissions (Access)? • Who Assigns Users to Roles? • Are there Constraints Placed on Users Within Those Roles?
Information Sharing and Security Mandatory Access Control • What is Mandatory Access Control (MAC)? • Restrict Access to Information, Resources, Based on Sensitivity Level (Classification) Classified Information - MAC Required • If Clearance (of User) Dominates Classification, Access is Allowed • MAC and DCP • MAC will be Present in Coalition Assets • Need to Support MAC of US and Partners • Partners have Different Levels/Labels • Need to Reconcile Levels/Labels of Coalition Partners (which Include Past Adversaries!)
Information Sharing and SecurityOther Issues • Intrusion Detection • Not Prevention • Intrusion Types: • Trojan Horse, Data Manipulation, Snooping • Defense: • Tracking and Accountability • Survivability • Reliability and Accessibility • Defense: • Redundancy • Cryptography • Fundamental to Security • Implementation Details (key distribution)
Stepping BackSecurity for Distributed Environments • Background and Motivation • What are Key Distributed Security Issues? • What are Major/Underlying Security Concepts? • What are Available Security Approaches? • Identifying Key Distributed Security Requirements • Frame the Solution Approach • Outline UConn Research Emphasis: • Secure Software Design (UML and AOSD) • Middleware-Based Realization (CORBA/JINI) • Information Exchange via XML
Security for Distributed Applications COTS Database Legacy Legacy COTS NETWORK Java Client Java Client Legacy Database COTS How is Security Handled for Individual Systems? What if Security Never Available for Legacy/COTS/Database? Security Issues for New Clients? New Servers? Across Network? What about Distributed Security? Security Policy, Model, and Enforcement?
DC for Military Deployment/Engagement U.S. Global C2 Systems Air Force Navy Joint Command System Battle Management System NGO/ PVO GCCS U.N. Army Battle Command System Combat Operations System NATO U.S.A Army Marine Corps AFATDS FADD ASAS GCCS-A ABCS CSSCS MCS Other OBJECTIVES: Securely Leverage Information in a Fluid Environment Protect Information While Simultaneously Promoting the Coalition Security Infrastructure in Support of DCP SICF France LFCS Canada HEROS Germany SIACCON Italy
DC for Medical Emergency Red Cross Pharma. Companies Govt. MDs w/o Borders EMTs RNs MDs State Health Other Transportation Military Medics Govt. Local Health Care CDC ISSUES: Privacy vs. Availability in Medical Records Support Life-Threatening Situations via Availability of Patient Data on Demand
Security Issues: Confidence in Security • Assurance • Do Security Privileges for Each User Support their Needs? • What Guarantees are Given by the Security Infrastructure in Order to Attain: • Safety: Nothing Bad Happens During Execution • Liveness: All Good Things can Happen During Execution • Consistency • Are the Defined Security Privileges for Each User Internally Consistent? Least-Privilege Principle • Are the Defined Security Privileges for Related Users Globally Consistent? Mutual-Exclusion
Security for Coalitions • Dynamic Coalitions will play a Critical Role in Homeland Security during Crisis Situations • Critical to Understand the Security Issues for Users and System of Dynamic Coalitions • Multi-Faceted Approach to Security • Attaining Consistency and Assurance at Policy Definition and Enforcement • Capturing Security Requirements at Early Stages via UML Enhancements/Extensions • Providing a Security Infrastructure that Unifies RBAC and MAC for Distributed Setting
Four Categories of Questions • Questions on Software Development Process • Security Integration with Software Design • Transition from Design to Development • Questions on Information Access and Flow • User Privileges key to Security Policy • Information for Users and Between Users • Questions on Security Handlers and Processors • Manage/Enforce Runtime Security Policy • Coordination Across EC Nodes • Questions on Needs of Legacy/COTS Appls. • Integrated, Interoperative Distributed Application will have New Apps., Legacy/COTS, Future COTS
Software Development Process Questions • What is the Challenge of Security for Software Design? • How do we Integrate Security with the Software Design Process? • What Types of Security Must be Available? • How do we Integrate Security into OO/Component Based Design? • Integration into OO Design? • Integration into UML Design? • What Guarantees Must be Available in Process? • Assurance Guarantees re. Consistent Security Privileges? • Can we Support Security for Round-Trip and Reverse Engineering?
Software Development Process Questions • What Techniques are Available for Security Assurance and Analysis? • Can we Automatically Generate Formal Security Requirements? • Can we Analyze Requirements for Inconsistency and Transition Corrections Back to Design? • How do we Handle Transition from Design to Development? • Can we Leverage Programming Languages in Support of Security for Development? • Subject-Oriented Programming? • Aspect-Oriented Programming? • Other Techniques?
Information Access and Flow Questions • Who Can See What Information at What Time? • What Are the Security Requirements for Each User Against Individual Legacy/cots Systems and for the Distributed Application? • What Information Needs to Be Sent to Which Users at What Time? • What Information Should Be “Pushed” in an Automated Fashion to Different Users at Regular Intervals?
Information Access and Flow Questions • What Information Needs to Be Available to Which Users at What Time? • What Information Needs to Be “Pulled” On-demand to Satisfy Different User Needs in Time-critical Situations • How Are Changing User Requirements Addressed Within the Distributed Computing Application? • Are User Privileges Static for the Distributed Computing Application? • Can User Privileges Change Based on the “Context” and “State” of Application?