Information Sharing and Security in
Dynamic Coalitions
Charles E. Phillips, Jr.
Computer Science & Engineering Department
191 Auditorium Road, Box U-155
The University of Connecticut
Storrs, Connecticut 06269-3155
charlesp@engr.uconn.edu
Profs. T.C. Ting and Steven A. Demurjian
Computer Science & Engineering Department
191 Auditorium Road, Box U-155
The University of Connecticut
Storrs, Connecticut 06269-3155
http://www.engr.uconn.edu/~steve
steve@engr.uconn.edu
SACMAT02-1
Overview of Presentation





Introduction
The Dynamic Coalition Problem
 Civilian Organizations
 Military Involvement/GCCS
Information Sharing and Security
 Federating Resources
 Data Integrity
 Access Control (DAC and MAC)
 Other Critical Security Issues
Candidate Security Approach
Conclusions and Future Work
SACMAT02-2
Introduction
Crisis and Coalitions




A Crisis is Any Situation Requiring National or
International Attention as Determined by the
President of the United States or UN
A Coalition is an Alliance of Organizations:
Military, Civilian, International or any
Combination
A Dynamic Coalition is Formed in a Crisis and
Changes as Crisis Develops, with the Key Concern
Being the Most Effective way to Solve the Crisis
Dynamic Coalition Problem (DCP) is the Inherent
Security, Resource, and/or Information Sharing
Risks that Occur as a Result of the Coalition Being
Formed Quickly
SACMAT02-3
Introduction
Near Simultaneous Crises
Crisis Point
NATO Hq
Olympic Games
BOSNIA
(NATO)
KOSOVO
(US,UK)
Earthquake
(United Nations)
Ship Wreck
(UK,SP)
SACMAT02-4
Evaluation vs. DCP
Emergent Need for Coalitions

“Coalitions must be flexible and no one coalition is
or has the answer to all situations.”
» Secretary of Defense, Donald Rumsfeld

“Whenever possible we must seek to operate
alongside alliance or coalition forces, integrating
their capabilities and capitalizing on their
strengths.”
» U.S. National Security Strategy

“Currently, there is no automated capability for
passing command and control information and
situational awareness information between nations
except by liaison officer, fax, telephone, or loaning
equipment.”
» Undersecretary of Defense for Advanced Technology
SACMAT02-5
The Dynamic Coalition Problem




Dynamic Coalition Problem (DCP) is the Inherent
Security, Resource, and/or Information Sharing
Risks that Occur as a Result of the Coalition Being
Formed Quickly
Private Organizations (PVO)
 Doctors Without Boarders
 Red Cross
Non-Government Organizations (NGO)
 NYPD
Government Agencies
 FBI
 CIA
 Military
SACMAT02-6
Supporting Advanced Applications
DCP Objectives for Crisis







Federate Users Quickly and Dynamically
Bring Together Resources (Legacy, COTs, GOTs,
DBs, etc.) Without Modification
Dynamically Realize/Manage Simultaneous Crises
Identify Users by Roles to Finely Tune Access
Authorize, Authenticate, and Enforce a Scalable
Security Policy that is Flexible in Response to
Collation Needs
Provide a Security Solution that is Portable,
Extensible, and Redundant for Survivability
Include Management/Introspection Capabilities to
Track and Monitor System Behavior
SACMAT02-7
The Dynamic Coalition Problem
Coalition Architecture
Clients Using Services
U.S. Army
Client
Federal Agencies
(FEMA, FBI, CIA, etc.)
Client
Resources Provide Services
COTS
LFCS
(Canada)
U.S. Navy
Client
SICF
(France)
French
Air Force
Client
HEROS
U.S. Legacy
System
(Germany)
SIACCON
NATO
Database
Client
German
COTS
Client
NATO SYS
(Italy)
NGO/PVO
(Red Cross, NYPD, etc.)
Client
GCCS (US)
NGO/PVO
Resource
SACMAT02-8
The Dynamic Coalition Problem
Joint and Combined Information Flow
Common Operating Environment
ARMY
Combined: Many
Countries
GCCS-A
GCCS
CORPS
Joint Task Force
ABCS
MCS
XX
Coalition
Partners
NATO
Systems
Coalition
Systems
Marines
DIV
Air Force
GCCS-M
FAADC2I
MCS
Adjacent
Navy
GCCS-N
GCCS-AF
CSSCS
AFATDS
ASAS
TBMCS
TCO
JMCIS
X
BDE
BSA
TOC
MCS
||
BN
||
BN
||
MCS
MCS
CO
FBCB2
Joint - Marines, Navy, Air Force, Army
SACMAT02-9
The Dynamic Coalition Problem
Combined Information Flow
Maneuver
Logistics
GCCS - Joint/Coalition -
Air Defense/Air Operations
Fire Support
Combined Database
Intelligence
Network and Resource
Management
SACMAT02-10
The Dynamic Coalition Problem
Coalition Artifacts and Information Flow
U.S. Global C2 Systems
Air Force
Joint
Command
System
Battle
Management
System
NGO/
PVO
GCCS
U.N.
NATO
Navy
U.S.A
Army Battle
Command
System
Army
Combat
Operations
System
Marine Corps
Dynamic Coalition
AFATDS
GOAL: Leverage information
in a fluid, dynamic
environment
ASAS
FADD
ABCS
CSSCS
GCCS-A
MCS
Other
Army C2
SACMAT02-11
The Dynamic Coalition Problem
Global Command and Control System
GLOBAL C2 SYSTEMS
MOBILE SUBSCRIBER EQUIPMENT
DATA RADIO
SATELLITE
MISSION PLANNING
MET
SUPPORT
INTEL
SATCOM
MANEUVER
CONTROL
TOPO
AIR DEFENCE
ARTY
Client/Server
AIR DEFENCE
MET
MISSION PLANNING
SUPPORT
INTEL
MANEUVER
CONTROL
Client/Server
SATCOM
GCCS Provides:
- Horizontal and Vertical Integration
of Information to Produce a
Common Picture of the Battlefield
- 20 separate automated systems
- 625 locations worldwide
- private network
ARTY
TOPO
Company
AIR DEFENCE
SUPPORT
INTEL
Client/Server
SATCOM
ARTY
MANEUVER
CONTROL
Situational Awareness
FBCB2
/EBC
Tactical BATTLEFIELD C2Platoon
SYSTEM
EMBEDDED BATTLE COMMAND
Internet
FBCB2
/EBC
Squad
MOBILE SUBSCRIBER EQUIPMENT
SACMAT02-12
The Dynamic Coalition Problem
Global Command and Control System
Joint Services
:
Weather
Video Teleconference
Joint Operations Planning and Execution System
Common Operational Picture
Transportation Flow Analysis
Logistics Planning Tool
Defense Message System
NATO Message System
Component Services
:
Army Battle Command System
Air Force Battle Management System
Marine Combat Operations System
Navy Command System
a.k.a
METOC
TLCF
JOPES
COP
JFAST
LOGSAFE
DMS
CRONOS
ABCS
TBMCS
TCO
JMCIS
SACMAT02-13
The Dynamic Coalition Problem
Global Command and Control System
Common Operational Picture
Common Picture
SACMAT02-14
The Dynamic Coalition Problem
GCCS Shortfalls: User Roles




Currently, GCCS Users have Static Profile Based
on Position/Supervisor/Clearance Level
Granularity Gives “Too Much Access”
Profile Changes are Difficult to Make - Changes
Done by System Admin. Not Security Officer
What Can User Roles Offer to GCCS?
 User Roles are Valuable Since They Allow
Privileges to be Based on Responsibilities
 Security Officer Controls Requirements
 Support for Dynamic Changes in Privileges
 Towards Least Privilege
SACMAT02-15
The Dynamic Coalition Problem
GCCS Shortfalls: Time Controlled Access


Currently, in GCCS, User Profiles are Indefinite
with Respect to Time
 Longer than a Single Crisis
 Difficult to Distinguish in Multiple Crises
 No Time Controllable Access on Users or
GCCS Resources
What can Time Constrained Access offer GCCS?
 Junior Planners - Air Movements of Equipment
Weeks before Deployment
 Senior Planners - Adjustment in Air
Movements Near and During Deployment
 Similar Actions are Constrained by Time Based
on Role
SACMAT02-16
The Dynamic Coalition Problem
GCCS Shortfalls: Value Based Access


Currently, in GCCS, Controlled Access Based on
Information Values Difficult to Achieve
 Unlimited Viewing of Common Operational
Picture (COP)
 Unlimited Access to Movement Information
 Attempts to Constrain would have to be
Programmatic - which is Problematic!
What can Value-Based Access Offer to GCCS?
 In COP
 Constrain Display of Friendly and Enemy Positions
 Limit Map Coordinates Displayed
 Limit Tier of Display (Deployment, Weather, etc.)
SACMAT02-17
The Dynamic Coalition Problem
GCCS Shortfalls: Federation Needs


Currently, GCCS is Difficult to Use for DCP
 Difficult to Federate Users and Resources
 U.S. Only system
 Incompatibility in Joint and Common Contexts
 Private Network (Not Multi-Level Secure)
What are Security/Federation Needs for GCCS?
 Quick Admin. While Still Constraining US and
Non-US Access
 Employ Middleware for Flexibility/Robustness
 Security Definition/Enforcement Framework
 Extend GCCS for Coalition Compatibility that
Respects Coalition and US Security Policies
SACMAT02-18
Information Sharing and Security
Federated Resources
RESOURCES
Command&Control Vehicles
Army Airborne Command & Control
System
JSTARS
Unmanned Aerial Vehicle
Satellites
Army Battle Command System
Embedded Command System
INTEL FUSION
Embedded Battle Command
AIR DEFENCE
Embedded Battle Command
FIELD ARTILLERY
Embedded Battle Command
MANEUVER CONTROL
Embedded Battle Command
Common Picture
PERSONNEL AND LOGISTICS
Embedded Battle Command
Fwd Support Element
Ammo/Fuel
Refit
ABCS
Bradley / EBC
Embedded Battle Command
SACMAT02-19
Information Sharing and Security
Syntactic Considerations




Syntax is Structure and Format of the Information
That is Needed to Support a Coalition
Incorrect Structure or Format Could Result in
Simple Error Message to Catastrophic Event
For Sharing, Strict Formats Need to be Maintained
In US Military, Message Formats Include
 Heading and Ending Section
 United States Message Text Formats (USMTF)
 128 Different Message Formats
Text Body of Actual Message
Problem: Formats Non-Standard Across Different
Branches of Military and Countries


SACMAT02-20
Information Sharing and Security
Semantics Concerns

Semantics (Meaning and Interpretation)
 USMTF - Different Format, Different Meaning
 Each of 128 Messages has Semantic Interpretation
 Communicate Logistical, Intelligence, and
Operational Information

Semantic Problems
 NATO and US - Different Message Formats
 Different Interpretation of Values
 Distances (Miles vs. Kilometers)
 Grid Coordinates (Mils, Degrees)
 Maps (Grid, True, and Magnetic North)
SACMAT02-21
Information Sharing and Security
Pragmatics Issues


Pragmatics - The Way that Information is Utilized
and Understood in its Specific Context
For Example, in GCCS
Inter-TOC
TOC-1
M-1068
M-1068
• Messaging
• VMF
• USMTF
• Situation Awareness
• BFA unique
• Files and DB Snapshots
• Unicast FTP
• Multicast FTP
• E-mail
• Global Broadcast Satellite
(GBS)
• Database Replication
Operational
Operational
Challenges
Challenges
• Autonomy
• Autonomy
• •Jump
JumpTOCs
TOCs
• Split TOCs
• Split TOCs
• Survivability
• Survivability
• •Bandwidth
Bandwidth
Contention
Contention
• Scalability
• Scalability
TOC 2/A-Cell
M-1068
M-1068
M-1068
M-1068
Intra-TOC
Intra-TOC
• ACDB DB
• ACDB DB
Synchronization
Synchronization
(RPC-based SR)
(RPC-based SR)
Tactical
WAN
Mixture of clients and
servers
M-1068
M-1068
TOC 2/B-Cell
SACMAT02-22
Information Sharing and Security
Pragmatics Issues
Pragmatics in GCCS

GBS
DSCS
DR DR
GBS
SEN
VTel
BVTC
Info/Intel/Plans
BVTC
Mobility
BVTC
TGT/Fires
BVTC
SEN
SEN
DR
DR
SEN
DR
MVR BN
GBS
204FSB
DR
GBS DR DR
704MSB
LEN
Current FDD laydown has 53
autonomous Command
Post/TOCs (i.e., nodes)
GBS DR
DR
GBS
BCV
MVR BN
GBS
Node Estimate
CMDR
DR
BVTC
DR
Relay
SEN
GBS
DR
TAC
GBS DR DR
1st BDE
GBS
GBS
GBS DR
BVTC
SINCGARS (FS)
EPLRS (AD)
GBS
XX
Sustainment
XXX
DR
DISCOM
DIV REAR
SINCGARS (FS)
EPLRS (AD)
GBS
299
ENG
DR
For a full Corps >200 nodes
MVR BN
GBS
4-42FA
X
SEN
GBS
DIVARTY
BVTC
SEN
XX
Division
Slice
GBS
DR
GBS
124th SIG BN
DR
HCLOS
XXX
GBS DR
SEN
GBS GBS
SINCGARS (FS)
EPLRS (AD)
BCV
BVTC
DR
MVR BN
GBS
DR
SEN
GBS DR
DR
MVR BN
GBS
4 FSB
Relay
DR
GBS DR DR
DR
DR
MVR BN
GBS
3-16FA
X
DIV CDR
DMAIN
CMDR
DR
2nd BDE
A2C2S
VTel
DR
TAC
DIV CDR
GBS
BVTC
588
ENG
GBS DR DR
DR
C2V
Theater
Injection Point
(TIP)
SEN
GBS
SINCGARS (FS)
EPLRS (AD)
HCLOS
SEN
DR DR
DR
DR DR
DR
GBS
DR
4
ENG
GBS DR
TAC
Basic Distribution Requirement
• Distribution Polices
• Automation & Notification
• User Controls
• Transport Mechanisms
• System and Process Monitors
• Security, Logs, and Archives
CMDR
BCV
GBS
SEN
404 ASB
SEN
GBS DR DR
4th BDE
BVTC
SINCGARS (FS)
EPLRS (AD)
GBS DR DR
DTAC 1
BVTC
BVTC
SINCGARS (FS)
EPLRS (AD)
DR
DR
Relay
SEN
GBS DR
1/4 AVN BN
DR
GBS
2/4 AVN BN
DR
DR
DR
GBS
Distribution Policy
DR
MVR BN
GBS
64 FSB
GBS DR DR
GBS
DR
MVR BN
GBS
XX
SEN
DR
GBS DR DR
3rd BDE
MVR BN
GBS DR DR
9-1FA
3-29FA
DR
1/10
CAV
CMDR
BCV
SEN
GBS
DR
• What • How
• When
- Prioritized
• Where - Encrypted
- Network
1/10 CAV Sqdn
Note: 3rd BDE not part of 1DD in Sep 2000.
SACMAT02-23
Information Sharing and Security
Data Integrity


Concerns: Consistency, Accuracy, Reliability
Accidental Errors
 Crashes, Concurrent Access, Logical Errors
 Actions:
 Integrity Constraints
 GUIs
 Redundancy

Malicious Errors
 Not Totally Preventable
 Actions:
 Authorization, Authentication, Enforcement Policy
 Concurrent Updates to Backup DBs
 Dual Homing
SACMAT02-24
Information Sharing and Security
Discretionary Access Control


What is Discretionary Access Control (DAC)?
 Restricts Access to Objects Based on the
Identity of Group and /or Subject
 Discretion with Access Permissions Supports
the Ability to “Pass-on” Permissions
DAC and DCP
 Pass on from Subject to Subject is a Problem
 Information Could be Passed from Subject (Owner)
to Subject to Party Who Should be Restricted

For Example,
 Local Commanders Can’t Release Information
 Rely on Discretion by Foreign Disclosure Officer

Pass on of DAC Must be Carefully Controlled!
SACMAT02-25
Information Sharing and Security
Role Based Access Control


What is Role Based Access Control (RBAC)?
 Roles Provide Means for Permissions to
Objects, Resources, Based on Responsibilities
 Users May have Multiple Roles Each with
Different Set of Permissions
 Role-Based Security Policy Flexible in both
Management and Usage
Issues for RBAC and DCP
 Who Creates the Roles?
 Who Determines Permissions (Access)?
 Who Assigns Users to Roles?
 Are there Constraints Placed on Users Within
Those Roles?
SACMAT02-26
Information Sharing and Security
Mandatory Access Control


What is Mandatory Access Control (MAC)?
 Restrict Access to Information, Resources,
Based on Sensitivity Level (Classification)
Classified Information - MAC Required
 If Clearance (of User) Dominates
Classification, Access is Allowed
MAC and DCP
 MAC will be Present in Coalition Assets
 Need to Support MAC of US and Partners
 Partners have Different Levels/Labels
 Need to Reconcile Levels/Labels of Coalition
Partners (which Include Past Adversaries!)
SACMAT02-27
Information Sharing and Security
Other Issues

Intrusion Detection
 Not Prevention
 Intrusion Types:
 Trojan Horse, Data Manipulation, Snooping

Defense:
 Tracking and Accountability

Survivability
 Reliability and Accessibility
 Defense:
 Redundancy

Cryptography
 Fundamental to Security
 Implementation Details (key distribution)
SACMAT02-28
Candidate Security Approach
Software Architecture
Database
Client
COTS
Client
Lookup
Service
Wrapped
Resource
for Database
Application
Wrapped
Resource
for COTS
Application
Java
Client
General
Resource
Wrapped
Resource
for Legacy
Application
Software
Agent
Legacy
Client
Security Policy
Client (SPC)
Lookup
Service
Security Authorization
Client (SAC)
Global Clock
Resource (GCR)
Unified Security Resource (USR)
Security
Policy
Services
Security
Security
Authorization Registration
Services
Services
Security
Analysis and
Tracking (SAT)
SACMAT02-29
Candidate Security Approach
Enforcement Framework
GCCS
Client
1 Register_Client(DoRight,100.150.200.250, ArmyLogCR1)
4 Return
Security
Registration
Result,Create_Token(DoRight,ArmyLogCR1,Token) Services
2 Verify_UR(DoRight,ArmyLogCR1)
5. Discover/Lookup(GCCS,Joint,CrisisPicture)
Returns Proxy to Course Client
6 CrisisPicture(Token,CR1, NA20, NC40)
11 Return Result,CrisisPicture(…)
Lookup
Service
7 IsClient_Registered(Token)
9 Check_Privileges(Token, GCCS, Joint,
CrisisPicture, [NA20,NC40])
GCCS
Resource
8 Return Result of IsClient_Registered(…)
3 Client OK?
USR
Security
Authorization
Services
Global
Clock
Tracking
Tool
Security
Policy
Services
10 Return Result of Check_Privileges(…)
SACMAT02-30
Candidate Security Approach
Security Assurance Checks
Start Constraint-Based
Assurance Checks
Required
User-Authentication
Check
Yes
Authentication
Successful
No
Authentication
Unsuccessful
(to error handler)
Mandatory
Access Control
Check
No
No
Yes
Time
Constraint
Check
No
Yes
Value
Constraint
Check
Yes
Authorization
Successful
(continue process)
No
Authorization
Unsuccessful
(to error handler)
SACMAT02-31
Conclusions and Ongoing Work






Explored Information Sharing Issues
Defined the Dynamic Coalition Problem
Discussed Coalition Participants
Examined GCCS and Needed Improvements
Offered Candidate Security Approach
Related/Ongoing Research Includes
 Support for Mandatory Access Controls
 Role Deconfliction and Mutual Exclusion
 User Constraints
 User Role Delegation Authority
 www.engr.uconn.edu/~steve/DSEC/dsec.html
SACMAT02-32