Form SF298 Citation Data

Transcription

1

2 Form SF298 Citation Data Report Date ("DD MON YYYY") Report Type N/A Dates Covered (from to) ("DD MON YYYY") Title and Subtitle Command & Control Protection for Force XXI Networks Authors Contract or Grant Number Program Element Number Project Number Task Number Work Unit Number Performing Organization Name(s) and Address(es) Information Assurance Technology Analysis Center (IATAC) 3190 Fairview Park Drive Falls Church VA Sponsoring/Monitoring Agency Name(s) and Address(es) Performing Organization Number(s) Monitoring Agency Acronym Monitoring Agency Report Number(s) Distribution/Availability Statement Approved for public release, distribution unlimited Supplementary Notes Abstract Subject Terms Document Classification unclassified Classification of Abstract unclassified Classification of SF298 unclassified Limitation of Abstract unlimited Number of Pages 18

3

4 REPORT DOCUMENTATION PAGE Form Approved OMB No Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing this collection of information Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to Washington Headquarters Services, Directorate for Information Operations and Reports, 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA , and to the Office of Management and Budget, Paperwork Reduction Project ( ), Washington, DC REPORT TYPE AND DATES COVERED 1 AGENCY USE ONLY (Leave blank) 2 REPORT DATE 9/1/92 Briefing 4 TITLE AND SUBTITLE Command & Control Protection for Force XXI Networks 5 FUNDING NUMBERS 6 AUTHOR(S) Not provided 7 PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES) 8 PERFORMING ORGANIZATION REPORT NUMBER Information Assurance Technology Analysis Center (IATAC) 3190 Fairview Park Drive Falls Church, VA SPONSORING / MONITORING AGENCY NAME(S) AND ADDRESS(ES) 10 SPONSORING / MONITORING AGENCY REPORT NUMBER Defense Technical Information Center DTIC-AI 8725 John J Kingman Road, Suite 944 Ft 11 SUPPLEMENTARY Belvoir, VA NOTES a DISTRIBUTION / AVAILABILITY STATEMENT 12b DISTRIBUTION CODE A 13 ABSTRACT (Maximum 200 Words) This briefing, on the Command and Control Protection for Force XXI Networks presented to AFCEA TECHNET at Fort Monmouth, NJ in 1997 by the Program Executive Officer, Command, Control and Communications Systems It provides an overview of battlefield communications, and information system security, first digitized division It includes host based C2 protect tools, commercial off the shelf (COTS) tools, as well as FBCB2 Security Policy 14 SUBJECT TERMS 15 NUMBER OF PAGES 17 SECURITY CLASSIFICATION OF REPORT Unclassified 18 SECURITY CLASSIFICATION OF THIS PAGE Unclassified 19 SECURITY CLASSIFICATION OF ABSTRACT Unclassified 16 PRICE CODE 20 LIMITATION OF ABSTRACT Unlimited NSN Standard Form 298 (Rev 2-89) Prescribed by ANSI Std Z

5 Digitization Is A Key Enabler To Gaining Information Dominance Dominant Maneuver thru :~::::~::~::::~~::~::~:: :::::::::~::::::::::::: ::::::::::::::::::::::::::::::::::::::: Precision Engagement ::::~:~:~:~:~:~:~:~,- ::::::::::::::::::~j: ~_~_~_~_~_~_~ ::i:::i:i:i:i:~:8:i:~:~:~::::: PROVIDES THE CDR WITH THE ABILITY TO DISTRIBUTE AND COORDINATE HIS INTENT/ORDERS QUICKLY Dominant Maneuver thru Greater Mobility 4% Flexibility MOVE INFORMATlON SENSOR RAPIDLY TO SHOOTER :::: ~~~~~~~~~~~~~~ :::::::::::::::: zj;$~<z~& ::~,j+~~&~*+> * ~~~~~~*:::::~:~~:~~~~~~~~~,~~~~~ 5 >, j ::, < & :;, - ',~::::~~~,~~~~~~~~~~~~j~~~~~;~:~~!: -> ANTICPATORY PROVIDES SUPPORT LOGlSTlCS TO THE NON-LINEAR SUPPORTSBATTLEFIELD _ ~~~~~~~~~~~~~~~~~~~~:::~::::::::: - j< ::~:::~~~:::::~::~~~~~~ ~, A~>:< : : :: jjjj y :j:: >y *,~ >p>j-2 h>z>~ > -%---A--:--,V:,,-a v 0, f qzi < :~~~:~~:~~~~#~~~~~j~~ 5 :ss5f"'z- 5,,, -A---,,,, ~~,,,~,~~~~~~ : : : ~**V<y~< A y -v % a --#A,~~:~;~:j~~~~~:~:~~~~~:~5v:~j~~:~ 3

6 Battlefield Communications Overview ~1 y V-x _ f>, \, : -, : -y:~y y y ~, ::::-::~~ x/ :: ~~~~~:-::~~::::~::::::~j~~~~~~~~~~:~:~ T 5 y n ~i:~:~:::: y A - Ỵ A \ <:+ ~~~~~~~~~~~~:~~~~~~~j~~~~~~~~~:~~~ i,?: -v-+:w? 5: : > x::::jjjjjjjjjjjjc : : : : : : : : : : : : : : : : : : :,, : : - % v :~j::>* ** * * ++ T : > d -, >,, < * < > y :~~:~::~~~~: &+:::y y + >, -A<%,, $A$,,, -- -,, ~~~#S x:::::::::-:x-::::x : : : : : * : : * : : : : : :-: x : 2~::~::~ 222 Y, Y2,, A A -,, f f,,, 5 a~:~*-+ <>\ %, ~~,,:::~ 5% 5-- ~,,*,~~ 2, 80 V~VV~-A -A%+ *-zhph %A+,>*+> 0 :x A ~::::::~:::::~-:::::::::::::~:~:~::::::::::~,, ~,~~~:::~:::;~:: y > > ~,, > ~~::s::,,, A-*-,*- ~,, -, 1< A -&j~jj~~

7

8 t k : : ; ::: : : :,: : :: r : ): : :: : ca : : : :::::::::::::: ::-:::- : : ::::::: ::::::::p: r :: : : : : :::::y:::::: I +: : : :yt :::j:: j: : :: :: jjj$j$j ::: : : : : : : :::::j::jj:::: :::g::jj::j ṙ ::::::::::::::::: First Digitized Division (FDD) Security Architecture xypted Comms i f 3rd Layer i : FBCBZ Network Intrusion Detection System Back-end Connections k Nelwark Intrusion Device System (NDS) : :: :::::::::: ::: :: :: :::::: ::: :::::::,:>,, > >,, >, :: :*: ::::::j:~ ::~:,:~~:::~::::::~:~:::~:::::~:: : :>:#<*p+ :> : ** ra,,j+ j:,>~ : >,:\, + 5 ~~~~~~s~,~~~~~~~~,~:~,~~~~~~~~,j~~~~~~~~~, 2> - *;****&, : ~ py TT, -A-,~~~,,~,~, 3*a*:* Y- --~,~~~~S,~,,,, 2 -a-, A ~, *, >*::y :*&,:jjjk qjjj~x:::><~ ----,0 : : :, : :2: : 8 : : : : :: : x::: v--a c > a - ~V * > < ~2~ 5 -&> a + :-s-x+:x+:-:: 0:

9 Hosts Systems Host-Based C2 Protect - As a minimum, all host systems will meet DOD ~STD Class C2 Protecti Level Requirements - All hosts systems will incorporate network authentication, integrity, and access control mechanisms in accordance with the Army C2 Protect Program - Hosts systems will incorporate intrusion detection functionality to extent possible/practical Applications - Strong authentication, integrity, access control and non-repudiation mechanisms as required per service :::::::~:::~:::~::::::: S~ : :::::::::L:~::~:~~:::: ~~~~~~~~~~~~~~~~~~~~~~~ :::j:yjjj: c Y ~~~~~i~l~i ::: i :::~~~ ~ ::::::::':'::::::::::::::::::::::~:~ : ~~~~~~~~~~:~~~~~~~~~~~~~~~~~~~~~~:~~~~~~~~~~~:~~~~::::~~ S::::~::::::~::::::::::~:::~:~:::::~:~:~ : -, <A, A - A,<q > - A ~: 0 : : : : : : : : : : : : : >:: : : x : > : : : : : : :: : : 0 x j8* -, x : : : : : >> I:$jjyfl, A $ 55: 2~, ::x=y,:>>, :~~~~~>~v& :-i- 5 'VA-, :~~~~ %,, * v~~s-:~~~~,::~~:~:~~:~*~~~,~,~~~:~~~~:;::~::;~j 5,y< 'y &+ : 3 <s A*-,, VVV~ * * y ~,,~,:::::::;~:::::~~:~~~::~:::::~~~::~:::::::::~~:~,~,::::, $#g#j$::::::&&&j~:::;:~::;: * *,, : : :;5 -** SV~S y A, ~, 5, >$, 5 j z \:::x:::: jx+ ---*--<-a, :::s s :~~::::~~::::::~::::j~~s~~s~:::::::: :

10

11 Current CCCommercial Off The Shelf (COTS) Integration Efforts 0 Plurge Routines Reviewing/evaluating for complete memory workstations between unclassified roles products available purge to transition classified and Secure Client - Server Services - Reviewing/evaluating products that can provide Authentication Encryption in the multiple DCE cell environ1nent of tt Tactical Operations Center

12 890 L-W 890 L-W aa!nas vs papuedxg I!eyy-a pazyewj0 j uo!~ezyojy3uas aseqelea sjanas pue sluay3 40 ajn)x! yy 890 l-w 0064 c- I uo!)ua)uo=) Pue WP!Ww3 yjom)an ww aava-sar> ::::::::::::~::::: 4/w WO!I!PPV aava-sa9 ylds pue dwnr 1 Aurouolnv (dllh) WM sja SAN sansq l!euj-3 Pue dlj 83/l* lauo!jemd() lan 10s (Paseq -l!eujpuw zllws(i & Abolouycm~ )uam=) ::::::y ::::::::::::::j: :::jjjjj::::: : ::: : :: :::jjjjj:::: _ : :,: : : : : :: ::::::: : ::::::::::::>: : F-J :::::::::::::::j::: : : :: ::::::, j::j:y$: : : : : : : : : : : : : : :j :::::::::::::: ::::::: : : ::::::: : : : ::I : 1: ::::::: : : Y A : :, : : : : : I J : ::::: 890 L-W 890 L-W :g-: Vd8 f (Gu!ya3aa 301-JWI 89OC-W 890 L-W / 6u!q!JwnS) r IIW-v/z 301 L us aseqwa 301-eJwl i- r ;I C-301 ;g ;j ;g x Y

13 COTS Example Combines the strengths of Secret Key and Public Key encryption technologies Provides comprehensive security framework for all TCP/IP based applications - Includes single sign-on a completely transparent manner in TCPIIP Desktop Client -- TCP/IP Applications Application Server Security Server

14 COTS Secure Capabilities : Authentication and single sign-on Standardized authorization across all applications Data protection services, smart Virtual Private Network (VPN) Dynamic support for new protocols Centralized management, connection monitoring Auditing, accounting, event notification Public key certificate services f: y:: :~~:~ p :::::::::::: x:::::::::::::::: x ::: x ::': :::::: :z::: : -:5:55' :: :x::: ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~:~::::~:~:::: *,* :+ a > 2 2 y;:;j < z, &*< ( > ::~~~~~~~~~~~~~~~~~~~~:~~~~~~~~~ ;:: +:~~ xesy > &< * x 2 *: 2> n, -- z * %v * * 0 + y y 5~ > j j :<:,~ ~ A y A A ~:::::::~~~~~ j$-c >:s ~~,,,~~ ~,~~~~~~ a--, ~~-~~~8, - +S =:: ~,, ~~~~~j~;j~~,~~~,~,~~:~:ji~~~::~,:::::~~~~,:~~~~,:~~~~:~j~;j::~~~~~~::~:~~::, <::+: :< *--A-? P\ 2--,,A, > -,,, < v**>?,v,*,, 2< 5 Z-z, ṿ ---A- y y A---,

15 c C2 Protect Integration Master FDD Schedule (Version 13)

16 0 0-0 i 9) CI 0 mm 3 tr P) 3 Q 1 (D v) CD smm s iq - CD < m - 0 s CD 1 CD CL CD < CD

17 z: $ j 2$ ::,:: F-+J : :-: -I : _~_~~~_~~_ > : :: : : : : _~_~_~_~_~_~_~ :_ : :: ::_::Y ::::::::::::::,_: :: 7 ::::::::::j:::::j:: : : : :::::::::::::: :::::::::::::::: t::::::: :::::::y:::::::: :::;:::j:::::::: r $1: :::i::::::::::: ::::::::::::::::: :: : : : : ~:~<:~g~:#::::::~:::::~ :::::::::::::::~:: :::::::::::::::::::::: : FBCB2 Capabilities Planned for FDD Sep 00 Remote security management 0 - Load passwords - Control system access: three operational capabilities Challenge a user to re-authenticate without interfering with the mission Lock-out the user until re-authentication Disable - through overwrite of the disk and reset of the router to its factory default - Authentication through the use of digital signature Security management transactions initiated/signed by security manager and sent to remote FBCB2 Ongoing evaluation of C2 Protection enhancements - Message authentication, intrusion detection, malicious code detection FBCBZ: Force XXI Battle Command Brigade and Below

18 m

19 Selective Purge Future Force XXI C2P Host Intrusion Detection Systems Tactical network guards to allow information exchange automatically between classification levels arfighter Information Networ - Terrestrial (WIN-T) e Network Guard Secret User Sensitive But Unclassified User Guard

20 Summary Information Assurance (IA) is a proactive and imperative part of the Army Digitization Program PEO C3S PMs will continue to aggressively pursue emerging assurance technologies, eg -Smart cards for user authentication Biometrics for Access Control - Biometrics for access control - Personal / host-level firewalls I m m ::::::: --2 -: :mx A - ::::::~~~~~:~; :~:~ :::::::::::~ :jr::::z s<~xp _ ~~~~~~~~~~~~~~~~~~~~~~~~ : j + ::: s ::::::::::::::: : : : : : A: A:: y-t Y, >A aa -,s~~~,, A, ZVV, 2~::::~,::~~:::::::::~::~ <:: z ::: Y,~,, -A: ;;$ 5~ ::::::::: f~ 5 ::::::::::: :: > A : -A $M - *-*>~va-~v 5 ~~:~:~~~~~~~~~,, -x-xxx:x:::::~ m-~ X ~:~~j~~~j~~:s~~~~~~~ e :~jj$jjj$&jg$j&j$j$j~~~ 1;: 1 ~~~::~~~~~jjj~~~ '*Z ~::~,:~,:~,~~::~ ~~~~~~~~~~: ~~~~~~ / &yy < : ---,-A--Az*,::::::::> :::::::::::::~~~:::jj~::~:::::::: p:<::::::::::::::::: : : ( >$X>>X> 2