Subject: Re: [cicm] Does CICM only provide (specify) the "red" side API ina multilevel system?

From: "Davidson, John A." <[email-masked]>
Date: Fri, 25 Jun 2010 10:55:08 -0700

Greetings, Im new, a JTRS COMPUSEC engineer, and see a couple of names I know.  Please bear with me while I learn the ropes a bit.   

I had an idea to throw out about this as an API.  Seems to me an API needs to be able to have a leg (an API) in each of two otherwise isolated domains.  The MLS OE needs to be able to isolate the API-A from the API-B.  Internally, the function would also have to be proven to represent a wall with no leaks besides the cryptographic transform.  This enables the OE to separate PT view API from a CT view API.  The OE could also choose to put both the A- and B-API in the same domain if, for instance, a control domain function needed to check a cryptographic signature, it could submit the authentication request and get the result in the same domain.  

When I say “otherwise isolated,” I admit I also believe I see two parts to this kind of function, cryptographic and bypass.  I guess I will extend my neck way out and admit I think cryptography can be supported securely but I just do not believe there is any logical way to support any amount of bypass securely, so I would suggest we consider declining to support bypass.  I would argue that bypass simply punches un-mitigatable holes (leaks) in our otherwise secure wall, and if someone thinks they need bypass, let them punch their own holes in somebody else’s wall.  That probably sounds heretical but I think I can justify that POV; I view bypass (like header bypass) as a symptom of an IA architectural problem that should have been solved outside the “crypto.”  But maybe this is a topic for another thread?  Help me out here.