Subject: [cicm] Red side versus Black side API

From: "John Fitton" <[email-masked]>
Date: Wed, 16 Jun 2010 14:24:21 -0400

>From a security design perspective one can envision the need to protect all
control functions which would seem to favor "red side" control. However in
the software radio world some of the waveform (air interface) applications
need to have some of the control  API's present on the "black side" and
others on the "red" with others on both sides. While most control functions
are unclassified, some may need to handle classified configuration data.

>From my experience base, I believe that the API functions should be agnostic
as to whether or not they are red or black side because typically they will
be on the side that needs them and this is a function of the security
architecture.  I think the model to consider is as follows because it
eliminates red/black terminology which is typically misused. 

Consider a MILS (Multiple Independent Levels of Security) environment using
a high assurance separation kernel in which all domains share the same
processor, each in their own partition, and the OS maintains the required
separation between the partitions.  One of the partitions could even be a
100% software based crypto. The system would include "Reference Monitor"
functions to support cross domain communications to the extent that these
are required and allowed. In this environment, the terms red and black are
indeed meaningless from an API perspective. 

In a high assurance environment which employs machine interpretable explicit
security policy statements, the security policy for a given
application/waveform could define the rule set that specifies which API's
are available in what is typically the "plaintext" space vs. the "cipher
text" space.

 I use the word "typically" because the in the JTRS Software Communications
Architecture Security Services API (note: the API was subsequently withdrawn
from the SCA), if you recall, supported encrypting data and returning the
cipher text back to the same side from which the plaintext was submitted.
There is also an interesting notion that one could take unclassified data
and store it in a protected "red side" database containing classified data
by encrypting it from "black to red" and when retrieving it siply decrypt it
from "red to black".  This process completely avoids the need for bypass and
write-up/down operations which are typically hard to do in this kind of
situation.

John Fitton

Harris Fellow, Senior Scientist

Harris RF Communications