Considerations for a shipboard multilevel secure local area network

88 Pages·2.1 MB·en_US

by  Riley, John W.;Schneidewind, Norman F.;Boger, Dan C.

PUDLEVK.MOXLIBRARY
NAVALPOSTGRADUATESCHOOL
MONT1" '" "icnpMiAo?f»/!i.5003

NAVAL POSTGRADUATE SCHOOL
Monterey California
,
THESIS
CONSIDERATIONS FOR A SHIPBOARD
MULTILEVEL SECURE LOCAL AREA NETWORK
by
John W. Riley III
March 1992
Principal Advisor: N.F. Schneidewind
Approved for public release; distribution is unlimited
T258524

UNCLASSIFIED
SECURITY CLASSIFICATION OF THIS PAGE
REPORT DOCUMENTATION PAGE FOoMrBmNAoppr07o0v4e-d01
la REPORTSECURITYCLASSIFICATION lb RESTRICTIVE MARKINGS
UNCLASSIFIED
2a SECURITY CLASSIFICATION AUTHORITY 3ApDIpSTrRoIBvUTeIdON/AfVoAIrLABIpLuITbYlOFicREPOrReTlease
2b DECLASSIFICATION/DOWNGRADING SCHEDULE distribution is unlimited
4 PERFORMING ORGANIZATION REPORT NUMBER(S) 5 MONITORING ORGANIZATION REPORT NUMBER(S)
6a NAME OF PERFORMING ORGANIZATION 6b OFFICE SYMBOL 7a NAME OF MONITORING ORGANIZATION
(Ifapplicable)
Naval Postgraduate School AS Naval Postgraduate School
6c ADDRESS (City, State, andZIPCode) 7b ADDRESS(City, State, andZIPCode)
Monterey, CA 93943-5000 Monterey, CA 93943-5000
8a. NAME OF FUNDING/SPONSORING 8b OFFICE SYMBOL 9 PROCUREMENT INSTRUMENT IDENTIFICATION NUMBER
ORGANIZATION (Ifapplicable)
8c ADDRESS(City, State,andZIPCode) 10 SOURCE OF FUNDING NUMBERS
PROGRAM PROJECT WORK UNIT
ELEMENT NO NO ACCESSION NO
11 TITLE (Include SecurityClassification)
CONSIDERATIONS FOR A SHIPBOARD MULTILEVEL
SECURE LOCAL AREA NETWORK
I2 PERSONAL AUTHOR(S)
RILEY, John W. Ill
13a TYPE OF REPORT 3b TIME COVERED DATE OF REPORT (Year,Month,Day) 5 PAGE COUNT
Master's Thesis FROM TO 1992 March ^ 7^9
16 SUPPLEMENTARY NOTATION The views expressed in this thes±s thosQ Q±
author and do not reflect the official policy or position of the Depart-
ment of Defpnsp nr t.hP tts Gogfixuman.^
FIELD GRCOOUSPATI CODESSUB-GROUP s1h8iSpUbBoJEaCrTdTERlMoSca(Clontainrueeaonnreevtewrsoerikf;necessshairypbanodairddentiLfyANby;blLocAkNnummbuelrt)i-
level security; NAVMACS/GateGuard interface; VERDIX
secure LAN; DMS multilevel; mailserver, MMS
19 ABSTRACT {Continue onreverse ifnecessaryandidentifybyblock number) This thesis investigates the possi-
bility of implementing a multilevel secure local area network on a medium-sized ship.
In particular it focuses on medium-sized ship communications suite connectivity to a Gate
Guard computer system, and then on incorporating systems that have been developed under
the Navy's transition plan for the Defense Message System; specifically the Multilevel
Mailer Server being installed at Navy Telecommunications Centers. A review of data com-
munications security considerations as well as DoD and Navy directives is provided for
background on the accreditation requirements of multilevel secure systems. Additionally
two commercially available products, the VERDIX Secure Local Area Network and Trusted
Information System' XENIX trusted operating system are reviewed and then shown how they
could potentially be integrated into a shipboard local area network. A potential con-
figuration is provided with recommendation for further study of system application
compatibility.
20 DISTRIBUTION/AVAILABILITY OF ABSTRACT ABSTRACT SECURITY CLASSIFICATION
UNCLASSIFIED
30UNCLASSIFIED/UNLIMITED SAME AS RPT DTIC USERS
22a NAME OF RESPONSIBLE INDIVIDUAL 22b TELEPHONE(IncludeAreaCode) 22c OFFICE SYMBOL
SCHNEIDEWIND, N.F. 408-646-2719 AS/ss
DDForm1473, JUN 86 Previouseditionsareobsolete SECURITY CLASSIFICATION OF THIS PAGE
S/N 0102-LF-014-6603 UNCLASSIFIED
Approved for public release; distribution is unlimited.
Considerations for a Shipboard Multilevel Secure Local Area Network
by
W
John RileyIII
Lieutenant Commander, UnitedStatesNavy
B.A,TulaneUniversity, 1980
Submitted in partial fulfillment
ofthe requirementsfor the degree of
MASTER OFSCIENCE IN TELECOMMUNICATIONS SYSTEMS MANAGEMENT
from the
NAVAL POSTGRADUATE SCHOOL
March 1992
ABSTRACT
Thisthesisinvestigatesthepossibilityofimplementingamultilevelsecurelocalareanetworkon
amedium-sizedship. In particular it focuseson medium-sizedshipcommunicationssuiteconnectivity
to aGateGuardcomputersystem, and thenon incorporatingsystemsthat havebeen developed under
theNavy'stransitionplanfortheDefenseMessageSystem;specificallytheMultilevelMailServerbeing
installedatNavyTelecommunicationsCenters.Areviewofdatacommunicationssecurityconsiderations
aswell as DoD and Navy directives is provided for background on the accreditation requirements of
multilevelsecuresystems.Additionallytwocommerciallyavailableproducts,theVERDIXSecureLocal
Area Network and Trusted Information Systems' XENIX trusted operating system arc reviewed and
then shown how theycould potentially be integrated into a shipboard local area network. A potential
configuration is provided with recommendation for further studs ofsystem application compatibility.
TABLE OFCONTENTS
I. INTRODUCTION 1
A. BACKGROUND 1
1. CurrentSystems 1
2. PrototypeSystems 2
a. SWIFTNET 2
b. GWIS 3
c. ShipboardNon-tacticalADPProgram 4
B. THEPROBLEMS 7
1. Message Handling 7
2. ElectronicLibrary 8
C. PURPOSE 9
D. ORGANIZATION 9
II. SECURITY OVERVIEW 11
A. BACKGROUND 11
1. Accesscontrols 11
a. Authentication 12
b. PartialAccess Control 12
c. FullAccessControl 13
d. AccessControlMatrix 13
2. Encryption 15
a. Data EncryptionStandard 15