Doctoral theses at NTNU, 2018:46 Vasileios Gkioulos Vasileios Gkioulos Securing Tactical Service Oriented Architectures ISBN 978-82-326-2884-1 (printed version) ISBN 978-82-326-2885-8 (electronic version) ISSN 1503-8181 Doctoral theses at NTNU, 2018:46 NTNU Technology Norwegian University of Science and Technology and Electrical Engineering Faculty of Information Technology Department of Information Security and Communication Vasileios Gkioulos Securing Tactical Service Oriented Architectures Thesis for the degree of Philosophiae Doctor Gjøvik, February 2018 Norwegian University of Science and Technology Faculty of Information Technology and Electrical Engineering Department of Information Security and Communication Technology NTNU Norwegian University of Science and Technology Thesis for the degree of Philosophiae Doctor Faculty of Information Technology and Electrical Engineering Department of Information Security and Communication Technology © Vasileios Gkioulos ISBN 978-82-326-2884-1 (printed version) ISBN 978-82-326-2885-8 (electronic version) ISSN 1503-8181 Doctoral theses at NTNU, 2018:46 Printed by Skipnes Kommunikasjon as Securing Tactical Service Oriented Architectures Vasileios Gkioulos Thesis submitted to the Norwegian University of Science and Technology for the degree of Doctor of Philosophy in Information Security 2018 Securing Tactical Service Oriented Architectures Faculty of Information Technology and Electrical Engineering Norwegian University of Science and Technology ”No man ever wetted clay and then left it, as if there would be bricks by chance and fortune.” (Plutarch, 45-120 A.D., Morals - De Fortuna) Declaration of Authorship I, Vasileios Gkioulos, hereby declare that this thesis and the work pre- sented in it is entirely my own. Where I have consulted the work of others, this is always clearly stated. Signed: (Vasileios Gkioulos) Date: Abstract Research and development across military network technologies is an ongo- ing task, seeking to satisfy continuously evolving requirements and adver- sarial models. Beyond distinct implementations or technologies, the afore- mentioned requirements specify networks that provide, flexibility, agility, and adaptability to the dynamic military operational context. Furthermore, such networks must primarily support uninterrupted access to services and information, for the consolidation and maintenance of an enriched COP (Common Operational Picture), and the provisioning of military capabili- ties. Nonetheless, military networks do not constitute a unified environment, for which generic technologies can be developed and deployed, while a clear distinction exists between the strategic, operational and tactical lev- els. The strategic/ operational levels rely on permanent or semi-permanent infrastructure that supports components such as headquarters, mission con- trol centres, and logistics coordination centres. Contrary to that, the tactical level incorporates provisional assets deployed for the attainment of specific operational objectives, within singular or interlaced mission scenarios. Therefore, tactical networks are of constrained nature in terms related to infrastructure, operational capabilities, and resource availability. Accord- ingly, deploying and securing tactical C2 (Command and Control) and C4I (Command, Control, Communications, Computers, and Intelligence) sys- tems, must accommodate such requirements and constraints. Furthermore, the increased integration of information systems towards the attainment of NEC (Network Enabled Capability), promoted the use of SOA (Service Ori- ented Architectures) across all levels. To address the security challenges, imposed by tactical SOA, the scope of this thesis is tripartite. Initially, the corresponding requirements have been extracted, referring both to the protection of information and services, but also to functional requirements for the developed policy and service architectures. Protect- ing tactical SOA requires the accommodation of security requirements, for stored, transmitted and processed information, under the explicit constraints of the tactical environment, maintaining operability within the various tac- tical modes of operation. Furthermore, the constraints of tactical networks impose significant limitations to the realization of suitable SOA based so- lutions. Overcoming these limitations, while maintaining the enforcement of security controls for the protection of services, as the means to process i information, is a critical task that we investigated. Finally the functional re- quirements for the implementation of a security policy mechanism tailored to tactical SOA, have been extracted and analysed. The aforementioned constraints within the highly dynamic tactical envi- ronment, impose significant limitations to the functionalities and efficiency of current security policy frameworks. Thus, a security policy framework dedicated to tactical SOA is presented, as it has been developed in align- ment to the previously identified requirements. Consequently, due to the constrained nature of tactical nodes, the parameters governing the partition- ing and distribution of security policies are investigated within our work. Elements of critical impact have been identified and analysed, while a suit- able partitioning mechanism has been defined. Furthermore, possible diver- gences across the distributed policies have been classified, and mechanisms for policy reconciliation have been developed. The nature of occurring di- vergences has been limited to an expected and permitted subset, while tak- ing under consideration the constraints of the tactical environment and the requirement for auditing, prioritization and roll back capabilities. The last component of our research relates to the development of a core security service architecture, tailored to the requirements of tactical SOA. This refers to a subset of services that are dedicated to the attainment of the identified security controls, according to security policies established at the mission preparation stage. Furthermore, additional aspects such as the interoperability of the security architecture and the QoS (Quality of Service) decision subsystem have been examined. ii Sammendrag Forskning og utvikling innen militære nettverksteknologier møter stadig økende krav og endrede sikkerhetsmodeller. Foruten spesifikke teknologi- implementasjoner er de nevnte kravene først og fremst knyttet til fleksi- bilitet, dynamikk og tilpasning til dynamiske militære operasjoner. Slike nettverk ma˚ hovedsakelig støtte uavbrutt tjeneste- og informasjonstilgang, sammenslaing˚ og vedlikehold av et felles overordna stridsbilde (COP Com- mon Operational Picture) og utrulling av militære ytelsesevner. Militære nettverk utgjør ikke noe enhetlig miljø hvor generelle teknolo- gier kan bli utviklet og utplassert og det eksisterer en klar forskjell mel- lom strategiske og taktiske domener. Det strategiske domenet innbefatter en permanent eller en halv-permanent infrastruktur som støtter opp un- der nettverkskomponenter for hovedkontor, operasjonskontrollsentere og logiske koordineringssentre. I motsetning, sa˚ innbefatter taktiske domener en mer provisorisk utrulling av enheter for oppnaelse˚ av spesifikke opera- sjonelle mal˚ innen enkle eller sammensatte militære operasjoner. Taktiske nettverk er derfor naturlig begrenset i forhold til infrastruktur, operasjonelle evner og ressurstilgjengelighet. Utrulling og sikring av tak- tiske kommando og kontroll systemer (C2 Command and Control og C4I Command, Control, Communication, Computer and Intelligence) ma˚ der- for imøtekomme en rekke krav og har mange begrensninger. Pa˚ grunn av en økende integrasjonsgrad mellom ulike informasjonssystemer for a˚ oppna˚ NEC (Network Enabled Capability), promoteres tjenesteorientert arkitektur (SOA Service Oriented Architectures) for begge typer domener. For a˚ pa˚ best mulig mate˚ kunne adressere sikkerhetsutfordringene igjennom bruk av taktisk SOA, er omfanget i denne avhandlingen tredelt. Den første delen inneholder relevante krav funnet for a˚ kunne utføre beskyttelse pa˚ tjeneste og informasjon niva,˚ men det er i tillegg ogsa˚ satt funksjonelle krav relatert til var˚ utviklede policy og tjeneste arkitektur. Det a˚ beskytte taktisk SOA setter sikkerhetskrav for lagret, sendt og prosessert in- formasjon, men det setter ogsa˚ eksplisitte begrensninger i taktiske miljø for a˚ opprettholde stabil drift i ulike taktiske driftsmodus. Disse begrensningene av taktiske nettverk tvinger frem et begrenset utfallsrom av mulige SOA løsninger. Det a˚ komme over disse begrensingene, samtidig som at sikker- heten handheves˚ for tjenestebeskyttelse innen informasjonsprosessering, er en kritisk oppgave som det har blitt forsket pa.˚ Kravdelen ble avsluttet ved iii a˚ ekstrahere og analysere en rekke funksjonelle implementasjonskrav til en sikkerhetspolicy spesialtilpasset til taktisk SOA. Disse begrensingene innen dynamiske taktiske miljø, utgjør en signifikant innskrenking av eksisterende sikkerhetsrammeverk. Den andre delen av forskningen presenterer derfor et rammeverk for en sikkerhetspolicy satt opp for taktisk SOA, som har blitt utviklet i trad˚ med de identifiserte kravene. Pa˚ grunn av en naturlig begrensning i taktiske noder, er det blitt forsket pa˚ parameterne som styrer partisjonering og distribusjon av sikkerhetspolicyer. Det har blitt analysert og identifisert elementer av kritisk betydning og det har blitt definert en passende partisjonersmekanisme. Mulige avvik for dis- tribuerte policyer har blitt klassifisert