Final
Data Protection Methods Report

for the

OSD CALS IWSDB PROJECT

An MVP Joint Venture

December 2, 1994

Submitted by
ManTech International Corporation
Technology Applications Operations Center
1313 Locust Avenue
Fairmont, West Virginia

In support of
Contract DAAB10-89-D-0503
And in compliance with
CDRL Sequence Number A018

SOW Numbers 3.0, 3.3, 3.3.3

TABLE OF CONTENTS

List of Figures
List of Tables
INTRODUCTION
BACKGROUND
1.0  DEFINING RESTRICTED DATA

1.1  Federal "Rainbow Series" Guidelines
1.2  Industry Restriction Guidelines
1.3  Current Practices

2.0  EXISTING DATA RESTRICTION METHODOLOGIES

2.1  Access Control Systems

2.1.1  Access Protocol

2.1.1.1  Password Protocols/Best Practices
2.1.1.2  Password Hardware:  Tokens, Buttons, and Smartcards

2.1.1.2.1  Fortezza Card
2.1.1.2.2  Fortezza's Capstone Chip
2.1.1.2.3  Clipper Chip Capabilities

2.1.2  Access Control Software

2.1.2.1  Role-Based Access Control Software
2.1.2.2  Polyinstantiation Control Software

2.2  Audit Control Systems

2.2.1  Audit Control Software and Abnormal User Behavior Detection
2.2.2  Audit Control Hardware

3.0  PROPOSED DATA RESTRICTION METHODOLOGIES

3.1  Third Party Authentication
3.2  Firewalls
3.3  Audit Protocols
3.4  CANEWARE and NES On-The-Fly Encryption
3.5  Direct Use of Government Computer Hubs
3.6  Replication Servers for Reliability

4.0  COMPARATIVE ANALYSIS PROCESS

4.1  General Conclusions
4.2  Observations and Conclusions

4.2.1  Privacy Issues
4.2.2  Post-FTS-2000 and Future Use of ATM

APPENDIX A - GLOSSARY
APPENDIX B - REFERENCES

List of Figures

Figure 3.2-1  Proposed DoD Security Protocol
Figure 3.5-1  CALS Electronic Commerce Resource Centers