Document Access Servlet™
(DAS)

Overview

Complementing SecretAgent (release 5.9 and above) and now SpyProof! 6.0 Enterprise Edition, DAS† allows sensitive documents and even entire disk partitions to be securely shared among the frequently changing members of one or more Communities of Interest (CoIs). Once a document is encrypted for a particular CoI (or for the union of several CoIs), it can only be decrypted by a current member of that group. Documents need not be re-encrypted as group membership rosters change — DAS figures out in real time who should have access to a given document.

NEW! As of release 1.7, DAS supports dynamic LDAP groups as well as static ones when used with SecretAgent 5.9 client software. As of release 6.0, SecretAgent clients allow documents to be encrypted for arbitrary intersections (of unions) of static and dynamic LDAP groups.

 

† Patent pending.

How DAS Works †

Regardless of where it's stored, when a user attempts to decrypt an archive owned by (i.e., encrypted for) a particular CoI, their SecretAgent client automatically establishes a TLS-secured session with the appropriate DAS webserver. DAS accepts a decryption request from the client and applies one of several configurable authentication mechanisms to check the user's membership in that CoI.

(Click diagram for a detailed DAS Architecture Diagram in PDF form).

If DAS determines that the user is currently a CoI member, it processes the request and returns a document decryption key to the client; otherwise, the request is denied. (Actually, a document might be encrypted for a number of ordinary recipients, a set of CoIs, or even the intersection of several COIs, so that the above process might be repeated until either a CoI membership test is passed or the user is found to possess the private key of one of the ordinary recipients.) If a document has been encrypted for a union of CoIs, the user need only be a member of one of them to decrypt the document; if it has been encrypted for an intersection of CoIs, the user must be a member of all of them to decrypt the document. (As of release 6.0, SecretAgent clients support arbitrary combinations of unions and intersections.)

DAS provides a web-based administrative interface for all system configuration, key management, and CoI maintenance tasks. Administrators can easily grant or deny users access to large numbers of sensitive files using centrally-managed CoI membership rosters based on DAS' own integrated certificate database, an organization's existing LDAP repository, or on any authentication mechanism provided by a third party. (In fact, membership testing can easily be configured to rely on existing third party solutions for restricted website access, although our existing customers appear to prefer to use their own enterprise-accessible LDAP repositories to define and maintain CoIs as static or dynamic LDAP queries.)

Optional Hardware Support

A network-attached hardware security module (HSM) may be used by one or more DAS servers to protect their system keys. The HSM may be directly connected over the network to the DAS servers (not illustrated), or indirectly connected via a proxy server (provided by ISC as an optional DAS component) as illustrated below:

(Click diagram for a detailed DAS Proxy Server Architecture Diagram in PDF form).

 

† Patent pending.

DoD Evaluation and User Comments

ISC's DAS interoperability demonstration project (IT 03.09) for CWID 2006 has been judged a "top performing technical solution" and is listed among the top twelve "standout" projects in the final report. The conclusion was that "DAS successfully secured and shared documents and files among established COI." On the issue of performance, they wrote:

"The Document Access Servlet (DAS), IT03.09, was an excellent product to control access to mass circulated documents. DAS provides a significant improvement to control access in this modern era for documents re-transmitted to offices not authorized to view the enclosed data.  The trial worked consistently well and issues encountered were easy to troubleshoot and solve. Most issues related to system configuration, setup, and MSEL execution not [negatively impact] product performance. The DAS trial met the CWID objective for Net-centric Enterprise Services."

Here is what a few of the participating warfighters had to say about the demo:

"... I was very impressed with the technology's capabilities and envision operational employment within the HLD/HLS environment."

"The versatility and utility of this product make this a viable technology for advancement."

"Seems like a very simple and transparent application. Just the kind of thing a warfighter needs."

"Enjoyable and easy to do.  The Secret Agent DAS program was extremely easy to learn and operate."

"This is one of the smoothest operating trials I had."

For more information, consult the CWID 2006 Warfighter/Operator Report and Technical Interoperability Assessment. If these links are broken, the reports are also available locally in PDF form:

CWID 2006 IT03.09 (DAS) Warfighter/Operator Report

CWID 2006 IT03.09 (DAS) Technical Interoperability Assessment