🎯 Scope and Objectives
ABAC-DLP is designed to operate within enterprise environments using Microsoft systems in an Active Directory domain, working with other software and hardware to secure sensitive documents.
🛡️ Enterprise Architecture
🛡️ Solution Components
| Feature | Technology |
|---|---|
| 🎯 Active Directory Domain Controller | The enterprise must deploy an AD-DC to manage users, organizational units, computers, and security groups. All users and computers should be part of the AD-DC and its defined security groups. Create a “MandatoryAccess” organizational unit at the root, with nested MLS and MCS sub-OUs. Also, set up an AD user with UPN “authservice@yourdomain” in the “MandatoryAccess” OU. |
| 🎯 Application Services | The solution utilizes an application service dedicated to authorizing users who request access to download and decrypt sensitive documents. Communication is conducted over a secure TLS channel, and the service can be deployed in a cluster environment to ensure redundancy and efficient load distribution. All services are required to operate on Active Directory domain-joined Windows hosts, running specifically as Windows Services with “LogOn” permissions assigned to “authservice@yourdomain”. |
| 🎯 Shared File System | The proposed solution necessitates the implementation of a shared file system for the storage of encrypted sensitive documents. Deployment will utilize an SMB 3.1.1 shared file system, with access strictly limited to the “authservice@yourdomain” Active Directory account. |
| 🎯 Enterprise PKI | The enterprise must set up a PKI to issue NPE certificates for TLS and PE certificates for user authentication with the application service. |
| 🎯 Network HSM | The enterprise must deploy an HSM to store cryptographic keys. The HSM needs to provide a Microsoft CNG API interface through a Key Storage Provider that complies with Microsoft CNG standards. The application service will connect to the HSM using the Microsoft CNG API. |
| 🎯 Application Client | This solution provides an MS-Windows desktop app for securely decrypting sensitive documents, allowing users to read or edit them. The client connects to the application service via TLS to access encrypted documents. |
| 🎯 Smartcard | This solution necessitates that desktop users possess a Smartcard issued by the organization's PKI infrastructure to authenticate with the application service when the client application initiates the download and decryption of sensitive documents. |
| 🎯 TLS | This solution uses TLS 1.3 for secure client-service and LDAP connections to the AD DC, with RSA keys and X.509 certificates for channel setup. Afterward, Lattice algorithms provide post-quantum perfect forward secrecy. |
| 🎯 Network Fabric | This solution entails establishing a network of MS-Windows host machines which communicate using TCP/IP and UDP protocols. It is designed for seamless deployment in either on-premises environments or cloud infrastructures. |
🛡️ Technology Stack
🎯 Front End Layer
| Feature | Technology |
|---|---|
| Framework | Microsoft Windows GDI |
| Language | C++ 17 |
| Libraries | Win32, Windows CNG, OpenSSL, LDAP, Crystals Kyber and Dilithium |
🎯 Back End Layer
| Feature | Technology |
|---|---|
| Framework | Windows Services |
| Language | C++ 17 |
| Libraries | Win32, Windows CNG, OpenSSL, LDAP, Crystals Kyber and Dilithium |
🎯 Storage Layer
| Feature | Technology |
|---|---|
| LDAP | Windows Active Directory |
| Networked Shared File System | A SMB 3.1.1 deployed shared folder accessible by the backend application services for storing encrypted files in a directory hierarchy. This shared folder must be restricted to the backend application services |
| APIs | LDAP API, Win32 |
🎯 Security
| Feature | Technology |
|---|---|
| TLS | OpenSSL APIs for TLS client server communication. |
| Perfect Forward Secrecy, PFS | PFS via Lattice algorithms Kyber and Dilithium |
| Authentication | Smartcard/PKI authentication via MS-CNG APIs |
| Confidentiality | Encryption/Decryption with AES256, RSA-2048 via OpenSSL 3.1 and MS-CNG APIs. Kyber via Crystals APIs. |
| Integrity | RSA-2048 Signature verification via OpenSSL 3.1 and MS-CNG APIs. Dilithium via Crystals APIs. |
| Hardware Key Storage | HSM key material storage and access via the MS-CNG APIs. |
🛡️ Non Functional Requirements
| Feature | Technology |
|---|---|
| Performance | This solution operates according to the network fabric implemented by the end user. Document download speeds depend on the bandwidth available within the local network fabric. |
| Scalability | This solution supports clustered deployment with up to eight concurrent application service instances for improved performance and scalability. |
| Confidentiality | Document encryption and decryption with AES256 when stored to the shared file system. |
| Integrity | Encrypted documents carry a digital signature signed by the authors Smartcard RSA2048 private key and verifiable by the end user. |
| Availability | This solution may be deployed in a clustered environment where up to eight instances of the application service may concurrently operate and each instance will continue to operate when other instances may have stopped or gone offline. |
| Maintenance | The application service is structured to function continuously, around the clock. Should the host machine require scheduled maintenance and be taken offline, the service can be gracefully stopped and subsequently restarted, at which point it will automatically rejoin the cluster and resume client operations. |
| Logging | Significant system events are logged to Windows Event Logger. |
| Auditing | Document access, approval or denial, is logged to Windows Event Logger for auditing purposes. |
| Monitoring | SNMPv3 traps issued for certain events. Service polling from a client to check for availability. |
| Disaster Recovery | IT operations should routinely back up both the shared file system and networked HSM per vendor guidelines, and ensure they know how to restore these backups. |
| Security | This solution enforces security through Confidentiality, Integrity, and Availability. It grants document access only when a user's multi-level, multi-category clearance matches the document's labels. |
| Compliance | The security of this application ensures that GDPR and HIPAA compliances are established. |