Information Centric Security

A significant amount of information-at-rest is available for exploit by a disloyal insider. The need is to compartmentalize the information-at-rest so that only those roles that are allowed to should have access to it. Information compartmentalizationmeans that a disloyal insider will only have access to a subset of the information. This controls the amount of information a disloyal insider would access, such that damage containment can be done in localizing the domain where the compromise occurs.This serves as a line of defense to be fused with other component technologies to form an integrated solution required for a Defense in Depth.This working model shall demonstrate a combination client and server version based on ANSI X9.69 for a representative operational environment. An analysis will be conducted related to the Security Targets (ST) and Targets of Evaluation (TOE) that will bedeveloped in accordance with published Protection Profiles (PP). The ST and TOE will be based on those security objectives and requirements required for NIAP at EAL 4. The design will incorporate tamper resistance functionality by adding hardware and othercapabilities for an eventual FIPS 140-2 certification. The information centric security system will meet the following categorized objectives: access control, key management, data protection, interoperability, audit trail and logging, system misuse and damage assessment, as well as modes of operation.Applicable markets for this research include homeland security and defense, healthcare, and digital and asset rights management