Blockchain as a cross-domain security solution
By design, a blockchain business network securely shares information between different organizations by distributing ledger transactions to peer nodes located throughout the business network, including nodes physically located within a competing organization’s security environment and domain. The same blockchain security design features that enable these secure cross-organizational information transfers are also ideally suited to ensure the safe, efficient and cost-effective transfer of information across different government and military network security domains — for example between classified and unclassified military networks.
The security controls and assured sharing inherent to open source blockchain Hyperledger Fabric hosted on high assurance off-the-shelf hardware infrastructures, can provide secure, timely and consistent end-to-end sharing of information within and across disparate security domains. A blockchain-based cross-domain solution is likely to be less complex, more effective and less expensive than traditional, special-purpose cross-domain guards when mitigating the high stakes security risks of cross-domain information transfer.
Public, private, government and military organizations classify, label and protect information commensurate with the security risk it poses if disclosed without authorization. For example, unclassified information poses no risk if disclosed while inadvertent disclosure of top secret information could be expected to cause exceptionally grave damage. The most rudimentary form of protection is segregating information of different security levels on completely separate IT infrastructures and communication networks. These separate networks, however, hinder day-to-day work because typically real-world work and business processes require accessing and exchanging information at varying classifications.
Traditionally, highly specialized IT systems known as cross-domain guards sit at the boundary of each security domain reading files from a designated source location in one security domain and applying a pre-approved filter for that specific source to each file. These filters and controls verify the integrity and contents of the file to satisfy security policies then write the file to a designated target location in the other security network. These cross-domain data flows are either low-to-high — lower security classifications to higher ones — or high-to-low.
The concern for low-to-high guards is preventing the introduction of dangerous computer files like viruses or malware, and preventing a reverse flow of data. The chief concern for high-to-low guards is preventing unauthorized leakage of higher classification data to the lower classification network.
