Zero Trust security is being adopted across companies and government organizations to continually verify cybersecurity requirements. This paper investigates architecture development methodologies that can develop a Zero Trust architecture that implements the missions of an enterprise. An enterprise architecture depends on an organization's strategic priorities and should reflect the organization's critical decisions. These decisions can be evaluated according to criteria such as interoperability, speed of operations tempo, and cyber-resilience to failures. Zero-Trust architectures must define alternatives tailored to missions. An enterprise architecture can then be developed that describes the context, operations, and resources associated with a strategic implementation decision. A multi-criteria decision-making method such as the Analytic Hierarchy Process can help guide the development and implementation of Zero Trust strategy. Zero Trust criteria are defined according to quality attributes associated with the DoD Reference Architecture Pillars, and security solutions are evaluated against how well they meet these criteria.

Planning future Multi-Domain Battle (MDB) missions requires extensive, complex, and real-time collaboration and coordination between many Warfighting Functions and Domains such as Electronic Warfare (EW), Positioning, Navigation and Timing (PNT), Network Operations, and Cyber Operations. This collaboration and coordination requires synchronization of the associated domain processes and activities. Large Infrastructure projects for Command and Control (C2) are designed to integrate and align these processes through Information Technology (IT) services, such as decision aids, collaboration tools, and communication tools. New acquisition initiatives are driving infrastructure development to support the rapid fielding of capabilities through a modular software development approach. State-of-the-Art Shared Infrastructure Services can be developed using Agile Software Development (ASD) methods such as Scrum, Kanban, or Extreme Programming. However, the integration of these IT services cannot be easily planned since they are developed at the technology (i.e., software implementation) level according to the selected ASD method. Engineering the Infrastructure as Code (IaC) results in a gap between doctrinal processes and required system functionality since developers quickly code and configure small functional modular units at the technology level, while bypassing the traditional top-down waterfall flow from requirements to design. Furthermore, IaC does not explicitly require consulting a systems architecture. To improve the alignment of configured IT infrastructure services with doctrinal processes, this paper seeks to determine the extent to which agile Development Operations (DevOps) process can implement C2 doctrine while supporting dynamically-changing mission requirements and an operational environment. This paper proposes an automated Systems Engineering workflow to realize IT infrastructure services using Model-Driven Architecture (MDA) and a military DevOps.

The future Tactical Internet is becoming increasingly virtualized with increasing variation in the type and number of network resources. Capabilities developers offer many choices of technical solutions to implement service requirements. Technology approaches such as software-defined networks, cloud computing and the internet of things enable many different usage scenarios. Network behavior will increasingly be determined through a configuration strategy that determines how resources will be placed in service. As a result, acquisition of and realization of infrastructure to meet demands of network services depends on effective configuration validation solutions. This paper discusses opportunities for applying assurance-driven design to validate the correctness of behavioral requirements for network capability insertion in the Army's networks.

Configuring automated recovery in a multilayer virtualized network presents significant architectural issues. The rules that define the interworking strategy between recovery mechanisms must be translated into technology-specific provisioning commands sent to network devices. This provisioning data is typically fragmented across many computing and networking resources. There is also a set of possible device actions that can be performed by a resource, such as forwarding traffic to a protection route, discovering a route to send traffic, adjusting security characteristics of a link, and matching sender and receiver characteristics. Consequently, multiple information models, each of which is specific to a device type and technology layer must be understood, aligned and shared. As a result, an approach is needed to verify and validate that the resulting recovery operations from the input provisioning data achieve end-to-end service requirements.This paper presents an ontological approach to assure the correct coordination of recovery actions using an integrated knowledge model of multilayer recovery. With an ontological approach, an assurance case that proves correctness of provisioning and resulting network operations can be automated. Such an ontological model identifies the key domain elements and their relationships. Associated statements can then be retrieved from a knowledgebase so that the constraints associated with the network representation and service requirements can be tested. (C) 2016 The Authors. Published by Elsevier B.V.

This paper explores challenges in implementing an end-to-end communications architecture for Condition-Based Maintenance Plus (CBM+) data transmission which aligns with the Army's Network Modernization Strategy. The Army's Network Modernization strategy is based on rolling out network capabilities which connect the smallest unit and Soldier level to enterprise systems. CBM+ is a continuous improvement initiative over the life cycle of a weapon system or equipment to improve the reliability and maintenance effectiveness of Department of Defense (DoD) systems. CBM+ depends on the collection, processing and transport of large volumes of data. An important capability that enables CBM+ is an end-to-end network architecture that enables data to be uploaded from the platform at the tactical level to enterprise data analysis tools. To connect end-to-end maintenance processes in the Army's supply chain, a CBM+ network capability can be developed from available network capabilities.

We have developed an engineering method to detect errors in provisioning automated recovery processes in multilayer and multi-protocol communications transport networks. Our dependability assessment process leverages inference techniques provided by Semantic Web technologies in order to detect network-device provisioning errors. Provisioning should be accompanied by methodologies, processes, and activities to ensure that it can be trusted to achieve a desired network state. Our method takes into account unique constraints in the telecommunications domain including bottom-up evolution of physical layer technologies to provide connectivity and lack of a universal model of network functionality. We apply our method to assessing the correctness of provisioning decisions for a protection switching application in a transport network in both the spatial and temporal domains.

Future unmanned systems will be integrated into the Global Information Grid (GIG) and support net-centric data sharing, where information in a domain is exposed to a wide variety of GIG stakeholders that can make use of the information provided. Adopting a Service-Oriented Architecture (SOA) approach to package reusable UAV control station functionality into common control services provides a number of benefits including enabling dynamic plug and play of components depending on changing mission requirements, supporting information sharing to the enterprise, and integrating information from authoritative sources such as mission planners with the UAV control stations data model. It also allows the wider enterprise community to use the services provided by unmanned systems and improve data quality to support more effective decision-making. We explore current challenges in migrating UAV control systems that manage multiple types of vehicles to a Service-Oriented Architecture (SOA). Service-oriented analysis involves reviewing legacy systems and determining which components can be made into a service. Existing UAV control stations provide audio/visual, navigation, and vehicle health and status information that are useful to C4I systems. However, many were designed to be closed systems with proprietary software and hardware implementations, message formats, and specific mission requirements. An architecture analysis can be performed that reviews legacy systems and determines which components can be made into a service. A phased SOA adoption approach can then be developed that improves system interoperability.

An enterprise data strategy outlines an organization's vision and objectives for improved collection and use of data. We propose generic metrics and quantifiable measures for each of the DoD Net-Centric Data Strategy (NCDS) data goals. Data strategy metrics can be adapted to the business processes of an enterprise and the needs of stakeholders in leveraging the organization's data assets to provide for more effective decision making. Generic metrics are applied to a specific application where logistics supply and transportation data is integrated across multiple functional groups. A dashboard presents a multidimensional view of the current progress to a state where logistics data shared in a timely and seamless manner among users, applications, and systems.

There are an increasing number of ways optical network devices and IP routers can interact with each other during a network fault. To provide continuity of service, the interactions between each component in a network must be cooperative. Consequently, the effect of recovery processes cooperating are the network configurations that have certain structural relationships, which can be elaborated. A conflict detector can prove that service will be restored during a fault scenario by checking whether these structural properties hold.We are using simulation as a method to study the coordination of recovery strategies and whether different coordination strategies will achieve recovery goals attached to a network service. The network service carries a traffic stream, which is injected into and extracted from a network. For multilayer recovery to complete, the cumulative effect of device actions during a failure must be (1) a connected path between the endpoints of a service and (2) a flow traffic delivered to a destination at a quality that matches a service level agreement.We represent Optical and Multiprotocol Label Switching (MPLS) recovery actions as graph-maintenance operations that change the state of a digraph. For example, the actions of forwarding traffic between an access port and a trunk port and selecting traffic from a new trunk port and forwarding it to an access port can be modeled as a sequence of edge additions and deletions. The state of the digraph represents the current configuration of a multilayer network as actions of recovery are performed. In this paper, we define some structural properties that can be observed during a simulation as the network evolves to a final state from an initial state before a failure occurs.

A multilayer network is a complex system composed of many devices which in turn are composed of many subsystems. A failure event changes the configuration of the multilayer network, triggering recovery at more than one layer. Proving that a circuit will work after provisioning operations is an important step to preventing misconfiguration of network devices. We have been working on implementing the consistency checker for one layer. It creates a network representation and adds changes to the network. To verify operation of the system, graphical representation of packets are exchanged between different ports. To understand such a systems, we describe them with a block diagram representing important resources.

A multilayer network is a complex system composed of many devices which in turn are composed of many subsystems. A failure event changes the configuration of the multilayer network, triggering recovery at more than one layer. Proving that a circuit will work after provisioning operations is an important step to preventing misconfiguration of network devices. We have been working on implementing the consistency checker for one layer. It creates a network representation and adds changes to the network. To verify operation of the system, graphical representation of packets are exchanged between different ports. To understand such a systems, we describe them with a block diagram representing important resources.

With more options to recover traffic provided, based on services survivability requirements, providing an integrated recovery solution becomes critical. Layering has been a key driver in allowing network devices and technologies geared to carrying new types of services such as IP traffic over existing networks. Also, it has allowed networks to increase capacity by converting SONET to wavelengths. Providing connectivity is a key function of recovery, no matter what the layer. We expect that recovery capabilities will be added to client layers such as IP and MPLS and to server layers such as WDM. A primary goal of recovery is for all services traversing a failed link to be restored in a way consistent with businesses requirements. Inconsistent provisioning will prevent this. Furthermore, since recovery can occur at a different time than when it is provisioned, inconsistent provisioning is really determined after the fact, with services left unrepaired or repaired unnecessarily and at extra cost. Double redundancy will let different layers operate on the same traffic because of the containment relationship of units of traffic called encapsulation. In other words, recovery operates twice. We can ensure recovery meets a global perspective on how traffic should be restored by simply checking the provisioning at each device and checking suitable properties of a formal representation. In this paper, we propose a mapping from command-line interfaces to a topological representation that will allow us to check if provisioning is consistent.

The acceleration in computational scale to solve problems in emerging "computational" fields from Nanoscience and Genetics to Astrophysics places increasingly heavy compute and data storage burdens on locally and globally distributed computer systems. We are focusing on the management of these loosely coupled systems (clusters and Grids) which are asked to behave as an increasingly large single entity, repeatably and reliably. Our approach explores several areas and levels, from low level detection and reaction of loosely coupled subsystems to application dynamics, including human factors. These areas are discussed and results from our work to date is presented. New questions emerge to stimulate deeper thought and discussion of requirements understanding and capture.

Networks add recovery to deliver reliable service between a source and destination. Reliable service is an uninterrupted data transfer between nodes, even if certain links or nodes are faulty. Recovery processes in multilayer networks might operate at the same time when faults propagate between layers during a common-cause failure. We propose an architectural model, that represents point-to-point networks as a grid, where the decisions of recovery can be represented as the replacement of ports. Since a connection is a path through the grid, we can easily determine if multiple connections are repaired. Repairing connections is the goal of multilayer recovery, even if they are repaired at different layers. Since the operations of recovery are the result of preplanned provisioning, a model-checking algorithm could be implemented to check for conflicts in the provisioning. As a first step, this paper decouples the protocols for implementing the actions of recovery from an actual resource-based model. Therefore, no signaling between nodes is treated. Since the provisioning of recovery processes will create decisions of recovery after a catastrophic common-cause failure, we can map the configurations that satisfy goals into provisioning commands sent to recovery processes.

The plethora of new technologies and services such as MPLS, ATM, IP, SONET and WDM allows services to be restored at different layers and at different costs. Restoration schemes at multiple layers might collide, causing a race condition, where restoration agents at different layers keep trying to establish a connection. We define a model for restoration mechanisms at different layers and discuss a technique for automatically detecting conflicts. Our algorithm might be applied as a test before a failure occurs.

Limited attention has been paid to the interactions of service restoration protocols that operate during a fiber cut to restore connectivity between communications equipment. Historically, restoration protocols were deployed only at the SONET layer in telephony networks. SONET frames that carried voice-grade signals such as a T1 or T3 would be redirected to protection path over architectures that supported bidirectional communication. With the advent of new communication technologies such as ATM, IP and WDM, a cable cut can affect multiple routing processes at each of these layers even if a particular network region only supports a few of these technologies. For example, restoration processes at an arbitrary layer in adjacent networks might trigger if lower-layer protocols don't finish within specific deadlines. With the growth of data traffic and a wide range of service offerings, the telecommunication networks of the future are growing more complex, requiring multiple interactions between software systems. Failures will be difficult to pinpoint and the cooperation of the repair processes will be key to ensure that services traversing multiple networks are not interrupted.

Protection switching interactions in wide-area networks need to interoperate with each other in order to restore a wide variety of services, provide survivability to mission-critical applications and accommodate an evolving network infrastructure. Without some coordination between restoration mechanisms, an outage duration would be lengthened as methods assigned to each layer interfere with each other or the network would be locked up in a deadlocked state that never converges to a new topology. A set of control policies can be specified to coordinate between restoration mechanisms in a network that spans multiple layers and regions. These control policies are expressed as rules, and are collectively denoted as the escalation strategy. The escalation strategy can be provisioned by a network manager and is implemented as a distributed coordination protocol between peer recovery agents in the nodes. As rules for coordinating between restoration mechanisms are formalized, a mathematical proof could be provided to prove that the network does indeed converge to a new topology.

We propose a programmable automatic protection switching (APS) protocol to repair an impaired lightpath traversing an optical link. Recovery agents repair impaired flows by searching through a space of policies before attempting a protection switch and after switching impaired traffic. A policy manager disseminates a changeable set of policies to each agent and ensures consistent interpretation end-to-end QoS. QoS policies are structured to be interpreted in the same way by developing a model of end-to-end QoS over which logic formulae can be checked for satisfaction.

Protection switching interactions in wide-area networks need to interoperate with each other in order to restore a wide variety of service types, provide survivability to mission-critical applications and accommodate an evolving network infrastructure. Without some coordination between restoration mechanisms, an outage duration would be lengthened as methods assigned to each layer interfere with each other or the network would be locked up in a deadlocked state that never converges to a new topology. A set of control policies can be specified to coordinate between restoration mechanisms in a network that spans multiple layers and regions. These control policies are expressed as rules, and are collectively denoted as the escalation strategy. The escalation strategy can be provisioned by a network manager and is implemented as a distributed coordination protocol between peer recovery agents in the nodes. As rules for coordinating between restoration mechanisms are formalized, a mathematical proof could be provided to prove that the network does indeed converge to a new topology.

Automatic protection switching (APS) protocols assigned to different layers in wide-area networks require interworking functionality in order to restore a wide variety of services and accommodate an evolving network infrastructure. Without some coordination between restoration mechanisms, an outage duration would be lengthened as methods assigned to different layers interfere with each other, and the network would be locked up in a deadlocked state that never converges to a new topology. A set of control policies can be specified to schedule different restoration mechanisms in a network that spans multiple layers and administrative boundaries. These control policies, which are expressed as if-then rules, are denoted as the escalation strategy. As rules for coordinating between restoration mechanisms are formally expressed in a policy definition language, a mathematical proof could be provided to prove that the agents have consistent knowledge of the network state, allowing individual APS protocols to cooperate with each other