Securing Enterprise Multicast Access Control Requirements with Group Domain of Interpretation (GDOI)

Abstract

The Defense Information Systems Agency (DISA) provides the Department of Defense (DoD) Intelligence, Surveillance, Reconnaissance (ISR) community with access to critical Full Motion Video (FMV) services such as DISA's Unified Video Dissemination System (UVDS) and the U.S. Air Force Global Broadcast Service (GBS). These systems provide ingest and dissemination of ISR sensor streaming video and metadata using IP multicast transport, a technology critical to efficient FMV delivery. To meet FMV and other multicast requirements, DISA NS122 is delivering an Enterprise Multicast Service for Defense Information Systems Network (DISN) customers that will allow native transport of multicast across the DISN Core. However, based on real time changes to the sensitivity of a mission, some multicast customers have an "access control" / limited distribution (LIMDIS) requirement specifying that mission commanders have the ability to stop the flow of FMV to certain receivers in the middle of a mission. Based on this requirement, there is a risk that some DISN multicast customers will choose not to use the Enterprise Multicast Service and continue operating with the existing, less efficient tunnel-based multicast architecture. DISA can mitigate this risk and encourage the use of the Enterprise Multicast Service by providing an access control solution for SATCOM Gateway and other DISN customers. The purpose of this document is to outline a network based approach for solving the aforementioned access control requirement. Doing so will enable a greater percentage of existing multicast users to transition to the Enterprise Multicast Service, increasing bandwidth efficiency and allowing for greater multicast network scalability across the DODIN.