# Security Architecture for Cloud-Based Command and Control System in IoT Environment
## 2 Background
### DoD C4I System
#### 2.1.2 Security Requirements of National Defense Cloud Service in DoD  
The DoD has implemented IdAM services on a \"per-application, enclave, or per-system basis\" [4]. Furthermore, the DoD used the common access card (CAC), which is a common means of authentication, such as the current Korean military's cryptographic module. However, inconsistency problems occurred owing to the different authentication, authorization, and access control processes for each system. Consequently, the U.S. military is currently building a cloud-based national defense information system through a JIE, and deploying the JRSS to enhance the security of information exchange and data access. Additionally, it is deriving and directing the security requirements of cloud computing through the security requirements guide of cloud computing from the federal risk and authorization management program (FedRAMP) and the defense information system agency (DISA). Table 1 summarizes the security requirements published by the FedRAMP, and Table 2 summarizes the cloud computing security requirements published by the DISA [5; 6]. The DoD provides a standard approach to security assessment, certification, and continuous monitoring of cloud products and services through the FedRAMP. Cloud service providers that provide products and services to the U.S. government must certify their compliance with the FedRAMP, which is a requirement specified in NIST 800-53; i.e., security and privacy for federal information systems and organizations. In addition, more than 2000 U.S. government agencies currently use various Amazon web services (AWS), and the DoD applies AWS to process, store and transmit data. AWS obey the security requirements through the certification of the DISA under the DoD. It defines security requirements guides, as summarized in Table 2, and provides a standard assessment and certification process.  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Name** & **Requirements** \\ \hline \hline \multirow{6}{*}{FedRAMP Security Controls Baseline} & Access Control \\  & Security Alert and Education \\  & Inspection and Responsibility \\  & Evaluation and Authorization \\  & Configuration \\  & Emergency Management \\  & Identification and Authentication \\  & Incident Response \\  & Maintenance Management \\  & Media Security \\  & Physical Environment Defense \\  & Plan \\  & Personnel Security \\  & Calculate Threat \\  & Add System and Service \\  & System and Communication Security \\  & System and Information Integration \\ \hline \hline \end{tabular}
\end{table}
Table 1: Federal risk and authorization management program (FedRAMP) Security Controls Baseline [5].  
\begin{table}
\begin{tabular}{c c} \hline \hline
**Name** & **Requirements** \\ \hline \hline \multirow{6}{*}{DISA Cloud Computing Security Requirements Guide} & Availability assurance \\  & Usage of SSI/VPN \\  & Recovery (Duplexing, Backup) \\  & Security Team Composition \\ \cline{1-1}  & Resilience, on-Demand Scalability \\ \cline{1-1}  & Maintain Operational Transparency \\ \cline{1-1}  & Personnel Security \\ \cline{1-1}  & Logical Separation of Information Data \\ \cline{1-1}  & Physical Separation of Information Data \\ \hline \hline \end{tabular}
\end{table}
Table 2: Defense information system agency (DISA) Cloud Computing Security Requirements Guide [6].