I need to implement a classification system for my company, similar to the government's.
I'm working for a company working with the government. The classification system in my country isn't public so we can't just ask them how to do. We're required to create classification levels like:
Public) but with internal names (
la, "l" stands for "level") just as theirs. We can't know how the government does that, so I need your help to design such a system, talking about encryption, storage, sharing, authentication, ...
We simply need an equivalent system. Concerning the authentication, I've thought about using a PKI. Concerning the storage and redundancy, I've thought about an encrypted external HDD like a NAS/SAN (RAID + geographically distant/separated/isolated connected via a VPN. Levels are cumulative and not automatically deduced. To avoid risk of data loss and because it's needed by the laws in my country, I need to create a 6th level/SOS level (the highest level), to an anonymous which will be able to access and decrypt ANYTHING, and manage the system. "Anonymous" because it's not given to anyone, the "level" will be kept in 1 or more different safe and will be used if there is a system failure or if the government ask access to our data or to manage the system (because I will manage it but I don't have a high level).
I'm thinking about
PKI to authenticate someone's identity and level. But then, the user need to decrypt the document. If a data is password based encrypted, it will be stored somewhere (maybe an etoken), if discovered the system is compromised. If I use
levels PKI for encryption (1
private key for 1
level), a user which is granted multiple levels will have to store multiple private keys on his token.
Do you guys have an idea on how it's done by the government and their classification system? We have to basically do the same.
EDIT: Some parts of my question aren't clear enough or are bad explained. I've not edited my question based on the answers content, so I hope I didn't change the question because some answers are already really interesting.