# US 11,310,198 B2 · Integrated multi-level or cross-domain network security management appliance, platform and system, and remote management method and system therefor

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,310,198 B2
- Document ID: US11310198B2
- Status: Granted
- Kind: B2
- Application number: 16/697,857
- Filed: 2019-11-27
- Published: 2020-03-26
- Granted: 2022-04-19
- Earliest claimed: 2017-05-31
- Assignees: Crypto4A Technologies Inc.
- Applicants: Crypto4A Technologies Inc.
- Inventors: Bruno Couillard; Bradley Clare Ritchie; James Ross Goodman; Jean-Pierre Fiset
- Web page: https://patentgrep.com/patent/US11310198B2

## CPC

- H04L 63/0209: {Architectural arrangements, e.g. perimeter networks or demilitarized zones}
- G06F 21/44: Program or device authentication
- G06F 21/606: {by securing the transmission between two devices or processes}
- G06F 21/74: operating in dual or compartmented mode, i.e. at least one secure mode
- G06F 21/87: by means of encapsulation, e.g. for integrated circuits
- G09C 1/00: Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system (cryptographic typewriters G09C3/00)
- H04L 9/0877: {using additional device, e.g. trusted platform module [TPM], smartcard, USB or hardware security module [HSM]}
- H04L 9/0897: {involving additional devices, e.g. trusted platform module [TPM], smartcard or USB}
- H04L 63/0485: {Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up}
- G06F 2221/2113: Multi-level security, e.g. mandatory access control
- H04L 2209/12: Details relating to cryptographic hardware or logic circuitry
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G09C: CIPHERING OR DECIPHERING APPARATUS FOR CRYPTOGRAPHIC OR OTHER PURPOSES INVOLVING THE NEED FOR SECRECY

## Abstract

Described are various embodiments of an integrated multi-level or cross-domain network security appliance and system. In one embodiment, a cross-domain network traffic management appliance comprises: an external hardware network domain port to interface with an external network corresponding with a first network security domain, and exchange domain-specific data therethrough; a cross-domain hardware port to interface with a second network security domain and exchange cross-domain data therethrough; one or more hardware-integrated processing engines; and a hardware-integrated interconnection matrix configured to define, in hardware, designated data communication paths to interconnect said processing engines; wherein said one or more hardware-integrated processing engines are operable to: process and validate ingress first domain data received from said first network security domain via said external hardware port for cross-domain egress via said cross-domain hardware port; and process cross-domain ingress data received via said cross-domain hardware port for dispatch to said first network security domain via said external hardware network port; wherein cross-domain egress and ingress data is internally encrypted and decrypted, respectively, in accordance with a designated destination-domain encryption process.

## Claims

### Claim 1

A cross-domain network traffic management appliance comprising:
an external hardware network domain port to interface with an external network corresponding with a first network security domain, and exchange domain-specific data therethrough;
a cross-domain hardware port to interface with a second network security domain and exchange cross-domain data therethrough;
one or more hardware-integrated processing engines; and
a hardware-integrated interconnection matrix configured to define, in hardware, designated data communication paths to interconnect said processing engines;
wherein said one or more hardware-integrated processing engines are operable to:
process and validate ingress first domain data received from said first network security domain via said external hardware network domain port for cross-domain egress via said cross-domain hardware port; and
process cross-domain ingress data received via said cross-domain hardware port for dispatch to said first network security domain via said external hardware network domain port;
wherein cross-domain egress and ingress data is internally encrypted and decrypted, respectively, in accordance with a designated destination-domain encryption process; and
wherein said hardware-integrated processing engines comprise a domain-specific protocol adapter operable to interface with said external hardware network domain port, a cross-domain data validation engine operable to validate said ingress domain-specific data once processed by said protocol adapter, and a cross-domain access portal operable to interface with said cross-domain hardware port.

### Claim 2 (depends on 1)

The appliance of claim 1, wherein said cross-domain egress and ingress data is respectively encrypted or decrypted by a hardware-integrated encryption engine.

### Claim 3 (depends on 2)

The appliance of claim 2, wherein said hardware-integrated encryption engine is operatively associated with a plurality of hardware security module (HSM) ports distinctly addressable via said respective data communication paths of said interconnection matrix to respectively encrypt said cross-domain egress data and decrypt said cross-domain ingress data.

### Claim 4 (depends on 1)

The appliance of claim 1, wherein said respective data communication paths of said interconnection matrix physically segregates ingress and egress cross-domain data paths.

### Claim 5 (depends on 1)

The appliance of claim 1, further comprises a distinctly addressable hardware-integrated administrative engine operable to securely manage operation of said two or more hardware-integrated processing engines.

### Claim 6 (depends on 1)

The appliance of claim 1, further comprising an external hardware security network port distinctly addressable by one of said hardware-integrated processing engines to invoke an external validation process to be applied to said ingress domain-specific data prior to encryption for cross-domain egress.

### Claim 7 (depends on 1)

The appliance of claim 1, wherein said interconnection matrix defines a one-way hardware data path between said protocol adapter and said cross-domain access portal via said cross-domain data validation engine to process said ingress domain-specific data, and a distinct hardware data path between said cross-domain access portal and said protocol adapter to process said cross-domain ingress data.

### Claim 8 (depends on 1)

The appliance of claim 1, wherein said cross-domain hardware port comprises an external cross-domain port to be operatively interfaced with a corresponding external cross-domain hardware port of a corresponding cross-domain network traffic management appliance operatively associated with said second network security domain.

### Claim 9 (depends on 1)

The appliance of claim 1, wherein said cross-domain hardware port comprises an internal cross-domain port operatively interfacing with a corresponding internal cross-domain hardware port operatively associated with said second network security domain.

### Claim 10 (depends on 1)

The appliance of claim 1, wherein said cross-domain hardware port is configured to operatively interface with a secure interconnection network operatively interconnecting respective cross-domain hardware ports associated with respective network security domains to securely transfer encrypted cross-domain data therebetween.

### Claim 11 (depends on 1)

The appliance of claim 1, wherein said cross-domain hardware port is operable to interface with multiple distinct second network security domains and exchange distinct destination domain-specific data therewith.

### Claim 12

A cross-domain network traffic management system comprising:
a plurality of hardware data path layers, each one of which corresponding with a designated network security domain and comprising:
an external hardware network domain port to interface with an external network corresponding with a given network security domain, and exchange domain-specific data therethrough;
a cross-domain hardware port to interface with distinct hardware data path layers corresponding with distinct network security domains and exchange cross-domain data therethrough;
one or more hardware-integrated processing engines; and
a hardware-integrated interconnection matrix configured to define, in hardware, designated data communication paths to interconnect said processing engines;
wherein said hardware-integrated processing engines are operable to:
process and validate ingress given domain data received from said given network security domain via said external hardware network domain port for cross-domain egress via said cross-domain hardware port; and
process cross-domain ingress data received via said cross-domain hardware port for dispatch to said given network security domain via said external hardware network domain port;
wherein cross-domain egress and ingress data is internally encrypted and decrypted, respectively, in accordance with a respectively designated destination-domain encryption process; and
wherein said hardware-integrated processing engines comprise, for at least one of said hardware data path layers, a domain-specific protocol adapter operable to interface with said external hardware network domain port thereof, a cross-domain data validation engine operable to validate said ingress given domain data once processed by said protocol adapter, and a cross-domain access portal operable to interface with said cross-domain hardware port thereof.

### Claim 13 (depends on 12)

The system of claim 12, wherein each said cross-domain hardware port operatively interfaces with a secure interconnection network to securely transfer encrypted cross-domain data thereon.

### Claim 14 (depends on 12)

The system of claim 12, wherein said cross-domain egress and ingress data is respectively encrypted or decrypted by a hardware-integrated encryption engine.

### Claim 15 (depends on 12)

The system of claim 12, wherein said hardware-integrated encryption engine is operatively associated with a plurality of hardware security module (HSM) ports distinctly addressable via said designated data communication paths of said interconnection matrix to respectively encrypt said cross-domain egress data and decrypt said cross-domain ingress data.

### Claim 16 (depends on 12)

The system of claim 12, wherein said designated data communication paths of said interconnection matrix physically segregates ingress and egress cross-domain data paths.

### Claim 17 (depends on 12)

The system of claim 12, further comprising an external hardware security network port distinctly addressable by one of said hardware-integrated processing engines to invoke an external validation process to be applied to said ingress domain-specific data prior to encryption for cross-domain egress.

### Claim 18 (depends on 12)

The system of claim 12, wherein said interconnection matrix defines a one-way hardware data path between said protocol adapter and said cross-domain access portal via said cross-domain data validation engine to process said ingress first domain data, and a distinct hardware data path between said cross-domain access portal and said protocol adapter to process said cross-domain ingress data.