Apparatus and method for providing multi-level security for communication among computers and terminals on a network

A multi-level network security apparatus for a computer network having at least one user coupled thereto, the at least one user selected from a group consisting of a host computer and at least a second network, comprising:

• a secure network interface unit (SINU) coupled between said at least one user and the computer network which operates at a user layer communications protocol, said SINU comprising:
• a user interface for providing an interface between the user and SNIU, said user interface being operative for translating data received from the user into a format used by said SNIU,
• a session manager for identifying a user requesting access to the network at the session level and verifying if the identified user is authorized for access to the network, managing functions of communications sessions permitted by said network security apparatus and maintaining a session audit,
• a dialogue manager for controlling a data path established in the SNIU,
• and an association manager which operates to establish and control a user session at a session layer of interconnection between the user and the network through said SNIU if said identified user is verified for access,
• whereby the SNIU is implemented to create a global security perimeter for end-to-end communications and wherein the network may be individually secure or non-secure without compromising security of communications within said global security perimeter;
• and
• a security management architecture, including a security manager (SM) connected to said SNIU for causing said SNIU to be operated and configured for protecting the security communications transmitted through said SNIU between the at least one user and the network, said SM capable of implementing a security policy selected from the group consisting of discretionary access control, mandatory access control, object reuse, labeling, denial of service detection, data type integrity, cascading control and covert channel use detection, said SM further providing inter-network administration.