System and method for achieving network separation
AssigneeSecure Computing Corporation
InventorsMark P. Gooderum, Trinh Q. Vu, Glenn Andreas
Life of this patent
Estimating the term…
Abstract
A system and method of achieving network separation within a computing system having a plurality of network interfaces. A plurality of burbs or regions is defined, wherein the plurality of burbs includes a first and a second burb and wherein each burb includes a protocol stack. Each of the plurality of network interfaces is assigned to one of the plurality of burbs and more than one network interface can be assigned to a particular burb. Processes are bound to specific burbs when they try to access that burb's protocol stack and communication between processes assigned to different burbs is restricted so that a communication between a process bound to one burb must pass through a proxy before being sent to a different burb.
Claims9
A method of achieving network separation within a computing system having a plurality of network interfaces, including a first and a second network interface, the method comprising the steps of:
- defining a plurality of burbs, wherein the plurality of burbs includes a first and a second burb and wherein the first burb includes a fit protocol stack and the second burb includes a second protocol stack separate from the first protocol stack;
- assigning each of the plurality of network interfaces to one of the plurality of burbs, wherein more than one network interface can be assigned to a particular burb, wherein the step of assigning includes the steps of assigning the first network interface to the first burb and the second network interface to the second burb;
- binding processes to burbs;
- and
- restricting communication between processes bound to different burbs, wherein the of restricting communication between processes includes the steps of:
- examining a message received by the first network interface;
- and
- if the message is to be routed through the second network interface, routing the message up through the first protocol stack to a process bound to the first burb, transferring the message to a process bound to the second burb and routine the message down through the second protocol stack to the second network interface.
A secure server, comprising:
- an operating system kernel;
- a plurality of network interfaces which communicate with the operating system kernel;
- and
- a plurality of burbs, including a first and a second burb;
- wherein each network interface is assigned to one burb from the plurality of burbs, wherein each burb includes a separate protocol stack for handling communication across the network interface, wherein each protocol stack is associated with only one burb, wherein a first protocol stack is associated with the first burb, and wherein communication from a process bound to the first burb must pass through the first protocol stack to a proxy before being sent to the second burb.
Dependencies are inferred from the claim text.