US 7,734,916 B2Granted

Multi-level security systems

AssigneeInternational Business Machines Corporation

InventorPatrick Michael LiVecchi

Life of this patent

Estimating the term…

Loading patent…

Abstract

Techniques are disclosed for multi-level security (“MLS”) in computing systems. Communication between MLS systems in the prior art requires explicitly tagging each packet with its security classification. The packet tags comprise variable-length bit patterns inserted into packet headers. This results in a number of drawbacks, including increased path length and code complexity, as well as reduced interoperability. An MLS system according to the present invention simulates a cluster or collection of single-level security systems, and thereby avoids packet tagging. For each security classification used by an MLS system, a distinct source address is defined. This source address is used for outbound packets having that security classification, such that the packet's source address implicitly identifies the packet's security classification.

Claims7

Dependent claims

A computer program product for providing multi-level security systems, the computer program product embodied on one or more computer-usable storage media and comprising computer-usable program code for:

defining, for each of a plurality of different security classifications to be used by a first multi-level security (“MLS”) system when sending outbound packets to a second MLS system, a unique source address;
and
processing each of the outbound packets sent from the first MLS system to the second MLS system, further comprising:
determining, by the first MLS system, a particular one of the security classifications that applies to the outbound packet;
locating, by the first MLS system, the unique source address defined for the determined particular one;
and
replacing, by the first MLS system, a source address in a packet header of the outbound packet with the located unique source address, thereby conveying the security classification that applies to the outbound packet through the source address in the packet header;
and
sending, by the first MLS system responsive to the replacing, the outbound packet to the second MLS system.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 12/053,523Filed 21 Mar 2008 · continuation
Priority: 1 Aug 2002
Published: US 2008/0168557 A110 Jul 2008
Granted: 8 Jun 2010
Term ends: Not estimatedThe source records don’t support an estimate.

Classification2 codes

H04L 63/105
For controlling access to devices or network resources: multiple levels of security
H04L
Digital communication

Family

Application10/210,267Parent of this continuation · filed 1 Aug 2002
Application11/769,348Parent of this continuation · filed 27 Jun 2007
US 2008/0168557 A1Pre-grant publication · published 10 Jul 2008
US 7,356,695 B2Parent of this continuation
US 2007/0250921 A1Published application
US 2007/0277034 A1Published application
US 7,779,255 B2Related patent
US 7,734,916 B2This patent

From the US filing history. Foreign family members aren’t listed.