US 8,478,997 B2 · Multi-level security software architecture

Abstract

A multi-level security software architecture includes various components configured to provide full data separation across multiple processors while limiting the number and size of high assurance components. The architecture includes a domain separator for ensuring that messages exchanged between domains that are distributed on different microprocessors are securely routed between domain members. The domain separator verifies a message label including a domain identifier provided by a domain gateway and cryptographically binds the message label to each message via cryptographic keys. This prevents misrouting messages caused by accidental or malicious corruption of message labels. Additionally, the domain separator can encrypt messages as necessary to enforce data separation on shared network buses. The domain separator is also responsible for managing the cryptographic keys used to label or encrypt messages.

Claims17

Dependent claims

A data processing apparatus adapted for transmitting messages classified at different security classification levels while maintaining data separation of the messages, the data processing apparatus comprising:

a first processor having a first memory, the first processor being associated with a first domain operating at a particular security classification level, the first domain being identified via a domain identifier;
a second processor having a second memory;
and
a communication bus coupled in-between the first processor and the second processor,
wherein, the first memory includes program instructions, the first processor being operable to execute the program instructions, the program instructions including:
receiving a message from a first application in the first processor intended for a second application in the second processor;
tagging the domain identifier to the message;
receiving the message with the tagged domain identifier;
identifying a first domain gateway from which the message is received;
verifying accuracy of the tagged domain identifier based the identification of the first domain gateway from which the message is received;
selecting an encryption key based on the domain identifier;
encrypting at least a portion of the message based on the selected encryption key;
and
routing the encrypted message to the second processor via the communication bus, wherein the second application in the second processor generates an output in response to the message.

11 more elements

Dependencies are inferred from the claim text.

Multi-level security software architecture

Life of this patent

Multi-level security software architecture

Life of this patent

Abstract

Claims17