Semi-interactive one-way transfer of data to an isolated network

Patent metadata

Field	Value
Publication number	US-12261831-B2
Application number	US-202318308605-A
Country	US
Kind code	B2
Filing date	Apr 27, 2023
Priority date	Mar 8, 2021
Publication date	Mar 25, 2025
Grant date	Mar 25, 2025

Abstract

The present embodiments relate to providing near real-time communications from a public network to a private network. A first computing device in a public network can obtain data packets to be provided to the private network from an application executing on the first computing device. A trust module executed by the first computing device can authenticate the user, application, and the data packets to be provided to the private network and add metadata relating to the sending user, recipient user, etc. The data packets can be forwarded to the private network via a cross-domain system (CDS). The metadata and the digital signature on the data packets can be verified by a trust module executing on a second computing device in the private network. The second computing device can receive the data packets and store the data packets for subsequent actions to be performed in the private network.

First claim

What is claimed is:

1. A method for secure one-way transmission of data from a public network to a private network, the method comprising:
obtaining, at a first computing device in the public network, a stream of data packets from a first application;
forwarding the stream of data packets and user information associated with a sending user to a first instance of a trust module executing on the first computing device;
adding metadata to the stream of data packets, the metadata including (a) a digital signature derived from a private key specific to the first instance of the trust module and (b) information relating to the user information; and
forwarding the stream of data packets to a second computing device in the private network via a cross-domain system (CDS), wherein the stream of data packets are forwarded along a priority communication channel in the CDS; and
responsive to forwarding the stream of data packets to the CDS, diverting existing traffic in the CDS to a second communication channel.

2. The method of claim 1 , wherein the existing traffic in the CDS is diverted to the second communication channel to increase throughput of transmission of the stream of data packets on the priority communication channel.

3. The method of claim 1 , wherein the first instance of the trust module is configured to authorize the first application by determining that the stream of data packets is signed with a first trusted application key unique to the first application, and wherein a second instance of the trust module in the private network executing on the second computing device is configured to authorize a recipient application by determining that the stream of data packets are signed with a second trusted application key unique to the recipient application.

4. The method of claim 1 , wherein the first application authenticates the sending user by verifying login credentials provided to the first application that correspond with the sending user.

5. The method of claim 1 , further comprising authenticating, by the first instance of the trust module, the sending user and the first application by verifying a token obtained by the first instance of the trust module responsive to the sending user providing the user information to the first application, the user information including login credentials specific to the sending user for logging into the first application.

6. The method of claim 1 , further comprising converting the stream of data packets into a first file type, wherein the stream of data packets fall below a threshold data size and are within a set of encoding criteria.

7. The method of claim 1 , wherein the CDS is configured to:
store the stream of data packets in a dynamic buffer,
validate the digital signature including the private key specific to the first instance of the trust module,
log the stream of data packets in an auditing computer for subsequent auditing of content being transmitted to the private network; and
provide the stream of data packets to a receive buffer of the second computing device responsive to the second computing device verifying an identity of the sending user and verifying the digital signature.

8. The method of claim 1 , wherein the stream of data packets are provided to a one-way clipboard allowing content to be written or copied to the one-way clipboard.

9. The method of claim 1 , wherein the CDS is configured to assign a ticket to the stream of data packets via a ticketing module, the ticket identifying a session between the sending user and a recipient user.

10. The method of claim 1 , wherein the stream of data packets are sent to the second computing device via the CDS using a one-way chat application.

11. The method of claim 1 , further
prior to forwarding the stream of data packets and the user information associated with the sending user to the first instance of the trust module executing on the first computing device:
responsive to determining that the stream of data packets satisfies at least one of: (a) a threshold data size or (b) a set of encoding criteria, converting the stream of data packets into a first file type.

12. The method of claim 1 , further comprising:
validating the digital signature derived from the private key specific to the first instance of the trust module; and
responsive to the validating, forwarding the stream of data packets to the second computing device in the private network via the CDS, wherein the CDS provides one-way communication of data from the public network to the private network.

13. The method of claim 12 , further comprising storing the stream of data packets in a dynamic buffer.

14. The method of claim 12 , further comprising logging the stream of data packets in an auditing computer for subsequent auditing of content being transmitted to the private network.

15. The method of claim 12 , wherein the stream of data packets are provided to a receive buffer of the second computing device responsive to the second computing device verifying an identity of the sending user and verifying the digital signature.

16. A first computing device in a public network, comprising:
a first processor; and
a first computer-readable medium including instructions that, when executed by the first processor, cause the first processor to:
obtain a stream of data packets from a first application executing on the first computing device;
forward the stream of data packets and user information associated with a sending user to a first instance of a trust module executing on the first computing device;
add metadata to the stream of data packets, the metadata including (a) a digital signature derived from a private key specific to the first instance of the trust module and (b) information relating to the user information; and
forward the stream of data packets to a second computing device in a private network via a cross-domain system (CDS), wherein the stream of data packets are forwarded along a priority communication channel in the CDS; and
responsive to forwarding the stream of data packets to the CDS, diverting existing traffic in the CDS to a second communication channel.

17. The first computing device of claim 16 , wherein the existing traffic is diverted to the second communication channel to increase throughput of transmission of the stream of data packets on the priority communication channel.

18. The first computing device of claim 16 , wherein the second computing device in the private network is configured to:
process, by a second instance of the trust module executing on the second computing device, the metadata of the stream of data packets to verify an identity of the sending user and verify the digital signature relating to the first instance of the trust module; and
receive the stream of data packets at a receiving buffer responsive to verifying the identity of the sending user and verifying the digital signature.

19. The first computing device of claim 16 , wherein the first computer-readable medium further causes the first processor to:
split the stream of data packets into a number of portions responsive to the stream of data packets exceeding a threshold data volume, wherein the stream of data packets are forwarded to the CDS in the number of portions.

20. The first computing device of claim 16 , wherein the CDS is configured to:
establish a session between the first computing device and the second computing device for secure one-way transmission of data; and
log the stream of data packets and the metadata i

Assignees

• Oracle Int Corp

Inventors

• Kuehnel Thomas Werner
• Garfinkel Joseph Neil

Classifications

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/12

  Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32) · CPC title

• H04L49/9005

  using dynamic buffer space allocation · CPC title

• H04L9/3226

  using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083) · CPC title

• H04L9/3247

  involving digital signatures · CPC title