Configurable cross-domain information assurance

Patent metadata

Field	Value
Publication number	US-9760731-B2
Application number	US-201514876532-A
Country	US
Kind code	B2
Filing date	Oct 6, 2015
Priority date	Oct 6, 2015
Publication date	Sep 12, 2017
Grant date	Sep 12, 2017

Abstract

Methods for configuring and utilizing a configurable data guard (CDG) implemented on a hardware-based programmable logic device are disclosed. The CDG may include integrated circuit portions comprising a plurality of arrays of generic comparison operations and a plurality of arrays of generic action operations. The CDG may receive a data guard configuration. The CDG may perform an authentication and integrity check procedure on the received data guard configuration. The CDG may configure a plurality of guard primitives based on the data guard configuration. Each guard primitive may be configured from at least one generic comparison operation and at least one generic action operation. The guard primitives may be used to enforce the complex data guard rules that correspond to the data guard configuration.

First claim

What is claimed:

1. A configurable data guard (CDG) implemented on a hardware-based programmable logic device, the CDG comprising:
a first network interface configured to receive data;
a first integrated circuit portion of the hardware-based programmable logic device, the first integrated circuit portion comprising a plurality of arrays of preconfigured comparison operations;
a second integrated circuit portion of the hardware-based programmable logic device, the second integrated circuit portion comprising a plurality of arrays of preconfigured action operations;
a microprocessor configured to:
receive a data guard configuration,
perform an authentication and integrity check procedure on the received data guard configuration, and
configure a plurality of guard primitives based on the data guard configuration, wherein each guard primitive is configured from at least one preconfigured comparison operation from the first integrated circuit portion and at least one preconfigured action operation from the second integrated circuit portion; and

a second network interface configured to output the data after the data has been processed by the plurality of guard primitives.

2. The CDG as in claim 1 , wherein the microprocessor is further configured to normalize the data received via the first network adapter prior to the data being processed by the plurality of guard primitives.

3. The CDG as in claim 2 , wherein normalizing the data comprises removing transport layer control plane data and removing application layer control plane data.

4. The CDG as in claim 3 , wherein the microprocessor is further configured to re-frame the data after the data has been processed by the plurality of guard primitives.

5. The CDG as in claim 4 , wherein re-framing the data comprises re-attaching the application layer control plane data and re-attaching the transport layer control plane data.

6. The CDG as in claim 1 , wherein the hardware-based programmable logic device corresponds to one of an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA).

7. The CDG as in claim 1 , wherein the microprocessor is further configured to perform a check of the plurality of preconfigured comparison operations and of the plurality of preconfigured action operations at start-up.

8. The CDG as in claim 1 , wherein the microprocessor is further configured to perform a known answer test for each of the plurality of guard primitives when configuring the plurality of guard primitives.

9. A method for configuring a configurable data guard (CDG), the method comprising:
the CDG receiving a data guard configuration from a computing device, wherein the CDG is implemented on hardware-based programmable logic device;
the CDG performing an authentication and integrity check procedure on the received data guard configuration; and
the CDG configuring a plurality of guard primitives based on the data guard configuration, wherein each guard primitive is configured from at least one preconfigured comparison operation corresponding to a first integrated circuit portion comprised in the hardware-based programmable logic device of the CDG and at least one preconfigured action operation corresponding to a second integrated circuit portion comprised in the hardware-based programmable logic device of the CDG.

10. The method as in claim 9 , wherein the data guard configuration further comprises an input/output (I/O) configuration, and the I/O configuration indicates an application layer protocol utilized by communications to be processed by the CDG and a transport layer protocol utilized by communications to be processed by the CDG.

11. The method as in claim 10 , further comprising the CDG configuring a communication protocol normalization adapter to remove control plane data associated with the communications processed by the CDG prior to processing the communications via the plurality of guard primitives.

12. The method as in claim 10 , further comprising the CDG configuring a communication protocol framing adapter to re-attach the control plane data associated with the communications processed by the CDG after to processing the communications via the plurality of guard primitives.

13. The method as in claim 9 , further comprising:
the CDG receiving a communication; and
the CDG processing the communication via the plurality of guard primitives after applying the data guard configuration, wherein user data plane data of the communication is processed via the plurality of guard primitives.

14. The method as in claim 13 , wherein control plane data associated with the communications is removed prior to processing the communications via the plurality of guard primitives.

15. The method as in claim 9 , wherein the hardware-based programmable logic device that implements the CDG comprises an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA).

16. The method as in claim 9 , further comprising:
the CDG performing a self-check of at least one preconfigured comparison operation and the at least one preconfigured action operation.

17. The method as in claim 9 , further comprising:
The CDG performing at least one known answer test for each of the plurality of guard primitives after applying the data guard configuration.

18. A configurable data guard (CDG) comprising:
a first integrated circuit portion of the hardware-based programmable logic device, the first integrated circuit portion comprising a plurality of arrays of preconfigured comparison operations;
a second integrated circuit portion of the hardware-based programmable logic device, the second integrated circuit portion comprising a plurality of arrays of preconfigured action operations; and
a microprocessor configured to:
receive a data guard configuration,
perform an authentication and integrity check procedure on the received data guard configuration, and
configure a plurality of guard primitives based on the data guard configuration, wherein each guard primitive is configured from at least one preconfigured comparison operation from the first integrated circuit portion and at least one preconfigured action operation from the second integrated circuit portion.

19. The CDG as in claim 18 , further comprising:
a first network interface configured to receive a first communication,
a communication protocol normalization adapter configured to remove control plane data from the first communication prior to the first communication being processed via the plurality of guard primitives;
a communication protocol framing adapter configured to re-apply the control plane data to the first communication after the first communication has been processed via the plurality of guard primitives;
a second network interface configured to output the first communication.

20. The CDG as in claim 18 , wherein the microprocessor is further configured to:
perform a self-check to test ensure that each preconfigured comparison operation of the plurality of arrays of preconfigured comparison operations is operating correctly prior to applying the data guard configuration; and
perform a self-check to test ensure that each preconfigured action operation of the plurality of arrays of preconfigured action operations is operating correctly prior to applying the data guard configuration.

Assignees

• L-3 Communications Corp
• L3 Tech Inc

Inventors

• Winslow Richard Norman
• Costantini Frank Anthony
• Devlin Steven Daniel
• Smith Robert M

Classifications

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• H04L63/0263 Primary

  Rule management · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L41/28

  Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration · CPC title

• H04L63/12

  Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32) · CPC title