Multiple level security adapter

• US 20070263658A1
• Filed: 05/15/2006
• Published: 11/15/2007
• Est. Priority Date: 05/15/2006
• Status: Active Grant

• Current Assignee: The Boeing Co.
• Original Assignee: The Boeing Co.
• Inventors: Hartman, Brett, Ung, Kevin, Donofrio, Thomas, Arnold, Steven, Murphy, Michael, Balza, Richard, Kwok, Samuel
• Granted Patent: US 7,873,071 B2
• Time in Patent Office: Days
• US Class Current: 370/466
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 69/08 Protocols for interworking; Protocol conversion

Abstract

In exemplary embodiments, data with a format compatible with a first protocol standard is received on behalf of a first application. When the format of the data is not compatible with a second protocol standard, the format of the data is automatically transformed to a format that is compatible with the second protocol standard. The data is transmitted to a second application service using the second protocol standard. The data may be received from the second application. When the format of the data is not compatible with a third protocol standard, the format of the data is automatically transformed to a format that is compatible with the third protocol standard. The data is transmitted on behalf of a third application using the third protocol standard. The first and third applications may be in first and second protected enclaves. The second application may include a security gateway service.

Claims

1. A computer executable method of exchanging data, the method comprising:

receiving data on behalf of a first application using a first protocol standard, the data having a format compatible with the first protocol standard;

determining whether the format of the data is compatible with a second protocol standard;

when the format of the data is not compatible with the second protocol standard, automatically transforming the format of the data to a format that is compatible with the second protocol standard; and

transmitting the data to a second application service using the second protocol standard.

2. The method of claim 1, further comprising:

receiving the data from the second application using the second protocol standard, the data having a format compatible with the second protocol standard;

determining whether the format of the data is compatible with a third protocol standard;

when the format of the data is not compatible with the third protocol standard, automatically transforming the format of the data to a format that is compatible with the third protocol standard; and

transmitting the data on behalf of a third application using the third protocol standard.

3. The method of claim 2, wherein the first application is provided within a first protected enclave.

4. The method of claim 3, wherein the second application includes a security gateway service.

5. The method of claim 4, wherein the third application is provided within a second protected enclave.

6. The method of claim 5, wherein:

the first protocol standard defines a first security level; and

the third protocol standard defines a second security level.

7. The method of claim 1, further comprising:

determining whether an application layer protocol is intermixed with the data received on behalf of the first application; and

when an application layer protocol is intermixed with the data received on behalf of the first application, automatically removing the intermixed application layer protocol from the data.

8. The method of claim 2, wherein the first and second and third protocol standards each include a respective transport layer protocol and a respective application layer protocol.

9. The method of claim 1, wherein determining includes:

identifying a type of the first application; and

comparing the type of the first application against a list of predetermined application types.

10. The method of claim 9, wherein determining further includes:

identifying a type of data received on behalf of the first application; and

comparing the type of the data received on behalf of the first application against a list of predetermined data types.

11. The method of claim 1, wherein transforming is performed by an XSLT transformation engine.

12. A computer readable program product comprising:

first computer readable program code means for receiving data on behalf of a first application using a first protocol standard, the data having a format compatible with the first protocol standard;

second computer readable program code means for determining whether the format of the data is compatible with a second protocol standard;

third computer readable program code means for, when the format of the data is not compatible with the second protocol standard, automatically transforming the format of the data to a format that is compatible with the second protocol standard; and

fourth computer readable program code means for transmitting the data to a second application using the second protocol standard.

13. The computer readable program product of claim 12, further comprising:

fifth computer readable program code means for receiving the data from the second application using the second protocol standard, the data having a format compatible with the second protocol standard

sixth computer readable program code means for determining whether the format of the data is compatible with a third protocol standard;

seventh computer readable program code means for, when the format of the data is not compatible with the third protocol standard, automatically transforming the format of the data to a format that is compatible with the third protocol standard; and

eighth computer readable program code means for transmitting the data on behalf of a third application using the third protocol standard.

14. The computer readable program product of claim 13, wherein the first computer readable program code means includes an application proxy.

15. The computer readable program product of claim 14, wherein the second computer readable program code means includes a security gateway proxy.

16. The computer readable program product of claim 12, further comprising:

ninth computer readable program code means for determining whether an application layer protocol is intermixed with the data received on behalf of the first application; and

tenth computer readable program code means for, when an application layer protocol is intermixed with the data received on behalf of the first application, automatically removing the intermixed application layer protocol from the data.

17. The computer readable program product of claim 12, wherein the third computer readable program code means includes an XSLT transformation engine.

18. The computer readable program product of claim 12, wherein the second computer readable program code means includes:

eleventh computer readable program code means for identifying a type of the first application; and

twelfth computer readable program code means for comparing the type of the first application against a list of predetermined application types.

19. The computer readable program product of claim 18, wherein the second computer readable program code means further includes:

thirteenth computer readable program code means for identifying a type of data received on behalf of the first application; and

fourteenth computer readable program code means for comparing the type of the data received on behalf of the first application against a list of predetermined data types.

20. A system for exchanging data, the system comprising:

a first computer processing component configured to receive data on behalf of a first application using a first protocol standard, the data having a format compatible with the first protocol standard;

a second computer processing component configured to determine whether the format of the data is compatible with a second protocol standard;

a third computer processing component configured to, when the format of the data is not compatible with the second protocol standard, automatically transform the format of the data to a format that is compatible with the second protocol standard; and

a fourth computer processing component configured to transmit the data to a second application service using the second protocol standard.

21. The system of claim 20, further comprising:

a fifth computer processing component configured to receive the data from the second application using the second protocol standard, the data having a format compatible with the second protocol standard;

a sixth computer processing component configured to determine whether the format of the data is compatible with a third protocol standard;

a seventh computer processing component configured to, when the format of the data is not compatible with the third protocol standard, automatically transform the format of the data to a format that is compatible with the third protocol standard; and

an eighth computer processing component configured to transmit the data on behalf of a third application using the third protocol standard.

22. The system of claim 20, wherein the first, second, third, and fourth computer processing components are provided in one computer processor.

23. The system of claim 20, wherein the first, second, third, and fourth computer processing components are distributed among more than one computer processor.

24. The system of claim 21, wherein the first, second, third, and fourth computer processing components are provided within a first protected enclave.

25. The system of claim 24, wherein the second application includes a security gateway service implemented on a secure network server.

26. The system of claim 25, wherein the fifth, sixth, seventh, and eighth computer processing components are provided within a first protected enclave.

27. The system of claim 20, further comprising:

a ninth computer processing component configured to determine whether an application layer protocol is intermixed with the data received on behalf of the first application; and

a tenth computer processing component configured to, when an application layer protocol is intermixed with the data received on behalf of the first application, automatically remove the intermixed application layer protocol from the data.

28. The system of claim 20, wherein the second computer processing component includes:

an eleventh computer processing component configured to identify a type of the first application; and

a twelfth computer processing component configured to compare the type of the first application against a list of predetermined application types.

29. The system of claim 28, wherein the second computer processing component further includes:

a thirteenth computer processing component configured to identify a type of data received on behalf of the first application; and

a fourteenth computer processing component configured to compare the type of the data received on behalf of the first application against a list of predetermined data types.