SECURE HIGH PERFORMANCE MULTI-LEVEL SECURITY DATABASE SYSTEMS AND METHODS

• US 20100011007A1
• Filed: 07/02/2009
• Published: 01/14/2010
• Est. Priority Date: 07/09/2008
• Status: Active Grant

• Current Assignee: The Boeing Co.
• Original Assignee: The Boeing Co.
• Inventors: Wagner, David H., Rodriguez, Ismael, Peters, Marc A., Kuehn, Dennis L., Stone, Kevin A., Bettger, David D.
• Granted Patent: US 8,682,845 B2
• Time in Patent Office: Days
• US Class Current: N/A
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 67/1097 for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS]

Abstract

In accordance with one or more embodiments of the present disclosure, systems and methods described herein provide for transferring data over one or more networks. A storage area network is adapted to communicate with the one or more networks. A first component is adapted to route data to and from the storage area network. A second component is adapted to route data to and from the storage area network. A gateway component is adapted to control the routing of data between the first and second components and the storage area network. The storage area network is adapted to separate metadata from the data and store the metadata in a secure server positioned behind the gateway component.

Claims

1. A system for sharing data over one or more networks, the system comprising:

a storage area network adapted to communicate with the one or more networks;

a first component adapted to route data to and from the storage area network via a first storage network connection;

a second component adapted to route data to and from the storage area network via a second storage network connection;

a gateway component adapted to control the routing of data between the first and second components and the storage area network; and

a metadata controller adapted to separate metadata from the data, store the metadata in a first database, and store the data without metadata in a second database.

2. The system of claim 1, wherein the metadata controller is adapted to encrypt and store the metadata in the first database separate from the second database, and wherein the first database comprises a metadata database.

3. The system of claim 1, wherein the metadata controller is adapted to encrypt and store the data without the metadata in the second database separate from the first database.

4. The system of claim 1, wherein the first and second databases comprise RAID storage devices.

5. The system of claim 1, wherein the gateway component comprises a security gateway component adapted to control one or more authorizations and decryption keys for accessing at least the data in the storage area network.

6. The system of claim 1, wherein the gateway component comprises a multi-level secure gateway component adapted to control access to at least the data in the storage area network from different security domains.

7. The system of claim 1, wherein at least one of the first and second storage network connections to the storage area network comprises a Fibre Channel network connection.

8. The system of claim 1, wherein the data comprises multi-level security data, and wherein the storage area network is adapted to store the multi-level security data in the second database separate from the first database.

9. The system of claim 1, wherein the metadata controller comprises a metadata server adapted to control the routing of data between the first and second components, the first and second databases, and the storage area network.

10. The system of claim 1, wherein the metadata controller comprises a plurality of metadata host-bus adapters adapted to separately communicate with the first and second databases.

11. The system of claim 1, wherein the first component comprises a network server adapted to communicate with the storage area network to route data to and from the storage area network via the first storage network connection.

12. The system of claim 1, wherein the second component comprises a second server adapted communicate with the storage are network to route data to and from the storage area network via the second storage network connection.

13. The system of claim 1, further comprising a channel switching mechanism adapted to route data between the metadata controller and one or more of the first component, the second component, the first database, and the second database.

14. The system of claim 13, wherein the channel switching mechanism comprises one or more shared storage network ports that are adapted to be controlled by the metadata controller, and wherein the use of the shared storage network ports are monitored by the metadata controller.

15. The system of claim 14, wherein the shared storage network ports are enabled by the metadata controller for use, and wherein the shared storage network ports are disabled by the metadata controller when not in use.

16. A method for sharing data over one or more networks, the method comprising:

establishing a storage area network to facilitate communication with the one or more networks;

routing data to and from a first component over the storage area network via a first storage network connection;

routing data to and from a second component over the storage area network via a second storage network connection;

controlling the routing of data between the first and second components and the storage area network; and

separating metadata from the data;

storing the metadata in a first database; and

storing the data without metadata in a second database.

17. The method of claim 16, further comprising encrypting and storing the metadata in the first database separate from the second database, and wherein the first database comprises a metadata database.

18. The method of claim 16, further comprising encrypting and storing the data without the metadata in the second database separate from the first database.

19. The method of claim 16, further comprising controlling one or more authorizations and decryption keys for accessing at least the data in the storage area network.

20. The method of claim 16, further comprising controlling access to at least the data in the storage area network from different security domains.

21. The method of claim 16, further comprising controlling a channel switching mechanism to route data between the first component, the second component, the first database, and the second database.

22. The method of claim 21, further comprising:

controlling one or more shared storage network ports of the channel switching mechanism; and

monitoring the use of the one or more shared storage network ports of the channel switching mechanism.

23. The method of claim 22, further comprising:

enabling the shared storage network ports for use; and

disabling the shared storage network ports when not in use.

24. Software encoded in one or more computer readable media and when executed operable to share data over one or more networks, the software further operable to:

establish a storage area network to facilitate communication with the one or more networks;

route data to and from a first component over the storage area network via a first storage network connection;

route data to and from a second component over the storage area network via a second storage network connection;

control the routing of data between the first and second components and the storage area network; and

separate metadata from the data;

store the metadata in a first database; and

store the data without metadata in a second database.