Multi-Level Secure Information Retrieval System

• US 20100146618A1
• Filed: 12/05/2008
• Published: 06/10/2010
• Est. Priority Date: 12/05/2008
• Status: Active Grant

• Current Assignee: Forcepoint Federal Holdings LLC (Forcepoint LLC)
• Original Assignee: Raytheon Company (Rtx Corporation)
• Inventors: DelRocco, Anthony J., Teijido, Daniel
• Granted Patent: US 8,359,641 B2
• Time in Patent Office: Days
• US Class Current: 726/12
• CPC Class Codes: G06F 21/6245 Protecting personal data, e.g. for financial or medical purposes
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

According to one embodiment, a multi-level secure information retrieval system includes an enterprise access service tool coupled to one or more client applications and at least one gateway managed by an enterprise. The enterprise access service tool executes services operating in a service oriented architecture. The enterprise access service tool receives requests from the client applications, associates each of the requests with one of a plurality of differing security levels, and transmits the requests to the gateway. The gateway transmits the requested information back to the client applications in which the information is filtered by the gateway according to their associated security levels.

Claims

1. A multi-level secure information retrieval system comprising:

an enterprise access service tool comprising a plurality of services operating in a service oriented architecture, the plurality of services comprising a computer-readable media storing code executable by a computer processor of a computing system, the computing system coupled to a client application and a gateway managed by a corresponding enterprise, the enterprise access service tool operable to;

receive, from the client application, a request for information stored in a data repository managed by the enterprise;

determine one security level among a plurality of security levels associated with the request; and

transmit the request and the one security level to the gateway, the gateway operable to transmit the requested information back to the client application, the information filtered by the gateway according to the one security level.

2. The multi-level secure information retrieval system of claim 1, wherein the plurality of differing security levels comprise a plurality of security levels that each has an ascending level of security, the plurality of services operable to associate the request with the one security level and other plurality of security levels below the one security level.

3. The multi-level secure information retrieval system of claim 1, wherein the request conforms to a publish/subscribe model.

4. The multi-level secure information retrieval system of claim 1, wherein the client application comprises a web browser.

5. The multi-level secure information retrieval system of claim 1, wherein the computing system is coupled to the gateway through a publicly accessible network.

6. The multi-level secure information retrieval system of claim 1, wherein the gateway comprises a high assurance guard.

7. The multi-level secure information retrieval system of claim 1, wherein the gateway comprises a proxy data repository that is operable to store published data.

8. The multi-level secure information retrieval system of claim 1, wherein the enterprise access service tool is operable to receive, from the client application, another request for information stored in a legacy data repository, associate the another request with another one of the plurality of differing security levels;

and

transmit the requested information stored in the legacy data repository to the client application, the information filtered by the enterprise access service tool according to the one security level.

9. The multi-level secure information retrieval system of claim 1, wherein the plurality of services comprise a plurality of commercial off-the-shelf services that are operable to access the information from the data repository through a virtual private network.

10. A method for providing an information retrieval system in a multi-level secure environment comprising:

implementing a plurality of services operating in a service oriented architecture;

receiving, by the plurality of services, a request for information stored in a data repository managed by at least one enterprise from a client application;

determining one security level among a plurality of differing security levels associated with the request; and

transmitting the request and the one security level to a gateway of at least one enterprise, the gateway operable to transmit the requested information back to the client application, the information filtered by the gateway according to the one security level.

11. The method of claim 10, wherein associating the request with the one security level comprises associating the request with the one security level and other of the plurality of security levels below the one security level.

12. The method of claim 10, wherein receiving the request for information comprises receiving the request conforms to a publish/subscribe model.

13. The method of claim 10, wherein receiving the request for information from the client application comprises receiving the request from a web browser.

14. The method of claim 10, wherein the information is filtered by the gateway comprising a high assurance guard.

15. The method of claim 10, further comprising receiving, from the client application, another request for information stored in a legacy data repository, associating the another request with another one of the plurality of differing security levels;

and transmitting the requested information stored in the legacy data repository to the client application, the information filtered by the enterprise access service tool according to the one security level.

16. The method of claim 10, wherein receiving the request by a plurality of services operating in a service oriented architecture comprises receiving the request by a plurality of commercial off-the-shelf services and accessing the information from the at least one data repository through a virtual private network.

17. A computer-readable medium having code stored therein that, when executed by a processor, is operable to perform at least the following:

implement a plurality of services operating in a service oriented architecture;

receive, by the plurality of services, a request for information stored in a data repository managed by at least one enterprise from a client application;

determine one security among a plurality of security levels associated with the request; and

transmit the request and the one security level to a gateway of at least one enterprise, the gateway operable to transmit the requested information back to the client application, the information filtered by the gateway according to the one security level.

18. The code of claim 17, wherein associating the request with the one security level comprises associating the request with the one security level and other of the plurality of security levels below the one security level.

19. The code of claim 17, wherein receiving the request for information comprises receiving the request conforms to a publish/subscribe model.

20. The code of claim 17, wherein receiving the request for information from the client application comprises receiving the request from a web browser.

21. The code of claim 17, wherein the information is filtered by the gateway comprising a high assurance guard.

22. The code of claim 17, further operable to receive, from the client application, another request for information stored in a legacy data repository, associate the another request with another one of the plurality of differing security levels;

and transmit the requested information stored in the legacy data repository to the client application, the information filtered by the enterprise access service tool according to the one security level.

23. The code of claim 17, wherein receiving the request by a plurality of services operating in a service oriented architecture comprises receiving the request by a plurality of commercial off-the-shelf services and accessing the information from the at least one data repository through a virtual private network.