System and Method for Providing Voice Communications Over a Multi-Level Secure Network

• US 20100296444A1
• Filed: 01/13/2010
• Published: 11/25/2010
• Est. Priority Date: 05/22/2009
• Status: Active Grant

• Current Assignee: Forcepoint Federal Holdings LLC (Forcepoint LLC)
• Original Assignee: Raytheon Company (Rtx Corporation)
• Inventors: Marchant, Robert L., Tierney, Michael O., Magon, Raymond A., Masiyowski, John F.
• Granted Patent: US 8,730,871 B2
• Time in Patent Office: Days
• US Class Current: 370/328
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 65/103 in the network
• CPC Class Codes: H04L 65/1076 Screening of IP real time communications, e.g. spam over Internet telephony [SPIT]

Abstract

According to one embodiment, a communication network includes an analog voice bridge coupled to two secure network domains that each have a differing security level. The analog voice bridge includes two codecs that are coupled together through an analog voice line that transfers analog voice signals. The analog voice bridge is coupled to each secure network domain through a network switch that transfers data packet streams from their respective networks to the codecs while restricting data packets that are not associated with the data packet stream.

Claims

1. A communication network comprising:

an analog voice bridge comprising a first codec and a second codec coupled together through an analog voice line that is operable to transfer an analog voice signal between the first codec and the second codec while restricting transfer of data packets between the first codec and the second codec, the first codec coupled to a first secure network domain classified according to a first security level that differs from a second security level of a second secure network domain coupled to the second codec;

a first network switch coupled between the first codec and the first secure network domain, the first network switch operable to transfer a first voice packet stream encapsulating the analog voice signal between the first secure network domain and the first codec; and

a second network switch coupled between the second codec and the second secure network domain, the second network switch operable to transfer a second voice packet stream encapsulating the analog voice signal between the second secure network domain and the second codec.

2. The communication network of claim 1, wherein the first network switch is operable to restrict transfer of data packets not associated with the first voice packet stream between the first secure network domain and the first codec;

and

the second network switch is operable to restrict transfer of data packets not associated with the second voice packet stream between the second secure network domain and the second codec.

3. The communication network of claim 1, wherein the first network switch and the second network switch each comprise an access control list that stores information associated with one or more terminals coupled to the first secure network domain and the second secure network domain respectively, the first network switch and the second network switch operable to restrict access of the one or more terminals to the analog voice bridge according to the information stored in the access control list.

4. The communication network of claim 1, further comprising a packet filter coupled between the first or second secure network domain and one or more terminals, the packet filter comprising an access control list that stores information associated with the one or more terminals and operable to restrict access of the one or more terminals to the analog voice bridge according to the information stored in the access control list.

5. The communication network of claim 4, wherein the packet filter is operable to restrict access of the one or more terminals according to their type.

6. The communication network of claim 4, further comprising one or more terminals coupled to the first or second secure network domain, one of the one or more terminals comprising a computing system operable to execute a browser that establishes voice connections through the analog voice bridge.

7. The communication network of claim 4, further comprising a wireless network coupling one or more terminal to the first or second secure network domain.

8. The communication network of claim 1, further comprising a routing table coupled to the first codec or the second codec, the first codec or the second codec operable to restrict voice communication of one or more terminals coupled to the first secure network domain or the second secure network domain according to information associated with the one or more terminals stored in the routing table.

9. The communication network of claim 1, wherein the first codec is embodied in a computing system that is independent of a second computing system embodying the second codec.

10. The communication network of claim 1, wherein the first network switch or the second network switch comprises a monitoring tool that is operable to selectively monitor voice communications through the analog voice bridge.

11. The communication network of claim 1, wherein the first network switch or the second network switch comprises a auditing tool that is operable to audit voice communications through the analog voice bridge.

12. The communication network of claim 1, wherein the analog voice signal comprises an intercom connection.

13. The communication network of claim 1, wherein the first secure network domain is separated from the second secure network domain according to a protection level 4 (PL4) protection level as specified by a Director of Central Intelligence Directive 6/3.

14. A communication method comprising:

transferring, using a first network switch, data packets associated with a first voice packet stream between a first secure network domain and a first codec while restricting other data packets not associated with the first voice packet stream, the first voice packet stream encapsulating an analog voice signal;

transferring, using an analog voice line, the analog voice signal between the first codec and the second codec; and

transferring, using a second network switch, data packets associated with a second voice packet stream between a second secure network domain and the second codec while restricting other data packets not associated with the second voice packet stream, the second voice packet stream encapsulating the analog voice signal, the first secure network domain classified according to a first security level that differs from a second security level of the second secure network domain.

15. The communication method of claim 14, further comprising:

restricting, using the first network switch, transfer of data packets not associated with the first voice packet stream between the first secure network domain and the first codec; and

restricting, using the second network switch, transfer of data packets not associated with the second voice packet stream between the second secure network domain and the second codec.

16. The communication method of claim 14, further comprising restricting, using the first or second network switch, access of one or more terminals coupled to the first or second network switch according to an access control list stored in the first or second network switch, respectively.

17. The communication method of claim 14, further comprising:

restricting, using a packet filter coupled between one or more terminals and the first or second secure network domain, access to the one or more terminals according to an access control list stored in the packet filter, the access control list storing information associated with the one or more terminals.

18. The communication method of claim 17, further comprising restricting access, using the packet filter, to the one or more terminals according to their type.

19. The communication method of claim 17, further comprising establishing a voice connection through the analog voice bridge using a browser executed on one of the one or more terminals.

20. The communication method of claim 17, wherein the one or more terminals are coupled to the first or second secure network through a wireless network.

21. The communication method of claim 14, further comprising restricting voice communication of one or more terminals coupled to the first secure network domain or the second secure network domain according to information associated with the one or more terminals stored in a routing table coupled to the first codec or the second codec.

22. The communication method of claim 14, wherein the first codec is embodied in a computing system that is independent of a second computing system embodying the second codec.

23. The communication method of claim 14, further comprising selectively monitoring voice communications through the analog voice bridge.

24. The communication method of claim 14, further comprising to auditing voice communications through the analog voice bridge.

25. The communication method of claim 14, wherein the analog voice signal comprises an intercom connection.

26. A communication network comprising:

an analog voice bridge comprising a first codec and a second codec coupled together through an analog voice line that is operable to transfer an analog voice signal between the first codec and the second codec while restricting transfer of data packets between the first codec and the second codec, the first codec coupled to a first secure network domain and the second codec coupled to a second secure network domain; and

a packet filter coupled between the first or second secure network domain and one or more terminals, the packet filter comprising an access control list that stores information associated with the one or more terminals and operable to restrict access of the one or more terminals to the analog voice bridge according to the information stored in the access control list.

27. The communication network of claim 26, wherein the first secure network domain is classified according to a first security level that differs from a second security level of the second secure network domain.