ENABLING MULTI-LEVEL SECURITY IN A SINGLE-LEVEL SECURITY COMPUTING SYSTEM

• US 20100306534A1
• Filed: 05/25/2010
• Published: 12/02/2010
• Est. Priority Date: 05/26/2009
• Status: Active Grant

• Current Assignee: Forcepoint Federal Holdings LLC (Forcepoint LLC)
• Original Assignee: Raytheon Company (Rtx Corporation)
• Inventors: Teijido, Daniel, Brooks, Randall S.
• Granted Patent: US 8,468,344 B2
• Time in Patent Office: Days
• US Class Current: 713/166
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2113 Multi-level security, e.g. mandatory access control

Abstract

According to an embodiment, a system may comprise a mass storage device that is operable to be coupled to one or more processors. The mass storage device may comprise a base operating system that is operable to be executed by the one or more processors. The base operating system may be operable to implement a single security level. The mass storage device may also comprise a virtual operating system that is operable to be executed by the one or more processors. The virtual operating system may be executed using a virtualization tool that is executed by the base operating system. The virtual operating system may be operable to process information according to a plurality of security levels and communicate the information to one or more computing systems. The information may be communicated according to the plurality of security levels of the information.

Claims

1. A system comprising:

a mass storage device operable to be coupled to one or more processors, the mass storage device comprising;

a base operating system operable to be executed by the one or more processors, the base operating system operable to implement a single security level;

a virtual operating system operable to be executed by the one or more processors, the virtual operating system executed using a virtualization tool executed by the base operating system, the virtual operating system operable to;

process information according to a plurality of security levels; and

communicate the information to one or more computing systems, the information communicated according to the plurality of security levels of the information.

2. The system of claim 1, the virtualization tool operable to isolate one or more processes of the virtual operating system from the base operating system.

3. The system of claim 1, the virtualization tool operable to restrict the base operating system from accessing secure information of the virtual operating system.

4. The system of claim 1, the virtual operating system operable to communicate the information using one or more packets, the packets indicating a security level of the information.

5. The system of claim 1, the virtual operating system operable to communicate the information to a gateway that supports a plurality of labeled zones of a network.

6. The system of claim 1, the one or more processors comprising a processor of a MACINTOSH™

personal computer.

7. The system of claim 1, virtual operating system further operable to implement a plurality of hierarchical labeled zones such that a file of a labeled zone may access a file of labeled zone of an equal or lower security level, but the file may not access a file of a zone of a higher security level.

8. A method comprising:

executing a base operating system by one or more processors, the base operating system operable to implement a single security level;

executing a virtual operating system by the one or more processors, the virtual operating system executed using a virtualization tool executed by the base operating system;

processing, by the virtual operating system, information according to a plurality of security levels; and

communicating the information with one or more computing systems, the information communicated according to the plurality of security levels of the information.

9. The method of claim 8, further comprising:

using the virtualization tool to isolate one or more processes of the virtual operating system from the base operating system.

10. The method of claim 8, further comprising:

using the virtualization tool to restrict the base operating system from accessing secure information of the virtual operating system.

11. The method of claim 8, further comprising:

communicating, by the virtual operating system, the information using one or more packets, the packets indicating a security level of the information.

12. The method of claim 8, further comprising:

communicating, by the virtual operating system, the information to a gateway that supports a plurality of labeled zones of a network.

13. The method of claim 8, the one or more processors comprising a processor of a Macintosh™

personal computer.

14. The method of claim 8, further comprising:

implementing a plurality of hierarchical labeled zones such that a file of a labeled zone may access a file of labeled zone of an equal or lower security level, but the file may not access a file of a zone of a higher security level.

15. A tangible computer-readable medium having computer-executable code, when executed by one or more processors operable to:

execute a base operating system by one or more processors, the base operating system operable to implement a single security level;

execute a virtual operating system by the one or more processors, the virtual operating system executed using a virtualization tool executed by the base operating system;

process, by the virtual operating system, information according to a plurality of security levels; and

communicate the information to one or more computing systems, the information communicated according to the plurality of security levels of the information.

16. The medium of claim 15, when executed by one or more processors further operable to:

isolate one or more processes of the virtual operating system from the base operating system.

17. The medium of claim 15, when executed by one or more processors further operable to:

restrict the base operating system from accessing secure information of the virtual operating system.

18. The medium of claim 15, when executed by one or more processors further operable to:

communicate the information using one or more packets, the packets indicating a security level of the information.

19. The medium of claim 15, when executed by one or more processors further operable to:

communicate the information to a gateway that supports a plurality of labeled zones of a network.

20. The medium of claim 15, the one or more processors comprising a processor of a Macintosh™

personal computer.