EMBEDDED GUARD-SANITIZER

• US 20110283143A1
• Filed: 05/12/2010
• Published: 11/17/2011
• Est. Priority Date: 05/12/2010
• Status: Active Grant

• Current Assignee: Northrop Grumman Systems Corporation (Northrop Grumman Corporation)
• Original Assignee: Northrop Grumman Systems Corporation (Northrop Grumman Corporation)
• Inventors: Collins, James G.
• Granted Patent: US 9,773,130 B2
• Time in Patent Office: Days
• US Class Current: 714/37
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices

Abstract

An apparatus includes a processor; a volatile, high-to-low working memory partition connected to the processor; a volatile, low-to-high working memory partition connected to the processor; a high-side, input/output section providing an interface to a high-side network or data bus, and configured to send messages to the high-to-low working memory, and to receive messages from the low-to-high working memory; a low-side, input/output section providing an interface to a low-side network or data bus, and configured to send messages to the low-to-high working memory, and to receive messages from the high-to-low working memory; a first non-volatile memory for storing a rule set binary image, whereby the processor controls the transfer of messages between the high-side input/output section and the low-side input/output section in accordance with the rule set; and a second non-volatile, memory for storing firmware for controlling executive functions of the apparatus.

Claims

1. An apparatus comprising:

a processor;

a volatile, high-to-low working memory partition connected to the processor;

a volatile, low-to-high working memory partition connected to the processor;

a high-side, input/output section providing an interface to a high-side network or data bus, and configured to send messages to the high-to-low working memory, and to receive messages from the low-to-high working memory;

a low-side, input/output section providing an interface to a low-side network or data bus, and configured to send messages to the low-to-high working memory, and to receive messages from the high-to-low working memory;

a first non-volatile memory for storing a binary rule set image, whereby the processor controls the transfer of messages between the high-side input/output section and the low-side input/output section in accordance with the rule set; and

a second non-volatile, memory for storing firmware for controlling executive functions of the apparatus.

2. The apparatus of claim 1, wherein:

the high-side, input/output section includes a volatile high-side memory input message buffer, a volatile high-side memory output message buffer and a high-side interface configured to send messages to the high-to-low working memory, and to receive messages from the low-to-high working memory; and

the low-side, input/output section includes a volatile low-side memory input message buffer, a volatile low-side memory output message buffer and a low-side interface to the microprocessor and its working memory configured to send messages to the low-to-high working memory, and to receive messages from the high-to-low working memory.

3. The apparatus of claim 1, wherein:

the firmware provides executive services, input/output services, startup diagnostics, operational diagnostics, and a run-time environment for the rule-set image.

4. The apparatus of claim 1, further comprising:

an alphanumeric status display unit to show the operational status of the apparatus.

5. The apparatus of claim 1, further comprising:

a load port to input the rule set image from an external, non-volatile memory device.

6. The apparatus of claim 1, further comprising:

permanent markings indicating “

high side” and

“

low side”

connections for the networks or data buses to prevent inadvertent misconnection.

7. The apparatus of claim 1, wherein the processor and firmware block message transfers between high-side and low-side networks of data buses by default.

8. The apparatus of claim 1, wherein the firmware provides an executive program not writable or modifiable by the processor except by use of a special, protected load port.

9. The apparatus of claim 1, wherein the processor controls the transfer of messages between the high-side input/output section and the low-side input/output section by passing the messages unmodified, redacting or substituting the messages, or blocking the messages under control of the rule set image.

10. The apparatus of claim 1, wherein the processor performs a hardware and firmware diagnostic test after start-up.

11. The apparatus of claim 1, wherein the processor performs periodic hardware and firmware diagnostic tests during normal operations.

12. The apparatus of claim 1, wherein the processor periodically checks the validity of the rule set image.

13. The apparatus of claim 1, wherein the firmware writes status messages to an alphanumeric display and optionally sends a status message on the high-side network in support of built-in test capability of a system in which the apparatus is embedded.

14. The apparatus of claim 1, wherein the rule set image produced on a separate, general purpose computer by a rule set image generator software application and compiled into the form of a binary executable image to be executed by the processor.

15. The apparatus of claim 1, wherein the rule set image dictates how particular messages are passed unaltered, redacted or blocked by the apparatus.

16. The apparatus of claim 1, wherein the apparatus uses the processor'"'"'s hardware memory partitioning capability to maintain separate high-to-low and low-to-high working memory partitions.