MLWEB: A MULTILEVEL WEB APPLICATION FRAMEWORK

• US 20120185911A1
• Filed: 09/30/2011
• Published: 07/19/2012
• Est. Priority Date: 09/30/2010
• Status: Abandoned Application

• Current Assignee: The Government Of The United States Of America, As Represented By The Secretary Of The Navy
• Original Assignee: The Government Of The United States Of America, As Represented By The Secretary Of The Navy
• Inventors: Polite, Khandys, Macklin, Thomas, Ashmore, John
• Application Number:
  US13/251,158
• Publication Number:
  US 20120185911A1
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

A method of transferring data from a server via a web application by receiving a request from a user operating in a disparate security domain for data on a data store. Generating a labeled view of the data requested from the data store, wherein the label-data relationship can be trusted at a level commensurate to the trust level of the operating system. Next, determining if the data is authorized by a security policy with a policy design engine; and then transmitting the data to the user if the data is authorized. Data can also be transferred by receiving a data flow from the user for writing to the data store. Next, the data flow can be inspected for disallowed content, and a determination is made if the data flow is authorized. If the data flow is authorized, mediating the data flow between the user and the data store with a trusted monitor.

Claims

1. A method of transferring data from a server via a web application, comprising the steps of:

receiving a request from a user operating on a network in a disparate security domain for data on a multilevel data store;

generating a labeled view of the data requested from the multilevel data store, wherein the label-data relationship can be trusted at a level commensurate to the trust level of the OS;

determining if the data is authorized by a security policy with a policy design engine; and

transmitting the data to the user if the data is authorized.

2. The method of claim 1, further comprising the steps of:

receiving a data flow from the user operating on the network in the disparate security domain for writing to the multilevel data store;

inspecting the data flow for disallowed and mislabeled content;

determining if the data flow is authorized by the security policy; and

if the data flow is authorized, authorizing the data flow and mediating the data flow between the user and the multilevel data store with a trusted monitor component.

3. A cross domain system, comprising:

a plurality of connections to users on networks in disparate security domains;

a content server configured to extend multilevel web services to the users;

a trusted monitor component configured to mediate all information flows that occur between the users and the cross domain solutions;

a multilevel data store configured to read and write data from the users depending on a determination by a policy decision engine on whether the given data is authorized by a security policy.