TRANSMISSION FILTERING PROCESSOR ARCHITECTURE

• US 20140201273A1
• Filed: 01/15/2013
• Published: 07/17/2014
• Est. Priority Date: 01/15/2013
• Status: Active Grant

• Current Assignee: Cubic Defense Applictions Incorporated
• Original Assignee: Cubic Corporation
• Inventors: STERN, RICHARD
• Granted Patent: US 9,356,898 B2
• Time in Patent Office: Days
• US Class Current: 709/204
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload

Abstract

A processor for filtering message traffic between communication systems may include an input buffer storing an input message and an output buffer. The processor may also include a memory interface communicatively coupled to a filter rule table that includes message filter rules for verifying input messages received by the input buffer and build output message rules for constructing output messages based on the input messages received by the input buffer. The processor may additionally include a message filter state machine circuit communicatively coupled to the input buffer that applies the message filter rules to the input message from the input buffer and determines whether the input message conforms to each of the message filter rules. The processor may further include a build output message state machine circuit that constructs an output message based on the input message and causes the output message to be stored in the output buffer.

Claims

1. A processor for filtering message traffic between a first communication system and a second communication system, the processor comprising:

an input buffer storing an input message received from the first communication system;

an output buffer that is accessible by the second communication system;

a memory interface communicatively coupled to a filter rule table, wherein the filter rule table comprises;

message filter rules for verifying input messages received by the input buffer; and

build output message rules for constructing output messages based on the input messages received by the input buffer;

a message filter state machine circuit communicatively coupled to the input buffer, wherein the message filter circuit;

applies the message filter rules to the input message from the input buffer; and

determines whether the input message conforms to each of the message filter rules; and

a build output message state machine circuit communicatively coupled to the input buffer and the output buffer, wherein the build output message circuit;

constructs an output message based on the input message; and

causes the output message to be stored in the output buffer.

2. The processor for filtering message traffic between a first communication system and a second communication system of claim 1 wherein the message filter state machine circuit and the build output message state machine circuit are separate state machine circuits, neither of which is implemented using a general-purpose processor.

3. The processor for filtering message traffic between a first communication system and a second communication system of claim 1 wherein the message filter state machine circuit and the build output message state machine circuit are configured to process input messages at a rate of at least 100 Mb/s.

4. The processor for filtering message traffic between a first communication system and a second communication system of claim 1 wherein the build output message state machine circuit is able to construct the output message after the message filter state machine circuit determines that the input message conforms to each of the message filter rules.

5. The processor for filtering message traffic between a first communication system and a second communication system of claim 1 wherein the message filter rules are executed in a first batch, and the build output message rules are executed in a second batch.

6. The processor for filtering message traffic between a first communication system and a second communication system of claim 1 wherein one or more of the message filter rules includes an AND condition that instructs the message filter state machine circuit to determine that the input message does not conform to each of the message filter rules if any of the one or more message filter rules fails.

7. The processor for filtering message traffic between a first communication system and a second communication system of claim 1 wherein one or more of the message filter rules includes an OR condition that instructs the message filter state machine circuit to determine that the input message does not conform to each of the message filter rules if each of the one or more message filter rules fails.

8. The processor for filtering message traffic between a first communication system and a second communication system of claim 1 further comprising an encryption circuit that operates based on one or more of the build output message rules to encrypt at least a portion of the output message.

9. The processor for filtering message traffic between a first communication system and a second communication system of claim 8 wherein the encryption circuit is certified by the National Security Agency (NSA).

10. The processor for filtering message traffic between a first communication system and a second communication system of claim 1 wherein the first communication system and the second communication system are subject to different security requirements.

11. The processor for filtering message traffic between a first communication system and a second communication system of claim 1 wherein the output message includes output values not derived from values in the input message.

12. A method of filtering message traffic between a first communication system and a second communication system using a trusted guard processor, the method comprising:

receiving an input message from an input buffer, wherein the input message is sent from the first communication system;

receiving, using a memory interface communicatively coupled to a filter rule table;

message filter rules for verifying input messages received by the input buffer; and

build output message rules for constructing output messages based on the input messages received by the input buffer;

applying the message filter rules to the input message from the input buffer using a message filter state machine circuit that is communicatively coupled to the input buffer;

determining whether the input message conforms to each of the message filter rules using the message filter state machine circuit;

constructing an output message based on the input message using a build output message state machine circuit that is communicatively coupled to the input buffer and an output buffer; and

causing the output message to be stored in the output buffer, wherein the output buffer is accessible by the second communication system.

13. The method of filtering message traffic between the first communication system and the second communication system using the trusted guard processor of claim 12 wherein the message filter state machine circuit and the build output message state machine circuit are separate state machine circuits, neither of which is implemented using a general-purpose processor.

14. The method of filtering message traffic between the first communication system and the second communication system using the trusted guard processor of claim 12 wherein the message filter state machine circuit and the build output message state machine circuit are configured to process input messages at a rate of at least 100 Mb/s.

15. The method of filtering message traffic between the first communication system and the second communication system using the trusted guard processor of claim 12 wherein the build output message state machine circuit is able to construct the output message after the message filter state machine circuit determines that the input message conforms to each of the message filter rules.

16. The method of filtering message traffic between the first communication system and the second communication system using the trusted guard processor of claim 12 wherein the message filter rules are executed in a first batch, and the build output message rules are executed in a second batch.

17. The method of filtering message traffic between the first communication system and the second communication system using the trusted guard processor of claim 12 wherein one or more of the message filter rules includes an AND condition that instructs the message filter state machine circuit to determine that the input message does not conform to each of the message filter rules if any of the one or more message filter rules fails.

18. The method of filtering message traffic between the first communication system and the second communication system using the trusted guard processor of claim 12 wherein one or more of the message filter rules includes an OR condition that instructs the message filter state machine circuit to determine that the input message does not conform to each of the message filter rules if each of the one or more message filter rules fails.

19. The method of filtering message traffic between the first communication system and the second communication system using the trusted guard processor of claim 12 wherein the build output message state machine circuit comprises an encryption circuit that operates based on one or more of the build output message rules to encrypt at least a portion of the output message.

20. The method of filtering message traffic between the first communication system and the second communication system using the trusted guard processor of claim 19 wherein the encryption circuit is certified by the National Security Agency (NSA).