Multi-level security network system

• US 6,304,973 B1
• Filed: 08/06/1998
• Issued: 10/16/2001
• Est. Priority Date: 08/06/1998
• Status: Expired due to Term

• Current Assignee: API Cryptek, Inc. (API Technologies Corporation)
• Original Assignee: Cryptek Incorporated (API Technologies Corporation)
• Inventors: Williams, Timothy C.
• Primary Examiner(s): Decady, Albert
• Assistant Examiner(s): KABAKOFF, STEPHEN ERIC
• Application Number:
  US09/129,879
• Time in Patent Office: 1,167 Days
• Field of Search: 713/151, 713/153, 713/154, 713/200-202, 713/192, 711/213-215, 710/52, 710/129, 709/213-215, 235/375-386, 235/435, 235/487
• US Class Current: 726/3
• CPC Class Codes: H04L 63/0218 Distributed architectures, e.g. distributed firewalls
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 69/12 Protocol engines

Abstract

A network prevents unauthorized users from gaining access to confidential information. The network has various workstations and servers connected by a common medium and through a router to the Internet. The network has two major components, a Network Security Center (NSC) and security network interface cards or devices. The NSC is an administrative workstation through which the network security officer manages the network as a whole as well as the individual security devices. The security devices are interposed, between each of workstation, including the NSC, and the common medium and operate at a network layer (layer 3) of the protocol hierarchy. The network allows trusted users to access outside information, including the Internet, while stopping outside attackers at their point of entry. At the same time, the network limits an unauthorized insider to information defined in their particular security profile. The user may select which virtual network to access at any given time. The result is trusted access to multiple secure Virtual Private Networks (VPN), all from a single desktop machine.

Claims

1. A security device for connecting a host computer from a host bus to a network accessible to other host computers, the security device comprising a local bus, a network interface connecting said local bus to the network, and a two-port memory device connecting said local bus to the host bus including a first port coupled to said host bus, a second port coupled to said local bus, and a RAM connected between said first and second ports, said RAM storing information provided over said host bus in a host bus memory space and storing information provided over said local bus in a local bus memory space wherein information to be transferred from the host bus to the local bus is written to said host bus memory space and then transferred out of host bus memory space into local bus memory space in advance of security processing, said transferred information being invisible to said host bus, said security device further comprising a central processing unit connected with said local bus, said central processing unit having associated firmware, and a security device local RAM, said central processing unit transferring information out of said local bus memory space of said two-port memory device into said security device local RAM in accordance with a predetermined security policy.

2. The security device of claim 1, further comprising a cipher unit connected to the local bus.

3. The security device of claim 1, further comprising an authentication interface unit connected with said local bus for authenticating a computer user.

4. The security device of claim 1, wherein said network interface comprises a network coprocessor.

5. The security device of claim 1, wherein the network comprises a local area, Ethernet or token ring network.

6. The security device of claim 1, wherein security is implemented at a network layer of protocol hierarchy.

18. The security device of claim 1 wherein said network interface comprises a network processor for extracting information out of said security device local RAM for transfer to said network.

7. A security device for connecting a host computer from a host bus to a computer-accessible network, the security device comprising a local bus, a network interface for connecting said local bus to the computer network, and a communication separation unit for connection between said local bus and said host bus, said communication separation unit including a first port coupled to said host bus, a second port coupled to said local bus, and a signal storage device interconnecting said first and second ports, said signal storage device storing signals provided over said host bus in a host bus memory space and over said local bus in a local bus memory space, wherein said signals are switchable between said host bus memory space and said local bus memory space with said switched signals from said host bus memory space being invisible to said host bus after being switched to said local bus memory space, said communication separation unit preventing pass-through of signals between said host bus and said computer-accessible network without transitory storage in said signal storage device, said security device further comprising security device processing means and a local RAM, said security device processing means for transferring signals between said local bus memory space of said signal storage device and said local RAM.

8. The security device of claim 7 wherein said signal storage device includes a RAM.

9. The security device of claim 7 wherein said signal storage device is a two-port RAM.

10. The security device of claim 7 wherein said security device processing means enables the writing of signals over said host bus to said signal storage device and the reading of signals from said signal storage device to said local bus.

11. The security device of claim 7 wherein said network interface includes a network processor.

12. The security device of claim 7 wherein signals to be passed between said host bus and said local bus are switched out of host bus memory address space into local bus memory space.

13. The security device of claim 12 wherein said switching is in advance of security processing.

14. The security device of claim 7, further comprising an authentication interface unit connected with said local bus for authenticating a computer user.

15. The security device of claim 7 further comprising a cipher unit connected with said local bus.

16. The security device of claim 15 wherein said cipher unit is connected with said local bus via a RAM.

17. A security device for a multi-level secure network implementing security at a network layer (layer 3) of protocol hierarchy having a plurality of host computers accessible to users and connected to a computer network medium, said security device connectable between at least one host computer bus and the network medium, wherein said security device comprises a local bus, a network interface for connecting said local bus to the computer network medium, and a communication separation means for connection between said local bus and said host bus and for preventing direct pass-through of signals between said host bus and said local bus, said communication separation means including a memory device for storing information provided over said host bus in a memory space, and means for switching said information from said memory space to said local bus while making said switched information inaccessible to said host bus.

19. A security device for a multi-level secure network implementing security at a network layer (layer 3) of protocol hierarchy having a plurality of host computers accessible to users and connected to a computer network medium, said security device connectable between at least one host computer bus and the network medium, said security device comprising

a local bus, a local RAM, and a local processor;

a network interface for connecting said local bus to the computer network medium and including a network processing means for transferring information between said local RAM and said network medium;

a communication separation means for connection between said local bus and said host bus and for preventing direct pass-through of information between said host bus and said local bus and for preventing direct access between said host bus and components within said security device, said communication separation means including a memory device for storing information provided over said host bus in a memory space, a first port interconnecting said host bus and said memory device, and a second port interconnecting said local bus and said memory device, said information transferrable from said memory space to said local bus while making the transferred information inaccessible to said host bus;

wherein said local processor processes information to be transferred between said host bus and said network medium in accordance with a predetermined security policy to determine whether communication between a host computer and the network medium is authorized, said local processor including means for accessing host bus information from said memory space of said communication separation means, processing said host bus information in accordance with said security policy, transferring the processed host bus information to said local RAM for access by said network processing means, accessing network medium information placed in said local RAM by said network processing means, processing said network medium information in accordance with said security policy, and transferring the processed network medium information to said communication separation means for access by said host bus.

20. The security device of claim 19 further comprising authentication means for reading authentication information from an authentication unit to determine an individual'"'"'s having access to the network, said authentication means connected with said local bus.

21. The security device of claim 19 further comprising encryption/decryption means for encrypting host bus information and for decrypting network medium information.

22. The security device of claim 19 wherein said processing of said host bus information in accordance with said security policy includes means for performing discretionary access control (DAC) and mandatory access control (MAC) policies.