Secure segregation of data of two or more domains or trust realms transmitted through a common data channel

• US 7,181,540 B2
• Filed: 01/09/2004
• Issued: 02/20/2007
• Est. Priority Date: 11/18/1999
• Status: Expired due to Fees

• Current Assignee: L-3 Communications Corporation (L3Harris Technologies, Inc.)
• Original Assignee: L-3 Communications Corporation (L3Harris Technologies, Inc.)
• Inventors: Anspach, Jonathan Paul, Whitaker, David J
• Primary Examiner(s): Chang; Jungwon
• Application Number:
  US10/754,227
• Publication Number:
  US 20040143755A1
• Time in Patent Office: 1,138 Days
• Field of Search: 709/229, 709/245, 709/249, 709/227, 709/238, 713/200, 713/201, 370/390, 370/392
• US Class Current: 709/249
• CPC Class Codes: H04L 41/083 for increasing network speed
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/101 Access control lists [ACL]

Abstract

A system for transporting data comprising a first domain comprising a first plurality of filters in a first communication channel, the first communications channel including a common portion, the first plurality of filters employing a first plurality of filtering criteria; a second domain comprising a second plurality of filters in a second communications channel, the second communications channel including the common portion, the second plurality of filters employing a second plurality of filtering criteria; a plurality of managers each coupled to one of the first plurality of filters and the second plurality of filters, each of the plurality of managers comprising means for configuring the one of the first plurality of filters and the second plurality of filters; and at least one control terminal coupled to the plurality of managers for controlling said plurality of managers.

Claims

1. A system for securely transporting data to multiple domains comprising:

a common channel for carrying data of a plurality of domains wherein said plurality of domains includes at least a first domain and a second domain;

at least one switch through which data enters said common channel;

at least one switch through which data exits said common channel;

a first plurality of routers coupled to said at least one switch through which data enters said common channel;

a second plurality of routers coupled to said at least one switch through which data exits said common channel;

a first filtering means for filtering data traveling through said at least one switch through which data enters said common channel and said at least one switch through which data exits said common channel based on a first filtering criteria;

a second filtering means for filtering data traveling through said plurality of routers coupled to said at least one switch through which data enters said common channel based on a second filtering criteria;

a third filtering means for filtering data traveling through said plurality of routers coupled to said at least one switch through which data exits said common channel based on a third filtering criteria;

wherein said first filtering means, said second filtering means, and said third filtering means prevent data designated for said first domain from transferring to said second domain and to prevent data designated for said second domain from transferring to said first domain.

2. The system of claim 1 further comprising terminals coupled to each of said routers.

3. The system of claim 2 wherein said terminals are coupled to said routers by way of Ethernet switches and network interface cards.

4. The system of claim 3 wherein said routers and the Ethernet switch coupled thereto are housed in a single chassis.

5. The system of claim 4 wherein said router and the Ethernet switch coupled thereto independently process data.

6. The system of claim 1 further comprising video equipment coupled to at least one of said switches.

7. The system of claim 1 further comprising audio equipment coupled to at least one of said switches.

8. The system of claim 1 wherein said at least one switch through which data enters said common channel is in a ring configuration.

9. The system of claim 1 wherein said at least one switch through which data exits said common channel is in a ring configuration.

10. The system of claim 1 wherein said first filtering criteria is any of the group consisting of IP addresses and socket numbers.

11. The system of claim 1 wherein said second filtering criteria is any of the group consisting of MAC addresses, AAL types, and ATM header error controls.

12. The system of claim 1 wherein said third filtering criteria is any of the group consisting of MAC addresses, IP addresses, IP header checksums, and socket numbers.

13. The system of claim 1 wherein said system does not employ encryption technology.

14. A system for securely transporting data to multiple domains comprising:

a common channel for carrying data of a plurality of domains wherein said plurality of domains includes at least a first domain and a second domain;

at least one switch through which data enters said common channel;

at least one switch through which data exits said common channel;

a first plurality of routers coupled to said at least one switch through which data enters said common channel;

a second plurality of routers coupled to said at least one switch through which data exits said common channel;

a switch coupled to one of said first plurality of routers;

a switch coupled to one of said second plurality of routers;

a first filtering means for filtering data traveling through said at least one switch through which data enters said common channel and said at least one switch through which data exits said common channel based on a first filtering criteria;

a second filtering means for filtering data traveling through said plurality of routers coupled to said at least one switch through which data enters said common channel based on a second filtering criteria;

a third filtering means for filtering data traveling through said plurality of routers coupled to said at least one switch through which data exits said common channel based on a third filtering criteria;

a fourth filtering means for filtering data traveling through said switch coupled to one of said first plurality of routers based on a fourth filtering criteria;

a fifth filtering means for filtering data traveling through said switch coupled to one of said second plurality of routers based on a fifth filtering criteria;

wherein said first filtering means, said second filtering means, said third filtering means, said fourth filtering means, and fifth filtering means prevent data designated for said first domain from transferring to said second domain and to prevent data designated for said second domain from transferring to said first domain.

15. The system of claim 14 wherein said switch coupled to one of said first plurality of routers is an Ethernet switch.

16. The system of claim 14 wherein said switch coupled to one of said second plurality of routers is an Ethernet switch.

17. The system of claim 14 wherein at least one terminal is coupled to said switch coupled to one of said first plurality of routers.

18. The system of claim 14 wherein at least one terminals coupled to said switch coupled to one of said second plurality of routers.

19. The system of claim 14 wherein said first filtering criteria is any of the group consisting of IP addresses and socket numbers.

20. The system of claim 14 wherein said second filtering criteria is any of the group consisting of MAC addresses, AAL types, and ATM header error controls.

21. The system of claim 14 wherein said third filtering criteria is any of the group consisting of MAC addresses, IP addresses, IP header checksums, and socket numbers.

22. The system of claim 14 wherein said fourth filtering criteria is MAC addresses.

23. The system of claim 14 wherein said fifth filtering criteria is MAC addresses.

24. The system of claim 14 wherein said system does not employ encryption technology.

25. A system for transporting data comprising:

a common physical communication channel;

a first domain comprising a first plurality of filters in a first logical communications channel, the first logical communications channel transmitting first data at least in part via the common physical communication channel, a first terminal coupled at one end of the first logical communications channel, and a second terminal coupled at another end of the first logical communications channel, the first plurality of filters employing a first plurality of filtering criteria;

a second domain comprising a second plurality of filters in a second logical communications channel, the second logical communications channel transmitting second data at least in part via the common physical communication channel, a third terminal coupled at one end of the second logical communications channel, and a fourth terminal coupled at another end of the second logical communications channel, the second plurality of filters employing a second plurality of filtering criteria; and

wherein the first data and the second data physically intermingle on the common physical channel while logical separation is simultaneously maintained between the first and second data.

26. The system of claim 25 wherein at least one filter in said first plurality of filters is in said second plurality of filters also.

27. The system of claim 26 wherein said first plurality of filters includes a filter based in an IP address.

28. The system of claim 26 wherein said first plurality of filters includes a filter based on a MAC address.

29. The system of claim 26 wherein said first plurality of filters includes a router.

30. The system of claim 29 wherein said second plurality of filters includes a router.

31. The system of claim 26 wherein said first plurality of filters includes a switch.

32. The system of claim 31 wherein said switch is an ATM switch, and where said ATM switch is said at least on filter.

33. A system for transporting data comprising:

a common physical communication channel;

a first domain comprising a first plurality of filters in a first logical communications channel, the first logical communications channel transmitting first data at least in part via the common physical communication channel, the first plurality of filters employing a first plurality of filtering criteria;

a second domain comprising a second plurality of filters in a second logical communications channel, the second logical communications channel transmitting second data at least in part via the common physical communication channel, the second plurality of filters employing a second plurality of filtering criteria;

wherein the first data and the second data physically intermingle on the common physical channel while logical separation is simultaneously maintained between the first and second data;

a plurality of managers each coupled to one of the first plurality of filters and the second plurality of filters, each of the plurality managers comprising means for configuring the one of the first plurality of filters and the second plurality of filters;

at least one control terminal coupled to the plurality of managers for controlling said plurality of managers.

34. The system in claim 33 wherein said at least one control terminal channel includes means for storing a configuration file for each of said first plurality of filters and each of said second plurality of filters.

35. The system of claim 33 wherein each of said plurality of managers includes respective management software.

36. The system of claim 35 wherein said control terminal does not include management software, but rather includes communications software in communication with said management software.

37. The system of claim 36 wherein said control terminal includes x-protocol software.