Method and apparatus for executing web services through a high assurance guard

• US 7,689,699 B2
• Filed: 06/07/2007
• Issued: 03/30/2010
• Est. Priority Date: 06/07/2007
• Status: Active Grant

• Current Assignee: The Boeing Co.
• Original Assignee: The Boeing Co.
• Inventors: Chazin, David
• Primary Examiner(s): Chan; Wing F
• Assistant Examiner(s): Yohannes; Tesfay
• Application Number:
  US11/810,914
• Publication Number:
  US 20080307101A1
• Time in Patent Office: 1,027 Days
• Field of Search: 709/229, 709/223
• US Class Current: 709/229
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

In accordance with an embodiment, a method of executing web services through a high assurance guard includes transmitting a target service request having routing information from the source security domain to a source one-way high assurance guard (HAG) service, inspecting the target service request in the source one-way HAG service to determine if the target service request violates at least one rule governing communications transmitted from the first security domain, transmitting the target service request to a destination one-way HAG service in the destination security domain via a one-way HAG according to the routing information if the target service request does not violate the at least one rule and discarding the second target service request if the target service request violates the at least one rule, and providing the target service request to the target service.

Claims

1. A method of transmitting information from a source security domain associated with a first security classification to one of a plurality of destination security domains associated with a second security classification, comprising the steps of:

transmitting a target service request having routing information from the source security domain to a source one-way high assurance guard (HAG) service;

inspecting the target service request in the source one-way HAG service to determine if the target service request violates at least one rule governing communications transmitted from the first security domain;

transmitting the target service request to a destination one-way HAG service in the destination security domain via a one-way HAG according to the routing information if the target service request does not violate the at least one rule and discarding the second target service request if the target service request violates the at least one rule; and

providing the target service request to the target service;

wherein the target service request is wrapped in a second message to the source one-way HAG service, inspected by the source one-way HAG service to determine if the wrapped target service request violates the at least one rule, and unwrapped in the destination one-way HAG service.

2. The method of claim 1, wherein the second security classification is higher than the first security classification.

3. The method of claim 1, wherein the target service request is formatted by a requesting client in the source security domain.

4. The method of claim 1, wherein the target service request is wrapped by a requesting client in the source security domain.

5. The method of claim 4, wherein the requesting client invokes the source one-way HAG service.

6. An apparatus for transmitting a target service request to a target service, comprising:

a source security domain, associated with a first security classification, the source security domain including source one-way high assurance guard (HAG) service;

a destination security domain, associated with a second security classification, the destination security domain including a destination one-way HAG service; and

a one-way HAG, communicatively coupling the source security domain and the destination security domain via the source one-way HAG and the destination one-way HAG;

wherein the source one-way HAG service accepts a target service request, inspects the target service request to determine if the target service request violates at least one rule governing communications transmitted from the source security domain, transmits the target service request to the destination one-way HAG service via the one-way HAG only if the target service request does not violate the at least one rule and discards the target service request if the target service request violates the at least one rule; and

wherein the destination one-way HAG service provides the target service request to the target service; and

wherein the target service request is wrapped in a second message to the source one-way HAG, inspected by the source one-way HAG service to determine if the wrapped target service request violates the at least one rule, and unwrapped in the destination one-way HAG service if the wrapped target service request does not violate the at least one rule.

7. The apparatus of claim 6, wherein the second security classification is higher than the first security classification.

8. The apparatus of claim 6, wherein the target service request is formatted by a requesting client in the source entity domain.

9. The apparatus of claim 6, wherein the target service request is wrapped by a requesting client in the source entity domain.

10. The apparatus of claim 9, wherein the requesting client invokes the one-way HAG service.

11. A method of transmitting information between a source security domain associated with a first security classification to one of a plurality of destination security domains associated with a second security classification, comprising the steps of:

transmitting a target service request from a client to a source two-way high assurance guard (HAG) service;

generating a unique token from the target service request, the token associating the target service request with the client;

transmitting the target service request and the token to a destination two-way HAG service via a first source one-way HAG service, a HAG and a first destination one-way HAG service;

executing the target service request to produce response data;

transmitting the response data and the token from the destination two-way HAG service to the source two-way HAG service via a second destination one-way HAG service, a second HAG, and a second source one-way HAG service; and

delivering the response data to the client.

12. The method of claim 11, wherein:

the target service request is generated in a thread executing in the first security classification; and

the thread is suspended after transmitting the target service request and the token to the destination two-way HAG service and resumed upon receipt of the response data and the token in the source two-way HAG service, using the token.

13. The method of claim 12, wherein the step of transmitting the target service request and the token to the destination two-way HAG service via the first source one-way HAG service, the HAG, and the first destination one-way HAG service comprises the steps of:

transmitting the target service request and the token to a first source one-way HAG service;

suspending execution of the thread;

transmitting the target service request and the token from the first source one-way HAG service to a first destination one-way HAG service in the destination security domain via a HAG communicatively coupling the first security domain and the second security domain; and

routing the target service request and the token from the first destination one-way HAG service to a destination two-way HAG service in the destination security domain.

14. The method of claim 12, wherein the step of transmitting the response data and the token from the destination two-way HAG service to the source two-way HAG service via a second destination one-way HAG service and the second source one-way HAG service comprises the steps of:

generating a two-way source HAG service request having the response data and the token;

transmitting the two-way HAG service request to a second destination one-way HAG service;

transmitting the two-way source HAG service request to a second source one-way HAG service via the second HAG;

routing the two-way source HAG service request to the two-way source HAG service to extract the response data and the token; and

resuming execution of the thread in the source security domain using the token.

15. The method of claim 14, wherein the step of generating a two-way source HAG service request having the response data and the token comprises the step of wrapping the response data and the token in a two-way source service request.

16. The method of claim 11, wherein the target service request is wrapped by the client and extracted by the source two-way HAG service.

17. An apparatus for transmitting a target service request to a target service and receiving a response therefrom, comprising

a source security domain associated with a first security classification, the source security domain including a source two-way high assurance guard (HAG) service communicating with a first source one-way HAG service and a second source one-way HAG service;

a destination security domain associated with a second security classification, the destination security domain comprising a destination two-way HAG service communicating with a first destination one-way HAG service and a second destination one-way HAG service;

a first HAG, communicatively coupling the first source one-way HAG service and the first destination one-way HAG service; and

a second HAG, communicatively coupling the second destination one-way HAG service and the second source one-way HAG service;

wherein the source two-way HAG service accepts the target service request from a client, generates a unique token from the target service request, the token associating the target service request with the client, and transmits the target service request and the token to the destination two-way HAG service via the first source one-way HAG service, the HAG and the first destination one-way HAG;

wherein the target service executes the target service request to produce response data; and

wherein the destination two-way HAG service receives the response data and transmits the response data and the token from the destination two-way HAG service to the source two-way HAG service via the second destination one-way HAG, the second HAG and the second source one-way HAG service to deliver the response data to the client.

18. The apparatus of claim 17, wherein:

the target service request is generated in a thread executing in the source security domain; and

the thread is suspended after transmitting the target service request and the token to the destination two-way HAG service and resumed upon receipt of the response data in the source two-way HAG service using the token.

19. The apparatus of claim 18, wherein the source two-way source HAG service request having the response data and the token is generated by wrapping the response data and the token in a source two-way source service request.

20. The apparatus of claim 19, wherein the target service request is wrapped by the client and extracted by the source two-way HAG service.