System and method for providing secure internetwork services via an assured pipeline

• US 7,730,299 B2
• Filed: 01/30/2007
• Issued: 06/01/2010
• Est. Priority Date: 10/12/1994
• Status: Expired due to Fees

• Current Assignee: McAfee, LLC
• Original Assignee: Secure Computing LLC (McAfee, LLC)
• Inventors: Hammond, Scott W., Gooderum, Mark P., Boebert, William E., Rogers, Clyde O., Andreas, Glenn
• Primary Examiner(s): LUU, LE HIEN
• Application Number:
  US11/669,025
• Publication Number:
  US 20070226789A1
• Time in Patent Office: 1,218 Days
• Field of Search: 713/153, 713/152, 713/164, 713/161, 713/162, 713/15, 713/201, 709/229, 380/44
• US Class Current: 713/153
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

A system and method for the secure transfer of data between a workstation connected to a private network and a remote computer connected to an unsecured network. A secure computer is inserted into the private network to serve as the gateway to the unsecured network and a client subsystem is added to the workstation in order to control the transfer of data from the workstation to the secure computer. The secure computer includes a private network interface connected to the private network, an unsecured network interface connected to the unsecured network, wherein the unsecured network interface includes means for encrypting data to be transferred from the first workstation to the remote computer and a server function for transferring data between the private network interface and the unsecured network interface.

Claims

1. A firewall device comprising:

a processor;

a memory; and

a secure operating system having an operational kernel and an administrative kernel, wherein the operational kernel includes a Type Enforcement security mechanism for restricting execution of files stored in the memory by the processor, further wherein execution restrictions placed on files in the memory can only be modified from within the administrative kernel.

2. The firewall device of claim 1, further comprising:

executable instructions stored in the memory and operable on the processor for causing the firewall device to filter network traffic received over a network interface.

3. The firewall device of claim 1, wherein the firewall device includes a virtual page translator having page access control bits and wherein the secure operating system uses the page access control bits to ensure that resource protection checks are not avoided.

4. The firewall device of claim 1, wherein the secure operating system prevents access to executable objects that have not been recognized as a trusted executable object.

5. A server comprising:

a processor;

a secure operating system having a security mechanism for restricting access by processes to server resources, wherein the security mechanism includes a means for establishing an assured pipeline between processes operating in different domains; and

a firewall operating on the processor, wherein the firewall interacts with the secure operating system to limit interactions between processes in different.

6. The server of claim 5, wherein the security mechanism is a Type Enforcement security mechanism.

7. The server of claim 5, wherein the security mechanism is a multilevel secure computer mechanism.

8. The server of claim 5, wherein the security mechanism prevents execution of executable objects that have not been recognized as a trusted executable object.

9. The server of claim 5, wherein the processor includes a virtual page translator having page access control bits and wherein the secure operating system uses the page access control bits to ensure that file protection checks are not avoided.

10. The server of claim 5, further comprising:

a memory;

a first network interface;

a second network interface; and

software in the memory that is operable on the processor for causing the server to;

encrypt outbound network traffic received on the first network interface;

send the encrypted outbound network traffic over the second network interface;

decrypt inbound network traffic received on the second network interface; and

send the inbound decrypted network traffic on the first network interface.

11. The server of claim 10 wherein the firewall uses the assured pipeline to communicate data between the first and second network interfaces.

12. The server of claim 11, wherein the means for establishing the assured pipeline comprise:

a means for performing a file permission check; and

a means for performing a secure operating system permission check.

13. A method of securing server resources, the method comprising:

restricting access by a process in an external domain to a server resource in the internal domain using a secure operating system, wherein the secure operating system includes a security mechanism for establishing an assured pipeline between one or more processes in the external domain and one or more processes in the internal domain;

operating a firewall on the server'"'"'s processor, wherein the firewall interacts with the secure operating system to limit interactions between processes in different domains according to a security policy.

14. The method of claim 13, wherein the security mechanism is a Type Enforcement security mechanism.

15. The method of claim 13, wherein the security mechanism is a multilevel secure computer mechanism.

16. The method of claim 13, wherein the security mechanism includes preventing execution of executable objects that have not been recognized as a trusted executable object.

17. The method of claim 13, wherein the secure operating system uses page access control bits to ensure that file protection checks are not avoided.

18. The method of claim 13, further comprising:

encrypting outbound network traffic received over a first network interface;

sending the encrypted outbound network traffic over a second network interface;

decrypting inbound network traffic received on the second network interface; and

sending the inbound decrypted network traffic on the first network interface.

19. The method of claim 18, wherein operating the firewall includes establishing the assured pipeline between the first and second network interfaces.

20. The method of claim 19, wherein establishing the assured pipeline includes:

performing a file permission check; and

performing a secure operating system permission check.

21. A secure system for transferring data between computers across a public network, the system comprising:

a workstation connected to an internal network;

a gateway computer connected to the internal network though a first network interface and connected to the public network though a second network interface, wherein the gateway computer includes a means for establishing an assured pipeline between the first and second network interfaces, receives data from the workstation on the first network interface, encrypts the received data, and transmits the encrypted data using the second network interface; and

a remote computer connected to the external network configured to receive the encrypted data from the gateway computer.