User interface for providing voice communications over a multi-level secure network

• US 8,863,270 B2
• Filed: 01/13/2010
• Issued: 10/14/2014
• Est. Priority Date: 05/22/2009
• Status: Active Grant

• Current Assignee: Forcepoint Federal Holdings LLC (Forcepoint LLC)
• Original Assignee: Raytheon Company (Rtx Corporation)
• Inventors: Masiyowski, John F., Magon, Raymond A., Tierney, Michael O., Marchant, Robert L.
• Primary Examiner(s): Shiferaw, Eleni
• Assistant Examiner(s): CALLAHAN, PAUL E
• Application Number:
  US12/686,946
• Publication Number:
  US 20100299724A1
• Time in Patent Office: 1,735 Days
• Field of Search: 726/4, 726/14, 726/15, 726/30, 713/153, 713/166, 713/151, 713/156
• US Class Current: 726/15
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 65/103 in the network
• CPC Class Codes: H04L 65/1076 Screening of IP real time communications, e.g. spam over Internet telephony [SPIT]

Abstract

According to one embodiment, a computer system executing a computer program is coupled to multiple secure network domains configured in a multi-level security architecture. The computer program simultaneously establishes a voice connection with a first terminal configured on a first secure network domain and a second terminal configured on a second secure network domain. The computer program may then selectively couple an electroacoustical transducer to the first terminal or the second terminal, and generate an indicator on a user interface indicating the security level of the selected terminal.

Claims

1. A computer program product comprising:

executable code embodied on a non-transitory computer-readable medium, the nontransitory computer-readable medium, when operably coupled to a first computer system that is configured to display information on a user interface associated with a first terminal, the computer system coupled to a first secure network domain, enabling the computer system to execute the executable code so as to;

establish and monitor a plurality of independent voice sessions, each respective independent voice session comprising a voice connection established between the first terminal and at least one other terminal selected from one or more of a plurality of second terminals on a second secure network domain, the second secure network domain being separate and distinct from the first secure network domain;

display on the user interface, for each respective one of the plurality of independent voice sessions, a respective first indicator constructed and arranged to indicate the security level of the respective independent voice session, wherein each respective indicator remains on the user interface as long as the respective independent voice session exists;

present on the user interface at least one communication type indicator, the communication type indicator corresponding to at least one communication type selected from left ear, right ear, and speak, wherein the communication type indicator designates on the user interface which type of communication a corresponding second terminal is having with a user of the first terminal, wherein;

when the communication type indicator comprises left ear, then the communication type indicator identifies a first corresponding second terminal that is operably coupled to a left earpiece used by the operator of the first terminal;

when the communication type indicator comprises right ear, then the communication type indicator identifies a second corresponding second terminal that is operably coupled to a right earpiece used by the operator of the first terminal; and

when the communication type indicator comprises speak, then the second indicator identifies one or more third corresponding second terminals that are receiving voice signals generated by the operator of first terminal;

present on the user interface, for the at least one communication type indicator, a corresponding security indicator, the corresponding security indicator configured to indicate a security level of the corresponding first, second or third corresponding second terminal that is associated with the communication type indicator; and

dynamically modify each respective first indicator, during each respective independent voice session, to correspond to a change in the security level of the respective independent voice session that arises during the respective independent voice session.

2. The computer program product of claim 1, wherein the computer system further executes the executable code so as to:

generate, for each respective independent voice session, second and third indicators on the user interface, wherein the second indicator indicates a first security level of the first terminal, and the third indicator indicates a second security level of the second terminal, and wherein the second and third indicators, respectively, continue to be displayed on the user interface during each respective independent voice session as long as the first terminal and second terminal, respectively, are connected to each respective independent voice session.

3. The computer program product of claim 2, wherein the executable code, when executed by the computer system, is operable to

enable a third terminal in operable connection with one of the first secure network domain, second secure network domain, and a third secure network domain, the third secure network domain being separate and distinct from the first and second secure network domains, to join at least one existing independent voice session;

and

generate, for the at least one existing independent voice session, a fourth indicator on the user interface indicating the security level of the third terminal, wherein the fourth indicator remains on the user interface so long as the third terminal is connected to the existing independent voice session.

4. The computer program product of claim 2, wherein the code is further operable, for at least one existing respective independent voice session, to automatically change the second and third indicators, during the at least one existing respective independent voice session, such that each indicator represents a security level that is no higher than the lower of the security level of the first terminal and the security level of the second terminal.

5. The computer program product of claim 3, wherein the executable code, when executed by the computer system, is operable to;

detect when one of the first, second, and third terminals has left the at least one existing respective independent voice session; and

dynamically modify the first indicator, during the at least one existing respective independent voice session, to correspond to any changes in the security level of the at least one existing respective independent voice session resulting from one of the first, second, and third terminals leaving the at least one existing respective independent voice session.

6. The computer program product of claim 1, wherein the first secure network domain and the second secure network domain are configured in a multi-level security architecture.

7. The computer program product of claim 1, wherein the executable code, when executed by the computer system, is further operable to implement a positive inclusion mandatory access control (MAC) policy by authenticating only pre-registered users of the executable code.

8. The computer program product of claim 1, wherein a first security level of the first secure network domain is different from a second security level of the second secure network domain.

9. The computer program product of claim 1, wherein the code is further operable to define the security level of at least one respective independent voice session based at least in part on the security levels of each respective terminal connected to the at least one respective independent voice session, wherein the security level of the at least one respective independent voice session is dynamically configured, during the at least one respective independent voice session, to be no higher than the lowest security level of the security levels of all terminals connected to the at least one respective independent voice session.

10. The computer program product of claim 1, wherein the first indicator further comprises information indicating a security level of at least one of the first and second terminals.

11. The computer program product of claim 1, wherein the executable code, when executed by the computer system, is operable to:

configure the first and second terminals to communicate during the at least one respective independent voice session using one or more packet streams, each packet stream comprising at least one of an analog voice signal portion and a non-voice signal portion, the non-voice signal portion comprising a data signal comprising non-voice data and including no analog voice signals; and

restrict the communication of data signals between the first and second secure network domains to carry only the analog voice signal between the first and second network domains and to restrict communication of the data signal.

12. A computer implemented method comprising:

establishing and monitoring a plurality of independent voice sessions, each respective independent voice session comprising a voice connection established between a first terminal configured on a first secure network domain and a second terminal configured on a second secure network domain, the second secure network domain being separate and distinct from the first secure network domain;

generating, on a user interface associated with the first terminal, for each respective one of the plurality of independent voice sessions, a respective first indicator configured to indicate the security level of the first respective independent voice session, wherein each respective first indicator remains on the user interface during the respective independent first voice session;

presenting on the user interface at least one communication type indicator, the

communication type indicator corresponding to at least one communication type selected from left ear, right ear, and speak, wherein the communication type indicator designates on the user interface which type of communication a corresponding second terminal is having with a user of the first terminal, wherein;

when the communication type indicator comprises left ear, then the communication type indicator identifies a first corresponding second terminal that is operably coupled to a left earpiece used by the operator of the first terminal;

when the communication type indicator comprises right ear, then the communication type indicator identifies a second corresponding second terminal that is operably coupled to a right earpiece used by the operator of the first terminal; and

when the communication type indicator comprises speak, then the second indicator identifies one or more third corresponding second terminals that are receiving voice signals generated by the operator of first terminal;

presenting on the user interface, for the at least one communication type indicator, a corresponding security indicator, the corresponding security indicator configured to indicate a security level of the corresponding first, second or third corresponding second terminal that is associated with the communication type indicator; and

dynamically modifying each respective first indicator, during each respective independent voice session, to correspond to a change in the security level of the respective independent voice session that arises during the respective independent voice session.

13. The computer implemented method of claim 12, further comprising:

generating, for at least one respective independent voice session, second and third indicators on the user interface, wherein the second indicator indicates a first security level of the first terminal, and the third indicator indicates a second security level of the second terminal, wherein the second and third indicators, respectively, continue to be displayed on the user interface during the at least one respective independent voice session as long as the first terminal and second terminal, respectively, are connected to the at least one respective independent voice session.

14. The method of claim 13, further comprising dynamically changing, for at least one respective independent voice session, the second and third indicators, during the at least one respective independent voice session, to ensure that the second and third indicators each represents a security level that is no higher than the lowest security level of all terminals connected to the at least one respective independent voice session.

15. The computer implemented method of claim 12, wherein the first secure network domain and the second secure network domain are configured in a multi-level security architecture.

16. The computer implemented method of claim 12, further comprising:

enabling a third terminal in operable connection with one of the first secure network domain, second secure network domain, and a third secure network domain, the third secure network domain being separate and distinct from the first and second secure network domains, —

to join at least one existing independent voice session from the plurality of independent voice sessions; and

generating, for the at least one existing independent voice session, a fourth indicator on the user interface indicating the security level of the third terminal, wherein the fourth indicator remains on the user interface so long as the third terminal is connected to the at least one existing independent voice session.

17. The method of claim 16, further comprising:

detecting, for the at least one existing independent voice session, when one of the first, second, and third terminals has left the at least one existing independent voice session; and

dynamically modifying the first indicator, during the at least one existing independent voice session, to correspond to any changes in the security level of the at least one existing respective independent voice session resulting from one of the first, second, and third terminals leaving the at least one existing independent voice session.

18. The computer implemented method of claim 12, further comprising implementing a positive inclusion mandatory access control (MAC) policy by authenticating only pre-registered users of the executable code.

19. The computer implemented method of claim 12, wherein a first security level of the first secure network domain is different from a second security level of the second secure network domain.

20. The method of claim 12, further comprising defining the security level of at least one respective independent voice session based at least in part on the security levels of each respective terminal connected to the at least one respective independent voice session, wherein the security level of the at least one respective independent voice session is dynamically configured, during the at least one respective independent voice session, to be no higher than the lowest security level of the security levels of all terminals connected to the at least one respective independent voice session.

21. The method of claim 12, wherein the first indicator further comprises information indicating the security level of at least one of the first and second terminals.

22. The computer implemented method of claim 12, further comprising:

configuring the first and second terminals to communicate during the at least one respective independent voice session using one or more packet streams, each packet stream comprising at least one of an analog voice signal portion and a non-voice signal portion, the non-voice signal portion comprising a data signal comprising non-voice data and including no analog voice signals; and

restricting the communication of data signals between the first and second secure network domains to carry only the analog voice signal between the first and second network domains and to restrict communication of the data signal.

23. A system, comprising:

a user interface capable of displaying a plurality of respective first indicators corresponding to a plurality of respective independent voice sessions, wherein each indicator is indicative of at least one security level of a plurality of security levels, each respective first indicator corresponding to a security level of a respective independent voice session;

a computer system comprising at least one processor implemented at least partially in hardware in operable communication with the user interface, the computer system configured to;

establish the plurality of independent voice sessions, each respective independent voice session comprising a voice connection established between a first terminal configured on a first secure network domain, the first terminal in operable communication with the user interface, and at least one other terminal selected from a plurality of second terminals configured on a second secure network domain, the second secure network domain being separate and distinct from the first secure network domain;

configure the appearance of each respective the first indicator on the user interface to indicate the security level of the corresponding respective independent voice session, wherein each respective first indicator remains on the user interface during the respective independent voice session;

present on the user interface at least one communication type indicator, the communication type indicator corresponding to at least one communication type selected from left ear, right ear, and speak, wherein the communication type indicator designates on the user interface which type of communication a corresponding second terminal is having with a user of the first terminal, wherein;

when the communication type indicator comprises left ear, then the communication type indicator identifies a first corresponding second terminal that is operably coupled to a left earpiece used by the operator of the first terminal;

when the communication type indicator comprises right ear, then the communication type indicator identifies a second corresponding second terminal that is operably coupled to a right earpiece used by the operator of the first terminal; and

when the communication type indicator comprises speak, then the second indicator identifies one or more third corresponding second terminals that are receiving voice signals generated by the operator of first terminal;

present on the user interface, for the at least one communication type indicator, a corresponding security indicator, the corresponding security indicator configured to indicate a security level of the corresponding first, second or third corresponding second terminal that is associated with the communication type indicator; and

dynamically modify the appearance of each respective first indicator, during the voice session, to correspond to a change in the security level of the respective independent voice session that arises during the respective independent voice session.

24. The system of claim 23, wherein the computer system is further configured to:

generate, for each respective independent voice session, second and third indicators on the user interface, the second indicator indicating a first security level of the first terminal and the third indicator indicating a second security level of the second terminal, and wherein the second and third indicators, respectively, remain on the user interface during each respective independent voice session as long as the first terminal and second terminal, respectively, are connected to each respective independent voice session.

25. The system of claim 24, wherein the computer system is further configured to dynamically change the second and third indicators, during each respective independent voice session, to ensure that the second and third indicators each represents a security level that is no higher than the lowest security level of all terminals connected to the at least one respective independent voice session.

26. The system of claim 23, wherein, the first and second terminals are configured to communicate during the at least one respective independent voice session using one or more packet streams, each packet stream comprising at least one of an analog voice signal portion and a non-voice signal portion, the non-voice signal portion comprising a data signal comprising non-voice data and including no analog voice signals;

and

wherein the system further comprises means for restricting communication of data signals between the first and second secure network domains, the means for restricting communication configured and arranged to carry only the analog voice signal between the first and second network domains and to restrict communication of the data signal.

27. The system of claim 26, wherein the means for restricting communication comprises at least one of:

an analog voice bridge configured to decapsulate analog voice information from the packet stream to allow the analog voice signal portion to be transmitted while restricting passage of the data signals;

a network switch configured to restrict any packet stream that comprise data signals from being communicated outside of the respective first or second secure network domain; and

a packet filter configured to restrict access to at least one respective independent voice session only to those terminals having sufficient authorization for access to the at least one respective independent voice session.