Ruggedized, compact and integrated one-way controlled interface to enforce confidentiality of a secure enclave

• US 9,305,189 B2
• Filed: 04/14/2010
• Issued: 04/05/2016
• Est. Priority Date: 04/14/2009
• Status: Active Grant

• Current Assignee: OWL Cyber Defense Solutions LLC
• Original Assignee: Owl Computing Technologies, Inc.
• Inventors: Mraz, Ronald, Staubly, Steven
• Primary Examiner(s): POTRATZ, DANIEL B
• Application Number:
  US12/760,162
• Publication Number:
  US 20120030768A1
• Time in Patent Office: 2,183 Days
• Field of Search: 713/151, 713/152, 713/168, 713189-194, 726/17, 726/26, 726/27, 726/29, 705/56, 380/202
• US Class Current: 1/1
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/82 Protecting input, output or interconnection devices
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: G06F 21/86 Secure or tamper-resistant housings

Abstract

A rugged, integrated network interface appliance for ensuring secure data transfer comprising send-only network interface circuitry comprising a microprocessor, a program memory, a first host interface, and a first serial interface; receive-only network interface circuitry comprising a microprocessor, a program memory, a second host interface, and a second serial interface; a single data link connecting the first serial interface of the send-only network interface circuitry to the second serial interface of the receive-only network interface circuitry that is configured such that the send-only network interface circuitry is configured not to receive any data from said data link, and the receive-only network interface circuitry is configured not to send any data to said data link.

Claims

1. A ruggedized network interface appliance for ensuring secure data transfer comprising:

send-only network interface circuitry comprising a processor, a program memory, a first host interface, and a first serial interface;

receive-only network interface circuitry comprising a processor, a program memory, a second host interface, and a second serial interface;

a single data link connecting the first serial interface of the send-only network interface circuitry to the second serial interface of the receive-only network interface circuitry;

wherein the send-only network interface circuitry is configured not to receive any data from said data link, and said receive-only network interface circuitry is configured not to send any data to said data link; and

wherein the send-only network circuitry and the receive-only network circuitry reside on a single circuit board,

wherein the single circuit board has three separate contiguous areas, a first area containing the send-only network circuitry, a second area containing the receive-only network circuitry and a third area disposed directly between the first area and the second area containing no electrical connections between the first area and the second area, and

wherein the single data link comprises only a single optical isolator device which spans the third area but has no connection thereto.

2. The network interface appliance of claim 1 wherein said data link is an optical link.

3. The network interface appliance of claim 1 wherein at least one of said host interfaces is a USB interface.

4. The network interface appliance of claim 1 wherein at least one of said host interfaces is an Ethernet interface.

5. The network interface appliance of claim 1 wherein at least one of said host interfaces is a RS-232 interface.

6. The network interface appliance of claim 1 wherein the network interface appliance has a data throughput of at least 1 Mbps.

7. The network interface appliance of claim 1 wherein at least one of the first host interface and the second host interface uses a ruggedized connector.

8. The network interface appliance of claim 7 wherein the ruggedized connector is keyed to physically enforce the unidirectionality of the data flow.

9. The network interface appliance of claim 1 wherein the send-only and receive-only circuitry are configured to filter data passing through the network interface appliance.

10. The network interface appliance of claim 9 wherein the filtering is performed in the send-only circuitry.

11. The network interface appliance of claim 9 wherein the filtering is performed in the receive-only circuitry.

12. The network interface appliance of claim 9 wherein the data passing through the network interface appliance comprises Extensible Markup Language (XML) documents.

13. The network interface appliance of claim 12 wherein the filtering is accomplished using XML schema.

14. The network interface appliance of claim 13 wherein the filtering is configured such that documents conforming to preselected XML schema are assigned to preselected channels.

15. The network interface appliance of claim 14 wherein the channels through which the documents conforming to preselected XML schema can pass are user programmed via the first host interface.

16. The network interface appliance of claim 9 wherein the filtering can be user-configured via a connection to the first host interface.

17. The network interface appliance of claim 1, further comprising a single ruggedized housing, wherein all of the send-only network interface circuitry, the receive-only network interface circuitry and the single data link are contained within the housing.

18. The network interface appliance of claim 1 wherein the send-only and/or receive-only network circuitry implement bidirectional transfer protocols to pace data flow across the data link.

19. The network interface appliance of claim 18 wherein at least one of the send-only network interface circuitry and receive-only network interface circuitry implements TCP/IP protocols to pace data flow across the data link.

20. The network interface appliance of claim 18 wherein a software proxy application is used to implement bidirectional transfer protocols to pace data flow across the data link.

21. The network interface appliance of claim 1 wherein the unidirectionality of the data link is further maintained by software residing in said program memories.

22. The network interface appliance of claim 1, wherein the single circuit board and the send-only circuitry and receive-only circuitry residing on the single circuit board are potted in a solid material.