Enterprise cross-domain solution having configurable data filters

• US 9,380,023 B2
• Filed: 09/04/2013
• Issued: 06/28/2016
• Est. Priority Date: 05/13/2013
• Status: Active Grant

• Current Assignee: OWL Cyber Defense Solutions LLC
• Original Assignee: Owl Computing Technologies, Inc.
• Inventors: Mraz, Ronald, Hope, James
• Primary Examiner(s): Gee, Jason K.
• Assistant Examiner(s): Bucknor, Olanrewaju
• Application Number:
  US14/018,085
• Publication Number:
  US 20140337410A1
• Time in Patent Office: 1,028 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols

Abstract

A cross-domain system for transferring files from a client to a server. A first server in the first network domain receives and stores files from the client via the first network. The received files are processed based on predetermined instructions stored in an associated file. The processed received files are transmitted to a second server via a one-way data link. The second server in the second network domain receives and stores the processed received files. The received files are further processed based on predetermined instructions stored in an associated file. The further processed received files are transmitted to the server via the second network. The two associated files are stored in permanent memory with security policies which prevent the files from disrupting operation of the first and second servers, respectively. The security policies allow the associated files to be overwritten to update the processing performed by the associated server.

Claims

1. A cross-domain system for transferring files from a client coupled to a first network in a first network domain to a server coupled to a second network in a second network domain, the cross-domain system comprising:

a first server in the first network domain having an input adapted to receive files from the client via the first network and store the received files in a first temporary memory, the first server configured to process the received files based on predetermined instructions stored in at least one associated first file stored in a first permanent memory, the first server also having an output for transmitting the processed received files;

a one-way data link having an input coupled to the output of the first server and an output; and

a second server in the second network domain having an input adapted to receive the processed received files from the first server via the one-way data link and store the received files in a second temporary memory, the second server configured to further process the received files based on predetermined instructions stored in at least one associated second file stored in a second permanent memory, the second server also having an output adapted to transmit the further processed received files to the server via the second network;

wherein the first server is configured to store the at least one associated first file in the first permanent memory with first security policies which prevent the at least one associated first file from disrupting operation of the first server;

wherein the second server is configured to store the at least one associated second file in the second permanent memory with second security policies which prevent the at least one associated second file from disrupting operation of the second server;

wherein the first and second servers are configured to allow the at least one associated first file and the at least one associated second file to be overwritten to update the processing performed by the first server and the second server, respectively, while maintaining the respective security policies applied to such files.

2. The system of claim 1, wherein the first permanent memory and the second permanent memory each constitute a hard disk.

3. The system of claim 1, wherein the processing performed by the first server constitutes filtering.

4. The system of claim 3, wherein the at least one associated first file contains instructions which cause all files to be blocked from being transmitted on the output of the first server.

5. The system of claim 3, wherein the at least one associated first file contains instructions for filtering the received file based on predetermined criteria specified by a customer.

6. The system of claim 1, wherein the processing performed by the second server constitutes filtering.

7. The system of claim 6, wherein the at least one associated second file contains instructions which cause all files to be blocked from being transmitted on the output of the second server.

8. The system of claim 6, wherein the at least one associated second file contains instructions for filtering the received file based on predetermined criteria specified by a customer.

9. A cross-domain system for transferring files from a client coupled to a first network in a first network domain to a server coupled to a second network in a second network domain, the cross-domain system comprising:

a first server in the first network domain having an input adapted to receive files from the client via the first network and store the received files in a first temporary memory, the first server configured to process the received files based on predetermined instructions stored in at least one associated first file stored in a first permanent memory, the first server also having an output for transmitting the processed received files;

a one-way data link having an input coupled to the output of the first server and an output; and

a second server in the second network domain having an input adapted to receive the processed received files from the first server via the one-way data link and store the received files in a second temporary memory, the second server also having an output adapted to transmit the received files to the server via the second network;

wherein the first server is configured to store the at least one associated first file in the first permanent memory with security policies which prevent the at least one associated first file from disrupting operation of the first server;

wherein the first server is configured to allow the at least one associated first file to be overwritten to update the processing performed by the first server, while maintaining the security policies applied to such file.

10. The system of claim 9, wherein the first permanent memory and the second permanent memory each constitute a hard disk.

11. The system of claim 9, wherein the processing performed by the first server constitutes filtering.

12. The system of claim 11, wherein the at least one associated first file contains instructions which cause all files to be blocked from being transmitted on the output of the first server.

13. The system of claim 11, wherein the at least one associated first file contains instructions for filtering the received file based on predetermined criteria specified by a customer.

14. A cross-domain system for transferring files from a client coupled to a first network in a first network domain to a server coupled to a second network in a second network domain, the cross-domain system comprising:

a first server in the first network domain having an input adapted to receive files from the client via the first network and store the received files in a first temporary memory, the first server also having an output for transmitting the received files;

a one-way data link having an input coupled to the output of the first server and an output; and

a second server in the second network domain having an input adapted to receive the received files from the first server via the one-way data link and store the received files in a second temporary memory, the second server configured to process the received files based on predetermined instructions stored in at least one associated second file stored in a second permanent memory, the second server also having an output adapted to transmit the processed received files to the server via the second network;

wherein the second server is configured to store the at least one associated second file in the second permanent memory with security policies which prevent the at least one associated second file from disrupting operation of the second server;

wherein the second server is configured to allow the at least one associated second file to be overwritten to update the processing performed by the second server, while maintaining the security policies applied to such file.

15. The system of claim 14 wherein the first permanent memory and the second permanent memory each constitute a hard disk.

16. The system of claim 14, wherein the processing performed by the second server constitutes filtering.

17. The system of claim 16, wherein the at least one associated second file contains instructions which cause all files to be blocked from being transmitted on the output of the second server.

18. The system of claim 16, wherein the at least one associated second file contains instructions for filtering the received file based on predetermined criteria specified by a customer.