Abstract:
A method of operating a multi-level security system including the steps of providing a plurality of processors. At least some of said processors are equipped with a data card which permits simultaneous processing of different classification levels of information and the dynamic reallocation of processors to different classification levels.

Description:
CROSS REFERENCE TO RELATED APPLICATION  
       [0001]    This application claims rights under U.S. Provisional Patent Application Serial No. 60/406,758 filed Aug. 29, 2002. 
     
    
     
       BACKGROUND OF THE INVENTION  
         [0002]    1. Field of the Invention  
           [0003]    The present invention relates to signal and data processing, and in particular to methods and apparatus for granting privileged access to data and files by direct or indirect means. Still more particularly, the present invention relates to methods and apparatus for dynamically and automatically changing the classification level of processing elements.  
           [0004]    2. Brief Description of Prior Developments  
           [0005]    A multi-level security system is a system, which is capable of processing unclassified data, CONFIDENTIAL data, SECRET data, TOP SECRET data all in the same system. The conventional way that this function has been carried out is to physically separate processors. Some processors are dedicated to processing unclassified information while other processors are dedicated to processing SECRET information and still other processors are dedicated to processing TOP SECRET information. A possible problem with the above described approach is that at any instant in time the system may have much more unclassified information to process than classified information. The system may not, therefore, have enough processors to run the unclassified information, while other processors dedicated to classified information may be relatively underused.  
           [0006]    Multi-level security has been implemented before in large networks and in systems that are custom designed but have not been implemented using commercial off the shelf processor boards in an embedded processing system.  
           [0007]    A need therefore exists for a multi-level security system which efficiently makes use of all available computer assets. A need also exists for a multi-level security system which is capable of making use of off the shelf or other computers which may be readily available through commercial sources.  
         SUMMARY OF INVENTION  
         [0008]    The present invention is a small data card that fits on top of the board which allows the security level of the processor to be dynamically changed by changing the keying information in the data card. This data card is called the virtual private network (VPN) card and it serves to implement the multi-level security system.  
           [0009]    The data card which is included in the apparatus and method of the invention along with appropriate software that is an interface to a data fabric. The particular data fabric that we are pursuing currently is gigabit Ethernet although any data fabric would apply to this invention. The data fabric comes over the top of the circuit card, comes into the data card and goes into a government approved encryption device. The encryption device itself is conventional and well known to those skilled in the are and is available from various vendors and these are approved for use on encrypting classified information. Information is decrypted when it comes on to the board and encrypted when it comes off the board. This data card is always used in sets of cards and the basic concept is that when classified information at for example, the SECRET level needs to be transferred from one board to another board at the SECRET level that goes through the data card becomes encrypted and is put on the data fabric encrypted so that it is no longer classified information. It is then transferred over to the circuit card and it is decrypted and then sent to the commercial processing board where it is processed. Only cards that have the same key can process the SECRET information. The user has another circuit card with the VPN processing data at, for example, the CONFIDENTIAL level. Any attempt to send information from a SECRET module to a CONFIDENTIAL module will not succeed. The module will have a different key and that information will not be properly decrypted so it will not be received by the CONFIDENTIAL processing module. The user or controlling software then is provided a means to change the classification level of a processing card without any physical changes. For example, if a CONFIDENTIAL card wants to or needs to be changed or reallocated to SECRET processing, the trusted system software will zeroize the circuit card, clearing all the information of it, give it the SECRET level key and now that processor, which used to process CONFIDENTIAL information, is now capable of processing SECRET information. The VPN card provides the physical red/black boundary, making it possible to use commercial boards for classified processing, the unclassified information (black side) being the data fabric and the classified information (red side) being on the circuit card is on the data card. The user does not have to have any red/black boundaries on the commercial circuit card. The VPN card satisfies the requirements imposed by the government to implement the red/black boundary, some of those include tempest and encryption and these are all concentrated on to the small data card so that the user does not have to design the entire circuit card to the government specifications.  
           [0010]    For purpose of this disclosure, the term “red” refers to all types of classified information generally and the term “black” refers to unclassified information. As used hereafter “pink”, “purple” and “orange” are classes of “red”. 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0011]    The present invention is further described with reference to the accompanying drawings in which:  
         [0012]    [0012]FIG. 1 a  is a front perspective view of a commercial off the shelf (COTS) processor board with a virtual private network (VPN) encryptor peripheral component interconnect mezzanine card (PMC) daughter card which comprises a preferred embodiment of the method of the present invention;  
         [0013]    [0013]FIG. 1 b  is a schematic diagram showing the operation of the COTS processor and VPN encryptor shown in FIG. 1 a;    
         [0014]    [0014]FIG. 2 is a schematic diagram showing a method by which encrypted VPN supports red/black separation on a single data fabric as is used in a preferred embodiment of the method of the present invention;  
         [0015]    [0015]FIG. 3 is a schematic diagram showing encrypted VPN support of multi-level security as is used in a preferred embodiment of the method of the present invention;  
         [0016]    [0016]FIG. 4 is a schematic diagram illustrating a method by which the Information Security (INFOSEC) module controls intra-level communications and key management as is used in a preferred embodiment of the method of the present invention;  
         [0017]    [0017]FIG. 5 is a schematic diagram illustrating encrypted VPN permitting dynamic allocation of assets to different security levels as is used in a preferred embodiment of the method of the present invention;  
         [0018]    [0018]FIG. 6 is a schematic diagram illustrating the implementing of a communications path with reconfigurable assets as is used in a preferred embodiment of the method of the present invention; and  
         [0019]    [0019]FIG. 7 is a schematic diagram illustrating the implementing of a jammer with reconfigurable assets as is used in a preferred embodiment of the method of the present invention.  
     
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT  
       [0020]    Referring to FIG. 1 a , there is a COTS processor board  10  on which is affixed the VPN encryptor  12 , which is a PMC daughter card that makes use of an approved INFOSEC chip. This daughter card is designed to support red/black separation and is not a COTS product. The processor board runs on the red side. The backplane  14  isolates power and simple controls and forms another red/black boundary using techniques such as filters  16   18 .  
         [0021]    The COTS processor board  20  typically includes processors and memories  22 ,  24 ,  26 , and  28  which are interconnected with a data switch  30 . The data switch  30  is interconnected with a VPN encryptor  32  which has a key manager function  34  and a zeroised function  36  which are explained in greater detail hereafter.  
         [0022]    Referring to FIG. 2, there is a COTS general purpose processor board (GPP)  38  with an encrypted VPN  40  having a key  42  which is interconnected by way of a bus  43  to a second general purpose processor  44  with an encrypted VPN having a key  48 . This key  48  is the same as key  40 ; therefore, data  49  contained in general purpose processor  38  is encrypted by the VPN card  40 , transferred over the data fabric of bus  43 , is decrypted by the VPN card  46  and received by general purpose processor  44 . The information  49  exchanged between GPP  38  and GPP  44  (and received at GPP  44  as information  50 ) cannot be intercepted by unclassified GPP  52  or GPP  53  because the data is encrypted as it is transferred over the data fabric or bus  43 .  
         [0023]    Referring to FIG. 3, GPP  54  with an encrypted VPN  56  and key  58  is shown. This GPP is interconnected through bus  59  to a general purpose processor  60  with an encrypted VPN  62  and key  64 . Key  64  is different from key  68 ; therefore, data or message  66  in general purpose processor  54  is not encrypted as data message  67  in GPP  60 .  
         [0024]    Still referring to FIG. 3, there are two VPN cards  56  and  62  on GPP&#39;s  54  and  60  respectively which are keyed for two different classification levels, e.g. CONFIDENTIAL designated pink and SECRET designated purple and there is a message  66  which gets encrypted and gets put on the bus  59 , and is sent to the GPP  60  via the VPN  62 . This board tries to decrypt the message  66  with the wrong key, so that garbled information is received so it does not get the final message. All the information that goes across the data fabric is unclassified information which is either purely unclassified or classified information that has been encrypted and so unclassified GPPs  68  and  69 , cannot access any classified information. Accordingly, computers at the SECRET level can talk to each other. Computers at the TOP SECRET level can talk to each other. Computers at the unclassified level can talk to each other. Computers of different classification cannot directly communicate. If, for example, a SECRET computer tries to talk to a CONFIDENTIAL computer the information cannot go through. The only way the user can do that is to go through a government certified device that allows that type of information flow which is called the guard function. The guard function examines the content of messages, rate of messages, and other message parameters and determined, by a series of pre-defined security policies, whether the information should be permitted to cross between classification levels. So each type of GPP has a key at its own classification level and so if it is desired to change these from, for example, from TOP SECRET to SECRET, first the trusted software of this implementation deletes the keys and that makes the two boards unclassified. The key management function of this implementation then provides new keys. For example, if the user wants to change to the CONFIDENTIAL level he can have four boards that can run at the CONFIDENTIAL level. The user can also use the same boards to process unclassified information by zero zing the key. Now the user can run the GPP at the bypass mode and can run unclassified information on it.  
         [0025]    Referring to FIG. 4, there is an INFOSEC module with a VPN card  64  with keys  66 ,  68 , and  70 . There are also COTS general-purpose processors (GPP) with VPN cards  72 ,  74 ,  76 ,  78 ,  80 , and  82 . There are also unclassified GPP=s  84 ,  86 ,  88 , and  90 . In this arrangement the INFOSEC module  64  controls intra-level communications and key management. It is understood from the previous discussions that information can be passed over the data fabric or bus  91  between like classification levels, but not between different classification levels. It will be understood from FIG. 4 that information can be transferred between different classification levels only by passing the information through the trusted guard function on the INFOSEC module. It can be passed between the unclassified GPP&#39;s  84 ,  86 ,  88  and  90 . The information can also be passed directly between the boards at one classification level  80 ,  82  which are the same classification level. The information can be passed between boards at a different classification level  76  and  78  and all of these information transfers can occur at the same time. If a board at one classification level at GPP  80  attempts to send information to another GPP allocated to a different classification level at GPP  74  that information cannot be passed as was described in connection with FIG. 3. Instead, that information must got through an information security module which contains the keys for all classification levels and includes a trusted guard function which implements the security policies for sending information between different classification levels. If COTS GPP  82  has information that needs to be sent to COTS GPP  72  which is operating at a different classification level it is first sent to the INFOSEC module. The data is encrypted by the VPN at GPP  82 , goes across the data fabric, is decrypted by the VPN with the orange key. That information and then checked by the trusted guard function. If it meets the security policies, it is re-encrypted with the pink GPP  72  and the information is then sent over the data fabric encrypted with that key, decrypted by the VPN on processor  72  and the information then can be received.  
         [0026]    Referring to FIG. 5, there is an INFOSEC module with VPN card  92  with keys  94 ,  96 , and  98 . There are also COTS GPP&#39;s with VPN cards  100 ,  102 ,  104 ,  106 ,  108 , and  110  which have respectively keys  112 ,  114 ,  116 ,  118 ,  120 , and  122 . There are also unclassified GPP=s  124 ,  126 ,  128 , and  130 . In this arrangement the encrypted VPN permits dynamic allocation of assets to different security levels. It will be understood from FIG. 5 that the classification level of processors can be changed by the trusted software by deleting the key in the VPM module, zeroizing the COTS processor, which means wiping out any information in the memory, and reloading it with a different key. In this way the COTS processor can dynamically change from one classification level to another without the need to effect any physical changes to the system.  
         [0027]    Referring to FIG. 6, an arrangement is shown with an antenna  132 , a T/R switch  134 , a tuner  136 , an FPGA card  138 , GPP&#39;s with VPN cards  140  and  142 , which in this instance are set to perform unclassified processing, government authorized cryptographic equipment  144  implemented on the INFOSEC modules discussed earlier, and red side processing GPP with VPN card  146 . There is also a user interface (I/F) with VPN card  148  as well as another GPP with VPN card  150 , an exciter with VPN card  152 , a PA  154 , a T/R switch  156  and an antenna  158 . It will be understood from FIG. 6 and FIG. 7 generally, that one possible application of the invention in which the user has a multi-mission system which is to be capable of simultaneously performing communications, signal intelligence (SIGINT) and jamming. Conventionally these three capabilities are implemented by three totally separate systems and the security approach used today would prohibit those functions from being implemented simultaneously in the same system. It will be understood that the method and apparatus of this invention can allow information to be separated and allows the two functions to occur simultaneously. The solid line shows the receive communications path from the antenna  158  being received by the tuner  136  implementing a modem in the FPGA card  138  in the black side general purpose processor  140 . Additional black side processing occurring on the general purpose processor  142 . Information then goes to the crypto device  144  which may be the IFOSEC module  144  described in connection with FIG. 6. The information then gets the key change as described on FIG. 4 and is sent to the classified processing on the general purpose processor  146  is then sent out to the user to receive the data through the user interface  148 . The information to be transmitted from the user out the radio communication functions is received by the user interface  148  as SECRET level data and is sent over to a GPP the same classification level where the red side processing of the radio occurs. It is then sent over the data fabric to the crypto logical device located on the information security module  144  where the data is encrypted for transmission. From where it goes to the transmit black side processing at GPP  142  it then goes to a GPP  150  also on the black side where the transmit half of the modem is prepared, over the VPN in this case in the bypass mode because data is being transferred from a black processor to a black processor, out to the excitor  152  and the information is sent through the power amplifier  154  out to the transmit receive (TR) switch  156  and transmitted out the antenna  158 . In this way, the user can implement a secure radio using the invention as a reconfigurable software programmable radio.  
         [0028]    Referring to FIG. 7, an arrangement is shown in which there is a antenna  160 , a tuner  162 , an FPGA card  166 , a GPP with VPN card  166  for signal detection, a GPP with VPN card  168  for signal identification, a guard  170  with VPN card  170 , and a GPP with VPN card  172 . There is also a User I/F with VPN card  174 , a GPP with VPN card  176 , an exciter with VPN card  178 , a PA  180  and an antenna  182 . It will be understood from FIG. 7 that it is shown that the same hardware configuration used for communications in FIG. 6 can be used simultaneously for signals intelligence (SIGINT) simultaneously with communications signal jamming. For SIGINT the target signal is received by the antenna  160  and processed by the tuner  162  and then sent to the FPGA card  164  which implements a fast transform FFT. That information is then passed over the switch data fabric to the general purpose processor  166  which implements the signal detection function. The information is then passed to provide some additional classified processing. In order to accomplish this processing the information is sent to the guard function on the INFOSEC module  170  where it allows information to be passed in an unrestricted way from the unclassified side of the system to the classified side of the system but has a means to insure that no information can accidentally be leaked back in the other direction. The information is then encrypted with the classified level key on the VPN card mounted on the INFOSEC module  170  and sent over to the general purpose processor  168  which is running at the classified level. The processor then does a signal identification. That information is further processed and sent to another computer operating at the same classification level  172  that performs additional processing such as target identification. That information then is reported to the user, operating at the classified level and so it is sent across the VPN across the user interface and out to the user. In this way the user can get the SIGINT information that was processed by the system.  
         [0029]    Using the same hardware and running at the same time, communication signal jamming may be accomplished. A command comes from the user to perform the jamming through the user interface  174  this is a classified level command that is then sent over the VPN to the general-purpose processor  176 . That information is then sent to the exciter  178  where the RF signal is generated and it is sent to the power amplifier  180  and out the antenna  182 .  
         [0030]    It will be appreciated that a method and apparatus for operating a multi-level security system has been described which efficiently makes use of all available computer assets. It will also be appreciated that this method and apparatus can make use of off the shelf or other computers, which may be available through commercial sources.  
         [0031]    While the present invention has been described in connection with the preferred embodiments of the various figures, it is to be understood that other similar embodiments may be used or modifications and additions may be made to the described embodiment for performing the same function of the present invention without deviating therefrom. Therefore, the present invention should not be limited to any single embodiment, but rather construed in breadth and scope in accordance with the recitation of the appended claims.