Abstract:
A multi-class switching system that includes a coder/decoder for converting voice between analog and digital; a first switch coupled to the coder/decoder to isolate non-secure entities in a dial-up network, including fiber optic ports to pass classified and unclassified data to one of a classified IP network and an unclassified IP network, an encryption device coupled to the first switch to encrypt digitized voice, a second switch coupled to the encryption device and directly to the first switch, wherein the second switch receives encrypted digital voice from the encryption device connection and unencrypted digital voice from the direct connection, and wherein the first switch and the second switch operate in a plurality of states including secure, non-secure, and cut-off, a fiber optic (F/O) switch coupled to the coder/decoder, and at least one controller to control states of the first switch, the second switch, and the fiber optic (F/O) switch.

Description:
CROSS-REFERENCE AND PRIORITY CLAIM TO RELATED APPLICATION 
       [0001]    This patent application claims priority to provisional U.S. Patent Application Ser. No. 61/321,313, filed Apr. 6, 2010, and entitled “Multi-Class Switching System and Method”, the entire disclosure of which is incorporated herein by reference. 
     
    
     BACKGROUND OF THE INVENTION 
       [0002]    Industry and Government agencies are migrating away from integrated services digital network (ISDN) technology at video teleconference (VTC) endpoints. ISDN is a set of communications standards for simultaneous digital transmission of voice, video, data, and other network services over the traditional circuits of the public switched telephone network. In the new communications environment, switching devices will be directed to connecting two or more IP networks of varying classification. This new communication environment, and associated switching system, particularly when used by the military, security, and intelligences services, requires extraordinary means to ensure communications security. 
         [0003]    A number of Federal agencies are involved in certifying and validating hardware and software used in these communications systems so that such security can be insured. Use of the Internet has compounded the difficulty in ensuring this security, and has required rigorous testing regimes and complex designs for such communications system. Further aggravating the security issue is the movement toward a converged communications system—one in which all video, data, and voice communications flow though a common (and digital) gateway. A common reference for such a converged communications system in U.S. military circles is a net-centric system, which is intended to support Network Centric Warfare (NCW). 
         [0004]    Part of a converged communications system involves Voice Over Internet Protocol (VoIP), a technology that is a critical component of NCW, and is associated with potential command center desk top convergence, mobility enhancements, infrastructure reduction and multi-media collaboration. Implementing VoIP is a critical step to effectively converge all communications traffic (data, voice, video, etc.) onto an IP network that is central to effective NCW. 
       SUMMARY OF THE INVENTION 
       [0005]    The present invention relates to a multi-class switching system that includes a coder/decoder for converting voice between analog and digital; a first switch, e.g., red switch, coupled to the coder/decoder to isolate non-secure entities in a dial-up network and includes fiber optic ports to pass classified and unclassified data to one of a classified IP network and an unclassified IP network, an encryption device coupled to the first switch, e.g., red switch, to encrypt digitized voice, a second switch, e.g., black switch, coupled to the encryption device and directly to the first switch, e.g., red switch, wherein the second switch, e.g., black switch, receives encrypted digital voice from the encryption device connection and unencrypted digital voice from the direct connection, and wherein the first switch, e.g., red switch, and the second switch, e.g., black switch, operate in a plurality of states including secure, non-secure, and cut-off. There is a fiber optic (F/O) switch coupled to the coder/decoder, and at least one controller that includes a state control module, power-on/off logic, network cut-off logic, and remote control logic to control states of the first switch, e.g., red switch, the second switch, e.g., black switch, and the fiber optic (F/O) switch. The controller stores and retrieves sensitive coder/decoder parameters for operation of the coder/decoder, wherein the secure storage controller accesses the coder/decoder only when the first switch, e.g., red switch, and the second switch, e.g., black switch, both are in the cut-off state. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0006]    In the drawings, which are not necessarily drawn to scale or with correct proportions, like numerals describe substantially similar components throughout the several views. The drawings illustrate generally, by way of example, but not by way of limitation, various embodiments discussed in the present document. 
           [0007]      FIG. 1  illustrates a converged communication environment in which a multi-class switching system is implemented; 
           [0008]      FIG. 2  illustrates in block diagram form, an exemplary multi-class switching system installed in the converged communications environment of  FIG. 1 ; 
           [0009]      FIG. 3  is a block diagram illustrating various features of exemplary controllers used with the switching system of  FIG. 2 ; and 
           [0010]      FIGS. 4 and 5  are flowcharts illustrating exemplary operations of the switching system of  FIG. 2 . 
       
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
       [0011]    The following detailed description includes references to the accompanying drawings, which form a part of the detailed description. The drawings show, by way of illustration, specific embodiments in which the invention may be practiced. These embodiments, which are also referred to herein as “examples,” are described in enough detail to enable those skilled in the art to practice the invention. The embodiments may be combined, other embodiments may be used, or structural and logical changes may be made without departing from the scope of the present invention. The following detailed description is, therefore, not to be taken in a limiting sense, and the scope of the present invention is defined by the appended claims and their equivalents. In this document, the terms “a” or “an” are used to include one or more than one and the term “or” is used to refer to a nonexclusive “or” unless otherwise indicated. In addition, it is to be understood that the phraseology or terminology employed herein, and not otherwise defined, is for the purpose of description only and not of limitation. 
         [0012]      FIG. 1  shows a converged communications environment  1  for controlling and enforcing security of certain communications over a number of networks. The environment includes a number of “rooms”  2  that may communicate through an exemplary multi-class switching system  10  to other entities using one or more notional domains, or networks  4  (five are shown). Examples of the notional domains include unclassified ISDN, NIPRNet, Classified ISDN, SIPRNet, and JWICS. The Secret Internet Protocol Router Network (SIPRNet) is a system of interconnected computer networks used by the U.S. Department of Defense (DoD) and the U.S. Department of State to transmit classified information (up to and including information classified SECRET) via the TCP/IP protocol suite in a secure environment. SIPRNet also provides services such as hypertext document access and electronic mail. As such, SIPRNet, together with its counterpart, the TOP SECRET and SCI Joint Worldwide Intelligence Communications System (JWICS), is the DoD&#39;s classified version of the public Internet. 
         [0013]    The Non-classified Internet Protocol Router Network (NIPRNet) is used to exchange sensitive but unclassified information between “internal” users, as well as providing users, access to the Internet. NIPRNet is composed of Internet Protocol routers owned by the DoD. NIPRNet was created by the Defense Information Systems Agency (DISA) to supersede earlier networks. NIPRNet is, by design, a parallel air gapped analog to the SIPRNet, providing seamless interoperability for unclassified combat support applications, as well as providing a gateway to the public Internet. (An air gap is a security measure often taken for computers and computer networks that must be extraordinarily secure. The air gap ensures that a secure network is completely physically, electrically, and electromagnetically isolated from non-secure networks, such as the public Internet or a non-secure local area network. Limitations imposed on devices used in these environments may include a ban on wireless connections to or from the secure network or similar restrictions on electromagnetic leakage from the secure network through the use of TEMPEST or a Faraday cage. In environments where networks or devices are rated to handle different levels of classified information, the two (dis)-connected devices/networks are referred to as “low side” and “high side,” low being unclassified and high referring to classified, or classified at a higher level. This is also occasionally referred to as red or high (classified) and black or low (unclassified). To move data from the high (red) side to the low (black) side, it is necessary to write data to a physical medium, and the data to a device on the latter network. Data can move low-to-high with minimal processes while high-to-low requires much more stringent procedures to ensure protection of the data at a higher level of classification. 
         [0014]    Each of the “rooms”  2  may include specific communications components or processes  6 , including cameras, microphones, displays, CODECS, DVD/VCR(s), Blu-Ray™ components, and touch screens(s). 
         [0015]    The environment  1  also may connect communications points (not shown), that are fixed or mobile, distributed or centralized. For example, the “room”  2  may be implemented in a self-propelled vehicle, and may be used to communicate with other mobile assets and with fixed assets. The “room”  2  may communicate with other communications centers and communicate with, or control the communication to, from, and among less capable units, such as individual communications devices. Such individual communications devices include computers, telephones (fixed and mobile), radios, and any other communications device. The individual communications devices may be installed in any combination in one or more of the mobile and fixed assets. 
         [0016]    The controlled communications include voice, voice over IP (VoIP), data, and video. The communications means include wired communications using fiber optic, cable, and copper means. For example, the environment  1  may involve video conferencing among a number of distributed computers connected through a fiber optic network. The communications may be classified or unclassified, requiring a corresponding secure mode of communications and a corresponding non-secure mode of communications. 
         [0017]    Within the environment  1 , control of the communications, including communications security, is effected by the switching system  10 . Switching system  10  includes specific hardware devices, including switches, routers, modems, wiring, cabling and other signaling means, decoders, controllers, processors, storage units and interfaces. The switching system  10  also includes programming, embodied as software, hardware, or firmware, or any combination of software, hardware, or firmware, on one or more of the hardware devices or processors, as appropriate to support the functioning of the hardware devices. 
         [0018]      FIG. 2  is a block diagram of the exemplary switching system  10  for use in the converged communications environment of  FIG. 1 . The switching system  10  provides the following five features: 
         [0019]    1. Secure IP telephony, supporting encrypted voice/IP data and video communications on the same terminal, and that preferably: (a) complies with NATO SCIP standards; (b) supports National and NATO encryption algorithms; (c) supports H.323 and SIP signaling protocols; (d) is compliant with COTS and NATO SCIP IP telephone systems; (e) is compliant with Network Centric Warfare Concepts; and (f) is compliant with TACOMS Post 2000 criteria. 
         [0020]    2. Tactical IP Switches that are: (a) based on IP concepts; (b) support H.323 and SIP signaling protocols; (c) use F/O Gbit Ethernet Interface for the connection to other switches; (d) use 10/100 Base-T Ethernet interfaces to form high speed LANs; and (e) have H.323 Gatekeeper and SIP proxy server capabilities for management purposes of the VoIP call control functions. 
         [0021]    3. Gateway functions developed on switches to allow end-to-end encrypted voice calls between secure IP telephones and circuit switched voice terminals (ISDN, PSTN Network users). 
         [0022]    4. E 1 /E 2 /E 3  for connections to LAN/WANs and connections between tactical IP switches. 
         [0023]    5. ISDN PRI (DSS1 ITU Q.931 Signaling) for ISDN switch connections; V.35 for LAN/WAN, router connections; and radio interface (Combat Net Radio (CNR) Gateway Interface) for CNR radio connections. 
         [0024]    As can be seen in  FIG. 2 , switching system  10  interfaces include a man-machine interface (touch panel  50 ), a signage panel  60  (e.g., a LED display), network interfaces (IMUX  460 ), and other interfaces, all of which may be used to link to a number of different networks (or domains). The networks include dial-up network  20 , classified IP network  30 , and unclassified network  40 . Other network types may be part of the converged communications environment  1  (see  FIG. 1 ). 
         [0025]    The switches include a first switch, e.g., red switch,  420  and second switch, e.g., black switch,  430 . (Red and black are preferably used to refer respectively to secure and non-secure communications.) The controllers and processors include primary room controller (PRC)  200 , secure storage controller (SSC)  300 , and secure switch manager (SSM)  400 . The controllers communicate with certain of the other system  10  components using RS-232 protocols, for example. 
         [0026]    Certain of the hardware devices illustrated in  FIG. 2  may be rack-mounted in a single rack (not shown) or in multiple racks. The hardware devices may be electrically coupled for signaling purposes by wiring bundles or backplanes, or a combination of wiring bundles, cables, and backplanes. These coupling means may include shielding to eliminate the threat posed by EMI, and to prevent possible “eavesdropping.” These coupling means include fiber optic (F/O) cable as well as conventional copper wire. 
         [0027]    As can be appreciated from  FIG. 2 , the switching system  10  can operate in a secure mode and a non-secure mode. Within the secure mode, the system  10  may invoke two or more sub-modes. For example, the system  10  may provide for default operation in SECURE, SECRET, SECRET SAP, TOP SECRET, AND TOP SECRET SCI sub-modes. Selection of such sub-modes for operation of the system  10  may be by way of a user-entered choice. The thus-selected sub-mode may be displayed on the signage panel  60 . The touch panel  50  allows the user to enter a user-defined choice (e.g., CLASSIFIED) for operation of the system  10 , and subsequent display on the signage panel  60 . 
         [0028]    The switching system  10  non-secure default sub-modes of operation may include UNCLASSIFIED and MEETING IN PROGRESS. As with the secure mode, the non-secure mode allows a user-defined choice of operation, entered from the touch panel  50 . For example, if the user wants the signage panel  60  to show NON-SECURE, the user simply enters this choice from the touch panel  50 . 
         [0029]    In selecting sub-modes of operation, and for display of such sub-modes on the signage panel  60 , the user may make entries using a pull-down menu, a soft key pad, or any other well-known means for entering a choice on a touch screen. 
         [0030]    The signage panel  60  also may be used for other purposes, including display of a microphone (MIC) MUTE status. 
         [0031]    The PRC  200  also includes the hardware and programming (software and firmware) needed to invoke the various control functions available to a human user by way of the touch panel  50 . The PRC  200  controls the I/O, RS-232 and relays for operating the switching system  10  and for communications room operations. 
         [0032]    The secure storage controller  300  (SSC) is used for storing and retrieving sensitive CODEC parameters. Table 1 presents a nonexclusive listing of such CODEC parameters. 
         [0000]    
       
         
               
             
               
               
             
           
               
                 TABLE 1 
               
             
             
               
                   
               
               
                 CODEC PARAMETERS 
               
             
          
           
               
                 Parameter 
                 Notes 
               
               
                   
               
               
                 DHCP/static 
                 Defines whether to use DHCP or Static IP assignment. This 
               
               
                   
                 configuration only applies to IPv4. 
               
               
                 IP address 
                 Defines the IPv4 IP address to use. Only applicable if Static  
               
               
                   
                 IP assignment is being used. 
               
               
                 IP subnet 
                 Defines the subnet mask. Only applicable if Static IP 
               
               
                   
                 assignment is being used. 
               
               
                 IP gateway 
                 Defines the IP gateway. Only applicable if Static IP  
               
               
                   
                 assignment is being used. 
               
               
                 IP DNS #1 
                 Defines the network addresses for DNS servers. Up to 5 
               
               
                   
                 addresses may be specified. 
               
               
                 IP DNS #2 
                 Defines the network addresses for DNS servers. Up to 5 
               
               
                   
                 addresses may be specified. 
               
               
                 External 
                 Mode: &lt;On/Off&gt; Enables/disables External Services.  
               
               
                 Services 
                 External Services allows a third party integrator to present  
               
               
                   
                 services on the unit using XHTML 1.0 strict and HTTP. If  
               
               
                   
                 turned on, a menu choice will appear in the services menu,  
               
               
                   
                 and entering this the TANDBERG unit will retrieve a  
               
               
                   
                 default XHTML page as specified in the External Services  
               
               
                   
                 configuration menu. 
               
               
                 External 
                 Configures the External Services IP Address. 
               
               
                 Services IP 
                   
               
               
                 Address 
                   
               
               
                 Corporate 
                 Mode: &lt;On/Off&gt; Enables/disables use of a Corporate  
               
               
                 Directory 
                 Directory stored on a remote server. 
               
               
                 Corporate 
                 Specifies the IP address to the server where the Corporate 
               
               
                 Directory IP 
                 Directory is located. Example: xconfiguration 
               
               
                 Address 
                 corporatedirectory address: 10.47.6.75 
               
               
                 H.323 Call 
                 Mode: &lt;Direct/Gatekeeper/CallManager&gt; Defines how to 
               
               
                 Mode 
                 establish H.323 calls. Direct: An IP address must be used  
               
               
                   
                 in order to make a H.323 call. The system will not use a 
               
               
                   
                 gatekeeper or CallManager. Gatekeeper: The system will  
               
               
                   
                 use a gatekeeper to make a H.323 call. CallManager:  
               
               
                   
                 The system will use a CallManager to make a H.323 call.  
               
               
                   
                 Direct H.323 calls can be made even though the  
               
               
                   
                 H.323CallSetup Mode is set to Gatekeeper or Callmanager.  
               
               
                   
                 Example: xConfiguration H.323  
               
               
                   
                 CallSetup Mode: Gatekeeper 
               
               
                 Gatekeeper 
                 Discovery: &lt;Manual/Auto&gt; Auto: The system will 
               
               
                 Mode 
                 automatically try to register to any available gatekeeper.  
               
               
                   
                 If a gatekeeper responds to the request sent from the  
               
               
                   
                 CODEC 410 within 30 seconds this specific gatekeeper  
               
               
                   
                 will be used. This requires auto discovery on the  
               
               
                   
                 gatekeeper as well. If no gatekeeper responds, the system  
               
               
                   
                 will not use a gatekeeper for making H.323 calls and  
               
               
                   
                 hence an IP address must be specified manually. Manual:  
               
               
                   
                 The system will use a specific gatekeeper identified by  
               
               
                   
                 H.323 Gatekeeper Address. Example: xconfiguration  
               
               
                   
                 H.323 Gatekeeper discovery: manual 
               
               
                 Gatekeeper  
                 Specifies the IP Address of the Gatekeeper. 
               
               
                 IP Address 
                   
               
               
                 Call 
                 Specifies the IP Address of the Call Manager IP address. 
               
               
                 Manager IP 
                   
               
               
                 Address 
                   
               
               
                 Site ID 
                 Defines Site ID. 
               
               
                 E.164 alias 
                 Defines e.164 alias. 
               
               
                 SNMP mode 
                 Mode: &lt;On/Off/ReadOnly/TrapsOnly&gt; Enables or  
               
               
                   
                 disables SNMP service. If set to On, both Read and  
               
               
                   
                 sending of Traps will be enabled. If set to Off, all SNMP  
               
               
                   
                 functionality will be disabled. ReadOnly: The system  
               
               
                   
                 will not send SNMP traps, but it will be possible to read  
               
               
                   
                 data from the SNMP MIB. TrapsOnly: The system will  
               
               
                   
                 send SNMP traps, but it will not be possible to read data  
               
               
                   
                 from the SNMP MIB. Example: xconfiguration snmp  
               
               
                   
                 mode: readonly 
               
               
                 SNMP #1 IP 
                 Defines SNMP host addresses. Up to 3 addresses may be 
               
               
                 address 
                 specified. Defines the network addresses for DNS servers. 
               
               
                   
                 Example: xconfiguration snmp hostipaddr: 
               
               
                 SNMP #2 IP 
                 Defines SNMP host addresses. Up to 3 addresses may be 
               
               
                 address 
                 specified. Defines the network addresses for DNS servers. 
               
               
                   
                 Example: xconfiguration snmp hostipaddr: 
               
               
                 External 
                 Specifies the IP address to the External Manager/ 
               
               
                 Manager IP 
                 Management system. 
               
               
                 address 
                   
               
               
                 HTTP mode 
                 Mode: &lt;On/Off&gt; Enables or disables HTTP service. 
               
               
                 HTTPS 
                 Mode: &lt;On/Off&gt; Enables or disables HTTPS service. 
               
               
                 mode 
                   
               
               
                 Telnet mode 
                 Mode: &lt;On/Off&gt; Enables or disables Telnet service. 
               
               
                 SSH mode 
                 Mode: &lt;On/Off&gt; Enables or disables SSH service. 
               
               
                 FTP mode 
                 Mode: &lt;On/Off&gt; Enables or disables the systems  
               
               
                   
                 embedded FTP server. 
               
               
                   
               
             
          
         
       
     
         [0033]    Thus, the secure storage controller  300  stores IP addressing data and accesses the CODEC  410  to provide the IP addressing data for repopulating the CODEC  410  during a switch between secure and non-secure modes of the system  10 , and, as will be discussed below, anytime power is lost to either the first switch, e.g., red switch,  420  or the second switch, e.g., black switch,  430 . Moreover, access between the CODEC  410  and the secure storage controller  300  is allowed only when both the first switch, e.g., red switch,  420  and the second switch, e.g., black switch,  430  are in the cut-off state. This access restriction, invoked by programming in the secure storage controller  300  (e.g., the Isolation module  330 ), or alternatively in the primary room controller  200 , prevents any portion of a non-secure network contacting any portion of a secure network. 
         [0034]    The secure switch manager (SSM)  400  controls RS-232 communications between the PRC  200  and the SSC  300  and power to the media converters  470 . This communications path between the PRC  200  and the SSC  300  is activated only when the switching system  10  is in secure mode. During non-secure operations, the RS-232 path between the PRC  200  and SSC  300  is cut-off. In an embodiment, the SSM  400  has a total of seven (7) isolated form “C” relay outputs (rated at 1 amp @ 120 VAC/28 VDC) that can be activated via positive (+) low current trigger inputs (rated at 3 to 24 VDC @ 2 mA minimum). When applied in two domain IP systems, three outputs will connect or disconnect the Tx, Rx, and Gnd RS-232 connectivity between the PRC  200  and the SSC  300 . Two outputs will cut power on or off to the non-secure and secure media converters  470 , depending on the selected state. 
         [0035]    The first switch, e.g., red switch,  420  and the second switch, e.g., black switch,  430  are dual channel fiber optic (F/O) switching units. Each channel has three position states: SECURE (A) position, NON-SECURE (B) position, and CUT-OFF (C) position. The operational programming of the switches  420  and  430  may be specific per their environment and application. Each channel within a switch  420 / 430  can be independently controlled by various means of actuation. The means of control include: manual control via front panel push button; contact closure control from a remote set of open/close contacts wired to the remote port of the switch; and RS232 serial command controls as issued from a remote device capable of sending and receiving ASCII characters. Both the first switch, e.g., red switch,  420  and second switch, e.g., black switch,  430  may be certified through common criteria EAL4 testing. 
         [0036]    The first switch, e.g., red switch,  420  provides for both RS-530 and IP switching. Channel one (Ch1) allows the user the capability of sharing a single DB25/F interface device connected to the common port among two other DB25/M devices connected to the “SECURE” and “NON-SECURE” DB25 ports. Channel two (Ch2) allows the user the capability of sharing a 10/100 Base-T device connected to the common port among two duplex ST (1300 nm wavelength) Fiber Optic devices connected to SECURE and NON-SECURE Fiber Optic ports. The Fiber Optic ports connect to media converters  470  and the output (i.e., the connection between the red switch  420  and the CODEC  410 ) of the IP side of the red switch  420  is a copper Ethernet port connecting to the CODEC  410 . The output of the red switch  420  does not require a separate media converter because media conversion between fiber and copper takes place in the red switch  420 . Because the first switch, e.g., red switch,  420  is TEMPEST approved, fiber optic modems are not needed. Both channels allow the user to set the switches  420  and  430  to the CUT-OFF position, which stops any and all data throughput for the switch. Switching may be controlled locally by manually operating front panel push buttons. Alternatively, the first switch, e.g., red switch,  420  may be controlled remotely using the DB9 Control port located on the rear of the unit using either contact closures or an RS-232 command interface. The switch unit housing the first switch, e.g., red switch,  420  includes front panel LED displays that indicate the respective switch position and unit power status. All ports (SECURE, NON-SECURE, and COMMON) for the first switch, e.g., red switch,  420  are transparent to all data going through that switch. If power to the first switch, e.g., red switch,  420  is removed, both switches  420 / 430  will be automatically set to the CUT-OFF position. When power is restored, each switch  420  and  430  will move to the programmed default position (see Table 2). 
         [0037]    For the second switch, e.g., black switch,  430 , channel one allows the user the capability of sharing a single DB25/M interface device connected to the common port among two other DB25/F devices connected to the SECURE and NON-SECURE DB25 ports. Channel two allows the user the capability of sharing a single RJ45 device connected to the common port with two other RJ45 devices connected to the SECURE and NON-SECURE RJ45 ports. Both channels allow the user to set the switches to the CUT-OFF position, which stops any and all data throughput for the switch. The second switch, e.g., black switch,  430 , may be controlled locally by manually operating front panel push buttons or remotely from the DB9 Control port located on the rear of the switch unit using either contact closures or an RS-232 command interface. Front panel LED displays indicate the respective switch position and unit power status. All ports (SECURE, NON-SECURE, and COMMON) for the second switch, e.g., black switch,  430 , are transparent to all data going through that switch. If power to the second switch, e.g., black switch,  430  is removed, both switches  430  and  420  will be automatically set to the CUT-OFF position. When power is restored, each switch  420 / 430  will move to the programmed default position (see Table 2). 
         [0038]    For the second switch, e.g., black switch  430 , channel one allows the user the capability of sharing a single DB25/M interface device connected to the common port among two other DB25/F devices connected to the SECURE and NON-SECURE DB25 ports. Channel two allows the user the capability of sharing a single RJ45 device connected to the common port with two other RJ45 devices connected to the SECURE and NON-SECURE RJ45 ports. Both channels allow the user to set the switches to the CUT-OFF position, which stops any and all data throughput for the switch. The second switch, e.g., black switch  430  may be controlled locally by manually operating front panel push buttons or remotely from the DB9 Control port located on the rear of the switch unit using either contact closures or an RS-232 command interface. Front panel LED displays indicate the respective switch position and unit power status. All ports (SECURE, NON-SECURE, and COMMON) for the second switch, e.g., black switch  430  are transparent to all data going through that switch. If power to the second switch, e.g., black switch  430  is removed, and then restored, it will power up in the CUT-OFF position. If system power is lost, both switches  420 / 430  will be automatically set to the CUT-OFF position until the PRC initializes each switch  420 / 430  to the programmed default position (see Table 2). 
         [0039]    The CODEC  410  may be implemented as software (i.e., a computer program), as hardware, or both. The CODEC  410  is capable of encoding and decoding a digital data stream or signal. The CODEC  410  as used in the switching system  10  converts audio analog to digital (V.35-412) and computer digital sound back to audio. 
         [0040]    The CODEC  410  receives IP addressing data from the SSC  300  during every change of state in the system  10 , and every mode change between secure and non secure. The CODEC  410  then reboots, and the desired mode of operation is placed into effect. 
         [0041]    Media converters  470  are coupled to the IP side of the red switch  420  as well as to each IP domain (i.e., the IP networks  30  and  40  in  FIG. 2 ). When a specific IP network is not in use, power is removed from the associated media converter  470  by operation of the PRC  200  and SSM  400 . 
         [0042]    Encryption Device  440  is used to encrypt and decrypt digital voice communications using a NSA-approved encryption algorithm. 
         [0043]    Dial isolator  450  is used for secure dialing from the CODEC  410 . The isolator  450  provides the necessary separation, e.g., red/black, on the RS-366 communication path. 
         [0044]    IMUX  460  enables the RS-530 serial and RS-366 dialing protocols to provide communications to the ISDN network. 
         [0045]      FIG. 3  is a block diagram illustrating various features of exemplary controllers (PRC  200  and SSC  300 ) used with the switching system  10 . The PRC  200  and SSC  300 , as well as the SSM  400  (not shown in  FIG. 3 ) may include programming on a single processor or multiple processors. Multiple processors may be installed in the same physical platform or in separate platforms. The programming may be software that is loaded into memory. Alternatively, some or all of the programming may be implemented in hardware. In  FIG. 3 , programming components of the PRC  200  include the following modules: a touch panel control module  210  that implements the touch panel functionality, including communications between the touch panel  50  and other components of the switching system  10 ; a CODEC control module  220  that controls operation of the CODEC  410 ; signage control module  230  that controls the display shown on signage  60 ; and secure storage isolation module  240  that works in conjunction with the SSC  300  to ensure that the address data retained in the SSC  300  is never accessible from an outside network. 
         [0046]    The SSC  300  includes the following programming modules: an address store  310  that maintains a persistent store of IP address and other related information, and that repopulates the CODEC  410  upon system  10  reboot; a secure/non-secure sensing module that senses when the system  10  is operating in a secure or non-secure mode, and when power is lost to certain components (e.g., the first switch, e.g., red switch,  420  or the second switch, e.g., black switch,  430 ) of the system  10 ; and isolation module  330  that isolates the SSC  300  from other components of the system  10  under defined operation conditions of the system  10 . 
         [0047]    The PRC  200  controls the transitioning of system  10  components, including changes in software states, power on/off, and network connection/cut-off. For example, to securely transition the CODEC  410  from unclassified to classified use, the CODEC  410  is placed in a transition state where it disconnects from the network and all residual information is removed. The processes by which this is accomplished is called periods processing. For a single CODEC and shared peripherals, on a classified CODEC the audio/video media stream is classified information. Other information such as IP addresses, address book entries, call logs and call data records are sensitive information that may be considered classified. 
         [0048]    Software states include power up and power down. For power up, in addition to VTC calls, customers also use their VTC rooms for in-room meetings and briefings; therefore, the power up sequence defaults to network cut-off so as to prevent accidental or intentional connections from remote sites during secure or non-secure meetings. 
         [0049]    Upon system power up, the following states are set: 
         [0000]    
       
         
               
             
               
               
               
               
             
           
               
                 TABLE 2 
               
             
             
               
                   
               
               
                 SOFTWARE STATE TABLE 
               
             
          
           
               
                   
                 Switch 
                 Description 
                 Default Power-Up 
               
               
                   
                   
               
               
                   
                 Red, Ch1 
                 Red RS-530 
                 Cut-Off 
               
               
                   
                 Red, FOS, Ch2 
                 IP 
                 Cut-Off 
               
               
                   
                 Black, Ch1 
                 Black RS-530 
                 Cut-Off 
               
               
                   
                 Black, Ch2 
                 Telephone 
                 Non-Secure (B) or Cut-Off 
               
               
                   
                   
               
             
          
         
       
     
         [0050]    The default power-up state for the first switch, e.g., red switch,  420  channel 2 (Ch2) is Cut-Off; however, the default setting may be changed to Non-Secure so that scheduling, control, and administration on the CODEC  410  can still take place using remote management software. The default Power-Up can be altered depending on specific customer requirements. 
         [0051]    During the system start-up phase the system  10  will go into Non-Secure mode by default. This will be indicated on the signage panel  60  and on the touch panel  50 . 
         [0000]    
       
         
               
             
               
               
               
               
             
           
               
                 TABLE 3 
               
             
             
               
                   
               
               
                 SOFTWARE STATE TABLE 
               
             
          
           
               
                   
                 Switch 
                 Description 
                 Default Start-Up 
               
               
                   
                   
               
               
                   
                 red, Ch1 
                 Red RS530 
                 Non-Secure (B) 
               
               
                   
                 red, FOS, Ch2 
                 IP 
                 Non-Secure (B) 
               
               
                   
                 black, Ch1 
                 Black RS530 
                 Non-Secure (B) 
               
               
                   
                 black, Ch2 
                 Telephone 
                 Non-Secure (B) 
               
               
                   
                   
               
             
          
         
       
     
         [0052]      FIGS. 4 and 5  are flowcharts illustrating exemplary operations of the switching system  10 .  FIG. 4  illustrates an exemplary process  600  for switching from non-secure to secure mode with a flowchart representative of the computer program instructions. In the description of the flowcharts, the functional explanation marked with numerals in angle brackets, &lt;nnn&gt;, will refer to the flowchart blocks bearing that number. 
         [0053]    The process begins, block &lt; 605 &gt;, when the PRC  200  receives a signal from the touch panel  50  confirming the end user&#39;s desire to change from non-secure mode to secure mode. Upon receipt of the confirmation signal in block &lt; 605 &gt;, the PRC  200  initiates a series of steps within the system  10 , including: 
         [0054]    &lt; 610 &gt;—red switch Ch1 switched to Cut-Off (C)&lt; 
         [0055]    &lt; 615 &gt;—red switch Ch2 switched to Cut-Off (C)&lt; 
         [0056]    &lt; 620 &gt;—black switch Ch1 switched to Cut-Off (C)&lt; 
         [0057]    &lt; 625 &gt;—black switch Ch2 switched to Cut-Off (C)&lt; 
         [0058]    &lt; 630 &gt;—Turn Off Secure Relay 
         [0059]    &lt; 635 &gt;—Turn Off Non-Secure Relay 
         [0060]    &lt; 640 &gt;—Turn Off Cut-Off Relay 
         [0061]    &lt; 645 &gt;—Turn Off Communications Relay (Disengage comms between SSC  300  and PRC  200 )&lt; 
         [0062]    &lt; 650 &gt;—Turn On Cut-Off Relay 
         [0063]    &lt; 655 &gt;—Turn On Communications Relay (Engage comms between SSC  300  and PRC  200 ) 
         [0064]    &lt; 660 &gt;—Poll the Secure Storage Controller (SSC)  300  via RS-232 to obtain the Sensitive IP Information required for use on the Secure network. 
         [0065]    &lt; 665 &gt;—Send Secure CODEC parameters from SSC  300  to the CODEC  410 . See Table 1 for a listing. 
         [0066]    &lt; 670 &gt;—Reboot the CODEC  410  and wait for CODEC to come up 
         [0067]    &lt; 675 &gt;—Turn Off Cut-Off Relay 
         [0068]    &lt; 680 &gt;—Turn On Secure Relay 
         [0069]    &lt; 685 &gt;—red switch Ch1 and Ch2 switched to secure (A)&lt; 
         [0070]    &lt; 690 &gt;—black switch Ch1 and Ch2 switched to secure (A)&lt; 
         [0071]    &lt; 695 &gt;—Update signage  60  to reflect SECURE 
         [0072]      FIG. 5  illustrates an exemplary process  700  for switching from secure to non-secure mode with a flowchart representative of the computer program instructions. In the description of the flowcharts, the functional explanation marked with numerals in angle brackets, &lt;nnn&gt;, will refer to the flowchart blocks bearing that number: 
         [0073]    In block &lt; 705 &gt;, the PRC  200  receives a confirmation signal sent by the user from the touch panel  50  to confirm the change to non-secure mode. The PRC  200  then initiates the following steps: 
         [0074]    &lt; 710 &gt;—Red switch Ch1 switched to Cut-Off (C)&lt; 
         [0075]    &lt; 715 &gt;—Red switch Ch2 switched to Cut-Off (C)&lt; 
         [0076]    &lt; 720 &gt;—Black switch Ch1 switched to Cut-Off (C)&lt; 
         [0077]    &lt; 725 &gt;—Black switch Ch2 switched to Cut-Off (C)&lt; 
         [0078]    &lt; 730 &gt;—Turn Off Secure Relay 
         [0079]    &lt; 735 &gt;—Turn Off Non-Secure Relay 
         [0080]    &lt; 740 &gt;—Turn Off Cut-Off Relay 
         [0081]    &lt; 745 &gt;—Turn Off Communications Relay (Engage comms between SSC  300  and PRC  200 )&lt; 
         [0082]    &lt; 750 &gt;—Turn On Cut-Off Relay 
         [0083]    &lt; 755 &gt;—Erase all sensitive IP Information within the codec 
         [0084]    &lt; 760 &gt;—Send non-secure codec parameters from the PRC  200  to the CODEC  410 . See Table 1 for a listing. 
         [0085]    &lt; 765 &gt;—Reboot the CODEC  410  to clear residual information on volatile memory and wait for Codec to come up 
         [0086]    &lt; 770 &gt;—Turn Off Cut-Off Relay 
         [0087]    &lt; 775 &gt;—Turn On Non-Secure Relay 
         [0088]    &lt; 780 &gt;—Red switch Ch1 switched to non-secure (B)&lt; 
         [0089]    &lt; 785 &gt;—Red switch Ch2 switched to non-secure (B)&lt; 
         [0090]    &lt; 790 &gt;—Black switch Ch1 switched to non-secure (B)&lt; 
         [0091]    &lt; 795 &gt;—Black switch Ch2 switched to non-secure (B)&lt; 
         [0092]    &lt; 800 &gt;—Update signage  60  to reflect NON-SECURE 
         [0093]    Thus, there has been shown and described several embodiments of a novel invention. As is evident from the foregoing description, certain aspects of the present invention are not limited by the particular details of the examples illustrated herein, and it is therefore contemplated that other modifications and applications, or equivalents thereof, will occur to those skilled in the art. The terms “have,” “having,” “includes” and “including” and similar terms as used in the foregoing specification are used in the sense of “optional” or “may include” and not as “required.” Many changes, modifications, variations and other uses and applications of the present construction will, however, become apparent to those skilled in the art after considering the specification and the accompanying drawings. All such changes, modifications, variations and other uses and applications, which do not depart from the spirit and scope of the invention, are deemed to be covered by the invention, which is limited only by the claims that follow. It should be understood that the embodiments disclosed herein include any and all combinations of features described in any of the dependent claims.