Abstract:
A method for operating a multiple single levels of security (MSLS) system comprising the step of providing switched-circuit functionality between channels operating at the same level of security whereby MSLS requirements are met and intelligence is distributed in a way to minimize security certification effort, and apparatus operative for said method.

Description:
CROSS-REFERENCE TO RELATED APPLICATION  
       [0001]    The present application claims the benefit of Provisional Application Ser. No. 60/469,322 filed May 7, 2003, and entitled “Hardware Enforced Multiple Single Levels of Security For Distributed Processing.” The contents of that application are hereby incorporated by reference. 
     
    
     
       FIELD OF THE INVENTION  
         [0002]    The present invention relates generally to security systems for use in communication systems, and more particularly to such security systems that include Multiple Single Levels of Security (MSLS).  
         BACKGROUND OF THE INVENTION  
         [0003]    Present communication systems, typically bidirectional communication systems, whether for military, industrial or commercial use, or for use between private individuals, typically require separate physical systems for each security level supported. The requirements depend upon the types of information being communicated, and upon the parties involved in the communication.  
           [0004]    Different levels of security are defined in DOD 5200.28-STD, entitled “Department Of Defense Trusted Computer System Evaluation Criteria,” dated December 1985. In broad terms, the criteria are characterized by four divisions, namely “A, B, C, and D”. Division A is the highest protection, and is known as “Verified Protection.” The next level is “Division B: Mandatory Protection”; followed by “Division C: Discretionary Protection”; followed by the lowest level “Division D: Minimal Protection.” DOD5200.28-STD also provides the mandatory access control requirements for these levels of security.  
           [0005]    Particularly in the military fields, including the armed forces and DOD, and governmental agencies such as NASA, and many others, hierarchical mandatory access control is required. Similarly, hospitals and commercial companies, for example, may require non-hierarchical mandatory access control to be maintained for their information or material.  
           [0006]    One example of military use for Multiple Single Levels of Security (MSLS) is in Joint Tactical Radio Systems, known under the acronym JTRS. The present inventors recognize that known MSLS systems require involved security certifications, and typically have inadequate networking capability. Accordingly, the present inventors recognize that there is a need in the art for providing an MSLS system capable of meeting all of the security requirements of such systems, in addition to permitting the distribution of intelligence or secure information or material in a manner minimizing security certification efforts, while providing networking functionality between channels operating with the same security label. They further recognize that there is a present need for such MSLS records and apparatus not only for JTRS systems, but also for use in any applicable communication systems requiring MSLS.  
         SUMMARY OF THE INVENTION  
         [0007]    In one embodiment of the present invention a software defined JTRS radio system is provided that satisfies MSLS security requirements, by including means for permitting multiple channels to be utilized. Each channel is capable of operating with a different security label from all other channels in a manner minimizing security certification efforts between users of the JTRS radio systems. Another embodiment of the invention includes networking means for providing functionality or communication between channels operating with the same security label. In yet another embodiment of the invention, a system and method is provided for permitting multiple apparatus having a plurality of ports and/or channels to communicate via connection only of respective ports and/or channels having the same security label. 
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0008]    Various embodiments of the invention are described in detail below with reference to the drawings, in which like items are identified by the same reference designation, wherein:  
         [0009]    [0009]FIG. 1 is a functional block diagram showing one embodiment of the present invention;  
         [0010]    [0010]FIG. 2 is a functional block diagram showing details of a preferred embodiment of the method and apparatus of the present invention;  
         [0011]    [0011]FIG. 3 is a functional block diagram of various embodiments of the invention shown, for example, as used in a JTRS system or environment;  
         [0012]    [0012]FIG. 4 shows a Switch Policy (SP) Startup Sequence Diagram for an embodiment of the invention;  
         [0013]    [0013]FIG. 5 shows an I/O Port Classification Data Sequence Diagram for an embodiment of the invention;  
         [0014]    [0014]FIGS. 6A and 6B together show a Circuit Connection Request Sequence Diagram for an embodiment of the invention;  
         [0015]    [0015]FIGS. 7A and 7B together show a Circuit Disconnect Request Sequence Diagram for an embodiment of the invention;  96642   3   
         [0016]    [0016]FIGS. 8A and 8B together show a Processor Security label Change Sequence Diagram for an embodiment of the invention; and  
         [0017]    [0017]FIGS. 9A and 9B together show a Reset SP Sequence Diagram for an embodiment of the invention. 
     
    
     DETAILED DESCRIPTION  
       [0018]    One use of the various embodiments of the invention is illustrated in FIG. 1, showing a block schematic diagram of a Joint Tactical Radio System (JTRS) that includes multiple single levels of security (MSLS) by inclusion of the present invention. Before describing various aspects of the system of FIG. 1, as previously indicated, although the present invention is illustrated as used in a JTRS, it is not meant to be so limited, and can be used or incorporated into hospital record systems, any myriad number of commercial data processing or information systems, such as used by insurance companies, or by educational institutions, and so forth. Throughout this description of the invention, the term “Switch” is associated with switches that respectively provide different levels of security. As will be shown, the present invention provides for the physical separation of security labels, for ensuring the obtainment of multiple single levels of security (MSLS), also known as multiple independent levels of security (MILS). Through use of the present invention&#39;s switch policy programming (SP), controlling the operation of the Switch, required security policy for the system is enforced, whereby at any given time only ports and/or channels having the same security label can be connected together. Typically, the Switch device itself is provided by an application specific integrated circuit (ASIC).  
         [0019]    With reference to FIG. 1, a generalized functional block diagram of one embodiment of the invention is shown. More specifically, a label assignor  2 , consisting of a microprocessor in this example, is programmed to assign specific security labels to ports and channels that are available in the system being controlled. Another microprocessor is programmed to provide a configuration generator  4  for providing connection information, such as which ports, and the specific port configurations, are to be connected to various channels, for example. In other words, the configuration generator  4  provides instructions for making all interconnections between ports and channels, and/or between channels.  
         [0020]    The label assignor  2  and configuration generator  4  are each connected to a switch policy (SP) microprocessor  6 . Switch policy microprocessor  6  is programmed to compare the security labels assigned to various ports and channels with the interconnection request received from the configuration generator  4 , to ensure that for any of the interconnection requests, that only ports and channels having the same security label are approved for interconnection. Switch policy microprocessor  6  enforces both hierarchical and non-hierarchical mandatory access control decisions. Note that the switch policy microprocessor  6  is programmed to make a one-to-one association between labels from the label assignor  2  and port and channel interconnections from the configuration generator  4 . If the security labels are not identical for any of the connections being requested, the switch policy microprocessor  6  is programmed to send a return response to the configuration generator  4 , whereby the connections will not be made or permitted. Otherwise, the switch policy microprocessor  6  will drive the switch  8  to make the requested port and/or channel interconnections. The switch  8  includes switch fabric connection registers  12 . The switch fabric connection registers  12  receive the interconnection information from the switch policy microprocessor  6 , resetting the associated registers (not shown) to in turn cause the switch fabric connections to be made, that is, to connect the requested ports and channels together as requested, and as approved by the switch policy  6 .  
         [0021]    In the example of use of the present invention in a joint tactical radio system (JTRS), the switch fabric connection registers  12  are included in the JTRS. However, an external device may also be connected to the JTRS, in which case the switch connection registers  12  will provide control signals over control line  14  for controlling the switch fabric connection registers  12  of the external device, for example. Note that the control signal output line  14  does not necessarily represent a hardwire connection, and can be a connection made via an infrared coupling or via radio transmission, for example. Also note that the configuration generator  4  can typically be configured from a personal computer, as shown by control line  5 , for example. Also, a typical implementation may include four processors, four channels, and an associated switch  8 , for example.  
         [0022]    Use of a multiple single levels of security system of the present invention in a Joint Tactical Radio System (JTRS) is shown in FIG. 2 with one level of detail, and in FIG. 3 with a higher level of detail. The Joint Tactical Radio System (JTRS) uses physical isolation, the aforesaid Switch Policy  6  functioning in conjunction with the switch  8  to enforce a mandatory access control (MAC) policy for multiple single levels of security (MSLS). The various limits subject to MAC include the Input/Output (I/O) ports I/O 1  through I/O n , and channels CH 1  through CH 4 , of the Switch fabric connection registers  12 , as shown in FIG. 2, as an example. Through use of MAC, the necessary label requirements are provided by the label assignor  2  (FIG. 1) and the MSLS requirement is supported. The switch  8  supports interconnections between various combinations of the I/O ports and Processor interfaces. With further reference to FIGS. 1 and 2, the switch policy microprocessor  6  is connected to the label assignor microprocessor  2 , and configuration generator microprocessor  4 , previously mentioned.  
         [0023]    A Security Manager (SM)  36  bidirectionally communicates with the SP component  6 , 10 . The Security Manager  36 , in this example, bidirectionally communicates via a local area network or Ethernet interface  40  with an Ethernet driver  42 . The Ethernet driver  42  bidirectionally communicates through use of I/O device  46 , in this example to the Switch Control Service (SCS) component  48 . A Radio Services System Control Center  50  communicates in this example via ports  52  and  54  having a bidirectional flow of information with ports  56  and  58  of the SCS component  48 . Similarly, a Radio Security Services Audit Service Center  60  communicates via its port  62  being coupled to port  64  of the SCS component  48 .  
         [0024]    The switch  8  supports inerconnection between various I/O and Processor interfaces, as previously mentioned. Each low level interface capable of connecting to a Switch  8  circuit is identified as a port by the Switch Policy  6  and Switch  8 . Ports are defined for the purpose of the Switch  8  as:  
         [0025]    1. A data connection to any one Processor;  
         [0026]    2. An audio connection to any one Processor;  
         [0027]    3. Any data connection to user I/O&#39;s; and  
         [0028]    4. Any audio connection to user I/O&#39;s.  
         [0029]    The Switch policy  6  provides the Mandatory Access Control (MAC) decision making process. The Switch  8  creates circuit connections among I/O channels or ports, and among Processor channels or ports to permit information flow between objects based upon decisions made by the Switch Policy  6 . The Switch circuits are independent of each other and any channel or port can be brought on line without affecting the other channels or ports. The Switch Policy  6  configures one port or channel at a time. In this way, any one circuit can be configured or deactivated without interfering with any other circuit. The active channels and/or ports are not shut down when a new one is brought on line. The switch  8  enforces information flow control policy for the JTR Set.  
         [0030]    The Switch  8  and Switch Policy  6  provide interconnections between various combinations of Processors and I/O ports that support information flow policy, thereby restricting interconnections to objects of identical security classification and non-hierarchical category. The Switch  8  and Switch Policy  6  use the concept of ports to provide information flow control between the various objects requiring MAC adjudication.  
         [0031]    MSLS Switch Policy Function:  
         [0032]    The Switch  8  and Switch Policy  6  provide interconnections between various combinations of Processors and I/O ports that support information flow policy restricting interconnections to objects of identical security classification and non-hierarchical category, as previously mentioned. The Switch Policy  6  determines if System Control Services  50  (See FIG. 3) configuration requests conform to the MAC requirements/security policy.  
         [0033]    The Switch Policy  6  provides interfaces with:  
         [0034]    1. The Radio Service System Control  50  (resides on the Configuration Generator  4 , in this example); and  
         [0035]    2. A Security Manager  36 .  
         [0036]    Classifying Ports and Processors:  
         [0037]    The Switch Policy  6  obtains required labels by the following method. The Switch Policy  6  resets the security label locations as part of a startup routine. The System  50  stores the security I/O label file in a mass memory. As part of the startup routine, the System Control  50  (see FIG. 3) forwards a security I/O label file to the Security Manager  36 . The Security Manager  36  authenticates the file and loads the Security I/O label file into the Switch Policy  6 .  
         [0038]    The Security Manager  36  forwards the security label of the Processor to the Switch Policy  6  when the security label changes for the respective Processor.  
         [0039]    The Switch Policy  6  uses the Security Manager  36  interface to obtain the security I/O label which provides the sensitivity classification for the various I/O ports and Processors. The Switch Policy  6  uses the security information as the basis for mandatory access control (MAC) decisions.  
         [0040]    Switch Circuit Configuration:  
         [0041]    The Switch Policy  6  uses the Configuration Generator  4  interface to receive switch configuration requests from the Switch Control Service Component  48 . A request to create a switch circuit comes from a configuration file. Trusted paths are created to ensure the request originates from the appropriate object. The Configuration Generator  4  uses a trusted path with the Security Manager  36  to pass Switch configuration requests to the Security Manager  36 . The Security Manager  36  relays the Switch configuration request via a trusted path to the Switch Policy  6 . The Switch Policy  6  uses the trusted path with the Security Manager  36  to ensure that only trusted objects within Security Manager  36  identify the security label of each Processor and I/O Port.  
         [0042]    The Switch Policy  6  permits connections between:  
         [0043]    1. Channel Processors; and  
         [0044]    2. User I/O ports and/or other channel processors.  
         [0045]    The System Control Service  48  initiates a circuit connection with a circuit connection request to the Switch Control Service  48 . The Switch Control Service  48  makes the circuit connection request after any Processor initialization. The Switch  8  supports up to N circuits with up to M port connections per circuit. The values of N and M are determined by the particular application. The Switch  8  maintains separate connection registers for each port. The Switch Policy  6  writes to the specific connection register the specific port (I/O or Processor) to be connected.  
         [0046]    The following discussion addresses circuit connections requested between user I/O ports and Processors within a system. Once the Switch Policy  6  receives a circuit connection request from the Switch Control Service  48 , the Switch Policy  6 :  
         [0047]    1. Compares the security label from the first port with the security label of the second port to be connected to the circuit;  
         [0048]    2. If all security labels are equal (same hierarchical classification, same non-hierarchical compartment), Switch Policy  6  sets the connection registers for the requested circuit, and ACK (positive acknowledge) response to the Switch Control Service  48 ; and  
         [0049]    3. If two ports&#39; security labels are not equal between any other connection requests, then a NACK (negative acknowledge) response is sent to the Switch Control Service  48 .  
         [0050]    The Switch Policy  6  also limits each Switch port to a single circuit. The Switch Policy  6  provides this limitation to prevent interference between circuits, not for security purposes.  
         [0051]    High Assurance Switch Function:  
         [0052]    Each circuit has switches, which can connect any two of the ports together subject to the limitations discussed previously.  
         [0053]    The Switch  8  treats each Switch port as a single label device. Security label determination is described above under the Switch Policy  6 . Unique Switch Connection Registers  12  are associated with each port. Unique inputs and outputs are associated with each port connection register. The Switch  8  asserts the unique port gates (connection made to a specific circuit) when the Switch Policy  6  writes the destination port ID into its Switch Connection Register  12 . The Switch  8  only uses circuit switching to facilitate evaluation.  
         [0054]    Those skilled in the art will appreciate that the present invention allows MSLS to be implemented with minimal intelligence in Switch Policy  6 , and to perform the switching functions with minimized code requiring evaluation.  
         [0055]    Essentially with further reference to FIG. 3, the Switch Policy  6  has two components. One is a Switch Control Service Component  48  which is a reference part on the configuration generator  4 . The second is the SP (Switch Policy) Component  6 , 10  which is resident on a microcontroller connected to the Switch  8 .  
         [0056]    The Radio Services System Control  50 , through the SCS  48  interface, is the entity that commands the SP  6  to do all its various functions such as connect a circuit, disconnect a circuit, reset, provide I/O port security label data, etc. The SCS  48  receives the SP  6  command responses and relays the information to Radio Services System Control  50 . The Radio Security Services Audit Service (RSSAS)  60  is for reporting auditable events or alarms.  
         [0057]    Responses are fed back by the RSSC  50 . The communication from the SCS to the SP is through the Security Manager interface layer. The Security Manager for the most part is just a pass through. There is one message that it automatically generates, as will be discussed below in relation to one of the Sequence Diagrams. The method is initiated when the command comes in from Radio Services System Control  50 , via the SCS Component  48  going through the assembly of Ethernet Driver  42  through the Security Manager  36 . The latter transmits the message over an I 2 C Interface  38  to the SP Component  48 . The SP Component  6 , 10  maintains numerous tables based on the pertinent data. One table is an I/O Port Security Label Table, containing a list of the I/O Ports and their security labels. Security labels consist of security levels such as secret, classified, confidential, etc., and a compartment label which consists of tags such as US only and/or NATO.  
         [0058]    Another table is a circuit connection table of active circuit connections. Yet another table is a JTR port security label table, which is a list of the circuit connections going across two systems. The SP Component  6 , 10  on one side communicates the I 2 C  38  to the Security Manager  36  and onto the SCS  48  or SCS System Control  50 , and in the other direction communicates with the Switch  8 . A Switch ASIC (Application Specific Integrated Circuit) is the Switch Fabric Connection Registers  12 . These are the registers that the SP Component  6 , 10  writes to when it wants to make a connection or make a disconnection. There is another interface there through a Dual Port RAM  32 . If the SP component  6 , 10  wants to communicate with another JTR, it communicates via the Dual Port RAM  32 . A Switch SP Message Handler  29  handles the Dual Port RAM  32  on the other side. It communicates via a Mux  26  to another JTR indirectly to another JTR&#39;s SP Component  27 , or to operator interface devices known as CDD&#39;s  34 . A local CDD and a remote CDD, and all three of those interfaces are via Mux (multiplexers)  28  and  30 .  
         [0059]    An SP Startup Sequence Diagram is shown in FIG. 4. In this Diagram, and the Sequence Diagrams of FIG. 5 through  9 , programming or processing steps, typically progress from left to right and top to bottom. In FIG. 4, the top left side is an SP Poll (Switch Policy Poll) message being received by the Security Manager  36  interface from Ethernet Interface  40  in this example. The signal path in this example is from Radio Services System Control  50 , through Switch Control System (SCS) component  48 , I/O Device Call  46 , Ethernet Driver  42 , and Ethernet Interface  40 . However, FIGS. 4 through 9, for the sake of simplicity, show programming steps or processing from the Security Manager  36 , with the message entering the Security Manager  36  being passed onto the I 2 C Bus or Ethernet Interface and so forth. At SP startup, the SP Component  6 , 10  performs a number of self-tests. At the same time there are other portions of the system that are starting up such as the Security Manager  36  System Control, and SCS Component  48 , for example. When the SCS Component  48  completes startup, it begins generating Switch Policy SP Poll messages, and will send them out periodically. When the SP Component  6 , 10  completes startup, it performs self-tests, and if the self-tests are successful, the Security Manager to SP Interrupt Handler  11  is ready to process interrupts, and at that point it will receive an interrupt indicating data on the I 2 C Bus  38  in the form of a Switch Policy (SWPOL) SP Poll message. The Interrupt Handler  11  next performs an I 2 C Read. It reads this data, recognizes it as a poll message, and performs the SP Poll processing. The SP Component  6 , 10  generates a Self-Test Status Response message which it writes to the appropriate memory partition in Dual Port RAM  32 . At that point it interrupts the Switch SP Message Handler  29 , indicating that there is data in Dual Port RAM  32  that the Message Handler  29  has to read. The Handler  29  will then read the appropriate report RAM location to be the Self-Test Status Response. The SP Message Handler  29  then does a determination as to whether it was successful or not successful. If it determines the response to that operation is a failure, it generates an interrupt. An Alarm Interrupt Handler  70  responds to the interrupt by generating an audit event signal message with an audit event indication via an  12 C Write to the I 2 C Bus  38 . If the response operation was successful, an Interrupt is then triggered for the success case, the SP Response Interrupt Handler  72  is triggered, and responds by reading the appropriate Dual Port Memory Partition, reading the Self Test Status Response Message, and performing an I 2 C write to the Security Manager  36  which sends it up the line eventually getting to Radio Services System Control  50 .  
         [0060]    In FIG. 5, an I/O Port Security label Data Sequence Diagram is shown. System Control  50  reads an I/O Port Security label Data file from memory, and sends it via the SCS  48  to the Security Manager  36 . The Security Manager  36  authenticates this file, puts it in a message format for the SP Component  6 , 10 , which is a Switch Policy I/O Port Security labels Authenticated Message, and passes it onto the I 2 C Bus  38 . Next, an interrupt is generated, the SP Interrupt Handler  11  receives the interrupt as an I 2 C Read, reads a routine designated I/O Port Security label Data off the I 2 C Bus into the SP Component  6 , 10 , and the latter builds and maintains an I/O Port Security label Table based on the data that it received within this message. The data includes all the I/O Ports and their security labels composed of respective security levels and compartment labels. When the SP Component  6 , 10  processes this message, it will generate a response. The response is an SP Operational Status Message. The message is written to Dual Port RAM  32 . Next, an Interrupt is triggered, causing the SP Message Handler  29  on the Switch  8  to respond by reading the appropriate section of Dual Port RAM  32  to retrieve the message. The SP Message Handler  29  determines the success of the response operation, whereby all further processing is similar to that of SP Startup described above, as will be the case for all of the following sequence diagrams of FIGS. 6 through 9 discussed below. If any of these determinations are a failure, an Alarm Signal Message with an Alarm indication is generated, as would happen in this case. More specifically, as with the SP Startup, if failure occurs, an audit event is triggered, an Alarm Signal Message is generated, put on the I 2 C Bus and sent upstream. If it is a success, an Interrupt is generated for the success case, the SP Response Interrupt Handler  70  is called, and it responds by performing a Read to Dual Port RAM  32 . Once the Dual Port RAM  32  Read has been executed, the Interrupt Handler  70  then forwards the Switch Policy SP Operational Status Message, on the I 2 C Bus  38 . The Security Manager  36  retrieves the message off the I 2 C Bus  38 , and passes the message upstream to Radio Services System Control  50 .  
         [0061]    A Circuit Connection Request Sequence Diagram is shown in FIGS. 6A and 6B. A Circuit Connection Request is detected on the I 2 C Bus  38  triggering the SP Interrupt Handler  11 , which responds by performing an I 2 C Read, reading the message off the I 2 C Bus  38 , and determines that it is a Circuit Connection Request. Interrupt Handler  11  responds by calling the Connect Circuit routine. The SP Component  6 , 10  then retrieves the port ID&#39;s that are to be connected, and performs a connection Register Write operation. A bank of Connection Registers  12  is included in the Switch  8  (FIGS. 1-3), one register for every port that exists. For example, if Port A is to be connected to Port B, the Switch Connection Registers  12  write Port B address into Port A, and Port A address into Port B, and the Switch SP Message Handler  29  does a Cyclic Connection Register Check to determine if anything was written to the Connection Registers. If a non-zero value was written into the designated Connection Registers  12 , it then tries to perform a circuit connection. In performing the Cyclic Connection Register Check, the SP Message Handler  29  determines whether the circuit connection is a failure or success. In the failure case, operation is similar to that performed for the previously described sequence diagram.  
         [0062]    In the case of a success, an Interrupt is written to the Connection Register Interrupt Handler  13 , which responds by writing a Circuit Connection Response to Dual Port RAM  32 , and writing an Interrupt to the SP Message Handler  29  telling the latter that information was written to Dual Port RAM  32 . The Message Handler  29  then reads the Circuit Connection Response. The response message is checked. If the operation was deemed a success, a success case will trigger an interrupt that the SP Response Interrupt Handler  70  will respond to by reading the SP Response, which is the Circuit Connection Response. The SP will put the Switch Policy Circuit Connection Response message onto the I 2 C Bus  38  where it will ultimately pass to System Control  50 .  
         [0063]    The processing continues with reference to the Circuit Disconnect Request Sequence Diagram of FIGS. 7A and 7B. A Circuit Disconnect Request comes in from System Control  50   96642   16  through the SCS  48  to the Security Manager  36 . The request is put on the I 2 C Bus  38 . The Security Manager to SP Interrupt Handler  11  triggers on an interrupt, and generates an I 2 C Read. It reads the message and determines that it is a Circuit Disconnect Request message. It processes the message and performs a Disconnect Circuit Write. However, in this case, it looks at the two identified Port ID&#39;s, for example, Ports A and B, which are supposed to be disconnected. It responds by writing 0 in Port A and B respective Connection Registers  12 . Previously for connection the address of Port B was written in Port A&#39;s connection register, and the address of Port A into Port B&#39;s connection register. A connection register write is performed.  
         [0064]    A determination of the success of the Circuit Disconnect Response operation is now made. If the operation is a success, a Success Interrupt is triggered. The SP Response Interrupt Handler  70  reads the Circuit Disconnect Response from Dual Port RAM  32  and puts the message on the I 2 C Bus  38  to be received by Radio Services System Control  50 .  
         [0065]    The processing or programming description continues with reference to the Processor Security Label Change Sequence Diagram of FIGS. 8A and 8B. A Processor Level Change message is the one message that is autonomously generated by the Security Manager  36 , not by System Control  50 . This message gets generated when the Security Manager  36  responds to a processor changing security labels. The Security Manager to SP Interrupt Handler  11  triggers on the interrupt, and performs an  12 C Read off the I 2 C Bus  38 . Upon determining that a Processor Security label Change message was read, SP Component  6 , 10  determines if there is any active circuit connection on the processor that has just changed its classification label. If there is, SP Component  6 , 10  performs Connection Register Writes on Connection Registers  96642   17   12 , disconnecting all active circuit connection involving any one of that processor&#39;s ports. The SP Component  6 , 10  writes zeros in the affected port ID connection registers that have active circuit connections that must be disconnected. After SP Component  6 , 10  writes to those Connection Registers  12 , the Switch  8  performs the circuit disconnections. Next, the SP Message Handler  29  performs a Cyclic Register Check, to determinate the success or failure thereof. If it was successful, SP Message Handler  29  interrupts Connection Interrupt Handler  13 , which responds by generating a Processor Security Label Change Response message, which it writes to Dual Port RAM  32 . It interrupts the SP Message Handler  29  to indicate that there is a message to be read. The SP Message Handler  29  responds by reading the Processor Security label Change Response message, and then does a determination of the success or failure of that response operation. If the response operation was successful, the Switch Message Handler  29  triggers an interrupt for the Success Case, whereby the SP Response Interrupt Handler  70  is executed, and responds by reading the Processor Security label Change Response message from Dual Port RAM  32 , and writing the message to the I 2 C Bus  38 , for ultimate reception by System Control.  
         [0066]    Reference is now made to the Reset SP Sequence Diagram, shown in FIGS. 9A and 9B. Due to various conditions, System Control  50  might decide to reset the SP  6 . At that time a command will be generated from System Control  50  to initiate the reset. The command goes through the SCS Component  48 , as do all the other commands, through to the Security Manager  36 . Eventually the command will be placed on the I 2 C Bus  38 , an Interrupt is generated to the Security Manager  36  to SP Interrupt Handler  11 , which responds by generating an I 2 C Read, reads the message off the I 2 C Bus  38 , and determines that it is a Reset SP. SP Interrupt Handler  11  performs the Reset SP processing by sending a Reset SP( ) to SP Component  6 , 10  which responds by generating a Connection Register Write( ) for writing all zeros in all the port connections affected. In this manner all ports are disconnected any channels.  
         [0067]    Following this step, as previously described for the other sequences, the success or failure of the Reset must be determined. If it is a success case, as before, a response message is generated, and a Reset SP Response message is generated by Connection Register Interrupt Handler  13  and written to the Dual Port RAM  32 . Also, an interrupt is triggered by Interrupt Handler  13  to activate the Switch Message Handler  29  to read from the Dual Port RAM  32  memory address which contains the Reset SP Response message.  
         [0068]    Next, as shown in FIG. 9B, a determination of the success of reading Reset SP Response must be made. The success case will trigger the Interrupt Success Case to the SP Response Interrupt Handler  70 , the latter responding by reading the Reset SP Response to Dual Port RAM  32 , and also writing the Reset SP Response on the I 2 C Bus  38 , via an I 2 C Write, for transfer upstream to System Control  50 , as previously described for other Sequences. Next, the SP Response Handler  70  generates a reset command for resetting the SP  6  and the Switch  8 . After resetting, a new Startup Sequence can be initiated as described above for the SP Startup Sequence Diagram, of FIG. 4.  
         [0069]    In summary, note that there are six messages in the Sequence Diagrams in FIGS. 4 through 9A and  9 B that all have the same type of steps. When a message is received, an operator determines the message content, an operation is performed, validation of that operation is made to determine success or failure  
         [0070]    Although various embodiments of the invention have been shown and described herein, they are not meant to be limiting. Those of skill in the art may recognize certain modifications to these embodiments, which modifications are meant to be covered by the spirit and scope of the appended claims.