Rockwell Collins, Inc.

Other

Sun Microsystems, Inc.

Ajile Systems, Inc.

David S Hardin

James A Marek

Allen P Mass

Matthew M Wilding

T Douglas Hiratzka

David A Greve

Raymond A Kamin

Nick M Mykris

Steven E Koenck

Mark A Bortz

John K Gee

Philippe M T Limondin

Michael J Frerking

Philip J Wiley

Michael H Masters

James N Potts

Gregory Bollella

Sung J Kim

Peter Cadwell Dibble

Jennifer A Davis

Michael W Whalen

Ryan P Littler

Scott D Robbins

Jing Liu

Raymond J Richards

Benjamin M Brosgol

Konrad L Slind

An autonomous vehicle system includes one or more output devices, one or more input sources, and a controller. In some embodiments, a verified inference engine is used by the controller to generate outputs for the output devices from inputs received from the input sources. The inference engine may be verified to be mathematically correct with an automated theorem proving tool. The automated theorem proving tool may verify that the inference engine meets the design requirements of standards such as DO-178C Level A and/or EAL-7. The controller is configured to validate the inputs received from the input sources, store the validated inputs in a fact base, generate outputs from the validated inputs, validate the one or more outputs, and provide the one or more validated outputs to the output devices.

Verified inference engine for autonomy

A system for controlling the flight of aircraft includes an aircraft operated by a human pilot, one or more optionally piloted aircraft controlled by a processor, and a communication link between the aircraft. The optionally piloted aircraft receives data indicative of the position and flight path of the piloted aircraft, and is automatically controlled to maintain a predetermined range of separation distances from the piloted aircraft. Control of the optionally piloted aircraft may include machine reasoning computing functions based on a classification of data received by the communication link, data indicative of the current positions and three-dimensional flight paths of the aircraft, stored data from previously calculated positions and three-dimensional flight paths of the aircraft, and stored data from previously executed flight plans associated with the optionally piloted aircraft.

System and method for cooperative operation of piloted and optionally piloted aircraft

Testing a system against fuzzing attacks includes negating all regular expressions used in the corresponding language, and applying those negated regular expressions to a system interface. Only expressions definitively outside the scope of protocol specification implicate vulnerabilities to fuzzing attacks. The system detects fuzzing attacks by continuously monitoring packets of data and only passing through packets that conform to regular expressions of the language.

Regular expression based cyber fuzzing attack preventer

Cross-Domain guard with authentication and authorization function used to protect data transferred between two separate and secure networks. The guard utilizes an existing audit port to provide the capability augment or replace data-forwarding decisions, which were previously being based solely on whether the data is in a well-formed packet. The authentication and authorization may be resident in a partition, a side car processor or a separate network.

High assurance guard for security applications utilizing authentication and authorization services for sources of network data

The present invention is directed to routing information between networks of differing security level. Communication to/from each network is handled by a dedicated Offload Engine (OE). Each OE interfaces to a Guard Engine through a Guard Data Mover (GDM) and includes an interface for connecting to an external network. A first OE receives a data packet from a first network intended to be transmitted to a second network. The Guard Engine analyzes the data packet. The Guard Engine includes an ACL (Access Control List) which are rules data packets must meet before being passed onto a destination network. If allowed, the Guard Engine delivers the data packet to the second network via a second OE utilizing a GDM associated with the first OE and a GDM associated with the second OE. The architecture of the present invention reduces the time and effort needed to attain high-assurance certification.

High-assurance architecture for routing of information between networks of differing security level

The present invention is a methodology for developing high-assurance microcode. The method may comprise one or more of the following steps: (a) receiving a plurality of requirements detailing intended behavior of microcode (b) creating a model of microcode behavior; (c) generating microcode based on the model; (d) generating test cases based on the model; (e) simulating the behavior of the microcode; (f) translating the model into a verification tool-specific format; and (g) formally verifying the model using a verification tool.

Method and system for the development of high-assurance microcode

The present invention is directed to a system for providing a trusted environment for untrusted computing systems. The system may include a HAC subsystem managing shared resources and a trusted bus switch for controlling a COTS processor to access the shared resources. The shared resources such as memory and several I/O resources reside on the trusted side of the trusted bus switch. Alternatively, the system may include a SCM as an add-on module to an untrusted host environment. Only authenticated applications including COTS OS execute on the SCM while untrusted applications execute on the untrusted host environment. The SCM may control secure resource access from the untrusted host through a plug-in module interface. All secure resources may be maintained on the trusted side of the plug-in module interface.

System for providing secure and trusted computing environments through a secure computing module

System for providing secure and trusted computing environments

The present invention is a method for providing a high-assurance guard in a partitioned processing system, the partitioned processing system including a first input/output partition, a guard function partition and a second input/output partition, the method including the steps of: receiving a data packet from the first input/output partition of the partitioned processing system via a first I/O interface; determining if the data packet is well-formed as defined by an interface control document; and forwarding the data packet to the second input/output partition of the partitioned processing system and to a second I/O interface only when the data packet is well-formed.

Evaluatable high-assurance guard for security applications

An invention is provided for a synchronous transfer of control. An asynchronous interrupt exception is received, and in response, the value of a reference counter is determined. The value of the reference counter is based on the execution of synchronized code. Generally, the reference counter is initialized to a predetermined number, and altered based on the execution of synchronized code. When the asynchronous interrupt exception is received, the method is asynchronously interrupted when the value of the reference counter is equal to the predetermined number.

System and method for asynchronous transfer of control

A method and apparatus including an overview component depicting a plurality of virtual machines on a display of a computerized system. Parameter details of at least one virtual machine are concurrently displayed with the overview component. The method steps include receiving the compiled source code for two applications, creating two relocatable virtual machines to run the compiled source codes, determining the parameters for the multiple virtual machine environment, locating the two relocatable virtual machines and generating a target executable file for the environment.

Builder tool and interface for system supporting multiple virtual machines

A component model for use in a time sensitive embedded application. The system includes an event-generating software component that can generate an event notification in response to an event. It also includes a listener software component that can receive an event notification. Further, it includes an event transmission object that can facilitate transmission of an event notification from an event-generating software component to a listener software component. The event transmission object passes a primitive data type parameter that conveys data describing an event generated by said event-generating software component to a listener software component.

Software component model for time sensitive embedded applications

Multiple Java Virtual Machines (JVMs) operate on a single direct execution JAVA processor with each JVM operating in a separate time slice called a partition. Each JVM has its own data and control structures and is assigned a fixed area of memory. Each partition is also allotted a fixed period of time in which to operate, and, at the end of the allotted time, a context switch is forced to another JVM operating in the next partition. The context switch does not transfer control directly from one JVM to another JVM. Instead, at the end of a partition time period control is switched from the currently operating JVM to a &ldquo;master JVM&rdquo; during a time period called an &ldquo;interstice.&rdquo; The master JVM handles system interrupts and housekeeping duties. At the end of the interstice time period, the master JVM starts a proxy thread associated with the next JVM to become operational. The proxy thread handles JVM-specific interrupts and checks the status of the associated JVM. If the JVM appears operational the proxy thread transfers control to the JVM thread. Time intervals such as partition times and interstice times are enforced by hardware timers and memory accesses are checked by address comparison circuitry to prevent a system failure due to a malfunction in either the master JVM or another JVM.

Real time processor capable of concurrently running multiple independent JAVA machines

An improved computer architecture and system advantageously combine the beneficial characteristics of a high level object oriented programming language with an optimized processor for efficient application to real time embedded computing problems. Additionally, an improved method for resolving symbolic references in code generated by compiling source code written in an object oriented programming language to the corresponding logical memory addresses stores look-up information with the object itself after the first encounter of a given symbolic reference, whereby the logical memory address information is available for subsequent encounters of the symbolic reference, and whereby no modification of the program instructions containing the symbolic reference is necessary. In a preferred embodiment, the Java&trade; programming language is used.

Growing community of inventors

Cedar Rapids, IA, United States of America

David S Hardin