Harris Corporation

Jeffrey L Murray

Terence W O'Brien

Richard Schmalbach

John Blessing

A secure file service includes a cryptographic processor () and a secure file system (). The cryptographic processor is comprised of a trusted microprocessor and a trusted operating system executing on the trusted cryptographic processor. The cryptographic processor includes hardware and software for accessing at least one classified data file from the secure file system, decrypting the classified data file, and serving the classified data file in decrypted form to a secure user processor () that has requested the file. The secure file system can be either a single-level secure file system () or a multi-level secure file system ().

Computer architecture for an electronic device providing a secure file system

Method for providing a single level secure (SLS) user processor () with access to a multi-level secure (MLS) file system (). The method begins by authenticating a user to a cryptographic processor () by communicating one or more types of user authentication information to the cryptographic processor. Based on such authentication, the MLS file system services are provided such that the SLS user processor () has access to files () at only one defined security classification level at a time. The method also includes zeroizing one or more data stores used by the SLS user processor each time the SLS user processor transitions between accessing classified data files at a first security classification level and a second security classification level.

Computer architecture for an electronic device providing single-level secure access to multi-level secure file system

System for providing a secure file service includes an MLS file service module () comprised of a cryptographic processor (). The MLS file service module also includes an MLS file system () hosted by the cryptographic processor. A secure user processor () includes programming and communications hardware for requesting at least one classified file from the MLS file service module. The cryptographic processor includes cryptographic hardware and software to decrypt the classified file. The cryptographic processor is also performs an integrity check on the classified file. Once the file is decrypted and its integrity checked by the cryptographic processor, the MLS file service module serves the classified file to the secure user processor in decrypted form. If the classified file is an executable file, the method also includes selectively enabling a write function for program memory of the secure user processor. This write function is disabled immediately after the classified executable file has been loaded into the program memory to guard against self modifying programs.

Growing community of inventors

Penfield, NY, United States of America

Jeffrey L Murray