Northrop Grumman Systems Corporation

Mark A Bellmore

William Edward Freeman

Kenneth Wagner Aull

David M Iodice

Thomas C Kerr

Matthew R Luker

Christopher Beattie

Forrest Bland

Matthew T Kirk

A containerized cross-domain solution (CDS) is disclosed herein. In some examples, a first network interface container can be executed on a server to run a first network interface application to receive a data packet that includes data generated by a first process executing at a first security domain. A filter container can be executed on the server to run a data filter to evaluate a data content of the data to determine whether the data content violates a set of data rules. A second network interface container can be executed on the server to run a second network interface application. The data packet can be provided to the second network interface application in response to determining that the data content does not violates the set of data rules. The second network interface application can provide the data packet to a second security domain for a second process executing therein.

Containerized cross-domain solution

In an example, a system can include a web service interface (WSI) and a service directory for enabling communication between a web and non-web service. The WSI can be configured to communicate with the non-web service to receive reader data and/or writer data. The service directory can be configured to provide the WSI with non-web service subscriber data and/or non-web service publisher data for the non-web service in response to receiving the reader and/or writer data. The non-web service subscriber data identifies a web service as a subscriber of data provided by the non-web service and the non-web service publisher data identifies the web service as a publisher of data from which the non-web service is enabled to retrieve data. The WSI can be configured to provide the web service subscriber and/or publisher data to the non-web service to enable the non-web service to communicate with the web service.

Systems and methods for communicating messages between web and non-web services

A process for generating a unique, secure and printable identity document, for authenticating the use of the document, and for granting privileges based on the document, includes generating an identity certificate for an individual. This certificate incorporates a pointer to biometric and other identifying data for the individual which are stored in a reference database. The identity certificate is encoded to produce, for example, a machine-readable printable 2-dimensional barcode as an identity document. The identity document may then be used by the document holder for generation of an encoded privilege document and this, in turn, is compared with the stored reference data, including the stored biometric when the privilege is to be exercised.

Secure identity and privilege system

A method and computer program to assign certificates/private keys to a token. This method and computer program allows a user to access a certificate authority and have certificates/private keys that are used for signature, encryption and role purposes generated and downloaded to the token. The use of secure communication lines and computers is not necessary since the token contains a unique token ID and private key, while the certificate authority contains the associated public key for the token. The certificate generated is wrapped in the public key and only the token, having the associated private key, may activate the certificate.

Assignment of user certificates/private keys in token enabled public key infrastructure system

A method, and a corresponding apparatus, provide for remote, secure replacement of private keys in a private key infrastructure. The method is implemented as a secure key replacement protocol (SKRP), which includes the steps of receiving a rekey request, where the rekey request identifies a private key for replacement, authenticating the rekey request, replacing the identified private key with a SKRP key, signing the challenge with the SKRP key, and returning the signed challenge. The rekey request includes the SKRP key and the challenge.

Method and apparatus for secure key replacement

A method and computer program to revoke and update a token () having several encryption, signature and role certificates/private keys contained in the token (). The certificates/private keys in the tokenare transmitted wrapped by a public key and may only be activated by a private key contained in the token (). The activation of any certificate/private key requires the entry of a passphrase by a user (). Further, all certificates/private keys contained in a token () are stored in an authoritative database. In the event that a token () is lost then all certificates/private keys associated with the token () are revoked. Further, when new certificates/private keys are issued to a user () these certificates/private keys are encrypted using the token's () public key and downloaded to the token ().

Growing community of inventors

Mt. Airy, MD, United States of America

Mark A Bellmore