The Boeing Company

Steven L Arnold

Arun Ayyagari

John E Bush

Thomas E Donofrio

Kevin Yong Ung

Travis Stephen Reid

Kelly SeiYuda Bunn

Ryan D Hammond

Daniel D Schnackenberg

Janell Schnackenberg, Legal Representative

Brett Hartman

Samuel C Kwok

Richard M Balza

Michael J Murphy

In general, certain embodiments of the present disclosure provide techniques or mechanisms for automatically filtering network messages in an aviation network for an aircraft based on a current system context. According to various embodiments, a method is provided comprising receiving a network message transmitted from a source avionic device to a destination avionic device via one or more network packets within the aviation network. A current system context, indicating an aggregate status of avionic devices within the aviation network, is determined based on monitoring the avionic devices. The network message is analyzed by identifying a plurality of attributes corresponding to header and data fields of the one or more network packets corresponding to the network message. The acceptability of the network message within the current system context is determined based on one or more filter rules that specify what attributes are allowed within a particular system context.

System and method for context aware network filtering within an aviation network

In general, certain embodiments of the present disclosure provide methods and systems for automatic generation of filter rules based on functional network flows for e-Enabled aviation systems. According to various embodiments, a method is provided comprising capturing network packets corresponding to a functional network flow transmitted within a networked aviation system, and parsing the network packets in order to extract one or more network messages corresponding to the functional network flow. The network message is examined in order to identify and classify a plurality of attributes corresponding to the header and data fields of the network packets. A table corresponding to the network messages is automatically generated, which includes one or more filter rules. In some embodiments, the table may be used to determine which communications are authorized during a particular context of the networked aviation system. The method further comprises validating the one or more filter rules.

System and method for automatic generation of filter rules

System and method for context aware network filtering

The methods and systems of the present disclosure provide a high assurance means for multiple legacy communication (e.g., Mil-Std-1553 communications protocol) system users and/or devices and multiple IP based network users and/or devices to seamlessly, and in real time, share information across various security domains. Specifically, the system enables multiple legacy communication system protocols and interfaces to communicate with existing IP interfaces and protocols with a high degree of trust. The system includes a configurable filtering capability to allow for the data to be inspected prior to being passed from one security domain to another security domain.

Trusted, cross domain information sharing between multiple legacy and IP based devices

A method for communicating information packets from a first host system operating in a first security domain and in accordance with a non-secure communications protocol, using a dataguard, to a second host system operating in a second security domain different than the first security domain, and where the second host system is also operating in accordance with the non-secure communications protocol. The method may involve: using a first driver operating with the dataguard to interface the dataguard with the first host system; using a first proxy task group operating with the dataguard to interface the dataguard to the first driver and to communicate with the first driver in accordance with a protocol of the first security domain; using a second driver operating with the dataguard to interface the dataguard to the second host system; and using a second proxy task group operating with the dataguard to interface the dataguard to the second proxy task group and to communicate with the second driver in accordance with a protocol of the second security domain.

System and method for information sharing between non-secure devices

A server for transferring data between networks. The server is programmed to perform the following steps: (a) creating a receiving process, a filtering process and a forwarding process, the filtering process being dictated by a file that specifies filtering rules, wherein: (b) the receiving process receives data transmitted from a source host; (c) the filtering process filters the transmitted data based on the filtering rules; and (d) the forwarding process forwards only filtered data to a destination host.

High-assurance file-driven content filtering for secure network server

A method and apparatus for passing data from a first application at a first security level to a second application in a second security level higher than the first security level is disclosed. A backchannel communications link is established between the first application and the second application, and the backchannel link is used to transmit information such as an acknowledgement message from the second application to the first application.

Method and apparatus for reliable, high speed data transfers in a high assurance multiple level secure environment

In exemplary embodiments, data with a format compatible with a first protocol standard is received on behalf of a first application. When the format of the data is not compatible with a second protocol standard, the format of the data is automatically transformed to a format that is compatible with the second protocol standard. The data is transmitted to a second application service using the second protocol standard. The data may be received from the second application. When the format of the data is not compatible with a third protocol standard, the format of the data is automatically transformed to a format that is compatible with the third protocol standard. The data is transmitted on behalf of a third application using the third protocol standard. The first and third applications may be in first and second protected enclaves. The second application may include a security gateway service.

Growing community of inventors

Kirkland, WA, United States of America

Steven L Arnold