EP0849680A2
Expired / Lapsed
EP
⏱️ 0.0 years remaining
Multilevel security port methods, apparatuses, and computer program products
Assignee: Sun Microsystems Inc
•
Filing: 1997-12-17
•
Granted: —
•
Expires: 2017-12-17
Abstract
Abstract A multilevel port system on a computer operating under a multilevel operating system to permit contemporaneously opening a plurality of sockets having the same port number while meeting the requirements of an appropriate security policy, thus allowing third party applications to run as if they were unimpeded by the security policy, and methods thereby. The computer system having an operating system adhering to an access control security mechanism. Such systems include government systems wherein a hierarchy of security classification levels are defined (e.g., top secret, secret, classified, unclassified), and commercial systems. Sensitivity labels pursuant to an access control security mechanism include at least hierarchical security classifications, and may include non-hierarchical categories or compartments which represent distinct areas of information in a system. A port is characterized by a port number and a sensitivity label thus permitting opening a plurality of ports having identical port numbers and unique sensitivity labels.
Inventors
- 👤 Gary W. Winiger
Bibliographic Details
Application Number
—
Jurisdiction
EP
Data Source
google_patents
Last Synchronized
2026-10-24 16:31
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/10; H04L63/105; G; G06; G06F; G06F21/00; G06F9/00; G06F9/06; G06F9/46; G06F9/54; G06F9/544; G06F12/00; G06F12/14; G06F12/1458; G06F12/1491; G06F2211/00; G06F2211/009; G06F2221/00; G06F2221/21; G06F2221/2113
Claims Analysis
Total Claims: 10
Claim 1
Independent Claim
132 words
A computer program product comprising: a computer useable medium having a computer readable
program code mechanism embodied therein for generating a
plurality of ports, said ports being associated with a
common port number, each of said ports having a selected
sensitivity label, said port number and said sensitivity
label defining a selected port identifier for at least
one of said ports, permitting multiple, simultaneous
access to the port, said computer code mechanism
comprising: first computer readable code mechanism for
constructing a communications packet comprising a
protocol header in turn comprising at least source
machine identification, source port number, and
destination port identifier region, said destination port
identifier region including a destination port number and
sensitivity label subregion; and second computer readable code mechanism for
permitting reception communications packets for
establishing receiver ports.
Claim 2
Dependent Claim
191 words
A first program storage device readable by a
machine, tangibly embodying a program of instructions
executable by the machine to establish a multilevel port
for enabling multiple, simultaneous access of a resource
in a multilevel trusted system, said first program
storage device comprising: first computer readable code devices configured to
receive a communications packet from a source machine
running an application instantiated in a first process,
said packet comprising at least a first destination port
number and a first sensitivity label; second computer readable code devices configured to
examine said packet for identifying said port number and
said sensitivity label, said port number and said
sensitivity label, together providing a port identifier; third computer readable code devices configured to
compare said port identifier to port identifiers
associated with pre-existing open ports; and fourth computer readable code devices configured to
open a port having the same port number as pre-existing
open ports when said sensitivity label of said port
identifier is unique as compared to sensitivity labels of
pre-existing open ports, said opening permitting
contemporaneous processes associated with a plurality of
ports having the same port number, and a unique
sensitivity label.
Claim 3
Dependent Claim
29 words
A first program storage device as in claim 2 further
comprising a kernel having a security portion, said
security portion including said third and fourth computer
readable code devices.
Claim 4
Dependent Claim
122 words
A first program storage device as in claim 3,
further comprising: fifth computer readable code devices configured to
pass a data portion of the communications packet to the
process instantiating the application associated with the
port previously opened in said port opening step; sixth computer readable code devices configured to
prepare a reply communication packet for transmission to
said first process, said reply communication packet
comprising at least a destination port number, a second
sensitivity label, and a reply; seventh computer readable code devices configured to
transmit said reply communication packet to said source
machine; and eighth computer readable code devices configured to
process said reply communication packet by said source
machine in accordance with the security protocol of said
source machine.
Claim 5
Dependent Claim
89 words
A computer having a multi-level trusted operating
system, comprising: a computer useable medium having a computer readable
program code mechanism embodied therein for generating a
plurality of ports, said ports being associated by a
common port number, each of said ports having a unique
sensitivity label, the combination of said port number
and said sensitivity label defining a unique port
identifier for each of said ports, said plurality of
ports permitting multiple, simultaneous access of said
common port number, said computer readable code mechanism
in said multi level-trusted system.
Claim 6
Dependent Claim
61 words
A computer as in claim 5, wherein said computer
readable code mechanism also includes computer readable
code means for receiving a communications packet, for
examining the packet to extract a destination port number
and a sensitivity label, for determining the availability
of a port having a unique port identifier address, and
for opening a port having a unique port identifier
address.
Claim 7
Dependent Claim
53 words
A multilevel port for permitting simultaneous access
by a plurality of processes, each process having a
different sensitivity label, the multilevel port defined
by a common port number and a plurality of selected,
unique sensitivity labels to permit two-way communication
between said port and a plurality of processes having the
same sensitivity labels.
Claim 8
Independent Claim
153 words
A method for enabling simultaneous access of a
port by a plurality of processes in a multilevel trusted
system, comprising the steps of: intercepting a first communications packet in a
second computer system, said communications packet
generated by the kernel of a first computer system, said
communications packet comprising a destination port
number and a first sensitivity label; examining the communications packet to extract and
identify said port number and said sensitivity label,
said port number and said sensitivity label combination
defining a port identifier; comparing said port identifier to the port numbers
and sensitivity labels of pre-existing open ports; establishing a port in the event no pre-existing
open port has the same port identifier as defined in said
communication packet; passing the data portion of said communication
package to an applications process in said second
computer system, said applications process having a port
number and sensitivity label equivalent to said port
identifier.
Claim 9
Dependent Claim
104 words
A method for enabling simultaneous access of a port
as in claim 8 further comprising: preparing a reply; constructing a second, return communications packet,
said return communications packet comprising at least a
reply, a source port number, and a second sensitivity
label associated with said applications process in said
second computer system; transmitting said second communications packet to
said first computer system; intercepting said second communications packet by a
kernel in said first computer system; comparing said first sensitivity label to said
second sensitivity label; and processing the reply in accordance with the security
protocol associated with the kernel in said first
computer system.
Claim 10
Dependent Claim
41 words
A method for enabling simultaneous access of a port
as in claim 8 wherein said intercepting step is performed
by a daemon operating between the data link and the
network layers of a second computer system operating
under an OSI protocol.
References Cited (Backward Citations)
No citation records indexed.
USPTO Annuity & Maintenance Windows
Maintenance schedule is calculated for granted US utility patents.