Domain Guard System for Secure Low-Latency Message Transmission
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems that protect high-trust domains from low-trust domains often introduce latency as a security measure, which is undesirable, and there is a need for a method to securely transmit messages without increasing latency.
Innovation Solution
A domain guard system utilizing two processors, one for the low-trust domain and one for the high-trust domain, that compares source addresses and messages against whitelists and stored values, writing valid messages to memory and acting upon them, ensuring secure transmission without latency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security analysis is performed on messages passing through the system, then security protection is improved, but message transmission speed deteriorates due to latency
Solution Approach 1:
The system segments the security verification process into two independent phases: a first processor performs initial security analysis and validation on messages from the low-trust domain, while a second processor handles message routing and transmission to the high-trust domain. This segmentation allows security checks to be performed in advance without blocking the main message transmission path, thereby maintaining high transmission speed while ensuring security protection.
Solution Approach 2:
The first processor performs preliminary security analysis and validation of messages before they are transmitted to the high-trust domain. By conducting security checks in advance and storing validated messages in memory, the system ensures that messages are already cleared of threats before reaching the high-trust domain, eliminating the need for real-time analysis during transmission and thus maintaining high speed.
2Reliability
If multiple security checks are performed on messages, then security protection is improved, but processing time increases
Solution Approach 1:
The processing system is segmented into two independent processors: the first processor handles security verification and validation, while the second processor handles message routing and transmission. This segmentation allows multiple security checks to be performed in parallel and independently, reducing the total processing time while maintaining comprehensive security protection through multiple verification stages.
Solution Approach 2:
The system maintains continuous processing by having the first processor continuously validate messages and store them in memory while the second processor simultaneously handles routing and transmission. This continuous operation without idle waiting periods ensures that multiple security checks do not create bottlenecks, as both processors work in parallel on different tasks, thereby reducing overall processing time.
Data Source
AI summary
A computer device for routing communications from a low-trust domain to a high-trust domain is provided. The computer device includes a first processor and a second processor. The first processor is programmed to receive a packet from the low-trust domain to be transmitted to the high-trust domain and compare the source address to a white list of source addresses. If the source address matches the white list, the first processor is programmed to compare the message to one or more messaging requirements. If the message meets the one or more messaging requirements, the first processor is programmed to write the message to a memory. The second processor is programmed to read the message from the memory and compare the message to a plurality of stored values. If the message matches the plurality of stored values, the second processor is programmed to act upon the message.