Multi-Crypto Module Architecture for Shared Multi-Level Secure Storage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing military-intelligence and secure computing systems require physically isolated, protected data storage sites for each level of classified data, leading to high costs, redundancy, inefficiency, and slow cross-domain information sharing.
Innovation Solution
A multi-level security architecture using multi-crypto modules (MCMs) for dynamic security provisioning, enabling secure data sharing and storage across different security domains by encrypting and decrypting data based on detected metadata and integrity checks, with MCMs providing cryptographic separation and secure communication over Ethernet networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If physically isolated storage systems are used for each classified data level, then security is improved, but cost and hardware redundancy increase
Solution Approach 1:
The patent combines multiple physically isolated storage systems into a single shared storage infrastructure by implementing cryptographic separation at the data level rather than the physical level. Multiple security domains share the same storage hardware, network infrastructure, and computing resources, eliminating hardware redundancy while maintaining security through cryptographic boundaries.
Solution Approach 2:
The patent introduces cryptographic modules and security appliances as intermediaries that enforce security boundaries between different classified data levels. These intermediaries provide cryptographic separation and access control, allowing physical sharing of resources while maintaining logical isolation for security purposes.
2Reliability
If physically isolated storage systems are used for each classified data level, then security is improved, but operational efficiency deteriorates
Solution Approach 1:
The patent merges multiple isolated operational environments into a unified system where computing, storage, and networking resources are shared across security domains. This consolidation eliminates operational inefficiencies associated with maintaining separate physical systems while cryptographic controls ensure security requirements are met.
Solution Approach 2:
The patent implements dynamic security provisioning that allows security boundaries and access controls to be flexibly configured and adjusted based on data classification levels and operational requirements. This dynamic approach enables efficient resource allocation and cross-domain data sharing while maintaining appropriate security protections.
3Reliability
If physically isolated storage systems are used for each classified data level, then security is improved, but cross-domain information sharing becomes slow and cumbersome
Solution Approach 1:
The patent employs security appliances and cryptographic modules as intermediaries that enable efficient cross-domain data sharing by handling encryption, decryption, and access control operations. These intermediaries facilitate rapid authorized data transfer between security domains without requiring manual intervention or physical data movement, dramatically reducing cross-domain sharing time while maintaining security.
Data Source
AI summary
Systems, methods, and apparatus for a MILS HPC, data storage system (DSS) system architecture that incorporates a multi-crypto module (MCM) to provide end-to-end multi-independent level security (MILS) protection. Configuration of each MCM enables a high performance computing (HPC) resource to compute different security domains with the associated security level keys from a key/node manager. The HPC resource can be dynamically re-allocated to different security level domain(s) by the key/node manager. In one embodiment, the DSS stores encrypted data regardless of the domains.