Multi-Level Security Software Architecture for Avionics Data Separation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current embedded avionics systems face challenges in achieving Multiple Independent Levels of Security (MILS) across multiple processors, leading to increased costs and complexity, as they primarily operate at a system high classification protocol, restricting data sharing and increasing the total system cost of ownership.
Innovation Solution
A software architecture that enables data separation across multiple processors by using a domain separator module and domain gateway to securely transmit messages classified at different security levels, employing encryption and decryption based on specific classification levels, and maintaining data separation through a communication bus, allowing for true system MLS capability.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If system high classification protocol is used to ensure security, then data separation is maintained, but data sharing between networked systems is restricted and system performance deteriorates
Solution Approach 1:
The system segments data classification into multiple independent levels (e.g., unclassified, confidential, secret, top secret) that can coexist on the same processor. Each classification level operates as a separate domain with its own security policies, allowing data to be shared within appropriate classification boundaries while maintaining separation between different classification levels.
Solution Approach 2:
A separation kernel acts as an intermediary layer between applications and the underlying hardware/resources. This kernel enforces MLS policies by mediating all data access and communication between different classification levels, enabling secure data sharing while maintaining strict separation boundaries through centralized policy enforcement.
2Reliability
If system high classification protocol is used to maintain security, then data separation is ensured, but total system cost of ownership increases due to personnel clearing requirements
Solution Approach 1:
By segmenting the system into multiple independent classification levels with separate security domains, the system allows personnel to be cleared only to the specific classification level they need to access, rather than requiring clearance to the aggregate system-high classification. This reduces personnel clearance costs and administrative overhead.
Solution Approach 2:
Each classification level within the MLS system has its own local security policies and access controls tailored to that specific classification. This allows the system to apply security measures locally at each classification level rather than uniformly across the entire system, reducing the overall security burden and associated costs.
3Reliability
If separation kernel is used to achieve data separation on single processor, then MLS operation is enabled, but data separation across multiple processors is not achieved
Solution Approach 1:
The separation kernel is designed with universal MLS capabilities that function identically whether running on a single processor or multiple processors. The same core separation mechanisms and policy enforcement logic are applied across all processors in the system, allowing the kernel to seamlessly support both single-processor and multi-processor configurations without requiring different implementations.
Solution Approach 2:
The system extends data separation from the traditional single-processor dimension to the multi-processor dimension by implementing inter-processor communication protocols that maintain MLS boundaries. Messages passing between processors are tagged with classification levels and routed through domain gateways, adding a spatial dimension to separation while maintaining the same security model.
4Reliability
If multiple independent levels of security are implemented across multiple processors, then true MLS capability is achieved, but development and evaluation costs increase
Solution Approach 1:
The MLS system is segmented into modular components including domain gateways, separation kernels, and classification modules that can be independently developed, tested, and evaluated. This segmentation allows for targeted security evaluations of individual components rather than requiring comprehensive evaluation of the entire multi-processor system, reducing development and certification costs.
Data Source
AI summary
A multi-level security software architecture includes various components configured to provide full data separation across multiple processors while limiting the number and size of high assurance components. The architecture includes a domain separator for ensuring that messages exchanged between domains that are distributed on different microprocessors are securely routed between domain members. The domain separator verifies a message label including a domain identifier provided by a domain gateway and cryptographically binds the message label to each message via cryptographic keys. This prevents misrouting messages caused by accidental or malicious corruption of message labels. Additionally, the domain separator can encrypt messages as necessary to enforce data separation on shared network buses. The domain separator is also responsible for managing the cryptographic keys used to label or encrypt messages.