Parallel Guard Engines for Cross-Domain Data Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cross-domain security solutions face challenges in achieving redundancy and non-bypassability without introducing processing latency, particularly in the sequential inspection of data packets by guard engines.
Innovation Solution
A cross-domain cryptographic system employing parallel guard engines and sequential cryptography, utilizing random number generators to generate one-time pads for encryption and decryption, ensuring data packets are inspected in parallel while maintaining sequential cryptographic control, thereby reducing latency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If guard engines operate sequentially to achieve redundancy and non-bypassability, then security reliability is improved, but processing latency increases
Solution Approach 1:
The patent segments the security inspection process by dividing guard engines into parallel inspection units that can simultaneously examine different aspects of data packets. Each guard engine operates independently on copied packet data, allowing redundant security checks to occur concurrently rather than sequentially, thus maintaining reliability while reducing latency.
Solution Approach 2:
The patent implements preliminary cryptographic operations on data packets before parallel inspection. Encryption and decryption are performed in advance using cryptographic engines, so that when packets reach parallel guard engines, the cryptographic overhead has already been handled. This preliminary action allows parallel inspection to proceed without adding sequential cryptographic delays.
2Reliability
If redundant guard engines inspect packets sequentially, then non-bypassability is achieved, but processing speed decreases
Solution Approach 1:
The patent transitions from sequential inspection (one dimension of time) to parallel inspection by introducing spatial dimensionality. Multiple guard engines are arranged in parallel configurations that can simultaneously process packet copies, effectively adding a spatial dimension to the inspection process. This maintains non-bypassability through redundant checks while dramatically improving processing speed through concurrent operations.
Solution Approach 2:
The patent creates copies of data packets for distribution to multiple parallel guard engines. Instead of passing a single packet through sequential inspection, the system generates redundant packet copies that can be inspected simultaneously by different guard engines. This copying mechanism enables parallel processing while ensuring that all inspection paths must be satisfied for packet transmission, maintaining non-bypassability.
3Loss of time
If parallel guard engines are used, then processing latency is reduced, but cryptographic control complexity increases
Solution Approach 1:
The patent merges cryptographic control functions into centralized cryptographic engines that manage encryption and decryption for all parallel guard engines. Instead of each guard engine having independent cryptographic controls, the system combines cryptographic operations into shared resources that serve multiple parallel inspection paths. This merging reduces overall cryptographic control complexity while enabling parallel processing.
Solution Approach 2:
The patent introduces cryptographic engines as intermediary components that mediate between parallel guard engines and data packets. These intermediary cryptographic engines handle the complexity of cryptographic operations, providing a simplified interface for parallel guard engines while maintaining secure cryptographic control. The intermediary layer manages the coordination and synchronization required for parallel cryptographic operations.
Data Source
AI summary
A system and method for cross-domain parallel inspection of data packets in transit between domains of differing security classification incorporating sequential cryptographic control is disclosed. In embodiments, the system includes first and second random number generators, each generating a one-time pad for transmission to both a corresponding front-end cryptographic engine and a parallel guard engine. The cryptographic engines double encrypt the data packet in sequence according to the one-time pads, storing the encrypted packet in a holding register. Each guard engine inspects the data packet in parallel, indicating approval by transmitting a release to the holding register and sending its one-time pad to a back-end cryptographic engine. When the holding register receives both releases, the double encrypted packet is sequentially decrypted by the back-end cryptographic engines in reverse order according to the one-time pads received from the guard engines. The fully decrypted data packet is transferred to the second domain.