US5845068A
Expired / Lapsed
US
⏱️ 0.0 years remaining
Multilevel security port methods, apparatuses, and computer program products
Assignee: Oracle America Inc
•
Filing: 1996-12-18
•
Granted: 1998-12-01
•
Expires: 2016-12-18
Abstract
Abstract A multilevel port system on a computer operating under a multilevel operating system to permit contemporaneously opening a plurality of sockets having the same port number while meeting the requirements of an appropriate security policy, thus allowing third party applications to run as if they were unimpeded by the security policy, and methods thereby. The computer system having an operating system adhering to an access control security mechanism. Such systems include government systems wherein a hierarchy of security classification levels are defined (e.g., top secret, secret, classified, unclassified), and commercial systems. Sensitivity labels pursuant to an access control security mechanism include at least hierarchical security classifications, and may include non-hierarchical categories or compartments which represent distinct areas of information in a system. A port is characterized by a port number and a sensitivity label thus permitting opening a plurality of ports having identical port numbers and unique sensitivity labels.
Inventors
- 👤 Gary W. Winiger
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-11-05 05:50
CPC Classifications
H; H04; H04L; H04L63/00; H04L63/10; H04L63/105; G; G06; G06F; G06F21/00; G06F9/00; G06F9/06; G06F9/46; G06F9/54; G06F9/544; G06F12/00; G06F12/14; G06F12/1458; G06F12/1491; G06F2211/00; G06F2211/009; G06F2221/00; G06F2221/21; G06F2221/2113
Claims Analysis
Total Claims: 15
Claim 1
Independent Claim
132 words
A computer program product comprising: a computer useable medium having a computer readable program code mechanism embodied therein for generating a plurality of ports, said ports being associated with a common port number, each of said ports having a selected sensitivity label, said port number and said sensitivity label defining a selected port identifier for at least one of said ports, permitting multiple, simultaneous access to the port, said computer code mechanism comprising: first computer readable code mechanism for constructing a communications packet comprising a protocol header in turn comprising at least source machine identification, source port number, and destination port identifier region, said destination port identifier region including a destination port number and sensitivity label subregion; and second computer readable code mechanism for permitting reception communications packets for establishing receiver ports.
Claim 2
Dependent Claim
132 words
A computer program product comprising: a computer useable medium having a computer readable program code mechanism embodied therein for generating a plurality of ports, said ports being associated with a common port number, each of said ports having a selected sensitivity label, said port number and said sensitivity label defining a selected port identifier for at least one of said ports, permitting multiple, simultaneous access to the port, said computer code mechanism comprising: first computer readable code mechanism for constructing a communications packet comprising a protocol header in turn comprising at least source machine identification, source port number, and destination port identifier region, said destination port identifier region including a destination port number and sensitivity label subregion; and second computer readable code mechanism for permitting reception communications packets for establishing receiver ports.
Claim 3
Dependent Claim
191 words
A first program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to establish a multilevel port for enabling multiple, simultaneous access of a resource in a multilevel trusted system, said first program storage device comprising: first computer readable code devices configured to receive a communications packet from a source machine running an application instantiated in a first process, said packet comprising at least a first destination port number and a first sensitivity label; second computer readable code devices configured to examine said packet for identifying said port number and said sensitivity label, said port number and said sensitivity label, together providing a port identifier; third computer readable code devices configured to compare said port identifier to port identifiers associated with pre-existing open ports; and fourth computer readable code devices configured to open a port having the same port number as pre-existing open ports when said sensitivity label of said port identifier is unique as compared to sensitivity labels of pre-existing open ports, said opening permitting contemporaneous processes associated with a plurality of ports having the same port number, and a unique sensitivity label.
Claim 4
Dependent Claim
191 words
A first program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to establish a multilevel port for enabling multiple, simultaneous access of a resource in a multilevel trusted system, said first program storage device comprising: first computer readable code devices configured to receive a communications packet from a source machine running an application instantiated in a first process, said packet comprising at least a first destination port number and a first sensitivity label; second computer readable code devices configured to examine said packet for identifying said port number and said sensitivity label, said port number and said sensitivity label, together providing a port identifier; third computer readable code devices configured to compare said port identifier to port identifiers associated with pre-existing open ports; and fourth computer readable code devices configured to open a port having the same port number as pre-existing open ports when said sensitivity label of said port identifier is unique as compared to sensitivity labels of pre-existing open ports, said opening permitting contemporaneous processes associated with a plurality of ports having the same port number, and a unique sensitivity label.
Claim 5
Dependent Claim
29 words
A first program storage device as in claim 2 further comprising a kernel having a security portion, said security portion including said third and fourth computer readable code devices.
Claim 6
Dependent Claim
122 words
A first program storage device as in claim 3, further comprising: fifth computer readable code devices configured to pass a data portion of the communications packet to the process instantiating the application associated with the port previously opened in said port opening step; sixth computer readable code devices configured to prepare a reply communication packet for transmission to said first process, said reply communication packet comprising at least a destination port number, a second sensitivity label, and a reply; seventh computer readable code devices configured to transmit said reply communication packet to said source machine; and eighth computer readable code devices configured to process said reply communication packet by said source machine in accordance with the security protocol of said source machine.
Claim 7
Dependent Claim
89 words
A computer having a multi-level trusted operating system, comprising: a computer useable medium having a computer readable program code mechanism embodied therein for generating a plurality of ports, said ports being associated by a common port number, each of said ports having a unique sensitivity label, the combination of said port number and said sensitivity label defining a unique port identifier for each of said ports, said plurality of ports permitting multiple, simultaneous access of said common port number, said computer readable code mechanism in said multi level-trusted system.
Claim 8
Dependent Claim
89 words
A computer having a multi-level trusted operating system, comprising: a computer useable medium having a computer readable program code mechanism embodied therein for generating a plurality of ports, said ports being associated by a common port number, each of said ports having a unique sensitivity label, the combination of said port number and said sensitivity label defining a unique port identifier for each of said ports, said plurality of ports permitting multiple, simultaneous access of said common port number, said computer readable code mechanism in said multi level-trusted system.
Claim 9
Dependent Claim
61 words
A computer as in claim 5, wherein said computer readable code mechanism also includes computer readable code means for receiving a communications packet, for examining the packet to extract a destination port number and a sensitivity label, for determining the availability of a port having a unique port identifier address, and for opening a port having a unique port identifier address.
Claim 10
Dependent Claim
65 words
A multilevel port for permitting simultaneous access by a plurality of processes, each process having a different sensitivity label, the multilevel port defined by a common port number and a plurality of selected, unique sensitivity labels to permit two-way simultaneous communication between said port and ones of the plurality of processes having the same sensitivity labels as ones of said plurality of unique sensitivity labels.
Claim 11
Dependent Claim
65 words
A multilevel port for permitting simultaneous access by a plurality of processes, each process having a different sensitivity label, the multilevel port defined by a common port number and a plurality of selected, unique sensitivity labels to permit two-way simultaneous communication between said port and ones of the plurality of processes having the same sensitivity labels as ones of said plurality of unique sensitivity labels.
Claim 12
Independent Claim
197 words
A method for enabling simultaneous access of a port by a plurality of processes in a multilevel trusted system, comprising the steps of: intercepting a first communications packet in a second computer system, said communications packet generated by the kernel of a first computer system, said communications packet comprising a destination port number and a first sensitivity label; examining the communications packet to extract and identify said port number and said sensitivity label, said port number and said sensitivity label combination defining a port identifier; comparing said port identifier to the port numbers and sensitivity labels of pre-existing open ports; establishing a port in the event no pre-existing open port has the same port identifier as defined in said communication packet; establishing another port when one of the pre-existing ports has the same port identifier and a different sensitivity label as defined in said communication packet, said another port and said one of the pre-existing ports being simultaneously accessible by said plurality of processes; and passing the data portion of said communication package to an applications process in said second computer system, said applications process having a port number and sensitivity label equivalent to said port identifier.
Claim 13
Independent Claim
197 words
A method for enabling simultaneous access of a port by a plurality of processes in a multilevel trusted system, comprising the steps of: intercepting a first communications packet in a second computer system, said communications packet generated by the kernel of a first computer system, said communications packet comprising a destination port number and a first sensitivity label; examining the communications packet to extract and identify said port number and said sensitivity label, said port number and said sensitivity label combination defining a port identifier; comparing said port identifier to the port numbers and sensitivity labels of pre-existing open ports; establishing a port in the event no pre-existing open port has the same port identifier as defined in said communication packet; establishing another port when one of the pre-existing ports has the same port identifier and a different sensitivity label as defined in said communication packet, said another port and said one of the pre-existing ports being simultaneously accessible by said plurality of processes; and passing the data portion of said communication package to an applications process in said second computer system, said applications process having a port number and sensitivity label equivalent to said port identifier.
Claim 14
Dependent Claim
41 words
A method for enabling simultaneous access of a port as in claim 8 wherein said intercepting step is performed by a daemon operating between the data link and the network layers of a second computer system operating under an OSI protocol.
Claim 15
Dependent Claim
104 words
A method for enabling simultaneous access of a port as in claim 8 further comprising: preparing a reply; constructing a second, return communications packet, said return communications packet comprising at least a reply, a source port number, and a second sensitivity label associated with said applications process in said second computer system; transmitting said second communications packet to said first computer system; intercepting said second communications packet by a kernel in said first computer system; comparing said first sensitivity label to said second sensitivity label; and processing the reply in accordance with the security protocol associated with the kernel in said first computer system.
References Cited (Backward Citations)
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2001-11-30 | 2002-06-01 | 2002-12-01 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2005-11-30 | 2006-06-01 | 2006-12-01 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2009-11-30 | 2010-06-01 | 2010-12-01 | $7700.00 | Window Closed / Lapsed |