When was the last time that you heard the words “ fast ”, “ high-assurance ” and “ easy-to-integrate ” to describe the same security product?
System integrators are under increasing pressure to provide strong security for their systems, while providing greater functionality and flexibility to the Warfighter. At the same time budget pressures dictate that programs have fewer dollars to spend.
PCSexpress is the definitive implementation of the MILS Partitioning Communication System architecture. PCSexpress saves size, weight, and power while decreasing certification and accreditation costs.
PCSexpress provides complete control of each information flow between applications in a distributed system. PCSexpress provides high robustness separation of data throughout network communications.
PCSexpress is high-assurance COTS security software to build high-performance, GIG-connected systems. Objective Interface developed PCSexpress specifically for high assurance certification, including:
- Common Criteria EAL 6+
- DCID 6/3 PL 5
- DO-178B Level A
Click here to download the PCSexpress brochure.
- PCSexpress is Secure Communications Infrastructure
|
|
PCSexpress is high-performance, real-time communications software that provides securely separated communications channels between systems. |
- PCSexpress is Independent of Communications Protocols
|
PCS express enables secure intersystem communications and strong node/application authentication over a wide variety of communication protocols including:
- point-to-point (e.g., TCP, UDP, SCTP, RapidIO, VME, PCI, et al) and
- point-to-multipoint (e.g., IP Multicast, FireWire, USB, Link16, et al).
|
- PCSexpress is Key to Multiple Independent Levels of Security (MILS)
|
PCSexpress is a critical component of MILS that extends the Separation Kernel's policy enforcement to distributed systems. |
- PCSexpress is High Assurance
|
PCSexpress is high assurance COTS middleware, certified to the highest levels of the Common Criteria. With PCSexpress, the communications security policy is enforced by a component that is based upon years of research by Objective Interface in cooperation with the DoD, major defense prime contractors, and academia. |
- PCSexpress Protects Investment in Legacy Applications
|
|
PCSexpress allows legacy network applications to run without change. PCSexpress makes communication security transparent to the application, middleware, and network protocols. PCSexpress allows for the continued use of existing middleware solutions to develop and deploy applications. PCSexpress operates independently of traditional middleware such as CORBA, DDS, SQL, Web Services, .NET and others. Existing code bases and libraries can remain essentially unmodified even though their security requirements have changed or increased. |
- PCSexpress Reduces Certification and Accreditation risk
 |
PCSexpress was designed and implemented following NSA guidelines for High Robustness certification. PCS express reduces schedule and cost risk for certification and accreditation. |
- PCSexpress Simplifies Secure Application Deployment
 |
PCSexpress lets each developer concentrate on his application without worrying about securing how that application communicates. Architects draw systems as functional boxes connected by data flow arrows. PCSexpress guarantees data can only flow along those arrows, and that there are no unintended arrows. Information flow between functional boxes can be trusted. The communication system cannot introduce unwanted side effects. The PCSexpress damage limitation capability isolates obscure application bugs such as accidental bandwidth overrun. This modularization of concerns lets each developer concentrate on the behavior to be implemented, reducing schedule uncertainty and risk. |
- PCSexpress Allows Quick Reaction to Changing Requirements
 |
Changes in infrastructure and communications security requirements are accommodated without changes to the application because communication channel security is independently administered. |
- PCSexpress is Easy to Administer
 |
Each user community can independently control system authorization and manage their own security. Security enforcement is automatically coordinated. |
- PCSexpress Enables Coalition Force Operations
 |
PCSexpress makes it easy to create and connect a wide variety of communities of interest on a secure basis. This means that for the first time, coalition force network operations can easily separate the communication between coalition partners so that each partner can quickly access authorized information without manual intervention. |
- PCSexpress Allows Agile Networking
|
PCSexpress ' ability to bridge between networks and across domains provides the capability that Network Centric Operations (NCO) demands. This capability allows the Warfighter to leverage information supremacy.
|
- PCSexpress Enables High-Performance Communications
The total zero-copy architecture optimizes the performance of network communications and minimizes security overhead. Latency (delay for delivering the first byte) and bandwidth reduction (delay added to each additional byte) are optimized specifically for each Separation Kernel platform. Exhaustive benchmarking has shown that bandwidth is most severely constrained by the number of times that data buffers are copied by applications, stacks, and middleware. Objective Interface has worked directly with each Separation Kernel vendor to implement secure data transfer between partitions without copying.
- PCSexpress Enables Fault Tolerant Systems
The PCSexpress design precludes a single point of failure. This means:
- the PCSexpress security infrastructure safely survives node and communication link failures and
- system architects can configure applications that survive node and communication link failures.
- PCSexpress Enables Agile (and Secure) Network Configuration
PCSexpress provides safe and secure dynamic addition and reconfiguration of deployed, active channels. This enables systems to react quickly to changing requirements and facilitates Network Centric Operations.
- PCSexpress is Application Transparent
The strong security capabilities of PCSexpress are provided in a form that isolates application code from the complexity of the security functions (identification, authentication, authorization, policy administration, etc.). Thus, applications can evolve independent of the security function. The administration of the security function is independent of the applications.
- PCSexpress Enforces Information Flow
PCSexpress allows security administrators to set security policies as explicit information flows between robustly separated subjects. Information flow-based policy administration is simpler and more adaptable to changes in requirements than a lattice-based policy (Bell-LaPadula write-up/read-down, Biba read-up/write-down, etc.).
- PCSexpress Safeguards Information Flow
PCSexpress communication channels are protected with high assurance. PCSexpress performs strong node and application authentication before data is allowed to flow. Bandwidth allocations are enforced guaranteeing quality of service. Covert timing and storage channels are suppressed. Distributed key supercession and promotion of key generations to deployed systems ensure confidentiality and integrity of data. Forward secrecy for group and point-to-point communication is maintained. The bottom line is that applications can communicate more securely without implementing additional security functions.
- PCSexpress Provides Trustworthy Separation
Multiple physical networks are no longer required to guarantee that data with different security levels (TOP SECRET vs. SECRET) or belonging to different Communities of Interest (SECRET NOFORN vs. SECRET NATO) will remain separate. PCSexpress cryptographically separates multiple data flows. Duplicate “air gap” communication links used to ensure separation can now be collapsed down to a single physical channel based on COTS networking equipment. Traffic on one logical flow cannot affect, or even be detected by, the parties exchanging data on any other logical flow. Projects realize significant savings in size, weight and power as well as cost.
The Separation Kernel foundation plus the high-assurance engineering process that produced the PCSexpress software means that PCSexpress is:
- N on-bypassable —the security functions cannot be circumvented
- E valuatable —the security functions small enough and simple enough to be mathematically verified and evaluated
- A lways invoked —the security functions are invoked each and every time
- T amperproof —subversive code cannot alter the function of the security functions by exhausting resources, overrunning buffers, or other forms of making the security software fail
- PCSexpress Enables Layered Assurance
PCSexpress provides a robust communications foundation guaranteeing that distributed downgraders, guards, and firewalls cannot be bypassed. Complex systems can then be decomposed into functional modules that can interact only in predictable ways. Because of this certainty, each module can be individually evaluated and certified, simplifying system accreditation and maintenance.
- PCSexpress Enables Distributed Management of Security Policies
PCSexpress robustly supports independent management of distributed authorizations. Centralized policy management is not required. Each user community can independently specify and manage their own security policies including constraints on policy interaction. Policies are automatically combined to control authorization.
- PCSexpress Enables Secure Communications Over Untrusted Networks
PCSexpress assumes that the network is not trustworthy. Data is safeguarded before it is placed in the custody of the communications infrastructure. Not relying upon the network to have any security properties enables the system designer to utilize COTS protocol stacks, network interfaces, transmission media, hubs, switches, and routers without exposing distributed data to additional threats.
PCSexpress makes development, accreditation, deployment, operation and maintenance of high-assurance distributed systems affordable. The MILS architecture significantly increases the protection, reduces time to develop, and reduces schedule risk of deploying technology to provide high assurance systems that are both safe and secure.
|
