The Sentinel Multi-Domain Security System
Secured Processing, Inc. (SPI) develops and markets products that provide multiple secure data processing domains while also protecting an organization's valuable information from theft, exploitation, and destruction. With our products, your organization can control who can access your organization's most valuable information and how it is processed and stored.
Is your valuable data protected against Insider and External Threats?
An organization's survival in this information technology era depends on its ability to protect its valuable data. Most defenses have been designed to protect information from network "Hackers," while the most predominant threat is INSIDE your organization. "Insiders" can be disgruntled employees, agents of foreign governments and/or terrorist organizations, criminals, or intruders that slip past the organization's physical and administrative security. They can appear as trusted employees and are especially dangerous and effective because they have inside knowledge of defenses. Most organizations rely on User Identification and Authentication (I&A) based on PIN and Password and discretionary access control enabled by the operating system software that can easily be spoofed or overcome by an Insider. In addition, unprotected network or USB ports can be used to download valuable data or upload malware. A recent example of the latter in which malware contaminated Jump Drives were used by Insiders to attack a major DoD Command was reported by CBS News 60 minutes on November 8, 2009. Similarly, defenses against external threats from hackers also rely on software based defenses that can be easily disabled. The Sentinel is immune to such threats and also provides the user with a capability to counter on-going external attacks by closing vulnerable computer network and USB ports.
The Sentinel Concept
SPI designed the Sentinel to provide secure Multifactor I&A and a combination of Mandatory and Discretionary Access Control to secure access to multiple data domains, USB ports, Network ports, and Portable Media Drives within any host computer. The Sentinel can be easily installed within or external to the host computer in minutes. All Sentinel controls are isolated from host computer data interfaces so there is no possibility of a Hacker from disabling its operation or an Insider without physically removing the system, which requires special tools.
The I&A Process
The primary Sentinel component is the Security Module, which is easily setup to work with the host computer and includes the patented circuitry and firmware to control all sentinel security functions. This includes Multifactor I&A based on a Smart Card that is inserted by the user into the Security Module’s integrated Smart Card Reader to verify their PIN, Password, and biometric data entered from their keyboard and validated against the encrypted data separately stored within the Smart Card and the Security Module. In addition, the Smart Card also utilizes an encrypted electronic key called a Machine Authorization Code (MAC) that is matched to the MAC that is stored and encrypted in the Security Module. These keys are verified by the Security Module whenever a Smart Card is inserted and if they don’t match the card is rejected and the I&A process cannot proceed. The I&A process also uses the MAC to link the user to their selected secure domain and the domain operating system, software and protected data. If the MAC within the secure domain media device and the MAC on the User’s Smart Card and/or Security Module do not match the media and the host computer are not powered on. The I&A process is only necessary during initial login and as long as the Smart Card is not removed, it is not repeated for each domain access.
The Access Control Process
In addition to I&A data, a user’s Smart Card is also programmed by a Security Administrator with the user’s mandatory access rights to data within a domain based on their Security Clearance Level. Similarly, access to domain resources such as network and USB ports are programmed for individual users for each domain based on the discretion of the Sentinel Security Administrator as determined based on need and potential threat. Each Security Module can also be setup by the Security Administrator with a discretionary security policy for access to domains, ports and portable media or a group policy can be installed for all or subsets of installed Security Modules. This can be refined even further by controlling access to domains and each individual domain resource based on Time of Day (TOD) in increments as small as 1 minute. Overall access is implemented by the Security Module based on the “minimum privilege” level determined by comparing programmed Smart Card and Security Module privileges. This allows the Security Administrator to minimize Insider risks based on host computer location, user base, or threat environment. The Sentinel is also designed to lockout users from making modifications to security settings while preventing Security Administrators from gaining access to user data. Additional protection is provided by the Sentinel's capability to collect and process security-related audit data on all user and administrator functions.
Effective and Inexpensive
The Sentinel is the least expensive MDS solution on a per user basis with respect to both acquisition and support costs. By replacing the need for multiple computers or expensive hardware, software, and infrastructure, savings in excess of 60% can be achieved in acquisition, maintenance, and energy consumption costs. In addition, the level of security is enhanced against both Insider and External Threats by providing Security Administrators and computer users with unprecedented control over potential vulnerabilities.
Back to Top
