Abstract: Mobile ad hoc Network (MANET) includes a first node of a plurality of nodes which self-assigns a role as a part of a network-spanning backbone upon a determination by the first node that one or more criteria have been satisfied. The first node uses the network-spanning backbone to facilitate a first-tier control plane communication service within the MANET. The first node also communicates within the MANET using a second-tier control plane communication service separate from the first-tier control plane communication service. The second-tier control plane communication service is used by the first node when communicating exclusively with neighbor nodes that are a 1-hop distance from the first node.

Abstract: Mobile ad hoc Network (MANET) includes a first node of a plurality of nodes which self-assigns a role as a part of a network-spanning backbone upon a determination by the first node that one or more criteria have been satisfied. The first node uses the network-spanning backbone to facilitate a first-tier control plane communication service within the MANET. The first node also communicates within the MANET using a second-tier control plane communication service separate from the first-tier control plane communication service. The second-tier control plane communication service is used by the first node when communicating exclusively with neighbor nodes that are a 1-hop distance from the first node.

Abstract: A secure file service includes a cryptographic processor (302, 602) and a secure file system (301, 601). The cryptographic processor is comprised of a trusted microprocessor and a trusted operating system executing on the trusted cryptographic processor. The cryptographic processor includes hardware and software for accessing at least one classified data file from the secure file system, decrypting the classified data file, and serving the classified data file in decrypted form to a secure user processor (402, 502, 702) that has requested the file. The secure file system can be either a single-level secure file system (301) or a multi-level secure file system (601).

Abstract: Method for providing a single level secure (SLS) user processor (402, 502) with access to a multi-level secure (MLS) file system (300). The method begins by authenticating a user to a cryptographic processor (302) by communicating one or more types of user authentication information to the cryptographic processor. Based on such authentication, the MLS file system services are provided such that the SLS user processor (402, 502) has access to files (306, 308, 310, 312, 314) at only one defined security classification level at a time. The method also includes zeroizing one or more data stores used by the SLS user processor each time the SLS user processor transitions between accessing classified data files at a first security classification level and a second security classification level.

Abstract: System for providing a secure file service includes an MLS file service module (300) comprised of a cryptographic processor (302). The MLS file service module also includes an MLS file system (301) hosted by the cryptographic processor. A secure user processor (402) includes programming and communications hardware for requesting at least one classified file from the MLS file service module. The cryptographic processor includes cryptographic hardware and software to decrypt the classified file. The cryptographic processor is also performs an integrity check on the classified file. Once the file is decrypted and its integrity checked by the cryptographic processor, the MLS file service module serves the classified file to the secure user processor in decrypted form. If the classified file is an executable file, the method also includes selectively enabling a write function for program memory of the secure user processor.

Abstract: Authentication and access control device (104) includes a first security key sub-system (110, 112, 114, 116, 118). The first security key sub-system is responsive to an input signal for providing a first key code required for permitting a user access to a controlled resource. The device advantageously also includes a second security key sub-system (110, 112, 114, 116, 118) for providing a second key code different from the first key code. The second key code is useful for authenticating the user or facilitating secure use of a particular controlled resource (102).

Abstract: Mobile PDA computer system (300) includes a secure user processor (302), a non-secure user processor (306), a cryptographic engine (304), and a shared human/machine interface (HMI) (308). The secure user processor (302) can be comprised of a first trusted microprocessor and a first trusted operating system executing on the first trusted microprocessor. The non-secure user processor (306) can be comprised of a second non-trusted microprocessor and a second non-trusted operating system executing on the second non-trusted microprocessor. A cryptographic engine (304) can be comprised of a third trusted cryptographic processor and a third trusted operating system executing on the third trusted cryptographic processor. The cryptographic engine can be configured for encrypting and decrypting data. A first data communication link (303) communicates data between the secure user processor and the cryptographic engine.

Abstract: Mobile PDA computer system (300) includes a non-secure processor (306), comprising an untrusted microprocessor and an untrusted operating system executing on the untrusted microprocessor. The system also includes a secure processor (302), comprising a trusted microprocessor and a trusted operating system executing on the trusted microprocessor. A cryptographic engine (304) is provided for encrypting and decrypting data. A first data communication link (303) communicates data between the secure processor and the cryptographic engine. A second data communication link (305) communicates data between the non-secure processor and the cryptographic engine. In this way, the cryptographic engine forms a bridge between the secure user processor and the non-secure user processor.

Abstract: A software-defined radio includes a pair of radio subsystems such as a red (command) and black (data) radio subsystem having an operating environment conforming to the Software Communications Architecture (SCA) specification, for example, as used for Joint Tactical Radio System (JTRS). A clock is read by at least one of the radio subsystems for determining time of day. A processor of the radio subsystem is operative for distributing the time of day to the radio subsystems using a global hardware timing pulse. Each processor can include a free-running timer to which any time sources within the pair of radio subsystems are set.

Abstract: Method for synchronizing stored data in one device (102, 106, 202, 206, 210) with other devices (102, 106, 202, 206, 210) at multiple levels of security classification. The methods and systems disclosed herein can advantageously utilize unique protocols and, optionally, cryptographic technologies to effect data synchronization in a secure manner.