Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

1-10 Introduction
Additional Sidewinder G2 operating characteristics
Figure 1-5. Logical
network protocol stacks
provide network
separation
One of the unique aspects of the SecureOS is the use of multiple
logical network stacks to strengthen the enforcement of the inter-burb
aspects of the system security policy. A network stack consists of
different layers of software responsible for different aspects of the
communications. For example, one layer checks a message’s routing
information to ensure that it is transmitted to the correct network.
Normal computing systems, and firewalls that operate on an
unsecured OS, have only one network stack.
The SecureOS includes modifications that provide stronger separation
of communication between different burbs. There are checks at all
layers of the software to ensure that the network stack data from one
burb is not mixed with, or impacted by, data associated with another
burb. This logical separation of the network stacks by the security
burb is augmented by the Type Enforcement security policy, which is
integral to SecureOS. It controls all operational aspects of the system,
including enforcement of the separation data processing by the
security burb. This ensures that information passes from one burb to
another only if the network security policy says the specific
information flow is allowed.
Figure 1-5 shows this logical network separation and the processing
elements involved in the transfer of data between the network stacks
associated with each burb. Before a process can interact with a
network stack, the Type Enforcement security policy must indicate
that the process is allowed to interact with that burb’s network stack.
trusted
network
Sidewinder G2
logical network
protocol stacks
Internet