RSS
Green Hills Platform for Secure Networking
By one estimate, over 150 million sensitive records have been breached in the last three years alone. To combat this growing problem, companies employ an average of 30 security products throughout their organizations. It’s not just sophisticated, well trained hackers who commit cyber-crimes these days. With ready access to sophisticated hacker tools, security breaches are as easy as point-click-attack.
|
|||||
| The solution to fail-first, patch-later | |||||
|
The world has become accustomed to the fail-first, patch-later mentality of insecure software and computing infrastructure. Because of this, much of the world’s critical infrastructure, financial networks, medical information systems, telecommunications gear, and portable mobile devices are open to compromise by determined individuals, corporations, organized crime, and nation states. Network developers need to build in device security at the core of system design by starting with INTEGRITY operating system technology .The combination of INTEGRITY’s separation architecture, its advanced GHNet networking stack, and GateD Layer 2 switching/Layer 3 routing capabilities delivers unmatched security and reliability without compromising system throughput. Telecom OEMs and network device manufacturers can increase time-to-market by relying on a complete, proven, and integrated solution developed and supported by experts in telecommunications and networking.
|
|||||
| Maximum security and reliability | |||||
|
With INTEGRITY, embedded networking developers can ensure their applications meet the highest possible requirements for security, reliability, and performance. To achieve this, INTEGRITY uses hardware memory protection to isolate and protect application execution. Secure partitions guarantee each task the resources it needs to run correctly and fully protect the operating system and user tasks from errant and malicious code—including denial-of-service attacks, worms, and Trojan horses. Unlike other memory-protected operating systems, INTEGRITY never sacrifices real-time performance for security and protection.
|
|||||
| Guaranteed protection | |||||
 The INTEGRITY operating system provides all the capabilities embedded designers need to enforce the policies of separation, damage limitation, and information flow control as well as provide secure networking for today’s more complex and connected applications. INTEGRITY was designed from the beginning with network security in mind and supports the requirements and security policies of Multiple Independent Levels of Security (MILS)—the architecture for composing secure computing systems from high-assurance components. INTEGRITY's separation kernel protects against damage from errant or malicious code by preventing processes from writing beyond assigned memory regions. In addition, INTEGRITY’s partitions prevent unintended access to data from outside the partition where the data resides. INTEGRITY's Multiple Independent Levels of Security (MILS) separation kernel architecture provides a highly robust mechanism to separate security functions. INTEGRITY's separation kernel protects against damage from errant or malicious code by preventing processes from writing beyond assigned memory regions. In addition, INTEGRITY’s partitions prevent unintended access to data from outside the partition where the data resides. Deploying a networking solution based on the secure separation kernel architecture of the INTEGRITY operating system enables the highest levels of security for network devices. INTEGRITY was designed from the beginning with network security in mind and supports the requirements and security policies of Multiple Independent Levels of Security (MILS)—the architecture for composing secure computing systems from high-assurance components. INTEGRITY provides all the essential components required to harden networked devices against attack:
|
|||||
| GHNet Networking Stack | |||||
The GHNet TCP/IP stack is the foundation for all networking protocols for the Green Hills family of operating systems (including INTEGRITY, INTEGRITY-178B, and µ-velOSity™). A full-featured, high-performance host and router TCP/IP stack, GHNet was designed specifically for network-centric systems with options for advanced routing as well as an extensive suite of security protocols. GHNet is an ultra-compact dual-mode IPv4/IPv6 stack that combines a minimum footprint with maximum performance. GHNet is suited for use in products ranging from small footprint consumer devices to advanced core network equipment. It has broad RFC support, BSD 4.4 and NetLink socket API support, and has been through extensive protocol conformance and interoperability testing. It is also integrated with a broad range of networking applications, management, and security protocols. See the complete list of supported protocols below.
Modular design and scalability Extensive routing support Multiple instances True zero copy Written by US citizens | |||||
| GateD: the standard for Internet routing | |||||
 ) Green Hills Software’s GateD family of products is a processor-neutral, comprehensive data-plane and control-plane solution that provides complete source code for Layer 2 switching and Layer 3 routing protocols. The scalability of the code, complete functionality, and expansive set of APIs make the code ideal for inclusion in carrier-grade core, edge, and aggregation devices. For over fifteen years, hundreds of products have been built around GateD Layer 3 routing technology. As the chosen standard starting point for anyone who required Internet routing—GateD provides everything from server redundancy to the most scalable, core IP routers. Representing a substantial evolutionary step forward, GateD provides equipment manufacturers with exactly the functionality they require for building next-generation carrier-targeted equipment: core and edge IP routers as well as aggregation devices. GateD is a complete control-plane solution, with all requisite protocols packaged conveniently for inclusion in a wide range of next-generation carrier devices. Available components include complete support for both unicast control-plane routing for Ipv4 and IPv6 (call Green Hills Software sales for availability of multicast protocols). Equipment manufacturers can pick and choose from these individual components when developing their carrier-class networking equipment, only designing in what is needed at the time but offering seamless upgrading to add other GateD protocols in the future.
The modular design of GateD allows common functionality, data structures, and APIs to be shared across protocols. From an equipment manufacturer’s perspective, this provides two immediate advantages:
» More on GateD Routing & Switching Solutions | |||||
| GateD Layer 2: the benchmark for next-generation switches* | |||||
|
The Green Hills GateD suite of layer 2 switching protocols provides OEM developers with more out-of-box features, greater flexibility, reduced memory and CPU usage, and advanced carrier-grade scalability and functionality—all while also simultaneously reducing development time, development cost, and ongoing product maintenance. With the GateD Suite of Switching Protocols and its range of advanced components, developers can dramatically reduce time-to-market for a range of network devices, including:
The GateD suite of switching protocols sets the benchmark for the next generation of OEM Ethernet switching solutions. GateD provides a comprehensive feature set that requires no additional engineering work, yet still allows maximum flexibility in configuration and deployment. To speed product development, developers only need to modify a few constants in a single, convenient header file to optimize memory consumption and match software to hardware functionality. Combined with one of Green Hills Software’s out of-the-box ports available on a number of reference designs, an OEM can get to QA with a fully-featured, stable switch in the shortest time possible. For advanced functionality, the GateD Hardware Abstraction Layer (HAL) can be populated with driver-specific calls that leverage features in custom silicon. Developers can also fully integrate switching protocols with the Green Hills carrier-grade routing stack on their own or with the help of Green Hills Software’s professional services engineers. With its comprehensive feature set, GateD switching protocols can support equipment requirements spanning from simple bridging and switching, to advanced VLAN and prioritization support for voice, video, and data triple plays. Raising the bar on security Built on top of common GateD core functionality, which is pre-audited to remove security holes, such as buffer overrun exploits, the GateD switching protocols provide simple yet comprehensive API to 802.1x port-based authentication schemes. This powerful API allows for easy integration, not just with off-the-shelf solutions such as RADIUS or TACACS+, but also with any proprietary security access you need to deploy. GateD’s VLAN capabilities allow any individual VLAN to be configured as the management network. 802.1x authentication control is on a per logical port basis, giving your customers the greatest level of user control possible. Security and user access is enhanced further by powerful access control lists for easy support of any filtering capability available in hardware, and basic switch defenses against malicious activity such as broadcast storms. The additional use of AgentX as the SNMP configuration mechanism allows support for SNMPv3 in conjunction with SSH for another level of unparalleled security. Native triple-play support With appropriate support available from Green Hills’ professional services organization, your network managers can focus on fine-tuning ingress and egress traffic flows (where the number of flows per queue is only limited by hardware) on a per-port or per service basis. There is no more comprehensive solution that will allow customers to speed deployment of converged voice, video, and data networks. | |||||
| Advanced system managment | |||||
One of the most time-consuming challenges facing equipment manufacturers today is the integration of management across their various subsystems. Green Hills provides two ways to help solve this problem. With GateD Command Line Interface (CLI) module, you can start working with the code as soon as you receive it. Also, the CLI can be easily extended to manage the rest of the system. The GateD AMI provides a simple, consistent interface for integration with the management plane. Additionally, the AMI Agent allows communication with a remote management plane. The AMI Agent is easily ported to a variety of messaging systems and provides a common point for integration with existing CLIs, web user interface, or out-of-band management tools. For network management, Green Hills includes the standard SNMP MIBs with most protocols. Generic access to the MIBs is achieved through the SMUX and AgentX protocols, developers then use the SNMP agent of their choice. As with all other common functionality, the SMUX and AgentX implementations are shared by all of the routing protocols, so once an agent is set up to interact with it, no further work is needed as additional protocols are added. When it comes to logging, debugging, and error reporting, the AMI allows in-depth debugging information to be routed to the CLI or log files, giving the developers direct access to the run-time state. The developer can query information on the state of the routing tables, interfaces, or individual protocols. Additionally, the protocols share common tracing and logging functions that keep track of events with a configurable level of verbosity. The output of this information can be sent to just about any destination, whether it is to a file in memory or on disk, to a syslog mechanism, or to the console or some other output device as a stream.  AMI:direct access to the code The AMI Agent is designed for easy integration with any messaging system available on the control plane operating system. AMI’s simple, consistent API dramatically improves speed of integration with any user interface, providing substantial speed-up in product time-to-market. When used in conjunction with the AMI Agent, the management plane can be off-loaded to a separate processor, or an entirely different card, removing management overhead from the control plane and improving efficiency. When combined with Green Hills’ CLI module, dozens of engineering years can be saved.
 De facto standard for configuration management
The CLI comes pre-integrated with our Advanced Management Interface (AMI) providing equipment manufacturers with the broadest possible set of choices in the design of the management plane for their device. The AMI Agent mechanism allows the CLI to operate directly on the control plane, as it would in a traditional router, or to be located on a separate management blade in the chassis, as is the design in some of today’s new, high-end equipment. At Green Hills Software we understand that there is more to a system than just the control plane. That’s why our CLI module is also designed with extensibility in mind. New commands are easily added to manage additional sub-systems, such as line cards, layer 2 protocols, or application components. And the CLI module back-end is designed to easily integrate with legacy management APIs for support of these additional components. | |||||
| INTEGRITY Multivisor | |||||
 Channel density is another critical consideration for equipment manufacturers. As processor speeds increase, manufacturers need to squeeze more channels and data throughput onto a single CPU. But to do this, some hardware redundancy may need to be sacrificed. With Green Hills Software’s separation kernel technology and the guaranteed resource allocations it provides, developers can securely and reliably execute multiple virtual processors and guest operating systems on a single device. This enables them to retain the same redundancy architecture while consolidating software from multiple CPUs onto a single CPU. Features and benefits of Green Hills Software’s INTEGRITY Multivisor:
Professional services |
|||||
Dual
mode IPv4/IPv6