Green Hills Platform for Secure Networking
By one estimate, over 150 million sensitive records have been breached in the last three years alone. To combat this growing problem, companies employ an average of 30 security products throughout their organizations. It's not just sophisticated, well trained hackers who commit cyber-crimes these days. With ready access to sophisticated hacker tools, security breaches are as easy as point-click-attack.
The world has become accustomed to the fail-first, patch-later mentality of insecure software and computing infrastructure. Because of this, much of the world’s critical infrastructure, financial networks, medical information systems, telecommunications gear, and portable mobile devices are open to compromise by determined individuals, corporations, organized crime, and nation states.
Network developers need to build in device security at the core of system design by starting with INTEGRITY operating system technology .The combination of INTEGRITY’s separation architecture, its advanced GHNet networking stack, and GateD Layer 2 switching/Layer 3 routing capabilities delivers unmatched security and reliability without compromising system throughput.
Telecom OEMs and network device manufacturers can increase time-to-market by relying on a complete, proven, and integrated solution developed and supported by experts in telecommunications and networking.
With INTEGRITY, embedded networking developers can ensure their applications meet the highest possible requirements for security, reliability, and performance.
To achieve this, INTEGRITY uses hardware memory protection to isolate and protect application execution. Secure partitions guarantee each task the resources it needs to run correctly and fully protect the operating system and user tasks from errant and malicious code—including denial-of-service attacks, worms, and Trojan horses.
Unlike other memory-protected operating systems, INTEGRITY never sacrifices real-time performance for security and protection.
The INTEGRITY operating system provides all the capabilities embedded designers need to enforce the policies of separation, damage limitation, and information flow control as well as provide secure networking for today's more complex and connected applications.
INTEGRITY was designed from the beginning with network security in mind and supports the requirements and security policies of Multiple Independent Levels of Security (MILS)—the architecture for composing secure computing systems from high-assurance components.
INTEGRITY's separation kernel protects against damage from errant or malicious code by preventing processes from writing beyond assigned memory regions. In addition, INTEGRITY's partitions prevent unintended access to data from outside the partition where the data resides.
INTEGRITY's Multiple Independent Levels of Security (MILS) separation kernel architecture provides a highly robust mechanism to separate security functions. INTEGRITY's separation kernel protects against damage from errant or malicious code by preventing processes from writing beyond assigned memory regions. In addition, INTEGRITY's partitions prevent unintended access to data from outside the partition where the data resides.
Deploying a networking solution based on the secure separation kernel architecture of the INTEGRITY operating system enables the highest levels of security for network devices. INTEGRITY was designed from the beginning with network security in mind and supports the requirements and security policies of Multiple Independent Levels of Security (MILS)—the architecture for composing secure computing systems from high-assurance components.
INTEGRITY provides all the essential components required to harden networked devices against attack:
- Protected execution of applications and system service
- Guaranteed resource allocation and application execution
- Information flow control between partitions, stack, router and application isolation
- Containment of errors and attacks
The GHNet TCP/IP stack is the foundation for all networking protocols for the Green Hills family of operating systems (including INTEGRITY, INTEGRITY-178B, and µ-velOSity™). A full-featured, high-performance host and router TCP/IP stack, GHNet was designed specifically for network-centric systems with options for advanced routing as well as an extensive suite of security protocols.
GHNet is an ultra-compact dual-mode IPv4/IPv6 stack that combines a minimum footprint with maximum performance.
GHNet is suited for use in products ranging from small footprint consumer devices to advanced core network equipment. It has broad RFC support, BSD 4.4 and NetLink socket API support, and has been through extensive protocol conformance and interoperability testing. It is also integrated with a broad range of networking applications, management, and security protocols. See the complete list of supported protocols below.
GHNet is a true dual mode IPv4/IPv6 stack and can be configured for IPv4 only, IPv6 only, or to support both protocols simultaneously. This is an important feature since the transition from IPv4 to IPv6 is expected to take several years. Furthermore, the IPv6 functionality has been approved by the industry standard IPv6 READY Program, which guarantees IPv6 interoperability.
Modular design and scalability
The GHNet protocol suite has a modular design and is highly configurable, providing maximum size and feature scalability. If a module isn’t used, instead of being merely deactivated it is removed entirely to save valuable storage memory space in the often limited capacity of an embedded device.
Extensive routing support
GHNet can be configured to support host-only stack features with minimal footprint, or enabled with advanced routing features. The built-in virtual routing and forwarding support enables a single stack to assume the responsibility of multiple TCP/IP stacks. As a result, existing hardware and software capabilities can be used far more efficiently. Furthermore, GHNet is integrated and optimized to work with Green Hills Software’s GateD Layer 3 routing solutions that include OSPFv2/v3, BGP, RIP, RIPng, IS-IS, PIM-SM/SSM/DM, and MSDP, DVMRP.
GHNet can be configured to run in either the kernel’s address space, or in a separate partition for maximum security and availability. Multiple instances of the stack can be run in separate partitions enabling these stacks to execute at multiple independent levels of security, easily managing multiple Ethernet connections securely and independently.
True zero copy
To optimize processing speed and packet throughput, GHNet offers a zero copy API with the option for true zero copy for raw sockets, UDP, and TCP from the application all the way through the driver (including the TCP layer when the stack is running in kernel mode).
Written by US citizens
GHNet is a clean room design, written by US citizens from the ground up. It was not derived from publicly available Unix stacks or open source software. The design achieves Berkeley 4.4 and Netlink socket compatibility, small size, and high performance for both IP and UDP traffic.
Green Hills Software’s GateD family of products is a processor-neutral, comprehensive data-plane and control-plane solution that provides complete source code for Layer 2 switching and Layer 3 routing protocols. The scalability of the code, complete functionality, and expansive set of APIs make the code ideal for inclusion in carrier-grade core, edge, and aggregation devices.
For over fifteen years, hundreds of products have been built around GateD Layer 3 routing technology. As the chosen standard starting point for anyone who required Internet routing—GateD provides everything from server redundancy to the most scalable, core IP routers. Representing a substantial evolutionary step forward, GateD provides equipment manufacturers with exactly the functionality they require for building next-generation carrier-targeted equipment: core and edge IP routers as well as aggregation devices.
GateD is a complete control-plane solution, with all requisite protocols packaged conveniently for inclusion in a wide range of next-generation carrier devices. Available components include complete support for both unicast control-plane routing for Ipv4 and IPv6 (call Green Hills Software sales for availability of multicast protocols). Equipment manufacturers can pick and choose from these individual components when developing their carrier-class networking equipment, only designing in what is needed at the time but offering seamless upgrading to add other GateD protocols in the future.
The modular design of GateD allows common functionality, data structures, and APIs to be shared across protocols. From an equipment manufacturer’s perspective, this provides two immediate advantages:
- Additions and modifications to existing APIs at points of integration have limited effect on the stability of existing protocols. This means that even major new features can be deployed without anxiety over changes to long-established, de facto standard code, such as Green Hills’ Fast OSPF and BGP implementations.
- New protocols inherit a high degree of stability and robustness for the long deployment of standard functions, such as memory allocation, scheduling, and routing policy.
The Green Hills GateD suite of layer 2 switching protocols provides OEM developers with more out-of-box features, greater flexibility, reduced memory and CPU usage, and advanced carrier-grade scalability and functionality—all while also simultaneously reducing development time, development cost, and ongoing product maintenance.
With the GateD Suite of Switching Protocols and its range of advanced components, developers can dramatically reduce time-to-market for a range of network devices, including:
- entry level fixed-port fast Ethernet switches
- modular stackable gigabit switches with multiple 10 gigabit uplinks
- full-blown carrier class chassis systems.
The GateD suite of switching protocols sets the benchmark for the next generation of OEM Ethernet switching solutions. GateD provides a comprehensive feature set that requires no additional engineering work, yet still allows maximum flexibility in configuration and deployment.
To speed product development, developers only need to modify a few constants in a single, convenient header file to optimize memory consumption and match software to hardware functionality. Combined with one of Green Hills Software’s out of-the-box ports available on a number of reference designs, an OEM can get to QA with a fully-featured, stable switch in the shortest time possible.
For advanced functionality, the GateD Hardware Abstraction Layer (HAL) can be populated with driver-specific calls that leverage features in custom silicon. Developers can also fully integrate switching protocols with the Green Hills carrier-grade routing stack on their own or with the help of Green Hills Software’s professional services engineers.
With its comprehensive feature set, GateD switching protocols can support equipment requirements spanning from simple bridging and switching, to advanced VLAN and prioritization support for voice, video, and data triple plays.
Raising the bar on security
In today’s climate, security isn’t just a consideration, it’s a necessity. The GateD suite of Layer 2 switching protocols raises the bar for security with a solution that truly delivers absolute security.
Built on top of common GateD core functionality, which is pre-audited to remove security holes, such as buffer overrun exploits, the GateD switching protocols provide simple yet comprehensive API to 802.1x port-based authentication schemes. This powerful API allows for easy integration, not just with off-the-shelf solutions such as RADIUS or TACACS+, but also with any proprietary security access you need to deploy.
GateD’s VLAN capabilities allow any individual VLAN to be configured as the management network. 802.1x authentication control is on a per logical port basis, giving your customers the greatest level of user control possible. Security and user access is enhanced further by powerful access control lists for easy support of any filtering capability available in hardware, and basic switch defenses against malicious activity such as broadcast storms.
The additional use of AgentX as the SNMP configuration mechanism allows support for SNMPv3 in conjunction with SSH for another level of unparalleled security.
Native triple-play support
With fully integrated support for 802.1Q and 802.1p, IGMP snooping, GVRP, and advanced ACLs GateD’s switching protocols allow different types of data to be sent over different VLANs. As a result, VLANs can be classified and forwarded in any method of prioritization that hardware allows. This also enables simultaneously reductions of overall network bandwidth consumption by optimizing multicast video feed traffic to only those ports required.
With appropriate support available from Green Hills’ professional services organization, your network managers can focus on fine-tuning ingress and egress traffic flows (where the number of flows per queue is only limited by hardware) on a per-port or per service basis. There is no more comprehensive solution that will allow customers to speed deployment of converged voice, video, and data networks.
One of the most time-consuming challenges facing equipment manufacturers today is the integration of management across their various subsystems. Green Hills provides two ways to help solve this problem.
With GateD Command Line Interface (CLI) module, you can start working with the code as soon as you receive it. Also, the CLI can be easily extended to manage the rest of the system.
The GateD AMI provides a simple, consistent interface for integration with the management plane. Additionally, the AMI Agent allows communication with a remote management plane. The AMI Agent is easily ported to a variety of messaging systems and provides a common point for integration with existing CLIs, web user interface, or out-of-band management tools.
For network management, Green Hills includes the standard SNMP MIBs with most protocols. Generic access to the MIBs is achieved through the SMUX and AgentX protocols, developers then use the SNMP agent of their choice. As with all other common functionality, the SMUX and AgentX implementations are shared by all of the routing protocols, so once an agent is set up to interact with it, no further work is needed as additional protocols are added.
When it comes to logging, debugging, and error reporting, the AMI allows in-depth debugging information to be routed to the CLI or log files, giving the developers direct access to the run-time state. The developer can query information on the state of the routing tables, interfaces, or individual protocols. Additionally, the protocols share common tracing and logging functions that keep track of events with a configurable level of verbosity. The output of this information can be sent to just about any destination, whether it is to a file in memory or on disk, to a syslog mechanism, or to the console or some other output device as a stream.
AMI:direct access to the code
The GateD Advanced Management Interface (AMI) provides a common management API across all GateD products. Internally, AMI consists of two distinct components: an API and an Agent. The AMI API provides direct access to all configurable options across all portions of the code, allowing highly scalable, incremental configuration.
The AMI Agent is designed for easy integration with any messaging system available on the control plane operating system. AMI’s simple, consistent API dramatically improves speed of integration with any user interface, providing substantial speed-up in product time-to-market.
When used in conjunction with the AMI Agent, the management plane can be off-loaded to a separate processor, or an entirely different card, removing management overhead from the control plane and improving efficiency. When combined with Green Hills’ CLI module, dozens of engineering years can be saved.
De facto standard for configuration management
The Green Hills Software Command Line Interface (CLI) module is the defacto standard for configuration management of Layer-3 and higher devices. CLI features include:
- Tab completion
- Context-sensitive help
- Command history
- Management plane logging
- Bulk configuration
- Preservation/display of current configuration data
The CLI comes pre-integrated with our Advanced Management Interface (AMI) providing equipment manufacturers with the broadest possible set of choices in the design of the management plane for their device.
The AMI Agent mechanism allows the CLI to operate directly on the control plane, as it would in a traditional router, or to be located on a separate management blade in the chassis, as is the design in some of today’s new, high-end equipment.
At Green Hills Software we understand that there is more to a system than just the control plane. That’s why our CLI module is also designed with extensibility in mind. New commands are easily added to manage additional sub-systems, such as line cards, layer 2 protocols, or application components. And the CLI module back-end is designed to easily integrate with legacy management APIs for support of these additional components.
Channel density is another critical consideration for equipment manufacturers. As processor speeds increase, manufacturers need to squeeze more channels and data throughput onto a single CPU. But to do this, some hardware redundancy may need to be sacrificed.
With Green Hills Software’s separation kernel technology and the guaranteed resource allocations it provides, developers can securely and reliably execute multiple virtual processors and guest operating systems on a single device. This enables them to retain the same redundancy architecture while consolidating software from multiple CPUs onto a single CPU.
Features and benefits of Green Hills Software’s INTEGRITY Multivisor:
- Built on the secure INTEGRITY separation kernel
- Support for multiple virtual machines
- Execute any guest operating systems and applications
- Software development tools to develop and run native security and safety critical applications
- Enable highest security and safety where you need it
- Maintain current investment in legacy operating systems and applications
- Open flexibility for OS integration
Expanding on its unique position in the industry by delivering comprehensive software solutions for secure networking, Green Hills Software offers a full range of professional services that include: complete networking system design, integration, debug, optimization, customization, test, and validation, training, and enhanced product support. By taking advantage of these services, customers can deliver higher-quality products with faster time-to-market and at lower development and deployment cost.