SEPARATION AT THE LEVEL
OF SILICON
A new protection solution is needed that can provide the following characteristics:
• Isolate the user’s sensitive work environment on a laptop preventing exposure to network threats
• Protect the user’s sensitive data so it is not compromised even if the laptop is lost
• Allow sensitive corporate assets to be protected from insider threats
• Facilitate monitoring of corporate assets and sensitive data that allow for remote backups,
remote upgrades and remote disabling of sensitive data
• Allow seamless operation of existing work environments on commodity laptops without significant loss of
user experience
• Isolate the user’s sensitive work environment on a laptop preventing exposure to network threats
• Protect the user’s sensitive data so it is not compromised even if the laptop is lost
• Allow sensitive corporate assets to be protected from insider threats
• Facilitate monitoring of corporate assets and sensitive data that allow for remote backups,
remote upgrades and remote disabling of sensitive data
• Allow seamless operation of existing work environments on commodity laptops without significant loss of
user experience
PLATFORM DETAILS
The solution consists of the following elements:
LYNXSECURE SEPARATION KERNEL HYPERVISOR
Hardware-enforced separation and virtualization properties of LynxSecure allow for separate secure domains to exist. Two main domains are constructed:
• One that is not secure, connected to the outside world, and handling clear-text unclassified data
• A second domain used for handling sensitive or classified data, with no connection to the outside world. Any data transfer to and from this domain is controlled and encrypted and any sensitive information that is stored on the endpoint is also encrypted
Both domains can run standard operating systems and applications, but the OS and applications in the secure domain are isolated from any network borne outside threats.
• One that is not secure, connected to the outside world, and handling clear-text unclassified data
• A second domain used for handling sensitive or classified data, with no connection to the outside world. Any data transfer to and from this domain is controlled and encrypted and any sensitive information that is stored on the endpoint is also encrypted
Both domains can run standard operating systems and applications, but the OS and applications in the secure domain are isolated from any network borne outside threats.
LYNX MULTI-NODE MANAGEMENT
Lynx offers manageability to perform provisioning and enable the update and upgrade of operating systems and other software functionality running in virtual machines. Lynx’s platform provides tools to integrate with the current MDM (Mobile Device Management) solutions. LynxSafe supports this capability on the device itself, keeping the relevant APIs, messaging and integration required to execute on security workflows without compromising security.
INLINE DISC ENCRYPTION
Allows for encryption at the storage speed for the data stored on the disk. This means that even if the endpoint is ever broken into, or stolen, the data is never exposed to a third party.
LYNX SIMPLE APPLICATIONS (LSAs)
LSAs are true bare-metal applications, each running directly on hardware without any underlying operating system components. When needing to meet the strict timing requirements of complex and safety-critical systems, Lynx Advanced Scheduling can be used to precisely control the execution and timing of the LSA components in the system. Communications interconnects provide security-policy enforced, zero copy, fast and low latency communications between critical functions.
CERTIFICATION EVIDENCE
For many years, Lynx has certified its products within safety critical, military, and commercial aviation systems to DO-178C DAL A and other standards. Lynx provides artifacts and support to our customers who are going through various industry specific certifications.
TOOLS
Lynx tools support LynxOS-178 RTOS, Linux, LSA, and LynxSecure across fundamental tasks including application development, debug, trace and visualization. Luminosity and SpyKer are Eclipse based environments that allow intuitive build and debug of applications and drivers, event trace and visualization for LynxOS-178 and Linux guests.
CLASSIFIED CERTIFICATION
The platform is extensible to support the most stringent certification requirements such as CSfC (Commercial Solution for Classified applications) defined by the United States Government’s National Security Agency (NSA). The process enables commercial products to be used in layered solutions to protect highly classified information.
MARKET TRENDS