Federated Search Management
When designing service-oriented architectures (SOAs), we should assume that some of the components will eventually be compromised and set our level of trust appropriately. Advanced attacks often gain access to a trusted component, which in turn acts as a beachhead within a network. That infiltration is then used as a launching point to escalate privileges. Components within an SOA often need to share sensitive information, but the consequential high degree of trust between components is a liability. Authorization information is particularly problematic. Anonymous authorization is a design principle that can be used to decrease the level of trust required and so reduce the attack surface of SOAs. Our Secure Federated Search Manager (S-FSM) technology is a prototype implementation of an cross-organizational and anonymous authorization system.
Industry and government users need to aggregate and search data that is sensitive and secured as well as data that is freely available and open. Data with different levels of access are kept isolated, either with password protection, VPNs, firewalls, or even by "air-gaps" (where each security level has its own, isolated network). Thus, searching over diverse data sets poses a problem: users cannot perform a single search that will return results from all the systems to which they have access. Indeed, virtually every user of the Internet experiences this problem to some degree.
Galois' standards-based S-FSM system elegantly satisfies these dual requirements, enabling collaboration without compromising security. This solution is compatible with standard web mashup APIs as well as "discovery" systems like RSS and other Web 2.0 tools. A standards-based approach allows our system to aggregate content from search providers who are completely unanticipated by the S-FSM system, which store data in a variety of formats, and which utilize any kind of identity, authentication, and authorization system.
Collaborate with Us
Licensing - Obtain a license for one of our advanced technologies.
Research & Development - Solve your toughest problems by exploring new approaches with us.
Training - Learn how to use cutting-edge tools to increase trustworthiness in your critical systems.