AltaSec HAF-100 ViaSat High Assurance Trusted Filter

The ViaSat AltaSec HAF-100 High Assurance Trusted Filter is a Cross Domain Solution (CDS) product that securely permits data to pass between networks of different security classification levels. By enforcing rigid rules as defined by a "filter policy," the HAF-100 ensures that only the desired data crosses the classification boundary.

When HAF-100s are positioned in an application network, no traffic is allowed to cross from one security domain to another without going through filter review. Message filter rules define the policy to be enforced. Fixed format messages that transit the HAF-100 are compared against the installed rule based filter policy, so that only messages with valid format and with valid ranges of values for all fields are forwarded. Messages that fail filtering on the black interface are silently discarded from the viewpoint of the sender. Messages that fail filtering on the red interface may be silently discarded or feedback can be provided to the sender. In every case, the "event" of a dropped message is recorded for audit and forwarded to a central audit server.

The HAF-100 also filters the rate at which valid messages are able to pass over the classification boundary. This feature limits the ability of an adversary to exploit valid messages.

Featuring High- and Low-side SNMP v3 support, the HAF-100 can be polled on demand to ensure the device is ready, and to provide statistics of operation. The trusted filter responds to the poll with messages which can be monitored by a standard SNMP network manager.

The HAF-100 is a high assurance, rule-based filter, based on ViaSat's Programmable Scalable Information Assurance Model (PSIAM) security architecture. Rule enforcement is applied in a High Assurance and tamper-protected environment. The HAF-100 can be securely upgraded with new message rule sets after the product is deployed.