Tessera for Cross Domain
A bi-directional security gateway that mediates controlled information exchange between classification domains — enforcing dual security policies on every flow, with a Guard as the sole permitted crossing path.
Classified networks operate under security policies that define what information can be created, handled, and shared within each domain. Those policies reflect different classification ceilings, different coalition memberships, and different need-to-know requirements.
Yet operators and systems in different domains regularly need to exchange information — tasking orders, intelligence reports, situation reports. When that information crosses a domain boundary, both security policies must be satisfied simultaneously: the originating domain's policy must confirm the label is valid, and the destination domain's policy must confirm the information is releasable to that domain.
Human-enforced transfer processes are slow, error-prone, and do not scale. Manual review cannot keep pace with operational information flows, and a single oversight can expose classified material to an unauthorised domain.
Six principles that define the security of Tessera for Cross Domain.
Every flow is checked against the security policies of both domains. The source policy confirms the label is valid, and the destination policy confirms the content may enter.
No network path joins the two domains except through the guard. There is no bypass and no exception.
Any error at any stage results in a denial. The guard never forwards content it could not fully check.
The signed label travels unchanged through the gateway, so the receiving domain can verify it.
Every decision, allow or deny, is recorded with the direction, the parties, the label and the checks applied.
The software layout matches a physical three-legged appliance, so it can be moved to dedicated hardware.
High-to-Low (HS→LS) and Low-to-High (LS→HS) flows follow distinct pipelines. Each stage is a policy enforcement point; failure at any stage blocks the flow.
All content is scanned before it reaches the guard. If the scanner cannot be reached, the flow is rejected.
Office and PDF attachments are rebuilt without active content or macros before they cross.
Outbound content is checked for patterns that the policy does not allow to leave.
Every internal connection is authenticated in both directions, with certificate revocation checked.
Separate authorities for connections and for label signing, with short certificate lifetimes.
Operators sign in through the organisation's identity provider, with roles that limit what each may change.
Each domain has separate external, internal and guard segments. Firewalls deny all traffic that is not explicitly allowed.
Mail handling, scanning, certificates and monitoring run as separate services that can be updated one at a time.
Firewall rules can be exported for physical appliances when a deployment moves to dedicated hardware.
XML Confidentiality Label format; classification and category encoding evaluated against domain SPIFs for every flow.
CMS SignedData validation (HS→LS) and generation (LS→HS); ADatP-4778.2 binding profiles for OOXML, XMP, and sidecar.
ABAC policy enforcement referencing ACP-240 attribute URI conventions for classification and category assertions in GIF flows.
Full SPIF parsing for both domain policies; dual-SPIF evaluation for every crossing decision.
Cryptographic Message Syntax for STANAG 4778 Binding Information Object signing and verification.
RFC-compliant Non-Delivery Reports (NDR) generated on DENY, informing the originating sender of the rejection reason.
Standards implemented in Tessera for Cross Domain
STANAG 4774 STANAG 4778 ACP-240 ADatP-5636 XMLSPIF v2.1/v3.0 RFC 5652 CMS RFC 3464 NDR