» Security breaches: as easy as point-click-attack
» GateD Layer 3: the standard for Internet routing
» GateD Layer 2: the benchmark for next-generation switches
» Advanced system management

The Green Hills Platform for Secure Networking combines the INTEGRITY operating systems with the GHNet host/router stacks,
GateD switching/routing capabilities, and INTEGRITY Secure Virtualization Technology to deliver unmatched security and reliability
without compromising system throughput.

Guaranteed protection
The INTEGRITY operating system provides all the capabilities embedded designers need to enforce the policies of separation, damage limitation, and information flow control as well as provide secure networking for today’s more complex and connected applications.

INTEGRITY was designed from the beginning with network security in mind and supports the requirements and security policies of Multiple Independent Levels of Security (MILS)—the architecture for composing secure computing systems from high-assurance components.

INTEGRITY's Multiple Independent Levels of Security (MILS) separation kernel architecture provides a highly robust mechanism to separate security functions. A true MILS kernel, INTEGRITY has received certification from NIAP at Common Criteria level EAL6+, the most rigorous security evaluation ever achieved for a commercial operating system.

INTEGRITY's separation kernel protects against damage from errant or malicious code by preventing processes from writing beyond assigned memory regions. In addition, INTEGRITY’s partitions prevent unintended access to data from outside the partition where the data resides.

Deploying ?a networking solution based on the secure separation kernel architecture of the INTEGRITY operating system enables the highest levels of security for network devices. INTEGRITY was designed from the beginning with network security in mind and supports the requirements and security policies of Multiple Independent Levels of Security (MILS)—the architecture for composing secure computing systems from high-assurance components.

INTEGRITY provides all the essential components required to harden networked devices against attack:

• Protected execution of applications and system service
• Guaranteed resource allocation and application execution
• Information flow control between partitions, stack, router and application isolation
• Containment of errors and attacks

GHNet Networking Stack The GHNet TCP/IP stack is the foundation for all networking protocols for the Green Hills family of operating systems (including INTEGRITY, INTEGRITY-178B, velOSity™, and µ-velOSity™). A full-featured, high-performance host and router TCP/IP stack, GHNet was designed specifically for network-centric systems with options for advanced routing as well as an extensive suite of security protocols. GHNet is an ultra-compact dual-mode IPv4/IPv6 stack that combines a minimum footprint with maximum performance. GHNet is suited for use in products ranging from small footprint consumer devices to advanced core network equipment. It has broad RFC support, BSD 4.4 and NetLink socket API support, and has been through extensive protocol conformance and interoperability testing. It is also integrated with a broad range of networking applications, management, and security protocols. See the complete list of supported protocols below.

For maximum flexibility, Green Hills Software's GHNET TCP/IP stack can run in either the INTEGRITY kernel space or in a separate protected address space.

Dual mode IPv4/IPv6 GHNet is a true dual mode IPv4/IPv6 stack and can be configured for IPv4 only, IPv6 only, or to support both protocols simultaneously. This is an important feature since the transition from IPv4 to IPv6 is expected to take several years. Furthermore, the IPv6 functionality has been approved by the industry standard IPv6 READY Program, which guarantees IPv6 interoperability. Modular design and scalability The GHNet protocol suite has a modular design and is highly configurable, providing maximum size and feature scalability. If a module isn’t used, instead of being merely deactivated it is removed entirely to save valuable storage memory space in the often limited capacity of an embedded device.

Host Stack Configuration » TCP » DHCP » PPPoE » UDP » FTP » SLIP » ICMP » TFTP » AutoIP » IPv4 » NAT » DNS Resolver » ARP » Netlink Socket » Ethernet » Telnet » IPv6 » RIP Listener » PPP » Web Server » IP Multicast » MLD (IPv6 only) » CLI

Written by US citizens
GHNet is a clean room design, written by US citizens from the ground up. It was not derived from publicly available Unix stacks or open source software. The design achieves Berkeley 4.4 and Netlink socket compatibility, small size, and high performance for both IP and UDP traffic.

Green Hills Software’s GateD family of products is a processor-neutral, comprehensive data-plane and control-plane solution that provides complete source code for Layer 2 switching and Layer 3 routing protocols. The scalability of the code, complete functionality, and expansive set of APIs make the code ideal for inclusion in carrier-grade core, edge, and aggregation devices.

An evolutionary step forward for Internet routing
For over fifteen years, hundreds of products have been built around GateD Layer 3 routing technology. As the chosen standard starting point for anyone who required Internet routing—GateD provides everything from server redundancy to the most scalable, core IP routers. Representing a substantial evolutionary step forward, GateD provides equipment manufacturers with exactly the functionality they require for building next-generation carrier-targeted equipment: core and edge IP routers as well as aggregation devices.

GateD is a complete control-plane solution, with all requisite protocols packaged conveniently for inclusion in a wide range of next-generation carrier devices. Available components include complete support for both unicast and multicast control-plane routing for Ipv4 and IPv6. Equipment manufacturers can pick and choose from these individual components when developing their carrier-class networking equipment, only designing in what is needed at the time but offering seamless upgrading to add other GateD protocols in the future.

The modular design of GateD allows common functionality, data structures, and APIs to be shared across protocols. From an equipment manufacturer’s perspective, this provides two immediate advantages:

The additional use of AgentX as the SNMP configuration mechanism allows support for SNMPv3 in conjunction with SSH for another level of unparalleled security.

Native triple-play support
With fully integrated support for 802.1Q and 802.1p, IGMP snooping, GVRP, and advanced ACLs GateD’s switching protocols allow different types of data to be sent over different VLANs. As a result, VLANs can be classified and
forwarded in any method of prioritization that hardware allows. This also enables simultaneously reductions of overall network bandwidth consumption by optimizing multicast video feed traffic to only those ports required.

With appropriate support available from Green Hills’ professional services organization, your network managers can focus on fine-tuning ingress and egress traffic flows (where the number of flows per queue is only limited by hardware) on a per-port or per service basis. There is no more comprehensive solution that will allow customers to speed deployment of converged voice, video, and data networks.

Two ways to management subsystems
One of the most time-consuming challenges facing equipment manufacturers today is the integration of management across their various subsystems. Green Hills provides two ways to help solve this problem.

With GateD Command Line Interface (CLI) module, you can start working with the code as soon as you receive it. Also, the CLI can be easily extended to manage the rest of the system.

The GateD AMI provides a simple, consistent interface for integration with the management plane. Additionally, the AMI Agent allows communication with a remote management plane. The AMI Agent is easily ported to a variety of messaging systems and provides a common point for integration with existing CLIs, web user interface, or out-of-band management tools.

For network management, Green Hills includes the standard SNMP MIBs with most protocols. Generic access to the MIBs is achieved through the SMUX and AgentX protocols, developers then use the SNMP agent of their choice. As with all other common functionality, the SMUX and AgentX implementations are shared by all of the routing protocols, so once an agent is set up to interact with it, no further work is needed as additional protocols are added.

When it comes to logging, debugging, and error reporting, the AMI allows in-depth debugging information to be routed to the CLI or log files, giving the developers direct access to the run-time state. The developer can query information on the state of the routing tables, interfaces, or individual protocols. Additionally, the protocols share common tracing and logging functions that keep track of events with a configurable level of verbosity. The output of this information can be sent to just about any destination, whether it is to a file in memory or on disk, to a syslog mechanism, or to the console or some other output device as a stream.

AMI: direct access to the code
The GateD Advanced Management Interface (AMI) provides a common management API across all GateD products. Internally, AMI consists of two distinct components: an API and an Agent. The AMI API provides direct access to all configurable options across all portions of the code, allowing highly scalable, incremental configuration

The AMI Agent is designed for easy integration with any messaging
system available on the control plane operating system. AMI’s simple, consistent API dramatically improves speed of integration with any user interface, providing substantial speed-up in product time-to-market.
When used in conjunction with the AMI Agent, the management plane
can be off-loaded to a separate processor, or an entirely different card, removing management overhead from the control plane and improving efficiency. When combined with Green Hills’ CLI module, dozens of engineering years can be saved.

De facto standard for configuration management
The Green Hills Software Command Line Interface (CLI) module is the defacto standard for configuration management of Layer-3 and higher devices. CLI features include:

• Tab completion
• Context-sensitive help
• Command history
• Management plane logging
• Bulk configuration
• Preservation/display of current configuration data

The de facto standard for Layer 3 configuration management, the GateD CLI includes a variety of features that enable you to start working with the code as soon as you receive it.

Professional services
Expanding on its unique position in the industry by delivering comprehensive software solutions for secure networking, Green Hills Software offers a full range of professional services that include: complete networking system design, integration, debug, optimization, customization, test, and validation, training, and enhanced product support.
By taking advantage of these services, customers can deliver higher-quality products with faster time-to-market and at lower development and deployment cost.