WO2017210720A1

WO2017210720A1 - A secure collaborative data communications network

Info

Publication number: WO2017210720A1
Application number: PCT/AU2017/050463
Authority: WO
Inventors: Nicholas Forbes; Perry Smith; James Milne
Original assignee: Myriad Technologies Pty Ltd
Priority date: 2016-06-10
Filing date: 2017-05-18
Publication date: 2017-12-14

Abstract

The present invention relates to a secure collaborative data communications network. The network includes a primary node, associated with a primary entity, enabling collaboration of features or structure of a secondary node using a template arrangement. The secondary node, associated with a secondary entity under control of the first entity, replicates the collaboration of features or structure from the primary node. Advantageously, the primary node enables collaboration of features or structure of the secondary node using the template arrangement and the secondary node replicates that collaboration which is far more rapid (e.g. minutes) when compared with manually and independently configuring both nodes from scratch (e.g. months). Furthermore, replicating to ensure that the collaboration of features or structure is common among the nodes avoids compatibility and interoperability problems among nodes in the network.

Description

A SECURE COLLABORATIVE DATA COMMUNICATIONS NETWORK

TECHNICAL FIELD

[0001] The present invention generally relates to a secure collaborative data communications network. The present invention has particular, although not exclusive application to military warfighter networks including tank, ship, plane and other warfighter divisions. The present invention also has applicability to commercial use cases that require secure collaboration within a multi-node environment.

BACKGROUND

[0002] The reference to any prior art in this specification is not, and should not be taken as an acknowledgement or any form of suggestion that the prior art forms part of the common general knowledge.

[0003] During military operations, secure collaboration networks and nodes must be rapidly established between dispersed battalions under the control of a central warfighter division. In practice, the associated collaboration nodes in the network must be manually configured which can be extremely time consuming, often taking months, before which time the military operation may have actually ended. The configuration is conventionally undertaken at many levels.

[0004] There is a need for more rapid configuration of the collaboration nodes and networks.

[0005] Further, each node is often configured differently which causes compatibility and interoperability problems among nodes in the network. Also, each node may operate in a completely separate security context to the other nodes, making

interchange of information difficult.

[0006] There is a need for node configuration to avoid compatibility and interoperability problems among nodes in the network.

SUMMARY OF THE INVENTION [0007] According to one aspect of the present invention, there is provided a secure collaborative data communications network including:

a primary node, associated with a primary entity, enabling collaboration of features or structure of a secondary node using a template arrangement; and

the secondary node, associated with a secondary entity under control of the first entity, replicating the collaboration of features or structure from the primary node.

[0008] Advantageously, the primary node enables collaboration of features or structure of a secondary node using the template arrangement and the secondary node replicates that collaboration which is far more rapid (e.g. minutes) when compared with manually and independently configuring both nodes from scratch (e.g. months).

Furthermore, replicating to ensure that the collaboration of features or structure is common among the nodes avoids compatibility and interoperability problems among nodes in the network.

[0009] The primary entity may be a military division whereas the secondary entity may be a battalion operating under the control of the military division. The features or structure may relate to operational processes of the nodes. The nodes of the federated network may act autonomously in the event of a communications breakdown . In particular, the second node, once established, may operate autonomously from the primary node.

[00010] The network may be configured to automatically apply metadata to data in both nodes using security contextual information and/or metadata rules. The network may be configured to replicate the data and the associated metadata, and/or security contextual information between the nodes so that the nodes are configured to securely search content across other nodes. Maintaining the security context of information across the nodes in this manner results in the successful operation of the node network as a whole.

[00011 ] The templating arrangement may include a templating engine for using a template definition to automatically create the features or structure. The network may include a provisioning engine for provisioning operational processes to facilitate collaboration, sharing, scaling and/or configuring among the nodes. [00012] According to another aspect of the present invention, there is provided a method for establishing a secure data communications connection between

collaborating primary and secondary nodes, the method including:

the primary node, associated with a primary entity, enabling collaboration of features or structure of the secondary node using a template arrangement; and

[00013] Preferably, the foregoing steps are automated.

[00014] The method may further involve the step of automatically applying metadata to both nodes using contextual information and/or metadata rules. The method may further involve replicating data objects, associated metadata and/or security context between the nodes so that the nodes are configured to securely search content across other nodes.

[00015] The method may involve creating a primary node using automated provisioning scripts. The method may involve creating a secondary node using automated provisioning scripts.

[00016] The method may involve seeding user identities into the primary node. The method may involve seeding user identities into the secondary node.

[00017] The method may involve the primary node establishing collaboration functionality between the primary and secondary nodes. The method may involve the primary node establishing replication patterns between the two nodes.

[00018] The method may involve deploying the secondary node into the physical environment. For both nodes, the method may involve modifying the collaboration features and structure via updated template definitions. The method may involve decommissioning or repurposing the secondary node when no longer required.

[00019] According to another aspect of the present invention, there is provided a method for establishing a secure data communications connection between

collaborating nodes in a network, the method including: replicating data and associated metadata, and/or security contextual information between the nodes so that the nodes are configured to securely search content across the network.

[00020] Any of the features described herein can be combined in any combination with any one or more of the other features described herein within the scope of the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

[00021 ] Preferred features, embodiments and variations of the invention may be discerned from the following Detailed Description which provides sufficient information for those skilled in the art to perform the invention. The Detailed Description is not to be regarded as limiting the scope of the preceding Summary of the Invention in any way. The Detailed Description will make reference to a number of drawings as follows:

[00022] Figure 1 is a block diagram of a military data communications network in accordance with an embodiment of the present invention; and

[00023] Figure 2 is a flowchart showing a method for establishing a secure data communications connection between collaborating primary and secondary nodes in the network of Figure 1 .

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

[00024] According to an embodiment of the present invention, there is provided a secure collaborative data communications network 100 for military operations as shown in Figure 1 . The network 1 00 includes a division (i.e. primary) node 1 02, associated with a military division 1 03 (i.e. primary entity). The division node 102 enables collaboration of features and structure of a battalion (i.e. secondary) node 104 using a template arrangement. The battalion node 104 is associated with a battalion 105 (i.e. secondary entity) under control of the division 103. The battalion node 1 04 replicates the collaboration of features and structure from the division node 102. The secondary nodes 104 below the primary 104 may be configured as a 'mesh' style network to share information collaboratively within the network 100. [00025] Advantageously, the division node 1 02 enables collaboration of features and structure of the battalion node 104 using the template arrangement and the battalion node 104 replicates that collaboration. This automated process is far more rapid (e.g. 3 hours) when compared with manually and independently configuring both nodes 102, 104 from scratch (e.g. 3 months). Furthermore, replicating to ensure that the

collaboration of features and structure is common among the nodes 1 02, 104, avoids compatibility and interoperability problems among nodes 102, 1 04 in the network 100.

[00026] The replicated features and structure relate to operational processes 106 of the nodes 1 02, 104. In this manner, the nodes 1 02, 104 of the federated network 100 can act autonomously in the event of a communications breakdown. In particular, the battalion node 1 04, once established, may operate autonomously from the division node 102. The network 100 is configured to automatically apply metadata to data in nodes 102, 1 04 using contextual information and/or metadata rules. The network 1 00 is further configured to replicate the data, associated metadata and/or security context between the nodes 1 02, 104 so that the nodes 102, 1 04 are configured to securely search content across the nodes 1 02, 104 in the network 100. Maintaining the security context of information across the nodes 1 02, 104 in this manner results in the successful operation of the node network 100 as a whole.

[00027] In the prior art, each network node was instead unaware of other nodes in the network 100, essentially making secure collaboration and content creation largely a discrete activity within a specific node. Having seamless access to information on separate node locations was very difficult or impossible due to the different security contexts of a specific piece of information or a document. The preferred embodiment ensures that any piece of information stored on a node 102, 104 maintains its security context throughout the network 100, thus making seamless collaboration on content possible.

[00028] The preferred embodiment enables managing content and documents in a secure environment across disparate networks 100, regardless of the physical topology (i.e. computers, bearers (routers/switches/satcoms)). Each T node 102, 1 04 utilises industry standards, e.g. SAML, XAML, XML, .Net, and standard products (e.g.

Commercial off the Shelf - COTS and Military off the shelf - MOTS) in such a way as to provide secure collaboration, document management and automated processes particularly suited for warfighter services.

[00029] The structured collaboration environment complies with compliance and organisation standards Out of the box - OOTB which is a key differentiator to standard SharePoint (Microsoft product) or Standard CMS functionality (e.g. Oracle CMS). The environment also supports very complex business processes without any code being written or customizations being made. These processes relate to site structures (e.g. lists, libraries, calendars, web pages, forms, workflows, third party tools and a variety of other constructs, metadata and autotags)

[00030] Figure 1 shows two T nodes 102, 104, but is fully scalable to form a series of nodes, starting with a master 'TO' node 102 that anchors the rest of the virtualised network of nodes 104. The next level down is a Ύ1 ' node 1 04 that can be provisioned as a specific node to service a particular group (e.g. battalion 105) of people with a set of services. These services relate to collaboration and process automation. The operational processes 106 can be 'generated' or 'provisioned' using a provisioning engine 108.

[00031 ] The network provisioning engine 108 supports the following features:

• Seamless collaboration across nodes 102, 1 04 which can collaborate on documents, content (including web pages, calendars etc);

• Secure content and information sharing in a secure way across nodes 102, 1 04;

• Each node 102, 104 can easily scale in terms of the number of users accessing the services by scaling the hardware around the solution; and

• Each node 102, 104 can be quickly and easily provisioned using automation scripts that provide a combination of provisioning of services combined with a specific configuration to enable a node 102, 104 to operate within a context of a network of other nodes 1 02, 104.

[00032] The network 100 also includes a templating engine, using a template definition of processes, to automatically create requirements to provide collaboration features and structure. This template arrangement is far more efficient than instead relying on an individual's ability to translate operational requirements into a technical specification that are then manually coded in the prior art. The templating arrangement creates features and structure that automatically fit within the broader network design.

[00033] Templating involves:

a. encoding the node requirements into a set of template definitions, and b. using the inputs to the templating engine to create the users structured collaboration environment.

[00034] The structured collaboration environment sits within an over-arching design of the T nodes 102, 104 that supports the creation of structured collaboration for any given set of user requirements. The T node configuration automatically recognises the security context and content of the provisioned division warfighter services and provides full information flow of collaboration and process automation content across the T node network 1 00.

[00035] An automated method 200 for establishing a secure data communications connection between the collaborating division and battalion nodes 102, 104 is now described with reference to Figure 2.

[00036] At step 202, the method 200 initially involves creating the division node 102 using automated provisioning scripts. The division node 202 is stood up for a division 103.

[00037] At step 204, the method 200 also involves creating the battalion node 104 using automated provisioning scripts. The battalion node is stood up for a battalion 105 to collaborate with the division node 202 of the division 103.

[00038] At step 206, the method 200 involves seeding user identities into the division node 102. In particular, users for the division 103 are populated into the division node 102.

[00039] At step 208, the method 200 involves seeding user identities into the battalion node 104. In particular, users for the battalion 105 are populated into the battalion node 104. [00040] At step 210, the division node 102 establishes collaboration functionality between the division node 1 02 and battalion node 104. In particular, the battalion node 104 receives input from the node administration team based upon how and why the division 103 and battalion 105 are collaborating.

[00041 ] At step 212, the division node 102 enables collaboration of features and structure via the template definition and template engine. In particular, the created collaboration structures allow for collaboration with the battalion 105 around an exercise.

[00042] At step 214, the battalion node 104 replicates the collaboration of features and structure from the division node 1 02 via the template definition and template engine.

[00043] At step 216, the division node 102 establishes replication patterns between the two nodes 102, 104. In particular, replication of data between the division 1 03 and battalion 105 is established.

[00044] At step 218, the method 200 involves deploying the battalion node 1 04 into the physical environment. In particular, the battalion node 104 is deployed to the battalion 105.

[00045] At step 220, the method 200 involves using the division node 102 and battalion node 104 by the respective division 103 and battalion 105.

[00046] At step 222, the method involves automatically applying metadata to data in both nodes 102, 1 04 using security contextual information and metadata rules. When loading documents into the nodes 102, 1 04, metadata are applied to the nodes 102, 104 based on content including who created the document, what the document is about and where the document is saved.

[00047] At step 224, the method 200 involves replicating the data, associated metadata and security context between the nodes 102, 1 04. Data received by the nodes 102, 1 04 is replicated between the division 103 and battalion 105. The nodes 102, 104 are thereby configured to securely search content across all nodes forming part of the overall network 1 00. [00048] At step 226 and for both nodes, the method 200 involves modifying the collaboration features and structure via updated template definitions. During the life of the nodes 1 02, 104, the structures that a division 103 and battalion 1 05 are

collaborating in may change. This change is propagated to the nodes 102, 104 via the defined templates.

[00049] At step 228, the division node 102 exports data to external systems via Application Programming Interfaces (APIs) and export mechanisms.

[00050] At step 230, the method involves decommissioning or repurposing the battalion node 104 when no longer required.

[00051 ] A person skilled in the art will appreciate that many embodiments and variations can be made without departing from the ambit of the present invention.

[00052] The present invention has application for emergency service entities and other entities having a chain of command.

[00053] In compliance with the statute, the invention has been described in language more or less specific to structural or methodical features. It is to be understood that the invention is not limited to specific features shown or described since the means herein described comprises preferred forms of putting the invention into effect.

[00054] Reference throughout this specification to One embodiment' or 'an embodiment' means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the present invention. Thus, the appearance of the phrases 'in one embodiment' or 'in an embodiment' in various places throughout this specification are not necessarily all referring to the same embodiment. Furthermore, the particular features, structures, or characteristics may be combined in any suitable manner in one or more combinations.

Claims

The claims defining the invention are as follows:

1 . A secure collaborative data communications network including:

2. A network as claimed in claim 1 , wherein the primary entity is a military division whereas the secondary entity is a battalion operating under the control of the military division.

3. A network as claimed in claim 1 , wherein the features or structure relate to operational processes of the nodes.

4. A network as claimed in claim 1 , wherein the nodes of the network act autonomously in the event of a communications breakdown.

5. A network as claimed in claim 1 , wherein the secondary node, once established, operates autonomously from the primary node.

6. A network as claimed in claim 1 , configured to automatically apply metadata to data in both nodes using security contextual information and/or metadata rules.

7. A network as claimed in claim 6, wherein the network is configured to replicate the data and the associated metadata, and/or security contextual information between the nodes so that the nodes are configured to securely search content across other nodes.

8. A network as claimed in claim 1 , wherein the template arrangement includes a templating engine for using a template definition to automatically create the features or structure.

9. A network as claimed in claim 1 , further including a provisioning engine for provisioning operational processes to facilitate collaboration, sharing, scaling and/or configuring among the nodes.

10. A method for establishing a secure data communications connection between collaborating primary and secondary nodes, the method including the steps of:

1 1 . A method as claimed in claim 1 0, wherein the steps are automated.

12. A method as claimed in claim 1 0, further involving the step of automatically applying metadata to both nodes using contextual information and/or metadata rules.

13. A method as claimed in claim 1 0, further involving replicating data objects, associated metadata and/or security context between the nodes so that the nodes are configured to securely search content across other nodes.

14. A method as claimed in claim 1 0, further involving creating the primary node using automated provisioning scripts.

15. A method as claimed in claim 1 0, further involving creating the secondary node using automated provisioning scripts.

16. A method as claimed in claim 1 0, further involving seeding user identities into the primary node.

17. A method as claimed in claim 1 0, further involving seeding user identities into the secondary node.

18. A method as claimed in claim 1 0, further involving the primary node establishing collaboration functionality between the primary and secondary nodes.

19. A method as claimed in claim 1 0, further involving the primary node establishing replication patterns between the two nodes.

20. A method as claimed in claim 1 0, further involving deploying the secondary node into the physical environment.

21 . A method as claimed in claim 1 0 which for both nodes, involves modifying the collaboration of features or structure via updated template definitions.

22. A method as claimed in claim 1 0, further involving decommissioning or repurposing the secondary node when no longer required.

23. A method for establishing a secure data communications connection between collaborating nodes in a network, the method including:

replicating data and associated metadata, and/or security contextual information between the nodes so that the nodes are configured to securely search content across the network.