The structural rewriting capability that enables high-assurance, hardware-verifiable file transfer across trust boundaries.
Higher-assurance capability vs. CDR alone
Pattern for Safely Importing Data - aligned
Detection, signatures or detonation required
Glasswall Transform to XML is a structural rewriting capability built into the Glasswall Embedded Engine. It takes a complex file format, such as a PDF, Word document, or spreadsheet, and converts it into a simplified, Verifiable Intermediate Representation of the file’s internal Document Object Model (DOM). Unlike standard CDR, which rebuilds a file and returns it in its original format, Transform to XML exposes the file’s structure in a form that hardware devices, FPGAs, and software validators can independently inspect and verify. This makes it the critical enabling capability for government-grade Cross Domain Solutions where hardware verification of file content is a requirement.
Transform to XML is the capability that allows CDS partners to satisfy the NCSC’s Pattern for Safely Importing Data in full.
CDR rebuilds files to a known-good specification and removes malicious content. For the majority of enterprise file security use cases, this is the right solution. However, for certain sensitive cross domain deployments - particularly those involving data diodes, FPGAs, or hardware security devices - there is an additional challenge: these hardware components cannot inspect complex file formats directly. A DOCX or PDF is structurally opaque to a hardware diode. The NCSC’s Pattern for Safely Importing Data recommends a transformation step precisely to address this gap. Without it, the assurance chain is incomplete. CDR disarms the file; Transform to XML makes it hardware-verifiable.
Glasswall CDR validates the incoming file against its manufacturer file specification. Active content and structural anomalies are identified and removed.
The file’s complex internal structure is unravelled into its constituent components - text, metadata, images, embedded objects - and represented as a Document Object Model (DOM).
The DOM is converted into a simple, verifiable intermediate representation (XML). Images are transcoded into standardised bitmaps. The result is a format that hardware can inspect.
The XML is passed to partner technology - a syntactic verification diode, FPGA, or software validator - for XSD schema validation. Only conformant files proceed.
The verified XML is returned to the original complex file format, giving the end user a clean, usable document on the other side of the boundary.
Glasswall CDR then re-applies the principles of step 1 to ensure a safe file is delivered on the secure side of the boundary.
CDR rebuilds files to a known-good specification and removes malicious content. For the majority of enterprise file security use cases, this is the right solution.
However, for certain sensitive cross domain deployments - particularly those involving data diodes, FPGAs, or hardware security devices - there is an additional challenge: these hardware components cannot inspect complex file formats directly. A DOCX or PDF is structurally opaque to a hardware diode.
The NCSC’s Pattern for Safely Importing Data recommends a transformation step precisely to address this gap. Without it, the assurance chain is incomplete. CDR disarms the file; Transform to XML makes it hardware-verifiable.
Mapped to NCSC guidance
NCSC Pattern for Safely Importing Data - Transform to XML directly satisfies the transformation step the pattern requires, completing the assurance chain that CDR alone cannot close. Deployments using both capabilities can claim full compliance.
Transforms complex file types into simple XML that one-way hardware diodes can inspect and pass, resolving the fundamental limitation of hardware-only verification.
XML output from Glasswall CDR can be syntactically verified against an XSD by FPGA-based partner technology, enabling the full NCSC-recommended transformation control chain.
Provides the structural rewriting step required for intelligence community and defence networks where standard CDR alone may be insufficient.
Allows CDS vendors to embed Glasswall's Transform to XML capability within their own solution and defend a higher price point with clear, auditable assurance evidence.
A tailored walkthrough of how Glasswall rebuilds files to a known-good state, removes hidden threats, and provides the intelligence you need to understand file risk.
What's in the demo
“
Beazley's security is paramount, and this integration has significantly reinforced our cybersecurity framework.
