Secured KVM switch
View Patent ↗A method supports secure input/output (I/O) communications between an I/O device and a data processing system via a keyboard, video, and mouse (KVM) switch. An example embodiment includes the operations of establishing a first secure communication channel between the KVM switch and the I/O device and establishing a second secure communication channel between the KVM switch and the data processing system. In addition, I/O data may be received at the KVM switch from the I/O device via the first secure communication channel. In response to receipt of the I/O data from the I/O device, the I/O data may be transmitted from the KVM switch to the data processing system via the second secure communication channel. Embodiments may also include support for non-secure channels between the KVM switch and non-secured I/O devices, non-secured data processing systems, or both.
1. A method for supporting secure input/output (I/O) communications between a plurality of I/O devices and a plurality of data processing systems via a keyboard, video, and mouse (KVM) switch, the method comprising:
the KVM switch providing, for each of the data processing systems, a plurality of emulated virtual secured I/O devices such that to the data processing system, the emulated virtual secured I/O devices are indistinguishable from physical I/O devices;
the KVM switch providing, for each of the I/O devices, an emulated virtual secured data processing system such that to the I/O device, the emulated virtual secured data processing system is indistinguishable from a physical data processing system;
establishing a first secure communication channel between a first one of the I/O devices and the emulated virtual secured data processing system provided for the first I/O device, wherein the first I/O device is selected from a group consisting of a keyboard, a video device, and a computer mouse;
establishing a second secure communication channel between a first one of the data processing systems and a particular one of the emulated virtual secured I/O devices provided for the first data processing system;
wherein at least one of the first and second secure communication channels supports encrypted communications;
transmitting I/O data between the KVM switch and the first I/O device via the first secure communication channel; and
transmitting the I/O data between the KVM switch and the first data processing system via the second secure communication channel;
wherein at least one of the transmissions of the I/O data comprises a transmission of encrypted I/O data via the first or second secure communication channel.
2. The method of claim 1 , wherein the data processing system comprises a first data processing system, the method further comprising:
establishing a third secure communication channel between the KVM switch and a second data processing system;
receiving a control command to switch from the first data processing system to the second data processing system;
after receiving the control command, receiving subsequent I/O data at the KVM switch from the first I/O device via the first secure communication channel; and
in response to receiving the subsequent I/O data from the first I/O device at the KVM switch via the first secure communication channel, transmitting the subsequent I/O data from the KVM switch to the second data processing system via the third secure communication channel.
3. The method of claim 1 , wherein the I/O data transmitted via the first secure communication channel comprises encrypted I/O data.
4. The method of claim 1 , wherein the I/O data transmitted via the second secure communication channel comprises encrypted I/O.
5. The method of claim 1 , wherein establishing a first secure communication channel between the first I/O device and the emulated virtual secured data processing system provided for the first I/O device comprises exchanging persona information between the first I/O device and the emulated virtual secured data processing system.
6. The method of claim 1 , wherein establishing a second secure communication channel between the first data processing system and the particular emulated virtual secured I/O device comprises passing a key between the first data processing system and the particular emulated virtual secured I/O device.
7. The method of claim 1 , wherein establishing a first secure communication channel between the first I/O device and the emulated virtual secured data processing system provided for the first I/O device comprises passing a key between first I/O device and the emulated virtual secured data processing system.
8. The method of claim 7 , further comprising storing the key in a keystore in a security chip in the KVM switch.
9. The method of claim 1 , wherein transmitting the I/O data between the KVM switch and the first data processing system comprises transmitting decrypted I/O data between the KVM switch and the first data processing system.
10. A keyboard, video, and mouse (KVM) switch that supports secure input/output (I/O) communications between an I/O device in communication with the KVM switch and a data processing system in communication with the KVM switch, the KVM switch comprising:
a peripheral port operable to communicate with the I/O device wherein the I/O device is selected from the group consisting of a keyboard, a video device, and a computer mouse;
a system port operable to communicate with the data processing system;
security logic in the KVM switch that provides an emulated virtual secured data processing system for the I/O device such that to the I/O device, the emulated virtual secured data processing system is indistinguishable from a physical data processing system, the security logic establishing a first secure communication channel between the emulated virtual secured data processing system and the I/O device via the peripheral port;
virtual KVM logic in the KVM switch that provides a plurality of emulated virtual secured I/O devices for the data processing system such that to the data processing system, the emulated virtual secured I/O devices are indistinguishable from physical I/O devices, the virtual KVM logic establishing a second secure communication channel between one of the emulated virtual secured I/O devices and the data processing system via the system port; and
switching logic that, in response to receiving I/O data from one of the I/O device via the first secure communication channel and the data processing system via the second secure communication channel, subsequently transmits the I/O data from the KVM switch to the other of the I/O device via the first secure communication channel and the data processing system via the second secure communication channel;
wherein the KVM switch receives the I/O data via the first or second secure communication channel as encrypted I/O data, or transmits the I/O data via the first or second secure communication channel as encrypted I/O data, or both.
11. The KVM switch of claim 10 , wherein:
the system port comprises a first system port;
the KVM switch further comprises a second system port;
the virtual KVM logic establishes a third secure communication channel between the KVM switch and a second data processing system in communication with the KVM switch via the second system port; and
in response to receiving a control command to switch from the first data processing system to the second data processing system and then receiving subsequent I/O data from the I/O device, the KVM switch transmits the subsequent I/O data to the second data processing system via the third secure communication channel.
12. The KVM switch of claim 10 , wherein the KVM switch receives the I/O data from the I/O device as encrypted I/O data.
13. The KVM switch of claim 10 , wherein the KVM switch transmits the I/O data to the data processing system as encrypted I/O data.
14. The KVM switch of claim 10 , wherein the KVM switch establishes the first secure communication channel between the emulated virtual secured data processing system and the I/O device in response to receiving a key from the I/O device.
15. The KVM switch of claim 10 , further comprising:
a security chip that contains the security logic and the virtual KVM logic; and
a keystore in the security chip used to establish the first secure communication channel.
16. The KVM switch of claim 10 , wherein the virtual KVM logic in the KVM switch establishes the second secure communication channel between the between the emulated virtual secured I/O device and the data processing system in response to receiving a key from the data processing system.
17. The KVM switch of claim 10 , wherein the KVM switch also supports a non-secure channel between the KVM switch and a non-secured data processing system.
18. The KVM switch of claim 10 , wherein the KVM switch also supports a non-secure channel between the KVM switch and a non-secured I/O device.
19. An information handling system that supports secure input/output (I/O) communications between an I/O device and a data processing system via a keyboard, video, and mouse (KVM) switch, the information handling system comprising:
a data processing system;
an input/output (I/O) device; and
a keyboard, video, and mouse (KVM) switch in communication with the data processing system and the I/O device wherein the I/O device is selected from the group consisting of a keyboard, a video device, and a computer mouse;
security logic in the KVM switch that provides an emulated virtual secured data processing system for the I/O device such that to the I/O device, the emulated virtual secured data processing system is indistinguishable from a physical data processing system, the security logic establishing a first secure communication channel between the emulated virtual secured data processing system and the I/O device;
virtual KVM logic in the KVM switch that provides a plurality of emulated virtual secured I/O devices for the data processing system such that to the data processing system, the emulated virtual secured I/O devices are indistinguishable from physical I/O devices, the virtual KVM logic establishing a second secure communication channel between one of the emulated virtual secured I/O devices and the data processing system; and
switching logic that, in response to receiving I/O data from the I/O device via the first secure communication channel, transmits the I/O data from the KVM switch to the data processing system via the second secure communication channel;
wherein the I/O data is received via the first secure communication channel as encrypted I/O data, or transmitted via the second secure communication channel as encrypted I/O data, or both.
20. The information handling system of claim 19 , wherein the KVM switch provides a secured, virtual I/O device for the data processing system by maintaining the secure communication channel between the data processing system and the KVM switch despite switching of the I/O device to a different data processing system in communication with the KVM switch.