Interconnectable personal computer architectures that provide secure, portable, and persistent computing environments
View Patent ↗Disclosed are interconnectable personal computer architectures comprising secure, portable and persistent computing environments that provide secure computing sessions with persistence. The computing environments are implemented using a secure non-computing client device, such as a USB device, that interfaces with a host computer and, optionally, a trusted server. The secure non-computing client device is used to instantiate a secure BIOS and a secure cold or warm boot of the host computer, from the client device, in a host protected area of the host computer, or from the trusted server. The client device comprises a security device, such a trusted platform module, that encrypts and decrypts data transferred between the client apparatus and the host computer to provide a sealed computing environment on the host computer. The client device may implement keyboard logger attack prevention. The client device may also implement a high assurance guard to protect applications. The client device may also comprise security wrapper software that encapsulates malware processed by the host computer. Computing methods and software are also disclosed.
1. An accessory configured to interface with a host computer having a basic input/output system (BIOS) that is initiated on power-up of the host computer to complete a boot sequence, the host computer being configured with at least one hardware device, the accessory comprising:
a cryptological chip;
a communications controller configured to interface between the accessory and the host computer;
a bootable first memory section readable by the host computer without decryption, the first memory configured to be writeable only by a program having an authentication key that is processable by the cryptological chip;
a second memory section encrypted with a cryptological key processable by the cryptological chip, the second memory configured to be readable or writeable only by a program having the cryptological key;
the first memory further configured with:
a booting software configured to communicate with the BIOS on power-up of the host computer via the communications controller, the booting software carrying instructions causing the host computer to use the first memory to complete the boot sequence;
a set of device drivers loaded by the booting software during the boot sequence; and
the cryptological key;
wherein the booting software contains instructions to load an operating system software and application software from the second memory using the cryptological key;
the second memory further configured with:
the operating system (OS) software configured to regulate the way application software uses the host computer's at least one hardware device;
a list software configured to prevent unauthorized application software from running.
2. The accessory of claim 1 , wherein the communications controller is a USB controller configured to cause the host computer to recognize the first memory as a read only mass storage device.
3. The accessory of claim 1 , wherein the communications controller is configured to communicate wirelessly with the host computer and is recognizable by the BIOS on power-up of the host computer.
4. The accessory of claim 1 , further comprising biometric identification apparatus to identify a user attempting to use the apparatus.
5. The accessory of claim 1 , wherein the list software is a white list software program.
6. The accessory of claim 1 , wherein the booting software is a boot strap software program.
7. The accessory of claim 1 , wherein the first memory further includes a trusted BIOS, and the booting software replaces the BIOS on the host computer with the trusted BIOS.
8. The accessory of claim 1 , further comprising a trusted server coupled to the host computer by way of a network, and that is configured to restrict the use of unauthorized peripherals.
9. The accessory of claim 1 , further comprising keyboard logger attack prevention software that is configured to prevent detection of keystrokes when using the host computer.