Secure control of insecure device
A computer system for securely controlling an insecure computer is provided. The system comprises an insecure computer, a secure computer and a unidirectional dataflow enforcer. The insecure computer comprises a dedicated video output with a hardware interface, and is configured to transmit its video output to a secure computer over a first connection and to receive instructions for controlling the insecure computer over a second connection. The secure computer is configured to receive the video output of the insecure computer over the first connection and to transmit instructions for controlling the insecure computer over the second connection. The unidirectional dataflow enforcer is configured to enforce unidirectional dataflow between the secure computer and the insecure computer, such that dataflow from the secure computer to the insecure computer over the second connection is allowed, but dataflow from the insecure computer to the secure computer over the second connection is prevented. A corresponding method is also provided.
1. A computer system for providing secure control of a computer, the system comprising an insecure computer and a secure computer:
the insecure computer having a dedicated video output with a first hardware interface of the insecure computer, and configured to transmit, by the video output, a screen image of its operating system interface to the secure computer over a first connection, and to receive instructions for controlling the insecure computer from the secure computer over a second connection that connects to a second hardware interface of the insecure computer, different from the first hardware interface;
the secure computer being configured to receive the video output of the insecure computer over the first connection and to transmit instructions for controlling the insecure computer over the second connection;
the system further comprising a unidirectional dataflow enforcer configured to enforce unidirectional dataflow between the secure computer and the insecure computer, such that dataflow from the secure computer over the second connection to the insecure computer is allowed, but dataflow from the insecure computer to the secure computer over the second connection is prevented.
2. The system of claim 1 , wherein the unidirectional dataflow enforcer is implemented using hardware.
3. The system of claim 2 , wherein the unidirectional dataflow enforcer comprises an optical link, the optical link comprising transmission hardware coupled to the secure computer and receiving hardware coupled to the insecure computer.
4. The system of claim 3 , wherein the transmission hardware comprises a laser.
5. The system of claim 2 , wherein the unidirectional dataflow enforcer comprises an electronic transmission link and electronic transmission can only occur from the secure computer to the insecure computer.
6. The system of claim 5 , wherein the electronic transmission link is one connection of a serial port link that uses different electrical connections for each direction of communication.
7. The system of claim 1 , wherein the unidirectional dataflow enforcer is implemented in software.
8. The system of claim 7 , wherein the software is executed on the secure computer.
9. The system of claim 7 , wherein the system further comprises an intermediate computing platform and the software is executed on the intermediate computing platform.
10. The system of claim 1 , wherein the unidirectional dataflow enforcer is a combination of hardware and software.
11. The system of claim 1 , wherein the unidirectional dataflow enforcer is a custom electronic device.
12. The system of claim 11 , wherein the unidirectional dataflow enforcer is a programmable logic device.
13. The system of claim 11 , wherein the unidirectional dataflow enforcer is an application-specific integrated circuit.
14. The system of claim 1 , wherein the secure computer is further configured to transmit the screen image of the operating system interface of the insecure computer to a second secure computer over a third connection, and to receive instructions for controlling the insecure computer from the second secure computer over the third connection.
15. The system of claim 14 , wherein the secure computer is configured to compress the screen image before forwarding it to the second secure computer.
16. The system of claim 14 , wherein the system comprises the second secure computer, the second secure computer configured to receive the screen image of the insecure computer from the secure computer over the third connection and to transmit instructions for controlling the insecure computer over the third connection.
17. The system of claim 1 , wherein the dedicated video output with a unidirectional hardware interface is one of the following interface technologies: VGA, DVI, HDMI, DisplayPort or DSI.
18. The system of claim 1 , wherein the unidirectional dataflow enforcer is configured to monitor the instructions transmitted over the second interface.
19. The system of claim 18 , wherein monitoring the instructions transmitted over the second interface comprises producing a log of the instructions.
20. The system of claim 19 , wherein the log of the instructions is transmitted to the secure computer over a dedicated interface.
21. The system of claim 1 wherein the instructions for controlling the insecure computer are user instructions input using one or more input devices.
22. The system of claim 1 wherein the insecure computer is further configured to transmit audio output to the secure computer over the first connection.
23. A secure computer, the secure computer being connected to an insecure computer over a first and second connection, wherein:
the first connection connects to a dedicated video output with a first hardware interface of the insecure computer;
the second connection connects to a second hardware interface of the insecure computer, different from the first hardware interface, to receive instructions for controlling the insecure computer, and is associated with a unidirectional dataflow enforcer configured to enforce unidirectional dataflow between the secure computer and the insecure computer, such that dataflow from the secure computer over the second connection to the insecure computer is allowed, but dataflow from the insecure computer to the secure computer over the second connection is prevented; and
the secure computer is configured to receive a screen image of the operating system interface of the insecure computer over the first connection and to transmit instructions for controlling the insecure computer over the second connection.
24. An insecure computer, the insecure computer being connected to a secure computer over a first and second connection, wherein:
the insecure computer has a dedicated video output with a first hardware interface of the insecure computer, and transmits, by the video output, a screen image of its operating system interface to the secure computer over the first connection;
the insecure computer has a second hardware interface, different from the first hardware interface, that is coupled to the second connection and that receives instructions from the secure computer for controlling the insecure computer;
the second connection is associated with a unidirectional dataflow enforcer configured to enforce unidirectional dataflow between the secure computer and the insecure computer, such that dataflow from the secure computer over the second connection to the insecure computer is allowed, but dataflow from the insecure computer to the secure computer over the second connection is prevented; and
the insecure computer is configured to receive the instructions from the secure computer and to carry out the instructions.
25. A method of securely controlling a computer comprising:
transmitting a screen image of the operating system interface of an insecure computer having a dedicated video output with a first hardware interface of the insecure computer, by the video output, to a secure computer over a first connection;
enforcing unidirectional dataflow between the secure computer and the insecure computer by allowing dataflow from the secure computer to the insecure computer over a second connection that connects to a second hardware interface of the insecure computer, different from the first hardware interface, and by preventing dataflow from the insecure computer to the secure computer over the second connection; and
receiving, from the secure computer, at the insecure computer, over the second connection, instructions for controlling the insecure computer.
26. A method of operating an insecure computer using a secure computer, the secure computer being connected to the insecure computer over a first and second connection, the method comprising, at the secure computer:
receiving a screen image of the operating system interface of the insecure computer over a first connection that connects to a dedicated video output with a first hardware interface of the insecure computer; and
transmitting instructions for controlling the insecure computer over the second connection, wherein the second connection connects to a second hardware interface of the insecure computer, different from the first hardware interface, to receive instructions for controlling the insecure computer, and is associated with a unidirectional dataflow enforcer configured to enforce unidirectional dataflow between the secure computer and the insecure computer, such that dataflow from the secure computer over the second connection to the insecure computer is allowed, but dataflow from the insecure computer to the secure computer over the second connection is prevented.
27. A method of operating an insecure computer using a secure computer, the insecure computer being connected to the secure computer over a first and second connection, the method comprising, at the insecure computer:
transmitting a screen image of the operating system interface of the insecure computer to the secure computer over the first connection using a dedicated video output with a first hardware interface of the insecure computer;
receiving, at a second hardware interface of the insecure computer, different from the first hardware interface, that is coupled to the second connection, instructions from the secure computer for controlling the insecure computer, wherein the second connection is associated with a unidirectional dataflow enforcer configured to enforce unidirectional dataflow between the secure computer and the insecure computer, such that dataflow from the secure computer over the second connection to the insecure computer is allowed, but dataflow from the insecure computer to the secure computer over the second connection is prevented; and
execute the instructions received from the secure computer.
28. The system of claim 1 , wherein the second hardware interface comprises a network interface that is configured to receive content from a server.
29. The system of claim 28 , wherein the screen image is generated based at least in part on the content.
30. The system of claim 1 , wherein the dedicated video output is configured so that software running on the insecure computer cannot affect signals transmitted over the first hardware interface.
31. The system of claim 30 , wherein the signals transmitted over the first hardware interface are generated by a dedicated single function controller.