Virus immune computer system and method

• US 10,346,608 B2
• Filed: 06/14/2018
• Issued: 07/09/2019
• Est. Priority Date: 12/12/2017
• Status: Expired due to Fees

• Current Assignee: Atense Incorporated, Atense LLC
• Original Assignee: John Almeida
• Inventors: Almeida, John
• Primary Examiner(s): Bayou, Yonas A
• Application Number:
  US16/008,779
• Publication Number:
  US 20190180027A1
• Time in Patent Office: 390 Days
• CPC Class Codes: G06F 21/51 at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability
• CPC Class Codes: G06F 21/56 Computer malware detection or handling, e.g. anti-virus arrangements
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 8/61 Installation
• CPC Class Codes: G06F 9/445 Program loading or initiating bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57
• CPC Class Codes: H04L 9/0822 using key encryption key
• CPC Class Codes: H04L 9/0825 using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage

Abstract

A method and apparatus prevents hacker code from infecting an application program by requiring decryption of the application program prior to running the application program on a computer. The device is preferably a computer system that includes a dongle, or a separate unit that is connected or connectable to the computer. A security program decrypts a first key with a second key stored on the dongle. When a new application is installed the first time on the computer, the security program uses a decrypted first key to encrypt whatever is installed such that the encrypted application program is the only installed version of the application program on any non-transitory computer readable memory accessible by the computer. When a command is given to startup the application program, whatever code is needed for startup is first decrypted using the decrypted first key.

Claims

1. A computer system comprising:

a storage device that is a separate unit from components necessary for startup of a computer, the storage device comprising;

a first-non-transitory computer storage medium, the first-non-transitory computer storage medium storing;

a device symmetric private key, the device symmetric private key operable to decrypt an encrypted operating system symmetric private key so as to produce a decrypted operating system symmetric private key;

a computer comprising a central processing unit, an address bus, and a second-non-transitory computer storage medium on which is stored the encrypted operating system symmetric private key and a security program that is operable to;

retrieve the device symmetric private key from the storage device;

decrypt the encrypted operating system symmetric private key with the device symmetric private key to produce the decrypted operating system symmetric private key;

preclude the computer from storing the device symmetric private key or the decrypted operating system symmetric private key in any non-transitory computer storage medium;

require the computer, upon first installation of an application program on the computer, to use the decrypted operating system symmetric private key to encrypt the application program such that the encrypted application program is the only installed version of the application program on any non-transitory computer readable memory accessible by the computer;

enable the computer, each time a command is given to startup the application program, to use the decrypted operating system symmetric private key to decrypt a first portion of the encrypted application program needed implement the command, and to store what was decrypted in a random access memory accessible by the computer;

require the computer to use the decrypted operating system symmetric private key to subsequently decrypt any second portion of the encrypted application program that is needed during operation of the first portion and to store what was subsequently decrypted in the random access memory accessible by the computer; and

prevent access to the device symmetric private key after the device symmetric private key is first accessed to produce the decrypted operating system symmetric private key, unless express authorization is first obtained.

2. The computer system of claim 1, wherein the security program is further operable to prevent the computer from running any part of the application program that has not been first encrypted with the decrypted operating system symmetric private key.

3. The computer system of claim 1, wherein the security program is further operable to store the encrypted application program in the random access memory accessible by the computer.

4. The computer system claim 3, wherein the security program is further operable to:

produce a modulus value by causing the central processing unit to perform a modulus operand between an address bus value and a length of the decrypted operating system symmetric private key to derive a remainder;

add the value of one to the remainder producing an added remainder value;

use the added remainder value to point to a byte value in the decrypted operating system symmetric private key; and

require the central processing unit to use the byte value for decryption of the encrypted application program stored in the random access memory.

5. The computer system of claim 1, wherein the security program is further operable to require the computer, after startup of the computer, to decrypt any executable code residing in the random access memory accessible by the computer, prior to running that executable code, where the decrypted operating system symmetric private key is used to decrypt said executable code.

6. The computer system of claim 1, wherein the security program is further operable to limit the storage device to a microchip integrated into a motherboard of the computer.

7. The computer system of claim 1, wherein the security program is further operable to prevent access to the device symmetric private key by implementing a procedure selected from the group consisting of producing and sending an automated signal from an operating system of the computer to the storage device, acting on manual input by a user at the physical location of the computer, producing and sending an automated signal from an basic input and output system of the computer to the security device, automatically activating a tristate switch, and causing the operating system to change a value in a flag to one recognized as a command to prevent such access.

8. The computer system of claim 1, wherein the first-non-transitory computer storage medium of the storage device is selected from the group consisting of an electronic chip, and a removable compact disk.

9. The computer system of claim 1, wherein the storage device is an electronic chip integrated into the computer.

10. The computer system of claim 9 further comprising:

a first-electronic tristate switch in the electronic chip; and

wherein the security program is further operable to activate the first-electronic tristate switch in order to prevent access to the device symmetric private key.

11. The computer system of claim 10, further comprising:

a second-electronic tristate switch in the electronic chip; and

wherein the security program is further operable to activate the second-electronic tristate switch to prevent reading the device symmetric private key from the random access memory accessible by the computer.

12. A storage device usable with a computer, the storage device comprising:

a non-transitory computer storage medium, a central processing unit, a data bus, and an address bus;

the non-transitory computer storage medium comprising a key usable for decrypting encrypted program code, the encrypted program code stored in a random access memory accessible by the computer, the key comprising a plurality of bytes wherein each byte in the plurality of bytes has a byte value;

the central processing unit of the storage device connectable to the random access memory through the data bus and the address bus;

the non-transitory computer storage medium storing computer code operable on the central processing unit of the storage device to;

identify a designated location in the random access memory accessible by the computer holding an encrypted byte of executable code;

perform a modulus operand between an address location of the encrypted byte of executable code and a length of the key to derive a remainder value;

add one to the remainder value deriving a summed value;

fetch the byte value of the byte in the plurality of bytes of the key, said byte located at the summed value;

use the byte value that is fetched to decrypt an encrypted executable code starting at the designated location in the random access memory accessible by the computer, wherein such use producing a decrypted executable code; and

execute the decrypted executable code.

13. A method for improving operation of a computer to provide the computer with immunity from infection of a software program by a software virus or by memory software code injection, the method comprising the steps of:

hosting an operating system in a non-transitory computer storage medium accessible by the computer;

receiving at the computer an encrypted operating system symmetric private key through a network connection;

decrypting the encrypted operating system symmetric private key on the computer to derive a decrypted operating system symmetric private key;

encrypting a software program using the decrypted operating system symmetric private key upon first installation of the software program and thereby create an encrypted software program that is the only installed version of the software program on the computer;

when executing a command to start the software program, requiring the operating system to use the decrypted operating system symmetric private key to decrypt a first part of the encrypted software program necessary to start the software program;

requiring the computer to use the decrypted operating system symmetric private key to subsequently decrypt any second part of the encrypted software program that is needed during operation of the first part; and

precluding the operating system from running any executable code that has not been previously encrypted with the decrypted operating system symmetric private key.

14. The method of claim 13, further comprising the step of storing the first part and any second part that is decrypted in a random access memory accessible by the computer.

15. A method for improving operation of a computer to provide the computer with immunity from infection of a software program by a software virus or by memory software code injection, the method comprising the steps of:

hosting an operating system in a non-transitory computer storage medium accessible by a computer;

receiving at the computer an encrypted operating system symmetric private key through a network connection;

decrypting the encrypted operating system symmetric private key on the computer to derive a decrypted operating system symmetric private key;

encrypting a software program using the decrypted operating system symmetric private key upon first installation of the software program and thereby create an encrypted software program that is the only installed version of the software program on the computer;

when executing a command to start the software program, requiring the operating system to use the decrypted operating system symmetric private key to decrypt a first part of the encrypted software program necessary to start the software program;

requiring the computer to use the decrypted operating system symmetric private key to subsequently decrypt any second part of the encrypted software program that is needed during operation of the first part; and

storing the first part and any second part that is decrypted in a random access memory accessible by the computer.

16. The method of claim 15, further comprising the step of precluding the operating system from running any executable code that has not been previously encrypted with the decrypted operating system symmetric private key.