Virus immune computer system and method

• US 10,614,254 B2
• Filed: 12/12/2017
• Issued: 04/07/2020
• Est. Priority Date: 12/12/2017
• Status: Active Grant

• Current Assignee: Atense Incorporated, Atense LLC
• Original Assignee: Atense Incorporated
• Inventors: Almeida, John
• Primary Examiner(s): Patel, Haresh N
• Application Number:
  US15/839,450
• Publication Number:
  US 20190180056A1
• Time in Patent Office: 847 Days
• Field of Search: 713189
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/72 in cryptographic circuits
• CPC Class Codes: G06F 21/73 by creating or determining hardware identification, e.g. serial numbers
• CPC Class Codes: H04L 2209/127 Trusted platform modules [TPM]
• CPC Class Codes: H04L 9/006 involving public key infrastructure [PKI] trust models network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/088 Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms network architectures or network communication protocols for using time-dependent keys in a packet data network H04L63/068
• CPC Class Codes: H04L 9/0897 involving additional devices, e.g. trusted platform module [TPM], smartcard or USB
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

A method and apparatus prevents hacker code from infecting an application program by requiring decryption of the application program prior to running the application program on a computer. The method includes steps of: providing a storage device that is a separate unit from components necessary to operate the computer; storing a symmetric private key on the storage device; using the symmetric private key to produce an encrypted application program upon first installation; thereafter decrypting that part of the encrypted application program needed implement a command to run the application program; precluding the computer from running any part of the application program that has not been first encrypted with the symmetric private key; and, decrypting, on the fly, only those follow-on parts of the encrypted application program needed to perform functions called for during operation of the application program.

Claims

1. A method for preventing hacker code from infecting an application program, the method requiring decryption of the application program prior to running the application program on a computer, the computer comprising a non-transitory computer storage medium;

random access memory;

a central processing unit; and

an operating system, the operating system stored in the non-transitory computer storage medium of the computer, the method comprising the steps of;

providing a storage device comprising a non-transitory computer storage medium, said storage device being a separate unit from components necessary to operate the computer;

storing a symmetric private key on the storage device, the symmetric private key being symmetric in that it is usable for encryption and decryption of the application program stored in the random access memory of the computer;

using the symmetric private key to produce an encrypted application program upon first installation of the application program on the computer, the encrypted application program comprising encrypted operational instructions needed to run the application program, such that after such first installation, the encrypted application program is the only installed version of the application program on the computer;

upon receiving a command to run the application program, loading the encrypted application program into the random access memory of the computer;

requiring the central processing unit to decrypt, using the symmetric private key, that part of the encrypted application program needed implement the command to run the application program;

precluding the computer from running any part of the application program that has not been first encrypted with the symmetric private key; and

,

requiring the central processing unit to decrypt, on the fly, only those follow-on parts of the encrypted application program needed to perform functions called for during operation of the application program.

2. The method of claim 1, further comprising the steps of:

producing a modulus value by causing the central processing unit to perform a modulus operand using between an address bus value and a length of the symmetric private key to derive a remainder, using the remainder to locate a byte location of the symmetric private key;

using the modulus value to point to a byte value in the symmetric private key;

requiring the central processing unit to use the byte value for decryption of any follow-on parts of the encrypted application program needed to perform functions called for during operation of the application program.

3. The method of claim 1, further comprising the steps of:

receiving a hacker code on the computer, the hacker code containing a non-encrypted software instruction that if executed would implement an unwanted operational command;

retaining the hacker code only in the random access memory of the computer along with the encrypted application program;

receiving a request from the central processing unit to execute the non-encrypted software instruction of the hacker code stored in the random access memory of the computer;

decrypting the non-encrypted software instruction of the hacker code using the symmetric private key, said decrypting producing a non-functional software instruction; and

the central processing unit terminating attempted execution of the non-functional software instruction.

4. The method of claim 1, further comprising the step of preventing access to the symmetric private key after the symmetric private key is successfully used to produce the encrypted application program, unless express authorization is first obtained.

5. The method of claim 1, further comprising the step of limiting the storage device to a microchip integrated into a motherboard of the computer, said microchip not having a dedicated central processing unit.

6. The method of claim 1, further comprising the step of preventing access to the symmetric private key by implementing a procedure selected from the group consisting of producing and sending an automated signal from an operating system of the computer to the storage device, acting on manual input by a user at said computer, automatically using a tristate switch, and causing the operating system to change a value in a flag to one recognized as a command to prevent such access.

7. The method of claim 1, further comprising the step of limiting the non-transitory computer storage medium of the storage device to non-transitory computer storage medium selected from the group consisting of an electronic chip, and a removable compact disk.

8. The method of claim 1, further comprising the step of hosting the storage device in an electronic chip integrated into the computer.

9. The method of claim 8, further comprising the steps of:

hosting a first-electronic tristate switch in the electronic chip; and

activating the first-electronic tristate switch in order to prevent access to the symmetric private key.

10. The method of claim 9, further comprising the steps of:

hosting a second-electronic tristate switch in the electronic chip; and

activating the second-electronic tristate switch in order to prevent reading of the symmetric private key from the read-access memory of the computer.