Methods and apparatus for digital data processor instantiation

• US 20090089871A1
• Filed: 07/05/2006
• Published: 04/02/2009
• Est. Priority Date: 03/07/2005
• Status: Abandoned Application

• Current Assignee: Unicom Engineering, Inc. (UNICOM Global, Inc.)
• Original Assignee: Network Engines Incorporated (UNICOM Global, Inc.)
• Inventors: Murphy, Kevin J. JR., Adams, Don, Amaral, John
• Application Number:
  US11/481,089
• Publication Number:
  US 20090089871A1
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: G06F 21/572 Secure firmware programming, e.g. of basic input output system [BIOS]
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

The invention provides, in one aspect, a digital data processing device includes a firewall device and a computer, both housed within the same enclosure and sharing a common path to the Internet (or other external network), yet, not sharing the same substantive processing logic. Thus, by way of example, the firewall device does not the computer'"'"'s central processing unit (CPU) to execute firewall logic. The digital data processing device can be arranged to limit connectivity and/or functionality of the computer and/or firewall device, e.g., absent authentication. Thus, for example, the computer and firewall can be coupled to the common path—e.g., a modem, network interface card or other communications port supporting access via wired (e.g., wired ethernet and coaxial), wireless (e.g., satellite, telephony, 802.11x), and/or optical (e.g., fiber) means—such that that access by the computer to the Internet (or other external network) is mediated by the firewall device.

Claims

1. A digital data processing device, comprising

A. a firewall device and a computer that are housed in common enclosure,

B. a path supporting communications to any of the Internet or other network (collectively, “

external network”

), the firewall device and the computer being coupled to the path for communications over the external network,

C. the firewall device and the computer being free of common processing logic.

2. The digital processing data device of claim 1, wherein the path comprises any of a modem, network interface card or other communications device supporting access to the external network any of wire, wireless, or optical means, or a combination thereof.

3. The digital data processing device of claim 2, wherein the firewall device and the computer communicate with one another via the path.

4. The digital data processing device of claim 2, wherein the firewall device and the computer communicate over the path using an ethernet protocol.

5. The digital data processing device of claim 2, wherein the computer and the firewall device each comprise a separate respective processing logic.

6. The digital data processing device of claim 5, wherein the processing logic of each of the computer and the firewall is a central processing unit.

7. The digital data processing device of claim 5, wherein the computer and the firewall device each comprise a separate respective storage device.

8. The digital processing data device of claim 5, wherein the computer is any of a general-purpose computer, a special-purpose computer, personal digital assistant, MP3 player, game player, or other digital data processing device.

9. The digital processing data device of claim 5, wherein the computer and the firewall device each comprise a separate respective power supply.

10. The digital processing data device of claim 2 configured to limit any of operation, modification and/or connectivity of the computer absent authentication.

11. The digital processing data device of claim 10, wherein the computer and the firewall device are coupled to the common path such that that access by the computer to the external network is mediated by the firewall device.

12. The digital processing data device of claim 12, comprising a security module that is coupled to the computer and that limits any of operation, modification and/or connectivity thereof absent coupling a token with the digital processing data device.

13. The digital processing data device of claim 12, wherein the token couples with The digital processing data device any of mechanically, electrically, magnetically, optically, or electro-magnetically, or a combination thereof.

14. The digital processing data device of claim 13, wherein the token comprises any of a key fob, smart card, credit card, or the like.

15. A digital data processing device, comprising

A. a firewall device and a computer that are housed in common enclosure,

B. a path supporting communications to any of the Internet or other network (collectively, “

external network”

), the firewall device and the computer being coupled to the path for communications over the external network such that communications by the computer over the external network are mediated by the firewall device,

C. the path comprising any of a modem, network interface card or other communications device supporting access to the external network via any of wire, wireless, or optical means, or a combination thereof.

D. the firewall device and the computer communicating to one another over the path via an ethernet protocol, the digital processing data device configured to limit any of operation, modification and/or connectivity of the computer absent authentication,

E. a security module that is coupled to the computer and that limits any of operation, modification and/or connectivity thereof absent (i) coupling a token with the digital processing data device, and (ii) external authentication received via the external network.

16. The digital processing data device of claim 15, wherein the token couples with The digital processing data device any of mechanically, electrically, magnetically, optically, or electro-magnetically, or a combination thereof.

17. The digital processing data device of claim 15, comprising a security module that is coupled to the firewall device and that limits any of operation, modification and/or connectivity thereof absent (i) coupling a token with the digital processing data device, and (ii) external authentication received via the external network.

18. The digital processing data device of claim 17, wherein absent authorization the firewall device any of limits by any of address, packet type, application and protocol communications by the computer over the external network.

19. The digital processing data device of claim 15, wherein the computer executes a plurality of operating system instances within a virtual machine environment, where each operating system instance includes an operating system and one or more applications programs, and wherein the instances utilize independent memory spaces, registries, stacks, and environmental variables.

20. The digital processing data device of claim 19, wherein one or more of the operating system instances are pre-configured by the vendor and one or more of the operating system instances are configured by the purchaser.

21. A digital data processing system comprising

A. a first digital data processing device that is coupled with one or more other digital data processing devices via any of a local area network, wide area network, or other network segment (collectively, “

network segment”

),

B. the first digital data processing device comprising

i. a firewall device and a computer that are housed in common enclosure,

ii. a path supporting communications to any of the Internet or other network (collectively, “

external network”

), the firewall device and the computer being coupled to the path for communications over the external network such that communications by the computer over the external network are mediated by the firewall device,

iii. the path comprising any of a modem, network interface card or other communications device supporting access to the external network via any of wire, wireless, or optical means, or a combination thereof,

iv. the firewall device and the computer communicating to one another over the path via an ethernet protocol,

v. a security module that is coupled to the computer and that limits any of operation, modification and/or connectivity thereof absent (i) coupling a token with The digital processing data device, and (ii) external authentication received via the external network.

22. The digital data processing system of claim 21, wherein one or more of the other digital data processing devices comprise client workstations.

23. The digital data processing system of claim 22, wherein any of the client workstations comprise desktop and laptop computers.

24. The digital data processing system of claim 22, wherein the digital data processing device is configured as a mail server, file system server, proxy server.

25. The digital data processing system of claim 22, wherein the data processing device is a store-and-forward site for software executed by the other digital data processors on the network segment.

26. A method of operating a digital data processing device, the method comprising

A. providing the digital data processing device as a firewall device and a computer that are housed in common enclosure, yet, that do not share common processing logic or common storage,

B. providing with the digital data processing device a path that supports communications to any of the Internet or other network (collectively, “

external network”

), and coupling the firewall device and the computer to that path for communications over the external network,

C. using the firewall device to mediate communications by the computer over the external network, such that communications by the computer over the external network are limited absent (i) coupling a token with the digital processing data device, and (ii) external authentication received via the external network.

27. The method of claim 26, comprising conducting communications between the computer and the firewall device solely via the path.

28. The method of claim 26, comprising limiting any of operation and/or modification of the computer absent (i) coupling a token with the digital processing data device, and (ii) external authentication received via the external network.

29. The method of claim 26, further comprising the steps of

D. providing the digital data processing device, initially, with any of limited software and data,

E. coupling the token with the digital data processing device to establish communications over the external network with an authentication system.

30. The method of claim 29, comprising using the authentication system to provide external authentication to the digital data processing system via the external network.

31. The method of claim 30, responding to such external authentication by any of removing or loosening restrictions on operation and/or modification of the computer.