Isolated multiplexed multi-dimensional processing in a virtual processing space having virus, spyware, and hacker protection features

• US 20100005531A1
• Filed: 12/23/2004
• Published: 01/07/2010
• Est. Priority Date: 12/23/2004
• Status: Abandoned Application

• Current Assignee: Vir2us, Inc.
• Original Assignee: Vir2us, Inc.
• Inventors: More, Anthony B., Largman, Kenneth, Blair, Jeffrey
• Application Number:
  US11/022,290
• Publication Number:
  US 20100005531A1
• Time in Patent Office: Days
• US Class Current: 726/24
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine

Abstract

Information appliance, computing device, or other processor or microprocessor based device or system provides security and anti-viral, anti-hacker, and anti-cyber terror features, and can automatically create multiple sequentially or concurrently and intermittently isolated and/or restricted computing environments to prevent viruses, malicious or other computer hacking, computer or device corruption and failure by using these computing environments in conjunction with restricted and controlled methods of moving and copying data, combined with a process that destroys malicious code located in computing environments and data stores. Time multiplexed processing streams with system, device, architecture and method for maintaining isolation of multiple processes executing in single physical processor. Virtual multi-dimensional processing space and virtual processing environments. Temporally multiplexed processing in a single CPU. Process isolation using address control and mapping. Selecting, configuring, switching, and/or multiplexing multiple processes in physical and/or virtual processing or computing spaces to create physical and/or virtual processing or computing environments.

Claims

1. A method for preventing a contamination of a first data by the execution of a second data, the method comprising the steps of:

interposing a first isolation device between a source and a processing logic and a second isolation device between the processing logic and a receiver, the first and second isolation devices each being incapable of executing any instruction coming into the isolation device from the source, from the receiver, or from the processor logic wherein the isolation devices prevent access to restrict or disable communication with the processing logic and prevent the execution of any instructions on the source or the receiver side by the processing logic;

communicating the second data from the source to the processing logic through the first isolation device;

processing the second data in the processor logic to generate a first result; and

communicating the first result from the processor logic to the receiver through the second isolation device.

2. A method as in claim 1, wherein the first and second isolation devices are incapable of executing any instructions because they only perform a copy operation on binary bits or a plurality of binary bits.

3. A method as in claim 2, wherein the copy operation is performed external to the processing logic.

4. A method as in claim 2, wherein the first and second isolation devices are the same device.

5. A method as in claim 2, wherein the first and second isolation devices are different devices.

6. A method for preventing a contamination of a first data by the execution of a second data, the method comprising the steps of:

isolating a source from a processing logic and from a receiver, the isolated source and isolated receiver being incapable of executing any instruction coming into the isolated source or the isolated receiver, from the source, from the receiver, or from the processing logic;

wherein the isolated source and isolated receiver prevent access to restrict or disable communication with any processing logic and prevent execution of any instructions on the source or the receiver side by any processing logic;

communicating the second data from the source to the processing logic in an isolated mode;

processing the second data in the processing logic to generate a first result; and

communicating the first result from the processing logic to the receiver in an isolated mode.

7. A method as in claim 6, wherein the isolation is a logical isolation.

8. A method as in claim 6, wherein the isolation is a physical isolation.

9. A method as in claim 6, wherein the source and receiver are storage locations and the isolation is accomplished using an address control procedure.

10. A method as in claim 9, wherein the address control procedure includes exerting a level of control within the computer below the operating system that hides certain memory locations and makes other memory locations available to a process.

11. A computer system that prevents contamination of a first data by the execution of a second data, the system comprising:

a processing logic;

a source;

a receiver; and

a first and a second isolation device, where the first isolation device is interposed between the source and the processing logic and the second isolation device is interposed between the processing logic and the receiver;

the first and second isolation devices each being incapable of executing any instruction coming into the isolation device from the source, from the receiver, and from the processor logic;

the isolation devices prevent access to, and restrict or disable communication with the processing logic and prevent the execution of any instructions on the source or the receiver side by the processing logic; and

a communication of the second data from the source to the processing logic through the first isolation device, where processing the second data in the processor logic generates a first result and the first result is communicated from the processor logic to the receiver through the second isolation device.

12. A computer system as in claim 11, wherein the first and second isolation devices are incapable of executing any instructions because they only perform a copy operation on binary bits or a plurality of binary bits.

13. A computer system as in claim 12, wherein the copy operation is performed external to the processing logic.

14. A computer system as in claim 12, wherein the first and second isolation devices are the same device.

15. A method as in claim 12, wherein the first and second isolation devices are different devices.

16. A computer system that prevents contamination of a first data by the execution of a second data, the computer system comprising:

a processing logic;

a source and a receiver, wherein the source is isolated from the processing logic and from the receiver, the isolated source and isolated receiver being incapable of executing any instruction coming into the isolated source or the isolated receiver from the source, from the receiver, or from the processing logic;

wherein the isolated source and isolated receiver prevent access to, restrict or disable communication with any processing logic and prevent execution of any instructions on the source or the receiver side by any processing logic;

a communication of the second data from the source to the processing logic in an isolated mode, wherein processing the second data in the processing logic generates a first result and the first result is communicated from the processing logic to the receiver in an isolated mode.

17. A computer system as in claim 16, wherein the isolation is a logical isolation.

18. A computer system as in claim 16, wherein the isolation is a physical isolation.

19. A computer system as in claim 16, wherein the source and receiver are storage locations and the isolation is accomplished using an address control procedure.

20. A computer system as in claim 19, wherein the address control procedure includes exerting a level of control within the computer below the operating system that hides certain memory locations and makes other memory locations available to a process.

21. A computer system as in claim 16, wherein:

the processing logic comprises at least one central processing unit (CPU);

the isolation is a hardware physical device isolation, and the isolated source and isolated receiver are physically incapable of executing any otherwise executable instruction including instructions contained in the data coming into the isolated source or the isolated receiver from the source, from the receiver, or from the processing logic; and

the source and receiver are storage locations and the isolation is accomplished using an address control procedure that includes exerting a level of control within the computer below the application program level and below the operating system that hides certain memory locations that are to be protected and makes other memory locations available to a process.