Hacking-Resistant Computer Design

• US 20200134170A1
• Filed: 05/15/2019
• Published: 04/30/2020
• Est. Priority Date: 08/31/2015
• Status: Active Grant

• Current Assignee: Pathguard Incorporated
• Original Assignee: Pathguard LLC
• Inventors: Newman, Frank N., Newman, Dan
• Granted Patent: US 11,030,301 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 12/1433 for a module or a part of a module
• CPC Class Codes: G06F 12/1441 for a range
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/79 in semiconductor storage media, e.g. directly-addressable memories
• CPC Class Codes: G06F 2212/1052 Security improvement
• CPC Class Codes: G06F 2221/031 Protect user input by software means
• CPC Class Codes: G06F 2221/032 Protect output to user by software means
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: G06F 3/0619 in relation to data integrity, e.g. data losses, bit errors
• CPC Class Codes: G06F 3/0644 Management of space entities, e.g. partitions, extents, pools
• CPC Class Codes: G06F 3/0659 Command handling arrangements, e.g. command buffers, queues, command scheduling
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A computer architecture is disclosed for implementing a hacking-resistant computing device. The computing device, which could be a mainframe computer, personal computer, smartphone, or any other computing device suitable for network communication, comprises a first partition and a second partition. The second partition can communicate over a network such as the Internet. In contrast, the first partition cannot connect to the Internet, and can directly communicate only with the second partition or with input/output devices directly connected to the first partition. Further, the first partition segments its memory addressing for program code and hardware-protects it from alteration. The second partition is hardware-limited from reading or writing to the memory addressing of the first partition. As a result, the critical data files and program code stored on the first partition are protected from malicious code affecting the second partition.

Claims

1. A computer system comprising:

a first partition and a second partition;

the first partition comprising;

a first CPU; and

a first memory module comprising;

a first memory unit comprising at least one memory address range for program code, wherein the program code comprises computer-executable code, and wherein the at least one memory address range for program code is configured by hardware circuitry; and

a second memory unit comprising at least one memory address range for other data, wherein the other data comprises data read from the second partition;

wherein the first CPU is hardware-configured to execute only the computer-executable code in the memory address range for program code; and

the second partition comprising;

a second CPU;

a second memory module; and

at least one communication module configured to couple to a network;

wherein the first CPU is configured to access the second memory module and read data from the second partition into only the at least one memory address range for other data; and

wherein the second CPU is restricted from accessing the first memory module.

2. The computer system of claim 1, wherein the hardware circuitry comprises at least one field-programmable gate array.

3. The computer system of claim 1, wherein the hardware circuitry comprises at least one field-programmable gate array.