Information security method and apparatus

• US 5,969,632 A
• Filed: 11/22/1996
• Issued: 10/19/1999
• Est. Priority Date: 11/22/1996
• Status: Expired due to Fees

• Current Assignee: Voltaire Advanced Data Security Limited (NVIDIA Corporation)
• Original Assignee: Voltaire Advanced Data Security Limited (NVIDIA Corporation)
• Inventors: Prescher, Amir, Diamant, Erez
• Primary Examiner(s): Holloway, III, Edwin C.
• Application Number:
  US08/754,871
• Time in Patent Office: 1,061 Days
• Field of Search: 340/825.32, 340/825.31, 340/825.34, 395/186, 395/187.01, 395/700, 380/49, 380/25, 713/200, 713/201, 711/163, 708/135, 709/229
• US Class Current: 340/5.3
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 21/554 involving event detection and direct action
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: G06F 21/80 in storage media based on magnetic or optical technology, e.g. disks with sectors preventing unauthorised reproduction or copying of disc-type recordable media G11B20/00
• CPC Class Codes: G06F 21/83 input devices, e.g. keyboards, mice or controllers thereof
• CPC Class Codes: G06F 21/84 output devices, e.g. displays or monitors
• CPC Class Codes: G06F 2207/7219 Countermeasures against side channel or fault attacks
• CPC Class Codes: G06F 2211/1097 Boot, Start, Initialise, Power
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

Communication apparatus including a public network, a secured network, a plurality of public nodes connected to the public network and a plurality of secured nodes connected to the secured network and to the public network. The nodes including interfaces for communicating therebetween over the networks, wherein each the secured node includes a communication controller a computer system and a secured storage area. A secured node divides a confidential message into at least two segments and transmits the segments via the networks wherein at least a selected one of the segments is transmitted via at least one of the secured networks. The communication controller is also operative to disconnect the secured storage area from the computer station and the public network when the communication between the computer station and the public network is in progress.

Claims

1. A device for protecting secured areas in a computer system, the device comprising:

a communication interface for connecting to a network;

a secured device interface for connecting to a secured area;

a managing controller connected to said communication interface and between said secured device interface and said computer system,

wherein said managing controller detects independently of a request message by a user of said computer system whether said communication between said computer system and said network is in progress,

wherein said managing controller connects said computer system with said secured device interface whether said communication is not in progress, and

wherein said managing controller disconnects said computer system from said secured device interface whether said communication is in progress.

2. A device according to claim 1 wherein said secured device interface is selected from the group consisting of:

a communication interface;

an input-output data interface;

a human interface; and

an electromechanical device interface.

3. A device according to claim 1 wherein said secured device interface includes a modem.

4. A device according to claim 1 wherein said secured device interface includes an input-output data interface and wherein said device further comprises a storage unit connected to said input-output data interface,

said storage unit storing secured information.

5. A device according to claim 4 wherein said storage unit is selected from the group consisting of:

a random access memory;

a read only memory;

a hard disk drive;

an EPROM;

an EEPROM;

a FLASH memory unit;

an optical storage unit; and

an electro-optical storage unit.

6. A device according to claim 1 further comprising:

a first wireless transceiver connected to said managing controller; and

a remote unit,

said remote unit comprising a second transceiver and a processor, connected thereto, said processor controlling said second transceiver,

said first transceiver enabling said managing controller to connect said computer station with said secured area interface when detecting a predetermined transmission,

said remote unit transmitting said predetermined signal via said second transceiver.

7. A method for protecting a secured area in a computer system which is connected to a network, the computer system including a secured area, the method comprising the steps of:

A. detecting independently of a request message by a user of said computer system the communication status between said computer system and said network, if said communication status is on-line, proceeding to step B, otherwise enabling access to said secured area,

B. monitoring all incoming data access requests and detecting if access is requested to said secured area, if so, proceeding to step C, otherwise proceeding to step D;

C. executing an alert procedure;

D. detecting independently of a request message by a user of said computer system the communication status between said computer system and said network, if on-line, proceeding back to step B, otherwise proceeding to step E; and

E. proceeding back to step A.

8. A method according to claim 7 wherein said alert procedure is selected from the group consisting of:

denying access to said secured area;

providing an alert signal to a user operating said computer system; and

providing access to an alternative area.

9. A method for protecting a secured area in a computer system which is connected to a network, the computer system including a secured area and a public storage area, the method comprising the steps of:

A. detecting independently of a request message by user of said computer system the communication status between said computer system and said network, if on-line, proceeding to step B, otherwise enabling access to said secured area;

B. monitoring all incoming data access requests and detecting if access is requested to said secured area, if so, proceeding to step C, otherwise proceeding to step D;

C. executing an alert procedure;

D. detecting independently of a request message by a user of said computer system the communication status between said computer system and said network, if on-line, proceeding back to step B, otherwise proceeding to step E;

E. analyzing data contained in said storage area so as to detect harmful software therein, if such harmful software is detected, proceeding to step F, otherwise enabling access to said secured area and proceeding to step A; and

F. executing an alert software.

10. A method according to claim 9 wherein said step B further comprises generating at least one log entry representing said access request before proceeding to step D, and

wherein said analyzing, in step E, is performed according to said at least one log entry.

11. A method according to claim 9 wherein said alert procedure is selected from the group consisting of:

halting selected activities said computer system;

denying access to said secured area;

providing an alert signal to a user operating said computer system; and

providing access to an alternative area.