Processes and systems for secured information exchange using computer hardware

• US 6,487,664 B1
• Filed: 11/24/1998
• Issued: 11/26/2002
• Est. Priority Date: 11/24/1998
• Status: Expired due to Term

• Current Assignee: Galactican Group
• Original Assignee: E-Com Defense, Inc.
• Inventors: Kellum, Charles W.
• Primary Examiner(s): Hayes, Gail
• Assistant Examiner(s): TRUVAN, LEYNNA THANH
• Application Number:
  US09/198,411
• Time in Patent Office: 1,463 Days
• Field of Search: 713/200, 713/201, 713/160, 713/156, 713/188, 713/176, 713/154, 713/165
• US Class Current: 726/22
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/145 the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms

Abstract

A system and method for providing external data-signal isolation, and signal-level information-preserving-data-transformations, to enable safe, operationally efficient, information sharing between protected information systems and networks and external, potentially hostile, information systems and networks which neutralizes any imbedded hostile executable codes such as viruses that may be in data-signals incoming from the external systems and networks. The system and method prevent untransformed external data-signals from entering protected systems and/or networks using an intermediate screen which is a computer hardware device. The intermediate screen is deployed between the protected systems and external systems and is used to process all incoming signals from the external system to obtain transformed data sets from which information is extracted before it is passed to the protected system.

Claims

1. A method of enabling information exchange between a protected system and an external information source wherein the information is contained in an initial data set carried by a signal while preventing any hostile data carried by the signal and which is executable in a first format of the signal from reaching the protected system in an executable format, including the steps of:

a. using an intermediate domain computer hardware device to receive the signal containing the initial data set transmitted from the external information source;

b. processing, within the intermediate domain computer hardware device, the signal by containing the initial data set within the intermediate domain computer hardware device and transforming the first format of the signal into a different second format to thereby form a second data set containing the information and such that the hostile data is not executable in the second format; and

c. thereafter passing the second data set to the protected system whereby any hostile data included in the signal is transformed from an executable state to a non-executable state in the second format.

2. The method of claim 1 wherein the processing step includes selecting an internal data set from the protected system that is to be updated by the information in the initial data set, transferring the internal data set to the intermediate domain computer hardware device from the protected system and thereafter processing the internal data set within the intermediate domain computer hardware device with the information in the second data set, and thereafter passing the processed internal data to the protected system to create processed internal data.

3. The method of claim 2 including the additional step of filtering the selected internal data set for authorized transfer to the intermediate domain computer hardware device.

4. The method of claim 1 wherein the processing step includes buffering the signal containing the initial data set and any hostile executable data in the intermediate domain computer hardware device.

5. The method of claim 1 in which the first and second formats are selected from a group of formats consisting of analogue, digital including wherein digital₁≠

digital₂, printer, telephone, video, optical, facsimile, text, font, EBCIBIC and ASCII and electro-magnetic and electro-optic signals.

6. The method of claim 5 including the additional step of screening internal data sets being transmitted from the protected system to an external system through the intermediate domain computer hardware device such that only authorized data sets enter the intermediate domain computer hardware device from the protected system.

7. The method of claim 1 including connecting the intermediate domain computer hardware device to an internal bus of a computer system operating as the protected system.

8. A system for enabling information exchange between a protected system and an external information source wherein the information is contained in an initial data set carried by a signal while preventing any hostile data carried by the signal and which is executable in a first format of the signal from reaching the protected system in an executable format, the system including:

a) means for connecting an intermediate domain computer hardware device between the external information source and the protected system to receive the signal containing the initial data set from the external source;

b) signal processing means within the intermediate domain computer hardware device, for processing the signal containing the initial data set by confining the initial data set within the intermediate domain computer hardware device and to transform the first format of the signal into a different second format by forming a second data set containing the information and such that any hostile data is not executable in the second format; and

c) means for passing the second data set to the protected system whereby any hostile data included in the signal is transformed from an executable state to a non-executable state in the second format.

9. The system of claim 8 in which said means for passing includes a first socket element for receiving the second data set and for conveying the second data set to the protected system.

10. The system of claim 9 including a second socket element for connecting the protected system to the signal processing means whereby information from the protected system may be selectively transferred to the signal processing means.

11. The system of claim 10 including means for filtering information to be transmitted through said second socket element to thereby prevent unauthorized release of information from the protected system.

12. The system of claim 8 wherein said intermediate domain computer hardware device is selected from a group of computer hardware devices consisting of single board computers, modified single board computers, embedded microprocessors, embedded microcontrollers, personal computers, webtv units, portable/laptop computer systems, mainframe computers and network computer systems.

13. The system of claim 8 including authorization screening means for identifying the protected system for authorized access to the intermediate domain computer hardware device.

14. The system of claim 8 including verifying means connected to said intermediate domain computer hardware device for verifying the transformation of the signal in the first format to the second format.

15. The system of claim 8 in which said signal processing means includes means for converting a telephone signal format to a video signal format.

16. The system of claim 8 in which said signal processing means includes means for converting a telephone signal format to a printed format.

17. The system of claim 16 including means for converting the printed format to an analog or digital signal to be passed to the protected system.

18. The system of claim 8 in which said means for connecting, said signal processing means and means for passing are mounted to a bus of the protected system.

19. The system of claim 18 including a plurality of intermediate domain computer hardware devices.

20. The system of claim 8 including a plurality of intermediate domain computer hardware devices, and means for identifying authorized intermediate domain computer hardware devices in a network of such devices.

21. The system of claim 20 wherein the means for identifying includes a DIN authentication capability.

22. A method of enabling secure information exchange between a protected system and an external information source on the internet wherein the information is contained in an initial data set carried by a signal while preventing any hostile data carried by the signal and which is executable in a first format of the signal from reaching the protected system in an executable format, including the steps of;

a. using an intermediate domain computer hardware device between the external information source on the internet and the protected system to receive the signal containing the initial data set transmitted from the external information source;

b. processing, within the intermediate domain computer hardware device, the signal containing the initial data set by containing the initial data set within the intermediate domain computer hardware device and transforming the first format of the signal into a different second format to thereby form a second data set containing the information and such that any hostile data which is executable within the initial data set is not executable in the second format;

c. thereafter, passing the second data set to the protected system whereby any hostile data included in the signal is transformed from an executable state to a non-executable state in the second format.

23. The method of claim 22 including selecting the intermediate domain computer hardware device from a group of computer hardware devices consisting of single board computers, modified single board computers, embedded microprocessors, embedded microcontrollers, personal computers, webtv units, portable/laptop computer systems, mainframe computers and network computer systems.

24. The method of claim 22 in which the first and second formats are selected from a group of formats consisting of analogue, digital including wherein digital₁≠

digital₂;

printed, telephone, video, optical, facsimile, text, font, EBCIBIC and ASCII and electromagnetic and electro-optic signals.