Computer system having data store protected from internet contamination by virus or malicious code and method for protecting

• US 7,100,075 B2
• Filed: 02/11/2002
• Issued: 08/29/2006
• Est. Priority Date: 05/19/2000
• Status: Active Grant

• Current Assignee: Vir2us, Inc.
• Original Assignee: Self Repairing Computers Incorporated
• Inventors: More, Anthony B., Largman, Kenneth, Blair, Jeffrey
• Primary Examiner(s): Beausoliel, Robert
• Assistant Examiner(s): Manoskey, Joseph D
• Application Number:
  US10/074,686
• Publication Number:
  US 20020194533A1
• Time in Patent Office: 1,660 Days
• Field of Search: 714/2, 714/7, 714/13, 714/19, 714/20, 714/23, 714/38, 713/200
• US Class Current: 714/13
• CPC Class Codes: G06F 11/1417 Boot up procedures
• CPC Class Codes: G06F 11/1451 by selection of backup contents
• CPC Class Codes: G06F 11/1456 Hardware arrangements for backup
• CPC Class Codes: G06F 11/1469 Backup restoration techniques
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system

Abstract

The invention may back up or recover a computing device. The computing device may include a user computing environment and a supporting environment which stabilizes and functionality of the user computing environment. The invention may include one or more external devices or removable media.

Claims

1. A computer system comprising:

a processor;

a memory coupled to the processor;

at least one non-volatile data store including a first data store and a second data store;

a data port;

a communication device for communicating over a communications link to an external device over the Internet; and

at least one of a (i) data store switch and (ii) a communications device switch, the data-store switch when present having a switch state and being operative to modify the accessibility of at least one of the first and second data stores according to an access status of said communications device, and the communications device switch when present being operative to modify the accessibility of said communications device by said computer including by said at least one data store according to the access status of said communications device;

the computer being operable to execute an Internet browser application program; and

the processor programmatically recognizing the intended launch or actual launch of the Internet browser and controlling the state of the data-store switch to make the second data store the only accessible data store when data is received from the Internet over the communications link.

2. A computer system according to claim 1, wherein the at least one non-volatile data store comprises first and second data stores and said data-store switch for modifying the accessibility of at least one of the first and second data stores by the computer.

3. A computer system according to claim 2, wherein the data port is operative to mediate and selectively link the computer to other devices over the communications link.

4. A computer system according to claim 3, wherein the computer is operable in:

(i) a connected state wherein the computer may use the data port to obtain data from another device over the communications link and the data-store switch may enable the second data store, and in (ii) a disconnected state wherein the computer may not use the data port to obtain data from another device over the communications link and the data-store switch may enable the first data store, so that the computer may enable only one of the first and second data stores at any given time and the data store enabled depending upon whether the computer is accessing the communications link or not accessing the communications link, and data received over the communications link being isolated only to the second data store.

5. A computer system according to claim 4, wherein if the data received over the communications link included a virus, hacking, or other malicious executable code, then the virus, hacking, or other malicious executable code is confined to the second data store.

6. A computer system according to claim 4, wherein the connected state comprises a network connected state and the disconnected state comprises a network disconnected state.

7. A computer system according to claim 2, wherein the switching of the first and second data stores may be done under manual, hardware or software control;

under manual control, a user controlling the state of the data-store switch; and

under software control, the data store switch responds programmatically to a processor in the computer to control the accessibility of the first and second data store according to the connected or disconnected state of the computer.

8. A computer system according to claim 2, wherein the computer synchronously switches the data port and the second data store so that the first data store is never accessible when the data port is active, thereby improving the resistance of the computer to viral infection and hacking.

9. A computer system according to claim 2, wherein the computer further comprises a communications device enabling switch for enabling and disabling access by the computer to the communications device.

10. A computer system according to claim 9, wherein the enabling and disabling access is accomplished by one of powering up or down the communications device and altering a state of a data line on a communications bus coupling the communications device to the computer to alter the ability of the communications device to transfer data to a data port of the computer.

11. A computer system according to claim 10, wherein the communications device operated in conjunction with the communications link is selected from the set of communications devices consisting of an acoustic modem, a POTS telephone line, a tap, an Ethernet, a wireless modem, and radiation-permeable space.

12. A computer system comprising:

a processor;

a memory coupled to the processor;

at least one non-volatile data store;

a data port;

a communication device for communicating over a communications link to an external device; and

at least one of a (i) data store switch and (ii) a communications device switch, the data-store switch operative to modify the accessibility of at least one data store according to an access status of said communications device, and the communications device switch operative to modify the accessibility of said communications device by said computer including by said at least one data store according to the access status of said communications device;

the at least one non-volatile data store comprises first and second data stores and said data-store switch is for modifying the accessibility of at least one of the first and second data stores by the computer;

the switching of the first and second data stores may be done under manual, hardware or software control;

under manual control, a user controlling the state of the data-store switch; and

under software control, the data store switch responds Programmatically to the processor in the computer to control the accessibility of the first and second data store according to the connected or disconnected state of the computer; and

the computer is operable to execute an Internet browser application program, the communications link comprises a communications link to the Internet, and the processor programmatically recognizes the intended or actual launch of the Internet browser and controls a state of the data-store switch to make the second data store the only accessible data store when data is received from the Internet over the communications link.

13. A computer system comprising:

a processor;

a memory coupled to the processor;

at least one non-volatile data store;

a data port;

a communication device for communicating over a communications link to an external device; and

at least one of a (i) data store switch and (ii) a communications device switch, the data-store switch operative to modify the accessibility of at least one data store according to an access status of said communications device, and the communications device switch operative to modify the accessibility of said communications device by said computer including by said at least one data store according to the access status of said communications device;

the at least one non-volatile data store comprises first and second data stores and said data-store switch for modifying the accessibility of at least one of the first and second data stores by the computer;

the data port is operative to mediate and selectively link the computer to other devices over the communications link;

the computer is operable in;

(i) a connected state wherein the computer may use the data port to receive data from another device over the communications link and the data-store switch may enable the second data store, and in (ii) a disconnected state wherein the computer may not use the data port to receive data from another device over the communications link and the data-store switch may enable the first data store, so that the computer may enable only one of the first and second data stores at any given time and the data store enabled depending upon whether the computer is accessing the communications link or not accessing the communications link, and data received over the communications link being isolated only to the second data store; and

an Internet browser application program stored on the second data store launches automatically when the computer boots from the second data store.

14. A computer system according to claim 13, wherein operating the data store switch between from the connected state and the disconnected state optionally includes re-booting the computer in order to make the selected one of the first and second data store the only data store available in the selected state.

15. A computer system according to claim 13, wherein only the second data store is available during operation in the connected state.

16. A computer system according to claim 13, wherein only the first data store is available during operation in the disconnected state.

17. A computer system according to claim 13, wherein both the first data store and the second data store are available during operation in the disconnected state.

18. A computer system comprising:

a processor;

a memory coupled to the processor;

at least one non-volatile data store;

a data port;

a communication device for communicating over a communications link to an external device; and

at least one of a (i) data store switch and (ii) a communications device switch, the data-store switch operative to modify the accessibility of at least one data store according to an access status of said communications device, and the communications device switch operative to modify the accessibility of said communications device by said computer including by said at least one data store according to the access status of said communications device;

the at least one non-volatile data store comprises first and second data stores and said data-store switch for modifying the accessibility of at least one of the first and second data stores by the computer;

the data port is operative to mediate and selectively link the computer to other devices over the communications link;

the computer is operable in;

(i) a connected state wherein the computer may use the data port to receive data from another device over the communications link and the data-store switch may enable the second data store, and in (ii) a disconnected state wherein the computer may not use the data port to receive data from another device over the communications link and the data-store switch may enable the first data store, so that the computer may enable only one of the first and second data stores at any given time and the data store enabled depending upon whether the computer is accessing the communications link or not accessing the communications link, and data received over the communications link being isolated only to the second data store; and

only the second data store is available during operation in the connected state; and

the second data store includes application program software to process the data received over the communications link so that there is no need to migrate the received data from the second data store to the first data store.

19. A computer system comprising:

a processor;

a memory coupled to the processor;

at least one non-volatile data store;

a data port;

a communication device for communicating over a communications link to an external device; and

at least one of a (i) data store switch and (ii) a communications device switch, the data-store switch operative to modify the accessibility of at least one data store according to an access status of said communications device, and the communications device switch operative to modify the accessibility of said communications device by said computer including by said at least one data store according to the access status of said communications device;

the at least one non-volatile data store comprises first and second data stores and said data-store switch for modifying the accessibility of at least one of the first and second data stores by the computer;

the data port is operative to mediate and selectively link the computer to other devices over the communications link;

the computer is operable in;

(i) a connected state wherein the computer may use the data port to receive data from another device over the communications link and the data-store switch may enable the second data store, and in (ii) a disconnected state wherein the computer may not use the data port to receive data from another device over the communications link and the data-store switch may enable the first data store, so that the computer may enable only one of the first and second data stores at any given time and the data store enabled depending upon whether the computer is accessing the communications link or not accessing the communications link, and data received over the communications link being isolated only to the second data store; and

only the second data store is available during operation in the connected state; and

the data received over the communications link and initially stored on the second data store is migrated to the first data store, and the procedure for migrating includes executing an anti-virus software before performing a copy operation between simultaneously enabled first and second data stores.

20. A computer system according to claim 19, wherein the migration includes a predetermined time delay to obtain and execute newly prepared and distributed security software addressing threats that have come to light since the time of receipt of the data over the communications link that is stored on the second data store and the copying of data from the second data store to the first data store.

21. In a computer system of the type having a processor, a memory coupled to the processor, at least one non-volatile data store including at least one of a first data store and a second data store, a data port, and a communication device for communicating over a communications link to an external device on the Internet;

a method of operating the computer system to protect the system degradation by from viral, hacker, and other malicious code contamination, the method comprising;

providing at least one of a (i) data store switch having a switch state, and (ii) a communications device switch; and

;

(i) when the data-store switch is provided, operating the computer system to modify the accessibility of at least one of the first and second data stores according to an access status of said communications device; and

(ii) when the communications device switch is provided, operating the computer system to modify the accessibility of said communications device by said computer including by said at least one data store according to the access status of said communications device;

operating the computer system to execute an Internet browser application program within the processor;

programmatically recognizing the intended or actual launch of the Internet browser by the processor; and

controlling the state of the data-store switch to make the second data store the only accessible data store when data is received from the external device on the Internet over the communications link.

22. A method according to claim 21, wherein:

the Internet browser application program is stored on the second data store and launches automatically when the computer boots from the second data store.

23. A method according to claim 21, wherein:

the second data store includes application program software to process the data received over the communications link without migrating the received data from the second data store to the first data store.

24. A method according to claim 21, wherein:

the data received over the communications link is initially stored on the second data store and is then migrated to the first data store using a procedure for migrating that includes executing an anti-virus software before performing a copy operation between first and second data stores.