Method of using one or more secure private networks to actively configure the hardware of a computer or microchip

• US 8,429,735 B2
• Filed: 02/16/2012
• Issued: 04/23/2013
• Est. Priority Date: 01/26/2010
• Status: Active Grant

• Current Assignee: Frampton E. Ellis
• Original Assignee: Frampton E. Ellis
• Inventors: Ellis, Frampton E.
• Primary Examiner(s): SIMITOSKI, MICHAEL J
• Application Number:
  US13/398,403
• Publication Number:
  US 20120311690A1
• Time in Patent Office: 432 Days
• Field of Search: 726/11, 726/22, 726/30, 713/194
• US Class Current: 726/11
• CPC Class Codes: G06F 11/2043 where the redundant components share a common memory address space
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/71 to assure secure computing or processing of information
• CPC Class Codes: G06F 21/85 interconnection devices, e.g. bus-connected or in-line devices
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones

Abstract

A method for a computer or microchip with one or more inner hardware-based access barriers or firewalls that establish one or more private units disconnected from a public unit or units having connection to the public Internet and one or more of the private units have a connection to one or more non-Internet-connected private networks for private network control of the configuration of the computer or microchip using active hardware configuration, including field programmable gate arrays (FPGA). The hardware-based access barriers include a single out-only bus and/or another in-only bus with a single on/off switch.

Claims

1. A method of securely controlling computer, including a computer on a microchip, said computer being configured to operate as a general purpose computer connected to the Internet, said computer comprising:

at least one network connection configured for connection to at least a public network of computers including the Internet, said at least one network connection being located in at least one public unit of said computer,

at least one additional and separate private network connection configured for connection to at least a separate, private network of computers, said at least one additional and separate private network connection being located in at least one protected private unit of said computer, and

at least one inner hardware-based access barrier or inner hardware-based firewall that is located between and communicatively connects said at least one protected private unit of said computer and said at least one public unit of said computer;

wherein said private and public units and said two separate network connections are separated by said at least one inner hardware-based access barrier or inner hardware-based firewall;

said at least one protected private unit of the computer includes at least a first microprocessor or core or processing unit,

said at least one public unit of the computer includes at least a second microprocessor or core or processing unit, configured to operate as a general purpose microprocessor or core or processing unit, and

said second microprocessor or core or processing unit is separate from said inner hardware-based access barrier or inner hardware-based firewall; and

at least a part of said computer is configured using active hardware configuration; and

said method comprising the steps of;

controlling at least a part of said active hardware configuration of said computer from said private network of computers, said controlling step including at least transmitting data and/or code from said private network of computers to said separate private network connection in said protected private unit of said computer;

receiving said data and/or code by said first microprocessor or core or processing unit in said protected private unit of said computer; and

transmitting data and/or code by said first microprocessor or core or processing unit in said protected private unit to at least a part of said computer to configure at least a part of said computer using said active hardware configuration of said computer.

2. The method of claim 1, wherein said computer further comprises at least one microchip that is configurable using at least one field programmable gate array (FPGA);

and said method further comprising the steps of;

controlling at least a part of FPGA configuration of said FPGA configurable microchip from said private network of computers, said controlling step including at least transmitting data and/or code from said private network of computers to said separate private network connection in said protected private unit of said computer;

receiving said data and/or code by said first microprocessor or core or processing unit in said protected private unit of said computer; and

transmitting data and/or code by said first microprocessor or core or processing unit in said protected private unit to at least a part of said FPGA configurable microchip to configure at least a part of said microchip using said at least one FPGA.

3. The method of claim 2, wherein said FPGA configurable microchip further comprises:

at least a separate, second inner hardware-based access barrier or inner hardware-based firewall that protects at least a separate, second private network connection configured for connection to at least a separate, second private network of computers, said at least a second private network connection being located in at least a second protected private unit of said FPGA configurable microchip; and

said second protected private unit of the FPGA configurable microchip includes at least a third microprocessor or core or processing unit; and

said method further comprising the steps of;

controlling at least a part of said FPGA configuration of said FPGA configurable microchip from said second private network of computers, said controlling step including at least transmitting data and/or code from said second private network of computers to said second private network connection in said second protected private unit of said FPGA configurable microchip; and

receiving said data and/or code in at least a part of said second protected private unit of said FPGA configurable microchip from said second private network of computers, said part of said second protected private unit including at least said third microprocessor or core or processing unit; and

transmitting data and/or code by said third microprocessor or core or processing unit to at least a part of said FPGA configurable microchip to configure at least a part of said FPGA configurable microchip using said at least one FPGA.

4. The method of claim 3, wherein said FPGA configurable microchip further comprises:

at least a separate, third inner hardware-based access barrier or inner hardware-based firewall that protects at least a separate, third private network connection configured for connection to at least a separate, third private network of computers, said at least a third private network connection being located in at least a third protected private unit of said FPGA configurable microchip; and

said third protected private unit of the FPGA configurable microchip includes at least a fourth microprocessor or core or processing unit; and

said method further comprising the steps of;

controlling at least a part of said FPGA configuration of said FPGA configurable microchip from said third private network of computers, said controlling step including at least transmitting data and/or code from said third private network of computers to said third private network connection in said third protected private unit of said FPGA configurable microchip; and

receiving said data and/or code in at least a part of said third protected private unit of said FPGA configurable microchip from said third private network of computers, said part of said third protected private unit including at least said fourth microprocessor or core or processing unit; and

transmitting data and/or code by said fourth microprocessor or core or processing unit to at least a part of said FPGA configurable microchip to configure at least a part of said FPGA configurable microchip using said at least one FPGA.

5. The method of claim 2, wherein:

said inner hardware-based access barrier or inner hardware-based firewall is configured in a manner such that the at least one protected private unit and the at least one public unit are connected by at least one out-only bus or channel that transmits data and/or code that is output from the at least one protected private unit to be input to the at least one public unit; and

said method further comprises the step of;

transmitting data and/or code by said first microprocessor or core or processing unit in said protected private unit through said out-only bus or channel to at least a part of said public unit to configure at least a part of said computer using said active hardware configuration of said computer.

6. The method of claim 5, wherein:

said inner hardware-based access barrier or inner hardware-based firewall is configured in a manner such that the at least one protected private unit and the at least one public unit are also connected by at least one in-only bus or channel that includes a hardware input on/off switch; and

said method further comprising the step of;

receiving data and/or code from said public unit part through said in-only bus or channel at said first microprocessor or core or processing unit.

7. The method of claim 1, wherein said computer further comprises:

at least a separate, second inner hardware-based access barrier or inner hardware-based firewall that protects at least a separate, second private network connection configured for connection to at least a separate, second private network of computers, said at least a second private network connection being located in at least a second protected private unit of said computer; and

said second protected private unit of the computer includes at least a third microprocessor or core or processing unit; and

said method further comprising the steps of;

controlling at least a part of said active hardware configuration of said computer from said second private network of computers, said controlling step including at least transmitting data and/or code from said second private network of computers to said second private network connection in said second protected private unit of said computer; and

receiving said data and/or code in at least a part of said second protected private unit of said computer from said second private network of computers, said part of said second protected private unit including at least said third microprocessor or core or processing unit; and

transmitting data and/or code by said third microprocessor or core or processing unit to at least a part of said computer to configure at least a part of said computer using said active hardware configuration of said computer.

8. The method of claim 7, wherein said computer further comprises:

at least a separate, third inner hardware-based access barrier or inner hardware-based firewall that protects at least a separate, third private network connection configured for connection to at least a separate, third private network of computers, said at least a third private network connection being located in at least a third protected private unit of said computer; and

said third protected private unit of the computer includes at least a fourth microprocessor or core or processing unit; and

said method further comprising the steps of;

controlling at least a part of said active hardware configuration of said computer from said third private network of computers, said controlling step including at least transmitting data and/or code from said third private network of computers to said third private network connection in said third protected private unit of said computer; and

receiving said data and/or code in at least a part of said third protected private unit of said computer from said third private network of computers, said part of said third protected private unit including at least said fourth microprocessor or core or processing unit; and

transmitting data and/or code by said fourth microprocessor or core or processing unit to at least a part of said computer to configure at least a part of said computer using said active hardware configuration of said computer.

9. The method of claim 1, wherein:

said inner hardware-based access barrier or inner hardware-based firewall is configured in a manner such that the at least one protected private unit and the at least one public unit are connected by at least one out-only bus or channel that transmits data and/or code that is output from the at least one protected private unit to be input to the at least one public unit; and

said method further comprising the step of;

transmitting data and/or code by said first microprocessor or core or processing unit in said protected private unit through said out-only bus or channel to at least a part of said public unit to configure at least a part of said computer using said active hardware configuration of said computer.

10. The method of claim 9, wherein:

said inner hardware-based access barrier or inner hardware-based firewall is configured in a manner such that the at least one protected private unit and the at least one public unit are also connected by at least one in-only bus or channel that includes a hardware input on/off switch; and

said method further comprising the step of;

receiving data and/or code from said public unit part through said in-only bus or channel at said first microprocessor or core or processing unit.

11. The method of claim 1, wherein said computer further comprises:

at least a separate, second inner hardware-based access barrier or inner hardware-based firewall that protects at least a second protected private unit of said computer;

said second protected private unit of the computer includes at least a master controlling device or central controller of said computer; and

said method further comprising the step of;

controlling by said master controlling device or central controller on a peremptory basis one or more parts of said computer, said master controlling device or central controller being controlled by a user of said computer.

12. The method of claim 11, wherein said method further comprises the step of:

controlling by said master controlling device or central controller on a peremptory basis all parts of said computer, said master controlling device or central controller being controlled by a user of said computer.

13. The method of claim 11, wherein said wherein said controlling step controls on a peremptory basis said one or more parts of said computer using a secure control bus.

14. The method of claim 1, wherein said computer includes at least 2 or 3 or 4 or 6 or 8 or 16 or 32 or 64 or 128 or 256 or 512 or 1024 microprocessors located in the public unit, each said microprocessor protected by a separate hardware-based inner access barrier or inner firewall.

15. A method of securely controlling a computer, including a computer on a microchip, said computer being configured for connection to the Internet, said computer comprising:

at least one network connection configured for connection to at least a public network of computers including the Internet, said at least one network connection being located in at least one public unit of said computer,

at least one additional and separate private network connection configured for connection to at least a separate, private network of computers, said at least one additional and separate private network connection being located in at least one protected private unit of said computer, and

at least one inner hardware-based access barrier or inner hardware-based firewall that is located between and communicatively connects said at least one protected private unit of said computer and said at least one public unit of said computer;

wherein said private and public units and said two separate network connections are separated by said at least one inner hardware-based access barrier or inner hardware-based firewall;

said at least one protected private unit of the computer includes at least a first microprocessor or core or processing unit,

said at least one public unit of the computer includes at least a second microprocessor or core or processing unit; and

said second microprocessor or core or processing unit is separate from said inner hardware-based access barrier or inner hardware-based firewall; and

at least a part of said computer is configured using active hardware configuration; and

said method comprising the steps of;

controlling at least a part of said active hardware configuration of said computer from said private network of computers, said controlling step including at least transmitting data and/or code from said private network of computers to said separate private network connection in said protected private unit of said computer;

receiving said data and/or code by said first microprocessor or core or processing unit in said protected private unit of said computer; and

transmitting data and/or code by said first microprocessor or core or processing unit in said protected private unit to at least a part of said computer to configure at least a part of said computer using said active hardware configuration of said computer.

16. The method of claim 15, wherein said computer further comprises at least one microchip that is configurable using at least one field programmable gate array (FPGA);

and said method further comprising the steps of;

controlling at least a part of FPGA configuration of said FPGA configurable microchip from said private network of computers, said controlling step including at least transmitting data and/or code from said private network of computers to said separate private network connection in said protected private unit of said computer;

receiving said data and/or code by said first microprocessor or core or processing unit in said protected private unit of said computer; and

transmitting data and/or code by said first microprocessor or core or processing unit in said protected private unit to at least a part of said FPGA configurable microchip to configure at least a part of said FPGA configurable microchip using said at least one FPGA.

17. The method of claim 16, wherein said FPGA configurable microchip further comprises:

at least a separate, second inner hardware-based access barrier or inner hardware-based firewall that protects at least a separate, second private network connection configured for connection to at least a separate, second private network of computers, said at least a second private network connection being located in at least a second protected private unit of said FPGA configurable microchip;

said second protected private unit of the FPGA configurable microchip includes at least a third microprocessor or core or processing unit; and

said method further comprising the steps of;

controlling at least a part of said FPGA configuration of said FPGA configurable microchip from said second private network of computers, said controlling step including at least transmitting data and/or code from said second private network of computers to said second private network connection in said second protected private unit of said FPGA configurable microchip; and

receiving said data and/or code in at least a part of said second protected private unit of said FPGA configurable microchip from said second private network of computers, said part of said second protected private unit including at least said third microprocessor or core or processing unit; and

transmitting data and/or code by said third microprocessor or core or processing unit to at least a part of said FPGA configurable microchip to configure at least a part of said FPGA configurable microchip using said at least one FPGA.

18. The method of claim 16, wherein said FPGA configurable microchip further comprises:

at least a separate, third inner hardware-based access barrier or inner hardware-based firewall that protects at least a separate, third private network connection configured for connection to at least a separate, third private network of computers, said at least a third private network connection being located in at least a third protected private unit of said FPGA configurable microchip;

said third protected private unit of the FPGA configurable microchip includes at least a fourth microprocessor or core or processing unit; and

said method further comprising the steps of;

controlling at least a part of said FPGA configuration of said FPGA configurable microchip from said third private network of computers, said controlling step including at least transmitting data and/or code from said third private network of computers to said third private network connection in said third protected private unit of said FPGA configurable microchip; and

receiving said data and/or code in at least a part of said third protected private unit of said FPGA configurable microchip from said third private network of computers, said part of said third protected private unit including at least said fourth microprocessor or core or processing unit; and

transmitting data and/or code by said fourth microprocessor or core or processing unit to at least a part of said FPGA configurable microchip to configure at least a part of said FPGA configurable microchip using said at least one FPGA.

19. The method of claim 16:

said inner hardware-based access barrier or inner hardware-based firewall is configured in a manner such that the at least one protected private unit and the at least one public unit are connected by at least one out-only bus or channel that transmits data and/or code that is output from the at least one protected private unit to be input to the at least one public unit; and

said method further comprising the step of;

transmitting data and/or code by said first microprocessor or core or processing unit in said protected private unit through said out-only bus or channel to at least a part of said public unit to configure at least a part of said computer using said active hardware configuration of said computer.

20. The method of claim 19:

said inner hardware-based access barrier or inner hardware-based firewall is configured in a manner such that the at least one protected private unit and the at least one public unit are also connected by at least one in-only bus or channel that includes a hardware input on/off switch; and

said method further comprising the step of;

receiving data and/or code from said public unit part through said in-only bus or channel to at said first microprocessor or core or processing unit.

21. The method of claim 15, wherein said computer further comprises:

at least a separate, second inner hardware-based access barrier or inner hardware-based firewall that protects at least a separate, second private network connection configured for connection to at least a separate, second private network of computers, said at least a second private network connection being located in at least a second protected private unit of said computer; and

said second protected private unit of the computer includes at least a third microprocessor or core or processing unit; and

said method further comprising the steps of;

controlling at least a part of said active hardware configuration of said computer from said second private network of computers, said controlling step including at least transmitting data and/or code from said second private network of computers to said second private network connection in said second protected private unit of said computer; and

receiving said data and/or code in at least a part of said second protected private unit of said computer from said second private network of computers, said part of said second protected private unit including at least said third microprocessor or core or processing unit; and

transmitting data and/or code by said third microprocessor or core or processing unit to at least a part of said computer to configure at least a part of said computer using said active hardware configuration of said computer.

22. The method of claim 15, wherein said computer further comprises:

at least a separate, third inner hardware-based access barrier or inner hardware-based firewall that protects at least a separate, third private network connection configured for connection to at least a separate, third private network of computers, said at least a third private network connection being located in at least a third protected private unit of said computer;

said third protected private unit of the computer includes at least a fourth microprocessor or core or processing unit,

said method further comprising the steps of;

controlling at least a part of said active hardware configuration of said computer from said third private network of computers, said controlling step including at least transmitting data and/or code from said third private network of computers to said third private network connection in said third protected private unit of said computer; and

receiving said data and/or code in at least a part of said third protected private unit of said computer from said third private network of computers, said part of said third protected private unit including at least said fourth microprocessor or core or processing unit; and

transmitting data and/or code by said fourth microprocessor or core or processing unit to at least a part of said computer to configure at least a part of said computer using said active hardware configuration of said computer.

23. The method of claim 15, wherein:

said inner hardware-based access barrier or inner hardware-based firewall is configured in a manner such that the at least one protected private unit and the at least one public unit are connected by at least one out-only bus or channel that transmits data and/or code that is output from the at least one protected private unit to be input to the at least one public unit; and

said method further comprising the step of;

transmitting data and/or code by said first microprocessor or core or processing unit in said protected private unit through said out-only bus or channel to at least a part of said public unit to configure at least a part of said computer using said active hardware configuration of said computer.

24. The method of claim 23, wherein:

said inner hardware-based access barrier or inner hardware-based firewall is configured in a manner such that the at least one protected private unit and the at least one public unit are also connected by at least one in-only bus or channel that includes a hardware input on/off switch; and

said method further comprises the step of;

receiving data and/or code from said public unit part through said in-only bus or channel to at said first microprocessor or core or processing unit.

25. The method of claim 15, wherein said computer further comprises:

at least a separate, second inner hardware-based access barrier or inner hardware-based firewall that protects at least a second protected private unit of said computer;

said second protected private unit of the computer includes at least a master controlling device or central controller of said computer; and

said method further comprising the step of;

controlling by said master controlling device or central controller on a peremptory basis one or more parts of said computer, said master controlling device or central controller being controlled by a user of said computer.

26. The method of claim 25, wherein said method further comprises the step of:

controlling by said master controlling device or central controller on a peremptory basis all parts of said computer, said master controlling device or central controller being controlled by a user of said computer.

27. The method of claim 25, wherein said wherein said controlling step controls on a peremptory basis said one or more parts of said computer using a secure control bus.

28. The method of claim 15, wherein said computer includes at least 2 or 3 or 4 or 6 or 8 or 16 or 32 or 64 or 128 or 256 or 512 or 1024 microprocessors located in the public unit, each said microprocessor protected by a separate hardware-based inner access barrier or inner firewall.

29. A method of securely controlling a computer, including a computer on a microchip, said computer is configured to operate as a general purpose computer connected to the Internet, said computer comprising:

at least one network connection configured for connection to at least a public network of computers including the Internet, said at least one network connection being located in at least one public unit of said computer,

at least one additional and separate private network connection configured for connection to at least a separate, private network of computers, said at least one additional and separate private network connection being located in at least one protected private unit of said computer, and

at least one inner hardware-based access barrier or inner hardware-based firewall that is located between and communicatively connects said at least one protected private unit of said computer and said at least one public unit of said computer;

wherein said private and public units and said two separate network connections are separated by said at least one inner hardware-based access barrier or inner hardware-based firewall;

said at least one protected private unit of the computer includes at least a first microprocessor or core or processing unit,

said at least one public unit of the computer includes at least a second microprocessor or core or processing unit, configured to operate as a general purpose microprocessor or core or processing unit;

said second microprocessor or core or processing unit is separate from said inner hardware-based access barrier or inner hardware-based firewall;

at least a separate, second inner hardware-based access barrier or inner hardware-based firewall that protects at least a second protected private unit of said computer;

said second protected private unit of the computer includes at least a master controlling device or central controller of said computer; and

said method comprising the steps of;

controlling at least one operation of said computer from said private network of computers, said operation including at least transmitting data and/or code from said private network of computers to said separate private network connection in said protected private unit of said computer;

receiving said data and/or code by said first microprocessor or core or processing unit in said protected private unit of said computer;

transmitting data and/or code by said first microprocessor or core or processing unit in said protected private unit to at least a part of said public unit; and

controlling by said master controlling device or central controller on a peremptory basis one or more parts of said computer, said master controlling device or central controller being controlled by a user of said computer.

30. The method of claim 29, wherein said computer further is configured using at least active hardware configuration, and said method further comprising the step of:

controlling by said master controlling device or central controller on a peremptory basis at least a part of said active hardware configuration of said computer.

31. The method of claim 29, wherein said computer further comprises at least one microchip that is configurable using at least one field programmable gate array (FPGA);

and said method further comprising the step of;

controlling by said master controlling device or central controller on a peremptory basis at least a part of said FPGA configurable microchip configured using at least one FPGA.

32. The method of claim 29, wherein said method further comprises the step of:

controlling by said master controlling device or central controller on a peremptory basis all parts of said computer.

33. The method of claim 29, wherein said controlling step controls on a peremptory basis one or more parts of said computer using a secure control bus.

34. The method of claim 29, wherein said computer includes at least 2 or 3 or 4 or 6 or 8 or 16 or 32 or 64 or 128 or 256 or 512 or 1024 microprocessors located in the public unit, each said microprocessor protected by a separate hardware-based inner access barrier or inner firewall.

35. A method of securely controlling a computer, including a computer on a microchip, said computer is configured for connection to the Internet, said computer comprising:

at least one network connection configured for connection to at least a public network of computers including the Internet, said at least one network connection being located in at least one public unit of said computer,

at least one additional and separate private network connection configured for connection to at least a separate, private network of computers, said at least one additional and separate private network connection being located in at least one protected private unit of said computer, and

at least one inner hardware-based access barrier or inner hardware-based firewall that is located between and communicatively connects said at least one protected private unit of said computer and said at least one public unit of said computer;

wherein said private and public units and said two separate network connections are separated by said at least one inner hardware-based access barrier or inner hardware-based firewall;

said at least one protected private unit of the computer includes at least a first microprocessor or core or processing unit,

said at least one public unit of the computer includes at least a second microprocessor or core or processing unit;

said second microprocessor or core or processing unit is separate from said inner hardware-based access barrier or inner hardware-based firewall;

at least a separate, second inner hardware-based access barrier or inner hardware-based firewall that protects at least a second protected private unit of said computer; and

said second protected private unit of the computer includes at least a master controlling device or central controller of said computer, and

said method comprising the steps of;

controlling at least one operation of said computer from said private network of computers, said operation including at least transmitting data and/or code from said private network of computers to said separate private network connection in said protected private unit of said computer;

receiving said data and/or code by said first microprocessor or core or processing unit in said protected private unit of said computer;

transmitting data and/or code by said first microprocessor or core or processing unit in said protected private unit to at least a part of said public unit; and

controlling by said master controlling device or central controller on a peremptory basis one or more parts of said computer, said master controlling device or central controller being controlled by a user of said computer.

36. The method of claim 35, wherein said computer further is configured using at least active hardware configuration, and said method further comprising the step of:

controlling by said master controlling device or central controller on a peremptory basis at least a part of said active hardware configuration of said computer.

37. The method of claim 35, wherein said computer further comprises at least one microchip that is configurable using at least one field programmable gate array (FPGA);

and said method further comprising the step of;

controlling by said master controlling device or central controller on a peremptory basis at least a part of said FPGA configurable microchip configured using at least one FPGA.

38. The method of claim 35, wherein said method further comprises the step of:

controlling by said master controlling device or central controller on a peremptory basis all parts of said computer.

39. The method of claim 35, wherein said controlling step controls on a peremptory basis one or more parts of said computer using a secure control bus.

40. The method of claim 35, wherein said computer includes at least 2 or 3 or 4 or 6 or 8 or 16 or 32 or 64 or 128 or 256 or 512 or 1024 microprocessors located in the public unit, each said microprocessor protected by a separate hardware-based inner access barrier or inner firewall.