System and method for implementing content and network security inside a chip

• US 8,869,270 B2
• Filed: 03/11/2009
• Issued: 10/21/2014
• Est. Priority Date: 03/26/2008
• Status: Active Grant

• Current Assignee: CUPP Computing AS
• Original Assignee: CUPP Computing AS
• Inventors: Touboul, Shlomo
• Primary Examiner(s): Kim, Jung
• Assistant Examiner(s): Stoica, Adrian
• Application Number:
  US12/402,443
• Publication Number:
  US 20090249465A1
• Time in Patent Office: 2,050 Days
• Field of Search: None
• US Class Current: 726/22
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 2221/034 Test or assess a computer or a system
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

Systems and methods for implementing content, streaming, and network security inside a chip or inside a computing device are disclosed. In exemplary embodiments, a system comprises a communication chip and a second processor. The communication chip comprises a router and security instructions. The router is configured to intercept untrusted data between a network, and a first router. The second processor is configured to receive the untrusted data from the router, process the untrusted data with the security instructions to produce trusted data, and provide the trusted data to the router.

Claims

1. A system, comprising:

at least one chip configured to be installed in a mobile device, the at least one chip comprising;

an intercepting device configured to intercept untrusted data from an untrusted portion of a network, the intercepting occurring before execution by a mobile device processor of the mobile device;

a security engine configured to provide security instructions operative to implement a security policy, the security instructions for providing internet gateway security for the mobile device, the internet gateway security including a firewall for the mobile device, the firewall for providing in accordance with the security policy pre-runtime security protection from malicious code in the untrusted data; and

a dedicated security system processor dedicated to security functions and configured to execute the security engine, thereby enabling the security engine to receive the untrusted data from the intercepting device, to evaluate the untrusted data for violations of the security policy to identify trusted data from the untrusted data in accordance with the security policy, and to provide the trusted data to the intercepting device for transmission to the mobile device processor for execution.

2. The system of claim 1, wherein the security instructions comprise an operating system stored in a preboot memory of the at least one chip.

3. The system of claim 1, wherein the security instructions are stored in a protected memory of the at least one chip.

4. The system of claim 1, wherein the security instructions are loaded into RAM of the mobile device.

5. A system, comprising:

a mobile device comprising;

an internal bus;

a mobile device processor communicatively coupled to the internal bus;

a memory module communicatively coupled to the internal bus;

a storage module communicatively coupled to the internal bus;

a communication module communicatively coupled to the internal bus;

an intercepting device configured to intercept untrusted data from an untrusted portion of a network, and from the memory module, the storage module, or the communication module, the intercepting occurring before execution of the untrusted data by the first mobile device processor;

a security engine configured to provide security instructions operative to implement a security policy, the security instructions for providing internet gateway security for the mobile device, the internet gateway security including a firewall for the mobile device, the firewall for providing in accordance with the security policy pre-runtime security protection from malicious code in the untrusted data; and

a dedicated security system processor dedicated to security functions and configured to;

execute the security engine, thereby enabling the security engine to receive the untrusted data from the intercepting device, to evaluate the untrusted data for violations of the security policy to identify trusted data from the untrusted data in accordance with the security policy, and to provide the trusted data to the router intercepting device for transmission to the first mobile device processor for execution.

6. The system of claim 5, wherein the security instructions comprise an operating system stored in a preboot memory of the mobile device.

7. The system of claim 5, wherein the security instructions are stored in a protected portion of the memory module or a protected portion of the storage module.

8. The system of claim 5, wherein the security instructions are loaded into RAM of the memory module within the mobile device.

9. The system of claim 5, wherein the mobile device is within a USB memory device.

10. A system, comprising:

a flash memory device comprising;

flash memory media;

an intercepting device configured to intercept untrusted data from an untrusted portion of a network, the intercepting occurring before execution by a mobile device processor of a mobile device;

a security engine configured to provide security instructions operative to implement a security policy, the security instructions for providing internet gateway security for the mobile device, the mobile internet gateway security including a firewall for the mobile device, the firewall for providing in accordance with the security policy pre-runtime security protection from malicious code in the untrusted data; and

a dedicated security system processor dedicated to security functions and configured to execute the security engine, thereby enabling the security engine to;

receive the untrusted data from the intercepting device, to evaluate the untrusted data for violations of the security policy to identify trusted data from the untrusted data in accordance with the security policy, and to provide the trusted data to the intercepting device for transmission to the mobile device processor for execution.

11. The system of claim 10, wherein the security instructions comprise an operating system stored in a preboot memory of the flash memory device.

12. The system of claim 10, wherein the security instructions are stored in a protected portion of the flash memory media.

13. The system of claim 10, wherein the security instructions are loaded into RAM of the flash memory device.

14. The system of claim 10, wherein the flash memory device is within a USB memory device.

15. A method, comprising:

storing security instructions operative to implement a security policy, the security instructions providing internet gateway security for a mobile device, the internet gateway security including a firewall for the mobile device, the firewall for providing in accordance with the security policy pre-runtime security protection from malicious code in untrusted data, the untrusted data from an untrusted portion of a network;

loading the security instructions into a memory;

executing the security instructions with a dedicated security system processor dedicated to security functions;

intercepting, with an intercepting device in a communication chip, the untrusted data before execution by a mobile device processor of the mobile device;

routing the untrusted data from the intercepting device to the dedicated security system processor;

evaluating the untrusted data for violations of the security policy with the dedicated security system processor executing the security instructions to identify trusted data from the untrusted data in accordance with the security policy; and

providing the trusted data from the dedicated security system processor to the intercepting device for transmission to the first mobile device processor for execution.

16. The method of claim 15, wherein the security instructions comprise an operating system stored in a preboot portion of the memory.

17. The method of claim 15, wherein the security instructions are stored in a protected portion of the memory.

18. The method of claim 15, wherein the memory comprises RAM of a digital device.

19. The method of claim 15, wherein the communication chip is within a network interface card.

20. A method, comprising:

storing security instructions operative to implement a security policy, the security instructions providing internet gateway security for a mobile device, the internet gateway security including a firewall for the mobile device, the firewall for providing in accordance with the security policypre-runtime security protection from malicious code in untrusted data, the untrusted data from an untrusted portion of a network;

loading the security instructions into a memory;

executing the security instructions with a dedicated security system processor dedicated to security functions;

intercepting, with an intercepting device contained in a flash memory device, the untrusted data before execution by a mobile device processor of the mobile device;

routing the untrusted data from the intercepting device to the dedicated security system processor;

evaluating the untrusted data for violations of the security policy with the dedicated security system processor executing the security instructions to identify trusted data from the untrusted data in accordance with the security policy; and

providing the trusted data from the dedicated security system processor to the intercepting device for transmission to the mobile device processor for execution.

21. The method of claim 20, wherein the security instructions comprise an operating system stored in a preboot memory of the flash memory device.

22. The method of claim 20, wherein the security instructions are stored in a protected portion of flash memory media of the flash media device.

23. The method of claim 20, wherein the security instructions are loaded into RAM of the flash memory device.

24. The method of claim 20, wherein the flash memory device is within a USB memory device.

25. A non-transitory computer readable medium configured to store instructions in a communication chip, the instructions executable by a dedicated security system processor to perform a method, the dedicated security system processor dedicated to security functions, and the method comprising:

before execution by a mobile device processor of a communication chip coupled to a mobile device, intercepting, using an intercepting device, untrusted data from an untrusted portion of a network;

routing the untrusted data to the dedicated security system processor;

evaluating the untrusted data with the dedicated security system processor executing security instructions operative to implement a security policy, the security instructions providing internet gateway security for the mobile device, the internet gateway security including a firewall for the mobile device, the firewall for providing in accordance with the security policy pre-runtime security protection from malicious code in the untrusted data, the security instructions checking for violations of the security policy, and the security instructions operative to identify trusted data from the untrusted data in accordance with the security policy; and

providing the trusted data from the dedicated security system processor to the mobile device processor for execution.

26. A non-transitory computer readable medium configured to store instructions in a flash memory device, the instructions executable by a dedicated security system processor to perform a method, the method comprising:

before execution by a mobile device processor of flash memory media of a flash memory device coupled to a mobile device, intercepting, using an intercepting device, untrusted data from an untrusted portion of a network;

routing the untrusted data to the dedicated security system processor;

evaluating the untrusted data with the dedicated security system processor executing security instructions operative to implement a security policy, the security instructions providing internet gateway security for the mobile device, the internet gateway security including a firewall for the mobile device, the firewall for providing in accordance with the security policy pre-runtime security protection from malicious code in the untrusted data, the security instructions checking for violations of the security policy, and the security instructions operative to identify trusted data from the untrusted data in accordance with the security policy; and

providing the trusted data from the dedicated security system processor to the mobile device processor for execution.