Patent Application
20070006320
1. Field of the Invention
The present invention relates to the field of information processing systems. In one aspect, the present invention relates to a system and method for ensuring a secure computing environment for computer systems used to communicate over the Internet.
2. Description of the Related Art
Computer systems have attained widespread use for providing information management capability to many segments of today's society. A personal computer system can usually be defined as a microcomputer that includes a system unit having a system processor and associated volatile and non-volatile memory, a display monitor, a keyboard, a fixed disk storage device, an optional removable storage device and an optional printer. These personal computer systems are information processing systems which are designed primarily to give independent computing power to a single user (or a group of users in the case of personal computers which serve as computer server systems) and are inexpensively priced for purchase by individuals or small businesses.
In recent years, there has been significant growth in the use of the personal computers to exchange information over the Internet. This exchange of information is based on a client/server model with the user's personal computer operating as the client to access data stored on a plurality of Internet servers. Some Internet service providers provide a computer to a user as part of a contractual relationship to provide Internet service. As part of the relationship, the Internet service provider may occasionally need to provide software packages to the computer relating to software upgrades and software that provides additional services. In addition, users may also attempt to download computer programs from the Internet or to install programs locally from sources that may not be secure.
Consequently, there is a need for a safeguard process that prevents users from installing unauthorized software that may adversely affect the operation of the computer and/or interfere with authorized software provided by the Internet service provider. In addition, a significant need exists for preserving the integrity of the operating system and the applications stored on computers, such as those used as personal Internet communicators (PICs) over a communication network provided by an Internet service provider. Further limitations and disadvantages of conventional systems will become apparent to one of skill in the art after reviewing the remainder of the present application with reference to the drawings and detailed description which follow.
The method and apparatus of the present invention provides a reliable and secure computing environment for a personal Internet communicator. In one embodiment, the present invention can be used to restrict the installation of operating system and/or software code on the personal Internet communicator by storing a key in the non-volatile storage of the personal Internet communicator, such as the master boot record, and requiring any bootable device to have a matching signature or key in order to be eligible to have operating system files or application files written.
The objects, advantages and other novel features of the present invention will be apparent to those skilled in the art from the following detailed description when read in conjunction with the appended claims and accompanying drawings.
While illustrative embodiments of the present invention are described below, it will be appreciated that the present invention may be practiced without the specified details, and that numerous implementation-specific decisions may be made to the invention described herein to achieve the developer's specific goals, such as compliance with system-related and business-related constraints, which will vary from one implementation to another. While such a development effort might be complex and time-consuming, it would nevertheless be a routine undertaking for those of ordinary skill in the art having the benefit of this disclosure. For example, selected aspects are shown in block diagram form, rather than in detail, in order to avoid obscuring or unduly limiting the present invention. Such descriptions and representations are used by those skilled in the art to describe and convey the substance of their work to others skilled in the art. The present invention will now be described with reference to the drawings described below.
Referring to
The PIC 110 includes communication hardware and software that allows the PIC 110 to send and receive communications to and from the Internet service provider 120. The communications hardware and software allows the PIC 110 to establish a communication link with the Internet service provider 120. The communication link may be any of a variety of connection types including a wired connection, a direct link such as a digital subscriber line (DSL), T1, integrated services digital network (ISDN) or cable connection, a wireless connection via a cellular or satellite network, phone modem dialup access or a local data transport system, such as Ethernet or token ring over a local area network.
When the customer enters a request for information by entering commands in the Web browser, the PIC 110 sends a request for information, such as a search for documents pertaining to a specified topic, or a specific Web page to the Internet service provider 120 which in turn forwards the request to an appropriate Web host server 150 via the Internet 140. The Internet service provider 120 executes software for receiving and reading requests sent from the browser. The Internet service provider 120 executes a Web server application program that monitors requests, services requests for the information on that particular Web server, and transmits the information to the user's PIC 110.
Each Web host server 150, 151, 152 on the Internet has a known address that the user supplies to the Web browser to connect to the appropriate Web host server. If the information is not available on the user's Web host server 150, the Internet 140 serves as a central link that allows Web servers 150, 151, 152 to communicate with one another to supply the requested information. Because Web servers 150, 151, 152 can contain more than one Web page, the user will also specify in the address which particular Web page he wants to view. The address, also known as a universal resource locator (URL), of a home page on a server is a series of numbers that indicate the server and the location of the page on the server, analogous to a post office address. For simplicity, a domain name system was developed that allows users to specify servers and documents using names instead of numbers. A URL may further specify a particular page in a group of pages belonging to a content provider by including additional information at the end of a domain name.
Referring to
As illustrated in
Various programming codes and software are stored in the PIC memory. For example, the basic input/output system (BIOS) code that starts the PIC 110 at startup may be stored in a BIOS ROM device 210 of the non-volatile storage 207, such as a ROM (Read Only Memory) or a PROM (Programmable ROM) such as an EPROM (Erasable PROM), an EEPROM (Electrically Erasable PROM), a flash RAM (Random Access Memory) or any other type of memory appropriate for storing BIOS. The BIOS/Bootloader 210 is essentially invisible to the user and includes a compatible bootloader to enable the PIC operating system to be an embedded closed operating system, such as a Windows CE type operating system, though any operating system (including but not limited to Windows-based and Linux-based Operating Systems) could be supported by the BIOS code. The BIOS/Bootloader 210 is essentially invisible to the user and boots to the operating system.
PIC software 230 and user data may also be stored on the hard drive 209 of the non-volatile storage 207 and executed and/or processed by processor 202. The PIC software 230 may include a master boot record (MBR) 231, an operating system 232, an application program partition 233, a software update module 234, user data 235, and a hidden image recovery module 236. The MBR 231 is a small program that is executed when the PIC 110 boots up, and typically resides on the first sector of the hard disk 209. In addition, the MBR 209 may contain a table of partitions on the disk. As for the operating system, several uniquely configurable operating parameters that can affect the performance of the system are pre-configured as part of the software 230 when it is initially installed on the drive 209. The software 230 also includes application programs 233 that are needed for the PIC 110 to function as specified. For example, the applications 233 may include web browser, Flash player, presentation viewer for PowerPoint, chat, game, compression utility, e-mail, word processor, spreadsheet, PDF viewer, media player and/or drawing applications. In addition, the user data 235 stores all of the user's data so that a user has direct access to the user data. This user data is protected from the rest of the operating system to prevent corruption of the data by a virus or other means.
In a selected embodiment, the PIC 110 is protected against unauthorized installations by configuring the PIC software 230 so that applications are added or updated only from boot loader devices that have a predetermined authorization or security key. An example of such a boot loader device is a USB-connected flash storage device. In an example implementation, the installation restriction is controlled by the software update module 234 which only allows installations from boot devices having a key that matches a locally stored installation key, such as a unique security key 240 that is stored in the non-volatile memory 207. The unique security key 240 may be unique for each PIC 110, 111, 112, or may instead shared among the PICS to collectively control installation access from a single source (e.g., ISP 120). In a selected embodiment, the unique security key 240 is stored in the master boot record 231 of the hard drive 209, although it may also be stored in the flash memory or other ROM 208 or on a hardwired integrated circuit. Thus, before any operating system files or application files are transferred from the bootable device, the update module 234 must determine that the boot device has a signature or key that matches or otherwise corresponds to the unique security key 240. In this way, the unique security key 240 can be used to protect the integrity of the operating system on the PIC 110 by restricting installation of operating system code or other software to bootable devices that have a matching security key.
Referring to
Referring to
To protect system integrity of the operating system and other applications, the PIC 110 is designed to limit the installation of additional software. For example, the PIC 110 may optionally be designed so that there is no floppy disk or CD-ROM drive included or supported, which would be the normal method for installing software and device driver packages. System integrity is further protected by disabling the USB keyboard and mouse until the operating system is loaded, making it very difficult to install anything even the PIC 110 could be booted from a different source. In addition, software installation may be disabled on the operating system and applications installed as part of the PIC software 230, except through use of the software update module 234 which disables software load or boot activity from any USB device that does not have an authorized signature key that matches the unique security key 240.
Each time the user or OS wants to launch an application or load a library (DLL) from an external storage device 508, the kernel component 504 checks with the OAL component 502 to confirm that the application or module should be launched. A key check routine 501 in the OAL component 502 confirms launch if an authorization key associated with the application or module matches a locally stored security key. The key check routine 501 can be accomplished in a variety of ways. For example, Windows CE provides a certification mechanism that can be leveraged to protect the PIC 110 by implementing security measures to prevent the OS from loading unknown modules, to restrict access to system application programming interfaces (APIs) and/or to prevent write access to parts of the system registry. In the course of certifying applications, a module can be designated as trusted or not trusted, and the kernel component 504 can use this information to prevent unauthorized applications from loading or to limit their access to the system. For example, before the kernel component 504 loads an application, a certification function in the OAL component 502 verifies the application signature, such as by comparing the application signature to the locally stored security key. With this approach, a Windows CE-based run-time images loads an application only if it contains a valid digital signature.
In addition, the integrity of the operating system may also be protected by including a limited set of BIOS firmware instructions to limit the installation of unauthorized operating systems. At system turn on, the limited BIOS firmware looks for an installation key, such as a unique security key 240, in the hard drive 209 or any other boot device (e.g., a USB-connected flash storage device or CD-ROM). If the installation key is not present, then system turn on is aborted, but if the installation key is present, then system turn on proceeds. In this way, the hard drive 209 is protected against replacing the original operating system (e.g., Windows CE) with any unauthorized operating systems (e.g., Linux).
Turning now to
As a preliminary step 602, a security key is stored in the non-volatile memory of a computer system (e.g., PIC 110) to be protected. When an installation event occurs at step 604 (e.g., during system startup when a bootable device attempts to write operating system files to the hard drive), the security key is retrieved from the non-volatile memory (step 606). In addition, an authorization key is requested from the boot device (step 608). Though depicted as occurring in parallel, the key retrieval steps may instead occur in sequence.
Once the security key and authorization key are obtained, they are compared at step 610. If the keys do not match (negative outcome to decision 610), then the requested installation is denied and the system reverts back to step 604 to detect the next installation event. At this point, the next boot device in the list may be checked for a key and the process is restarted, but if no key is found on any boot device in the list, then the system halts and appears hung to the user. However, if the keys match (affirmative outcome to decision 610), then the requested installation is approved (step 614) and the system reverts back to step 604 to detect the next installation event. As will be appreciated, the foregoing steps may be implemented as part of the software update module or as part of the BIOS code.
The particular embodiments disclosed above are illustrative only and should not be taken as limitations upon the present invention, as the invention may be modified and practiced in different but equivalent manners apparent to those skilled in the art having the benefit of the teachings herein. Accordingly, the foregoing description is not intended to limit the invention to the particular form set forth, but on the contrary, is intended to cover such alternatives, modifications and equivalents as may be included within the spirit and scope of the invention as defined by the appended claims so that those skilled in the art should understand that they can make various changes, substitutions and alterations without departing from the spirit and scope of the invention in its broadest form.
