Patent Application
20150235031
The invention relates to portable desktops, and more particularly to the recognition and configuration of hardware on the host of the portable desktop.
A portable desktop allows a user to utilize the hardware of a host computer system and thus provides a portable computing environment. A portable desktop may be physically embodied in portable storage media and more often is embodied in a portable device which includes processing hardware, storage, and input/output (I/O) hardware for communication with the host system and/or authentication by a user. The portable computing environment, hereinafter referred to as the portable desktop, is portable in the sense that any changes made to data files, software, settings, user preferences, or any other configuration or aspect of that computing environment made during a session on the host computer system, which are intended to be permanent, are stored in the portable device such that the portable desktop has continuity across multiple sessions. The appearance, functionality, content and/or configuration of the portable desktop should also be independent of any changes made to any particular host computer system as well as be independent of the particular host computer system used for any session. Portability, therefore, depends upon the ability of the portable desktop device to function with as many different host computer systems as possible independent of the software, operating system (O/S), or particular hardware possessed by the host computer system.
Depending upon the use of the portable desktop device, different considerations become more or less important in its configuration and capability. Individual users who use their portable desktop for functionality and data which are not sensitive nor give rise to security concerns will be more interested in broad compatibility with multiple systems at the expense of security. In the case of portable desktop devices which are deployed amongst members of an organization and if the functionality and/or data to be possessed by the portable desktop devices is particularly sensitive and/or must meet certain security protocols, it may be preferable that the portable desktop device be secure at the expense of compatibility with multiple systems.
Considerations for both portability and security are important in determining how a portable desktop device is to function with the hardware environment of its host computer system. Known approaches in addressing the needs of individuals and organizations utilizing portable desktop devices have merely offered a range of options falling within a portability versus security spectrum consistent with the idea that in order to have one of portability or security one must do so at the expense of the other.
One known approach falling at the security end of the spectrum limits the portable desktop device to function on identical systems only. The portable desktop device is configured such that it will only function with a host computer system having a computer configuration identical to a particular pre-defined computer configuration. This approach allows an administrator of an organization possessing sensitive data and/or programs to control exactly what kind of systems the portable desktop device will work with. Such an approach may also use some sort of system authentication to determine in addition to a kind of computer configuration, the identity of the host computer system in order to prevent the portable desktop device from functioning on any system which is not within the control of the administrator. This approach would be recommended for defense or law enforcement organizations. Unfortunately, although control and security are maintained, this renders the portable desktop device extremely limited in its portability.
Another known approach closer to the portability end of the spectrum restricts operation of hardware devices on the host computer system such that only standard devices may operate in the hardware environment supporting the portable desktop device during operation. According to such an approach, the portable desktop O/S loads standard configuration and drivers and only devices supporting these are operable and only in accordance with the standard functions of those devices. In this approach, although the portable desktop device would generally be portable across computer systems having standard driver compatible hardware, security risks associated with the operation of the hardware devices depend upon the security of the hardware devices themselves and the standard drivers being used therewith. The functionality and usefulness of the portable desktop will also be inherently limited to the standard functionality supported by the standard drivers and as such, any specialized hardware will be limited to rudimentary functioning or may not function at all.
Another known approach leaves both considerations of portability and security to the user by allowing a local operating system of the host computer system to execute the portable desktop. The security of the portable desktop is then only as secure as the local operating system its hardware and device drivers, rendering the portable desktop unsuitable for any applications requiring more security than the host computer system. As such a user of this kind of portable desktop device must know the security level of the local operating system and hardware and drivers of the host computer system or must be prepared to take the risk of using the portable desktop device in an unknown host computer system.
It would be advantageous for there to be a method or system for portable desktops that enhances portability and/or security and overcomes some limitations of known portable desktop approaches.
According to one aspect, the invention provides for a method of host computer system hardware recognition and configuration for a portable desktop device connected to the host computer system, the method comprising: on a first boot of the host computer system from the portable desktop device: recognizing at least one hardware device connected to the host computer system; configuring at least one hardware configuration file of a portable desktop O/S of the portable desktop device in accordance with the recognized hardware devices; and rebooting the host computer system; on a second boot of the host computer system from the portable desktop device: starting up the portable desktop O/S using the configured at least one hardware configuration file.
According to another aspect, the invention provides for a portable desktop device comprising: I/O hardware for coupling the portable desktop device to a host computer system, the host computer system connected to at least one hardware device; memory storage comprising: a portable desktop storage block comprising a portable desktop O/S; and a boot process block for execution by the host computer system, and on a first boot of the host computer system from the portable desktop device: a hardware recognition and configuration process block of the boot process block for causing the host computer system to: recognize the at least one hardware device connected to the host computer system; and configure at least one hardware configuration file of the portable desktop O/S in accordance with the recognized hardware devices, the boot process block for causing the host computer system to reboot itself once the host computer system has finished recognizing the at least one hardware device and configuring the at least one hardware configuration file, and on a second boot of the host computer system, the boot process block for causing the host computer system to initiate starting up the portable desktop O/S using the configured at least one hardware configuration file.
According to a further aspect, the invention provides for a method of host computer system hardware recognition and configuration for a portable desktop device coupled with the host computer system, the method comprising: on a first boot of the host computer system from the portable desktop device: recognizing at least one hardware device connected to the host computer system, copying at least one hardware configuration file to a portable desktop O/S of the portable desktop device in accordance with the recognized hardware devices, and rebooting the host computer system; and, on a second boot of the host computer system from the portable desktop device: starting up the portable desktop O/S using the copied at least one hardware configuration file.
According to yet another aspect, the invention provides for portable desktop device comprising: I/O hardware for coupling the portable desktop device to a host computer system, the host computer system connected to at least one hardware device; memory storage comprising: a portable desktop storage block comprising a portable desktop O/S; and a boot process block for execution by the host computer system, and on a first boot of the host computer system from the portable desktop device: a hardware recognition and configuration process block of the boot process block for causing the host computer system to: recognize the at least one hardware device connected to the host computer system; and copy at least one hardware configuration file to the portable desktop O/S in accordance with the recognized hardware devices, the boot process block for causing the host computer system to reboot itself once the host computer system has finished recognizing the at least one hardware device and copying the at least one hardware configuration file, and on a second boot of the host computer system, the boot process block for causing the host computer system to initiate starting up the portable desktop O/S using the copied at least one hardware configuration file.
In some embodiments, the invention provides for storing hardware configuration information for hardware devices of the host computer system during a first session of the portable desktop device with the host computer system which failed a hardware recognition and configuration process, identifying at a known system, hardware configuration files which support the hardware devices and updating the hardware recognition and configuration process of the portable desktop device therewith, whereby on a second session of the portable desktop device with the host computer system, the hardware recognition and configuration process succeeds.
The features and advantages of the invention will become more apparent from the following detailed description of the preferred embodiment(s) with reference to the attached figures, wherein:
It is noted that in the attached figures, like features bear similar labels.
Referring to
The portable desktop device 1000 is shown connected to its host computer system 1900. The host computer system 1900 is coupled to a number of hardware devices 1950. Some of the hardware devices 1950 are external to the host computer system 1900 while others are internal hardware devices. For the purposes of the invention, no distinction is made between an external or an internal hardware device, and as such hardware devices 1950 includes any and all hardware connected to and controlled by the host computer system 1900.
The host computer system 1900 is any computer system capable of interfacing with the portable desktop device 1000. The portable desktop device 1000 may be in the form of any peripheral device capable of interfacing with the host computer system 1900 and in some embodiments is a universal serial bus (USB) storage and processing device.
The portable desktop device 1000 is connected to the host computer system 1900 by input/output (I/O) hardware 1300. In addition to I/O hardware 1300, the portable desktop device 1000 comprises a processor 1100, authentication hardware 1400, and memory storage 1200. The processor 1100 is coupled to the I/O hardware 1300, the authentication hardware 1400, and the memory storage 1200. The authentication hardware 1400 may comprise biometric authentication hardware such as a fingerprint, retinal, or other scanner or may comprise some other input hardware for receiving a bar code, encryption key, combination, password or other authentication information.
The memory storage 1200 comprises a boot process 1220 application data storage block including application storage for a thin boot O/S 1224 in the form of a thin bootable client, including a security process 1224I and a previously configured flag 1224II. The boot process block 1220 also includes a hardware recognition and configuration process block 1226, which includes a devices and driver identification block 1226I and a hardware profiles block 1226II. Memory storage 1200 also comprises a portable desktop storage block 1240. The portable desktop storage block 1240 comprises a portable desktop O/S 1242 including hardware configuration block 1242I and a hardware drivers block 1242II. The portable desktop storage block 1240 also includes a storage block for the portable desktop user data 1244. The portable desktop O/S 1242 may include user data in the form of O/S preferences or configuration settings for a user. The portable desktop user data 1244 may include user installed applications which do not form part of the O/S along with preferences or configuration settings thereof, as well as any other data files associated with the portable desktop the user may have. In embodiments for which multiple users are supported, per user files, preferences or configuration settings are stored in the portable desktop O/S 1242 and multiple instances of portable desktop user data 1244, one for each user, are present in the portable desktop storage block 1240 (not shown). Optionally, in other embodiments, further portable desktop storage blocks are present in the memory storage 1200, each having its own portable desktop O/S and portable desktop user data blocks. This allows for further separation among users and/or groups of users, insuring not only that data and functions of each portable desktop environment are separated but that each user or group of users that can access one portable desktop environment have no knowledge of there being other users who use other desktop environments. A second portable desktop storage block 1250 is shown in dashed lines in
Referring also to
In most embodiments of the invention, in which the portable desktop device 1000 is a USB device, recognition and configuration of the hardware devices 1950 of the host computer system 1900 for use by the portable desktop device 1000 occurs when the host computer system 1900 is turned on and goes through a boot process while the portable desktop device 1000 is connected to the host computer system 1900. Prior to this, a main board or other booting hardware of the host computer system 1900 is configured to boot from the portable desktop device 1000 or is configured to boot from internal and external devices in an order such that when the portable desktop device 1000 is connected to the host computer system 1900 at the time the host computer system 1900 is turned on, the host computer system 1900 (HCS) will boot from the portable desktop device 1000 (PDD) as it does in step 200 of
In some embodiments, hot-plugging the portable desktop device 1000 will trigger the host computer system 1900 to detect the portable desktop device 1000 and prompt the user to confirm whether or not the system should be restarted in order to commence the portable desktop session.
During a boot of the host computer system 1900 from the portable desktop device 1000, the host computer system 1900 requests, through the I/O hardware 1300, a bootable process, for example the boot process 1220 within application data storage block of the memory storage 1200 and executes the bootable process.
Before responding with a bootable process, the processor on the portable desktop device checks the value of the previously configured flag 1224II (PCF) stored, for example, within the boot O/S 1224 of the boot process 1220 application data storage block as shown in step 205. In some embodiments the previously configured flag resides elsewhere within portable desktop device. If the previously configured flag 1224II has a value indicating that the portable desktop device 1000 has not been configured for the host computer system 1900 which it is connected to, the booting hardware of the host computer system 1900 will execute the boot process 1220. If the previously configured flag 1224II has a value indicating that the portable desktop device 1000 has been configured for the host computer system 1900 which it is connected to, the booting hardware of the host computer system 1900 will reset the previously configured flag 1224II as shown at step 265, and allow startup of the portable desktop as shown in step 270 and as described below.
The boot process 1220 is compatible with the booting hardware of the host computer system 1900. In some embodiments, the boot process 1220 is written in accordance with either the industry standards for IBM PC compatible machines or those of Apple Macintosh machines. In other embodiments, multiple boot processes are stored within the memory storage 1200, each of which is compatible with a different booting hardware industry standard, to allow operation of the portable desktop device 1000 with various kinds of host computer systems 1900. While executing the boot process 1220 the booting hardware of the host computer system 1900 executes the boot O/S 1224 which is typically a thin bootable but need not be thin.
After determining that the previously configured flag 1224II has a value indicating that the portable desktop device 1000 has not been configured, the booting hardware of the host computer system 1900 executes the boot process 1220 by proceeding to execute the security process 1224I. In embodiments in which the boot O/S 1224 includes the security process 1224I, the full functionality of the boot O/S 1224 is not enabled until the security process 1224I has authenticated use of the boot O/S 1224. Typically, authentication occurs before any data is provided from the portable desktop device to the host computer. In other embodiments the security process 1224I does not form part of the boot O/S 1224, but is instead a separate function within the boot process 1220 to authenticate use of the portable desktop device 1000.
When no data is provided from the portable desktop device to the host computer before authentication occurs, a user knows in advance that they must authenticate to the portable desktop device after power up. Alternatively, when the portable desktop device operates cooperatively with the host computer before authentication, then optionally while executing the security process 1224I, the booting hardware of the host computer system 1900 requests the user to provide user authentication information at step 210. Such a request may be displayed on a monitor connected to the host computer system 1900 which is accessible to the booting hardware in a very basic manner. The user may be requested to provide the user authentication information through the authentication hardware 1400, such as his or her fingerprint or retinal image. As described hereinabove other forms of user authentication information may be provided to the authentication hardware 1400, or provided directly to the host computer system 1900 through some other I/O device such as a keyboard and may comprise a password or code. The manner of requesting user authentication information and the performance of actual authentication of the user is determined by the security process 1224I and will depend on the requirements of the user of or deploying organization of the portable desktop device 1000.
In some embodiments, the security process 1224I executed by the booting hardware of the host computer system 1900 independently makes the request for authentication of the user but invokes the processor 1100 to perform the actual authentication of the user with use of the authentication hardware 1400. In some embodiments, the portable desktop device 1000 provides a connection (not shown) between the I/O hardware 1300 and the authentication hardware 1400 so that the booting hardware of the host computer system 1900 may access the authentication hardware 1400 without invoking the processor 1100. In other embodiments, the security process 1224I causes the booting hardware of the host computer system 1900 to simply invoke security processing by the processor 1100 and wait until the processor 1100 has notified the booting hardware of the host computer system 1900 that the authentication process has completed and whether or not authentication failed or succeeded.
Once user authentication by the security process 1224I has completed, the booting hardware of the host computer system 1900 commences hardware recognition and configuration process 1226 if the authentication was successful and ends the booting process if the authentication was not successful at step 215.
While executing the hardware recognition and configuration process 1226, the booting hardware of the host computer system 1900 performs hardware recognition at step 220 to determine the hardware configuration of the host computer system 1900, identifying all of hardware devices 1950 external and internal to the host computer system 1900 and optionally collecting other available information including for example the status, capability, and configuration of each hardware device of the hardware devices 1950. In some embodiments, the hardware recognition and configuration process 1226 causes the booting hardware to determine whether or not any network interface cards (NICs) are present within the hardware devices 1950, and moreover whether or not any present NICs are connected to any remote systems having a remote driver repository.
In some embodiments, the booting hardware of the host computer system 1900 compares the information gathered during hardware recognition or a code or checksum generated therefrom with similar information stored in a hardware profiles block 1226II at step 230. Alternatively, the hardware recognition and configuration process 1226 performed by the booting hardware of the host computer system 1900 is capable of identifying the host computer system 1900. The hardware profiles block 1226II stores hardware profiles defining previous successfully executed hardware configurations for the portable desktop, and is associated with a respective set of information, code, checksum, or system identification. If the information gathered, code, checksum, or identification during hardware recognition matches the equivalent information stored in the hardware profiles block 1226II, the booting hardware of the host computer system 1900 proceeds at step 240, in accordance with the associated hardware profile, to perform a same configuration of the files within the hardware configuration block 1242I of the portable desktop O/S 1242, as was performed in association with the previously successfully executed hardware configuration of the portable desktop.
The booting hardware of the host computer system 1900 proceeds then with hardware configuration at step 235 if no existing hardware profiles were found. For each hardware device found during hardware recognition, the booting hardware determines whether or not the hardware device is known, an identification of a proper driver for the hardware device, if known whether or not the hardware device or the device driver for the hardware device has any associated security concerns, whether or not the device driver is certified, whether or not the hardware device is unsupported, determining an availability of and identifying a location of the device driver, and creating or modifying files in and/or copying files to the portable desktop O/S 1242 as required.
Some of the files to be created or modified or copied by the booting hardware of the host computer system 1900 while executing the hardware recognition and configuration process 1226, are files residing in hardware configuration block 1242I of the portable desktop O/S 1242. Files in the hardware configuration block 1242I are created, modified, or copied to, in order to ensure that the correct device drivers are set within the startup files of the portable desktop operating system so that the portable desktop 1240 can run and utilize a subset of hardware devices of the hardware devices 1950 of the host computer system 1900. During the hardware recognition and configuration process 1226, the booting hardware of the host computer system 1900 makes the appropriate modifications or additions to files within the hardware configuration block 1242I to enable operation of drivers and devices which meet a set security threshold or specification of the portable desktop device 1000 and to disable operation of drivers and devices which fall below the security threshold or specification. As such, if the booting hardware executing the hardware recognition and configuration process 1226 determines that a hardware device is not known and if the security threshold or specification for the portable desktop device 1000 specifies that all unknown hardware is to be disabled, the files within the hardware configuration block 1242I are changed to ensure this. Likewise, depending upon the security threshold or specification of the portable desktop device 1000, the security concerns for each device or each device driver, whether or not the hardware device is unsupported, whether or not the device driver is certified, and whether or not the device driver is available and how it is available, may cause the device driver or the device to be enabled or disabled or optionally, restricted in use or operation during the portable desktop session.
In a case where it has been determined that the device driver is not located in the hardware drivers block 1242II, and it has been determined that a network interface card having a suitably secure connection to a remote driver repository forms part of the hardware configuration of the host computer system 1900, the booting hardware of the host computer system 1900 during the hardware recognition and configuration process 1226 may obtain the appropriate device driver from the remote repository as long as the security threshold or specification allows it. In this case, the newly obtained device driver is added by the booting hardware of the host computer system 1902 to the hardware drivers block 1242II of the portable desktop O/S 1242.
In some embodiments, and in accordance with the security threshold or specification for the portable desktop device 1000, the hardware configuration block 1242I is modified to ensure that all storage devices of the host computer system and in particular any hard drives of the host computer system are disabled during the portable desktop session. This prevents data from being stored locally on the host computer system, increasing security of the portable desktop and the information it holds, and eliminates the risk of loss of functionality due to changes to the portable desktop being recorded locally in the host computer system 1900 and subsequently being lost when the portable desktop is disconnected from the host computer system 1900.
Once configuration of the files of the hardware configuration block 1242I has been completed, or during the configuration thereof, the booting hardware of the host computer system 1900 checks the hardware configuration for minimal required functionality, according to a threshold stored with the security threshold or specification or in a functionality threshold or specification. This functionality threshold in general would be set to the minimum system requirements for operation of the portable desktop. If the booting hardware of the host computer system 1900 determines that the host computer system 1900 does not have the required hardware functionality, the hardware recognition and configuration process 1226 fails and the boot process 1220 would cease. This would occur, for example, if no interface devices were present within the host computer system 1900, and if the functionality threshold or specification of the portable desktop device 1000 required at least one interface device. The hardware configuration may also fail the functionality threshold if the devices and drivers are present, but due to security concerns, the devices and drivers for the required functionality are disabled. This could occur, for example, if the functionality threshold or specification of the portable desktop device 1000 required at least one interface device, and although many such devices and drivers were present none of the drivers met the security threshold or specification because they were all unsigned.
In some embodiments, no changes are made to the files of the hardware configuration block 1242I and the hardware drivers block 1242II until the hardware configuration has been deemed to pass both the security threshold or specification and the functionality threshold or specification. In other embodiments, a back-up of the files of the hardware configuration block 1242I is made before the changes are made, and if for any reason the hardware recognition and configuration fails, the files of the hardware configuration block 1242I are restored to their earlier form using the back-up.
Optionally, the booting hardware of the host computer system 1900 saves a hardware profile in the hardware profiles block 1226II defining the successful hardware configuration and associating it with the set of information, code, checksum, or system identification discussed above.
Once the configuration of the files of the hardware configuration block 1242I has been configured successfully at step 245, and any new profiles saved at step 250 or once the files of the hardware configuration block 1242I has been configured according to a profile in step 240, the booting hardware of the host computer system 1900 completes execution of the hardware recognition and configuration process 1226 by setting the previously configured flag 1224II to a value indicating that the portable desktop device 1000 has been configured at step 255 and restarting the host computer system 1900 at step 260.
When the host computer system 1900 is restarted, it boots from the portable desktop device 1000, the booting hardware of the host computer system 1900 requests a bootable process 1220. As was mentioned hereinabove, at an early stage in the boot process and the portable desktop device checks the value of the previously configured flag 1224II at step 205. Since the previously configured flag 1224II has been set to a value indicating that the portable desktop device 1000 has been configured, the booting hardware of the portable desktop device resets the value of the previously configured flag 1224II to a value indicating that the portable desktop device 1000 has not been configured at step 265, and initiates startup of the portable desktop (PD) at step 270. The previously configured flag 1224II is reset in order to ensure that the process of hardware recognition and configuration is performed the next time the portable desktop device 1000 is used, as it may be moved to a different system.
Since the files of the hardware configuration block 1242I and possibly the hardware drivers block 1242II have been modified as required, the portable desktop O/S 1242 starts up and operates the subset of hardware devices of the hardware devices 1950 in accordance with the security threshold or specification and the functionality threshold or specification of the portable desktop device 1000.
In some embodiments, during a portable desktop session, the contents of the boot process block 1220 are inaccessible, providing security for the boot process 1220 and ensuring that the security process 1224I is not tampered with.
As will be apparent to any skilled person in the art, the process of recognizing the hardware of the host computer system and configuring the files of the hardware configuration block of the portable desktop O/S makes the subsequent start-up of the portable desktop O/S extremely portable and efficient, since the portable desktop O/S has, in a sense, been custom pre-configured for the host computer system and the particular hardware devices it possesses. It also should be apparent to any skilled person in the art, that performing the process of configuring the files of the hardware configuration block of the portable desktop O/S in accordance with a security threshold or specification ensures a strictly followed level of security for the drivers and devices enabled for use by the portable desktop. As such, instead of portability at the expense of security and vice versa, a portable desktop device 1000 according to the embodiments described hereinabove may be provided with a customizable amount of both portability and security on an as needed basis.
Although the above embodiments contemplate a single memory store for portable desktop data, optionally, when multiple users are supported each different user of the multiple users is within an independent storage area providing optional enhanced security when only that storage area is accessible to the portable desktop. Further optionally, instead of providing the boot process with access to the storage area of the portable desktop, access is provided to a separate hardware configuration storage area that is also accessible to the portable desktop application. In this fashion, the portable desktop can optionally be prevented from modifying the hardware configuration and the boot process is prevented from accessing the portable desktop data.
When security and control over portability are of significant concern, optionally the configuration information for the hardware is retrieved during a first session, and in a case that the configuration failed, a log or record of the failure is also stored. Thereafter, an IT department or a server local to a network and known, is used to identify from the configuration information the necessary hardware configuration files or modifications thereto, or alternatively generates or obtains the necessary hardware configuration files, including drivers, etc. and updates/stores them in the devices/driver identification block 1226I and/or the hardware profiles block 1226II of the hardware recognition and configuration process block 1226 of the portable desktop device 1000. During a subsequent second session, the portable desktop device 1000 supports, with use of the modified or additional hardware configuration files, operation of its portable desktop environment on the host computer system 1900. In such an embodiment, the portable desktop device 1000 may not support operation of the portable desktop environment the first time it is used with a given host computer system. That said, after configuration by the IT department or known and local system, it will then support operation of the portable desktop environment. This provides an IT department, for example, with additional control over where and how the portable desktop device is used.
The embodiments presented are exemplary only and persons skilled in the art would appreciate that variations to the embodiments described above may be made without departing from the spirit of the invention. The scope of the invention is defined by the appended claims.
This application is a continuation of U.S. patent application Ser. No. 13/958,910, filed Aug. 5, 2013, issuing May 5, 2015, as U.S. Pat. No. 9,026,776, which is a continuation of U.S. patent application Ser. No. 12/570,608, filed Sep. 30, 2009, issuing Aug. 20, 2013, as U.S. Pat. No. 8,516,236, each of which is incorporated by reference herein, in its entirety.
| Number | Date | Country | |
|---|---|---|---|
| Parent | 13958910 | Aug 2013 | US |
| Child | 14703339 | US | |
| Parent | 12570608 | Sep 2009 | US |
| Child | 13958910 | US |
