Patent Application
20240045945
The present technology is directed generally to systems and methods for computer security. For example, the present technology is directed to providing air gap security between endpoint terminals and protected devices, or between slave (peripheral) devices and host devices (computers).
Prevention of unauthorized access to computer systems is paramount for many individuals and organizations interested in security. Despite the nearly ubiquitous use of passwords to control user access, many computer systems remain vulnerable to unauthorized access. For example, many computer systems and networks include one or more endpoints where human users engage with user interface devices such as keyboards, mice, monitors, voice controls, or other devices. These endpoints may be vulnerable to unauthorized access or tampering because malware may be injected into the computer systems via physical ports such as Universal Serial Bus (USB), High-Definition Multimedia Interface (HDMI) or other ports in which the user interface devices connect to the computing systems.
Many aspects of the present disclosure can be better understood with reference to the following drawings. The components in the drawings are not necessarily to scale. Instead, emphasis is placed on clearly illustrating the principles of the present disclosure. The same reference number indicates the same element throughout the several views.
The present technology is directed generally to systems and methods for computer security. For example, in one embodiment of the present technology, a computer security system may include an endpoint authentication interface configured to receive one or more user credentials, an endpoint enrollment controller operatively connected to the endpoint authentication interface, and an endpoint access controller operatively connected to the endpoint enrollment controller and configured to enable or disable one or more data connections between a protected device and an endpoint terminal system. The endpoint enrollment controller may be programmed with instructions that receive the one or more user credentials from the endpoint authentication interface and send a signal to the endpoint access controller to cause the endpoint access controller to enable or disable the one or more data connections. The one or more data connections may include connections between the protected device and a keyboard, a mouse, or a monitor. The protected device may include a host computer, a server, a network link, or a storage device. In some embodiments, the protected device may not be connected to an external system outside of a secured computing system that includes the protected device, and/or the endpoint access controller may not be connected to an external system outside of the secured computing system. The system may further include one or more additional endpoint access controllers configured to enable or disable one or more additional data connections between the protected device and one or more additional endpoint terminal systems.
In another embodiment of the present technology, the system may further include an interface interrogator device operatively connected to the endpoint access controller, and/or operatively connected between a user interface device (such as a keyboard, a mouse, a monitor, a mass storage device, and/or another peripheral device) and the protected device. The interface interrogator device may include a controller programmed with instructions that, when executed, determine if a user interface device is authorized to connect with the protected device, and in response to determining if the user interface device is authorized to connect with the protected device the interface interrogator device may enable or disable communication between the user interface device and the protected device. In some embodiments, when the user interface device comprises a mass storage device, the interface interrogator device is configured to prevent or disable communication between the mass storage device and the protected device.
In still another embodiment of the present technology, an interface interrogator device includes a plurality of connectors, wherein at least one first connector is configured to engage with a host port of a computing device, and wherein at least one second connector is configured to engage with a slave device. The interface interrogator device may further include an interrogation chip connected to the second connector and configured to receive data from the slave device. The interface interrogator device may further include a control chip connected to the interrogation chip, the control chip further being connected to the at least one first connector and programmed with instructions that enable or disable a connection between the slave device and the host port of the computing device. In some embodiments, the data from the slave device includes a slave device type, a slave device manufacturer, and/or a slave device product identification number. The connectors may be USB, HDMI, ethernet connectors, and/or other connectors for transmission of data. The control chip and/or the interrogation chip is programmed with instructions that, when executed, analyze the data from the slave device, determine whether the slave device is an authorized device, and, depending on the determination of whether the slave device is an authorized device, enable or disable the connection. For example, the interface interrogator device may disable the connection when the slave device type indicates a mass storage device.
In still another embodiment of the present technology, a method of controlling connections between a host computer and a slave device (such as a user interface device, peripheral device, mouse, keyboard, monitor, or the like) includes identifying a slave device using an interrogation chip by receiving, in the interrogation chip, data that identifies the slave device. The method may further include determining, based on the data that identifies the slave device, whether the slave device is an authorized device, and if the slave device is an authorized device, sending an approval signal from the interrogation chip to a control chip. The control chip may establish a connection between the host computer and the slave device based on the approval signal. In some embodiments, the method may include monitoring the connection, and if the slave device is removed or modified, disabling the connection and re-determining whether the slave device is an authorized device before re-enabling the connection or before permitting re-enablement of the connection.
In yet another embodiment of the present technology, a cable management system includes a retention rail having an elongated track with a groove. The system may further include a retention block with a body and an extrusion carrier extending from the body, the extrusion carrier configured to engage the groove with one or more retention rail extrusions extending from the extrusion carrier. The retention block receives one or more cables. The retention block may be movable along the track and/or the retention block may include a set screw passing through at least part of the retention block to selectively press against the retention rail to resist or prevent movement of the retention block. The retention block may include a channel passing through the retention block and configured to receive a cable tie element that may hold one or more cables in and/or on the retention block. The one or more retention rail extrusions may include two or more retention rail extrusions positioned to engage the retention block in a selected number of positions in the groove to provide adjustment to height and/or positioning of the one or more cables.
Various embodiments of the technology are described herein. The following description provides specific details for a thorough understanding and an enabling description of these embodiments. One skilled in the art will understand, however, that the technology may be practiced without many of these details. Additionally, some well-known structures or functions, such as those associated with computer terminals, computer networking, and printed circuit boards, may not be shown or described in detail for efficiency and to avoid unnecessarily obscuring the relevant description of the various embodiments. Accordingly, the technology may include other embodiments with additional elements or without several of the elements described below with reference to
The terminology used in the description presented below is intended to be interpreted in its broadest reasonable manner, even though it is being used in conjunction with a detailed description of certain specific embodiments of the technology. Certain terms may even be emphasized below; however, any terminology intended to be interpreted in any restrictive manner will be overtly and specifically defined as such in this detailed description section.
Many embodiments of the present technology may take the form of computer- or controller-executable instructions, including routines executed by a programmable computer or controller. Those skilled in the relevant art will appreciate that the technology can be practiced on computer/controller systems other than those shown and described below. The technology can be embodied in a special-purpose computer, controller or data processor that is specifically programmed, configured or constructed to perform one or more of the computer-executable instructions described below. Accordingly, the terms “computer” and “controller” as generally used herein refer to any data processor or data processing device and can include Internet appliances and hand-held devices (including palm-top computers, wearable computers, cellular or mobile phones, multi-processor systems, processor-based or programmable consumer electronics, network computers, mini computers and the like). Information handled by these computers can be presented at any suitable display medium, including a CRT display or LCD.
The technology can also be practiced in distributed environments, where tasks or modules are performed by remote processing devices that are linked through a communications network. In a distributed computing environment, program modules or subroutines may be located in local and remote memory storage devices. Aspects of the technology described below may be stored or distributed on computer-readable media, including magnetic or optically readable or removable computer disks, as well as distributed electronically over networks. Data structures and transmissions of data particular to aspects of the technology are also encompassed within the scope of the embodiments of the technology.
Systems and methods in accordance with embodiments of the present technology isolate users and endpoints from data resources intended to be secure and/or protected until users and endpoints have been properly authenticated. Such isolation can be colloquially deemed “air gap” security.
The secured computing system 103 may be physically secured in an enclosure 109, such as a room, a locked container, or another suitable enclosure. The secured computing system 103 may include a protected device 112, such as a host computer, network link, or other device, that contains secure data or enables a data connection to another secure system. The protected device 112 may generally include any device that is desired to be protected from unauthorized access, such as a server, a hard drive, a network connection, a controller for equipment, or the like. For example, in one particular embodiment, the protected device 112 may be a secure computer with sensitive commercial or intelligence data. In some embodiments, the protected device 112 is not connected to any external system other than the endpoint terminal system 106 (for example, the protected device 112 may not be connected to the World Wide Web or another external network).
The secured computing system 103 may further include an endpoint access controller 115, which enables or disables (such as turns on or turns off) the protected device 112 and/or connections 118 between the protected device 112 and the endpoint terminal system 106, such as network, HDMI 119, USB 120, and/or other network and/or data connections, such as Ethernet. The endpoint access controller 115 functions as a gateway between the protected device 112 and the endpoint terminal system 106. For example, when the endpoint access controller 115 has activated (enabled) one or more connections 118 to the protected device 112, the endpoint terminal system 106 can access and/or control the protected device 112. To facilitate connecting the protected device 112 to the endpoint terminal system 106, the endpoint access controller 115 may include one or more input/output ports 116 (such as HDMI, USB, Ethernet, and/or other input ports), which are connected to the protected device 112 or to the endpoint terminal system 106. In operation, the endpoint access controller 115 enables or disables activity across the input/output ports 116, thereby enabling or disabling the connections 118 (e.g., HDMI 119, USB 120) between the protected device 112 and the endpoint terminal 106. In some embodiments, the endpoint access controller 115 is not connected to any external system other than the endpoint terminal system 106, and it may be secured within the enclosure 109, to prevent unauthorized access or alteration. In some embodiments, the endpoint access controller 115 may connect to multiple protected devices 112 and multiple endpoint terminals 106 to enable or disable connections between one or more endpoint terminals 106 and one or more protected devices 112. In some embodiments, the secured computing system 103 may further include a hub device 117, which may include a USB hub, an HDMI hub, or another suitable data hub for connecting multiple data connections in a bus arrangement.
In some embodiments, an endpoint enrollment controller 121 may be configured to control whether the endpoint access controller 115 has enabled or disabled the connections 118 between the protected device 112 and the endpoint terminal system 106. For example, the endpoint enrollment controller 121 may receive enrollment credentials about a user, it may authenticate the user, and it may send a signal to the endpoint access controller 115 to enable the connections 118 between the protected device 112 and the endpoint terminal system 106, based on authenticating the user. In some embodiments, the endpoint access controller 115 may include manual on/off buttons 124 to manually enable or disable the connections 118 between the protected device 112 and the endpoint terminal system 106. In some embodiments, the endpoint access controller 115 may be positioned in a rack-mountable enclosure 127, so that the endpoint access controller 115 may be supported in a modular manner in the overall enclosure 109. In some embodiments, the rack-mountable enclosure may be approximately nineteen inches wide, and/or it may have other suitable dimensions.
The endpoint enrollment controller 121 may include a computing device such as a small computer or tablet device running an operating system (such as WINDOWS 10 by MICROSOFT, or another suitable operating system) that manages user enrollment and/or access control to the protected device 112. In some embodiments, the endpoint enrollment center 121 may connect to the endpoint access controller 115 via a data connection 130, such as USB or another suitable data connection. In some embodiments, the endpoint enrollment controller 121 is not connected to any external network, such that the endpoint enrollment controller 121 may only be controlled locally (for example, within the enclosure 109 by an embedded touch screen or other input device) to prevent unauthorized alterations to the endpoint enrollment controller 121.
In some embodiments, one or more of the components of the secured computing system 103 may be positioned outside of the enclosure 109, for example, in another enclosure, another secure location or environment, or in other locations (local or remote), depending on the level of security desired by the system operators.
In some embodiments, the endpoint terminal system 106 is an end user's access point for accessing data or signals on the protected device 112. The endpoint terminal system 106 may include one or more user interface devices, such as one or more monitors 133 for viewing data associated with the protected device 112. Other user interface devices of the endpoint terminal system 106 may include one or more keyboards 136, one or more mice 139, or other user interface devices suitable for interacting with computer systems such as the protected device 112. The user interface devices (such as the one or more keyboards 136, one or more mice 139, one or more monitors 133) may be connected to the secured computing system 103 via one or more USB connections 120, HDMI connections 119, or other suitable audio, video, or control connections.
The endpoint access controller 115 enables or disables connections 118 (including HDMI connections 119, USB connections 120, or other connections) between the user interface devices 133, 136, 139 and the protected device 112. In some embodiments, the endpoint access controller 115 provides an “air-gap” (either physical or electronic) that separates the protected device 112 from connections until connections are authorized. In some embodiments, to control enabling or disabling of the connections 118, a user provides credentials or authentication at the endpoint terminal system 106. The endpoint terminal system 106 may include an endpoint authentication interface 142 configured to receive user credentials and transmit the user credentials to the endpoint enrollment controller 121 for verification. In some embodiments, the endpoint authentication interface 142 may include a keypad 145 (which may include alphanumeric keys or other symbolic keys) for receiving a user passcode, personal identification number (“PIN”), or other entry for verifying a user's identity. In some embodiments, the endpoint authenticator interface 142 may include one or more biometric authentication devices such as a fingerprint scanner or facial recognition scanner. In some embodiments, the endpoint authentication interface 142 may additionally or alternatively include a card reader 148, which may be a swipe card reader, a contactless card reader, or another card reader similar to existing access card readers (sometimes called “smart” cards or radio-frequency identification cards). Information read or entered in the card reader 148 and/or the keypad 145 may be transmitted by the endpoint authentication interface 142 to the endpoint enrollment controller 121 for verification, and depending on whether a user has been authenticated and authorized, the endpoint enrollment controller 121 may instruct the endpoint access controller 115 to enable connections 118 between the user interface devices 133, 136, 139 and the protected device 112.
In some embodiments, the endpoint terminal system 106 may include a kill button 151, which in some embodiments may be positioned on and/or connected to the endpoint authentication interface 142. The kill button 151 may be configured to transmit a signal to the endpoint enrollment controller 121 to instruct the endpoint enrollment controller 121 to further instruct the endpoint access controller 115 to disable connections 118 with the protected device 112. Accordingly, the kill button 151 may function as an instant log-out button. In some embodiments, the kill button 151 may include a manual button and/or it may be accomplished by removal of a user's credentials (such as an access card) from the endpoint authentication interface 142.
Referring to
In other words, in operation, the endpoint terminal system 106 cannot access the protected device 112 unless and until the user provides authentication credentials at the endpoint authentication interface 142, those credentials are verified at the endpoint enrollment controller 121, and the endpoint enrollment controller 121 instructs the endpoint access controller 115 to enable the connections 118, which link the monitor 133, the keyboard 136, the mouse 139, and other peripherals or controllers to the protected device 112. In some embodiments, upon connecting the endpoint terminal system 106 with the protected device 112 (via the enablement of connections 118 by the endpoint access controller 115), a user may further be required to log in to the protected device 112. For example, as shown in
Embodiments of the present technology provide multiple layers of security. For example, in order to even communicate with the protected device 112, a user must be authenticated at the endpoint terminal system 106, and in order to access data on the protected device 112, a user may be further required to log in to the protected device 112. The present technology provides an air gap security arrangement that prevents all access to the protected device 112 without authorization. Before a user authenticates at the endpoint authentication interface 142, the protected device 112 is not even connected to the endpoint terminal system 103. The present technology accordingly completely blocks access to the actual interfaces of the protected device 112, including video and input interfaces, or other interfaces.
One potential vulnerability in computer systems is that nearly any data connection may provide a pathway for malware or other intrusions. For example, a nefarious party may simply plug a USB device into a USB port on a computer system (or another device in another data port) and activate instructions or code to inject malware or seize control of the computer system. Embodiments of the present technology provide interface interrogator devices to block malicious or otherwise unwanted data traffic to and/or from a computer system that is desired to be protected.
As explained in additional detail below, the interface interrogator device 300 may be configured to allow data traffic between some devices, such as the keyboard 136, the mouse 139, and the authenticator device 157, while the interface interrogator device 300 may be further configured to deny data traffic to and from the mass storage device 330 in order to prevent injection of malware or other undesirable code or instruction into the host computer 310. The interface interrogator device 300 analyzes data traffic and connections between devices and determines if devices should be allowed to communicate, by distinguishing between allowed devices such as human interface devices (mice, keyboards, etc.) and banned devices such as mass storage devices. In some embodiments, the interface interrogator device 300 is configured to be a single device capable of plug-and-play configuration, in which it may merely be operatively connected between the host computer 310 and the one or more slave devices 320. For example, the interface interrogator device 300 may be in the form of a dongle, adapter, or other intermediate connector.
In some embodiments, the interface interrogator device 300 includes a plurality of connectors 340 (such as two USB connectors 340, or other suitable data connectors, such as HDMI, ethernet, or others). The connectors 340 may be male connectors, female connectors, androgynous connectors, or other connectors suitable for engaging with a corresponding connector, such as a host port 350 and one or more slave devices 320. For example, in one particular embodiment, a first connector 340 may be a male USB connector for connecting to a corresponding female USB connector in the host computer 310, while a second connector 340 may be a female USB connector for receiving a corresponding male USB connector 360 associated with a slave device 320.
The interface interrogator device 300 includes a host interface 370 associated with a connector 340, to function as a host for the slave device 320. The host interface 370 is operatively connected to an interrogation chip 380, which requests and/or receives data from the slave device 320. The interface interrogator device 300 further includes a control chip 385 connected to the interrogation chip 380. In some embodiments, a control and monitor connection 390 facilitates communication between the interrogation chip 380 and the control chip 385. The control chip 385 functions as a latch (schematically illustrated as latch 393) to enable or disable a connection between the host interface 370 of the interface interrogator device 300 and a slave interface 395 associated with the connector 340 that engages the host computer 310. In some embodiments, the control chip 385 features a hardware gate allowing or disallowing physical connections, while in other embodiments, the latch 393 is embodied in software. The interface interrogator device 300 blocks all connections to the host computer 310 from passing through the interface interrogator device 300 until the slave devices 320 are verified and/or authorized.
Upon connection between the slave device 320 and the host interface 370, at block 410, the interrogation chip 380 carries out a handshake or enumeration to link the interface interrogator device 300 with the slave device 320. In block 420, optionally in response to an interrogation query by the interrogation chip 380, the slave device identifies itself to the host by device type, manufacturer identification, and/or product identification. The interrogation chip 380 determines whether the slave device 320 is an authorized device. If the slave device 320 is not an authorized device, at block 430 the interrogation chip does not send an approval signal to the control chip 385, so the control chip 385 does not establish a connection between the slave device 320 and the host port 350 of the host computer 310. The interrogation chip 380 may reset and wait for another slave device 320 to be connected to the host interface 370 of the interface interrogator device 300 to begin the authorization process again.
If the slave device 320 is an authorized device, at block 440 the interrogation chip 380 sends an approval signal to the control chip 385. In response, at block 450 the control chip 385 opens a monitored physical connection between the slave device 320 and the host port 350 of the host computer 310. For example, as shown in
In some embodiments, when the interface interrogator device 300 is authorizing a connection between the slave device 320 and the host computer 310, the host computer 310 may be engaged in a communication mode appropriate for the specific authorized slave device 320. If an unauthorized slave device 320 is swapped for an authorized slave device 320, the interface interrogator device 300 ends the connection. If a previously authorized slave device 320 attempts to switch states (for example, by masquerading as an authorized slave device, such as a mouse, and then beginning function as a mass storage device), the interface interrogator device 300 may detect the new communication mode and end the connection, restarting the interrogation at block 405.
In other words, the interrogation chip 380 and the control chip 385 of the interface interrogator device 300 together carry out a latch function, in which the interrogation chip 380 analyzes devices and instructs the control chip 385 to enable or disable a physical connection between devices. If any changes are detected by either the interrogation chip 380 or the control chip 385, connections are cut and the interrogation process begins again. Accordingly, the interface interrogator device 300 provides layered security, by analyzing slave devices 320 and allowing or disallowing connections based on the type of device (for example, mass storage devices may not be allowed to be connected), manufacturer information, product information, model information, or other characteristics suitable for determining whether a slave device 320 is acceptable.
The interrogation chip 380 may be programmed with instructions that determine whether a device is authorized. In some embodiments, the interface interrogator device 300 may include embedded machine-learning instructions that reduce or eliminate the need to individually program what slave devices 320 are to be allowed or disallowed. For example, the interface interrogator device 300 may include a controller with instructions that, when executed, enable a learning mode in which permitted slave devices 320 are connected to the interface interrogator device 300 to teach the interface interrogator device 300 what devices are allowed. The interface interrogator device may further include a controller with instructions that, when executed, enable operational mode to carry out the regular function of the interface interrogator device 300. In some embodiments, the interface interrogator device 300 may include a switch to activate and/or deactivate the learning mode, and/or it may include an interface for a user to enter a code to activate or deactivate the learning mode.
Interface interrogator devices 300 configured in accordance with embodiments of the present technology, in which interrogation software is hard-coded into the chips 380, 385, have several advantages over software-only solutions. For example, software-based port security running on a general operating system may be compromised if the operating system is compromised. In contrast, the physical interface interrogator devices 300 may be configured to lack general operating systems, programming interfaces, or other accessible or alterable code. Physical interface interrogator devices 300 may include a printed circuit board carrying the chips 380, 385. In addition, interface interrogator devices 300 may function as a self-supporting appliance positioned between a secured device and a peripheral to block introduction of all malware and/or data storage devices.
Systems and methods of securing computer systems configured in accordance with embodiments of the present technology may be scaled up to provide for multiple endpoints and/or multiple users. For example,
In some embodiments, the system 600 may include an enclosure 650 to contain the protected devices 112, the power supplies 610, the endpoint access controllers 620, and the primary access controller 115 in a compact and space-efficient design. For example, the endpoint access controllers 620 may be oriented vertically and stacked alongside each other (as shown in
Cable retention or management systems configured in accordance with embodiments of the present technology facilitate fast and accurate cable insertion and connection with improved organization and resistance to tampering. Referring back to
Positioning the retention block 165 along a position of the retention rail 160 facilitates accurate positioning of the cable 750. In some embodiments, a cable retention system need not include a retention rail 160. Rather, in some embodiments, the retention block 165 may be attached to a surface using an adhesive, a fastener, or another suitable attachment.
Retention blocks configured in accordance with embodiments of the present technology may be height-adjustable. For example,
Retention blocks 165 configured in accordance with embodiments of the present technology may also be locked or at least partially locked against the retention rail to prevent lateral movement along the retention rail. For example,
Although cable retention systems configured in accordance with embodiments of the present technology are described in the context of secured computing systems, cable retention systems may be used in other suitable implementations in which accurate and secure cable management is desired.
The processor(s) 1005 may include central processing units (CPUs) to control the overall operation of, for example, a host computer. In certain embodiments, the processor(s) 1005 accomplish this by executing software or firmware stored in memory 1010. The processor(s) 1005 may be, or may include, one or more programmable general-purpose or special-purpose microprocessors, digital signal processors (DSPs), programmable controllers, application specific integrated circuits (ASICs), programmable logic devices (PLDs), or the like, or a combination of such devices.
The memory 1010 can be or include the main memory of the computer system. The memory 1010 represents any suitable form of random-access memory (RAM), read-only memory (ROM), flash memory, or the like, or a combination of such devices. In use, the memory 1010 may contain, among other things, a set of machine instructions which, when executed by processor 1005, causes the processor 1005 to perform operations to implement embodiments of the present technology.
Also connected to the processor(s) 1005 through the interconnect 1025 is a (optional) network adapter 1015. The network adapter 1015 provides the computer system 1000 with the ability to communicate with remote devices, such as storage clients, and/or other storage servers, and may be, for example, an Ethernet adapter or Fiber Channel adapter, or adapters for other communication protocols disclosed herein.
The techniques introduced herein can be implemented by, for example, programmable circuitry (e.g., one or more microprocessors) programmed with software and/or firmware, or entirely in special-purpose hardwired circuitry, or in a combination of such forms. Special-purpose hardwired circuitry may be in the form of, for example, one or more application-specific integrated circuits (ASICs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), etc.
Software or firmware for use in implementing the techniques introduced here may be stored on a machine-readable storage medium and may be executed by one or more general-purpose or special-purpose programmable microprocessors. A “machine-readable storage medium,” as the term is used herein, includes any mechanism that can store information in a form accessible by a machine (a machine may be, for example, a computer, network device, cellular phone, personal digital assistant (PDA), manufacturing tool, any device with one or more processors, etc.). For example, a machine-accessible storage medium includes recordable/non-recordable media (e.g., read-only memory (ROM); random access memory (RAM); magnetic disk storage media; optical storage media; flash memory devices; etc.), etc.
The term “logic,” as used herein, can include, for example, programmable circuitry programmed with specific software and/or firmware, special-purpose hardwired circuitry, or a combination thereof.
Several additional aspects of the present technology are set forth in the additional following examples.
1. A computer security system, comprising:
2. The computer security system of example 1 wherein the endpoint enrollment controller is programmed with instructions that receive the one or more user credentials from the endpoint authentication interface and send a signal to the endpoint access controller to cause the endpoint access controller to enable or disable the one or more data connections.
3. The computer security system of examples 1 or 2 wherein the one or more data connections comprise connections between the protected device and a keyboard, a mouse, or a monitor.
4. The computer security system of any one of examples 1-3 wherein the protected device comprises a host computer, server, network link, or storage device.
5. The computer security system of any one of examples 1-4 wherein the protected device is not connected to an external system outside of a secured computing system that includes the protected device, and wherein the endpoint access controller is not connected to an external system outside of the secured computing system.
6. The computer security system of any one of examples 1-5 wherein the endpoint access controller comprises a manual button configured to enable or disable the one or more data connections.
7. The computer security system of any one of examples 1-6, further comprising a rack-mountable enclosure containing the endpoint access controller.
8. The computer security system of any one of examples 1-7 wherein the endpoint enrollment controller comprises a computer with an operating system and programmed with instructions that receive user enrollment credentials and determine whether a user is authenticated to access the protected device.
9. The computer security system of any one of examples 1-8 wherein the endpoint authentication interface comprises a keypad.
10. The computer security system of any one of examples 1-9 wherein the endpoint authentication interface comprises a card reader.
11. The computer security system of any one of examples 1-10, further comprising a kill button configured to generate and transmit a signal to the endpoint enrollment controller to instruct the endpoint enrollment controller to further instruct the endpoint access controller to disable the one or more data connections.
12. The computer security system of any one of examples 1-11, further comprising a hub device configured to interconnect one or more of the endpoint enrollment controller, the endpoint access controller, and the endpoint authentication interface.
13. The computer security system of any one of examples 1-12, further comprising one or more additional endpoint access controllers configured to enable or disable one or more additional data connections between the protected device and one or more additional endpoint terminal systems.
14. The computer security system of any one of examples 1-13, further comprising an interface interrogator device operatively connected to the endpoint access controller, the interface interrogator device including a controller programmed with instructions that, when executed, determine if a user interface device is authorized to connect with the protected device, and in response to determining if the user interface device is authorized to connect with the protected device, enabling or disabling communication between the user interface device and the protected device.
15. The computer security system of any one of examples 1-14 wherein when the user interface device comprises a mass storage device, the interface interrogator device is configured to prevent or disable communication between the mass storage device and the protected device.
16. An interface interrogator device comprising:
17. The interface interrogator device of example 16 wherein the plurality of connectors comprises a USB, HDMI, or ethernet connector.
18. The interface interrogator device of examples 16 or 17 wherein the control chip or the interrogation chip is programmed with instructions that, when executed, analyze the data from the slave device, determine whether the slave device is an authorized device, and, depending on the determination of whether the slave device is an authorized device, enable or disable the connection.
19. The interface interrogator device of any one of examples 16-18 wherein the connection is disabled when the slave device type indicates a mass storage device.
20. A method of controlling connections between a host computer and a slave device, the method comprising:
21. The method of example 20 wherein the data includes a slave device type, a slave device manufacturer, or a slave device product identification number.
22. The method of examples 20 or 21, further comprising monitoring the connection, wherein if the slave device is removed or modified, disabling the connection and re-determining whether the slave device is an authorized device before re-enabling the connection.
23. The method of any one of examples 20-22, further comprising enabling a learning mode with the interrogation chip in which data identifying the slave device is stored in a memory.
24. A cable management system, comprising:
25. The cable management system of example 24 wherein the retention block is movable along the track.
26. The cable management system of examples 24 or 25 wherein the retention block comprises a set screw passing through at least part of the retention block to selectively press against the retention rail to resist or prevent movement of the retention block.
27 The cable management system of any one of examples 24-26 wherein the retention block comprises a channel configured to receive a cable tie element, the channel passing through the retention block.
28. The cable management system of any one of examples 24-27 wherein the one or more retention rail extrusions includes two or more retention rail extrusions positioned to engage the retention block in a selected number of positions in the groove.
Advantages of systems configured in accordance with embodiments of the present technology include protecting computing systems and/or networks from unauthorized access, preventing connection of devices that may contain malware, and relatively simple design which may require only minimal training for security officers and other staff to implement. Systems configured in accordance with embodiments of the present technology provide an “air gap” isolation to physically separate users from components and networks. Systems configured in accordance with embodiments of the present technology provide layered security, which facilitates overlaying an independent security layer on an existing system infrastructure. For example, one layer (such as a computer terminal) may facilitate or prevent access to another layer (such as a server). In some embodiments, failure of one layer will not compromise an entire secured computing system. In some embodiments, equipment may be secured in a secure enclave with locks and/or walls that are difficult to penetrate, in order to physically separate authorized and/or unauthorized users from the equipment.
The above detailed descriptions of embodiments of the technology are not intended to be exhaustive or to limit the technology to the precise form disclosed above. Although specific embodiments of, and examples for, the technology are described above for illustrative purposes, various equivalent modifications are possible within the scope of the technology, as those skilled in the relevant art will recognize. For example, while steps are presented in a given order, alternative embodiments may perform steps in a different order. Moreover, the various embodiments described herein may also be combined or separated to provide further embodiments. For example, the foregoing includes multiple components that may work together in a secured computing system or separate components, such as interface interrogator devices, endpoint access controllers, or other components disclosed herein, however, the components disclosed herein may be deployed as individual components in specific applications. In some embodiments, the endpoint enrollment controller and endpoint access controller may be combined or integrated into a single controller, or they may be components of a single device.
Moreover, unless the word “or” is expressly limited to mean only a single item exclusive from the other items in reference to a list of two or more items, then the use of “or” in such a list is to be interpreted as including (a) any single item in the list, (b) all of the items in the list, or (c) any combination of the items in the list. As used herein, the term “and/or” when used in the phrase “A and/or B” means “A, or B, or both A and B.” A similar manner of interpretation applies to the term “and/or” when used in a list of more than two terms. Where the context permits, singular or plural terms may also include the plural or singular term, respectively. Additionally, the term “comprising” is used throughout to mean including at least the recited feature(s) such that any greater number of the same feature and/or additional types of other features are not precluded. To the extent any of the materials incorporated herein by reference conflict with the present disclosure, the present disclosure controls. It will also be appreciated that specific embodiments have been described herein for purposes of illustration, but that various modifications may be made without deviating from the technology. Further, while advantages associated with certain embodiments of the technology have been described in the context of those embodiments, other embodiments may also exhibit such advantages, and not all embodiments need necessarily exhibit such advantages to fall within the scope of the technology. Accordingly, the disclosure and associated technology can encompass other embodiments not expressly shown or described herein.
The present application is a continuation of U.S. patent application Ser. No. 17/253,560, filed on Dec. 17, 2020, which is a national stage application under 35 U.S.C. § 371, of International Patent Application No. PCT/US19/37623, filed on Jun. 18, 2019, which claims priority to U.S. Provisional Patent Application No. 62/763,449, filed Jun. 18, 2018, each of which is incorporated herein by reference in its entirety.
| Number | Date | Country | |
|---|---|---|---|
| 62763449 | Jun 2018 | US |
| Number | Date | Country | |
|---|---|---|---|
| Parent | 17253560 | Dec 2020 | US |
| Child | 18490601 | US |
