Secure computing

A secure computer is disclosed comprising a general-purpose domain, a secure domain, and a security module. The general-purpose domain is configured to provide general-purpose computing and comprises a host processor, a non-volatile storage system, and at least one networking device. The secure domain is configured to provide secure computing and comprises a secure processor. The security module is configured to facilitate data transmission between the general-purpose domain and the secure domain.

FIELD

The present invention relates to computers and specifically to a system and method for facilitating secure computing thereon.

BACKGROUND

Network-connected computers are difficult to keep secure. There are several reasons for this. For example, modern computers rely on their operating systems to keep the data within the computer safe. These operating systems are very complex pieces of software containing millions of lines of code. Such a large volume of code may have unintentional security leaks or extensions that intentionally break the security mechanisms. Alternatively, simpler, system-specific operating systems may not have the sophistication necessary to prevent or inhibit malicious attacks.

As another example, many computer users do not have the training, experience, or time to set up and maintain a secure computer properly. Accordingly, even if a computer is well secured when it is set up, the way it is used may make it less secure. Users may use a work computer for non-work-related activities, such as browsing the web, playing games, reading email, using social media, and the like that expose the computer and its data to security breaches. Even worse, users may disable security features in order to make it easier to access these activities.

Another security issue is the use of poor procedures to grant a remote computer access to a secure network. Typical techniques such as username and password combinations are not very secure. The password may be transferred to the user via an unsecure method like email, or the user may be tricked into giving the password to a third party by a misleading message or phishing scam.

Accordingly, it is an object of the present invention to obviate or mitigate at least some of the above-mentioned disadvantages.

SUMMARY

A computer is described that has two distinct hardware domains. A general-purpose domain is provided for a general-purpose host computer. A secure domain is provided for secure computing. The hardware in the secure domain is secure by design and does not depend on the security of the underlying operating system and software applications, or the skill of the operator and network administrators.

Thus, in accordance with an aspect of an embodiment, there is provided a secure computer comprising: a general-purpose domain configured to provide general-purpose computing, the general-purpose domain comprising: a host processor, a non-volatile storage system, and at least one networking device; a secure domain configured to provide secure computing, the secure domain comprising: a secure processor, and a security module configured to facilitate data transmission between the general-purpose domain and the secure domain. The security module comprises: key storage for storing at least one network encryption key; network identification (ID) storage for storing a network identifier; and a network encryption module configured to encrypt data communicated from the secure domain to the general-purpose domain and decrypt data communicated from the general-purpose domain to the secure domain using the at least one network encryption key.

In an embodiment, the key storage further stores at least one data encryption key. The security module further comprises a storage encryption module configured to encrypt data communicated from the secure domain to the general-purpose domain and decrypt data communicated from the general-purpose domain to the secure domain using the at least one network encryption key. The at least one network encryption key is used to encrypt and decrypt data communicated with the at least one networking device. The at least one storage encryption key is used to encrypt and decrypt data communicated with the non-volatile storage system.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

For convenience, like numerals refer to like structures in the drawings. Referring toFIG.1, an example of a secure computer in accordance with an embodiment of the invention is illustrated generally by numeral100. The secure computer system100comprises two distinct hardware domains. Specifically, a general-purpose domain102is provided for general-purpose computing. A secure domain150is provided for secure computing.

The two-domain system allows the computer to work in a way that people typically use a computer. That is, the general-purpose domain102provides users with an opportunity to perform non-secure operations, such as web browsing, games, movies, social media, and the like. The secure domain150facilitates operations that require access to secure information and private networks. The secure domain150is isolated from public networks by hardware interfaces, as will be described. The general-purpose domain102and the secure domain150do not share data. Thus, the likelihood of the non-secure operations performed by the general-purpose domain102affecting the secure domain150is greatly inhibited.

The secure domain150includes a power control module152, a secure processor154, and secure volatile memory155. The power control module152allows the secure domain150to be powered down. Powering down may reduce power consumption by the secure computer100when the secure domain150is not being used. Powering down also clears the secure volatile memory155when the secure domain150is not in use.

The general-purpose domain102includes a host processor104, host memory106, a non-volatile storage system108, and one or more networking devices110. The non-volatile storage system108includes storage devices such as a hard disk drive, a solid-state drive, or the like. The one or more networking devices include WiFi, Ethernet, Bluetooth, cellular technologies, and the like.

The secure domain150and the general-purpose domain102communicate with each other via a security module156. Peripheral devices130connect to the security module156, which controls the flow of peripheral information. In an embodiment, the peripheral devices130communicate with a peripheral hub132. The peripheral hub132is in communication with the security module156. Other devices that may be connected to the security module156include a video monitor140and an external authentication device142.

The secure domain150and general-purpose domain102operate independently of each other, and each have their own operating system. While the operating systems provide some level of security for both sides, the security module156is designed to provide the secure domain150with protection that is difficult, if not impossible, to be overridden by a software program, including the operating system, or misuse by the user of the secure computer100.

Referring toFIG.2the security module156is illustrated in greater detail. The security module156includes a context controller202, a video switch204, a secure peripheral device206interface, a host peripheral device interface208, a peripheral device filter210, key storage212, network identification (ID) storage214, password storage215, a storage encryption module216, a network encryption module218, and an authentication device interface220.

The context controller202controls the state of the security module156. The context controller202is accessible from the secure domain150via the secure peripheral device206and from the general-purpose domain102via the host peripheral device208. The context controller202can set the security module156into one of five states. Referring toFIG.9, a state diagram for the context controller is illustrated generally by numeral900. In a first state902, the secure domain150is powered down and locked. In a second state904, the secure domain150is powered up but locked and in reset. In a third state906, the secure domain150is powered up and running but inactive and locked. In a fourth state908, the secure domain150powered up and unlocked but inactive. In a fifth state910, the secure domain150is powered up, unlocked and active. The context controller202receives requests to change the state from both the secure domain150via the secure peripheral device206and from the general-purpose domain102via the host peripheral device208. In order to transition from a locked state (any of the first to third states902to906) to an unlocked state (either the fourth state908or the fifth state910), authentication will be required. The authentication will be described in detail later in the description. The context controller202also configures the secure peripheral device interface206and the peripheral device filter210, as will be described later.

The context controller202also sets the state of the video switch204to determine which domain has control of the monitor. When the secure domain150is active, the video switch204routes a video signal from the secure domain150to the monitor. Otherwise, the video switch204routes a video signal from the general-purpose domain102to the monitor.

The secure peripheral device206provides outside interface paths with the secure domain150. In an embodiment, the secure peripheral device interface206is a composite device with several interface components, including a context controller interface206a, a storage device interface206b, a network device interface206c, a keyboard interface206d, a pointer interface206e, an audio device interface206f, and a video device interface206g. Accordingly, the only devices that the secure domain150will have access to are the context controller202, a storage device, a network device, a keyboard, a pointer, an audio device, and a video device.

The host peripheral device interface208provides an interface between the secure domain150and the general-purpose domain102. Similar to the secure peripheral device interface206, the host peripheral device interface208is a composite device with several interface components, including a context controller interface208a, a secure storage interface208b, and a secure network interface208c. A first device driver USB1on the general-purpose domain102is coupled with the host peripheral device interface208to provide the necessary support for storage and networking, as will be described.

The context controller202further sets the state of the peripheral device filter210to determine to which domain to send signals coming from the external peripheral devices130. When the secure domain150is not active, the peripheral device filter210does not do anything to the signals passing through it. That is, signals coming from the peripheral hub132are passed directly a second peripheral driver USB2on the general-purpose domain102. When the secure domain150is active, the peripheral device filter210blocks keyboard, pointer, microphone, and videos signals from going to the general-purpose domain102and reroutes the data to the interface components208ato208fpresented by the secure peripheral device interface206. The peripheral device filter210also combines output sound from both the general-purpose domain102and the secure domain150to a sound output endpoint, if it exists.

The key storage212stores security keys for the secure computer100. In the present embodiment, there are two security keys: a network security key; and a storage security key. As will be described, the key storage212is configured to receive the two security keys via an application program interface (API). However, the API cannot read the keys from the key storage202. In one example, the key storage212comprises a non-volatile programmable memory structure that can only be written to once. In another example, the key storage212comprises a volatile memory structure and a battery, which is used to hold the information.

The network ID storage214stores a network ID represented by a serial number. In an example, the serial number is a 64-bit serial number. The network ID storage214is also programmed by the API. The network ID storage214may be a dedicated memory, or it can be a memory that is shared with other components of the security module156. Unlike the key storage212, the network ID can be read from the network ID storage214via the context controller202.

The password storage215stores authentication type, password length, and password for the authentication module. The password storage215comprises a non-volatile programmable memory structure which may or may not be re-writable. Alternatively, the password storage215comprises a volatile memory structure and a battery used to hold the information. The password storage215can be a standalone memory or it can be one a memory shared by other components of the security module156.

The storage encryption module216facilitates communication of secure storage data between the secure domain150and the general-purpose domain102. This allows the secure domain150to use the non-volatile storage system108. Storage data packets pass between the secure peripheral device interface206and the host peripheral device interface208via the storage encryption module216. This ensures that all outgoing storage data packets are encrypted, and all incoming storage data packets are decrypted and checked before being passed on. The keys for encryption and decryption are supplied by the key storage212via internal signals on the chip that cannot be probed. The storage encryption module216will only operate when enabled by the context controller202. Accordingly, when the storage encryption module216is disabled, the secure domain150is isolated from the non-volatile storage system108.

Similarly, the network encryption module218facilitates communication of secure network data between the secure domain150and the general-purpose domain102. This allows the secure domain150to communicate with remote computers. Network data packets pass between the secure peripheral device interface206and the host peripheral device interface208via the network encryption module218. This ensures that all outgoing network data packets are encrypted, and all incoming network data packets are decrypted and checked before being passed on. The keys for encryption and decryption are supplied by the key storage212via internal signals on the chip that cannot be probed. The network encryption module218will only operate when enabled by the context controller202. Accordingly, when the network encryption module218is disabled, the secure domain150is isolated from remote computers.

The context controller202is configured to inhibit a malicious change of context state by the host. Accordingly, the context controller202limits access to the unlocked security states. In an embodiment, four different types of authentication utilized, so the password storage215only needs a 2-bit authentication type field to represent all four authentication types. As an example, the storage used for the password length is 6 bits and for password the itself is 63 bytes. The password is programmed into the password storage215via the context controller202and the secure peripheral device interface206and cannot be read back. If the password storage215is re-writable, the password can only be changed to a new password with a command to the context controller220that includes the current password.

A first authentication type, or secure system type, is represented by “00” in the authentication type field. The secure system type may be used when the secure computer100is physically located in a secure location, such as behind firewalls in a secure room. Alternatively, the secure system type can be used when the secure operating system of the secure computer100provides adequate authentication. When the authentication type field is set to the secure system type the context controller202will enable a change to the secure state when requested, without any additional hardware authentication.

A second authentication type, or a password protected type, is represented by “01” in the authentication type field. The password protected type may be used when the secure computer100is physically located outside of a secure location. When the authentication type field is set to the password protected type, upon receipt of a request to change to the secure state, the context controller202will configure the peripheral device filter210to pass all keyboard input to the context controller202and block the keyboard input from the general-purpose domain102. The context controller202will only complete the change to the secure state if it receives an input password at the keyboard that matches the password in the password storage215.

A third authentication type, or an external device protected type, is represented by “10” in the authentication type field. Similar to the password protected type, the external device protected type may be used when the secure computer100is physically located outside of a secure location. When the authentication type field is set to the external device protected type, upon receipt of a request to change to the secure state, the context controller202will request authentication from an external authentication device via the authentication device interface220. In an embodiment, the authentication device interface is a serial peripheral interface (SPI). The external authentication device may include a biometric scanner or other advanced authentication scheme as desired. The external authentication device is configured to communicate the password to the context controller202using the SPI220upon authentication of the user. The context controller202will only complete the change to the secure state if it receives an input password via the SPI220that matches the password in the password storage215.

A fourth authentication type, or set password type, is represented by “11” in the authentication type field. The set password type indicates that the password has not yet been programmed, and authentication will always return true. Accordingly, this will prompt drivers on the secure system to request the user set the password. Once the password is set, the authentication type field is set to the password protected type and is represented by “00”, “01”, or “10” in the authentication type field.

Referring toFIG.3, the network encryption module218is illustrated in greater detail. The network encryption module218includes a header extractor302, a checksum generator304, network data encryption unit306, a network data decryption unit308, and a checksum tester310. When the secure domain150wants to send a data packet to a remote location, it sends the data packet to the network device interface206con the secure peripheral device interface206, which communicates the data packet to the network encryption module218. The header extractor302extracts the header from the data packet. The checksum generator generates a checksum. The checksum is created using a hashing algorithm. In the present embodiment, the MD5 message-digest algorithm is used and the checksum is a 128-bit MD5 message digest of the payload. The network data encryption unit306encrypts both the checksum and the payload. In the present embodiment, a 256-bit AES encryption algorithm provides the encryption using the network security key from the key storage212. When disabled by the context controller202, the header extractor302, network encryption unit306, and the network decryption unit308will not forward any data.

The encrypted data and a copy of the unencrypted header are sent to the secure network interface208con the host peripheral device interface208. The host peripheral device interface208communicates the packet to the peripheral driver USB1running on the general-purpose domain102. When the peripheral driver USB1receives the network packet, it examines the header to determine which destination machine in its table is to receive the packet. As will be described, the secure domain150is constrained to communicate only with a small number of machines on the public network that contain matched security modules156that can be used to decode the IP packets. The peripheral driver USB1then sends a User Datagram Protocol (UDP) packet to the destination machine with the network ID and the encrypted packet as its payload.

The peripheral driver USB1keeps an open UDP port for receiving secure packets from other devices. In an embodiment, secure packets are identified based on the port at which they are received. When a secure packet is received, it is passed on to the network encryption module218via the network interface208con the host peripheral device interface208. The network encryption module218receives the packet and the network data decryption unit308decrypts the packet using the network security key from the key storage212. The checksum tester310regenerates the MD5 message digest from the payload and compares it to the checksum in the decrypted message. Since the checksum is based on the unencrypted data, only another computer with a matching network security key will be able to generate a checksum that matches the MD5 digest after decryption. If the MD5 message digest and the checksum match, then the packet is verified. Once the packet is verified, it is communicated to the secure domain150via the network device interface206con the secure peripheral device interface206. If the MD5 message digest and the checksum do not match, then the packet is discarded.

Referring toFIG.4, the storage encryption module216is illustrated in greater detail. The storage encryption module216comprises a protocol analyzer402, a storage encryption unit404, and a storage decryption unit406. The storage device interface206bon the secure peripheral device interface206presents a standard peripheral mass storage class device to the secure domain150. When the secure processor154wants to access storage, it sends commands to the storage device interface206b, which in turns communicates the commands to the storage encryption module216. The commands are processed by the protocol analyzer402, where they are decoded to determine whether encryption is required. If the command contains storage data, then the data is encrypted by the storage encryption unit404. Specifically, the storage encryption unit404uses the storage security key from the key storage212for encryption. In an embodiment, the data is encrypted using an AES-256 encryption algorithm. Encrypted data is passed to the secure storage interface208bof the host peripheral device interface208. Other messages such as command block wrappers are not encrypted as they do not contain user data. Such messages are passed to the secure storage interface208bin plain text. As noted above, the storage encryption module216will only operate when enabled by the context controller202. Accordingly, when the storage encryption module216is disabled, the storage encryption unit404and storage decryption unit406modules will not forward any data.

The secure storage interface208bcommunicates the received storage commands to the first peripheral driver USB1. The first peripheral driver USB1is configured to open a file on the non-volatile storage system108that will act as a virtual disk for the secure domain150. The first peripheral driver USB1receives commands from the secure storage interface208band performs the corresponding disk action on the virtual disk. Even though the user data is stored in the general-purpose domain102, all user data is encrypted. Thus, the host processor104will not be able to access any user data from the secure domain150.

Data read from the virtual disk passes from the first peripheral driver USB1to the secure storage interface208band then to the storage encryption module216. The read data is processed by the protocol analyzer402to determine if the read data includes user data. If the read data does include user data, the user data is decrypted by the storage decryption unit406. Specifically, the storage decryption unit406uses the storage security key from the key storage212for decryption. In an embodiment, the data is decrypted using an AES-256 encryption algorithm. Decrypted data is passed to the storage interface206bof the secure peripheral device interface206. Other messages such as commands are not decrypted as they do not contain user data. Such messages are passed to the storage interface206bin plain text.

Unlike network packet communication, there is no hardware checking the read data. If the read data were not written by the storage encryption module, they will come back scrambled and the secure processor154will likely be able to detect a corrupted file system. As will be described, since only the security module156has access to the storage encryption key, any data written to the secure disk file must come through the secure domain150.

Referring toFIG.5, the peripheral device filter210is illustrated in greater detail. The peripheral device filter210comprises a peripheral device input filter502, a peripheral device output filter504, and a peripheral protocol analyzer506. All of the peripheral devices plugged into the system are connected to the peripheral hub132and controlled from the general-purpose domain102. That is, the general-purpose domain102enumerates the peripheral devices and runs the peripheral bus signaling. After enumerating a peripheral device such as a keyboard, pointing device, audio, or video, for example, the general-purpose domain102configures the peripheral filter210to look for data for these devices on particular device/endpoint combinations.

When the secure state is inactive, the peripheral protocol analyzer506is inactive and the general-purpose domain has control of the peripherals and monitor output. Accordingly, the peripheral device input filter502and the peripheral device output filter504do nothing but pass-through peripheral device data. In contrast, when the secure state is active, then the peripheral protocol analyzer506is active and the data to and from the peripheral devices130is filtered by the peripheral device input filter502and the peripheral device output filter504. Specifically, the peripheral protocol analyzer506is configured to monitor for the device/endpoint packets from or to devices used by the secure domain150.

Thus, in an embodiment in which the secure domain150has access to a keyboard, a pointer, a video device, and one or more audio devices, the peripheral protocol analyzer506is configured with the device and endpoint information for each of the keyboard, pointer, video device, and audio device. The audio device may be an input audio, for example a microphone, or an output audio device, for example a speaker. For data input from the peripheral device130, the protocol analyzer configures the peripheral device input filter502accordingly. When data is received from the peripheral device, it is filtered by the peripheral device input filter502and routed to a corresponding one of the interface components of the secure peripheral device interface206. Null data is routed to the second peripheral port USB2so that the general-purpose domain102does not interpret the missing data as an error with the peripheral device130. For data output to the peripheral device130, the protocol analyzer configures the peripheral device output filter504accordingly. When data is sent to the peripheral device130, it is filtered by the peripheral device output filter504and only data from a corresponding one of the interface components of the secure peripheral device interface206is sent to the device.

For example, consider a keyboard that sends keystrokes from device12, endpoint1. The peripheral protocol analyzer506detects when the general-purpose domain requests data from device12, endpoint1and set a “Keyboard EP” flag for the input peripheral filter502. When the data from the keyboard is received at the peripheral filter210, the input peripheral input filter502reroutes the data to the keyboard interface206dof the secure peripheral device interface206. Since it is not desirable to communicate copies of this data to the general-purpose domain102, the input peripheral filter502replaces data received from the keyboard with null information that does not contain any data. This null information satisfies the request for data from the general-purpose domain102, without jeopardizing the security of the secure domain150. Similar procedures are run for the pointer, video, and audio input packets.

As noted throughout the specification, the security module156includes the storage encryption key and the network encryption key. To facilitate communication between different computers with a secure network, the security module156of each computer within the secure network is configured with the same network encryption key and the same network ID. Thus, data encrypted and transmitted from one computer within the secure network can be received and properly decrypted at another computer within the secure network.

Referring toFIG.6, an example of a secure network is illustrated by numeral600. The network includes a local network602, a plurality of remote computers604, and a communication network606. The local network602includes a local working space602aand a local secure space602b. The local working space602aincludes a plurality of local computers608and a firewall610. The local secure space602bincludes a plurality of secure servers612and a secure firewall614. The secure servers612and the secure firewall614are coupled via a secure local area network616. The local computers608may include local secure computers608a, as described herein, and standard, state of the art computers608b. Similarly, the remote computers604may include remote secure computers604a, as described herein, and standard, state of the art computers (not shown).

Within the local working space602a, the local computers608are coupled via a local area network611. For ease of explanation, each of the local secure computers608abelongs to the same secure network, so each includes a security module156configured with the same network encryption key and the same network ID. Thus, data communicated from a secure domain150one of the local secure computers608acan be received and properly decrypted by the secure domain of another one of the local secure computers608a. Similarly, data communicated from the secure domain of one of the local secure computers608acan be received and properly decrypted by the secure domain of one of the remote secure computers604a. Yet further, the secure firewall614includes a security module156for each corresponding secure network. Thus, the secure domain of each of the local secure computers608aand the remote secure computers604acan also communicate with the secure servers612via the secure firewall614. In contrast, the standard local computers608band the standard remote computers will not be able to communicate with the secure domain150of any of the local or remote secure computers. Further, the standard local computers608band the standard remote computers will not be able to communicate with the secure servers612. Yet further, any external computer that manages to gain access through the firewall610will not be able to access to any data in the local secure space602bor on the secure domains150of the secure computers608aand604a.

Referring toFIG.7, the secure firewall614is illustrated in greater detail. The secure firewall614comprises a network router702, a plurality of security modules156ato156n, and a secure router704. The network router702may be implemented in software on a general-purpose computer and couples the secure firewall614with the local area network and the communication network. The network router702is also coupled to the plurality of security modules156ato156n. The secure router704couples the secure firewall614with the secure local area network616. When the network router702receives UDP packets that are to be forwarded to the local secure space602b, it recovers the network ID from the packet and forwards the packet to a corresponding of the corresponding security modules156ato156n, if it exists. The selected security module156decrypts the packet and confirms the checksum. If the checksum is confirmed, it is communicated from the secure router704to the local secure space602b.

To communicate a packet from the local secure space602bto one of secure computers608aor604a, the local secure server612sends a packet to the secure router704. The packet includes the address of the selected secure computer. The secure router704maintains a table correlating the address of the secure computers with their network ID. The security module156that has a network ID that matches the network ID of the selected secure computer is identified. The packet is communicated to the identified security module156, which encrypts the packet and forwards the encrypted packet to the network router702. The network router checks the address and builds a UDP packet for the secure device with the network number and encrypted packet.

The Basic Input/Output System (BIOS) of the secure domain150will initially perform a network boot from a machine in the secure space602bbefore installing the operating system, applications, and data files required to run the secure domain150. Only files fetched from the secure space602bwill be able to be installed in the secure domain150. The only drivers required for the secure domain are for those devices provide by the secure peripheral device interface206of the security module156. Other drives for the external peripheral devices130will be installed on the general-purpose domain102.

Referring toFIG.8, a programming device used to program the security module156is illustrated generally by numeral800. The programming device800is made as simple as possible to minimize the chance of security holes. The programming device800comprises a programming unit802, a plurality of security module interfaces804, an entropy source806, and an activation switch808. The programming unit802is coupled with each of the plurality of security module interfaces804, the entropy source806, and the activation switch808. The entropy source806can be any device that generates unbiased random numbers that cannot be duplicated, such as a thermal noise source from a resistor, for example. Each of the plurality of security module interfaces804comprises a serial peripheral interface (SPI) for coupling to a security module156. Each of the plurality of security module interfaces804also includes a red and green light emitting diode (LED). The programming unit802comprises a small microcontroller with a programming application and no permanent storage. The activation switch808is coupled with the programming unit802to initiate the programming application.

When security modules156are plugged into the security module interfaces804, they are interrogated by the programming unit802to determine if they have been programmed. Although the application programming interface of the security module156will never reveal the value of the storage security key or the network security key, it will indicate whether the keys have been programmed. If the programming unit802determines that the security module156is available and not already programmed with keys, it will light the red LED of the associated security module interface802. When the desired number of security modules156have been plugged in and verified, the programming unit802is ready to program the security modules156. In response to a user pressing the activation switch808, the programming unit802generates the network security key, the network ID, and a plurality of storage security keys. The network security key and the network ID will be common to all of the security modules156ato156n. The storage security key will be unique to each of the security modules156ato156n. The storage security key, the network security key and the network ID are sent to each security module156a total of five times. The application programming interface on the program module156reviews the storage security key, the network security key and the network ID to make sure that all five received versions are the same. If they are the same, the application program interface programs the storage security key, the network security key and the network ID before sending an acknowledgement to the programming unit802. The programming unit802will then switch the LED from red to green to indicate success. If the storage security key, the network security key and the network ID are not the same, then an acknowledgement is not sent. If the acknowledgement is not received within a predefine time period, the programming unit802will retry to program the security modules156. Once all the security modules156ato156nare programmed, the programming unit802erases its memory and gets set for the next programming cycle. At this point the only copies of the storage security key, the network security key and the network ID are stored inside the security modules. The storage security key and the network security key cannot be read out.

The above described computer system that provides a general-purpose domain for general-purpose host computer functionality and a secure domain for secure computing. The hardware in the secure domain is secure by design and does not depend on the security of the underlying operating system and software applications, or the skill of the operator and network administrators.

It will be apparent to those skilled in the art that various modifications and variations can be made to the disclosed secure computer without departing from the scope of the disclosure. Other embodiments of the secure computer will be apparent to those skilled in the art from consideration of the specification and implementation of the secure computer in a secure network disclosed herein. For example, although the secure computer is disclosed as switching control of the monitor between the secure domain150and the general-purpose domain102, in an alternative embodiment, a secure window and a general-purpose window are presented on the monitor. When the secure window is active, the secure domain150is active. When the general-purpose window is active, the secure domain150is inactive.

As another example, although the secure computer is described as using symmetric key cryptography, public-key cryptography can also be used. In such a case, both public encryption keys and private decryption keys are programmed in the key storage212. However, to enhance security, the public key need not actually be made available to the public.

As yet another example, secure computers in a first secure network can use the secure space602bto communicate with secure computers in a second secure network. In an embodiment, the secure computers in the first network can transmit data, along with a request to relay that data, to one of the secure servers612using the network encryption key associated with the first secure network. The secure firewall614decrypts the message and the request and forward them to the appropriate secure server612. The secure server612interprets the request and verifies that the requesting computer has permission to communicate with secure computers in the second secure network. If the user is verified, the secure server612communicates the data to the secure firewall614to relay to the secure computer in the second secure network. The secure firewall614uses the network encryption key associated with the second secure network to encrypt the data. The encrypted data is then relayed to the destination secure computer.

As yet another example, the secure computer may need to pass through a plurality of nested firewalls to reach a highly secure destination. For example, a first layer firewall would be accessible by any member of an organization. A second layer firewall would follow the first layer firewall and would be accessible only to a limited number of people within the organization. A third layer firewall would follow the second layer firewall and would be accessible only to a few of the limited number of people within the organization. To reach the inner, more secure layers, the secure computer requires multiple security modules156. For example, to reach the most secure, third layer firewall, the secure domain150first uses a security module associated with the third layer firewall to encrypt the data. The secure computer then uses a security module associated with the second layer firewall to encrypt the previously encrypted data. Finally, the secure computer then uses a security module associated with the third layer firewall to encrypt the twice previously encrypted data. The triple encrypted data is then passed to the general-purpose domain102to be communicated through the network. Once received at the destination, the nested packet works its way through each of the three firewall layers, with each firewall layer removing one of the nested encryption layers until the original, clear data is communicated on the innermost domain. As will be appreciated, data destined for a middle domain need not pass the third layer firewall. Thus, such data only needs to be encrypted twice to pass the first two layers. Similarly, data destined for an outer domain need not pass the second layer firewall or the third layer firewall. Thus, such data only needs to be encrypted one to pass the first layer firewall.

As will be appreciated, at present, the standard for the peripheral devices130is Universal Serial Bus (USB). However, other known peripheral bus protocols, such as Inter-Integrated Circuit (I2C), Serial Peripheral Interface (SPI), and other, proprietary, peripheral bus protocols may also be used.

The term computer, as used herein, is intended to have it well-known, broad definition. That is, a machine that can be instructed to carry out sequences of arithmetic or logical operations automatically via programming. As will be appreciated by a person skilled in the art, this definition encompasses personal computing devices such as desktop computers, laptop or notebook computers, smartphones, tablets, and the like. This definition also encompasses smart devices such as security cameras, remote locks, sensors, control systems, and the like, as well as embedded computers.

Although embodiments have been described above with reference to the accompanying drawings, those of skill in the art will appreciate that variations and modifications may be made without departing from the invention as defined by the appended claims.