Isolated KVM combiner for multi-network computer system having a video processor

The present invention presents apparatuses and systems for operating multiple computers from a single keyboard and a single mouse and view composite videos generated from video output of the multiple computers on a single display, while preventing any possible information leakage between the computers. Keyboard and mouse commands detected by a host controller are used to control a video processor and a peripheral switch. The peripheral switch directs keyboard and mouse signals to one selected host and at the same time, the video processor creates an active display window showing video information from the selected host. Physical unidirectional isolators in the video, keyboard and mouse channels prevent any potential data leakages between hosts.

FIELD OF THE INVENTION

The present invention, in some embodiments thereof, relates to apparatuses and systems for operating multiple computers from a single set of peripheral devices. More particularly, the invention presents a special secure KVM device for interacting with computers using a single console, while preventing data leakage between the connected computers and attached networks.

BACKGROUND OF THE INVENTION

Existing devices such as a Keyboard Video Moose (KVM) switch are used for interconnecting a single computer to multiple computers for control purposes. The switch enables sending commands and getting information from the controlled computers, thus a user of a KVM may have remote access to multiple computers from a single keyboard, a monitor, and a mouse. During access, keyboard characters or pointing data are sent to the remote computers and video signals are routed via the switch from the remote computers, processed, and displayed on the single video monitor. In general, the user navigates through an on-screen menu or display for easy of switching between the controlled computers.

Some KVM switches allow a user to view and access one of the controlled computers, while at the same time, the user can view video images from the others non-accessed computers on some parts of his video screen. This provides simultaneous information to the user and enables fast and simple on-screen navigation between the controlled computers.

Prior art for available products that allow a user to view video images from multiple sources simultaneously on a single screen, include the QuadView™ XL, and the device described in “Apparatus and system for managing multiple computers”, to VanHarlingen, Brian, Leibow, Michael, Chen and Li-ter, U.S. publication Ser. No. 11/105,063 US Now U.S. Pat. No. 7,240,111; but these products do not protect the information passed through the combiner device and leakage between the controlled computers is made possible on the KVM switch even if the controlled computers are far apart.

Previous systems presenting a KVN include United States Patent Application Number 2006/0230110A1, titled “Apparatus and system for managing multiple computers” to Brian VanHarlingen, Michael Leibow, and Li-ter Chen. However, they describe a non-secured KVM wherein the managed computers are not isolated and no isolation means presented.

OTHER REFERENCED PATENTS AND APPLICATIONS

1. United States Patent Application 20050044266—High isolation KVM switch2. United States Patent Application 20040015980—Systems and methods for monitoring and controlling multiple computers3. U.S. Pat. No. 7,240,111—Apparatus and system for managing multiple computers4. U.S. Pat. No. 7,284,278—Secured KVM switch5. U.S. Pat. No. 7,568,029—Apparatus and system for managing multiple computers6. U.S. Pat. No. 7,113,978—Computer interconnection system

For many applications (such as transactions in banking markets) it is desirable to have a secured management device that, on one hand allows for simple interaction and control of multiple computers, yet, on the other hand, prevents information leakage between the controlled computers.

The present invention addresses this aspect of isolation in a combiner, thus providing higher level of security.

SUMMARY OF THE INVENTION

It is provided in accordance with one embodiment, an Isolated KVM combiner for multi-network computer system comprising:a keyboard input configured to connect to a keyboard;a pointing device input configured to connect to a pointing device;a host controller receiving signals from at least one of said keyboard and said pointing device;at least one first peripheral interface and at least one second peripheral interface configured to connect to at least one first host computer and at least one second host computer, respectively;a peripheral switch selectively directing signals from said host controller only to a selected one of said at least one first peripheral interface and said at least one second peripheral interface at a time;at least one first physical unidirectional enforcing circuitry and at least one second physical unidirectional enforcing circuitry connected between said peripheral switch and said at least one first peripheral interface and said at least one second peripheral interface, respectively, enforcing data flow only from said peripheral switch to the peripheral interfaces;at least one first video input interface and at least one second video input interface configured to connect to video outputs of said at least one first host computer and said at least one second host computer, respectively;at least one video output port configured to connect to a user display device;a video processor;at least one first video physical unidirectional isolator and at least one second video physical unidirectional isolators, each connected between said video processor and one of said at least one first video input interface and said at least one second video input interfaces, respectively, enforcing data flow only from said at least one first video input interface and said at least one second video input interface, respectively, to said video processor,wherein said video processor is capable of combining video signals from the at least one first video input interface and the at least one second video input interface to a composite video signal and outputting said composite video signal to said at least one video output port,and wherein said video processor is responsive to commands received from at least one of said keyboard input and said pointing device input.

In accordance with another embodiment, the at least one first host computer and the at least one second host computer are connected to at least two separate networks, respectively.

In accordance with another embodiment, said peripheral switch is responsive to commands received from at least one of said keyboard input and said pointing device input.

In accordance with another embodiment, said composite video signal to be displayed on the user display device comprises at least one first window and at least one second window, wherein video content of said at least one first window is derived from video signal from said at least one first video input interfaces, and video content of said at least one second window is derived from video signal from said at least one second video input interfaces.

In accordance with another embodiment, only one of said at least one first window and said at least one second window is an active window, and the video content of said active window is derived from video signal from video input interface of the host computer coupled to the peripheral interface selected by said peripheral switch.

In accordance with another embodiment, the Isolated KVM combiner further comprising a video frame buffer connected to said video processor.

In accordance with another embodiment, having at least one video input interface connected to an external video source other than a computer.

In accordance with another embodiment, the isolated KVM combiner further comprising at least one first non-volatile memory and at least one second non-volatile memory connected to said at least one first video input interface and at least one second video input interface, respectively, wherein said at least one first non-volatile memory and said at least one second non-volatile memory contain display parameters readable by said at least one first host computer and said at least one second host computer, respectively.

In accordance with another embodiment, said display parameters are readable to the respective host to emulate standard display DDC (Display Data Channel).

In accordance with another embodiment, upon connection of the isolated KVM combiner to one or more of the first or second host computers, the host computer video circuitry interrogates said at least one first non-volatile memory and said at least one second non-volatile memory to receive Plug & Play parameters.

In accordance with another embodiment, said Plug & Play parameters are selected from the group consisting: display name, supported display resolution, and supported display refresh rate.

In accordance with another embodiment, said at least one first non-volatile memory and said at least one second non-volatile memory are user programmable.

In accordance with another embodiment, the isolated KVM combiner further comprising:at least one first audio interface and at least one second audio interface, respectively connected to one of said at least one first host computer and at least one second host computer; andan audio multiplexer is connected to said at least one first audio interface and said at least one second audio interface and to at least one audio peripheral selected from a group consisting of: microphone, headset, and a speaker.

In accordance with another embodiment, the isolated KVM combiner further comprising a cascading port to enable the isolated KVM device to be cascaded to another isolated KVM device.

In accordance with another embodiment, said video processor comprises an FPGA (Field Programmable Gate Array).

In accordance with another embodiment, said video physical unidirectional isolators comprise a 1-Way DVI Interface.

DETAILED DESCRIPTION OF THE DRAWINGS

In discussion of the various figures described herein below, like numbers refer to like parts. The drawings are generally not to scale. For clarity, non-essential elements may have been omitted from some of the drawing.

FIG. 1illustrates a high-level block-diagram of a prior art system10that enables a computer user to access multiple isolated networks using a single host computer. Host Computer2may be a PC, workstation, thin-client or portable computer connected to a single set of user mouse5, user keyboard6, user display4and user headset3. Host Computer2connected to three separate networks8a,8band8cvia LAN (Local Area Network) cable7and LAN switch1. LAN switch1may be a simple mechanical switch controlled by the user to enable access to the three LAN ports8a,8b, and8c. As the three networks may have different security levels it is typically desirable that LAN switch1will be designed in such way that it will reduce the risk electrical leakage between the three connected networks.

One major drawback of this method is that the connected of different security level networks to a single host2and its network adapter presenting the risk of leakage between the networks in the host. This can be done by hardware or by software means and although both networks are not connected simultaneously to the host2, information leaks may happen after LAN switch1connecting the host2to a different network. Another drawback of this system is the need to reboot the host2after switching network. Even with this practice data may leak between networks through the single attached host2.

Another disadvantage of this prior-art system is that the user cannot work simultaneously at application from different networks. This switching between application and networks is though for users that needs to work on different networks on a daily basis.

FIG. 2illustrates a high-level block-diagram of yet another prior art system20that enables a computer user to access multiple networks using multiple host computers. In this system the user uses two sets of computer hosts2aand2b, connected to two separate networks8aand8baccordingly. Computer hosts2aand2balso connected to two sets of desktop interaction devices—user keyboards6aand6b, user mice5aand5band two user displays4aand4b.

While this system eliminates the risk of leakage between the two networks8aand8b, it has several disadvantages.

One disadvantage of this system is that the user needs to interact with two separate sets of keyboards mice and displays. This divided focus tends to confuse the user.

Another disadvantage is the desktop space needed and the added costs of the two separate sets.

FIG. 3illustrates a high-level block-diagram of another prior art system30that enables a computer user to access multiple networks using multiple host computers and legacy KVM (Keyboard Video Mouse) device. In this system Host Computers2aand2bmay be PC, workstation, thin-client or portable computer. Host computers2aand2bare connected to isolated networks8aand8brespectively.

Host computers2aand2bare connected to a KVM device33through a set of connection cables. Cables34aand34bdelivers the video output of Host computers to the KVM. Cables35aand35bconnects the peripheral interface of Host computers to the KVM. Peripheral interface may be PS/2 (IBM Personal System 2 standard), USB (Universal Serial Bus) or other peripheral protocol. Cables36aand36bconnects the audio input/output of Host computers to the KVM. KVM device33switches the Host computer inputs/outputs to the connected set of Human Interface devices comprising of a display4, mouse5, keyboard6and headset or speakers3. Switch over from Host computer2ato2band back is controlled by the user through special keyboard keys combination or by activation a switch located at the KVM33.

While this system has the advantage of reduced LAN leakage through the Host computers, it can still enable data leakage at the KVM33due to software or hardware vulnerabilities.

Another disadvantage of this system is that the user must switch completely from one environment to the other. Some legacy KVMs designed to provide electrical isolation between the host computers to reduce the risk of electrical and electromagnetic leakages between the isolated LANs.

FIG. 4illustrates a high-level block-diagram of a preferred embodiment of the present invention40that enables a computer user to safely access multiple isolated networks using multiple host computers and a Secured KVM device. In this system Host Computers2aand2bmay be PC, workstation, thin-client or portable computer. Host computers2aand2bare connected to isolated networks8aand8brespectively. It should be noted here that Secured KVM device may have many more ports to support additional Host Computers. To simplify the figures, only two channels are shown hereafter.

Host computers2aand2bare connected to a Secured KVM device50through a set of connection cables. Cables may be substituted by other connection means such as fiber-optical links or wireless connection. Cables34aand34bdelivers the video output of Host computers to the Secured KVM device50. Cables35aand35bconnects the peripheral interface of Host Computers2aand2bto the Secured KVM50. Peripheral interface may be PS/2 (IBM Personal System 2 standard), USB (Universal Serial Bus) or any other suitable peripheral protocol.

Secured KVM device50Host Computer2avideo inputs connected to an optional physical isolator54a. Physical isolator may be opto-isolator, serial link, electromagnetic coupler, transformer or any other suitable circuitry. Similarly Host Computer2bvideo input is connected to an optional physical isolator54b. Isolation may be needed to avoid signal leakage between host computers due to common ground or power. If Host video input is analog additional buffer amplifier circuitry may be needed to properly interface with analog video source. If Host video input is digital (such as DVI) additional receiver circuitry may be needed to properly interface with digital video source.

Physical isolators54aand54bare connected to the video switch65to select active channel visible to the user through video output and User Display device4.

Physical isolators54aand54bmay have built-in or separate Analog to Digital converter (ADC) to enable interfacing with analog video signals from Host Computers2aand2b.

Secured KVM device50Host Computer2aperipheral port35ais connected to peripheral emulator circuitry60a. Secured KVM device50Host Computer2bperipheral port35bis connected to peripheral emulator circuitry60b. Peripheral Emulators circuitry60aand60bemulating standard peripheral device such as USB or PS/2 keyboard or mouse. Peripheral Emulators circuitry60aand60bare connected to physical unidirectional enforcing circuitry64aand64brespectively. Physical unidirectional enforcing circuitry64aand64bare for example: opto-isolator, serial link, electromagnetic coupler, transformer or any other suitable circuitry assuring one directional flow of data. Physical unidirectional enforcing circuitry64aand64bare required in order to assure that in any case of software failure or intended sabotage in the Host Computers2aand2bor in the Secured KVM device50, peripheral interface cannot cause information leakage between host computers.

Physical unidirectional enforcing circuitry64aand64bare connected to peripheral switch70to select active peripheral channel connected to the user keyboard and mouse.

Host controller80connected to the peripheral switch70interfaces between the bidirectional data flow of the connected user peripherals (mouse5and keyboard6) and the physically forced unidirectional data flow to the said peripheral emulators60aand60b.

Since peripheral protocols are bi-directional in nature and the data path between the host controller80and the peripheral emulators60aand60bis forced to unidirectional flow, the host controller serves as an interface between the standard peripheral protocol (such as PS/2 or USB) and the non-standard unidirectional internal protocol. This internal protocol may use one way serial, I2C or any other standard or non standard interface.

Video switch65and peripheral switch70can be manually operated by the user by means of mechanical switch. Video switch65and peripheral switch70can be alternatively controlled by host controller function80to switch sources based on preprogrammed keyboard keys combination or mouse control.

FIG. 5illustrates a high-level block-diagram of a preferred embodiment of the present invention100similar to the previousFIG. 4having Secured KVM Combiner function110. In this preferred embodiment of the present invention the video switch function65of the previousFIG. 4replaced by video processing function85. This video processing function receives multiple digital video data from optional physical isolators54aand54bto generate windows84aand84b(respectively) on output video port. To enable asynchronous video input and to enable additional video function an optional volatile memory88serving as video frame buffer connected to the video processing function85. Volatile memory88may be DRAM, DDR or any suitable fast volatile memory type.

Video processing function85may optionally be comprised of discrete logic, CPU, FPGA or ASIC technology.

Video processing function85receives commands from host controller function80based on user mouse and keyboard input. The host controller function80calculates mouse location in system mode, keys status, windows sizes, priority and locations and all other machine states and send proper commands to the video processing function85directly or through optional unidirectional flow device. User specific settings and administrator settings are all stored in the host controller function80non-volatile memory.

Video processing function85can receive video data from hosts that are not at the same display setting (resolution, refresh rate, colors, and phase) and stores it temporarily on the volatile memory frame-buffer88. Video output is generated by reading the volatile memory frame-buffer88content at any needed rate. Output display resolution can be adapted to any desirable setting irrespective to video input settings. Video processor may have a non-volatile memory device86to store CPU, FPGA or ASIC program and optional customer specific graphics such as display background images. Video processing function85typically connected to the user display4through DVI or HDMI transmitter55acting as a unidirectional flow device. This DVI or HDMI transmitter converts the digital video stream to differential signals needed to drive standard displays.

Non-volatile memory82aand82bconnected to the Host Computers2aand2brespectively. Non-volatile memory may contain display parameters readable to the host to emulate standard display DDC (Display Data Channel). Upon connection of Secured KVM Combiner to the Host Computers2aand2b, Host computers video circuitry interrogates the non-volatile memory functions82aand82bto receive Plug & Play parameters such as display name, supported display resolution, supported display refresh rate etc. Non-volatile memory functions82aand82bmay be programmed by the user to provide adequate information to the Host Computers as needed.

As video input data may have higher combined bandwidth than memory and video processing bandwidth various methods may be used to reduce such bandwidth.

Cropping of input video data removes data of areas that are not visible on the user display at any particular moment

Frame dropping—reduces incoming video data by skipping some frame. This method may cause visible artifacts though.

Reduced color depth or color depth conversion reduces input data at the cost of reduced color representation.

Other methods may be used to avoid bandwidth limitations depending on required video input settings.

An optional audio switching or mixing may be added to the Secured KVM Combiner device110in order to enable user to operate audio peripherals such as microphone, headset95or speakers. Host Computers2aand2bhaving additional audio cables36aand36bconnected to the Secured KVM Combiner apparatus. Cables may be audio out, audio in, microphone or any other digital or analog audio signal. Audio multiplexer/mixer92enables volume control of selected/unselected hosts based on programmed settings. For example selected host audio channel may have higher volume compared to other host audio signals. In some exemplary embodiments, audio signals comprises of speaker signals transmitted to the user speaker, but no microphone signals. By allowing only speaker signals, unidirectional signal flow is ensured.

Cascading port147connected to the video processor85and optionally connected to host controller80, enable parallel connection of more than one Secured KVM Combiner devices to increase the number of Host Computer ports. To support cascading of peripherals and audio, switches70and92may have an additional (third in the depicted exemplary embodiment) position to enable access of external cascaded Secured KVM Combiner to the attached set of headset95, keyboard6and mouse5. In order to coordinate cursor location and system states, host emulator function80may be also connected to the cascading port147.

FIG. 6aillustrates a typical implementation of a Secured KVM Combiner115similar to the Secured KVM Combiner110of the previousFIG. 5. In this system200, second host2bis replaced by an internal thin-client/computer module220b. This thin-client module internally connected to other Secured KVM Combiner functions through peripheral interface35b, video interface34band audio interface36b. Thin-client/computer module connected to its local area network8bthrough a LAN jack or fiber interface installed on the device panel. Other controls and indications may be installed to support the thin-client/computer module220b, such as Power/Fail LED, Reset switch and direct USB port to support local peripherals such as printers and authentication devices.

FIG. 6billustrates yet another typical implementation of a Secured KVM Combiner116similar to the Secured KVM Combiner115of the previousFIG. 6abut with removable modules. In this system300, the Secured KVM combiner116is designed as a modular chassis with several identical bays. Bays have electrical interfaces to enable insertion of required modules (302and303in this example). Module302is auxiliary interconnection module to interface external host2a. This module passes through or converts the peripheral interface35b, video interface34band audio interface36bfrom attached host2a. Second module303is a thin-client/computer module with internal thin-client/computer220battached to external LAN8b. This modular arrangement enables easy adaptation to the user and the organization with selection of internal or external hosts all interchangeable in a single chassis. Power to the module may be provided by KVM chassis116directly or through isolated supply or may be provided by external sources as required.

FIG. 7illustrates an exemplary implementation of a Secured KVM Combiner400. In this implementation the design is separated into two separate boards—video processing board124and system controller board122. To enhance product security the only link between system controller board122and video processor board124is a physical unidirectional enforcing circuitry108that connects the host controller80and the video processor80to deliver video commands and settings such as windows location, size, menu items, frames etc. 1-Way DVI interfaces54a,54b,54cand54dserves as a receiver (interface) between the differential DVI video in connected to the Host Computers video cards and a parallel (LCD bus) interface connected to the video processor85. Each DVI Receiver54ato54dalso serves as a physical unidirectional enforcing circuitry. In case that electrical isolation between video inputs is needed, additional isolators are placed between the DVI receivers and the video processor (not shown here). DVI Receivers54ato54dmay also powered independently by isolated power supplies to avoid common ground plane. DVI Receivers54ato54dmay also have separate electromagnetic shielding to avoid radiation leakage between channels.

In this particular implementation 4 channels are shown, however larger or smaller number of channels may be used.

For simplicity, cascading options are not depicted in this figure

FIG. 8aillustrates an exemplary implementation of a Secured KVM Combiner user display180in system mode. In the display mode shown, the user may move between different windows and change window size by using a pointing device and special system cursor150. Task-bar151located at the bottom of the visible display presents push buttons for each of the 4 different sources. Channel 1 source is accessed by clicking on channel 1 key142a. Channel 2 source is accessed by clicking on channel 2 key142b, etc. Each channel key is preferably marked with the color selected for that source—for example channel 1 key is marked with colored box identical in color to the frame154agenerated by the video processor around window152a. User may optionally cancel (disable) unused channel as will be explained in nextFIG. 8b. Optionally, user may also use the wheel in wheel mouse device to toggle between the 4 channels and bring each window to the front. The optional setup key140in the task-bar151enable authorized administrator user to access setup screens. Access to the setup preferably requires authentication means such as front panel key-lock opening, user name and password, smart-card etc.

The background image159may be a programmed color or a custom bitmap stored at the Secured KVM Combiner in special non-volatile memory (seeFIG. 5item marked86).

Preferably, user can use system cursor150to drag windows, and change window size by dragging window corner or side frame.

The task-bar may optionally roll down or disappear to save desktop space if mode is changed from system to normal.

User preset keys marked as149a,149band149cenable user to program specific windows arrangement and store it in one of the keys (this is done foe example by clicking on the preset key and holding for few seconds). Once user settings were stored, clicking on the key will immediately reconfigure the display with the stored setting.

Optional cascade key144located in the task-bar151change display mode to multiple overlaid windows. The optional tile key146arranges all 4 channels side by side to show all channels simultaneously.

Optional help key148located in the task-bar151may provide help images and text to assist the user in initial operation an in training.

In this example channel 4 window152dreduced to a size smaller than its native resolution. As a result a vertical scroll-bar156and horizontal scroll-bar158appeared on the window frame154dto enable user control of visible area.

Change from system mode to normal mode and back is preferably done through mouse clicks or other preprogrammed triggers. Once in normal mode, the system cursor disappears and the active host window cursor will be coupled to the user mouse.

FIG. 8billustrates the same display ofFIG. 8but with channel 2 disabled by the user. Windows 2 marked152bofFIG. 8is not shown anymore and channel 2 key in the task-bar142bbecame gray and has a cross on it.

FIG. 9illustrates an exemplary implementation of a Secured KVM Combiner user display190in administrator mode. This mode is accessible to authorized users through authentication means and by clicking on the SETUP key140located in the task-bar151.

Setup menu will appear on top of setup key140to enable user selection of system option172or each one of the individual channels 1 to 4 through keys170ato a70drespectively. If System key172is pressed another menu area163appears on top and present system level settings such as: frame width176, task-bar size 179, system cursor symbol174and display output settings178. This area163also shows various hardware parameters and loaded firmware versions.

It should be noted that display output settings may be automatically detected through display DDC interrogation by the host controller80. This will override administrator selection at setup screen.

When selecting a specific channel key170ato170d, administrator may select channel color and channel input resolution.

Setup may be loaded and saved automatically by external means such as USB flash key or memory card to enable fast device setup.

FIG. 10illustrates an exemplary front panel of a Secured KVM Combiner230with four external host computer ports of the present invention. This Secured KVM Combiner is similar to the Secured KVM Combiner shown inFIGS. 4, 5 and 7above with 4 channels in this specific embodiment of the present invention. It should be noted that more or less channels may be used.

Front panel206is preferably having the following features:

DVI OUT Connector203to connect a DVI user display. Fiber-optic display interface module may be fitted on the panel to support TEMPEST requirements or remote located display installations. Other display output interfaces, or multiple display output interfaces may optionally be used.

PS/2 keyboard connector214to enable connection of user PS/2 keyboard.

PS/2 mouse connector215to enable connection of user PS/2 mouse.

Dual USB connectors216to enable connection of USB user mouse and keyboard.

Optional Power LED218to indicate that the device is powered on.

Audio out jack222to enable connection of user headset or speakers.

Optional channel indicators, for example LEDs1008ato1008dmay be used for indication the status of the corresponding channel.

Optional administrator lock, for example physical lock1009may be used for changing the operation of the apparatus from user mode to administration or set-up mode by authorized personnel. It should be noted that other security measures prevention unauthorized tempering with the system may be employed in hardware or software.

It should be noted that more USB connectors may be used for example for multiple pointing devices. It also noted that only one of PS/2 or USB ports may be used.

It should be noted that some other feature such as Audio input jacks, power input jack and power switch may be located on the front panel.

It should be noted that some of these features and/or other feature may be located at other enclosure sides not shown here. For example the audio input jacks and main power switch may be located on the left side.

FIG. 11illustrates an exemplary rear panel of a Secured KVM Combiner230with four external host computer ports according to an exemplary embodiment of the present invention. This Secured KVM Combiner is similar to the Secured KVM shown inFIGS. 4, 5 and 7above with 4 channels in this specific embodiment of the present invention. Rear panel207is preferably having the following features:

USB Type-B connectors1114ato1114dto connect to the host computers2ato2dUSB peripheral ports respectively.

DVI connectors210ato210dto connect to the host computers2ato2dvideo output ports respectively.

Optional channel selected LEDs212ato212dto indicate the active selected channel.

It should be noted that number of channels may be different.

It should be noted that other I/O interface standards may be used.

FIG. 12illustrates an exemplary front panel of a Secured KVM Combiner250with two external host computer ports and two internal thin-client/computer modules of the present invention. This Secured KVM Combiner is similar to the KVM115shown inFIG. 6above but with 4 channels. Front panel208is similar to panel206inFIG. 10with the following differences:

Additional thin-client/computer Power LEDs1232aand1232dto indicate that the internal thin-client devices are powered on (green color) or failed in boot test (red color).

Additional thin-client/computer RESET switches234aand234dto allow the user to reset the internal thin-client devices.

FIG. 13illustrates an exemplary rear panel of a Secured KVM Combiner250with two external host computer ports and two internal thin-client modules of the present invention. This Secured KVM Combiner is similar to the KVM115shown inFIG. 6above but with 4 channels. Rear panel209is similar to panel207inFIG. 11with the following differences:

USB Type-B connectors1114aand1114dreplaced by LAN jack1316aand1316drespectively to enable LAN connection to internal thin-client modules. LAN connection may be changed to fiber-optic interface such as SFP type connector. LAN jacks13116aand1316dmay have internal LEDs to indicate LAN Link and Activity status.

DVI connectors210aand210dwere removed due to the internal thin-client modules at channels 1 and 4.

FIG. 14illustrates a typical rear panel features of a Modular Secured KVM Combiner260with two auxiliary host interface modules255band255cand two thin-client/computer modules256aand256d. This Secured KVM Combiner implementation of the present invention is similar to the KVM116shown inFIG. 6babove but with 4 channels. Rear panel shown is made of different modules inserted into KVM chassis219. Modules are inserted into the chassis219and secured by screws or Dzus fasteners2255aand2255b. Technician may remove these screws to exchange modules as needed while KVM is at the user desktop.

Modularity of the KVM Combiner offers several advantages compared to non-modular KVMs:

The number and type of modules used can be customized before or after deployment to any required configuration of internal or external hosts.

Cabling can be minimized when internal hosts are used

High security organizations may want to use security policies that dedicate hosts to specific networks after initial exposure to that network. With modular device it is possible to enforce such procedure and keep operational overhead to minimum.

Product maintenance and trouble shooting is simplified compared with integrated hosts.

Thin-client computer modules256aand256dpanels are fitted with a LAN jacks1316aand1316drespectively to attach the LAN, optional auxiliary USB connectors258aand258drespectively to attach optional user authentication device or printer and push buttons262aand262drespectively to reset the thin-client/computer or to enable restore to factory defaults. Optional microphone jack and other features may be added to enable further user options. LAN jack1316aor1316dmay be substituted by fiber LAN connection if needed. LEDs212aand212dmay indicate module selection or status.

Auxiliary host interface modules255band255cpanels are fitted with DVI input connectors210bto enable video input from connected host. USB jack214bto enable peripheral interface connection to attached host. LED212band212cmay indicate module selection or status.