Abstract:
The present disclosure relates to a KVM appliance for preventing the passing of status information between a target computer, which is in communication with the KVM appliance, and a peripheral of a user. The KVM appliance may comprise a housing, an indicator supported on the housing, and a main processing unit (MPU) for receiving status information. The MPU monitors status information received by it and determines when the received status information is of a specific type which is used to set the indicator, which in turn apprises the user of a real time status of a feature of the peripheral. When the status information is identi fled as being of the type to set the indicator, it is then used to set the indicator to indicate the real time status of the feature to the user of the peripheral.

Description:
CROSS REFERENCE TO RELATED APPLICATIONS 
       [0001]    The present application claims priority from U.S. provisional application Ser. No. 62/017,513, filed Jun. 26, 2014, the entire disclosure of which is hereby incorporated by reference into the present application. 
     
    
     FIELD 
       [0002]    The present disclosure relates to secure peripheral sharing switch (“PSS”) systems, and more particularly to a secure PSS system and method that eliminates the possibility of data leakage via a peripheral which is communicating with the PSS system. 
       BACKGROUND 
       [0003]    The statements in this section merely provide background information related to the present disclosure and may not constitute prior art. 
         [0004]    Secure peripheral sharing switch (“PSS”) systems are often used in applications where a peripheral, for example a keyboard, is being used to communicate with two different computer systems. One specific type of PSS system is a keyboard, video and mouse (“KVM”) system. For the sake of convenience, the present disclosure will make reference to a KVM system as the specific type of PSS under consideration, with the understanding that a KVM system is merely meant as one example. Thus, the teachings of the present application may be applied to other types of PSS systems besides a KVM system. 
         [0005]    KVM systems enable a single keyboard, mouse and video display device to communicate through a KVM appliance with one, two or more different target computers. Two or more of the target computers may be operating on different networks, often with different security levels. For example, one network may be a “classified” network and the other may be an “unclassified” network. When two or more target computers or other types of computing, peripheral or network devices are interfaced to the KVM appliance, a challenge arises with preventing data leakage from the user&#39;s computer or peripheral, back through the KVM appliance, to a different target computer. Such data leakage also presents a concern when a KVM appliance is used to provide a single computer or peripheral with shared access to two or more different networks, where the networks are designated with different security levels. 
         [0006]    If a KVM appliance is being used to initially interface the user&#39;s keyboard, mouse and display terminal to a first target computer operating on a first network, information may be transmitted both from the user&#39;s keyboard and mouse to the first target computer, as well as from the first target computer to the user&#39;s keyboard. The data transmitted from the first target computer to the user&#39;s keyboard may be, for example, data that is temporarily stored by the user&#39;s keyboard and controls setting a status indicator on the user&#39;s keyboard. In one example the data may be data that sets a lamp associated with the Caps Lock key on the user&#39;s keyboard, in response to the user pressing the Caps Lock key on the keyboard. Alternatively, the data could be used to set a scroll lock indicator or a numbers lock indicator on the keyboard. When the KVM appliance is used to switch the user&#39;s peripheral to communicate with a second target computer, for example operating on a second network, then the data which has been sent to the user&#39;s keyboard and is being stored by the user&#39;s keyboard (e.g., to set the Caps Lock lamp) may be passed (i.e., “leaked”) to the second target computer as soon as the second target computer begins communicating with the user&#39;s keyboard. 
         [0007]    The above described sharing or “leakage” of information from the user&#39;s peripheral from one target computer to another is not limited to just status information passed to the user&#39;s keyboard, but could potentially extend to virtually any other type of information that is shared between a target computer and the user&#39;s keyboard or mouse via the KVM appliance. While such keyboard status information is frequently used to set some type of status indicator on a keyboard or other peripheral that the user is using, this type of information is not necessarily limited to just status information used with a keyboard. Those skilled in the art will appreciate that various other peripherals often used by a user in a KVM setting may include some small amount of memory for temporarily storing information received from a target computer during a KVM session. In such instances it is highly undesirable if information can be passed/leaked from one target computer or device to a different target computer or device. And in many applications where a peripheral is able to be shared via a KVM to connect to computing device that access both classified and unclassified networks, such as in governmental and/or military settings, regulations may be in place that absolutely prohibit information leakage. 
         [0008]    Previous attempts to prevent information from being leaked from a peripheral communicating with one target computer to a different target computer, via a KVM appliance, have been less than fully satisfactory. One such attempt has involved simply preventing the status information from being passed to the shared peripheral (e.g., the user&#39;s keyboard). However, this provides the drawback that the user is not provided with the status information. In some instances, such as where the status information would ordinarily be used to set a Caps Lock indicator on the user&#39;s keyboard, the user would not know that the Caps Lock is turned on. This could present a frustrating situation for the user if the user is required to enter a password into a dialog box having hidden characters, and where some characters of the password are required to be in capital letters or symbols. Other attempts to address this challenge have met with limited success. 
       SUMMARY 
       [0009]    In one aspect the present disclosure relates to a KVM appliance for preventing the passing of status information between a target computer, which is in communication with the KVM appliance, and a peripheral of a user. The KVM appliance may comprise a housing, an indicator supported on the housing, and a main processing unit (MPU) for receiving status information. The MPU may be configured to monitor status information received by it and to determine when the received status information is of a specific type of status information used to set the indicator, which in turn apprises the user of a real time status of a feature of the peripheral. When the specific type of status information is identified as being of the type to set the indicator, the specific type of status information is used to set the indicator to indicate the real time status of the feature to the user of the peripheral. 
         [0010]    In another aspect the present disclosure relates to a KVM appliance for preventing the passing of status information between a target computer in communication with the KVM appliance, and a peripheral of a user. The KVM appliance may comprise a housing, an indicator supported on the housing, and a main processing unit (MPU). The MPU may receive a first code pertaining to status information when a user selects a predetermined feature associated with the peripheral. At least one target processing unit (TPU) may be used for interfacing the MPU with the target computer. The TPU is configured to pass the first code to the target computer and to receive status information including a second code associated with the predetermined feature. The second code is used to set the indicator on the KVM housing. 
         [0011]    In still another aspect the present disclosure relates to a method for preventing the passing of status information between a target computer in communication with the appliance, and a peripheral of a user which is communicating with the target computer via a KVM appliance. The method may comprise using the KVM appliance to detect the presence of a code associated with status information which is at least one of received from the peripheral or received from the target computer, and where the status information is related to a predetermined feature of the peripheral. The method also involves causing the KVM appliance to use the status information to set an indicator on the KVM appliance which provides real time notice to the user that the predetermined feature is active. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0012]    The drawings described herein are for illustration purposes only and are not intended to limit the scope of the present disclosure in any way. In the drawings: 
           [0013]      FIG. 1  is a high level block diagram of a prior art system illustrating how information may be passed back and forth between a user&#39;s keyboard to two target computers (Target Computer  1  and Target Computer  2 ) operating on two different networks, via a KVM appliance; 
           [0014]      FIG. 2  is an illustration of a new secure KVM appliance that incorporates status indicators for “Caps Lock” and other features, so that different types of status information can be visually provided to the user without the need to pass such information to a peripheral that the user is using; 
           [0015]      FIG. 3  is a high level flow diagram illustrating operations that may be performed by the secure KVM appliance of  FIG. 2  to detect and use status information received by it from a target computer to set a status indicator on the KVM appliance, and to prevent the status information from being passed to a peripheral in communication with the secure KVM appliance; 
           [0016]      FIG. 4  is a high level view of a system in accordance with another embodiment of the present disclosure in which a multiplexer is incorporated, and in which the MPU controls the multiplexer to receive a code directly from a selected one of a plurality of target processing units (TPUs), which the MPU then sends to the indicator; 
           [0017]      FIG. 5  is a high level view of a system in accordance with another embodiment of the present disclosure in which a code representing status information is transmitted directly from a selected one of a plurality of TPUs to a multiplexer, which is then controlled by the MPU so that the code is sent directly to the indicator without needing to be handled by the MPU; 
           [0018]      FIG. 6  is a high level flow diagram illustrating operations that may be performed by the KVM appliance, as configured in  FIG. 4 , to use the MPU of the KVM appliance to detect the receipt of the code and to pass the received code on to an indicator to turn on the indicator; and 
           [0019]      FIG. 7  is a high level flow diagram illustrating operations that may be performed by the KVM appliance, as configured in  FIG. 5 , so that the MPU of the KVM appliance is not involved with passing the code to the indicator. 
       
    
    
     DETAILED DESCRIPTION 
       [0020]    The following description is merely exemplary in nature and is not intended to limit the present disclosure, application, or uses. It should be understood that throughout the drawings, corresponding reference numerals indicate like or corresponding parts and features. 
         [0021]    Referring to  FIG. 1  there is shown a prior art system  10  in which two target computers (i.e., Target Computers  1  and  2 ) are in communication with a plurality of peripherals that a user is using. In this example a keyboard  12   a  forms one peripheral, a mouse  12   b  forms another peripheral, and a display terminal  12   c  forms still another peripheral. The peripherals  12   a - 12   c  are connected via a secure KVM appliance  14  (hereinafter “KVM appliance”  14 ) to either of Target Computers  1  or  2 . This prior art arrangement presents the challenge that if either Target Computer  1  or Target Computer  2  sends information to any of the peripherals  12   a - 12   c,  for example to set a Caps Lock LED  18  on keyboard  12   a,  and then the KVM appliance  14  is set to communicate with the other one of the Target Computers  1  or  2 , then stored status information may be passed from the keyboard  12   a  to the newly connected Target Computer (i.e., the other one of Target Computers  1  or  2 ). Effectively, the information transmitted to set the Caps Lock indicator lamp  18  on the keyboard  12   a  is temporarily stored in the keyboard  12   a  and then transmitted (i.e., leaked) to the other Target Computer (i.e., the other one of Target Computers  1  or  2 ), back through the KVM appliance  14 , once the connection is made between the keyboard  12   a  and the other Target Computer. 
         [0022]    Referring to  FIG. 2 , a system  100  is shown in accordance with one embodiment of the present disclosure which eliminates the possibility of information being leaked from the keyboard  12   a  or other peripheral being used to communicate with the Target Computers  1  and  2 . In this example the system  100  takes the form of a secure KVM appliance  100  that incorporates a main processing unit  100   a  (“MPU  100   a ”) and a target processing unit  100   b  (“TPU  100   b ”). The MPU  100   a  runs a non-transitory, machine readable program  100   a   1  stored in a non-volatile memory (not shown). The TPU  100   b  operates to receive information from the user&#39;s peripherals (e.g., keyboard  12   a  and/or mouse  12   b ) and to report the information to one of the two Target Computers  1  or  2 , whichever is selected at the time. 
         [0023]    The KVM appliance  100  also includes at least one status indicator component  102  for indicating a key status of a specific key on the keyboard  12   a.  The MPU  100   a  uses the program  100   a   1  to detect when one or more specific types of information, such as information required to set a status indicator lamp on the keyboard  12   a,  which is the type of information that should not be passed to the keyboard  12   a,  is received by the KVM appliance  100  from a Target Computer. The MPU  100   a  intercepts this information and instead of passing it to the keyboard  12   a,  uses it to set the status indicator component  102  which is associated with the Caps Lock feature of the keyboard  12   a.  In this manner the user is still apprised of the status by simply viewing the status indicator component  102  on a front panel  104  of the KVM appliance  100 , while the KVM appliance  100  prevents the status information from being transmitted to the user&#39;s keyboard  12   a.  In alternative configurations a “Scroll Lock” indicator component  106  may be set, and/or a “Numbers Lock” indicator component  108  may be set, if the user has pressed a “Scroll Lock” key or a “Numbers Lock” key on the keyboard  12   a.  These are merely a few examples of what type of status indicator components may be incorporated on the KVM appliance  100 . Those skilled in the art will appreciate that the status of various other keys of a keyboard, or virtually any other peripheral, such as the mouse  12   b  or display terminal  12   c,  could just as readily be included on the KVM appliance  100  along with a suitable modified program to detect when specific types of information have been received by the KVM appliance  100  to set the appropriate status indicator component. Also, it should be appreciated that while the KVM appliance  100  is only shown with three status indicator components  102 ,  106  and  108 , virtually any number of different status indicators may be provided depending upon how many different types of status one wishes to be able to display on the front panel  104 . 
         [0024]      FIG. 3  is a diagram  200  illustrating in greater detail how the system  10  of the present disclosure works to prevent specific types of information from being passed from a Target Computer (i.e., in this example Target Computer  1 , which is on a classified network) back through the KVM appliance  100  ( FIG. 2 ) to a peripheral that the user is using. In this example the peripheral is the keyboard  12   a  ( FIG. 1 ). Target Computer  1  has received information indicating that some event has occurred. As a result, it sends a CLOC (“Caps Lock On Code”) to the keyboard  12   a  on its own, that is, without having first received a CLDC (“Caps Lock Depressed Code”). The keyboard  12   a  stores the just-received CLOC. At some later point, if the user were to switch the KVM  100  from Target Computer  1  to a different Target Computer, for example, Target Computer  2 , which in this example is on an unclassified network, then Target Computer  2  would read the keyboard status and retrieve the information that the spurious CLOC was received. Even though this is only 1 bit (CapsLock or No CapsLock), information will have been transferred from the classified network to the unclassified network. Other scenarios are possible where a sequence of CapsLock On/ Off messages are sent to transfer larger amounts of data to the peripheral that are later retrieved by a different computer when the peripheral is switched to that computer. CapsLock on messages could be used to represent a ‘1’ and CapsLock off messages used to represent a ‘0’—e.g., Using CLOC/CLFC for On/Off, the sequence (CLFC,CLOC,CLOF,CLOF,CLOF,CLOF,CLOF,CLOC) would represent binary 01000001, which is ASCII character ‘A’. 
         [0025]    Referring further to  FIG. 3 , with the system  10  of the present disclosure, the above action of passing information from one Target Computer to a different Target Computer, via the user&#39;s peripheral, cannot occur. To explain this, consider that at operation  202  the user depresses the CapsLock key  18 . The keyboard  12   a  reports a CLDC having been generated at operation  204 . A main processing unit  100   a  (“MPU  100   a ”) of the KVM appliance  100  then reads the CLDC from the keyboard  12   a,  as indicated at operation  206 . The MPU  100   a  transmits the CLDC to a target processing unit  100   b  (“TPU  1   100   b ”) of the KVM appliance  100  via a suitable bus, in this example a bidirectional serial peripheral interface (“SPI”) bus  100   c.  TPU  1   100   b  reports the CLDC at operation  208  to Target Computer  1  via a suitable bus, which in this example is shown as a USB. It will be appreciated that virtually any other suitable form of bus besides those examples shown in  FIG. 3  may potentially be used. 
         [0026]    At operation  210 , Target Computer  1  processes the received CLDC and sends a CLOC in response, via a USB, back to the TPU  1   100   b.  The TPU  1   100   b  receives the CLOC at operation  212 . The TPU  1   100   b  then sends the CLOC via the serial peripheral interface bus  100   c  to the MPU  100   a.  The MPU  100   a,  using the program  100   a   1 , identifies the received information as the CLOC and then sends the CLOC to the status indicator component  102  as indicated in operation  214 . In this example the status indicator component  102  is an LED, which when illuminated provides a visual indication that the 
         [0027]    “CapsLock” feature of the keyboard is turned on. 
         [0028]    Referring to  FIGS. 4 and 5 , alternative arrangements for detecting the status information are shown. In  FIG. 4 , the MPU  100   a  is in communication with a multiplexer  100   c.  The multiplexer  100   c  is in turn in communication with a plurality of target processing units (TPUs)  100   b   1 - 100   b   3 . The TPUs  100   b   1 - 100   b   3  are independently associated with a plurality of Target Computers  1 - 3 . The Target Computers  1 - 3  may each be operating on separate networks or on only one or two networks. In this embodiment the MPU  100   a  controls the multiplexer  100   c  to select one of the TPUs  100   b   1 - 100   b   3  for communication with at a time. In this example the user has previously selected Target Computer  1  as the computer to communicate with by actuating a selection control (e.g., button) on the KVM appliance  100 . This signals the MPU  100   a  that Target Computer  1  is the computer that the user wishes to communicate with. The MPU  100   a  then knows to select TPU  100   b   1  for use. Now consider that TPU  100   b   1  has received the CLOC from Target Computer  1 . Since the TPU  100   b   1  has been selected for communication by the MPU  100   a,  the CLOC will be passed from the multiplexer  100   c  to the MPU  100   a.  The MPU  100   a  will then transmit the CLOC only to the indicator  102 , which causes the indicator to be turned on. Thus, in this example the MPU  100   a  is used to obtain the CLOC and to pass the CLOC on to the indicator  102  to turn on the indicator. It will be appreciated that the MPU  100   a  could also be used in this embodiment to first receive the CLDC (CapsLock Depressed Code) from the keyboard  12   a,  and then to pass the CLDC to the TPU  1   100   b   1 . However, in the examples of  FIGS. 4 and 5 , only the flow of information toward the MPU  100   a  is being shown (i.e., through the components circumscribed by the dashed line in  FIG. 3 ). 
         [0029]    In  FIG. 5  another embodiment of the system  10  is shown which is somewhat similar to the embodiment of  FIG. 4 , but instead enables the CLOC to be passed directly to the indicator  102  without first being received by the MPU  100   a.  The MPU  100   a  in this example controls two multiplexers  100   c   1  and  100   c   2  to select a specific one of the TPUs  100   b   1 - 100   b   3  for communication with. The CLOC received by the selected TPU is then transmitted directly to the indicator  102  via multiplexer  100   c   2 , which turns on the indicator  102 . Multiplexer  100   c   1  is otherwise used to enable bidirectional communication for all other information with the selected Target Computer. Thus, with this embodiment, the CLOC is never received by the MPU  100   a.  As with the embodiment shown in  FIG. 4 , the embodiment of  FIG. 5  could also use the MPU  100   a  to pass the CLDC received from the keyboard  12   a  on to the selected TPU  1   100   b   1 - 100   b   3 . In an alternative embodiment, the status indicator  102  may instead be provided on a standalone component that is in communication with the KVM appliance  100  via an interface cable. As such, it is not absolutely required that the status indicator  102  be located on the KVM appliance  100 , but it is anticipated that this may be a particularly popular and convenient means for implementing the status indicator  102 . 
         [0030]      FIG. 6  illustrates one example of various operations that may be performed by the KVM appliance  100  for the configuration of  FIG. 4 , where the CLOC is initially passed to the MPU  100   a  and then passed on by the MPU  100   a  to the LED  102 . The MPU  100   a  is used to determine if the received message (“Msg”) is a status indicator. If it is not, then the message is discarded. The determination may be based on a comparison of the received message with one or more stored messages that represent different types of status indications. 
         [0031]      FIG. 7  illustrates an example of various operations that the KVM appliance  100  may perform for the configuration of  FIG. 5 , where the CLOC is not passed to the MPU  100   a.  As is apparent from  FIG. 7 , the MPU  100   a  is not involved with passing the CLOC to the LED  102 ; rather, the MPU  100   a  is only involved with selecting the appropriate TPU  100   b   1 - 100   b   3  to use. With the configuration of  FIG. 7 , the selected TPU (TPU  100   b   1  in the example shown in  FIG. 5 ) would use an internal program similar or identical to program  100   a   1  to determine if the received message indicates a change in the status indicator. The selected TPU would then pass the received CLOC to the MUX  10 , which passes it to the LED  102 . 
         [0032]    The various embodiments of the KVM appliance  100  of the present disclosure thus positively eliminate the chance that status information can be leaked by a peripheral from one computer to another when the KVM appliance  100  is used to switch the peripheral to communicate with a different computer. This capability is expected to further significantly enhance security when a shared peripheral is being used to communicate with computers on two or more networks that have different security levels, and where the ability of the peripheral to leak information between the two networks would be considered a security breach. 
         [0033]    While various embodiments have been described, those skilled in the art will recognize modifications or variations which might be made without departing from the present disclosure. The examples illustrate the various embodiments and are not intended to limit the present disclosure. Therefore, the description and claims should be interpreted liberally with only such limitation as is necessary in view of the pertinent prior art.