Patent Description:
Portable computers are everywhere today. From smart phones to personal computers, organizations are using these platforms for critical security applications. In the course of the work, the user may need to communicate with a network or databases having lower security level without compromising the security of the high-security data.

A secure portable computer device as defined by the preamble portion of claim <NUM> is known from <CIT>. The structures connecting the two computer modules with peripheral devices such as a touch screen and camera comprise external switches, a mode switch, an Input/Output controller and a configuration registry.

<CIT>, titled "Secure KVM device ensuring isolation of host computers", to Softer, discloses a Keyboard Video Mouse (KVM) apparatuses and systems for operating multiple computers from a single console using a secured KVM device, while preventing information leakage between the computers. The system comprises several hosts connected through a secured KVM device to keyboard and mouse and one or more user displays. Secured KVM enables standard bi-directional communication between Secured KVM and user keyboard and mouse and between hosts peripheral ports and Secured KVM. Secured KVM physically enforces unidirectional data flow from attached keyboard and mouse to attached hosts peripheral ports to avoid potential leakages between hosts.

Encryption/decryption modules are commercially available, for example, Raytheon Proteus Cryptographic Module (PCM) is described in
www. com/capabilities/rtnwcm/groups/corporate/documents/image/pcm_ proteus.

<CIT>; titled "Secured audio channel for voice communication"; to Yaron Hefetz; discloses security devices and methods for hindering data theft and data leaks via audio channel of a computer system. The device and method are based on passing the audio signals through a coding vocoder that receives input audio signal from a computer and compressing the signal to a low bit-rate digital data indicative of human speech; and a decoding vocoder that decompress the digital data back to a secure audio signal. The data transfer of the protected audio channel is intentionally limited not to exceed the bit-rate needed to carry vocoder-compressed human speech which is well below the capabilities of unprotected audio channel. Both analog and digital audio ports may be protected. Hardware bit-rate limiter protect the system from software hacking.

Website www. org/wiki/Hardware_restriction discusses hardware security measures such as trusted boot.

Some background information may be found in the following referenced patents and applications:.

The object of the present invention is to provide an alternative portable computer platform having a high level of security.

More specifically the present invention relates to a portable computer that comprises of two completely isolated (the term "Air-Gapped) computer modules. The term "Air-Gapped" is used in the industry to indicate that there is a physical barrier between two sub-units (in contrast to software based logical separation which is vulnerable to hacking). One computer module for Higher-Security applications (referred to as "red"); and the other (referred to as black) for Lower-security applications such as email and internet. The two modules are coupled together to secure Peripheral Sharing Switch (PSS) or Peripheral Sharing Device (PSD) that enables intuitive user interaction while minimizing the security risk resulted from sharing same peripheral devices. Note that Air-Gap is a network security measure employed on one or more computers to ensure that a secure computer network is physically isolated from the unsecured networks, such as the public Internet or an unsecured local area network.

This technical problem is solved by a secure portable computer device comprising the features of claim <NUM>.

For a better understanding of the invention and to show how it may be carried into effect, reference will now be made, purely by way of example, to the accompanying drawings.

With specific reference now to the drawings in detail, it is stressed that the particulars shown are by way of example and for purposes of illustrative discussion of selected embodiments of the present invention only, and are presented in the cause of providing what is believed to be the most useful and readily understood description of the principles and conceptual aspects of embodiments of the invention. In this regard, no attempt is made to show structural details in more detail than is necessary for a fundamental understanding of the embodiments; the description taken with the drawings making apparent to those skilled in the art how the several forms of the invention may be embodied in practice. In the accompanying drawings:.

Before explaining at least one embodiment of the invention in detail, it is to be understood that the invention is not necessarily limited in its application to the details set forth in the following description or exemplified by the examples.

It will be appreciated that certain features of the invention, which are, for clarity, described in the context of separate embodiments, may also be provided in combination in a single embodiment. Conversely, various features of the invention, which are, for brevity, described in the context of a single embodiment, may also be provided separately or in any suitable sub-combination or as suitable in any other described embodiment of the invention.

In discussion of the various figures described herein below, like numbers refer to like parts. The drawings are generally not to scale. For clarity, non--essential elements may have been omitted from some of the drawing.

To the extent that the figures illustrate diagrams of the functional blocks of various embodiments, the functional blocks are not necessarily indicative of the division between hardware circuitry. Thus, for example, one or more of the functional blocks (e.g., processors or memories) may be implemented in a single piece of hardware (e.g., a general purpose signal processor or random access memory, or the like) or multiple pieces of hardware. Similarly, the programs may be stand -alone programs, may be incorporated as subroutines in an operating system, may be functions in an installed software package, and the like.

<FIG> schematically illustrates a portable computer system <NUM> according to the prior-art.

In this figure the portable computer <NUM> is enclosed in compact self--contained plastic or metal enclosure <NUM>. Display module <NUM> is typically a small LCD (Liquid Crystal Display) panel with LED (Light Emitting Diode) or CCFL (Cold Cathode Fluorescent Lamp) backlight. It is typically connected to the main enclosure part using flexible joints or hinges <NUM> to enable display folding on the keyboard/pointing device <NUM>. The keyboard/pointing device <NUM> has a part made of alphanumeric keys and an optional pointing device such as GlidePoint™ (Alps trademark) or other pointing device technology. In some prior-art portable computer the display <NUM> is further equipped with touch-screen or multi-touch function <NUM> that digitizes the user finger locations on the display <NUM>. In some prior-art portable computers the optional keyboard/pointing device <NUM> is omitted and replaced by soft-keyboard displayed on display <NUM> and captured by touch-screen controller <NUM>. In some embodiment of prior-art portable computer, the device <NUM> is further equipped with one or more video cameras <NUM> to enable the user to take video or movies and to support functions such as video conferencing and face recognition.

CPU (Central Processing Unit) <NUM> is a single-core or multiple-core processor or SOC (System On a Chip) that runs the operating system and user applications. CPU <NUM> may be ARM, Intel, AMD or any other processing architecture. It is cooled by cooling device <NUM>. Cooling device <NUM> may be simple heatsink, heatsink with fan, heat--pipe or any other heat dissipation technology that will cool the active parts such as CPU <NUM>, Graphics Processing Unit (GPU) <NUM>, Random Access Memory (RAM) <NUM> and other heat generating components. CPU <NUM> is coupled to LAN (Local Area Network) interface <NUM> that is further coupled through the LAN jack <NUM> and LAN cable <NUM> to the LAN <NUM> through Ethernet cable. CPU <NUM> is further coupled to the wireless LAN or cellular Modem interface <NUM> that is coupled to the wireless LAN antenna <NUM> to enable connection to nearby wireless networks. Commonly, Wi-Fi protocol is used for connecting to nearby wireless networks. Optionally, other wireless protocols, for example Bluetooth are supported.

CPU <NUM> is further coupled to RAM (Random Access Memory) volatile memory <NUM>. This memory may be DDR (Dual Data Rate) <NUM>, <NUM>, <NUM> or any other suitable volatile memory technology. CPU <NUM> is further coupled to the Mass Storage Device (MSD) <NUM>. MSD <NUM> is large capacity non-volatile memory that used to store the operating system, user application, user data and any other permanent data that is stored locally. MSD <NUM> may be electromechanical hard-drive, solid-state flash based, SSD (Solid State Disk) or any other non-volatile memory technology.

CPU <NUM> is further coupled to USB jacks <NUM> and <NUM> that enable the user to connect various standard USB devices such as USB mass-storage device or USB keyboard. Protocols other than USB are used by some manufacturers to connect peripheral devices.

CPU <NUM> is further coupled through internal or external bus such as PCI bus <NUM> to the GPU (Graphic Processing Unit) <NUM>. Video output <NUM> generated by GPU <NUM> is coupled to display module <NUM>.

Audio CODEC <NUM> is coupled to the CPU <NUM> through serial bus <NUM> such as USB or I2S. It plays digital sound through one or more speakers <NUM>. Additionally, audio CODEC <NUM> is connected to microphone <NUM>.

Optionally, portable computer system <NUM> further comprises a user authentication device <NUM> such a biometric sensor (for example fingerprint reader) or smart card reader <NUM> coupled to a smart-card reader or biometric reader arbiter <NUM>.

AC power to charge the battery and to operate the system is connected through AC or DC cord to Power connector <NUM>. Power connector <NUM> is coupled to the power supply and charger <NUM> that coverts the power input into low-voltage DC and adjust the charging current of the coupled battery <NUM>. It should be noted that AC/DC power supply <NUM> may be external to the device <NUM>. In such case, battery <NUM> is coupled to an internal switcher / charger module (not shown here). When AC power is not available, power supply and charger <NUM> is powering the whole system from battery <NUM> power.

Commonly, portable computer system <NUM> comprises a mother board <NUM> which is one or more interconnected Printed Circuit Board Assemblies (PCBAs).

<FIG> schematically illustrates a secure air-gapped portable computer system <NUM> according to an exemplary embodiment of the current invention.

In this figure the secure portable computer <NUM> is enclosed in compact self-contained plastic or metal enclosure <NUM>.

In this embodiment of the current invention the device secure portable computer system <NUM> is divided into four different components or modules:.

In the following figures and discussion, numeral followed by the letter "a" will refer to elements in or related the Red (Higher-Security) module 2a, while same numeral followed by the letter "b" will refer to elements in or related the Black (Lower-Security) module 2a. Numeral not followed by a letter will generally refer to elements common to or associated with both Red (Higher-security) and Black (Lower--Security)e modules, or the corresponding elements belonging to the prior art. This convention is to be understood even if not specifically reflected in the name of an element. It should be understood that the term "Lower-Security" does refer to absence of any kind of security. The Black (Lower-Security) module 2b may have protection means, but it lacks at least some of the security provided by the Red (Higher-Security) computer module 2a.

The modules and components listed about are mechanically attached to create a single portable device <NUM> physically similar to prior-art laptop computer, tablet or smart-phone. It should be noted that enclosure <NUM> may be internally sub-divided to separate the different components. For example, separate components may be radiation shielded from each other.

The Red (Higher-Security) computer module 2a comprises of CPU (Central Processing Unit) 18a. CPU 18a may be x86, ARM, MIPS (Microprocessor without Interlocked Pipeline Stages), RISC (Reduced Instruction Set Computer) or any other single or multiple core microprocessor. For the clarity of the figure the north bridge and south bridge and other processor chipset components were all combined here as a single component 18a. CPU 18a is coupled to RAM (Random Access Memory) 20a. RAM 20a may be Cache, SRAM, DDR (Dual Data Rate) SDRAM, DDR2, DDR3, DDR4 or any other volatile memory technology. RAM 20a may be installed as one or more memory modules or as individual chips. CPU 18a is also coupled to Mass Storage Device (MSD) 21a. Mass Storage Device is non-volatile memory that is used to store the Red (Higher-security) computer 2a data and programs. It may use non-volatile memory technologies such as SSD (Solid State Disk) that uses flash, mechanical hard-drive or any other suitable non-volatile memory technology. Preferably the CPU 18a interface with the Mass Storage Device 21a should support full data encryption for added security. MSD 21a may be optionally coupled to CPU 18a through full-time hardware based disk encryption module of the prior-art (not shown here). Mass Storage Device 21a may be modular (removable) or preferably mechanically fixed for added security.

CPU 18a is further mechanically and thermally coupled to the Cooling device 24a. Cooling device may use cooling fans, heat-pipes, cooling fins, radiators or any other combination of methods to enable efficient cooling of the CPU 18a. CPU 18a power management and Cooling device 24a control is designed to operate continuously at the same noise level to prevent cyberattacks that abuses cooling system noise signature (called Fansmitting).

CPU 18a is further coupled to Higher-Security LAN (Local Access Network) interface 19b to enable wired connection to the high security LAN 4a using Higher-Security LAN cable 103a and Higher-Security LAN jack 104a. LAN interface 19a may comprise MAC (Media Access Controller), PHY (Physical Layer), LAN transformer for isolation and Higher-Security LAN jack 104a. Higher-Security LAN jack 104a is optionally configured to prevent crossed connection of low security LAN 4b cable 103b into the high security interface 19a. Higher-Security LAN jack 103a is optionally RJ-<NUM> type with modified or keyed shape to prevent other standard plugs to fit it.

Alternatively, High security LAN jack 103a is clearly marked, positioned or colored to make it different from low security LAN jack 103b. For example, High security LAN jack 103a may have a cover (not seen in the figure) that needs to be removed or open in order to plug the High-Security LAN cable 103a. Optionally the opening the cover of High security LAN jack 103a has a lock that requires a key to open it.

CPU 18a is further optionally coupled to USB high security filter 16a through USB lines 17a. USB filter 16a is a combination of:.

Alternatively, USB high security filter 16a may comprise:.

<CIT>; titled "USB security gateway", provides more details on possible embodiments for constructing and operating filters 16x.

<CIT>; titled "Electro-mechanic USB locking device", provides details on possible embodiments for securely attaching a filter to an exposed USB jack.

Higher-Security USB Filter 16a host emulator is coupled through USB lines 14a and 15a to the General Purpose filtered High-Security USB jacks 12a and 13a respectively. CPU 18a other USB interface 26a is coupled to the Higher-Security Main Connector 28a of Red (Higher-Security) computer module 2a. Higher-Security Main connector 28a is used to provide all other peripheral device interfaces as well of power to the Red (Higher-Security) computer module 2a.

It should be noted that Main Connector 28x may be divided to few physical connectors such as a power connectors, a video connector, etc. In here, "x" following a numeral may stand for any of the letters a, b, etc. or the absence of a letter to point to identical or similar drawing elements.

CPU 18a is further coupled through interface 31a to a Higher-Security Graphical Processing Unit (or GPU) 27a. This chip or chipset generates the Higher-Security graphic display video output 33a that is coupled through the Higher-Security Module Main Connector 28a, and through the PSS/PSD module <NUM>, to the flat panel display <NUM> to provide user display. Higher-Security GPU 27a may use internal memory or may share the Higher-Security main RAM 20a with the Higher-Security CPU 18a. Display <NUM> is typically TFT (Thin Film Transistor) LCD (Liquid Crystal Display), however, other display technologies may be used. Display <NUM> is preferably or optionally having an optical film to allow visibility only from narrow angles perpendicular to the panel surface for added security.

The Red (Higher-Security) Computer module 2a comprises of Higher-Security power supply 30a that receives one or more low voltage inputs from the PSS/PSD module <NUM> and convert it into multiple low voltage planes that are required to power the CPU 18a, GPU 27a, RAM 20a and all other Computer module 2a power consumers. Power supply 30a is designed to filter (attenuate) digital noise from Red (Higher-Security) Computer module 2a, via the PSS/PSD module <NUM> to the Black (Low-security) Computer module 2b.

The Red (High-Security) Computer module 2a comprises of optional anti-tampering or self-destruction function 35a that is powered from the power supply 30a while device <NUM> is powered up, or by backup battery 32a while device <NUM> is unpowered. Tampering event is being detected by one or more Tampering sensor/s 36a. Tampering sensor/s 36a may comprise:.

Upon detection of tampering event through one or more Tampering sensors 36a, the anti-tampering or self-destruction function 35a will optionally cause a permanent damage to the Secure computer module 2a - for example - completely delete or even destroy the high security MSD 21a.

The Red (High-Security) Computer module 2a is typically running secure Operating System such as Linux Kernel or Android other custom made images or operating systems. Computer module 2a may be further comprising of prior-art trusted-boot and trusted execution software (for example UEFI) or hardware (for example TPM).

Optionally, MSD 21a (and optionally also MSD 21b) is encrypted such that if removed, data within it cannot be recovered without the proper key. Such key may be deleted when tampering event was detected.

The Black (Lower-Security) Computer module 2b is similar to the Red (Higher-Security) Computer module 2a. Thus, some of the similar components will not be discussed herein.

For example, optional filter 16b may be physically similar or identical to 16a, but may be differently configured, and it is intended to protect the module from USB cyber attacks.

The CPU 18b of the Black (Lower-Security) Computer module 2b may run different Operating System (for example Microsoft Windows) and may have different performance specification.

The GPU 27b may be optionally coupled to external display or projector through video output connector 700b. GPU 27a preferably is not connected to an external display support as additional security measure.

Video output connector 700b may be VGA, DVI, HDMI, Micro HDMI, DisplayPort or any other standard video protocol.

Unlike the Red (Higher-Security) Computer module 2a, the Black (Higher-Security) Computer module 2b of the exemplary embodiment of the current invention may not have anti-tampering function.

Unlike the Red (Higher-Security) Computer module 2a, the Black (Higher-Security) Computer module 2b may be equipped with wireless LAN or cellular Modem function 40b that is coupled to antenna 42b. Wireless LAN function 40b may be IEEE <NUM>, Bluetooth, Cellular Modem, LTO or any other wireless voice and data modem.

Both computer modules 2a and 2b are mechanically and electrically coupled to the PSS/PSD module <NUM>. Computer modules 2a and 2b may be separated from the PSS/PSD through fasteners such as thumb screws. This allows modularity and simpler maintenance and support. Such arrangement also enables easier upgrades in case that one or two computing modules should be upgraded.

The PSS/PSD module <NUM> comprises of Host Emulator and Controller function <NUM>. This function emulates the host computer in front of the connected USB HID (Human Interface Device) peripheral devices - the keyboard, touchpad <NUM> and optional touch-screen that is coupled through link <NUM>. The Host Emulator and Controller function <NUM> translate the keyboard, touchpad and touchscreen commands into serial unidirectional data stream that is switched by HID multiplexer <NUM> and data diodes 71a and 71b to HID device emulators 74a and 74b respectively. HID device emulators 74a and 74b translate the unidirectional data stream back into USB HID commands to interface through Module Main connectors 80a and 80b (which mate the Main module connectors 28a and 28b respectively).

Optionally, an external USB jack (or two jacks), not seen in these figures, filtered to accept only an external mouse (or a mouse and a keyboard) may be coupled to Host Emulator and Controller function <NUM> to augment or replace HID <NUM> and/or <NUM>.

USB lines 41a and 41b are routed via Module Main connectors 80a and 80b which mate the Main module connectors 28a and 28b respectively to USB lines 26a and 26b and to CPU 18a and 18b in the routed computer module 2a and 2b respectively.

Red-Black switch <NUM> controls the PSS/PSD module <NUM> channel selection through selection line <NUM> and HID multiplexer <NUM> and video multiplexer <NUM>. When the user wants to interact with the Red (Higher-Security) computer module 2a, Red-Black switch <NUM> is placed at the top position (red). This allow the two multiplexers to switch both HID (keyboard, mouse, touchpad and touchscreen) and video to the Red (High-Security) Computer module 2a. Similarly when the Red-Black switch is placed in the bottom position (Black), the two multiplexers switches both HID (keyboard, mouse, touchpad and touchscreen) and video to the Black (Low-security) Computer module 2b.

AC power to charge the battery and to operate the system is connected through AC or DC cord to Power connector <NUM>. Power connector <NUM> is coupled to the power supply and charger <NUM> that coverts the power input into low-voltage DC and adjust the charging current of the coupled battery <NUM>. It should be noted that AC/DC power supply <NUM> may be external to the device <NUM>. In such case, battery <NUM> is coupled to an internal switcher / charger module (not shown here). When AC power is not available, power supply and charger <NUM> is powering the whole system from battery <NUM> power. Power supply and charger <NUM> powers two different highly-isolated output channels: 55a one powers the Red (Higher-Security) Computer module 2a and 55b powers the Black (Lower-Security) Computer module 2b through Main module connectors 80a and 80b, mating Main module connectors 28a and 28b and power supplies 30a and 30b respectively. Isolation in the power supply charger <NUM> is useful for security to prevent data leakages through power signaling between the two computer modules 2x.

PSS/PSD module <NUM> may be further comprising a Multi-Domain smart-card reader or preferably biometric (fingerprints) reader arbiter <NUM> that is coupled to a biometric sensor and/or card reader <NUM> at one side and to the two HID Device emulators 74a and 74b. The two HID Device emulators 74a and 74b are optionally configured also as a biometric reader device emulator to support the biometric sensor <NUM>.

<CIT>; titled "User authentication device having multiple isolated host interfaces", provides more details on possible embodiments for constructing and operating devices for enabling a user to use a single user authentication device such as smart-card reader, such that the user is capable of securely interfacing with two or more isolated computers and enabling the user to authenticate and remain authenticated at multiple computers at the same time.

<FIG> schematically illustrates another secure air-gapped portable computer system <NUM> according to an exemplary embodiment of the current invention.

In this exemplary embodiment, the portable computer system <NUM> PSS/PSD module 82a is similar to PSS/PSD module <NUM> of <FIG> above but is having video processor <NUM> (FPGA, ASIC or microcontroller) and video memory <NUM>.

Host emulator <NUM>, connected to video processor <NUM> via channel <NUM> may serve as system controller for performing mouse tracking function, and control keyboard signaling, for controlling video processor <NUM> for selecting active windows on display <NUM>, creating, closing, sizing and moving windows on display <NUM>, etc..

<CIT>; titled "Isolated multi-network computer system and apparatus", provides details on possible embodiments for securely controlling a shared single display, using a video switch or a video combiner, while preventing any possible information leakage between two hosts.

<FIG> schematically illustrates screens of the programming software utility screen <NUM> used for configuring of USB filters 16x within a secure air-gapped portable computer system according to an exemplary embodiment of the current invention.

This screen <NUM> is presented on the display <NUM> to enable configuration and monitoring of the USB filters 16x within device <NUM> or <NUM>. It can be implemented as a program running locally at the corresponding module 2x. Optionally, filter 16b in black module 2b is left open to all devices, or entirely missing. Each filter 16x may have a separate filtering configuration. Additionally and optionally, different USB ports, for example 12a and 13a (and/or 12b and 13b) may be configured differently and may be associated with a separate screen <NUM>. Alternatively, designation may be done using column <NUM> as detailed below.

Screen <NUM> is divided into <NUM> main areas:.

To access screen <NUM>, the user activates the security application. The user or administrator would need a specific password to interact with the security application. Once password is authenticated and the programmer is authenticated the current device policy will appear in this screen.

Optionally, means to prevent a user from modifying the configurations of filter 16a (and optionally also 16b) are implemented. For example, only privileged "super user", may make such modifications, or an external programming device is needed (e.g. inserted in the USB jack, or into a proprietary programming jack, not seen in these figures), or the lists for 16a are factory installed and non-updatable.

Due to the separation of red and black modules, the administration application is preferably duplicated and run separately for red and black modules.

The user/administrator may enter new lines or drag and drop lines between the three areas-white-list, black-list and device read.

When entering a new line, the user/administrator may specify the following parameters (line number <NUM> is entered automatically by the system):.

A notation convention is used, for example module (or jack) designation from left to right.

Note that in each textual input field "*" may be entered to indicate wild-card.

Screen <NUM> may be used for creating, displaying, or modifying the parameters in an authorization matrix associating authorized devices to the modules 2x and to directions of data flow.

Preferably, the parameters of authorization matrix (specifically for red module 2a) may not be accessed via black module 2b as this module may not be trusted to be un-infected with hostile codes or otherwise compromised. Similarly, a device connected to a jack 12x or <NUM> may not be trusted to be un-infected with hostile codes or otherwise compromised.

<FIG> schematically illustrates an exemplary embodiment of the current invention <NUM> similar to the embodiment <NUM> shown in <FIG> above.

In this embodiment of the current invention <NUM>, the device is further equipped with a Red-Black crypto module <NUM>. Red-Black crypto module <NUM> allows red messages, voice and video to be sent and received in encrypted format over the black wireless or cellular modem 40b and antenna 42b. Red-Black crypto module <NUM> may have a battery <NUM> to support functions such as log, anti-tampering, secret key storage, etc. Red-Black crypto module <NUM> may be coupled to the Red (Higher-Security) computing module 2a LAN Interface 19a through LAN or RGII or SGMII interface 108a and it may be coupled to the Black (Lower-Security) computing module 2b LAN Interface 19b through LAN or RGII or SGMII interface 108b. Optionally Red-Black crypto module <NUM> may be coupled to the two computing modules 2x through high-speed USB link or through any other suitable serialized interface. Red-Black crypto module <NUM> may be for example Raytheon Proteus Cryptographic Module (PCM) or other similar products.

<FIG> schematically illustrates the audio security circuitry of a secure air-gapped portable computer system according to an exemplary embodiment of the current invention.

To reduce cluttering, this optional audio security circuitry was omitted from <FIG>, <FIG> and <FIG>. Some details of PSS/PSD 82c are illustrated in this figure. It should be noted that features and configurations from all PSS/PSD 82x may be combined.

Each module 2x comprises a corresponding audio CODEC 53x which generates a corresponding CODEC audio output <NUM>× and receives a corresponding CODEC audio input 120x. Audio CODEC 53x is coupled to the corresponding CPU 18x, for example via serial bus 26x.

CODEC audio outputs 121a and 121b are joined, or one of them is selected by audio out mux <NUM>. The output of audio out mux <NUM> is passed through audio out data diode <NUM>, amplified by audio out amplifier <NUM> and is heard by the user via speaker <NUM>.

Optionally, audio out amplifier <NUM> is designed to have low output to input signal coupling, and thus may be used as an audio out data diode <NUM>.

Optionally, additionally or alternatively, a back-to-back coding vocoder-decoding vocoder, as disclosed in <CIT> may be added or replace audio out data diode <NUM>.

Audio in signals from microphone <NUM> are amplified by audio in amplifier <NUM>, optionally passed through audio in diode <NUM> and fed to audio input mux <NUM>. An audio in mux <NUM> selects one of CODEC audio inputs 120a or 120b such that one of audio CODEC 53a or 53b receives the signals from microphone <NUM> at a time.

Optionally, audio in amplifier <NUM> is designed to have low output to input signal coupling, and thus may be used as an audio in data diode <NUM>.

Optionally, additionally or alternatively, a back-to-back coding vocoder-decoding vocoder, as disclosed in <CIT> may be added or replace audio in data diode <NUM>.

Audio command line <NUM> controlling audio in mux <NUM> and audio out mux <NUM> such that the both audio out and audio in signals are coupled to same module 2x at a time. Preferably, audio command line <NUM> is controlled by Red-Black switch <NUM>, or audio switch 96a. Optionally, additionally or alternatively, Host Emulator and Controller function <NUM> controls audio in mux <NUM> and audio out mux <NUM> via channel 87a.

It should be noted that control of audio source may be independent of the video control, but due to security it is preferable that both audio input and audio output are coupled to the same module 2x to avoid air-gap bridging by audio signals (for example audio output from speaker <NUM> may be peaked up by microphone <NUM>).

As used herein, the term "computer", processor or "module" may include any processor-based or microprocessor-based system including systems using microcontrollers, reduced instruction set computers (RISC), application specific integrated circuits (ASICs), logic circuits, and any other circuit or processor capable of executing the functions described herein. The above examples are exemplary only, and are thus not intended to limit in any way the definition and/or meaning of the term "computer".

The computer or processor executes a set of instructions that are stored in one or more storage elements, in order to process input data. The storage elements may also store data or other information as desired or needed. The storage element may be in the form of an information source or a physical memory element within a processing machine.

The set of instructions may include various commands that instruct the computer or processor as a processing machine to perform specific operations such as the methods and processes of the various embodiments of the invention. The set of instructions may be in the form of a software program. The software may be in various forms such as system software or application software. Further, the software may be in the form of a collection of separate programs or modules, a program module within a larger program or a portion of a program module. The software also may include modular programming in the form of object-oriented programming. The processing of input data by the processing machine may be in response to operator commands, or in response to results of previous processing, or in response to a request made by another processing machine.

As used herein, the terms "software" and "firmware" are interchangeable, and include any computer program stored in memory for execution by a computer, including RAM memory, ROM memory, EPROM memory, EEPROM memory, and non-volatile RAM (NVRAM) memory. The above memory types are exemplary only, and are thus not limiting as to the types of memory usable for storage of a computer program.

Claim 1:
A secure portable computer device (<NUM>) comprising:
a higher-security computer module (2a), for performing higher-security operations;
a lower-security computer module (2b), for performing low security operations;
a secure KVM (Keyboard Video Mouse) switch (<NUM>), interfacing said higher-security computer module and said lower-security computer module to a keyboard, a pointing device (<NUM>) and a display (<NUM>), while preventing data flow from said higher-security computer module (2a) to said lower-security computer module (2b); and
an enclosure (<NUM>), for enclosing at least said higher-security computer module (2a), said lower-security computer module (2b), and said secure KV M switch (<NUM>), wherein said enclosure (<NUM>) is sized to be used as a portable computer to be carried by a user,
characterized in that
said secure KVM (Keyboard Video Mouse) switch, having
a host emulator and controller function (<NUM>) interfacing with said keyboard and pointing device (<NUM>),
for each of said computer modules (2a, 2b), a human interface device emulator (74a, 74b) and a data diode (71a, 71b), respectively, and
a human interface multiplexer (<NUM>),
wherein said host emulator and controller function (<NUM>) is configured to emulate the host computer in front of a connected keyboard and pointing device (<NUM>) and to translate keyboard and pointing device commands into serial unidirectional data stream that is switchable by the human interface multiplexer (<NUM>) to the human interface emulators (74a, 74b), respectively, via the corresponding data diode (71a, 71b).