Patent ID: 7428754

Claim:
A system for secure computing by a user at a client communication network communicating with at least one of a plurality of remote data centers respectively coupled to a corresponding one of a plurality of data center communication networks, the system comprising: a defense-in-depth architecture, including: at least one client computing device providing a local user interface on the client communication network to said at least one of the plurality of remote data centers; said at least one client computing device being adapted for: executing on a local processor and in a local memory thereof an embedded operating system and an embedded set of computer applications, prohibiting local execution of any computer applications other than said embedded operating system and said embedded set of computer applications, prohibiting persistent storage in said local memory of any user data and of any data produced by said embedded set of computer applications, and prohibiting alteration of any operating parameters of said embedded operating system; public key infrastructure means for authenticating identities of the user and of said at least one client computing device to a remote data center to which access by the user is requested, said public key infrastructure means including: a client domain services system coupled to said client communication network to receive the identity of said at least one client computing device inalterably stored thereon and to authenticate said at least one client computing device to said client communication network upon successful authentication of said identity of said at least one client computing device, said client domain services system being prevented from remote access by entities outside said client communication network, said access to said remote data center being granted only upon successful authentication of said both identities of the user and said at least one client computing device; virtual private networking means for: establishing a virtual private network between said at least one client computing device and one of the plurality of data center communication networks only upon said successful authentication to a corresponding one of the at least one of the plurality of remote data centers coupled thereto; conducting network data packets respectively between said at least one client computing device and a corresponding one of the plurality of data center communication networks respectively over a corresponding one of a plurality of said virtual private networks; and encrypting said network data packets via a predetermined encryption algorithm; and server-based computing means for: remotely executing computer applications at said at least one of the plurality of remote data centers; and transmitting execution status of, and receiving user input to, said computer applications via said local user interface, said execution status being transmitted, and said user input being received, only over said corresponding one of said plurality of virtual private networks.