AU2005248713A2 - Isolated multiplexed multi-dimensional processing in a virtual processing space having virus, spyware, and hacker protection features - Google Patents

Description

WO 2005/116804 PCT/US2005/001484 ISOLATED MULTIPLEXED MULTI-DIMENSIONAL PROCESSING IN A VIRTUAL PROCESSING SPACE HAVING VIRUS, SPYWARE, AND HACKER PROTECTION FEATURES RELATED APPLICATIONS This application claims the benefit of priority under 35 U.S.C. 120 to U.S. Utility Patent Application No. 11/022,290 entitled "Isolated Multiplexed Multi-Dimensional Processing In A Virtual Processing Space Having Virus, Spyware, And Hacker Protection Features", filed 23 December 2004; and to, U.S. Utility Patent Application No. 10/760,131 filed 15 January 2004 and PCT/US2004/33955 filed 13 October 2004 both entitled "Computer System Architecture And Method Providing Operating- System Independent Virus-, Hacker-, And Cyber-Terror-lmmune Processing Environments"; both naming Kenneth Largman, Anthony B. More and Jeffrey Blair as inventors, and each of which applications is hereby incorporated by reference.

FIELD OF INVENTION This invention relates generally to security and anti-viral, anti-hacker, and anti-cyber terror features for computers, information appliances, mobile communication devices, and to other electronic devices; and more particularly to computers, information appliances, mobile communication devices and other electronic and computing devices supporting security and anti-viral, anti-hacker, and anti-cyber terror features that generate multiple concurrent or sequential temporal processing environments and procedures and programs that prevent malicious code that may be present within the device from affecting the system or other user or program data.

BACKGROUND

When based on the prior art, computers, cell phones, and a wide spectrum of devices that use computer or processor technology are vulnerable to computer hackers, viruses, cyber-terrorists, spyware, and/or other malicious or harmful computer program code. While anti-virus software is known, such anti-virus software frequently becomes obsolete with each new virus that is written and released.

Furthermore, at least some damage will usually be done to some computers during the initial stages of such release. Use of firewalls and other protective measures are also known, however, firewalls are generally not integrated into portable computers or portable computers operating over a public network outside of a corporate Information Technology (IT) environment, and a number of hacking techniques exist to defeat such firewalls in any event. The world-wide cost of damage from computer viruses, spyware, and hacking each year has been estimated to run into the tens of billions of dollars. More significantly with the ever increasing reliance on computers to control and maintain operation of airtraffic, transportation systems, building environmental control, stock markets, telephone systems, nuclear-power plants, and other public and private infrastructure, the potential harm from such malicious code goes beyond any monetary assessment.

What is needed is an architecture, system, and operational methodology that provide a measure of immunity from computer hacking, viruses, spy-ware, cyber-terror attacks, and the like, malicious activity. In a sense there remains a need for a universal vaccine against such malicious agents. There also remains a need for a computer that, unlike conventional computers that enable the user to initiate "repairs" on demand by reverting to known clean installation of operating system and application program software and/or data, resets or erases memory and data stores to create a known clean or sterile storage environment prior to opening files or data sets.

WO 2005/116804 PCT/US2005/001484 -2- BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 illustrates a laptop computer or other computing system, according to the prior art.

FIG. 2 illustrates a laptop computer system or other information appliance incorporating one embodiment of the present invention.

FIG. 3 illustrates a schematic diagram of an architecture and system for supporting multiple independent computing environments, according to one embodiment of the present invention.

FIG. 4 illustrates a diagrammatic flow chart of an embodiment of a method for using an embodiment of the present invention.

FIG. 5 illustrates a diagrammatic flow chart of an embodiment of a method for initiating computing environments.

FIG. 6 illustrates a diagrammatic flow chart of an embodiment of a method for configuring one or more switch systems of computing environments.

FIG. 7 illustrates an alternative embodiment of the invention including special purpose subsystems or computing environments and a common controller.

FIG. 8 illustrates another alternative embodiment of the invention.

FIG. 9 illustrates an embodiment of yet another alternative embodiment of the inventive architecture and system.

FIG 10 illustrates an embodiment of yet another alternative embodiment of the inventive architecture and system.

FIG, 11 illustrates an additional embodiment of the invention having a combined control computing environment and at least one isolated computing environment for user processing.

FIG. 12 illustrates an embodiment of the inventive architecture and system that provides a single physical computing environment but that can support a plurality of logical or virtual computing environments using intermittent access and temporally separated allocation of components and access.

FIG. 13 illustrates another embodiment of the inventive architecture and system configuration according to aspects of the invention.

FIG, 14 illustrates an embodiment of a interface card embodiment of the invention such as a PC Card implementation.

FIG. 15 illustrates an embodiment of the PC Card embodiment of FIG. 14 showing connectivity between the PC Card and peripheral bus, host bus, and host processor.

FIG. 16 illustrates aspects of dynamic configuration and component switching and connectivity within an embodiment of the invention.

FIG, 17 illustrates aspects alternative aspects of dynamic configuration and component switching and connectivity within an embodiment of the invention, FIG, 18 illustrates further features of an embodiment of the invention including how the inventive computing environment may couple multiple keyboards and mice and provide for multiple separate sets of layered video.

FIG, 19 illustrates an embodiment of a processing system configuration in which processing or computing environments are maintained in isolation from processor inputs and processor outputs.

FIG. 20 illustrates an embodiment of an N-dimensional virtual processing space having a WO 2005/116804 PCT/US2005/001484 -3plurality of virtual and physical processing or computing environments.

FIG. 21 illustrates an embodiment of a method for maintaining isolation between inputs and a processor.

FIG. 22 illustrates a particular embodiment of a system, device, and architecture for performing temporal multiplexing of a plurality of processes in a physical or virtual processing environment that may have only one processor.

FIG. 23 illustrates an embodiment of another system for maintaining a controlled degree of isolation between a plurality of processing in a computer.

SUMMARY

This invention provides security and anti-viral, anti-hacker, and anti-cyber terror features, and can automatically create multiple sequentially or concurrently and intermittently isolated and/or restricted computing environments to prevent viruses, malicious or other computer hacking, computer or device corruption and failure by using these computing environments in conjunction with restricted and controlled methods of moving and copying data, combined with a process that destroys malicious code located in computing environments and data stores.

In one embodiment, the invention provides an information appliance architecture, system, device, and methods for configuring and operating are provided. An information appliance of the type having first storage for programs and data, and processor logic and executing computer program instructions to perform a task involving a user data; the information appliance operating so that separate control processing environments and user processing environments are created and maintained such that: user data having unknown or untrusted content is not exposed in the control processor logic environment to computer program code that can execute any computer program code instructions imbedded in the user data; and user data having unknown or untrusted content is only exposed in the user processor logic environment in a temporary storage different from the first storage when isolated from first storage.

In another embodiment, the invention provides an information appliance having at least one processing logic device for executing at least one instruction; a first storage for storing first data and first program code including the at least one instruction and including a user data; a second storage for storing second data; a switching system for selectably and independently coupling and decoupling the processing logic device with the first storage and/or the second storage under automated control, the switching system receiving at least one control signal from the processing logic device for selecting a condition of the switching system; where the processing logic device operating in a control configuration and in a user data configuration according to the following conditions: the processing logic device may be coupled with the first storage when the processing logic is loaded with a program instruction not capable of executing a data item that has untrusted content or that did not originate within a known controlled environment; (ii) the processing logic device may not be coupled with the first storage when the processing logic is loaded with a program instruction that may be capable of executing a data item that has untrusted content or that did not originate within a known controlled environment; (iii) the processing logic device may be coupled with the second storage when the processing logic is loaded with a program instruction that may be capable of executing a data item that has untrusted content or that did not originate within a known controlled environment; and (iv) the processing logic device may WO 2005/116804 PCT/US2005/001484 WO 205/11804 CTIUS005!044- -4be coupled with the first storage and the second storage when the processing logic is loaded with a program instruction that is only capable of copying a data item from the first storage to the second storage or from the second storage to the first storage. A method of configuring and operating the information appliance is provided.

Embodiments of the invention provide for selecting, configuring, switching, and/or multiplexing multiple processes in physical an/or virtual processing or computing spaces to create physical and/or virtual processing or computing environments. In one particular embodiment, temporal multiplexing of a plurality of processes is provided in a manner that maintains isolation between processes so that a problem in one process (such as execution of a program virus) need not have any impact on another process or on stored programs or data. Isolation may also be selectively overridden by a trusted administrator using trusted architectural and program elements.

Embodiments of the invention may be applied to a variety of electronic devices and information appliances such as ones selected from the set including, but not limited to: any device incorporating a processing or computing logic, computer, notebook computer, personal data assistant, personal data organizer, cellular telephone, mobile telephone, radio receiver, radio transmitter, GPS receiver, satellite telephone, automobile on-board computer, aircraft on-board computer, navigation device, home appliance, printing device, scanning device, camera, digital camera, television receiver, broadcast control system, electronic instrument, medical monitoring device, security device, environmental control system, process monitoring or control system, and any combinations of these.

DETAILED DESCRIPTION OF EMBODIMENTS OF THE INVENTION This invention relates generally to computers, information appliances, mobile communication devices, cellular and mobile telephones, personal data assistants (PDAs), music storage devices and players, data organizers, hybrid devices incorporating these functional elements, and to other electronic systems and devices. It relates even more particularly to such systems and devices that provide security features and anti-viral, anti-hacker, and anti-cyber terror features; and even more particularly to such devices that can automatically create multiple sequentially or concurrently and intermittently isolated and/or restricted computing environments to prevent viruses, malicious or other computer hacking, computer or device corruption and failure by using these computing environments in conjunction with restricted and controlled methods of moving and copying data, combined with a process that destroys malicious code located in computing environments and data stores.

In the present invention, these needs are satisfied by providing an architecture, system, and approach and method of operation for computing devices and other information appliances. This new approach results in computers and information appliances that are inherently immune to hacking and viruses and other malicious agents and code. Additionally, unlike computers that enable the user to initiate "repairs" on demand by reverting to a prior backup of the software, embodiments of the inventive architecture, system, and methods reset or erase memory and data stores, prior to opening each file to maintain known clean or sterile storage and processing environments., For example, using this new technology, data storage may be automatically reformatted or erased, and memory may be cleared or reset after each and every time a computing environment is or may have been exposed to un-trusted or unknown code, prior to moving or opening a new file in that computing environment.

It will be understood in the context of the architecture, system, and method that embodiments WO 2005/116804 PCT/US2005/001484 of the invention provide intermittently sequentially isolated, and/or communicatively restricted, computing environments that are created, operated, and terminated by an automated control system.

Different levels of isolation and/or levels of security or immunity from malicious code may be implemented according to the needs of the computing environment and/or of the device incorporating or using the computing environment.

This section describes architectures, systems, apparatuses, methods, and computer programs and computer program products for protecting computers and computing devices from hacking, viruses, cyber-terrorism, and from potential damage or intrusion such as spy software (spy-ware), keystroke recorders and damage from hacking, viruses, worms, Trojan horses, and similar threats and vulnerabilities. Cyber-terrorism is an attempt to cripple or subvert a computing system, such as for example, by an attack that originates by an attempt at unauthorized access to a user's private data.

The present invention provides a solution to potential cyber-terrorism.

A computer system of the prior art typically includes: a processor, memory, display, a display controller, and input/output controller. The present invention provides a plurality of special-purpose subsystems (physically or temporally separated) housed within a computer system (or other device) housing or case. These special-purpose subsystems typically perform limited functions and have limited interaction with other special-purpose subsystems.

General- or special-purpose subsystems (also referred to in some embodiments as "isolated processing unit", "isolated computing environments", or more simply as "computing environments" sometimes further characterized by a functionally descriptive adjective) may be designed for many purposes, including to support storing information, performing work, and handing communication.

It is also to be noted that computing environments and components of such computing environments may be modular and dynamically configured so that the specific defective component and/or computing environment can be taken out of service by a controlling entity, such as a CSCE or CCE computing environment, until the defective component or set of components comprising a computing environment are swapped out for a working part or repaired. An optional diagnostic process of attaching components (such as via one or more switches or otherwise) and testing and removing components can be performed in order to identify and isolate the problem.

Aspects of computing environments are now described. This description is somewhat generalized owing to the broad range of specific embodiments and physical implementations that may be realized. A computing environment may execute one or more computer program instruction. One or more computing environments may be coupled with a computer system. The computing environment may be represented by a physical representation, a logical representation, and/or a combination of physical and logical representations. In a physical representation, the computing environment may incorporate a number of physical computer components, such as, for example, a central processing unit (CPU), one or more memory, and one or more peripheral. In a logical computing environment representation provides that a first computing environment may coexist with other computing environments by utilizing one or more common computing components. The first computing environment is isolated from the other computing environments such that communication is supported between the first computing environment and the other computing environments that might communicate a virus, hacker, or other intentionally or accidentally malicious code or data. For WO 2005/116804 PCT/US2005/001484 -6example, in one embodiment there is only indirect communication of a limited set of information. In another embodiment, there may be direct communication but such communication may be limited in specific ways, such as to permit only authorized data types and amounts, such as window screen coordinates, mouse position coordinates, or other data types and amounts as are described in additional detail herein. Filters or limiters may be used to limit the communication between the first computing environment and the second or other computing environments. In some embodiments these filters and/or limiters are hardware circuits that cannot be corrupted by malicious code, in other embodiments software and/or firmware may be used for such filtering or limiting, and in other embodiments hybrid hardware-software/firmware filters and/or limiters may be used. Each computing environment is typically capable of performing processing activities including receiving input from one or more peripheral through the 1/O switch system, and sending output to one or more peripheral through the I/O switch system. The processing activity performed by one computing environment is typically independent of the processing activities of another computing environment. According to one embodiment of the present invention, a potentially malicious processing activity of one computing environment does not directly interfere with the processing activity of another computing environment.

According to one embodiment, an isolated computing environment and other physical or logical computing environments may exist in different address spaces that correspond with a computer system. Consequently, each physical or logical computing environment is isolated from the operation of each of the other logical computing environments. Furthermore, one should appreciate that a variety of configurations may be used for managing the creation and operation of multiple logical computing environments. Furthermore, one should also appreciate that an operating system, (such as for example Linux, Macintosh, Microsoft Windows and/or other operating system), may correspond with a logical computing environment, a physical computing environment, and/or a combination of logical and physical computing environments.

A controlling computing environment may be selected from the computing environments for configuring and/or reconfiguring the data store switch system configuration and/or the I/O switch system configuration. The data store switch system configuration may support communication between the control computing environment and the protected data store, as described above. According to one embodiment of the present invention, an initial boot sequence may identify initial configuration information within the computer CMOS data to identify the control computing environment, the protected data store, and initiate configuration of the data store switch system configuration and/or the I/O switch system configuration.

One or more user computing environment may be selected from the computing environments to perform computer processing in isolation from the controlling computing environments and other user computing environments. Data (such as computer files) may be received by the user computing environment through a data store that may be communicatively coupled with the user computing environment. According to one embodiment, the controlling computing environment that may be communicatively coupled with a first data store that may include user information and a protected data store that may also include user information. The controlling computing environment is configured to support copying information between the protected data store and the first data store. After the controlling computing environment initializes the first data store then the first data store may be WO 2005/116804 PCT/US2005/001484 -7communicatively de-attached from the controlling computing environment and then attached to the user computing environment for use independent of other computing environments. After the user computing environment completes an activity (such as for example, editing a file, receiving email, etc.) then the first data store may be communicatively de-attached from the user computing environment and attached to the controlling computing environment. Again, the controlling computing environment is configured to support copying information between the protected data store and the first data store.

Consequently, data may be saved independently of the processing activities of the user computing environment. Accordingly, malicious code being processed within a user computing environment does not corrupt other files and/or data stored on a protected data store.

In one embodiment, sophisticated processing capability such as processing capability that might provide a capability to execute malicious computer program code or software, is selectively and intermittently removed when only a copy operation. The sophisticated processing or process itself is switched out of accessibility or disabled in response to a signal from the controlling entity during the copy operation and then re-enabled when the operation is completed. This operation may for example be used for file save operations, or when copying data or master templates to computing environment.

Returning to a description of other features we note that in one embodiment, a storage specialpurpose subsystem or computing environment (or protected storage computing environment) may be designed to store data and retrieve data, while allowing limited access to the stored data. A working special-purpose subsystem (also referred to as a isolated processing unit computing environment) may be designed to process information to achieve the same result as in a general purpose computer with various applications, but at the same time protecting the system as a whole and the user's data from loss or corruption. A communication special-purpose subsystem (or control and switching computing environment) may be designed to facilitate communication between other special-purpose subsystems or computing environments.

Each special-purpose subsystem or computing environment typically may include, depending upon the processing to be accomplished, one, some combination, or all of a: processing capability, memory, logic, and an interface for coupling for communication the special-purpose subsystem or computing environment with another (internal or external) component. Processing capability may be a computer processing unit (CPU) of some type or ASIC. The processing capability may be the computer-system CPU, or a CPU shared by multiple special-purpose subsystems. Thus, the processing capability associated with a special-purpose subsystem may also be used by the computer system or other special-purpose subsystems.

Exemplary features and aspects of the invention are first described to provide at least a partial orientation to the architecture, features, and advantages of the invention. This section is followed by even more detailed descriptions of several exemplary architectures and structural topologies so that both the broad scope of the invention and particular structural and methodological implementations are more readily understood.

Various embodiments of this invention provide concurrent and/or intermittent and sequential or temporal (time) isolation, and/or restriction of: processing or computing environments, data storage and processes, and communication. In at least some embodiments, this isolation and/or restriction is combined with erasure, reformatting, resetting or other sterilization of a previously used processing or WO 2005/116804 PCT/US2005/001484 -8computer environments prior to using that computing or processing environment for a later operation, such as before opening another file or data set for an operation.

In one embodiment, a computer system or other device incorporating a computing system or capability can be provided with a new type of self repairing feature on the basis that sequentially and automatically erasing/re-setting and copying all or part of a master template prior to each time a new file is opened can either repair the computer or prevent failure in the first instance.

In one exemplary embodiment, user data is stored in one or more concurrently or intermittently sequentially isolated and/or restricted data stores and/or intermittently isolated and/or restricted protected computing environments. Herein, a protected data store or stores or protected computing environment(s) may be referred to as Protected Data Storage (PDS). Protected Data Storage may store any kind of data such as user data and files, application program code programs or applets, operating systems or portions thereof, device drivers, status or state information, or any other information of whatever type.

While the structure, organization, and stored content of a protected data store or more generally protected store may vary from system to system, some features that may be present (including some optional features) are now described relative to one embodiment. A protected data store represents a data store that is used for storing information in a manner that prevents the data (any data including but not limited to user data, computer program code, email, web pages, instructions, operating system code, or any other set or collection of binary bits in that data store from being executed. Therefore the data is not exposed to a processing environment that typically performs processing or operations on the stored data or information based on the contents of the store information. This same isolation from exposure may also be applied during data and software copy operations so that any malicious code contained therein cannot be executed until it is in an isolated computing environment where exposure to an executing capability will at most contaminate that particular computing environment but be contained in isolation.

According to one embodiment of the present invention, a user file (such as, for example, a user's word processing document, e-mail, spreadsheet, Microsoft Outlook or other contacts file, password, cell phone telephone number list, PDA stored data, or any other user data or program) may be stored on a protected data store. In one embodiment the protection is achieved by storing the data in a protected store so that it is not accessible by any structure or process that can cause execution of malicious code or binary sequences such as may be present in a virus, robot, hacker code, or other malicious code. Ideally, user operations such as edits of the corresponding work processing document or opening and review of the email message (and any attachments thereto) are performed on a copy of the original data independently of the original version of the document that is stored on the protected data store and in a location within the computer (or other electronic device such as a PDA, cell phone, analog or digital camera, or other information appliance). The separation of the protected storage of an original file or data set and the storage and operation on a copy of the file or data set is described in greater detail elsewhere herein. In this context is may be appreciated that separated from a processor capable of executing viral or other malicious code, such code is simply a collection of and bits that will not be problematic even if it is stored on the data store or moved or copied from one data store to another data store.

WO 2005/116804 PCT/US2005/001484 -9- One or more of the inventive data stores may be used to define a protected data store. Multiple protected data stores may optionally be defined but are not typically needed. According to one embodiment of the invention, the protected data store may be used to store the user data or other files (possibly including computer application program, operating system, and other non-user code or data) independently of a processing environment that may modify the user file. It is noted that the master template may be one type of non-user data that is stored in a form of protected storage. This may alternatively be referred to as protected master template store.

According to one alignment of the present invention, a user's decision to edit the document causes the original version of the document to be copied from the protected data store to a second data store. A user computing environment that can be coupled with the second data store for editing the original document may be used to create a second version of the document. An action by the user, such as, for example, saving the second version of the document, generates a series of instructions that copies the second version of the document from the second data store back to the protected data store. Copying the second version of the document back to the protected data store may overwrite the original version of the document.

The structure and procedure for storing and retrieving binary data from protected data store and/or from protected master template store, and how operation on this protected information processed in the computing system without subjecting the data that may contain malicious code or data stored on the same storage device or within the same computer system is described in greater detail elsewhere in this specification.

Returning now to the description of the system, it is by means of switching communication that a Control Computing Environment concurrently or intermittently isolates and/or restricts communication with the Protected Data Storage as needed to protect the Protected Data Storage from the processing or execution of code that may occur of unknown and potentially malicious code. A directory of the data on the Protected Data Store may be created for example by a Control Computing Environment or a Protected Storage Computing Environment (see further description of these particular computing environment configurations herein elsewhere), and this directory may be communicated to a (concurrently or intermittently) isolated and/or restricted computing environment, such as for example a Desktop Computing Environment. Embodiments of these Control Computing Environments, Protected Storage Computing Environments, and Desktop Computing Environments, as well as other computing environments are described in greater detail elsewhere in this specification and in the drawings. Note that in one embodiment the directory is made by a Protected Storage Computing Environment that may contain limited processing abilities. For example it may contain functionality to read and write ASCII and extended ASCII filenames and directories, and may contain the ability to copy and move data, and may contain the ability to create a file directory, but may generally not contain many other functions or capabilities that would be required to recognize or execute code or perform other functions that might be harmful to system, program, or data integrity. This information may be collected by the Control Computing Environment or sent to the Control Computing Environment by the Protected Storage Computing Environment.

It should be noted that in at least one embodiment of the invention, one, more than one, or any combination of the following structures and/or procedures may be combined into one computing WO 2005/116804 PCT/US2005/001484 S environment configuration and/or process and that these may be predetermined or dynamically determined and configured: control environment, protected storage, desktop environment, (d) switch, switch configuration, reformatting/erasing environment, video control environment, (h) video processing, and any combination or subset of these. Other optional structural and/or procedural elements may also or alternatively be implemented as described elsewhere in this specification. Thus, for example, in one embodiment, the invention could consist of two computing environments, one that contains all environments and switches and switch configuration, but,excluding the user computing environment and a second environment that only contains a user environment.

To open user data, the user may select a representation of the data such as a filename or a "shortcut" or "alias" that is located or identified in or by the Desktop Computing Environment. The actual file is not opened or executed in the desktop computing environment and in embodiments of the invention is not actually present in that Desktop Computing Environment. Instead, this filename and location information (a pointer or reference to the file or data set) may then be sent to the Control Computing Environment which may not be isolated from the Desktop Computing Environment. In this embodiment, the Control Computing Environment may then copy the file corresponding to the file name selected by the user (or other designating entity) from the Protected Data Storage to one of a plurality of concurrently or intermittently isolated and/or communicatively restricted computing environments (such as to a User Computing Environment In this example, a command is sent to User Computing Environment #1 to open the file, and a command is sent to the switch(s) to terminate unrestricted communication with the User Computing Environment 1. The architecture, system, and methods associated with such operation are described in greater detail elsewhere in this specification.

At least in part for this reason, if the user data is "infected" with malicious code and executes, it can not damage or destroy other user data or information that is in storage protected from the executing malicious code, except for damage to the originally infected data file. It is also true that if the application program computer code or operating system program code is or may have been contaminated or compromised, such contamination or compromise :will not have any impact of continued operation of the system or device because at most a copy has been contaminated or compromised and is not reused.

In this exemplary embodiment an optional restricted communication path may connect the User Computing Environment 1 to the Control Computing Environment and this communication path may be restricted any one or more of several ways. For example, the communication path may be restricted by an ASIC limiter or filter which may have highly restricted communication abilities such as permitting only a predetermined set of ACSII characters to pass, such set and ordering being known with certainty or predetermined high probability of not supporting executable instructions. The limiter may for example compare the bits or characters that are attempted to be communicated with a permitted set of bits or characters. In this particular embodiment, for example, it may only contain or possess the functionality required to communicate a very limited number and/or combination or sequence of binary or bits to the control environment, representing concepts such as for example: 'save file" and "erase/reset this computing environment", and may for example contain limits to the quantity of information it can communicate in a time period or in response to an event or events.

Alternatively or in addition, for example, a electrical or optical light pulse or other signal could WO 2005/116804 PCT/US2005/001484 -11 be communicated to a receiver connected to the control environment, and for example one pulse meaning "save file"; and two timed consecutive pulses meaning "erase/reset this computing environment." It will be appreciated that these are only examples, and those workers having ordinary skill in the art in light of the description presented here will appreciate that other signaling schemes that limit the amount or nature of the information but that provide the required operation may be implemented.

After a data store and its computing environment has been "exposed" to a user document, and thus potentially exposed to a virus, spy software, or the like intentionally or unintentionally malicious program code, the data storage device may be completely reformatted and/or cleared, erased, and reset in any combination, thus eliminating all data, such as, for example, hidden partitions, drivers, boot sectors, hidden code, or the like. The computing environment may also be "re-set" (such as for example, power cycled or otherwise cleared or reloaded) in a manner that assures no residual contamination prior to its next use.

The switching and copying process described above (and in various alternative embodiments elsewhere in this specification) may be used to move data safely to and from isolated computing environments and data storage devices or storage subsystems; this process may be controlled and orchestrated by the Control Computing Environment, and associated software and the connected switches. Master Templates (described in greater detail in its various embodiments elsewhere herein, but which in simplified terms, contains or includes clean and uncontaminated executable code) may be copied between data storage devices as needed.

Several switches and switching systems and means are described in connection with the several embodiments. Again, this description is somewhat generalized because of the broad applicability of the inventive architecture, system, and method to many different physical implementations and device types. In one embodiment, a general switch system may be used to couple one or more of source and one or more of destination to support a communication between source and the destination, such as a for example between first and second storage devices or between a network interface card (NIC) and a computing environment, to name only two of many examples that could be named. The communication may support bi-directional or only unidirectional communications between a source and a destination. The general switch system may be coupled with a switch configuration that is used to determine which sources are to be coupled with which destinations. The switch configuration may for example include one or more of a logic circuit or circuits, a data file, a look-up table, and/or any other means for identifying or designating connections or valid enabled communications paths between source(s) and destination(s). In one embodiment, the switch configuration may identify invalid or non-enabled communication paths, and in yet another embodiment the switch configuration may identify both invalid (non-enabled) and valid (enabled) communication paths between possible sources and destinations. The general switch system may be implemented in hardware, software, and/or a combination of hardware and software.

According to one embodiment of the invention, the general switch system may be implemented in hardware as a physical switch. The source may be represented as an IDE drive and the destination may be represented as a computing environment. Each source may be coupled with the general switch system using an IDE cable. Each destination may also be coupled with the general switch WO 2005/116804 PCT/US2005/001484 -12system using an IDE cable. According to one, embodiment of the present invention, the switch configuration may be represented according to the physical capabilities of the switch and where the IDE cables are physically coupled with the switch. Physical manipulation and/or twisting of the physical switch may thereby connect a given IDE cable corresponding with a source to a given second IDE cable corresponding with a destination for supporting communication between the source and the destination. The communication between the source and the destination may support bi-directional communication. According to one embodiment of the present invention, the switch may be actuated manually and/or under the direction and/or control of one or more computing environment.

According to one embodiment of the present invention, a general switch system may be implemented in a combination of hardware and software, such as, for example, through the use of a computer system coupled with a general switch system. The computer system is capable of executing one or more computer instructions and may be used to configure the general switch system. Several example instructions may include configuring instructions, communication instructions, and accessing instructions. Configuring instructions may be used for configuring communication to support enabling or disabling communication between a given source and destination. Communication instructions may be used for receiving, sending, and/or verifying information related to one or more configurations. For example, communication instructions may be used to receive information that may subsequently be used by a configuration instruction. Accessing instructions may be used to read and/or write information related to a switch configuration. However, one should appreciate that other instructions and/or sets of instructions may be used.

The data store switch system may include the functionality of a general switch system, where the source may represent a data store and the destination may represent a computing environment.

The general configuration may be used to identify which data stores are coupled with which computing environments. As described above, the IDE devices may represent one embodiment of a data store that may be configured to support communication with one or more computing environment.

According to one embodiment of the present invention, the data store switch system may be coupled with a data store switch system configuration that may extend the number and/or type of traits corresponding with a general configuration. The data store switch system traits may further support configuring communication between the source and the destination.

The I/O and/or other peripheral or device switch system may include the functionality of a general switch system, where the source may represent a peripheral and the destination may represent a computing environment. The general configuration may be used to identify which data stores are coupled with which computing environments. A keyboard device may represent one embodiment of a peripheral that may be configured to support communication with one or more computing environment.

According to one embodiment of the present invention, the I/O System may be coupled with an I/O system configuration that may extend the number and/or type of traits corresponding with a general configuration. The I/O switch system traits support configuring communication between the source and the destination. In the context of such switching and communication paths, in one embodiment, a data store switch communication path is used to couple a computing environment with the data store switch.

The data store switch communication path is used to support the communication with at least one data store according to the data store switch configuration, as described above. According to one WO 2005/116804 PCT/US2005/001484 -13embodiment, one of the data stores coupled with the computing environment includes an operating system that may be used by the computing environment as a computer boot device.

In analogous manner, an I/O switch communication path is used to couple a computing environment with the I/O switch system. The I/O switch communication path may be used to couple one or more peripheral with one or more computing environments. The I/O switch system configuration may be used to direct the output from one or more computing environments to a single output device.

Similarly, the I/O switch system configuration may be used to direct an input from a single peripheral computing device to one or more computing environments.

The I/O switch system configuration may be configured to direct a received input (or output) to at least one of the computing environment based on a corresponding trait. And, the 1/O switch system configuration may be configured to direct an output generated by one or more of the computing environments to and input/output device, a peripheral, or to or from some other component in the system based on a corresponding trait (see description of traits elsewhere in this specification).

Turning attention to another type of signal, it is noted that in one embodiment, video signal outputs from each isolated computing environment may be combined or mixed at the point in the processing of these video signals when malicious code can no longer execute (for example, when output has been converted into graphic "primitives and attributes", and/or where the video signals are analog signals). This prevents a windowed video signal representing the process occurring in an isolated computing environment from being used as a medium for cross contaminating the different computing environments. (Note that not all computing environments require or generate video output signals, as some processing especially in specialized devices may process data in a computing environment but not provide a video display or signal that the user can view.) In one embodiment, a so called "isolated global toolbar" may also be utilized for a predetermined or dynamically context sensitive) commands and/or other operations or functions.

This isolated global toolbar may appear on its own isolated video layer or on the Desktop Computing Environment to protect it from malicious code. Advantageously, the isolated global toolbar is always on top or displayed in response to some user command or action so that the user or other trusted control entity may directly control an action in one of the computing environments. For example, if a user sees some suspicious output represented in a windowed video portion of the display screen, the user may access the isolated global toolbar and terminate the processing occurring in that computing environment, including optionally taking various options such as saving or not saving a file. In one embodiment, this provides the user or human operator with administrative control over the operation of the entire system as well as the operations occurring within any computing environment. In principle, the global tool bar may permit any operation or function but some embodiments, the global tool bar has a more restricted set of administrative functions or operation. In some embodiments, the functions and operations that may be accessed via the global tool bar may be set according to system defaults, administrative preferences, user preferences, or according to other rules or policies.

In one embodiment, these functions and operations may also or alternately be performed in computer program software instructions. In other embodiments, there may be a hardware component and in other embodiments that is a combination of hardware and software. Thus, each environment may be isolated in software, the switching and copying may be performed by software, and the like.

WO 2005/116804 PCT/US2005/001484 -14- It should be noted that optional procedural steps can be cut or eliminated, and the functions of computing environments described herein can be mixed and matched as desired. In some instances the decision to include or exclude optional steps or procedures will be made in the context of the threat environment, the sensitivity of the data and/or operation, the need for speed, the storage device attributes (magnetic storage versus electronic RAM for example), and other factors. For example, the functions of the Control Computing Environment could be combined with the Desktop Computing Environment and/or the Switch Configuration, and/or the switch, and/or Protected Storage.

The principles of the invention transcend any particular computer operating system, application program, user interface, or device type or characteristic. Essentially the inventive architecture, system, method, and procedures are applicable to any electrical, electronic, or optical device that has logic circuitry capable of using information (such as in the form of binary bits) to perform an intended logical or arithmetic operations and are therefore susceptible to being altered or corrupted by having different or additional information introduced so that the intended operations are not performed or additional operations are performed. In contemporary devices such as computers, information appliances, cellular or other mobile telephones, automotive electronics, home appliances, GPS receivers, PDAs, and the like the logic is a controller, processor, microprocessor, or other programmable logic circuits or logic means, or the like; and the information used are computer program instructions and optional data.

In the future it is anticipated that current developmental optical computing systems will be further commercialized and that the invention will therefore become applicable to optical computing and information processing systems and optical processors as well.

The description here focuses attention on computers and computing environments but it will be appreciated that the invention is applicable to all manner of devices and systems that have logic to interpret instructions and/or data and are therefore susceptible to accidental or intended malicious attach by viruses, hackers, spyware, cyber-terror or other external agents.

Attention is now directed to some features of a conventional computing system and comparative aspects of various embodiments of the invention. As the invention may be implemented in a number of different physical forms, we describe numerous embodiments as examples of how typical systems might be implemented. It will be understood by those workers having ordinary skill in the art that these are merely additional embodiments of the invention that embody some or all of these features.

FIG. 1 is an illustration showing a typical laptop (or other) computer system 1900, according to the prior art. This computer system includes a case or housing in which are disposed the electronics and any mechanical components, such as CPU 1508-1, Data store 1502-1 (typically in the form of a rotating magnetic hard disc drive, and one or more peripherals 1541-1, 1541-2, 1541-N, as are known in the art. The housing or case 1904 also typically mounts or carries a display screen 1904 and a keyboard and pointing device such as a mouse. Additional external peripheral devices may be attached or connected to such computer system 1900 via a variety of connector ports as are typically provided. In such conventional computing systems, the data store 1502-1 and peripherals 1514-N are coupled to CPU 1508-1 in a fixed topology, usually through system and peripheral busses as are known in the art. For example, the data store 1502-1, typically a hard disk drive or some solid state memory (RAM) is always coupled to the CPU unless physically removed from the system 1900.

WO 2005/116804 PCT/US2005/001484 Likewise, the CPU coupled memory is typically always coupled to the CPU unless removed and in most conventional computing systems a certain portion of such memory (such as in the form of on-chip caches) is always and permanently coupled to the CPU. Similarly, peripherals such as CDROM, DVD reader/writers, network interface cards (NIC), modems, floppy-disk drives (FDD), wireless interface cards, and other peripherals are coupled to the system and directly or~indirectly to the CPU via fixed busses and interconnects. Because these connections are always present, they may provide an opportunity for the introduction of a virus or other malicious code into the CPU, CPU associated memory, BIOS, or onto a data store. Such malicious code may act immediately or lay dormant until some future time or event. Such vulnerability and means for achieving a level of immunity from such vulnerability is further described relative to embodiments of the invention.

FIG. 2 illustrates an exemplary information appliance, such as a desktop computer system, a laptop computer system, a notebook computer system, a personal data assistant (PDA), a stationary or mobile wired or wireless communication device (such as a mobile telephone, cellular telephone, satellite telephone, radio-frequency transmitter and/or receiver, and the like). In general the inventive structures, methods, computer programs and computer program products are applicable and may be used with any electronic device or system that includes or may be adapted to include at least one processing elements, such as a controller or microcontroller, a CPU, an ASIC, a microprocessor, a logic circuit, or any other processing element. (Other embodiments of the invention are described and may utilize two or other plurality of such processing elements, including any combination of the recited processing element types.) Such systems may be implemented to perform a variety of operations, such as for example some predetermined, dynamically determined or other logic, computational, word processing, email, network computing, music processing, video processing, Internet browsing, voice processing or coding or decoding, picture or image acquisition or processing such as in digital cameras of mobile telephones incorporating digital cameras, GPS signal reception and processing, positional navigation, entertainment. Those workers having ordinary skill in the art in light of the description provided here will appreciate that many electronic devices and systems fall into the applicable category of applications. The invention provides particular advantages where anti-viral and anti-hacker protection is desired and also where it is desired to process multiple applications concurrently, though these two advantages may be achieved separately.

In the illustrated embodiment a single computing environment, or more advantageously in most embodiments of the inventive system and method, a plurality multiple independent computing environments 1508-1, 1508-2 1508-N are created. These computing environments 1508 have features analogous to the special purpose subsystems 1120 in the embodiments of FIG. 7 and FIG. 8, and the analogy will become more clear after the several embodiments of the invention have been described in full detail. The independent computing environments may for example be physically implemented using hard-wired or programmable arithmetic or logic circuitry, programmable microcontrollers, processors, microprocessors, CPUs, ASICs, in any combination and possibly with the support of support components such as microprocessor memory, power and the like as are known in the art. At least certain embodiments utilize Central Processing Units (CPUs), microprocessors, microcontrollers, ASICs, or some combination to provide the physical structure to create the computing (processing) environment 1508. In some instances the complexity of the processing or computational WO 2005/116804 PCT/US2005/001484 -16task will dictate the physical elements that will support the desired computing environment. In one embodiment the elements that create the computing environment are dynamically selectable and configurable. Such selection and configuration may be under user control, or more typically, under the automatic control of the computing system 2000 according to some 'predetermined or dynamically determined rules or policies and optionally but desirable according to some measured computing system physical or logical state, environmental conditions, processing request and complexity, application program size and data set size. Spares may also be provided so that such spare component (such as CPU, memory, storage, video processor, coprocessor, modem, network or Ethernet processor, and the like) can be switched in to replace a failed component. Dynamic allocation and configurability also provides efficiency where there are to be many computing environments as it is not necessary to provide all processing capabilities for every environment.

The computing environments 1508 are or may be coupled or selectably coupleable to peripherals 1514-1, 1514-N via optional I/O Switch system 1510 according to switching commands or an I/O switch configuration data or logic 1512. Any requirement for the optional I/O switch system 1510 in particular embodiments of the invention may depend on such factors as the characteristics of the particular peripheral, and the required or desired degree of security or isolation. In some embodiments, certain peripherals may be directly connected, permanently connected, permanently disconnected, or switchable connected with one or selected computing environments. The computer system 2000 of FIG. 2, may for example include a display device 1904 attached to and held by case or frame 1902. It will also generally include an input device such as a keyboard and pointing device, though there are not required given the many alternatives for input and output, such as voice input, touch screens, voice or spoken computer generated speech, and the like. LCD displays may also take the place of computer screens in such devices as cellular telephones, PDAs, and digital cameras, among other devices.

As with other switches and switching systems described herein, the switching can be any one, plurality, or multiplicity of mechanical, electrical, electronic, transistor, diode, microprocessor, digital or analog, that accomplish the desired switching and maintain desired or required voltage, current, isolation, impedance, termination, and/or electrical characteristics. For example, a switch that connects and disconnects a hard disk drive from a CPU will do so without damaging the CPU or the hard disk drive. In some situations with some devices, switching may be accomplished by turning the device, or portions of the device off, or otherwise limiting the operating voltage or current, by stopping a clock to the device, by interrupting a data line or communication pathway but not interrupting a power line, or other ways of stopping operation as are known in the art. As is described elsewhere in the specification, in some instances these switching operations are intended to provide a guaranteed level of isolation between components of the computing system and the different computing environments 1508-1 1508-N.

The plurality of computing environments (also referred to as special purpose subsystems 1120 in the embodiment of FIG. 7 and FIG. 8) are also selectably coupled or coupleable to one or a plurality of data stores 1502 through a data store switch system 1504 via data store switch system 1504 according to switching commands or a data store switch configuration data or logic 1506. Data store may be any combination of storage devices known in the art or to be developed, such as including but WO 2005/116804 PCT/US2005/001484 -17not limited to, rotating magnetic hard disk drives, rotating or non-rotating optical storage media, CDs, DVDs, holographic recordings, nanotechnology based storage, solid state memory (RAM, ROM, EEPROM, CMOS, and the like), molecular or atomic storage, chemical memory, as well as any other storage device or system. It will be appreciated that the separate logical storage elements 1502-1, 1502-2,...,1502-N may be configured or portioned on a single physical device or within or on any combination of physical devices and that even for a single logical storage device 1502-2 (for example) multiple different physical devices may be utilized to obtain the desired or required storage capacity, copy data to device speed, write data from storage device speed, clear and/or erase or overwrite speed and performance, or other operating characteristics. For example in one embodiment for a notebook computer, some of data store 1502 are implemented as logical partitions of a single physical hard disk drive. In another embodiment, all of the data store 1502 are implemented with solid state memory devices to provide fast read, write, and erasure speed performance. Various kinds of multiply-ported memory types and architectures are available and may be used. For example, Rambus memory may be used as well as more conventional memory chips. In yet another embodiment, several of the data store 1502 are implemented as separate platters or disks on a multi-disk hard magnetic disk drive.

Such drives may have a single controller and controlled set of read/write heads, or may have separate controllers and optionally independently operable actuator arms and read/write heads to assure isolation of data paths so that malicious code (such as from a virus, robot, or computer hacker) cannot migrate from one computing environment to another and corrupt the intended isolation and independence of the several computing environments.

It is expected that for physically small devices (such as for example, PDAs, mobile telephones or other communication devices) there will be a preference to utilize only solid state memory as compared to memory having mechanical moving parts because of the lower energy consumption, smaller size, lower heat generation, faster access speed, read/write speed, and speed and ease or erasure. Such solid state memory may be internal to the device mobile telephone), external but pluggable via a mechanical and electrical connector or coupling (such as by using compact memory cards or modules, Sony SmartMedia, as are available as base or additional memory for Microsoft Windows operating system (OS) and PalmPilot OS based PDAs; PDA cell phone combinations; PDA, cell phone, and digital camera combination devices; digital cameras; cell phones: digital audio and/or video recorders and players; MP3 players; and other devices and memory systems as are known in the art. There are also small and inexpensive storage devices and subsystems that are not solid state that may be used.

A comparison between the conventional computer system 1900 of FIG. 1 and the inventive embodiment 2000 of FIG. 2, reveals several differences. In the conventional system, the data store 1502-1 in connected directly or via some more-or-less fixed and permanent connections to CPU 1508- 1, such as over one or more busses or interconnects. (Mechanical and manual disconnection may be possible in some instances and for some device types, but not under programmatic control during operation of the computer according to the need for or desirability of a particular storage device, peripheral device, or other system component at the time according to a processing operation.) By comparison with conventional system 1900, the several data stores 1502-1,.., 1502-N of the computer system 2000 are coupled, if at all (depending upon the state of the data store switch system 1504), to a WO 2005/116804 PCT/US2005/001484 -18computing environment a computing environment that includes some processing or computing capability such as but not limited to a CPU) though the data store switch system. In general, any one of the data store 1502 may be coupled to any one of the computing environments, or coupled to none of them. More typically, any given data store will be intermittently coupled with or connected to a computing environment when there is a need for such coupling or connection, and the particular data store to which a particular data store 1502 may change during the existence of the computing environment. The predominant default is that such data stores and other devices are not coupled or connected unless access is specifically desired, required, and permitted by the controller or controlling computing environment.

Furthermore, in embodiments of the invention, the paring or switching connection between physical components such as a particular CPU and a particular data store hard disc drive or solid state memory chip) may (but is not required to) dynamically change for different processing operations.

Likewise, in at least some embodiments that include the optional I/O switch system 1510 and the optional I/O switch configuration 1512, the computing environments 1508 couple to peripherals 1514 only via-the I/O switch system 1510. The switchable connection or coupling may involve any of a variety of switching schemes, such as schemes that involve altering one or more electrical connection, removing power from an interface or peripheral device, stopping a clock signal that is required for operation of the peripheral, and other schemes, structures, and methods as are known in the art for making the peripheral appear not to be present or accessible to the computing environment.

It will be appreciated that operations that enable or disable (or connect and disconnect) either the data stores 1502 and/or the peripherals 1514 may happen automatically under program control without human user intervention (though the enablement or disablement may be the result of a command or other action by a user of the computer system), and that the enablement and disablement may occur many times per second when required for the operation of the inventive computer system 2000. For example, where the computer has interfaces or busses that operate at 100 MegaHertz, data stores and peripherals may be switchably coupled and decoupled as needed as operations on the interface or bus are initiated, executed, and completed. For example, switching may occur at least at rates of 1 Hz, 10 Hz, 100 Hz, 1KHz, 1 MHz, and 10 MHz, as well as at higher and lower rates and at any intermediate rate. It will also be appreciated in light of this description that the data store switch system 1504 and the I/O switch system 1510 (when present) can simultaneously switch to enable or connect, or to disable or disconnect, different CPUs to the data stores and/or peripherals.

In a typical conventional computer system 1900, the peripherals 1514 are connected directly to the CPU 1508 and are not switchably connected and disconnected (or enabled and disabled) during the operation of the computer system. It will be appreciate that the disconnection of the data stores and peripherals may also make them available to other computing environments. In conventional systems, even where some peripheral may be hot-pluggable, plugging the peripheral is a manual operation that requires human user interaction. Other differences between conventional computing systems and methods and the inventive system and method will be better appreciated in the context of the descriptions of the other embodiments of the invention described herein.

FIG. 3 illustrates a schematic diagram of an architecture and system 1500 for supporting multiple independent computing environments 1508-1 1508-N, including a computer system WO 2005/116804 PCT/US2005/001484 -19capable of supporting multiple independent computing environments that may advantageously be used to separate and isolate certain processing operations to prevent contamination or an attack that would damage user data by a malicious virus, robot, or hacking. Such a computer system 1500 may include a plurality of data stores 1502, a data store switch system 1504 (and optional data store switch configuration unit 1506), an I/O system such as one including one or.a plurality of peripherals 1514 coupled to the computing environments 1508 via an optional I/0 switch system and I/O switch configuration unit, and one or more computing environments 1508.

One or more data stores 1502 may be coupled with the computer system. A data store 1502 is representative of a memory area. A data store may be implemented by any type of storage media, such as magnetic hard disk drive, optical storage media, solid state memory, other forms of data storage, or a combination of these data storage media types. The data store may represent the memory area that corresponds to a disk drive and/or a portion of a one or more disk drives, and/or a combination or physical disk drives. According to one embodiment of the present invention, a data store 1502 may contain a copy of a master template. An embodiment of a method that may be used in conjunction with the inventive system is hereinafter described relative to FIG. 4.

Embodiment of Method For Using A Computer System Capable Of Supporting Multiple Independent Computing Environments With reference to FIG. 4, FIG. 5, and FIG. 6, attention is now directed to a description of aspects of the methods and operation for setup and initialization and operating of exemplary embodiments of a computer system according to the invention. The exemplary methods and procedures are at least applicable to the architectures and systems illustrated in the embodiments of FIG. 2 and FIG. 3 and it will be appreciated with appropriate modification owing to the somewhat different structure to the other embodiments of the invention, such as but not limited to the embodiments illustrated and described relative to FIGs. 9-17. The headings and subheadings provided in this section and throughout the specification are intended to act as a reference for the convenience of the reader where particular aspects of the invention and embodiments of the invention are described but it will be understood that aspect of the invention and embodiments of the invention are described throughout the specification, in the drawings, and in the claims and that the totality of the specification, drawings, and claims are to be considered in understanding the invention.

In one embodiment of the invention, the inventive method and the component procedures for creating or establishing computing environment(s), initializing, configuring switches, controlling processing, operating one or more computing environments, performing user andlor control operations within the computing environments, completion of user processing, saving files, and terminating processing in a computing environment may advantageously be implemented as a computer program or as a computer program product stored on tangible media and including computer program instructions for performing the methodological steps of the inventive method and system. Other embodiments may use a combination of hardware logic, firmware, and/or software to accomplish some or all of these procedures.

Aspects of the inventive method are now described. These and other aspects of the inventive method and procedures, including embodiment specific optional procedures and steps, are described in the context of specific embodiments throughout this specification.

WO 2005/116804 PCT/US2005/001484 Initial System Startup and Establishing A Computing Environment With reference to FIG. 4, according to one embodiment of the inventive method, using multiple independent computing environments (1508-N) may include initiating a system startup (1602), configuring the I/O switch system configurations (1512) at 1604 and data store switch configurations 1506 at 1604, configuring the I/O switch system 1510 to support communication, configuring the data store switch system 1504 to support communication, performing control processing at 1623, and user processing at 1631. Typically the control processing may also include control setup processing at 1615 and control save processing at 1621.

Initiating a system startup at 1602 may include an initial boot sequence similar to known boot sequences of a computer system. The boot sequence may further include support for defining and/or modifying one or more switch configuration at 1604, such as, for example, a data store switch configuration and/or an I/O switch configuration. The initial configuration of each switching system may be initiated to establish one or more communication paths between one or more source and one or more destination according to the corresponding switch configuration 1604. Configuration of switches 1800 may also involve procedures to configure data store switch 1804 and configure I/O system switch 1806 along with a procedure to initiate computing environments as illustrated in FIG. 6. (Other embodiments of the invention provide a combined procedure for configuring the data store and I/O switches when initially configuring or when reconfiguring a computing environment.) With further reference to FIG. 5, illustrating an embodiment of a procedure for initiating a computing environment, according to one embodiment of the present invention, the power may be turned on via a physical switch 1704 to initiate a system startup during a start operation 1702. At system startup, a CMOS memory 1708 may be used to define one or more step of the initialization process and/or boot sequence. The boot sequence 1706 or some other initialization sequence or procedure may use information coupled with the CMOS 1708 or other memory store to establish a switch system configuration and subsequently initialize the corresponding switch system to apply and/or modify the configuration to communicatively couple sources and destinations. One or more computing environments may also be initiated by the system startup at 1602.

With further reference to FIG. 4, establishing a computing environment at 1608 and 1622 may include configuring the I/O switch system configurations and data store switch configurations, configuring the I/O switch system to support communication, and configuring the data store switch system to support communication According to one embodiment, two data stores (such as, for example, data stores 1502-1, 1502-N) may be coupled with a computing environment. The first data store may include an operating system to support the processing activities of the computing environment. The second data store may include a variety of information that may be used or operated on by the computing environment. The variety of information may, for example, include specific user information and/or configuration information. Specific user information may include a document that is to be edited by a user.

Configuration information may be used of a controlling computing environment to configure a data store switch configuration and/or an I/O switch configuration.

Typically a control computing environment is established at 1608 before any user computing WO 2005/116804 PCT/US2005/001484 -21 environments are established. In some embodiments the control computing environment or equivalent may be established upon initialization. A first control computing environment may be established by the boot sequence as described above. The first data store may support an computer operating system.

The second data store may represent the protected data store. After the data stores are coupled to the computing environment, then the computing environment may boot to allow a user to interact with the computing environment. User inputs may be received through the I/O switch system 1510 that is configured to communicate inputs that correspond with traits of the control computing environment (such as, for example, a region trait and an computing environment identification trait) to the control computing environment. Similarly, outputs from the control computing environment may be sent to a peripheral (such as, for example, peripheral 1514-1, 1514-N) based on the traits that correspond with the control computing environment. Accordingly, the control computing environment may boot from the first data store and have access to the protected data store. Consequently, a user may interact with the control computing environment.

Attention is now directed to an option for using optional "traits" within embodiments of the inventive architecture, system, and method. References to traits are made in other portions of the specification and though advantageously used are optional features. In one embodiment, at least one characteristic, attribute, descriptor, or trait may be used to represent each source and destination (as well as to represent characteristics of other components of the system). The trait may be representative of a physical identifier and/or a logical identifier. According to the IDE disk drive storage device example, described above, each IDE cable may be identified by a physical coupling with the physical switch. The IDE drive information, (such as, for example, master and/or slave designation, drive size, and the like) may be used to identify the drive and/or a data store coupled with the drive.

Similarly, at least one trait is used to represent each destination, such as, for example, a computing environment or CE. If the computing environment is representative of a separate physical computing environment, it may be identified by the separate physical computing characteristics, such as, for example, a unique interface coupled with the general switch. According to one embodiment of the present invention, the computing environment may be represented as a logical computing environment that may share some or all of the physical computing properties that correspond with another computing environment. A logical computing environment may be identified in a variety of ways, such as, for example, through a unique process identifier.

One or more trait may correspond with an output device, such as, for example, a computer monitor and/or computer graphics card. According to one embodiment, a trait my correspond with a display region associated with a potential viewing area of the computer monitor. Display outputs from a source may be positioned according to the display region trait, such that output from one computing environment is directed for display within the region associated with a region trait. A region trait may include a pair of x, y coordinates that define a rectangular display region associated with the potential viewing area of the computer monitor. Accordingly, a display output from a particular computing environment may be represented according to one or more trait within the corresponding region and not another region.

One or more traits may correspond with an input device. As described above, a region trait associated with the potential viewing area may be further extended to identify when inputs are WO 2005/116804 PCT/US2005/001484 22communicated to a particular computing environment. Mouse movement and mouse commands may also correlate with a rectangular display region, such that inputs corresponding with the rectangular display region may be directed to the corresponding computing environment. Consequently, mouse movements within a region may be communicated with a computing environment that corresponds with the same region. The use of traits may generally be extended to any device, subsystem, or peripheral used with, associated with, or potentially available for use with on an as needed or intermittent basis with the system, and may include external devices or systems with which the inventive system may be placed in communication with.

The computing environment trait may be used to identify one or more output as having originated from the computing environment. The computing environment trait may also be used to identify one or more input and the corresponding computing environment that is a designated recipient of the input. One or more computing environment trait may be used to identify the computing environment. A computing environment trait may be used to uniquely identify the computing environment. The trait may identify a computing environment through corresponding physical attributes, logical attributes, or a combination of attributes. For example, a trait may identify a physical address of one or more computing system components. Alternatively, a trait may identify a logical address corresponding to a logical computing environment. Furthermore, one should also appreciate that a trait may identify a number of characteristics of a given computing environment, and the number and type of corresponding traits may vary in accordance with the present invention.

Traits may be used, for example, to assist in orchestrating and configuring components of the inventive system to accomplish one or a set of processing tasks. Such configuring may include configuring various switches, switching systems, and switching means to provide the desired connectivity to storage devices, I/O devices, and/or other peripherals.

Configuring Switches and Minimizing User Processing Within Control Environment One type of computing environment capable of configuring a switch system is the control computing environment. (Other embodiments of the invention provide for combining different computing environments so that other variations to this are possible as described herein elsewhere.) The control computing environment may re-configure the switch system configurations such as the data store switch configuration and the I/O switch configuration. The configuration of the corresponding switch system may be activated in a variety of ways, such as, for example configuring and or reconfiguring communication through the switch when any change to a supporting switch configuration is made and/or determined. Further, communication between the control computing environment and a switch system and/or switch system configuration may be encrypted to help ensure that only the control computing environment is capable of configuring the switch systems.

In one embodiment, processing of user data or unknown or untrusted data within the control computing environment is disabled or not allowed to eliminate the potential for corruption of data or other information (such as for example, corruption of user data files or computer program code existing or residing in that control computing environment) corresponding to the protected data store where for example protected data or master template may be stored. According to one embodiment of the present invention, if a user initiates a user operation, such as an activity that may typically be performed by a user, (such as, for example, email, word processing, etc.) then the user operation may be WO 2005/116804 PCT/US2005/001484 -23processed in a separate computing environment. In embodiments of the invention that combine user interface, control operations, and/or protected storage into a single computing environment or subsystem, the configuration of this environment is such that such environment does not support processing of the user data in a manner that would permit such user data to execute in that control environment and corrupt it or the system. Processing operations such as a copy operation may be supported but such copy operation would be implemented in a manner that does not permit execution or infection of other system files by malicious code.

The control computing environment may receive a user input to initiate a user operation. A computer mouse input may be received by the I/O switch system and directed to the control computing environment according to the I/O switch system configuration. Other inputs from other peripherals may also be received by the control computing environment through the I/O switch system.

Initiating and Performing A User Operation Within a User Computing Environment The user of a control computing environment may initiate a user operation. In one example, the user may double click on a particular icon displayed within a region of the monitor. The mouse action may be received by the control computing environment and result in the initialization at 1612 of a separate computing environment to perform user processing at 1631, such as, for example word processing. The control computing environment may initialize the creation of a separate processing environment to perform the word processing corresponding with an existing and or new document. If this is an existing document, the control computing session may need to copy a copy of the document to a third data store for subsequent use by a user computing environment. The control computing environment may configure the switch systems to support the user environment. The data store switch system may be configured to couple a third data store and a fourth data store with the user computing environment. The I/O switch system may be configured to couple peripherals with the user computing environment, such as, for example, a region of the display may be coupled with the user computing environment. The user computing environment may also be initiated by a signal or event triggered by the changes to one or more switch configurations. A variety of alternative approaches may also be used to initialize the user computing environment.

As part of the initialization at 1606 of the user computing environment, the file to be edited may be launched after the user computing environment is booted. According to another embodiment, an existing user computing environment may be coupled with a corresponding data store to make the file available for processing within the user computing environment. According to one embodiment of the present invention, the file or files to be edited may reside in a predefined location, such that a corresponding application may be launched to open the corresponding files and/or support the user activity. Control processing may be performed by the controlling computing environment, and may include configuring one or more switch configurations, initialization the reconfiguration of one or more switch systems, copying information between one data store to other data stores, copying information between the protected data store and other data stores.

User processing may include interaction with the controlling computing environment and user computing environments. Any processing typically associated with function that may be performed by a user may be configured for processing in an independent user computing environment. Accordingly, the user processing activities may not directly interfere with the processing activities of the controlling WO 2005/116804 PCT/US2005/001484 24 computing environment and/or the processing activities of other user computing environments.

Information may be made accessible to the user computing environment through the copying of computer information from one data store to another data store depending on the computer information that is necessary to support a particular user processing activity, such as, for example, a word processing activity, may require access to a user file to be edited.

Typically, the control computing process may include control setup processing at 1615 and control save processing at 1628. The control setup may be used to support the establishment of a user computing environment to be used to perform at least one processing activity, such as, for example, a word processing activity. Control save processing may include saving user information to a protected data store. Once the user processing activity is completed, then information related to the user processing activity may be saved into the protected data store at 1618 without allowing the user computing environment to perform the save function directly into the protected data store.

According to one embodiment of the present invention, the controlling computing environment may copy one or more file to a temporary data store. The controlling computing environment may update a data store switch configuration at 1616 to allow a user computing environment access to the temporary data store. According to one embodiment the controlling computing environment may verify the user computing environment has be communicatively coupled with the temporary data store.

Subsequently, the controlling computing environment may wait for the processing corresponding to one or more user computing environment at 1614 to complete. While waiting for the user computing environment to complete the controlling computing environment perform the function that may correspond with general desktop functionality. The desktop functionality may correspond to the management of data stores, configuring data stores, and copying of computing information between data stores, such as, for example, to clean one or more data stores of a computer virus. Typically, the functionality corresponding to the desktop functionality is limited to reduce the possibility of corrupting the computing information stored in the protected data store.

Completion Of User Processing At the completion of a user processing activity, the controlling computing environment may be notified according to a variety of different notification approaches. According to one such approach, the user computing environment may terminate such that the termination is sensed by the corresponding switch system. The switch system may activity notify the control computing environment that the data may contain user information that should be placed in the protected data store.

In response to the completion of the user activity, the control computing environment may couple the user data store with the controlling computing environment such that the user information and/or files may be copied to the protected data store independently of any process that may have been performed by the user computing environment. Accordingly, other files stored with the protected data store would not be corrupted by the operation of the independent user computing environment.

According to one embodiment of the present invention, a file save command may be used as a triggering event that causes the controlling computing environment to store a user file to the protected data store independently of other operations that may be preformed within the context of the user computing environment. According to one embodiment of the present invention, a temporary data store may be coupled with both a user computing environment and a controlling computing environment such WO 2005/116804 PCT/US2005/001484 that the user computing environment cannot corrupt other files coupled with the controlling computing environment. The user computing environment may save a file in a temporary data store, where the controlling computing environment may include the ability to copy the file to the protected data store and/or an intermediate data store. An intermediate data store may be subsequently used to save a corresponding file to the protected data store, such as, for example, when the user application is closed. Communication between a user computing environment may be passively implemented to help ensure the user computing environment can not corrupt files stored in a protected data store.

A user file may be saved to a temporary data store, as the result of a file save command.

Subsequent to the initiation of the save command, the data store switch system may verify that the data store is coupled with a saved file. If the file was present, then a series of instructions may be executed to copy the file from temporary data store to the protected data store.

According to one embodiment of the present invention, the controlling computing environment may wait for a corresponding user computing environment to complete a user activity, such as, for example, saving the file. Subsequently, the data store switch may be configuration to uncouple the temporary data store from the user computing environment. The temporary data store may then be coupled with the controlling computing environment. The protected data is also coupled with the controlling computing environment. The file may be copied from the temporary data store to the protected data store independently of the user computing environment. The temporary data store may then. be uncoupled from the controlling computing environment and recoupled with the user computing environment.

According to an alternative embodiment of the present invention, the save process may trip and/or set a flag corresponding to a switching system that is communicated to the controlling computing environment. The presence of one or more files may be verified. If the verification of files indicates the presence of files, then a series of computer instructions may be executed to copy one or more file from the temporary data store to the protected data store.

According to an alternative embodiment of the present invention, a keyboard command (such as, for example, Control-S) may be used to save a file. The I/O switch system may be configured to communicate the command sequence to both the user computing environment and the control computing environment. Consequently, the control computing environment may reconfigure the data store switch and/or the I/O switch system to support copying the file saved in the user computing environment to a protected data store.

According to an alternative embodiment of the present invention, the file could be transferred to protected data store when the user computing environment is closed and/or shutdown. One or more of the switch systems could sense the closure and/or shutdown. According to one embodiment of the present invention, a closed user computing environment may be verified by the data store switch system by an altered power state corresponding to the data store that may have been supplied by the user computing environment.

s According to an alternative embodiment of the present invention, a graphical region corresponding with a computer display monitor may be used to identify when user inputs have been received that correspond with a particular computing environment. The user input may be analyzed within the 11/O switch system and/or within the controlling computing environment depending on the WO 2005/116804 PCT/US2005/001484 -26specific implementation. According to one embodiment, a save command and/or a close command corresponding with a user computing environment may be used to identify that user information may need to be saved to a protected data store, and/or trigger the saving of computer information to a protected data store.

Closing the user computing environment may include turning a power switch off. A switching system may be capable of sensing a change in power consumption and/or interruption. If the user closes an application and a corresponding user computing environment then the controlling computing environment may sense the transition and save any corresponding user data to the protected data store. Before reconfiguring the data stores, a corresponding switch system may verify that the power to the data store containing the user data is disabled and/or in an off state. The controlling computing environment may then uncoupled the data store containing user information from the user controlling environment and copy the user information to a protected data store, as described above.

According to one embodiment of the present invention, data stores may be cleaned after they are coupled with a user computing environment. The controlling computing environment may reformat and/or clean one or more data stores after a user computing environment has used the data source. A master template data store may also be used to initialize a data store prior to coupling the data store with a user computing environment. According to another embodiment, the controlling computing environment may initiate another user computing process that is defined to support reformatting and/or cleansing one or more data stores.

Having described an architectural topology and system structure relative to the embodiment of FIG. 2 and FIG. 3 as well as initialization and operational aspects relative to the methods and procedures in FIG. 4, FIG. 5, and FIG. 6; attention is now directed to additional architectural, structural, and methodological aspects of such computing devices, information appliances, and processing machines.

FIG. 7 illustrates an embodiment of the invention 1105 including special purpose sub-systems or computing environments 1120 1120-1 and 1120-2) and a common controller 1130 within a computer system 1110 that is coupled with a number of peripherals i108 including a display 1140, keyboard 1150, and mouse 1160.

It will be appreciated that although only two special purpose subsystems are shown in the diagram that the system may include a single subsystem or computing environment or any plurality of such subsystems, may include a plurality but actively use only a single special purpose subsystem, or may include a plurality of special purpose subsystems having different structural and/or operational characteristics. For example, the plurality may be 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 32, 50, 64, 100, or more special purpose processing systems, or any intermediate number, subject to physical space, circuit density, heat generation, and other packaging and connectivity design issues as are known in the art.

Furthermore, in at least one embodiment, the inventive structure and method may be implemented in hardware having only a single or one subsystem or computing environment, where the computing environment or subsystem in used sequentially for different processes. In one embodiment of this single computing environment system, separate logic may be used to perform a store and restore of computing environment state so that the computing environment may be used to perform the WO 2005/116804 PCT/US2005/001484 -27intended processing operation and to maintain an ability to restore either an initial state or any intermediate state of a second or control process.

The structural and/or processing characteristics may include, but are not limited to special purpose subsystems having different processing capabilities different numbers of operations per second, different amounts of processor associated memory, different processor architecture or instruction sets, or different operating systems) or different amounts of mass storage in the form of a physical or logical allocation or hard disk drive, optical storage media, or solid state memory storage.

A controller 1175 and its associated and coupled memory storage 1176 is bi-directionally coupled to selected ones or all of the plurality of special purpose subsystems (for example, coupled to special purpose subsystems 1120-1 and 1120-2). This either direction of the bi-directional coupling to or from any of the special purpose subsystems may be intermittent, and/or switchably enableable and disableable. Furthermore, the connection between controller 1175 and the memory store 1176 may be switchably enableable and disableable.

As illustrated, an optional separate logic control device 1180 may be coupled between a first and second special-purpose sub-systems 1120. Common controller 1130 is coupled with special purpose subsystem 1120-1 and with special purpose subsystem 1120-2 via interface 1170.

Embodiments of the invention provide for these to be the same interface or separate interfaces. An optional interface 1170 may be coupled between special purpose subsystem 1120-1 and 1120-2, and such coupling may be intermittent or subject to being enabled or disabled when not needed or not desired. In this embodiment the interface is illustrated as being bi-directional but either unidirectional interface may be separately used, enabled, or disabled independently or as a set. Furthermore it will be appreciated that although a single line is illustrated in the drawing for clarity, the interface may be implemented as a plurality of connections or communication paths, such as but not limited to an interface multi-line bus interface. It will be appreciated that the display or display subsystem (such as a conventional display subsystem that includes a video processor card or chip-set, drivers, and display screen) receives data in the form of electrical signals from the common controller 1130, and that the common controller 1130 in turn receives its inputs from and as a result of processes executing on one or both of the special purpose subsystems 1120-1 and/or 1120-2. Hardware such as arithmetic and logic circuits, software, and firmware or a combination thereof in the display subsystem 1140, common controller 1130, and/or special purpose subsystems 1120-1 and 1120-2 generate a desired graphical display that for example reflects the user's computing environment desktop, and currently active and currently inactive windows.

The keyboard 1150 and mouse inputs 1160 are also typically unidirectional from the keyboard or mouse back to the common controller, unless some feedback in provided in the form of electronic signals or audio, mechanical, or tactile feedback. The unidirectional nature of display screen, keyboard, and mouse devices means that these are typically immune from malicious computer attack from outside the local computing environment and in at least some instances are treated as trusted or secure inputs when they occur.

FIG. 8 illustrates an alternative embodiment of the invention 1106 similar to the embodiment illustrated and described relative to FIG. 7. This alternative embodiment including special purpose subsystems 1120 and a common controller 1130 within a computer system 1110 that is coupled with a WO 2005/116804 PCT/US2005/001484 -28number of peripherals 1108 including a display 1140, keyboard 1150, and mouse 1160. As illustrated, a controller system may be coupled between and among first and second special-purpose subsystems 1120-1 and 1120-2, or as in the FIG. 7 embodiment, between any plurality of such special purpose subsystems. In this embodiment, the controller 1175 and associated coupled memory storage 1176 is implemented using one of the special purpose subsystems 1120-3 that is operated as a controller system 1177. Controller system 1177 (1120-3) is selectably coupled to one, more than one, or all of the other special purpose subsystems 1120 and to common controller 1130 via interface 1170.

The structure of exemplary special purpose subsystems and the manner in which they are configured to operate as application execution and processing units, or to take on various master control and/or monitoring functions, such as to operate as a controller system 1170, is described elsewhere in this specification relative to other ones of the figures.

Attention is now directed to further embodiments of the inventive architecture, system and method for an information appliance, computer, or data processing device. Recall that other embodiments of the inventive information appliance or computer system have been described that includes a plurality of data stores including at least one protected data store; a plurality of switching system for communicatively coupling (and decoupling) at least one source with a plurality of destinations, including a data store switch system wherein the source is a data store source, and a I/O switch system wherein the source is a peripheral source; a plurality of computing environments (sometimes referred to as shells) for performing a processing activity independently of another computing environment, coupled between the data store switch system and the I/O switch system, wherein the destination is the computing environment, and the switching system communicatively couples the source and the destination; at least one control computing environment selected from the plurality of computing environments for configuring the switch configuration according to the processing activity, communicatively coupled with the protected data store; and at least one user computing environment selected from the plurality of computing environments, wherein the processing activity is not performed on the protected data store.

In one embodiment of this information appliance and computing system each of the computing environments is further defined to be identified by at least one trait selected from a plurality of traits, the switching system communicatively couples the source and the destination according to the traits, and the at least one control computing environment is selected from the plurality of computing environments for configuring the switch configuration according to the processing activity and the traits.

The embodiment in FIG. 9 provides additional implementation and structural detail that exposes additional aspects and features that may be incorporated into devices and systems using the invention.

Similarities between this system architecture and structure will be apparent with those already described relative to FIG. 2 and FIG. 3.

In this embodiment, five computing environments 2108-1 through 2108-5 are specifically shown, though any number of computing environments may be provided either statically or dynamically. It will be appreciated that at least some of these computing environments 2108-1, 2108-5 appear to have somewhat different components or internal structure. In fact in some embodiments of the invention the structure and operation of the computing environments may be different (and perhaps significantly different), while in other embodiments they may be the same, and in WO 2005/116804 PCT/US2005/001484 -29yet still other embodiments the hardware may be the same but executing different operating system or application programs or with some other software configuration differences. In some of these computing systems, the configuration of the plurality of computing environments is dynamically configured as to hardware, firmware, software, or any combination of these.

In the system 2100 of FIG. 9, two of the computing environments 2108-4 and 2108-5 appear to have the same structural configuration (yet they may still have different software and data) and the other three computing environments 2108-1, 2108-2, and 2108-3 appear to have different structures.

The structures and operation of these different computing environments will now be described and we will later show relative to FIG. 10 how these different structures and operations may optionally but advantageously implemented using a common structural computing environment module that can be dynamically customized to provide the desired effective structure and operation.

User Interface Computing Environment Attention is first directed to User Interface Computing Environment (UICE) 2108-1 which provides a user interface operation, though not a conventional user interface, and which includes a central processing unit (CPU) 21 which generally includes a processor and processor coupled memory.

The CPU may also include other chips or circuits usually referred to as the processor chip set as is known in the art. CE 2108-1 also includes storage 2121 that is switchably coupleable to the CPU 2120.

In one embodiment, it is noted that the user can manipulate a file or data set somewhat transparently independent of the actual operating of the computer system and computing environments.

For example, in one embodiment, from the user's perspective he/she just drags an icon or file name or other descriptive reference from one location (such as the desktop, hard disk drive icon, or any other location) to any other location. In reality, for the desktop example, the controlling computing environment or user interface computing environment, calculates that'items (such as files) dragged to/from the area corresponding to the coordinates of the desktop and create icons of the item in the desktop environment or other destination, yet the actual file may be located in protected storage.

In the embodiment illustrated the storage 2121 is shown as having two storage portions, a secondary template portion (STP) 2122 that may store all or a selected portion of the master template (see description of master template elsewhere in this specification), and an optional temporary data store portion (TDP) 2123 that may store user data files but which may be eliminated as the need to provide storage in this environment is minimal in most embodiments. Recall that in preferred embodiments of this computing environment 2108-1 there are no application programs or actual files in this environment but only references, links, or pointers to such programs or actual files. (Note that other computing environments may also have minimal temporary storage requirements as a result of their minimal processing requirements as well.) Computing environment 2108-1 is identified as the user interface computational environment (UICE) and provides the interface between a human user or operator 2129 and the computing system 2100.

Usually, the User Interface Computing Environment (UICE) 2108-1 will have a secondary template portion that includes only the operating system components and application programs (if any) that are needed to provide the computing or data processing or control capability identified to the computing environment. For example, as the UICE will primarily receive requests and commands from the human user 2129, and process these so as to send signals to the Control and Switching Computing WO 2005/116804 PCT/US2005/001484 Environment, the UICE does not need to have any word processing, photo editing, e-mail, network or internet browsing, or other common or uncommon applications programs in its stored secondary template 2122. It may also have a different operating system than other, computing environments or an operating system that only includes the code, code portions, libraries, or other features of the operating system to support its responsibilities. This same principle of providing only the operating system components and application programs or application program components also applies to the other computing environment secondary templates, and though not considered to be the preferred approach, in all situations a complete copy of a master template or more than the minimum required operating system and application programs may be provided.

In other embodiments, such as in an embodiment of a computing environment generated or configured to perform image processing operations, the STP 2122 may store Microsoft Windows 2000 operating system code and Adobe Photoshop application software, and TDP 2123 may store one or more input digital image files, intermediate files that are created during execution of the Adobe Photoshop application software during processing of an image, and any output files that are generated.

TDP 2123 may also store any other user or temporary system data, such as a file to undo an prior edit or data copied to a clipboard.

In an actual implementation the STP and TDP may be the same physical storage device, such as a portion of a solid state memory, magnetic disk drive, or any other storage media, or they may be different physical devices or even different types of devices. Furthermore, using some of the dynamic switching configuration methods described herein, even the STP and/or TDP may each comprise a plurality of similar or dissimilar data store types, such as for example a combination of hard disk drive storage and solid state RAM, ROM, EEPROM, or the like.

Storage 2121 is selectively and switchably coupleable to CPU 2120. In the embodiment of FIG. 9, separate first switch 2124 and second switch 2125 are show for connecting or disconnecting CPU 2120 to/from STP 2122 and TDP 2123. A simple icon for a switch is shown but it will be appreciated in light of the description provided here that the switching may be, but is usually not, a simple wire that is connected or disconnected; and, is more typically a set of conductors such as an interface buss and signal conditioning circuitry for the signals on that interface buss. Switching to connect the CPU to the storage can be accomplished by any means that enables communication between the CPU and the storage, and switching to disconnect the CPU from the storage can be accomplished by any means that disables communication between the CPU and the storage as described elsewhere in this specification. Operation of these STP-CPU and TDP-CPU switches 224, 225 (or a more generic storage 2221 to CPU switch (not separately shown) to interoperate with other structures and procedures to protect the integrity of the computer system 2100 will be described subsequently after other components of system 2100 have been described in greater detail.

A peripheral switch 2157 is provided for coupling and decoupling (or enabling and disabling) any one or combination of peripheral devices, input devices, output devices, or the like. For example, keyboard, mouse, network interfaces or NICs, microphone, speakers, headsets, floppy-disk drive (FDD), hard-disk drive (HDD), PC Cards, memory cards, CD, DVD, serial or parallel interface devices, GPS devise, USB devices, scanners, biometric readers, wireless interfaces, or any other peripheral of device may be allocated to a particular computing environment. While the switch 25157 is illustrated as WO 2005/116804 PCT/US2005/001484 -31being part of Desktop and User Interface Computing Environment (UICE) 2108-1, it may be thought of and implemented as a separate stand-alone switch or switch subsystem, that is controlled by the CSCE or other controlling computing environment. In another embodiment it is controlled and directly couples peripherals to the other computing environments on an as needed and a permitted basis. In another embodiment, the video outputs from the computing environments may be switched and/or processed through the peripheral or input/output switching system. These peripheral switching and connection capabilities may also be combined with the other switching systems 2150 for storage devices and controlled by CSCE 2108-2 as described elsewhere in this specification. Computer environment 2108- 1 may also include additional components that are not needed or are inactivated for the particular function and operation of the computing environment at that time. Such additional components may for example include ROM, RAM. ASIC(s), and/or additional circuitry and logic elements.

Protected Storage and Read/Write Control Computing Environment Protected Storage Computer Environment (PSCE) 2108-3 is configured to store an original or primary master template PMT 2148 in a master template protected store 2142 and a primary user data 2149 in a user data protected storage 2143. In one embodimentthe functions and operations performed by the Protected Storage Computer Environment (PSCE) 2108-3 can be combined with the functions and operations performed by the Control and Switching Computing Environment 2108-2 and vice versa.

A master template take any of a variety of forms or content and may for example be a copy of data (commands, instructions, data elements, and the like) that represents an ideal state of a computer system or component of a computer system. The master template may for example, be created by copying data from an operational computer system or component of a computer system, or created in other ways. The computer system may be in an ideal state before creating a master template. An ideal state of a computer system may be represented by data that is accessible to the computer system.

Where different secondary templates are to be used in different computing environments, there will be different master template portions or a single master template having portions that can be communicated separately to the other computing environments 2108. Data, within this context, may include an operating system Linux, Unix, Windows 98, Windows 2000, and enhancements, extensions to these operating systems), applications WordPerfect, Microsoft Office), user data operating system preferences, background images, created documents), and component data BIOS, PRAM, EPROM). In some embodiments, data may also or alternatively include any information accessible to the computer system, including local and remote data storage devices, and data in other databases, so long as the protective measures and procedures of the invention are observed to maintain isolation of these other data elements. As an example, the master template for one computer system may include all of the information installed on that computer system, such as the Microsoft Windows 98 or 2000 operating system, WordPerfect application, Microsoft Word application, and documents created by the user. The information may be installed across one or multiple storage elements accessible to the computer system as described herein. Additionally, the master template may include a copy or an ideal-state version of the BIOS settings, or may provide multiple BIOS adapted to the particular computing environments.

In some embodiments, a master template may represent a snapshot of a newly purchased WO 2005/116804 PCTIUS2005/001484 32 computer system. Such system is typically in an ideal state with an operating system and various applications pre-installed, thereby allowing a user to begin utilizing the computer system. For a particular user, the master template may represent an ideal state of a computer system, including, for example, an operating system, applications, and user customizations. As an example, a user customization may include the users prior selection of a picture or '.Jpg" image for a desktop background, such as a picture of the users pet.

Optionally, the master template may be created from a first computer system and subsequently may be used as a master template for a different computer system. The first computer system might be the manufacturers computer system. An ideal state of the first computer is thereby transferred to a second computer system or any number of computer systems. In some embodiments the master template may be created in one computing environment and then with appropriate safeguards migrated and stored as the master template. Embodiments of the invention advantageously provide support for updating, patching, reinstalling, and replacing elements of the master template so that these operations can be performed with substantially or the same user interaction, and substantially the same or the same operational result. The master template may be alternatively be created by a process of selective copying. For example, depending on the particular OS in use, a program may interrogate the registry, determine what entries are associated with a particular program or application, and then choose to selectively copy only those files and entries associated with the particular program or application to the master template.

In the illustrated embodiment of a protected storage and read/write computing environment of FIG. 9 there is no connection to any processor that would permit execution of the binary information stored in the master template protected storage 2142 or the user data protected storage 2143. This isolation can be accomplished either by physically not providing any such processing capability such as a CPU, or by disabling or disconnecting such CPU from the protected storage. This disabling or disconnecting may be accomplished using the switches described elsewhere in the specification or by other known means for preventing the binary data in protected storage, whether computer program code instructions or data.

In this embodiment, the only processing operation permitted on binary data stored in the master template protected store 2142 or the user data protected store 2143 is a read operation, and in some instances (described elsewhere herein) a write operation. These may conveniently referred to as copy operations.

The inventive architecture, system, methods, procedures and computer program product protects computers, computing devices, information appliances, PDAs, cell phones and other processor incorporating devices from hacking, viruses, cyber-terrorism, and from potential damage or intrusion such as spy software, keystroke recorders, and damage from hacking, viruses, worms, Trojan horses, and similar threats and vulnerabilities, independent of whether they were maliciously or unintentionally introduced or exposed.

In one embodiment, the master template protected store 2142 stores one or more sets of computer program code instructions that can be communicated to other computing environments and which is sufficient to provide operational capability for the designated operation of that computing environment. In some embodiments, there is a single set of computer program code that permits any WO 2005/116804 PCT/US2005/001484 -33operation that may be requested by the user or by the system itself to be performed, and each computing environment receives a copy of this complete master template, at a time and in the manner described herein. In other embodiments, the master template protected store 2142 stores multiple different sets and only the set that provides the operations required of the particular computing environment are set to it. This may generally result in smaller and faster copy operations and lower individual and overall storage requirements. Where erasure is required additional time savings are realized for smaller template sizes. The different secondary templates may be stored or generated as needed, however, storing the secondary templates in a ready to copy form exposes a lower security risk and greater operational speed.

In one embodiment, the user data protected store 2143 stores original versions (or copies) of the user data or files referred to as protected user data 2149. For example, such user data may include or be selected from the set of data or files such as an e-mail, an e-mail attachment of any type, a word processing document, a TIFF image file, a JPEG image file, an MP3 file, a computer program, stored versions of an operating system or operating system file, stored versions of a computer program application program, a device driver, and any other type of computer data, file, or collection of "0" and/or bits. Interestingly, the user data protected store may even knowingly or unknowingly store a computer virus or a file containing a computer virus, computer robot or bot, spyware, or other malicious computer program code. The presence and storage alone of such, virus, bot, spyware, or other malicious computer program code in protected storage 2142, 2143 poses no threat and cannot by its presence in storage there cause harm. In one embodiment, the processor is decoupled from the protected storage when no access is required to data or computer program code stored there; however, in other embodiments the processor may remain coupled to the protected storage as the processor is not configured to be able to execute the data or computer program files there and cannot cause damage to the protected storage, the processor, or the protected storage computing environment 2108-3. In some embodiments, the decision to maintain a continuous communication path between protected storage and the processor within the protected storage computing environment 2108-3 may depend upon the set of functions or operations that are supported in that protected storage computing environment. These same considerations may apply in embodiments of the invention that combine the protected storage computing environment with other computing environments such as with a user interface computing environment and control and switching computing environment (but not with user data isolated computing environment).

As suggested, in one embodiment the protected storage computing environment 2108-3 may include a decoupled or disabled processor such as a CPU 2140 which can be switched to couple via switches 2144, 2145 to the protected store for initial loading or reloading of the master template or user data, compilation, virus scanning or detection, testing, or other special operations. Enabling the connection between the CPU and the protected storage would normally only be allowed where precautions were taken to prevent corruption of other data within the protected storage should a virus or other malicious computer program code be present and execute. In embodiments where only a "dumb copy" operation is supported between a protected storage, a CPU or other processor may remain coupled with or connected to the protected storage. A dumb copy is a copy that does not open or expose the file to be copied to computer program code that could result in contamination or infection.

WO 2005/116804 PCT/US2005/001484 -34- Dumb copy may be a bit-by-bit, byte-by-byte or other copy or bit replication operations, such as for example that may be implemented by a fixed hardware logic circuit or ASIC or where precautions are taken by using software or firmware, or by using a combination of hardware and software/firmware.

The protected storage computing environment 2108-3 may be coupled with other of the computing environments 2208-1, 2208-2, 2208-4, and 2208-5 (or any of the M computing environments) through a plurality of switches 2250, such as copy from MTPS enable switch 2251, copy from UDPS enable switch 2252, and write to UDPS 2253.

In one embodiment, a command from MTPS enable switch (SW1) 2251 enables (or disables) the appropriate master template portion to be accessed (or denied access) and read or copied to the secondary template portion of a computing environment, such as for example to STP 2122 of computing environment 2108-1. The copy from UDPS enable switch (SW2) 2252 enables (or disables) the appropriate user data or file to be accessed (or denied access) and read or copied to the user data storage portion of a computing environment, such as for example to TDP 2123 of computing environment 2108-1. Usually, only one file or the set of files needed to perform an operation will be copied, rather than the entire set of user data in the protected storage 2143. Other embodiments may copy the entire user data set but this is inefficient and may typically serve no obvious beneficial purpose, except in certain instances during maintenance, diagnostic, and/or repair operations.

The write to UDPS (SW3) 2253 enables (or disables) the appropriate user data or file to be accessed (or denied access) and read or copied from one of the other computing environments where it has been created or modified and written back to UDPS 2143 of computing environment 2108-3. In some embodiments a single switch provides bi-directional capability to read from and write to the user data protected storage 2143 so that only one switch (or set of switches) is required. It will also be observed that as the secondary template that is copied and sent from MTPS 2142 is not usually modified, there is typically no need to write it back to MTPS 2142. Therefore the copying from MTPS to STP may be unidirectional. Separate bi-directional handshakes and control signals or levels may be used as a signaling protocol for such events as request to copy, ready to copy, copy complete, data received, and the like. Parity or other error detection and error correction may be implemented as known in the art and consistent with aspects and features of the invention to verify that the transfer occurred without error, though this is optional.

In one embodiment, modification of a master template (or other template that may be used in the system) may involve: copying or loading it into one of the user isolated computing environments; then (ii) updating it using any necessary operating system, application program, complier, debugging, linking, or other programming procedures as are known in the art; and (iii) copying it back and saving it as the new master template in protected storage. The copied and saved version of the master template may replace the original or may be saved as a new file or as an updated version.

These switches or sets of switches may be a component or set of components of computing environment 2108-3, a separate component or set of components outside of computing environment 2108-3, or some combination thereof. In one embodiment, the switches are provided in hardware logic circuits, in another they are implemented by a micro-controller having a very limited set processing capabilities so that sophisticated multi-component and multi-signal switching schemes may be implemented but that do not enable malicious code to execute. In still another embodiment, the WO 2005/116804 PCT/US2005/001484 switching is implemented as an Application Specific Integrated Circuit (ASIC). In yet another embodiment, the switching is performed under the control of a micro-processor that has a very limited instruction set installed as its secondary template portion (STP) so that it cannot execute or permit execution of malicious code.

As described elsewhere herein, the protected storage can be implemented on or within any type or combinations of type or storage device or memory. In one embodiment, a provision is made for external and portable protected storage, so that for example a user could have their protected storage on a credit card size storage device (such as a flash memory card, USB memory device, Sony MemoryStick, PC Card based memory, or any other form of storage) and just plug it in at any one of a supporting computer or device. In one embodiment, the architecture, system, and method provide an optional hidden and protected backup storage system.

Control Switching Computing Environment Attention is now directed to control and switching computing environment (CSCE) 2108-2 which is responsible (with contribution from user interface computing environment 2108-1) for controlling and coordinating the operations of the other computing environments of the system 2100. In somewhat simplified terms, the switches connect a source to a destination. In some embodiments of the system 2100, data store switch system traits are supported and such traits may further support configuring a communication path between the selected source and destination. Note that in at least some embodiments, CSCE or other controlling computing environment has the ability to switch and couple any peripheral to any computing environment.

Computing environment 2108-2 receives inputs from user interface computing environment (UICE) 2108-1 and operates the switches 2250 (for example switch sets. SW1 2251, SW2 2252, and SW3 2253) of the protected storage computing environment (PSCE) 2108-3, as well as to interact with each other computing environment 2108 to operate switches to couple or decouple (enable or disable) connections or communications between processors a CPU) and storage a STP and TDP) of the computing environment. The switch control may be more or less direct, such as through an electrical connection and signal or voltage level or set of electrical signals or levels; indirect through a processor, CPU, ASIC, or other circuit or logic elements within the computing environment that receive the signals from the control and switching computing environment 2108-2; or as a combination of these direct and indirect architectures and methods.

As illustrated in the embodiment of the control and switching computing environment 2108-2, it includes a system switching controller unit 2138 which receives commands from UICE 2108-1 responsive to user inputs and commands or system activities and events, taking account the then current status and configuration of the computing system 2100 including available computer resources.

In some embodiments, scheduling and component prioritization and utilization arbitration are also provided by the system switch controller 2138. Switch configuration and status as well as other information and data may be stored in a switch configuration information storage 2139 which is operatively coupled via one or more busses, interfaces, or communication circuits, with the system switch controller 2139.

In this embodiment, CSCE 2108-2 receives one, and more usually, a set of signals 2180 from UICE 2108-1. These signals may generally be sufficient to communicate a user request input to UICE WO 2005/116804 PCT/US2005/001484 -36- 2108-1 so that the other elements of the computer system 2100 can be configured to perform the request. For example, the user may mouse click on a Microsoft Word icon on the UICE desktop expecting launch or an instance of Microsoft Word word-processing program. While UICE 2108-1 may be configured to present to the external human user 2129 that UICE 2108-1 and its components (e.g.

CPU 2120 and storage 2121), have installed Windows 2000 operating system, Microsoft Word 2000, and the document that the user desires to edit; in fact it may not have them, and may merely provide for a pointer, link, alias, or other reference to these operating system, application program, and user data files, among other computing system elements.

In particular, the Microsoft operating system and Microsoft Word application program would be present as MT 2148 and stored within protected storage MTPS 2142 of PSCE 2108-3. The user's word processing document if in existence and not to be newly created would be stored and retrievable from protected storage UDPS 2149.

Having described some of the structural and operational characteristics of a Control and Switching Computing Environment (CSCE) also referred to as the system "brain", now set forth are a partial list of some of the functions and operations in which some particular embodiments of the CSCE participates. Not all of these functions need be performed by the CSCE (or the CCE in later described embodiments). It will be appreciated that the particular functions and operations will depend on the implementation of the computing system as a whole, the CSCE (or CCE), and the other computing environments.

In some embodiments of the invention, the CSCE loads its own operating system (OS) upon start-up (or reset) which after loading will orchestrate (some or all of) enabled or supported operations or functions by the rest of the system. The inventive architecture, system, and method are operating system neutral, and any of the known operating systems may be used or adapted for use with the invention. Different operating systems may even be used in different computing environments of the system so that if desired the computing system can operate different operating systems and the suite of application programs suited to those operating systems. In some embodiments of the invention, the operating system may be dynamically determined an loaded when for example a user isolated computing environment is designated to perform a particular processing function or operation, so long as the computing system hardware can support that operating system and the intended operation.

Some embodiments of the invention will utilize different operating systems for different computing environments and such operating systems may be predetermined or dynamically determined as a function of time or task according to the needs of the system, the user selected processing task, the nature of the data, or according to other factors. For example, any of the Microsoft Windows operating systems known or announced Windows 98, Windows NT, Windows 2000, Windows XP, and improvements, enhancements and extensions thereof), Linux, Unix, Apple Operating Systems, various disk operating systems (DOS), or other specialized or proprietary operating systems or control programs may be used in the various computing environments so long as they support the intended operation and devices for that operation.

In some, but not necessarily all embodiments of the invention, the CSCE operating system or application programs (or a combination of these two) may be responsible for controlling or orchestrating (some or all of) the following functions, which is only an exemplary partial list: data storage device WO 2005/116804 PCT/US2005/001484 -37- (DSD) connection switching; (ii)send commands to computing environments to launch computer program applications (or hardwired operations when applicable) with optional verification of receipt of the commands and/or completion of the commanded operation; (iii) track coordinates of clickable windows and/or cursor; (iv) execute repairs and detection, cleaning, and/or destruction of viruses or other malicious code; conducts and control switching, reformatting, erasing, copying of templates and/or master template, resetting, rebooting, and other operations as described; (vi) generate and display "isolated global taskbar" or the equivalent user accessible user interaction tool (alternatively this taskbar or tool may be generated by the desktop and interface computing environment). These or other embodiments may also optionally provide for any one or more of: (vii) an "open" dialog screen; (viii) a "save" dialog screen; (ix) conduct switching of network communication (for example, see the description of the "netlock" operation); receive secure signals from communication environments; (xi) track the order in which communication environments are created and/or current communication environment order or priority; (xii) conduct switching of mouse and keyboard to and among the different computing environments; (xiii) conduct switching of other input/output or peripheral devices to and among the different computing environments; (xiv) coordinate the email access and processing; and/or other combinations of these functions.

In one embodiment, the CSCE may also have responsibility for controlling, coordinating, and/or processing video signals associated with processing activities in the various computing environments (including processing activities in the CSCE itself), or a separate computing environment or video processing unit or logic circuit or other means may be used for this purpose. When a separate video processor or controller is used, the CSCE may generally be responsible for coordinating and orchestrating it's operation with the other system components, but in some embodiments the video processor or controller may participate with the CSCE or other controlling of the system.

It will be appreciated in light of the description provided here that while separation of user computing environments (where potentially contaminated files may be opened and executed) from control computing environments is provided; the description of user interface, control and switching, protected storage, video processor and other operations and functions that operate on known clean data or computer programs as separate computing environments is somewhat artificial and primarily for the purpose of description here. It is noted that embodiments of the invention provides for separation of various non-user data control or processing environments as well as embodiments where these control functions are combined. While some combinations are specifically described by way of example, it is understood that any other combination of the different control or administrative functions and operations are supported consistent with the other principles of the invention.

It will also be appreciated that different levels or degrees of isolation may be required or allowed for different computing or processing environments or a different times within a particular or set of processing or computing environments. For example, in the situation where an unknown file or data set is to be opened and processed in an computing environment where a virus or hacker code may be exposed to a processor and code that might execute such code, the isolation between that file or data set and the "outside world" is absolute and contained within the user isolated computing environment.

This absolute isolation is between the particular user computing environment and other user computing environments and control environments.

WO 2005/116804 PCT/US2005/001484 -38- In other situations, the degree or level of isolation may be limited so that no harm, or a permitted degree of harm set my the computer or user, can be tolerated. This represents a kind of user or administrator override and may be set certain policies and rules that permit a more permissive use of the system. For example, if the computing system is normally used within a corporate computing environment on an Intranet with current anti-viral software, firewalls, and other protection provided by a corporate information technology (IT) department, it may be permissible to disable special processing of email because of the filtering already provided. Other embodiments, may provide for override all isolation when the network or computing environment generally can be trusted. While this permissive override may not be referred in all embodiments, it does show the flexibility afforded by the inventive architecture, system, and method. Therefore, it will be appreciated that different levels or degrees of isolation may be provided and the invention is not to be construed to be limited to architectures, systems, methods, or procedures that are intolerant of some degree of non-isolation or override.

Operations performed relative to processing video (digital or analog) from the different computing environments may include, by way of example but not limitation: merge or otherwise combine or format outputs from the several computing environments signals 2187-1 2187-5, 2187-N) for display on a monitor or display device. While any of a variety of initial or default conditions may be implemented, in one embodiment the default setting upon booting is to have the computing environment video signals disable or turned off because there should be no activity in any of the unallocated computing environments until some system or user initiated activity has been commanded.

Alternatively, the CSCE (or other entity) may turn on/off or enable/disable the video signals.

In some embodiments, the "processing" of video outputs from the computing environments is accomplished to present a "layering" effect on, for example, a single monitor. For example, the most recently active computing environment may always be moved to the "top" (or "front") layer or otherwise be treated according to predetermined rules or policies. The CSCE may contribute to controlling and orchestrating this process if it is not itself directly responsible for it. For example, the CSCE may send one or more commands to the video controller to help determine which "layer" to put in "front", and how to merge the video outputs from the various computing environments. The CSCE has this information because it maintains databases of information pertaining to layers, active computing environments, unallocated or inactive computing environments, window locations, mouse or pointing device cursor coordinates and locations and switching, for other purposes such as determining mouse clicks.

In some embodiments, such as in embodiments where a video graphics card or video subsystem may continuously send a signal (even for a "black" or empty screen), the video signal may be turned "on/off' or "enabled/disabled" at the video controller. Alternatively, the CSCE or video controller may simply be directed to "ignore" this signal from a particular computing environment when that computing environment is unallocated or inactive. In other words, the computing environment video cards (whether separate cards or chips or integrated with a processor or other logic circuits) could optionally always be "pumping out" a video signal, or the CSCE or other video controller could only have them output such video signal when they become active processing environments. This would beneficially decrease power consumption and heat generation, and may have the effect of increasing longevity of the system and its components. The CSCE may also send out a signal to the video controller or processor (when present) to tell it what video inputs from the computing WO 2005/116804 PCT/US2005/001484 -39environments to process, and what information for each video input that is to be used and what information may be ignored. For example, portions of a desktop for each computing environment may be suppressed when it is duplicative or does not represent actual activity in the computing environment.

Isolated Processing Unit Computing Environments System 2100 also includes one or a plurality of other unallocated isolated processing unit (IPU) computing environments (IPUCE) or shells, such as CE 2108-4 and CE 2108-5 which in the embodiment of FIG. 9 each include CPUs (2160, 2170), storage (2161, 2171) including STP (2162, 2172) and TDP (2163, 2173), interfaces (2169, 2179), and switches (2164, 2165, 2174, 2175) for coupling or decoupling (enabling or disabling communication) between the storage and the CPU.

This combination of operating system, application program, user data file, and computing hardware to support and interoperate with the operating system, application program, and user data, under control of the CSCE 2108-2 via UICE 2108-1 enable protected and isolated processing of the selected Microsoft Word program with the user data.

Operationally, UICE sends commands including any necessary data via signals 2180 to CSCE 2108-2. CSCE receives these signals taking account of current assignments of system 2100 resources and any other rules or policies to system configuration, selects an appropriate computing environment, such as computing environment 2108-4. Other embodiments of the invention provide for dynamic allocation of separate elements (such as CPU and storage) which can be assembled as a computing element even if not physically connected at the time of manufacture of the computer and even in not adjacently located within the computer system 2100 hardware.

Once the computing environment 2108-4 has been selected by CSCE 2108-2 and more particularly by rules policies or algorithms within system switch controller (SSC) 2138, the SSC sends one or more signals 2186-4 to CE 2108-4 to communicate that it has been allocated to perform a Microsoft Word processing program under the Microsoft Windows 2000 operating system with an identified user document file. CE 2108-4 optionally acknowledges that it has received the communication under some handshake or other communication protocol, even a communication protocol as simple as a single logic voltage level. Therefore the signal(s) 2186-4 may be unidirectional or bi-directional. SSC 2138 also communicates one or more switch control signals 2181 to switches 2250. For example, switch control signals 2181-1, 2181-2, and 2181-3 to configure one or more of switches SW1, SW2, and SW3 to permit the desired storage access. These same switches may optionally but advantageously acknowledge the communications from SSC and provide status back to indicate that the switches are in the proper configuration (open or closed, or enabled/disabled, for example) for the intended cooperation. Likewise, the switches 2250 may send a ready to send data type communication to the target destination such as the STP 2162 and/or TDP 2162 of storage 2161, and these may optionally though desireably indicate a ready to receive data type status signal back to the switches 2250.

Specifically in this word processing example, SW1 2251 would enable a communication of all or a selected part of the master template that includes Microsoft Widows 2000 operating system and at least Microsoft Word application program. Note that in some embodiments, the operating system and application program may alternatively be separately provided from separate sources. In yet other embodiments, the operating system may be provided within the computing environment so that it need WO 2005/116804 PCT/US2005/001484 not be communicated each time, either stored on the STP 2162 so that it need not be communicated each time or within a coupled ROM, or in other ways. Note, however, that where the STP is not cleared after use, there is a possibility of contamination if the STP may have been written to by malicious code, but may not be a problem if retrieved from a read only memory or ROM.

Either in parallel (where the communications paths provided are sufficient to support multiple access paths) or sequentially (where the communications paths 2187 may not be sufficient to support multiple access paths) SW1 2251 is configured to connect the MTPS 2142 to STP 2162 where upon STP 2162 receives the required computer program code. Likewise, SW2 2252 is configured to provide a communications path so that the identified user document file from, UDPS 2143 can be copied to TDP 2163. Recall that the hardware/ firmware/ software accessible during the copy operations are not sufficient to permit execution of any malicious code. For example, a hardware only copy circuit adapted to copy bits from a source to a destination cannot be corrupted by viral, hacker, or other malicious code and may be made to only grab (or read) bits from a source and replicate (or write) bits to a destination.

Buffers between source and destination may optionally be used as may filters or limiters. Software and/or programmable hardware may also be used for the copy operation but the capabilities of such copy means are advantageously protected from contamination of unintended modification that may compromise system or computing environment immunity. Desirably, the copy operation is only a copy of binary bits or sets of bits without any other interpretation; however, though desirable the invention need not be constrained by this condition and other protective measures may be utilized to prevent possible execution of malicious code.

In one embodiment, the process of copying data may be "dumb" or restricted so that data being copied cannot execute and thus the data on that data storage device cannot be damaged by malicious code. For example, to move or copy data it can be encoded, or an ASIC with limited functionality can be utilized, or direct memory transfer or any other method of moving or copying data can be used that does not allow data that may contain some executable code of bit-sequences to execute. Optionally, copying could be orchestrated by a control system that could address or have access to the isolated working system(s) and isolated or protected storage system(s).

Selecting a file to open in the storage system could initiate a process whereby a file is copied from the storage system or source (such as UDPS) to the working computer environment (such as the STP 2166 of IPUCE 2108-4) and after terminating the connection with the UDPS 2143 through the switch 2250, the data or file may be opened and permitted exposure to the CPU 2160. Saving a file in the working computing environment could initiate a process whereby the file is copied to the storage system. Quitting a file in the working computing environment could initiate a process whereby the new or updated file or data set is copied or written to the destination storage system (such as the UDPS 2143) and deleted (and desirably physically erased) in the source storage system (such as the TDP 2161). The term "copy" or "copies" or "copying" may be used in its broadest sense, and may include but not be limited to an algorithm, snapshot, compressed data, bit-by-bit, encryption, encoding, and the like.

The isolated computing environment may also send or otherwise communicate flags or other information or indicators 2191 identifying a status or state of the isolated computing environment (or some component within the ICE) to the control and Switching computing environment 2108-2. Such status or state may include and one or a combination of a ready for operation status, a complete WO 2005/116804 PCT/US2005/001484 -41processing status, a file ready for copy or save status, a reset status, and/or any other data or information that the controlling environment would need or be able to utilize.

The isolated computing environment may also send or otherwise communicate window x-y coordinates and optionally window dimensions 2192 for use by the controlling environment 2108-2 and/or the desktop and user interface computing environment 2108-1 (or by a separate video graphics processor or video display unit controlled by CSCE) to combine or merge the different computing environment windows to a single display device (if such single display is desired). The communication lines or links 2191, 2192 may also be shared over a single line or link. Furthermore, various traits as described elsewhere in this specification may be communicated over the communication lines or links.

These as well as any other communication path, communication link, or signal lines may be fitted with filters or limiters as described elsewhere in this specification to limit the type, sequence, number, or volume of information, data, binary bits, or the like to further reduce the possibility of infection between one computing environment and another. These filters and limiters are described in greater detail relative to other embodiments of the invention.

Once an appropriate combination of operating system, application program, and user data is present in CE 2108-4, the word processing operation can commence. The file can be saved either within the TDP 2163 until exiting the word processing program, or by using intermediate saves with write operations to UDPS 2143 via an appropriately configured switch SW3 2253.

Advantageously, when any read or write operations are made between MTDS 2142 or UDPS 2143 and a storage (such as STP 2164 or TDP 2163), the CPU 2160 is decoupled from the storage or disabled, so that MTDS 2142 or UDPS 2143 are never exposed to CPU 2160 in a way that might permit malicious code to be executed and contaminate the protected storage MTDS 2142 or UDPS 2143.

Once the word processing is complete and the new or edited file is written back to protected storage, a signal or state change or "flag" or other indication, and following instructions from the CSCE, the contents of STP 2162 and TDP 2163 are cleared and erased. This clearing or erasure should be an actual erase, such as by over writing the storage media, or formatting master boot records, or partition tables, so that any malicious code that might have been present in the last data set stored there is not spread to other files or data sets. This differs from most conventional systems which merely update a directory to remove the reference to the deleted file rather than actual erasure. The desirability of erasing the storage, space used and preferably the entire accessible storage space makes fast solid state memory more desirable than slower electro-mechanical storage such as hard disc drive storage. It also makes minimizing the amount of storage space that is accessible in a computing environment a consideration. The ability to dynamically allocate storage space in some embodiments of different size, to add to the accessible memory as the process generates a need for more memory, and to configure both solid state memory and larger and less expensive hard disk drive storage.

Reflection on the description provided to this point will reveal a situation in which a user data that was present in protected storage UDPS 2143 that was contaminated with a virus was moved with the virus to CE 2108-4 and then exposed to CPU 2160 and an operating system that is capable of supporting execution of the viral code within the computing environment.

WO 2005/116804 PCT/US2005/001484 -42- If the virus does not execute for whatever reason, such as the virus having an execution date condition that is not satisfied while exposed to the CPU and operating system, it will be returned with the file that contains it or even as a new and independent file to protected storage UDPS 2143. In this case neither the particular computing environment 2108-4 nor the system 2100 as a whole suffered any harm by virtue of having been exposed to the virus (or other malicious code).

On the other hand, if the virus (or other malicious code) does execute while within computing environment 2108-4 and explodes or otherwise contaminates CPU, CPU associated RAM or other memory, and/or the STP 2162 or TDP 2163 storage, its harmful effect is limited to the isolated computing environment 2108-4. No path is provided in this architecture and processing system and method to permit the virus or other malicious code to escape to the rest of the system 2100 and cause the system 2100 or data within the protected storage MTPS 2142 or UDPS 2143. Even if the virally contaminated file is returned to protected storage MTPS 2142 or UDPS 2143, the other operating system, application program, or other data files cannot be contaminated because the PSCE 2108-3 does not include a processor that can execute any bit pattern contained in the data, they are just "0" and bits and have no programmatic meaning within that computing environment. Again recall that the only operation the bits are exposed to is a dumb copy operation by hardware, software, and/or firmware that can only perform the copy and little if anything more. Where a virus executes while in a computing environment 2108 other than the PSCE, it may damage or destroy the copy of the file, the original data or file in PSCE is still in tact. Clearly, it may be desirable once a virus or other malicious code is discovered to exist, to take steps to clean or remove the virus and replace the virally contaminated version with a cleaned version. Such viral or malicious code detection and/or cleaning operation may in fact be one of the processes that is performed in the isolated computing environment on a copy of the file before the cleaned copy of the file is returned to protected storage. Saving files as versions rather than over writing is an alternative storage option.

Having now described the structural and operational features that enable safe processing of even maliciously infected files, we now digress to describe the graphical or display screen presentation to the human user 2129. For purposes of description, we assume that the computer system 2100 is providing a windowed system where each process may be displayed in a separate window of a display subsystem. Operating systems such as Microsoft Windows, Unix, Linux, Apple Macintosh OS, and other common operating support such windowing and structures and techniques for presenting a display of each process in separate windows of a common display. Therefore each computing environment provides a display screen or graphical output 2187 that is processed by a video display subsystem 2192 to present a windowed multi-taking processing system just like that of conventional multi-tasking windowed systems. Input/output such as via keyboard 2190 and mouse 2191 or other pointing device is similarly provided by allocating the keyboard button presses and mouse to an active process or window. The user 2129, or in some situations, the system itself identifies a selected or active window, and the keyboard and mouse actions are tracked and identified to the selected process.

Essentially the keyboard, mouse or pointing device, and display process are allocated to the active window or other identified active process through the UICE 2108-1 and the CSCE 2108-2.

In analogous manner, each other device or peripheral within the computer system, including any one or more of the floppy-disk drive, USB ports and any USB peripheral devices attached through WO 2005/116804 PCT/US2005/001484 -43these ports, modems, network interface circuits or cards (NIC), modems, SCSI interfaces and devices, PC Card slots and interfaces and devices connected via these interfaces, CD readers/writers, DVD readers/writers, scanners, printers, audio systems, microphone, speakers, serial or parallel interfaces and devices coupled with these interfaces, cameras, recorders, and without limitation any other IO or peripheral device or system that can be coupled to the computer or information appliance.

Recall that as this inventive architecture, system, and method can be applied to a diverse set of devices and appliances that have a processor, such as but not limited to computers, PDAs, mobile communication devices and telephones, cellular telephones, digital cameras, video recording devices, navigation and mapping systems, automobile engine management systems, aircraft navigation and guidance systems, network servers and routers, digital and HDTV television receivers and processors, security systems, and all manner of other electronic devices and systems that incorporate a processor and are susceptible to viral, spyware, bots, computer hackers, and other malicious code. Recall also that even non-intentional problems associated with execution of computer code that has not been completely debugged may be handled in a manner that prevents any failure in the code from having harmful effect on the rest of the system if it is tested, debugged, or otherwise utilized in one of the isolated computer environments. Therefore the set of possible input devices, output devices, input/output devices, and peripherals is a broad and diverse set and is not limited to those devices normally associated with conventional desktop or mobile notebook computing. A peripheral device may for example be an automobile or aircraft controlled or monitored by a information system made according to the principles of this invention.

It will also be appreciated in light of the description provided here, that although these different peripherals are visible in the desktop environment of the UICE 2108-1, the process that would actually access these peripherals (beyond the keyboard and mouse) would derive from one of the other isolated processing environments requiring access to the peripheral or more preferably would spawn or initiate a new process to interact with the peripheral and via the data stored and shared via the UDPS, provide data or otherwise interact with the peripheral device or subsystem.

Alternative Embodiment Combining Functions of User Interface Control Switching, and Protected Storage Computing Environments Having described the structure and operations performed by the Control User Interface Computing Environment 2108-1, Switching Computing Environment 2108-2, and Protected Storage and Read/Write Computing Environment 2108-3, it may be appreciated in light of the description that these operations may be combined and performed in a single computing environment that is separate from an Isolated User Computing Environment such as Isolated Computing Environments 2108-4 or 2108-5 in the embodiment of FIG. 10. In particular such an architecture and system configuration may provide at least some of the advantages of the inventive system and method so long as the combined block has no capability to execute user data and/or untrusted code and can only perform such operations as moving or copying data or programs to an isolated computing environment for execution but cannot open or execute them. In some embodiments, only trusted access is permitted to the controlling entity (whether distributed amongst a plurality of computing environments or combined). For example, depending upon rules and policies that may be implemented, a keyboard and mouse input may be treated as a trusted input or interaction medium. Standard security procedures for turning or WO 2005/116804 PCT/US2005/001484 -44powering on, logging into a computer or device, such as password or biometrics may be implemented to give some additional assurance that the user accessing the system and therefore possibly inputting keyboard and mouse inputs is authorized and trusted.

Alternative Embodiment With Dvnamically Configurable System Components Having described one particular multiple computing environment embodiment that sets forth some of the operational, control, interface and protection features, we now direct attention to another alternative in which a common set of computing environment are used to implement the particular set of User Interface computing environment (UICE), Control and Switching Computing Environment (CSCE), protected storage computing environment (PSCE) and the other computing environments (CE) which may be configured to perform word processing, email, internet browsing, or other operations.

With reference to FIG. 10, there is shown an alternative embodiment of a system 2200 for processing data or other information. As with the just described embodiment 2100 of FIG. 9. this system and architecture 2200 along with the methods and procedures for configuring the system and for operating the system are applicable to a broad and diverse set of electronic devices which would conventionally include one or more processors, controllers, microprocessors, central processing units (CPU), ASICs, logic circuits, or other means for processing electronic data.

For convenience of description, certain elements such as the various computing environments, peripherals, switches, and control lines and other signals have been drawn with the same or similar topology and given the same reference numbers. It will be appreciated that there are many ways of implementing the principles of the invention and that each of these descriptions and drawings (for example, the embodiments and system configurations of FIG. 9 and FIG. 10) are exemplary of a way of implementing and operating a system according to the invention.

System 2200 includes Desktop and User Interface Computing Environment (UICE) 2108-1 processing unit, Control and Switching Computing Environment (2108-2) processing unit, Protected Storage Computing Environment 2108-3 processing unit, and two Isolation Processing Unit Computing Environments IPUCE#1 2108-4 and IPUCE#2 2108-5. In the embodiment of FIG. 9, typical processing unit elements were illustrated and described to accomplish the desired operation of the particular processing unit 2108-1 2108-5 2108-N. In the embodiment of FIG. 10, there is illustrated a common component configuration which permits a plurality of modular units to be dynamically configured to perform the functions and operations required for initialization, configuration, and operation of the system 2200. While identical or common components are not required, there are advantages to using a common set of components which are or may be customized with software, firmware, and user or system data according to the intended operation and processing function.

Given this general correspondence between the computing environments 2108-1 through 2108-5 this description highlights the implementation differences (if any) and/or details.

With reference to the Desktop and User Interface Computing Environment (UICE) 2108-1 processing unit, it is noted that the CPU 2120 is now show to include a processor (PR) and Processor coupled memory in the form of RAM, and an optional processor chip set and BIOS as are known in the art. It will be appreciated than any form of processor, micro-processor, central processing unit, ASIC, or other logic circuit capable of performing the tasks of the Control and Switching Computing Environment (2108-2) may be utilized. Note that even for an overall system 2200 which may be WO 2005/116804 PCT/US2005/001484 required to perform sophisticated and complex data processing and which may require a CPU capable of executing complex computer program instructions, the "processor" of the Desktop and User Interface Computing Environment (UICE) 2108-1 processing unit may be a much simpler component.

Similar statements can be made about the Control and Switching Computing Environment (2108-2) processing unit and Protected Storage Computing Environment 2108-3 processing unit. In fact, in some embodiments, the function of the Control and Switching Computing Environment (2108-2) processing unit and Protected Storage Computing Environment 2108-3 processing unit can be performed by a single unit 2155, and in even other embodiments even the function and operation of the master template copy switch 2151 and the protected storage copy switch 2152 can be combined into a single unit 2156.

The UICE 2108-1 is also illustrated as, receiving control signals 2184A from CSCE (2184A-1), operating system (OS) and/or application programs from the protected master template (2184A-2), and data from protected storage (2184A-3). It also may send data back to protected storage (2184A-4).

These four sets of signals are illustrated as being present in each of the computing environments though to preserve clarity, not all of the connecting lines are shown. For some processing operations, not all signal lines may be required or used.

The embodiment also shows the allocation function that interoperates with the UICE, CSCE, and PSCE to couple and make available the different peripherals to the processing operations that may require them. it is noted that in at least one embodiment, the Keyboard and mouse (or other pointing or selection device, such as for example a touch screen) is available to the other computing environments and directly to the desktop and user interface computing environment processing unit.

An optional ASIC 2126 is also illustrated. In at least some embodiments, the CPU or an ASIC (or other logic circuit) may be sufficient to provide the required interface processing capability, but both are illustrated here in the interest of modularity and generality.

With reference to the Control and Switching Computing Environment 2108-2 processing unit, the control and switching computing environment processing unit (CSCE) is shown as a similar set of components though it will be appreciated that the contents of the storage for programs and data will typically be different according to the functions and operations provided by the computing environment.

In the case of the CSCE 2108-2, the temporary storage 2149 is indicated as including I/O switch configuration data 2158 and data transfer or read/write switch configuration data 2159.

With reference to the Protected Storage Computing Environment 2108-3 processing unit, again a similar set of components are shown. The protected store for the master template and user data is illustrated as being part of this unit. A complete copy of the master template including operating system and application program elements, or in some embodiments, copies of multiple templates appropriate to different processing operations that might be requested by a user, were stored in this protected storage 2141. User and possibly system files are stored in the protected data storage UDPS 2143.

Recall that the protected storage is not to be exposed to a processor or CPU capable of executing the user's data (or code instructions) that might be present, so that if a processor or CPU is provided, either it would be disabled or disconnected from the protected memory. Thus, switches 2144 and 2145 would be open or other steps taken to disable the processor, such as removing the operating voltage or withholding an operating clock signal required for operation. This may generally mean that a circuit WO 2005/116804 PCT/US2005/001484 -46such as an ASIC or other logic or processing circuit 2146 perhaps in cooperation with software and/or firmware would provide the processing capability to read and write to the protected memories and to preserve their isolation. It is noted that the master template copy switch and the protected storage copy switch or switches may be part of the PSCE or separate but in communication with it. The copy (read and/or write) can for example be performed by the ASIC or other logic or processing circuit 2146.

With reference to the two Isolation Processing Unit Computing Environments IPUCE #1 2108-4 and IPUCE #2 2108-5 also maintain this modular computing environment structure. These processing units may advantageously include a CPU that supports the full spectrum of processing operations that they might be asked to perform, such as word processing, connection with and interaction with the Internet, cellular telephone call reception and voice coding and decoding, and the like.

Embodiment With Combined Control User Isolated Computingl Environments With reference to FIG. 11, there is illustrated another alternative embodiment 2300 of the invention having a combined control computing environment and one (or more than one) isolated computing environment for user processing. The combined control computing environment orchestrates the operation of the computing system 2300 to provide any required operations of the afore described Control User Interface Computing Environment 2108-1, Switching Computing Environment 2108-2, and Protected Storage and ReadWNVrite Computing Environment 2108-3 of the earlier described embodiment. Isolated computing environment 2304-1 may take the form described in earlier embodiments and is not described in greater detail here, except that such ICE will normally include processing logic 2381 for executing the set of instructions intended of the ICE and storage 2380 switchably coupleable and decoupleable with the processing logic.

It will be appreciated that in any given embodiment some features and procedural steps'will be optional and not required depending upon the capabilities desired to be implemented and/or the degree of security or immunity desired. Some features and procedures may be dynamically implemented according to a current status of the system and an intended computing environment operation, among other factors. In any case, it will be appreciated in light of the description that these control operations are performed in a separate (physically or temporally) computing environment from an Isolated User Computing Environment.

In this embodiment, a control processing or computing environment (CCE) 2302 is established and operates to create, control, and terminate one or more isolated computing environments 2304-N.

In this embodiment, only one isolated computing environment 2304-1 is illustrated for simplicity of illustration, however, it any number of such isolated computing environments (ICE) or subsystems for user processing may be fixedly or dynamically configured and operated.

CCE 2302 includes some logic circuitry or other logic means 2320 (such as for example, a controller, micro-controller, processor, microprocessor, central processing unit or CPU, ASIC, programmable logic, or the like) and storage 2321 switchable coupleable and decoupleable to the logic means 2320 via one or more communication links 2328 through one or more switches or switching means 2325. Switch or switching means 2325 may generally include a plurality of switches or switching elements appropriate to couple or decouple the signals and data of interest between the storage 2321 and the logic means 2320 and may for example include signal conditioning circuitry as known in the art for coupling and decoupling storage with logic circuitry such as with a CPU.

WO 2005/116804 PCT/US2005/001484 -47- Depending upon the type of logic circuitry or logic means 2320, separate memory such as in the form of a ROM, RAM, registers, or the like may be provided and may also be switchably connectable or disconnectable (enableable or disableable) through one or more memory switches 2326. Switching may selectively enable either direction for read or write) or bi-directional communication or signaling to/from the memory or storage. In the context of this and the other embodiments of the invention, switch, switches, switching means, and the like terms are to be given their broadest possible interpretation and any device, logic, hardware, or software that either physically or logically couples or decouples a signal from one location to another location or that enables or disables an ability to communicate a signal between such locations independent of whether an electrical or optical connection exists or may exist.

The type and capability of the logic circuitry or logic means 2320 may generally depend on the logic or other processing operations to be performed by CCE 2302. For example, the processing operations to be performed as control for a general purpose notebook computer may be different than the control operations to be performed for a cellular telephone or an electronic camera, at least in part 1 5 because the operations to be performed by these different devices may generally differ.

In some embodiments the various switches (for example switches 2350, 2360, 2325, 2326) and switching capability for coupling or decoupling communication or signals with storage 2321, memory 2322, I/O or peripheral devices (such as for example, keyboard 2390, mouse 2391, or network NIC 2392), and/or storage device(s) 2380 in the isolated computing environments 2304, may be provided by logic circuitry 2320 or in other embodiments separate switching logic may be provided and that is controlled all or in part by the logic circuitry or logic means 2320. In this or other embodiments, a single switch or set of switches or multiple separate switches or sets of switches may be utilized to accomplish the desired switching operations.

While at least some of the switches may be controlled at least in part by CCE 2320, it will be appreciated that the communication links, signal lines, busses, or other connections may not pass through or be accessible by elements of the CCE 2320. For example, it at least one embodiment, network NIC 2392 may be switchably connected or disconnected with an isolated computing environment 2304-1, but the data or bits received from the NIC do not pass through CCE 2320 but only pass to the ICE 2304-1 so as to prevent exposure to a malicious agent. In at least some embodiments, separate modem and/or Network NIC devices and communication paths are provided for receiving data from the external environment and for sending data to the external environment so as to provide an additional measure of immunity and system protection. When received data is separated from transmitted data, this also provides a measure of protection for other computers or devices external to system 2300 because the chances of sending data that is contaminate or contains a malicious agent is reduced or eliminated. Storage 2321 may be implemented as a single physical device, as a combination of two or more physical devices, or as one or portions of one or more physical devices. It may for example be any type of magnetic, optical, solid-state, or other memory types as are known in the art or may be developed.

In the illustrated embodiment, storage 2321 provides master template protected storage (MTPS) 2322, user data protected storage (UDPS) 2323, switch configuration information or data 2324 for the storage device and/or for I/O devices, as well as an operational portion of whatever operating WO 2005/116804 PCT/US2005/001484 -48system elements and application programs 2325 as may be needed to support the device interface with the user and control. Temporary working storage 2326 may also optionally be provided. In some embodiments, the type of storage for these different stored components may advantageously be selected to facilitate fast read and/or write access and/or erasure of components from the storage. In particular, solid-state or semiconductor memory may facility fast access and ready and reliable erasure of a user computing environment after that user computing environment session has completed and is being terminated or closed.

One or more isolated computing environments 2304-1, 2304-N may be fixedly or dynamically configured. When the number of processors or other hardware may tend to limit the number of physically hardware) distinct sessions, additional isolated computing environments may optionally be implemented using temporal separation but intermittently accessing the hardware as described elsewhere in this specification.

Each ICE 2304 is advantageously switchably coupleable to storage (or portions of storage) 2321 via a CCE controlled switch 2350 so that access for read and/or write with protected storage (e.g.

MTPS 2322 and/or UDPS 2323) or other portions of storage 2321 as may be required. In the embodiment illustrated in FIG. 11, there is shown a Data-In 2351, a Data-Out 2352, and a OS-Apps (Operating System and Application Programs) 2352 communication or signals path. In different embodiments, a single communication or signals path (such as a wire, multi-wire bus, or optical link) may be used with path allocation and arbitration circuitry or other logic means to allocate and control communication over such single link. Furthermore, in embodiments that may provide for any operating system and/or application programs within the ICE 2304 there is no need to provide a path between storage 2380 in the ICE 2304 and storage 2321 within the CCE.

This or these same communication links 2351, 2352, 2353 may also be used to communicate any flags 2355, window x-y coordinates 2356, ICE video output 2357, and/or to couple peripheral devices on a dedicated or temporally shared intermittent basis. Alternatively separate dedicated or shared communication links may be utilized for these signals or data.

Flags 2355 provide status and/or command and control between CCE 2320 and ICE 2304 such as but not limited to flags or status for: "ICE ready to read Master Template", "ICE ready to read user protected data", "ICE processing completed", "ICE Processing Error encountered", "request to save file to protected store", "file save operation complete", "CCE command to reset and erase ICE", and other status and commands to support the desired operation. In some embodiments of the invention, the nature and complexity of the flags are deliberately kept simple and short (such as a few bits or bytes) so as to reduce or eliminate any possibility that the status or command and control flags might inadvertently communicate or transmit a virus or malicious code between the ICE and the CCE.

As already described relative to other embodiments, a video or graphics related output signal or data 2357 is provided from each ICE so that a rendition or representation of the ICE user environment a word processing screen) can be captured and displayed on a display screen or other deice 2393. In most embodiments, a single display device will be utilized but the invention does not preclude multiple display devices or indeed multiple video or graphics processors. When operating in a windowing environment, window x-y or line-sample coordinates and window sizes or other descriptors for the ICE window are communicated to CCE (or to a video processor 2392) controlled by CCE so that WO 2005/116804 PCT/US2005/001484 -49multiple windows from different ICEs can be combined with each other and optionally but desireably with a desktop Microsoft 2000 desktop) display generated by CCE 2302 or the video display 2393.

Filters or limiters that limit the type and/or amount of data communicated over the communication path may optionally but advantageously be provided between the CCE Storage 2321 and the ICE 2304, and/or between the ICE 2304 and the video display control unit 2392, and/or between the ICE 2304 and the CCE relative to flags, window coordinates and dimensions, or other status or command and control signals.

For example, a storage access limiter 2370 may be provided between storage 2321 and ICE storage 2380. In analogous manner, a limiter 2371 may be placed in the video signal path between each ICE and the CCE or video display control unit 2392.

In one embodiment, the limiter is combined with the switches (such as with switches 2350, 2360), while in other embodiments they are separate. Such filter or limiter function may also be implemented either as part of CCE logic or as part of ICE logic or as part of both. Redundancy with some validation between ICE and CCE elements may optionally be provided. In general, in this embodiment, any of these filtering or limiting operations will involve a comparison between an attempted communication and a permitted set of communications. If the attempted communication is permitted it will be allowed to pass, and if not permitted will not be allowed to pass. Various error messages and/or notifications may optionally but desireably be implemented according to rules or policies.

Embodiment Having Single Temporally Isolated Computing Environment for Control and Isolated User Processing With reference to FIG. 12, there is illustrated an embodiment that provides only a single physical computing environment but that can support a plurality of logical or virtual computing environments using intermittent access and temporal or time separated access. This single physical computing environment can support the control of the CCE as described in the previous embodiment and the isolated processing computing environment of one of more user processing sessions. This type of intermitted access with temporal separation may also be utilized with other embodiments of the invention that have or can support multiple physical computing environments. In the illustrated embodiment, a single processing logic element 2404 (such as for example, a processor, microprocessor, ASIC, controller, microcontroller, or other logic or processing circuitry means) may be communicatively coupled to storage 2406 though a switch or switching means 2412.

In one embodiment, storage 2406 may be physically or logically divided or partitioned to provide separation between an isolated computing environment storage 2410 and a control computing environment 2408 where for example, the master template and protected user data as well as any operating system and application program elements may be stored without fear of contamination. The isolated computing environment storage is provided for storing working copies of the user data, operating system and application program components, temporary storage, and the like during ICE execution. Sharing a common physical storage is advantageously accompanied by control routines or procedures that assure that execution of a malicious code while operating in the ICE mode cannot reach or contaminate or infect protected data storage, such as damage to the master template, original protected user data file, or the like.

WO 2005/116804 PCT/US2005/001484 50 Other embodiments of the invention utilize separate physical storage or memories and provide for memory address or access control so that inadvertent access such as access that may result from a hackers attempt to over-flow an allocated memory address range cannot occur. Providing separate physical storage for control and protected storage versus isolating computing environment working storage provides an additional level of isolation as it offers the possibility of complete physical isolation where communication lines or busses do not interconnect the two (or they can be physically or logically switched out or disabled) to that no contamination can occur. The use of different physical storage also optionally but advantageously offers the advantages of using different storage devices, such as ROM or EEPROM for portions of the control environment storage, RAM for the ICE, and magnetic storage such as a hard disk drive for any large data or program storage. Either the ICE or CCE requirements for storage may also make use of a plurality of different physical memories and/or memory types.

Switch or switching means 2412 may also be responsible for coupling and decoupling input/output or other peripheral devices (such as but not limited to keyboard 2418 and mouse 2418) with a selected one of the computing environments. In embodiments where the same processing hardware is temporally allocated to the different computing environments, the switching may still be desirable to enable or disable the use of an input, output, or other peripheral device so that a desired degree of isolation is maintained. For example, although keyboard and mouse may be coupled with both control and isolated computing environment performing a word processing application, a network NIC card may only be coupled with or enabled to an isolated computing environment performing an internet network browsing session but not to the control environment.

In one embodiment, a reset mode is provided to initiate a boot or restart to a known initial state.

The operating system and application programs for this initial state are stored in non-volatile memory in the control environment storage 2408 in a form where the reset and reload can be readily accomplished. In one embodiment, it is stored in fast ROM. This mode permits the isolated computing environment to perform its processing operation normally culminating in the generation of one or more new files or data sets or the generation of a revised or new version or versions of such files or data sets. In one embodiment, the reset mode procedure looks at a particular region of storage for any such new or revised files or data sets and copies then to protected storage to either add to or replace the files in the protected storage according to defined rules or policies. As the reset mode procedure merely copies the files or data sets but does not open or execute them, protection is maintained as in the other embodiments as described.

In another embodiment, the temporal isolation with shared hardware resources is accomplished by storing and restoring intermediate logic or processor 2402 state. By storing processor 2404 and any other required state information or data, one process such as a control process can be interrupted, a new isolated computing process can be conducted (completely or in part) with its processor state being stored and restored when interrupted and resumed, and so forth. Multiple processing sessions can be conducted in this way using a minimal physical hardware set. Structures and methods for storing and restoring processor state so that multiple processes can be handled during a defined time period and sometimes referred to as concurrent processing or multi-tasking. We do not go into the details of these known structures or methods here. However, in the context of the invention, we note that registers or other memory store may be provided for separately storing WO 2005/116804 PCT/US2005/001484 -51processor 2404 state for a plurality of computing environments so that isolation is maintained and malicious code is unable to circumvent the isolation. Thus, each individual temporally allocated segment of the processor (such as for example chips, RAM, storage, or some combination of these or other components or segments) may be reset or repaired individually, as some grouping, or collectively.

In one embodiment, separate reset logic 2450 is coupled with a hardware or software reset button or switch 2451 that provides the required isolated control for transitioning between the different computing environments and for storing state when one process is interrupted and for restoring that state when the process is resumed. The reset logic may be hard-wired logic or may be programmable and generates the signals to processor 2404 and switch 2412 to effect store and restore of state and the setting of other device 2400 parameters and conditions. Control lines to the device components are provided between state storage registers 2453, storage 2406, processor 2404, switch 2412, as required. In some embodiments, a process in an isolated computing environment may be conducted to completion so that in general only the control process may be suspended and then resumed. In other embodiments, any process may be suspended and resumed.

It will be appreciated that some embodiments of this type will find particular applicability to so called thin computing devices, such as cellular telephones, and the like. In such devices, there may be a need to handle the voice processing associated with the telephone conversation, receiving an electronic image or picture, or looking up a calendar item or telephone number, during a single use of the device. By facilitating multiple processes of this type using minimal hardware, the cost of the device can be reduced and small size maintained, as well as achieving a reduction in its power consumption and heat generation.

Alternative Embodiment Having Single Temporally Shared Computing Environment for Control and Isolated User Processing With reference to the embodiment in FIG. 13, there is illustrated a generalized configuration for an architecture and system 2500 according to aspects of the invention. In this embodiment, a first computing environment 2501 includes or may be configured to include and support the functions of a desktop environment, a control environment, erasing/reformatting of functions and/or environments, switch or switches, switch configuration(s), protected storage(s), network interfaces and connections or cards, ASICs having predetermined or dynamically determined communications with an ability limit communication functionality to provide or preserve a level of isolation, video processing and/or video control, mouse and keyboard input, input/output connections, peripheral device connections and control, and combinations of these as desired. This first computing environment 2501 is coupled via a switch 2503 (which may itself be optionally configured or implemenied within the first computing environment) to a second or user computing environment 2502. This second user computing environment has the same isolation as described in the earlier embodiments of the invention and therefore provides the same immunity to virus, hacker, cyber-terror, and other accidental or intentional attacks or contamination by malicious computer program code.

Typically the user computing environment 2502 will generate a video output signal that can be processed and displayed by a display device either by the user computing environment or via the first controlling computing environment 2501. It will however be appreciated that in some embodiments of the invention not all computing environments will require a video output signal or even awareness by a WO 2005/116804 PCT/US2005/001484 -52user that a separate computing environment has been created. For example, in certain cellular telephones, a computing environment created for processing or coding and decoding voice signals may not require any video output but merely generate the required signals. This is merely one example of a situation where output is a data set, and even in this example the data set is generated and used in real-time or near-real-time and not stored. It will be apparent from the description provided in this specification that the inputs and output of any computing environment will differ depending upon the processing task.

Switch or switching means 2503 can couple or decouple data 2506 (such as for example a copy of a user file or document) between user computing environment 2502 and the first computing environment 2501 which handles the control, interface, protected storage, switching and other functions for operation of the system 2500. An additional optional restricted communication link 2508 that may include communication lines and optional ASICs or other logic circuits or logic means, may be provided to support such operations as save file, erase computing environment, erase memory, erase storage, communicate window and/or object coordinates and identity, communicate mouse coordinates, and the like as described elsewhere in this specification. It will be appreciated that the switching of these is optional and that the communication paths may be direct and that any combination of signals (command, data, etc.) can be combined and multiplexed or otherwise communicated over a defined set of communication links. Such communication links may be wires, busses, optical links, or other connection means as are known in the art.

As for other embodiments described herein, filters or limiters 2510 may be provided in any communication path to filter or limit the type, pattern, or number or amount of bits or data that are passed over the communications path. Other optional specialized dedicated communication paths or links 2526 may be provided as may other generalized sharable communication paths or links.

PC CardBus or Interface Card Embodiment and Conventional Computer Having described several embodiments of the inventive system, architecture, and method, we now direct attention to an implementation of the inventive system, architecture, and method appropriate to a card or other circuit that is attached via an ISA bus, PCI, bus, USB Bus, SCSI bus, PC Card bus, or other buss or interfaces that provide bandwidth appropriate to the level of performance desired. In analogous manner the invention may be used in conjunction with any card, chip, or chip set that can be retrofittable plugged into a system or peripheral bus, for example, into an ISA, PCI, SCSI, Firewire, USB or other buss or connection.

The PC Card implementation is particularly useful as it permits notebook computer and other information appliances having a PC Card slot or cable to be retrofitted to provide the level of security and anti-virus and anti-hacker performance without completely replacing the notebook computer.

With reference to FIG. 14 attention is directed to elements of a PC Card coupling to a host computer processor and main processor memory. In a typical PC Card interface, the PC Card connects to the PCI Local Bus of the computer via a PCI to CardBus Bridge as is known in the art. The PCI Local Bus in turn couples to the host Computer bus via a Host-to-PCI Bridge. This Host Bus is the same bus that couples to the Host computer processor or CPU. Access to the host processor and to all of the peripherals of the host computer provides an opportunity to retrofit a PC Card based auxiliary processing system that has the advantages of the inventive system, architecture, and method.

WO 2005/116804 PCT/US2005/001484 -53- With reference to FIG. 14, there is illustrated a diagrammatic illustration of a PC Card version of the invention. While PC Card is advantageously used, it will be appreciated that the invention may be embodied in other different devices and connected or coupled with the notebook computer or other information appliance by other interfaces now existent or to be developed.

The PC CardBus provides all of the signals required to couple the circuits of the inventive system with the notebook computer. In one embodiment, circuits of the host computer are used to provide the User Interface computing environment, but in other embodiments, only the processors of the PC Card are utilized for processing. In one embodiment the hard disk drive of the host computer is utilized while in other embodiments solid state memory on the PC Card or coupled to the PC Card by a cable are utilized. Advantageously where a computer has multiple PC Card slots or connectors, one slot may mount and connect the PC Card carrying the inventive processor system, and the second card can carry a memory store having hard disk drive, optical, solid state or other memory storage, or combinations of these. Storage can also be provided on both the processor PC Card and on a PC Card based storage device.

FIG. 15 is an illustration showing a generalized architecture 2600 for coupling a PC Card 2602 to a PCI-to-CardBus Bridge 2604 and by that bridge circuit to the PCI local bus 2605. This PCI local bus in turn couples to the Host-PCI Bridge 2610 which provides access to the Host Bus 2612 and to the Host processor 2614. Main memory 2616, such as DRAM, is also coupled to the Host bus 2612 and to the PCI local bus 2605 via Host-PCI Bridge 2610. The PC card in this embodiment contains the inventive computing system whereas the host processor 2614 is the processor installed in the conventional notebook or desktop computer. It will be appreciated that for ISA or PCI cards, they may couple directly to a ISA local bus or ISA bus as is known in the art. The PC Card 2602 may advantageously include storage, network interconnect card (NIC), modem, graphics processor, wireless communication, and other device and peripheral operational features of a full computer system.

Alternatively, or in addition, the PC Card 2602 may include connectors for coupling such devices to the card. In other embodiments, a second PC Card may be provided to augment storage, communication, video processing, or other features and interoperate with the PC Card (or other plug in card in a desktop type computer) 2602 containing the inventive processing and computing environments. The ability to provide the inventive computing and processing environments in a retrofittable or pluggable package may be extended to various hand-held and portable devices such as cell phones, organizers, personal data assistants, satellite telephones, appliances, entertainment systems, or other devices or systems, having a plug-in card or external interface capability.

FIG. 16 illustrates an embodiment 2700 of the invention providing separate dynamically configurable system components, such as but not limited to: memory elements (such as RAM or ROM) 2702, data storage in any form (such as magnetic hard disk drives or other storage subsystems or devices 2706, solid state memory 2708, optical storage devices 2709, and the like), video processing elements 2704, signal processing elements 2711, Ethernet interfaces 2712, network interface cards 2713 or capabilities, modems 2714, wireless interfaces 2715, processors 2705, switches or switching elements 2730, communication paths, wires and/or busses 2720, ASICS 2717, or other components described relative to this invention. Only the interconnect capability is illustrated in this diagram and may be applied to any of the afore illustrated and described embodiments of the invention which WO 2005/116804 PCT/US2005/001484 -54provide the additional architectural, topological, system, and methodological details. Dynamic configuration or reconfiguration may occur upon initialization, during operation (even when other processing operations are on-going), or upon a system reset. In some embodiments, an allocation table or data structure 2725 will be stored identifying the allocation of the different components and elements to different computing environments.

The dynamic configurability of some or all of these components has already been described relative to other embodiments of the inventive architecture, system, and method. For example, it was earlier described that computing environments and components of such computing environments may be modular and dynamically configured so that the specific defective component and/or computing environment can be taken out of service by a controlling entity, such as a CSCE or CCE computing environment, until the defective component or set of components comprising a computing environment are swapped out for a working part or repaired. It had also been described that some embodiments of the invention may utilize dynamically allocatable and configurable Central Processing Units (CPUs), microprocessors, micro-controllers, ASICs, or some combination to provide the physical structure to create the computing or processing environments of the types already described. This dynamic configuration also provides for flexibility in choosing the characteristics.of a component or element to suit the particular processing task when components or elements with different characteristics are physically available within the system. In some instances the complexity of the processing or computational task will dictate the physical elements that will support the desired computing environment such as the need for a very fast processor or a large memory, or in other instances the desirability to minimize power consumption for a modest monitoring task that requires little processing power or speed and minimal amounts of memory. Recall that such selection and configuration may be under user control, or more typically, under the automatic control of the computing system according to some predetermined or dynamically determined rules or policies and optionally but desirable according to some measured computing system physical or logical state, environmental conditions, processing request and complexity, application program size and data set size. Other embodiments of the invention provide for dynamic allocation of separate elements (such as CPU and storage) which can be assembled as a computing element even if not physically connected at the time of manufacture of the computer and even in not adjacently located within the computer system hardware. In some embodiments, the dynamic allocation and configuration may involve and utilize external components or elements such as may be configured via external ports via the switching systems already described. In some embodiments, the control computing environments (such as the CSCE, CCE, or other control computing environments as described herein) may interoperate and/or control switches or switching systems as described relative to peripheral device, input/output device, and/or storage devices to enable communication paths, switch computing system elements together, and build the links and connections to provide the intended operation.

While FIG. 16 illustrates the different types of components as being connected to single schematic "lines" it will be appreciated that each component will be coupled to other components by a wire, set of wires, buss, or other communication link having the proper electrical (or optical) characteristics and signaling protocols to support the intended communication. Such proper characteristic are conventional, known in the art, and not described in further detail here. It will also be WO 2005/116804 PCT/US2005/001484 appreciated that although some embodiments of the invention may provide for dynamic configuration of all of the afore listed components and elements (as well as others not specifically listed), other embodiments may provide for more limited dynamic configurability, such as an ability to dynamically configure different data storage to dynamically or fixedly configured computing environments.

FIG. 17 illustrates an embodiment showing a plurality of computing environments, each having some set of components and wires, busses or other interfaces connecting the computing environment components via switches to different signal lines or busses. A plurality of data storage subsystems are also illustrated (possibly with different logical partitions or comprised themselves of a plurality of physical devices) that can be dynamically allocated to the overall computing system for use by the different computing environments. In some embodiments, each computing environment may include some data storage components and the dynamically allocatable or switchable data storage represents additional storage capacity when a required storage capacity for a storage or processing task (including for example temporary storage) exceeds the amount of storage available within the defined computing environment.

FIG. 18 illustrates how the inventive computing environment 2801 may couple multiple keyboards 2803 and mice 2804 (or other input or pointing devices) via keyboard communication line or link 2807 (such as an electrical cable or wireless link) and mouse communication line or link 2808 to isolated 'sets' of isolated computing environments (ICE's) within the inventive computing system or overall computing environment 2801, and combined with multiple separate 'sets' of layered video via video communication signal link 2806, Output may be sent to a single monitor or to separate monitors 2805 to create independent 'nodes' 2802-1 2802-N that perform independently and in isolation of one another, yet all under the control of a single controller or control environment.

Embodiment Having Plurality of Dynamically Configured Virtual Computing or Processing Environments Various embodiments of the invention have been described, including embodiments which (i) combine functions of user interface, control switching, and protected storage computing environments (See for example FIG. 9 and FIG. 10 and their accompanying description); (ii) system components are dynamically configurable (See for example FIG. 10 and its accompanying description); (iii) there is a single temporally isolated computing environment for control and isolated user processing (See for example FIG. 12 and its accompanying description); (iv) there is a single temporally shared computing environment for control and isolated user processing (See for example FIG. 13 and its accompanying description); there is a PC CardBus or other interface card embodiment and conventional computer (See for example FIG. 14 and FIG. 15 and their accompanying description); (vi) the system has separate dynamically configurable system components for defining computing environments according to computing task or other basis (See for example FIG. 16 and its accompanying description); and (vii) a plurality of computing environments are defined or configured where each having some set of components and wires, busses or other interfaces connecting the computing environment components via switches or multiplexers coordinated sets of switches) to different signal lines or busses (See for example FIG. 17 and its accompanying description). Other embodiments of the invention have also been described and this list is'not an attempt to identify all of them here, but rather to establish the basis for labeling another embodiment, herein referred to as a WO 2005/116804 PCT/US2005/001484 -56virtual processing space and virtual processing environments.

As described herein below, this embodiment incorporates the dynamic configuration of the physical system components (including aspects of selection, allocation and switching) along with an extension of the temporal multiplexing (time or temporal dimension) to an arbitrary set of dimensions in the multi-dimensional virtual processing space. Embodiments may also extend the notion of a dynamic configurability and the concepts of PC CardBus or other interface card extensions to embodiments that include other plug-in cards or modules, such as PCI card slot daughter boards, mother-board chip set replacements or additions, and interfaces that may be interposed between conventional components such as an inventive interface that may plug into (or otherwise mate with) the motherboard and the processor of a conventional microprocessor (such as the types made by Intel, Advanced Micro Devices, Motorola, and others) and conventional computer. Furthermore, the concepts of plug-in cards and interfaces may be combined. An embodiment of a virtual processing or computing space and virtual processing or computing environments are now described in greater detail.

Embodiment of a Multi-Dimensional Virtual Processing Space (VPS) Having a Plurality of Multiplexible Virtual Processing Environments (VPEs) This embodiment as well as the afore described embodiments provide a virus, hacker, and other malicious code immune environment in which each process is maintained in isolation of each other process that is or may be resident in the virtual processing space. Process inputs from an external and potentially contaminated source are processed through an input isolator to an isolated processing environment within the virtual processing space that has been cleaned, cleared, or otherwise reset to a known and trusted state before accepting the new process so that any contamination that might have been introduced by a prior process is eliminated. The processing environment then processes or executes the received external process and upon completion directs the process output or results to the external world, such as to the requesting process or to another process configured to receive the results, through an output isolator. The input and output isolators may be the same physical isolator or they may be different, an advantage of using different isolators being that they can handle and incoming process in partial temporal overlap with an outgoing process. In the event that the processing environment detects a problem during processing such as the execution or attempted execution of a virus or other malicious or damaging code (even code masquerading as data), the process can flush the external process result and not communicate it to the external world However, even if a virus or other malicious code is executed the processing environment is cleaned, cleared, reset, or otherwise brought back to a known and trusted state. In one embodiment, the known trusted state optionally restored from a trusted template or other protected storage that has also been maintained in isolation from the processing environment during the processing task.. (Embodiments of the invention that include an embedded template do not require this clear and restore.) The trusted template is a source for reloading an operating system, application programs, system parameters, and the like. In one embodiment isolation is provided by providing the trusted template in a read only memory. In one embodiment, the isolation from input to the processor and from the processor to the output are provided by hardware circuits that merely perform bit or bit stream copy or transfer operations and have no capability to execute viral or other malicious code or to be modified to perform other operations. An embodiment of the manner of processing environment isolation for two WO 2005/116804 PCT/US2005/001484 -57processing environments and two external processes is illustrated in FIG. 19.

Having described aspects of multi-processing environment isolation it will be appreciated that details of other embodiments for single processing or computing environments, multiple-computing environments, and for temporally multiplexed computing environments have already been described.

The details of how isolation is maintained is applicable to the present embodiment as well, and attention is now direcied to a multi-dimensional processing space incorporating at least some of these features.

With reference to FIG. 20, there is illustrated an embodiment of a multi-dimensional virtual processing space for processing or executing at least one, but more usually a plurality or multiplicity of, processes. The virtual processing space my therefore be 1-dimensional, 2-dimensional, 3-dimensional, 4-dimensional, or N-dimensional where N is any positive integer. In principle N may be any positive integer without limit, but in practice owing to the feasibility of configuring, allocating, controlling, and/or operating a very large number of virtual processing environments within a defined time period (or other operational limitation) on one or a plurality of physical hardware elements (such as for example logic circuits, microprocessors, microcontrollers, memory elements, and the like processing or computing hardware), the number of virtual processing environments may for example be limited to some number less than 1000 such as any particular integer number between 1 and 1000, or to a number less than 100, or less than 10, or less than or equal to 2, 3, 4, 5, 6, 7, 8, 9, or Because of the difficulty associated with diagramming the' structure and operation of a Virtual Processing Space having more than three-dimensions, the description here focuses on an exemplary processing space that has three-dimensions. The term "virtual" is used here at least in part because the multi-dimensional processing space may be created within a single physical processor which is arguably either one-dimensional or three-dimensional depending upon ones perspective. Even when a time-based or temporal sequence of processor events is considered, the dimensionality may be considered as either two-dimensional (processor spatial dimensions plus time) or four-dimensional (three processor spatial dimensions plus time). Where a plurality of processors are configured, the dimensionality is further extended or multiplied. In fact the inventive structure, device, and method provide for even greater dimensionality such that an N-dimensional virtual processing space is created over a smaller than N number of physical processors and time.

The exemplary embodiment of FIG. 20 has the dimensions of "processor number" (or number of processors), "processing time segment" (which may be interpreted as one or a collection of processor clock cycles or other time intervals), and "process type" (which may be interpreted in one embodiment to relate to a resource or set of resources within the one of the physical processors). The processor types identified in FIG. 20, include by way of example, but not limitation, floating-point operations, graphical rendering operations, communications operations, and any other of the mired of different operation types associated with computing, information processing, signal processing, communications, gaming, animation, speech processing, digital signal processing, and any other instruction, code, or operation type known in the computing or information processing arts.

It will be appreciated that specialized processors may be provided in accordance with the invention that separate elements of conventional processors that are integrated, or that specialized processors may be provided that make the processor elements separately accessible or addressable so that elements not used for one type of processing operation will be available for other operations WO 2005/116804 PCT/US2005/001484 -58during a common or partially-overlapping time period. The invention also provides that multiple instantiations or copies of a processor element may be provided within a single processor without duplicating all of the structures within the processor. In the embodiment in FIG. 20, five virtual processing environments are defined within the virtual product space as set forth in Table I below which shows exemplary virtual processing environments and multiplexed isolation or separation parameter.

The paradigm presented by this virtual processing space may be analogized with a multiplexing operation in which a logic circuit (such as one or more switches or switching elements) are utilized to select one of a plurality of inputs of a multiplexer as the single output of the multiplexer, such as when selecting an input signal to present to a subsequent circuit in an electrical system.

Table I. Exemplary Virtual Processing Environments and Multiplexed Isolation or Separation Parameter Multiplexed Parameter Providing Separation and Process Isolation With other Processes Process Process/Instruction Type Time Other or Segment Number 1 1 Floating Point Operation 50 2 1 Floating Point Operation 70 3 1 Communications Operation 50 4 2 Floating Point Operation 50 1 Graphics Rendering Operation 100 In the inventive system, device, and method, an external process (or its defining commands, instructions, and data) are selectively routed or multiplexed to a particular set of resources (referred to as a virtual processing environment) within the virtual processor space. The virtual processing environment may likewise be defined by a set of physical or logical switches, switching elements, or set of switches or switching elements a multiplexer or set of multiplexers).

FIG. 20 illustrates an exemplary embodiment in which an N-dimensional virtual processing space 2950 defines a plurality of virtual processing or computing environments including VPE1 2951, VPE2 2952, VPE3 2953, and VPE4 2954. Some of these virtual processing or computing environments may also correspond to physical processing or computing environments. A virtual processing space (VPS) and Virtual processor environment (VPE) configuration, allocation, and control unit (CACU) 2960 is responsible for configuring physical processing resources, such as for example, processor(s), memory, caches, I/O devices, keyboards, displays, CD ROMs, and any other processing component or peripheral that may be required. In this embodiment, the VPS 2950 is defined along a physical processor identity dimensional axis 2955, a processing time segment dimensional axis 2956, and an instruction or process type dimensional axis 2957. In this embodiment, the instruction or process types identified are a floating-point type, a graphics rendering type, and a communications type. It will be appreciated that other types may be identified. In one embodiment, the instruction or process types are identified and may utilized different aspects of a processing systems resources.

Furthermore, as described relative to the dynamically configurable and switchable components of the systems in FIG. 16 and FIG. 17, a processing system may be provided with the set of configurable WO 2005/116804 PCT/US2005/001484 59resources that are desired, and these physical elements may be allocated to a particular process. It will be appreciated that the ability to define particular virtual processing embodiment may be limited depending upon the physical processing resources, and therefore that the ability to define a virtual processing space to support a desired virtual (or physical) processing or computing environment may depend on the physical resources present. Modifying such as expanding the physical resources will permit expansion of the dimensionality of the VPS. Where redundant resources are provided for a particular configuration, the VPS 2950 may provide multiple instantiations or copies of a particular VPE The CACU 2960 also communicates with and controls a trusted source of templates 2958 that stores or generates known clean and functional versions and any operating system, program applications, driver software, system or program parameters and data, or other software elements that are or may be required to handle a particular processing operation. The manner in which templates are protected from alteration or contamination and used as trusted sources of processing code and instructions is described elsewhere in this specification and in the specifications of related patent applications that have been incorporated by reference herein, and is therefore not repeated here.

An isolated storage allocation controller logic 2962 is responsible for connecting a process input 2941 (such as processor inputs P 1 2942-1, P 2 2942-2 PK 2942-K) to a particular isolated storage lock (ISL) 2943 ISL 1 2944-1, ISL 2 2944-2 ISLM 2944-M). The isolated storage allocation controller 2962 is operative to switch connections of a web or fabric of possible connections so that a particular process is exclusively routed to and connected with an available ISL 2943. These ISL may in turn be connected to an appropriate virtual processing environment where the connection will in fact be with a physical resource. The operations associated with connecting a process input to a processor (such as the physical manifestation of a VPE) via an input isolation (or input ISL) and for g a processor output via an output isolation (or output ISL) have been described with respect to the method in FIG. 21. Operations for dynamically switching and configuring components have also been described and are not repeated here. Dynamic allocation of the ISL among the input processes is not required and may be fixed, but such dynamic configuration and allocation are advantageous for the additional flexibility such dynamic configuration and allocation provide.

While a three-dimensional virtual processing space was described relative processor number, time segment, and process type in the embodiment of FIG. 20, it will be appreciated that the dimensionality is not limited only to these dimensions. For example, with appropriately configured physical structures, instructions sets and formats, data sets and formats, dimensionality may be extended to other processing parameters, variables, conditions, or the like. Furthermore, while the description so far may have suggested digital computing such as is commonly currently used for personal computers, notebook computers, servers, routers, personal information devices, personal data assistants, information appliances, cellular telephones, televisions, home appliances, automotive electronics, industrial control and automation, robotics, aircraft control and other computing and information processing systems and devices, the invention is not so limited. For example, the invention is also applicable to analog computing and signal processing as well as digital computing and data processing, as well as to hybrid digital-analog devices and systems. The invention is also applicable to optical computing where such additional dimensions as frequency, wavelength, propagation mode, and other optical device and system parameters may be selected and multiplexed. Optical, digital, and/or WO 2005/116804 PCT/US2005/001484 analog elements may be provided in any combination to enable configuration, allocation, and control of a virtual processing space and a plurality of virtual processing environments defined therein. The configuration, allocation, and control may be fixed when manufactured, established by a programming operation, or dynamically set by control elements during operation according to operational policies.

Embodiments of the inventive system, device, and method may employ any of various types of switching, interconnecting, multiplexing, selecting, configuring, and/or multiplexing to achieve a desired structure for the tasks to be processed, and different forms may be used concurrently within a single processing system as may be appropriate to the structures and procedures. Various switches, and switching and control schemes and methods have been described relative to the other embodiments, and these schemes and methods may be employed with these embodiments as well.

It will be appreciated that many forms or types of multiplexing are known in the art and that other forms and types may be developed in the future, and any or all of these may be used in conjunction with the inventive system, device, and method. The following list is provided by way of example, but not by way of limitation: address multiplexing, burst time division multiplexing, codedivision multiplexing, demultiplexing, differential multiplexing, isolated multiplexing, multi-user multiplexing, multi-user spatial multiplexing, orthogonal frequency division multiplexing, polarization division multiplexing, space-division multiplexing, spatial multiplexing, subcarrier multiplexing, statistical multiplexing, time division multiplexing, wavelength division multiplexing, secure virtualization, methods of creating separate or secure processing or computing environments, and/or any other technique, procedure, or method of multiplexing or division of information, data or computer processing. It will also be appreciated that any one or any combination of these multiplexing schemes, virtualization schemes, or division schemes may be utilized.

Having set forth an embodiment of the virtual processing space (VPS) and a plurality of virtual processing or computing environments, attention is now directed to a description of the process and method for operating each virtual processing environment within the virtual processing space. The order of steps is exemplary and it will be understood that different ordering may be employed to achieve an equivalent or similar result, and that certain of the steps may be performed in parallel where no conflict occurs with respect to a resource. Each main step in the process 2970 is numbered and exemplary substeps within each main step are indicated by a letter. An embodiment of the method is also diagramed in the flow chart of FIG. 21.

1. Identify an External Process and Create, Configure, or Allocate a Trusted Virtual Processing or Computing Environment (and Optionally Isolated Storage Locks) to Execute an Identified External Process (Step 2971) Identify a first External Process Input (EPlin) to be executed from among a possible plurality of possible External Processes Inputs (EPlin, EP2in..., EPKin) where K is an integer over the range of positive numbers (Step 2971a). For the sake of simplified description and nomenclature, the terms External Process Input (EPl in) and External Process Output (EPlout) refer to both the input and oulput process respectively as well as the content (such as operating system requirements and/or parameters, application programs and/or parameters, commands, instructions, data, or other elements needed to define or execute a process) required to execute the process of generated as a result of such WO 2005/116804 PCT/US2005/001484 -61 process execution.

Establish a first known trusted Virtual Processing Environment (VPE1) from among a possible plurality of Virtual Processing Environments (VPE1, VPE2, VPE3, VPEM) within an N-dimensional Virtual Processing Space (VSP), where N is an integer over the range of positive numbers (Step 2971b). A Virtual Processing Environment may also be considered to be a Virtual Computing Environment when the process to be performed is a computing process, or more simply a computing environment. As these processing or computing environments are isolated from each other and from external processes, and are either virtual or physical subsystems or units, they are also referred to as isolated processing unit computing environments that may be used for any purpose whether user application processing, system control, or any other operation or processing task. For example, these virtual processing environments may be configured to operate as Control Switching Computing Environments, Protected Storage Computing Environments, ReadfWrite Control Computing Environments, User Interface Computing Environments, User Computing Environments, Control Computing Environments, Isolated Processing Unit Computing Environments, User Interface Computing Environments, or other computing or processing environments. These virtual computing or processing environments may be statically determined but are advantageously dynamically defined and configurable from existing system components. Such system components may be local or geographically distributed.

Optionally, Isolated Storage Locks (see below for ISLlin and ISLlout) may be identified, configured, and/or allocated at this stage so that they are available when needed as described below (Step 2971c). Note that the Isolated Storage Locks can store commands, data, or other information or content but cannot execute any collection of bits that may be viral or other malicious code. The term "Lock" in the phrase Isolated Storage Lock is used in analogy with the term Lock as used for "air lock" in spacecraft and other pressure or anti-contamination chambers or environments that prevent a direct connection or influence from an environment on one side of the air lock with an environment on the other side of the airlock.

2. Securely Load External Process Inputs into Trusted Virtual Processing Environment (Step 2972) Establish a first known trusted (cleared) Isolated Storage Lock (ISLlin) for storing input components needed to execute EPlin (Step 2972a).

Deisolate (couple) EPlin to ISLlin (Step 2972b). (Coupling and decoupling may be fixed or dynamically determined and may be physical or logical or virtual.) Load EPlin into ISL in. (Loading or transferring between any source and any destination is advantageously performed using a copy operation and copy devices or hardware that are incapable of executing any plurality of bits of the content copied (for example of EPlin or EPlout) as it is being copied (Step2972c). Furthermore, the Isolated Storage Locks (ISLlin and ISLlout) are advantageously incapable of executing any plurality of bits of the contents stored within them. It will also be appreciated that there is advantageously never a coupling between an external process and the Virtual Processing Environment, and that: a copy of the external process input is communicated to the Virtual Processing Environment via the input Isolated Storage Lock, and (ii) a copy of the external process output is communicated from the Virtual Processing Environment back to the external process WO 2005/116804 PCT/US2005/001484 -62- (or to another designated process) via the output Isolated Storage Lock.

Isolate (logically or physically uncouple) ISL1in from EP1in (Step 2972d).

Deisolate (couple) ISL1in to VPE1 (Step 2972e).

Transfer/Load/Copy EPlin from ISLlin to VPE1 (Step 2972f).

Isolate (uncouple) ISLlin from VPE1 (Step 2972g).

3. Execute the External Process within the Isolated Virtual Processing Environment (Step 2973).

Process the EPlin input using VPE1 to generate an EPlout output result (Step 2973a).

4. Securely Unload the External Process Results To Initiating External Process (Step 2974).

Establish a first known trusted (cleared) isolated storage lock (ISLlout) for storing output component resulting from execution of EPlin by VPE1 (in some embodiments, ISL1in is the same as ISLlout while in other embodiments it is different) (Step 2974a).

Deisolate (couple) VPE1 to ISLlout (Step 2974b).

Transfer/Load/Copy EPlout to ISLlout (Step 2974c).

Isolate (uncouple) VPE1 from ISLlout (Step 2974d).

Deisolate (couple) ISLlout to EPlout (where the output result EPlout is or may be considered to be either the same process or a different process from the input process EP1in) (Step 2974e).

Transfer/Load/Copy EPlout to EP1 (Step 2974f).

Isolate (uncouple) VPE1 from ISLlout (Step 2974g).

5. De-allocate the Trusted Virtual Processing Environment and Free Any Allocated Virtual Processing Space Resources (Step 2975).

Release and de-allocate any Virtual Processing Environment or Virtual Process Space resources that were allocated to VPElin orVPElout (Step 2975). Note that resources may alternatively be released and deallocated anytime after their availability is no longer required for the processes (Step 2975a). For example, the resources may be scheduled for use by a process after they have been identified to the process but need not be excluded from the pool of available resources for other external or internal processes until necessary.

It will be appreciated that the process described is merely one embodiment for accomplishing a desired or required degree of isolation. Other methods and procedure for achieving isolation may be utilized, and the ordering of steps in the embodiment described may be altered while achieving the same result.

Exemplary Embodiment of Temporal Multiplexing of Multiple Process Streams With Isolation Within a Single Computer In one embodiment of the invention, separate processes or processing streams are kept separate and isolated by control circuitry of other control logic. Processing streams may be utilized where completion of a complex or multi-part process requires more than one process execution.

Separation in this content means that (where desired) the execution of a process such as the execution of computer operating system and/or application program instructions may be performed in isolation from other processes within a processing logic. The processing logic may be a microprocessor, processor, controller, micro-controller, special purpose coprocessor, digital signal processor, optical computer, analog computer, or other device or system that performs a processing operation. While this WO 2005/116804 PCT/US2005/001484 -63description focuses attention on a single processor having a single processor core, the architecture and method may be applied to each or selected ones of a multiple processor system or to the multiple cores of a single processor. The invention may also be applied to computers having multiple processors on a single board and/or multiple processors that are distributed between different boards or different machines but coupled for communication with each other or with some other master controlling logic.

Multiple processes may be distinguished or separated on the basis of any one or combination of physical processing space variables or on the basis of the multi-dimensional virtual processing spaces described herein elsewhere. Some particularly useful variants involve temporal or time based switching or multiplexing or time sharing of processing tasks within at least a partially shared set of processing resources. An example of such a processing situation is when multiple processes are processes in a temporally multiplexed manner within a computer having a single processor with one or more cache or other very fast intermediary memories between the processor logic and a memory subsystem. In some contemporary computers, the fast intermediary memories may be one or more so called level 1 (L1) and/or level 2 (L2) cache memories and the memory subsystem may be a random access memory (RAM); however, the invention is not limited to only these configurations nor does it even require an intermediate memory such as the cache memory. Such a computer may also typically include one (or more than one) mass storage device such as a hard disk drive for storing operating systems, application programs, and operating system, application program and user data. In the future it is anticipated that other mass storage non-volatile storage systems will augment or replace some of these hard disk drives.

Isolation of one process from another process may usually be desired for example to prevent a problem occurring in one process or process stream from impacting on another process or processing stream, or corrupting operating system, application program, system or program data, or user data from being corrupted by another process. These problems are conventionally caused by computer viruses, computer hacker code, computer spyware or robots (so called "spy-bots"), or other malicious code.

They may also result from a bug or coding error in a computer operatinb system or application program or from some inconsistent computing machine setup, device error, or device driver issue. Memory overflow in a memory or memory subsystem, such as for example, in cache or other intermediate memory level 1 and/or level 2 cache memory) or in a memory subsystem processor associated RAM memory, or the like) between one program process and another program process may frequently cause a program failure or contamination.

Isolation of user data and/or programs or operating system components may be accomplished in various ways, such as but not limited to logical isolation, memory address management based isolation, physical isolation such as by switchably disconnecting all or a part of the communication or power paths that enable operation of the device or subsystem to thereby disable it, or operations that render particular devices, systems, or subsystems invisible to one or more processes. These methods and means for isolation may transient for short periods of time or for longer periods of time. Some processes may never see or have access to a device or subsystem.

Memory management is particularly important when processing multiple processes or process streams in any shared processing resource, such as in a single computer having only one physical processor and shared physical memory. Processor execution and mass storage device management WO 2005/116804 PCT/US2005/001484 -64are also valuable tools to prevent malicious activities in a computing or processing system. For example, if even the existence of other program items, data items, files, user data, and like can be hidden from other processes then there is less likelihood and in some embodiments an elimination of any ability of one process to spy on or obtain information about other processes or data that exit within a computer or computing or processing environment.

On the other hand, in some situations it may be desirable for a trusted user (such as an administrator having sufficient authorization and safeguards in place to execute trusted programs so as to be able to determine the operational health of a processing system, to monitor activities in the system, and/or to take corrective action or to otherwise maintain and administer system operation.

Embodiments of the invention therefore provide for selected isolation or non-isolation on a process-byprocess basis.

While there may have been some attempts to provide a degree of software based isolation to address some of the problems, they have not been able to guarantee isolation when desired and enabled, and have therefore allowed an entry point, Achilles-Heal, or other opportunity for exploitation by knowledgeable and sophisticated hackers and viruses. Operating systems such as the various versions of Microsoft Windows (Windows 98, 98SE, NT, 2000, XP, and the like) have been particularly targeted as have application programs for this operating systems. Other operating systems such as those for the Apple Computer products, various personal data assistants, cellular phones, and other information appliances have also been targeted and are vulnerable to attack.

The inventive temporal multiplexing that is described here may be used with a single physical computing machine, with a multiple processor computing machine, with single processors having so called dual-core or multiple-core processors, or with any virtual computing machines (such as but not limited to the virtual computing machine and virtual computing space described herein), where in any of these configurations there may be additional multiplexing or processing dimensions in addition to time, and/or where there may or may not be an actual time or temporal sequence associated with the process. The inventive system, device, architecture, and method may also be applied to computing machines independent of their underlying technology, including for example optical computing machines, digital computing machines, analog computing machines, biological or neurologically based computing machines or system, and/or any hybrid computing machines, including but not limited to combinations of the above listed computing technologies. The invention may also be applied to various non-computing machines that include a computing component such as televisions, entertainment systems and devices, video processors, automobile and aircraft simulation and/or control systems, and/or any other device or system having a processor or processing logic.

So as not to obscure the manner in which separate processes are kept separate the description that follows is confined to a computing machine having a single processor, where three input processing streams, referred to as A, B, and C having members B 1 B, and C 1

CK,

respectively and where I, J and K are positive integers. The invention as described relative to this embodiment may readily be extended to other physical and virtual computing and processing systems independent of type or application.

In addition to permitting temporal sharing of processing resources or devices or circuits in a physical or logical or virtual computing machine such as one of the virtual processing or computing WO 2005/116804 PCT/US2005/001484 environments, the inventive system and method maintain isolation so that different processes present in the computing environment are protected from contamination. This may be accomplished, at least in part, by separately controlling memory visibility andfor access by each process so that it can only see and can only have access to those portions of memory and other components of the processing environment that it has a right to see or access. Furthermore, visibility and/or access when permitted can be a read only access or permit both partial or full read and/or partial or full write operations.

Finally, even when a device or circuit is made visible, the visibility may be limited so that only portion of the device, device features, or other capabilities of the device are observed. In one example, different exclusive portions of a memory device may be made visible and capable for read/write access to two different processes, while a supervisory process may be able to only read the entire memory.

It is well known in the prior art that computer hackers or viruses are able to disrupt operation of a computer is to cause a memory or buffer overflow. Memory control in these machines is primarily under software control, where the software is either present in the BIOS, operating system, application programs, or some combinations of these. Because these are all typically accessible to a hacker or to viral or other malicious code, they can be accessed and modified without the users knowledge or permission.

The present invention may maintain processing environment configuration and control, including memory configuration and control, in a pristine environment (and therefore a trusted environment) so that neither unintended errors nor malicious hacker or viral code can access this configuration or control and modify it to the detriment of the computing system or data or other information within the computing system. Contamination of other processes or data belonging to those processes is therefore also protected. Note that in general even if malicious code is present in the computing system, it must have access to both an execution agent (such as all or a portion of circuits in a processor such as a central processing unit or CPU or any other logic processing device or circuit) and to another program and/or data to contaminate. Where only the execution agent is present, the malicious code can execute but it cannot contaminate another data or program element. If the malicious code is merely stored with another program or data (such as on a common hard disk drive) without isolation but does not have access to a program execution agent at the same time, then the malicious code cannot contaminate that other program or data item. It is noted that data may also be or carry program information such as executable code, and this is a reason why files that appear to be merely unexecutable code from a file type extension must be suspect. Recall that isolation may be physical, logical, virtual or my any other means or combination of means.

Embodiments of the invention provide both of these features. In one particular embodiment, memory configuration and control is maintained in a trusted read only memory (ROM) that cannot be written to or otherwise be modified by an executing program. Special trusted procedures may be provided so that required changes may be made in a secure and trusted manner. In another embodiment, memory configuration and control is maintained using a hardware ASIC. In another embodiment, memory configuration and control is maintained using a hardware ASIC that has firmware that can be modified but not by any process originating from a non-trusted source such as a process executing in the processor of a computer. Memory configuration and control may be set up with fixed sizes of a single physical memory being allocated to a particular process, or it may be dynamically WO 2005/116804 PCT/US2005/001484 -66determined such as through the use of statistical monitoring or via user profiles that suggests the number of concurrent processing environments and the memory or other resource requirements of the processes expected to be executed.

Embodiments of the invention eliminate or simplify the computing environment repair process after competing (successfully or unsuccessfully) a processing or computing task by utilizing, for example, an embedded master template that is pristine, trusted, and stable. In such instance, there is no need to both flush or clear and then restore the processing environment. For example, an embodiment of the invention may include a read only memory that stores a Microsoft Windows XP operating system (or any other operating system software) and any other application programs that may be needed in that processing environment. Different processing environments may provide for different embedded or stored operating systems and/or application programs. Furthermore, some approaches may embed some components and load others as needed to permit flexibility yet increase speed and throughput. For example, one embodiment may embed the operating system and load application programs into a write accessible memory. In such embodiments, the embedded operating system need not be flushed and restored, but the memory storing the application program that possibly may have been contaminated would be flushed and then restored to a known pristine state after its processing task completed.

With reference to FIG. 22, one architecture and operational scenario for temporally multiplexed operations of three processes A, B, and C are now set forth for a single processor and memory. For convenience of description it is assumed for purposes of this description that the three processes and are waiting for processor availability and that they start at the same time. Conventional elements of the computer system, processor, memory, and the like known by workers having ordinary skill in the art are not shown to avoid obscuration of the invention.

The computing system 3002 includes a processor 3004 that has a level 1 (L1) cache 3006, one or more input bus ports 3008 for receiving one or more input streams from an input source 3010, one or more output bus ports 3012 for communicating one or more output streams to a receiver 3014, and ports or pins for communicating status 3016 and control 3018. The processor also includes a bus or other means for communicating with on-chip, on-board, or other memory, such as a Level 2 (L2) cache 3020 and random access memory (RAM) 3022. This processor may be a conventional processor or microprocessor or one of specialized design. The inventive architecture also provides timing, address control, and switching (TACS) logic 3030 that includes input bus port 3032 for receiving an input or set of inputs 3036 and output bus port 3034 for communicating an output or set of outputs 3038. In this embodiment, TACS logic 3030 is connected to receive inputs 3036 intended for processor 3004 as inputs 3040 and for receiving processor outputs 3042 and further processing them to generate outputs 3038.

The TACS logic includes an input stream 3036 seriallizer logic or other input process stream seriallizing means 3044 that receives the input process streams 3036 (in this example, three input processes A, B, and C) and optionally parses them or otherwise identifies components within them that will be processed. The term seriallizer is intended to have the broadest possible meaning and is not limited to processing an input stream in a bit-by-bit, byte-by-byte, word-by-word or in any other particular manner, but rather can accept any one or any combination of input stream(s) having an or a WO 2005/116804 PCT/US2005/001484 -67combination of input stream characteristics, and process the or each stream according to a defined set of policies or logic to generate its output. (The deseriallizer may analogously receive and deseriallize any one or combination of inputs to generate its output.) It may optionally also identify components of the processor that are to be used by each process during particular processing cycles, though this is largely an advantage when other elements of the processor are to be separately allocated to one process or another. These components may for example be a single instruction, a single instructions with its data, several instructions, or any other set of commands, instructions, data, or the like as may be present in typical computing machines and methods. In this example, the seriallizer 3044 takes one component of A A 1 followed by one component of B B1), followed by one component of C

C

1 and then repeats for A A 2 B B 2 and C C 2 until each is finished and then handles additional process streams. Other examples may select from the waiting processing streams at the input 3032 according to predetermined or dynamically determined policies. There is no limit to the number of input streams and in one embodiment, they are queued until the TAGS logic 3030 and processor 3004 are ready to accept them for processing. Normally one of A, B, or C will be different in length and will finish first, but there is no reason to wait for the others to finish before parsing and serializing a next process stream D. In fact, the processes are executed entirely independent of each other. Other schemes may be implemented, and for example if processor stream B had a higher priority, then multiple components of B may be interspersed between single components of A and C, such as for example a serialized stream A 1

B

1

B

2

B

3

C

1 An embodiment of the process for in which processor memory, such as a L1 3006 or L2 3020 cache memory or other buffer memory on the processor chip 3004 or external memory such as RAM 3022, is controlled to maintain absolute separation of the processes, is now described. An alternative to providing intra-memory isolation is to provide separate physical memory chips for cache other fast intermediary memory or for other memory subsystems such as RAM memory, but this may not be preferred due to cost, interconnect, and other considerations. Where multiple processors or multiple processor cores are implemented, having separate physical memory devices or chips may be more feasible. Furthermore, some embodiments may provide multiple processor cores and fast memory associated with each core so that separate memory subsystems (such as for example, external RAM) may not be required.

Recall however, not all embodiments require or benefit from absolute separation or isolation of processes, and that in some embodiments, a trusted monitoring process may be provided that permits an authorized and trusted administrator to monitor operation of the computer. Other processes may also be allowed to operate without absolute isolation where there is a defined level of trust between them. Furthermore, a plurality of processes may be processed together even without trust so long as the plurality of inputs and outputs are grouped together and treated with the level of isolation described.

For example, a processing environment may be created to perform a word processing operation and a photo editing process using two different application programs. Even though the inputs and outputs of this processing environment may be a text documents and picture files, the invention is operative because the invention does not care what the characteristics or content of the input or output from a processing or computing environment are.

In this embodiment, the serialized stream 3050 is generated by trusted TAGS logic 3030 and WO 2005/116804 PCT/US2005/001484 -68the TACS logic also modifies the apparent process environment configuration (in simple terms the physical or logical configuration of the computer) according to the process component being handled.

In one embodiment where the components of streams A, B, and C are serialized in the manner described, a timing control circuit is operative to read and apply a different configuration for each component as it is received. The TAGS logic effectively reads a different configuration record (such as a BIOS configuration from a trusted ROM) at each moment in time so that the for each slice of time devoted to process A, it sees only the memory or other computer environment elements identified to process A, including only seeing the memory allocated to A and being incapable of inadvertently accessing other memory outside of the memory (address) range assigned to process In one embodiment, this memory management and control is accomplished by having processor 3004 write to and read from certain address ranges (or other identified portions) of the L1 and L2 caches and to RAM. This may for example be accomplished using an address remapping scheme in which only one region of each memory is visible to the processor, and those regions are mapped to or otherwise identified with a different address range in each memory L1, L2, RAM, and mass storage disk drive). In other words, the processor sees a first L1 cache address range ADDRI 3061 but, when processing process actually reads from or writes to and address range ADDR2 3062 associated with process when processing process actually reads from or writes to and address range ADDR3 3063 associated with process and when processing process "C" actually reads from or writes to and address range ADDR4 3064 associated with process Analogous mapping or identification occurs in the other storage devices, such as a hard disk drive storage device, level 2 cache, and RAM. In similar manner, other devices may be mapped to or exclusively identified with a particular process to maintain separation. Again, in embodiments of the invention, the mapping or exclusive identification or assignment is not merely an operating system or software reassignment, but involves a trusted control that redefines the configuration or components of the computing system so that one process does not see and is not aware of the other processes.

In the illustrated embodiment, the TACS 3030 is responsible for controlling the memory address control through control (and optional status) signals to L1 cache 3065, signals to L2 cache 3066, signals to RAM 3066, and optionally signals to mass storage devices or other devices 3068.

It does not matter if one of processes A, B, or C includes and executes a virus or other malicious code. Any common process environment elements that may be contaminated is cleared, reset, or repaired before being used by another process, and any elements of the process environment that need to be retained are not shared. Therefore in the event that process B executes a virus, the effects of such execution will only be apparent in the memory allocated to process B. Once the B process terminates by completion or error, the B allocated memory will be reset and any contamination will not propagate to the other processes. Normally, however, the internal components of a processor (except for example, the contents stored in a cache memory) will not retain residual elements of another process as the next process (such as an instruction or an instruction with its associated data) or such residual element by itself may not be operative by itself to do any harm or introduce any contamination. Where code is transiting a processor element (such as a register or the like) such code is irrelevant as it is not retained there and the next code in will effectively purge that residual element, but, where there is a storage, the element should be flushed or otherwise reset or made pristine to a WO 2005/116804 PCT/US2005/001484 -69known and trusted state. For conventional processor architectures and devices that may be used in conjunction with the inventive features, and which might contain a harmful residual feature, such elements may be cleared or reset. This may be taken into account by the timing address control and switching logic. For example, clearing instructions or codes may be introduced after a potentially harmful instruction or process, or where such harm cannot a prior be anticipated, such clearing or resetting processes may be introduced between every process owned by another process. For processor architectures to be developed in the future, a clearing or reset feature may be built into the processor architecture to improve the throughput of the processor without the need to insert clearing or resetting processes in the input stream.

Once the processor 3004 generates its outputs 3052 they are received by a processor side input port 3070 and processed by the TAGS logic to deserialize the combined output stream 3052 and provide proper output ordering. Although the output stream 3038 is illustrated with an order matching the ordering of the input stream 3036, this matching ordering is not required when tags or other process identifiers are utilized to identify which process the particular output pertains to.

Having described a particular embodiment of the manner in which a particular timing, address control and switching logic (TACS logic) 3030 was used, workers having ordinary skill in the art will appreciate that alternative structures and methods may be utilized to achieve alternative embodiments of the invention. One such alternative is illustrated in FIG. 23, which shows an alternative embodiment of a system for maintaining a controlled degree of isolation between a plurality of processing in a computer using address range control. A processor logic 3080, which may be any logic for processing computer program instructions or other instructions such as a processor, controller, or central processing unit, includes some internal address control logic 3081. Various forms of processor address control logic are known in the art and are not described in detail here. Either a separate address control and isolation logic 3082 is provided or the features of the inventive address isolation and control logic are incorporated into the address control logic of the processor or otherwise provided within the processor 3080. The address isolation and control logic (AICL) 3082 passes control and status signals with the address control logic 3081 within the processor and with the addressable memory/cache/storage subsystem(s) as may be required. The addressable memory/cache/storage 3085 may be by way of example but not limitation, a RAM, a ROM, a cache memory, a hard disk drive, or any other storage device or memory mapped input/output device. Inputs are received by the AICL 3082 and processed to generate certain control signals 3083 that may be communicated to address control logic 3081 and to the addressable memory 3085. Alternatively, the AICL 3082 may generate certain control signals 3083 that may be communicated to address control logic 3081 and the address control logic may then communicate additional control signals 3089 (and optionally receive status signals) to the addressable memory 3085. The structure of the AICL 3082 may generally depend on the nature of the inputs 3086 that are to be processed and this may be statically defined or dynamically determined based on the input. The output 3087 may usually be the same output the would have been generated for the corresponding input in a conventional processor, except that abnormal processing situations such as execution of a virus or other malicious code may optionally be suppressed and error or exception conditions (or system failures) that may have occurred may not occur.

Recall that in the embodiment of FIG. 22, some emphasis was placed on the applicability to WO 2005/116804 PCT/US2005/001484 temporal multiplexing, and separate processes or processing streams are kept separate and isolated by control circuitry of other control logic. Recall that multiple processes may be distinguished or separated on the basis of any one or combination of physical processing space variables or on the basis of the multi-dimensional virtual processing spaces described herein elsewhere. The reasons for and benefits of either complete isolation or a controlled degree of isolation have been described elsewhere herein and are not repeated as have been the multi-dimensional processing space that may be defined over a set of separation variables or parameters.

In one embodiment, a control environment executing during one time slice or period receives a request for an operation that was filed or left by a non-control process during an earlier time slice or period. The request is made or filed in a manner that although shared with another process cannot contaminate that process. For example, a single bit or a small number of bits that cannot carry an executable code are stored in one or several registers with in processor or other logic. The control environment looks or queries these registers and upon recognizing that a request was made by another process, may grant an access or permission or deny that access or permission for the operation or capability by means of a flag or other indicator (again such as a bit or a small number of bits in a register) so that an operation or capability is available when the requesting process next has use of the computing environment. The operation or capability may generally be any operation or capability that the computing environment has an ability to provide with the proviso that the control environment will not permit an operation or condition that may expose other processes or data to contamination. The permitted operations or capabilities may for example be defined by a set or rules, policies, tables, logic, or in any other way. In some embodiments, the granting of a permission or access may alter the apparent computing environment configuration to make visible and accessible a storage device such as a hard disk drive or other mass storage device, all or a portion of a processor associated memory subsystem such as a random access memory, all or a portion of one or more processor associated fast intermediate memories such as cache memories, make available or hide any input or output port, make available or hide any network interface card, and/or more generally hide, restrict, open, close, or otherwise make any element of the set of devices, circuits, logic, operations, hardware, or software available or unavailable to the requesting process. Granting of permission or access to one element or capability may necessarily require that the control process restrict or deny permission or access to others so that an appropriate degree of isolation ismaintained. The granting or denying of a permission or access may for example result form a physical change such as the closing or a switch or set of switches that creates a physical path or powers up a device or circuit, a logical change that alters physical hardware logic or software or firmware within the computing environment, or in any other way modifies or creates a different virtual, logical, or physical processing or computing environment. These combinations may be established according to rules, policies, tables, logic, or in any other way, and however established are protected from modification by the non-control processes and indeed may in some embodiments require a special administrator privilege. As described elsewhere in this specification, some of these modifications to the computing environment may be established using aspects of the dynamic switching and configuration structures and methods described elsewhere in this specification or using other structures and methods.

Among the devices that may necessarily be shared are the memory subsystem (typically RAM) WO 2005/116804 PCT/US2005/001484 -71 and any intermediate fast memory (typically one or more cache memories that on the processor chip or chip set) between the processor and the memory subsystem. Different portions of these memories may be made visible to the different processes using address control logic and procedures as described above as well as other well known techniques for configuring and controlling address allocation, master, data and instruction bus availability, description tables and the like. In one embodiment of the invention, a descriptor table, such as may be stored in a data structure in a memory or register, is normally hidden from other processes and only visible if at all to the control process. In another embodiment, selected portions of the descriptor table are maintained hidden while other portions may selectively be made visible to one or more processes, and in other embodiments separate descriptor tables are maintained and control is exercised to make one or more of them selectively available to processes where even when they are made visible, the visibility may only be transient or for a particular instruction or portion of the process. Conventionally, such descriptor tables are visible and accessible to all processes and such visibility and accessibility provides an opportunity for malicious code to alter contents of such descriptor tables and thereby enable a capability that would alter and damage the computing environment. Isolating, hiding, or denying access to such descriptor tables associated with memory addresses or other components of the computing environment except to the control process is another way the computing or processing environment may be protected. In at least one environment, configuration information is maintained in a read only memory and neither the operating system nor the application programs provided to non-control processes (and in some embodiments to control processes) are not able to manipulate such stored configuration information.

These and/or other embodiments of the invention may also or alternatively control visibility of and/or access to the various busses within the processing environment, the input/output ports or devices, the application program software loaded into an environment, the operating system or operating system elements, within the processing environment, or any combination of these or others.

In at least some embodiments, the presence (and therefore the denying of access to) of selected hardware or software component is guaranteed to be undetectable to the operating system. In some embodiments, this is advantageously assured by modifying an operating system (even including embedding a trusted read only version of the operating system) and/or by controlling the configuration at a hardware and/or at a firmware level. In some embodiments, physically or logically separate BIOS are provided that configure or reconfigure each processing environment on a dynamic basis. In other embodiments, a baseline BIOS configuration is established and changes to the configuration to add a particular capability are established dynamically.

As an example, in one particular embodiment, address locations or ranges are statically or dynamically defined a level or layer below the operating system layer so that the operating system (such as any Microsoft Windows, Linux, Apple Computer, or other operating system) is not able to modify or otherwise exert any influence over the definitions and so that the operating system only sees what the definitions permit it to see. The low level program or process may for example be any program or process that cannot be accessed by others, such as by the operating system, application programs, and of course not accessible to data that may contain potentially malicious code. In some embodiments, the low level definitions can be accomplished using a protected BIOS, by the address control logic (when the elements to be hidden are memory address locations), by the TACS control, WO 2005/116804 PCT/US2005/001484 -72 and even by the main processor itself, or by any other logic incorporated into the process or operated as a separate logic element and communicating with the processor. When the TACS control is involved, it may for example create a global description defining specific address ranges that will be made exclusively available to time isolated multiplexed events. Alternative controllers may define address isolation based on other of the non-temporally defined isolations available in any Ndimensional virtual processing space.

In one embodiment, a table defines memory address range availability for each process differentially and such definition may be logical or physical. In one embodiment, the BIOS retains a mapping in the form of a table. For example, if there is 1 Gigabyte of total RAM memory available to the hardware of the computing or processing system, the lower level control process permits the operating system to only see a predetermined or dynamically determined amount of memory such as for example 256 megabytes. The low level program or control may make different amounts and different memory address ranges available to different instantiations of the operating system, such as a first Microsoft Windows operating system associated with a first process and a second Microsoft Windows operating system associated with a second process.

Conventional systems and methods typically use a single "sand box" or "bowl of soup" in which all processes can interact but do not when program code is properly designed but expose the different processes and data to corruption when malicious, hacker, or viral code is introduced. One of the advantages of the inventive system and method is that each process uses its own sand box or a clean empty bowl and therefore contamination cannot occur even if there is malicious, hacker, or viral code that executes or attempts to execute in a processing or computing environment.

It will be appreciated that using the above described technique involving restricted message passing between a control process and another process, that the control process can effectively control the other process even though it is absent from the processor (except for the conditions, state, flags, or other indicators it left in the processor) while the other process is executing. The control process may also clear, flush, reset, or otherwise reestablish a pristine processing environment after the other process has used the processing resources for which access was permitted.

The ability to selectively hide portions of memory by controlling memory address ranges as described may be applied to any memory mapped device or subsystem within or external to the computing or processing environment. The inventive system and method may analogously be able to selectively hide other devices, circuits, software, and the like results in other benefits as well. For example, embodiments of the invention have described a need or desirability for moving a user data from a first storage location (such as a hard disk drive nonvolatile storage device) to another isolated storage location (sometimes referred to as an explosion room) before exposing that data to any processing element that may cause some malicious code hidden in the data (or program) to execute and cause a contamination of the computing or processing environment. However, it will be appreciated that in embodiments of the invention that provide for a guaranteed controlled isolation of portions of memory, storage, or logic, such copying or moving of the data to an isolated storage may not be required, thereby eliminating a time consuming step. In essence, such embodiments of the invention configure the processing environment so that the data item itself is isolated in place, and optionally some additional memory or other storage may be defined for temporary working storage or WO 2005/116804 PCT/US2005/001484 -73 for other purposes as may be required or desired for the particular process. The step of copying to a secure storage before processing and the copying back from secure storage may therefore be eliminated. A copy of the data may still be made prior to execution so that in the event that the process has a problem, there may be an assurance that the original data item has been retained and was not further contaminated. Maintaining such a copy may for example permit the item to be examined and/or cleaned of its contamination or virus where such cleaning is possible.

Other embodiments of the invention may provide memory or storage that may be dynamically switched into and out of the computing environment or into and out of particular instantiations of the computing environments. This would eliminate the need for copying, and/or would provide an alternative mechanism so that one of multiple cleaned memories may be swapped in while other memories that may be contaminated from exposure to a prior process are temporarily swapped out while they are cleaned or flushed by a separate process. Another embodiment of the invention may provide for logically breaking or segmenting memory into different portions each possibly having a different master template so that different memory address ranges may have stored complete new and pristine master templates ready for a processing task in a processing or computing environment.

In another embodiment, computing environments may be created by generating or creating a template or an operating system at one address range and user data at another address range within the same of different physical device. In fact, multiple computing environments having master or other templates and data may be created in this matter. Each is a complete and logically isolated environment because the low level configuration or other control guarantees no interaction outside of the memory address ranges defined. A supervisory control, defined in hardware, firmware, software or any combination of these may provide a hyper-visor to control each processing environment, switch in an out components, and manage the plurality of processing environments so that no contamination can occur. In one embodiment, even this supervisor control or hyper-visor is either not able to override or alter the low level configuration that prevents contamination. An external administrative process may be provided so that any software or firmware components may be loaded, updated, or purged as may be required.

It will be appreciated in light of the description herein, that various methods may be utilized to generate or copy a trusted portion of software or code into a memory, storage, or processor. In some embodiments of the invention, these are referred to as templates and master templates. Various protected copying schemes may be used as described elsewhere herein. For operating systems and processors that support some of the energy conserving suspend, hibernate, restore, and wake-up features that store system state from the processor and/or from volatile RAM memory into a non-volatile memory (such as to the hard disk drive), these features may be used to either generate a template, or where the templates have been prestored, to write a trusted template from storage to memory or the processor. In this way, the template is in a form and compatible with existing operating systems and hardware that support these features.

Various embodiments of system configurations and operating scenarios have been described in this specification. For example, embodiments have been described wherein there are multiple physical processors each having an assigned computing or processing environment. The embodiment described relative to FIG. 9 identified a User Interface computing environment, a control and switching WO 2005/116804 PCT/US2005/001484 74 computing environment, a protected storage computing environment, and at least one user computing environment. In the FIG. 10 embodiment, the system included a desktop and user interface computing environment processing unit, a control and switching computing environment processing unit, an isolation processing unit computing environment, a protected storage computing environment processing unit, and an isolated processing unit computing environment. Embodiments in which single (or a small set of) processors are used in a multiplexed manner so that a larger set of processes can be executed using a smaller set of physical hardware and/or software components. While the description has emphasized the flexibility and applicability of the inventive system and method to any processes and that the processes specifically set forth were exemplary, it is worth emphasizing that even the functions and operations of some of the specifically named or identified processes may be grouped so that they execute within the same process, while maintaining isolation where required. The combination or grouping of processes may have particular utility for some of the trusted control or supervisory operations, such as defining the desktop and user interface processing environment, video processing environment, and control and switching environment into a super control environment; but, maintaining this super or grouped processing environment separate from one or more user data processing environments.

The benefits of this process definition or grouping provides some efficiencies in the multiplexed embodiments of the invention, and particularly though not exclusively with respect to the temporal multiplexing embodiments. As the number of separate processes is reduced, the complexity of the switching between different processes is reduced and the time that may be consumed by storing and reloading state and/or with loading templates and/or clearing processing environments may also be reduced. In one embodiment, all non-user data processes are defined and implemented within a single control processing environment, and user-data related processing environments are executed and maintained separately from the control environment.

For this embodiment, as well as all other multiplexed processing scenarios, it should be clear that priorities for execution may be assigned to the different processes so that either the priority for access to a particular processing resource (such as to particular port, digital signal processor (DSP), or any other resource) or to the amount of time (processor clock cycles or instruction cycles) allocated to a process may be adjusted. The adjustment may be set statically or dynamically. Defaults may be set and then modified when a high-priority process is to be executed. High-priority processes may for example include a real-time or pseudo-real-time processing application such a video image capture, computer gaming, and other processes where a detectable delay might be objectionable to a user.

Normal or even lower-priority processing applications may include word processing applications where very little processing power is needed to keep up with a user typing text. Clearly, different systems may be set with different processing priorities depending upon the goals of the user and the environment in which the computing system is deployed.

The approach described immediately above has emphasized the manner in which multiple processes may be grouped, combined, or integrated into a larger or more complex processes. Other approaches may take what might be considered to be a single process and employ multiple system resources for execution. For example, in a system configuration that provides multiple physical processors, multiple memories coupleable with those processors, and/or other multiple copies of WO 2005/116804 PCT/US2005/001484 available resources, the processing requirements of a single process may be distributed between them so that the process may be executed more quickly or with the desired throughput. Typically, the processes for which multiple processors would be employed would be relatively complex processing tasks that had readily definable subtasks that could be distributed amongst different processors and their results combined in some way to generate a final result, or simplerprocessing tasks that has a lot of data or a lot of parallelism so that employing multiple processors would permit faster completion of the overall task. Though the underlying conventional processing is different than the processing described here, the SETI processing task is one notable example of a single large processing task being split up between multiple processors.

Any processing task might be split up, redefined, and/or distributed in this manner. In light of the flexible switching and system configuration features described relative to the FIG. 16 embodiment and elsewhere in this specification and/or the afore described virtual processing space and temporal or other non-temporal multiplexing embodiments, the invention clearly provides system and method in which a plurality of system resources are statically or dynamically configured and deconfigured that extends beyond a single processor configuration. For example, in a temporally multiplexed embodiment, different processes may be configured to have only a portion of a processor (processor is shared in some way), to have dedicate use of a processor, to have dedicated use of multiple processors, or to have partial access to multiple processors. Where shared processor access is implemented, such sharing is permitted only consistent with the security and protective features already described for the invention. This switchable allocation of processors, CPUs, or other processing or computing logic to the processes may also be applied to any other system resource.

This aspect of the invention may have particular benefit and utility when applied to grid computing, clustering, parallel processing, massively parallel processing, symmetrical processing, and/or other processing scenarios where some degree of parallel, distributed, or cooperative processing is beneficial.

At least in part because multiple system resources may be logically or physically combined or used in a multiplexed or parallel computing configuration, a physical computing system may be built having a plurality or multiplicity of processing resources, such as multiple processors or CPUs, multiple memories, or even multiple system-on-a-chip (SOC), that can be automatically (or manually) and dynamically configured according a current set of processing needs to perform the one or the set of processing tasks in some optimum manner according to define rules, policies, or logic. Optimization parameters may for example include maximizing throughput, fastest execution, minimum power consumption, greatest error reduction, minimum heat generation, or any other data or operational preference or requirement. Embodiments of the invention incorporating this feature may optionally utilize relatively low performance processors or CPU's or other system components to minimize hardware cost but without impacting performance due to the ability to dynamically combine these resources.

It will be appreciated in light of the description provided herein, that embodiments of the invention may provide for switchably configuring either in a static manner or dynamically (such as through the use of one of the multiplexing schemes already described), a physical or virtual computing system or environment to include (or remove) any of the resources that may be available. For example, WO 2005/116804 PCT/US2005/001484 -76in addition to the processors, memory elements, hard disk drives or other storage subsystems, embodiments of the system may switch or multiplex modems, network interface cards (NICs) or other network interfaces, a sniffer or read-only NIC video display or processing cards or logic circuits, graphic cards or processing logic circuits, universal serial bus (USB) ports and interfaces, FireWire or IEEE 1394 interfaces and ports, serial ports, parallel ports, PC Card ports and interfaces, PCI interfaces, memory interfaces, microphone and speaker input and output ports, digital signal processors and logic, printer ports, CD and DVD interfaces, audio and video processing logic, wireless interfaces, and any other hardware alone, hardware executing software or firmware, and to the extent that ports interfacing to external devices may be enabled or disabled, external devices and systems.

In one embodiment, one of the processes that are executed is'a network interface such as a network interface card (NIC) type process. The NIC has a buffer or other storage means for storing data received from an external source or process. Once received and stored, the multiplexed processing scenario reads the buffer and may handle the received data in a manner analogously to the other protected processing schemes. In other words, while external sources would appear to raise a greater concern as to contamination (such as from e-mail, spai, virus, spybot, or spy-ware laden websites, and the like) than an internal data set, the protective measures provided by the inventive system and method provide the same high-level of protection as for other user data sets. These same benefits are provided independent of whether the external connection is via a modem, floppy disk, USB memory device, input/output port, wireless connection, or any other interface. Means are provided to isolate that input data so that it cannot contaminate other user data or the stored trusted versions of application programs and operating system.

The use of the inventive switching and control features of the invention are applicable to any of the buffers, caches, data storage, and/or memory systems and subsystems, that may be present within a processing or computing system; including for example, but not limited to any embedded operating systems, applications program software code, or embedded data. Just as was described relative to hard disk drive storage devices, switches or switching logic may be utilized to physically or logically add and/or remove any identified buffer, cache, data storage, and/or memory system or subsystem from the computer system either statically, dynamically, or in any temporal or multiplexed manner. In addition, the inventive switching and control features of the invention are applicable to system resources that are not normally associated with a data storage function such as a video or graphic controller or processor, a printer, a sound card, or any other system or computer resource. Memory address. range mapping, powering on/off, BIOS-based configuration and deconfiguration, and other means for hiding or making visible such system resources have been described throughout the specification and are not repeated in detail here.

With particular reference to systems having storage or memory with embedded operating system(s), application program(s), and/or other executable or nonexecutable code or data stored therein, these embedded elements may be switched into added) or out of removed) to/from a processing environment to provide the desired or required operating system(s), application program(s), or other code or data needed to perform the processing task. For example, embedded stored versions of Microsoft Windows XP (or any other operating system), Microsoft Outlook, Adobe Photoshop, and/or data such as an embedded screen image graphic may be embedded in different physically or logically WO 2005/116804 PCT/US2005/001484 77distinct memories or storage means. These may for example, be different memory chips, logically separated portions of a common physical device that are isolated by the afore described address mapping and control or via other means. These are then added to the processing environment when a need is identified and removed from the processing environment when the need is no longer present, to thereby free up the resource for another process. A control environment or other control element within the system, anticipates or detects a need for the particular embedded (as well as to non-embedded) code or data and configures that embedded element into the processing environment using the afore described switching and configuration features of the invention. The detection may be a request or some other detection means such as a program call. The control environment or other control element is also responsible for anticipating or detecting when the need for that embedded element has expired and removes that element from the configuration of the processing environment and makes it available for other processing requirement requests.

The control environment and/or a hardware switching environment (optionally including some software and/or firmware) may make any of the addressable memories, embedded storage, or the like accessible as read-only, write-only, or read-write memory so that the nature of the access can be controlled or limited. This access type control (read-only, write-only, read-write) may be generally useful depending upon the processing task at hand. It also provides a procedure for maintaining a particular memory or storage holding a template in a read-only mode for normal access so that the template cannot be contaminated or compromised by a write operation, but permits that template to be updated (such as to a newer version) by a user or process having sufficient access privileges.

In the context of maintaining physical or logical isolation of storage, hard disk drives or other rotating storage media having multiple platters or surfaces may be isolated by operating read/write heads separately for each platter surface. Conventionally, a hard disk drive having two platters and four surfaces will be operated by a single disk drive controller and by an actuator that moves multiple read/write heads in concert. Embodiments of the invention provide for separate controllers that at least control access to the read/write heads in independent manner so that one controller is only aware of its single (or set of) surface and read/write head; but, not aware of other surfaces or heads within the same hard disk drive. In another embodiment, separate actuators may also be provided so that actuator arms and read/write heads operate independently for each surface or set of surfaces. The dynamic configuration features of the invention may also be applied to such a hard disk drive to make more of fewer of the surfaces available and to make them either read-only, write-only, or read-write enabled.

In one embodiment of the invention, features of the invention are provided on a logic board within or attached to the hard disk drive or within a disk drive controller. The logically or physically isolated hard disk drive platter surfaces may then be used for isolated storage. In one embodiment these elements and features are combined so that the hard disk drive with the control features provide a network appliance having the protective and security features of the invention without the need for a separate computer or external processor. Therefore, the invention also provides a network or networked appliance having the protective and security features of the invention.

WO 2005/116804 PCT/US2005/001484 -78- Other Optional Features that May be Used With Embodiments of the Invention Having described several different embodiments of computer and information appliance architectures, system configurations, and methods and procedures for generating and operating computers, information appliances, and other devices, we now digress to describe some features (including some optional features) that may be provided with some of the embodiments. These descriptions also provide some indications of the types of applications that may be handled in the various computing environments, and how particular susceptibility to viruses, hacker code, Trojan horses, and other malicious code may present a security or immunity issue and how such issues are resolved using the inventive architecture, system, methods, and procedures of the invention. In the context of this description the use of the term computing environments of CE is intended to include any of the variety of computing environments, isolated computing environments, or computing or isolated subsystems as are described in this specification as well as to such computing environments and subsystems as are described in the related applications and incorporated by reference herein.

Data may be moved between special-purpose subsystems or computing environments using a separate logic control device, such as an ASIC or logic control device utilizing direct memory access.

The process of moving data advantageously does not allow the data to be executed, which could possibly enable or let loose hacking, viruses, other malicious code, and the like. Additionally, data may be encrypted, compressed, or encoded to prevent its execution.

Repair or recovery of a computing environment may be implemented if and when needed. A computing environment (CE) may be repaired or returned to an ideal state using an automated repair process. Such repairs may be conducted "on the fly", or after each transction or without rebooting.

Master templates typically represent an ideal state of a special-purpose subsystem, and may be stored on a storage system. A transaction may include reading e-mail, wherein the opening of each individual e-mail messages represents a separate transaction. Optionally, one or more items can be ignored during a repair process. For example, if an e-mail has been opened, a repair process may run ignoring the open e-mail, detect and repairs problems, and then a user may respond to the e-mail without quitting it. In another embodiment, all downloads and e-mail can be saved immediately to the storage system prior to opening the download or e-mail in the work subsystem.

In one embodiment, the logic of a CE may trigger an event associated with a repair process.

The repair process may perform a comparison between a master template of the working system and state of the current working system. Any differences between them could trigger a subsequent repair process in which some or all data that is different is deleted from the working system. Further, data may be copied from the master template by the repair process as necessary. In one embodiment, the repair process may make the working system identical to the master template.

In one embodiment, a repair process can be conducted after one or more e-commerce transactions, or after surfing one or more web pages, and the like. Thus all known and unknown viruses and Trojan horses can be made impotent prior to the next transaction. While this process does not eliminate viruses, worms and Trojan horses from the computer (they may be stored in the storage system), it keeps them in an in operative state. The repair process could repair volatile and non-volatile memory, or clear volatile memory, or set volatile memory to an ideal state.

In one embodiment, if the user selects more than one e-mail to open, two or more e-mails could WO 2005/116804 PCT/US2005/001484 79 be copied to the working system and could be open simultaneously. Optionally each e-mail could be copied to its own separate isolated working system, opened, viewed, and worked on separately. If the user needs to copy data from one isolated e-mail to another isolated e-mail, a copying process can be used that does not allow code to execute.

In one embodiment, web commerce software, or e-mail software, or any software can be modified so that individual records, or only copies of the records that are specifically needed for a transaction are copied to the storage system, utilized and then copied back to the database in the storage system, and after each such transaction a repair can be conducted. Optionally, in a transaction in which data interacts with more than one database or CGI for example, the transaction can be broken up into discrete segments, data copied to and from the isolated storage system(s) or working systems as needed, and repairs can be run between each segment of a transaction, or between some segments of a transaction. Optionally, software can contain instructions that define what type of data can comprise a transaction, limiting the copy process to only copying data that meets certain criteria.

In one embodiment, to further speed the repair process a master template of the working system and the software in the working system, may each be loaded into their own separate isolated volatile memory areas or shells to increase the speed of the repair process. Thus, if data in the working system is in volatile memory and the master template is in volatile memory, repairs can be conducted at higher speeds. Alternatively a new working system shell can be utilized, eliminating the need for a repair. For example a user could open an e-mail, and read the e-mail using one shell, and if they want to respond to the e-mail a second shell could be used for the response. Optionally the first shell or computing environment can be checked for a virus while the user is writing a response to an e-mail using a second shell, and additional shells or computing environments can be made ready for use.

In another embodiment, data can be downloaded directly to a storage system, using a method of encrypting or compressing or other copying which prevents execution of the data. Optionally, an isolated hidden backup or archive system may be utilized with this invention, which may make an array of hidden backups or archives of the storage system or working system volatile or non-volatile memory/memories or data as desired, and which may be time stamped. Copying of data to such backup or archive system could also use techniques described herein to prevent execution of files and damage to the data on the backup system.

With respect to file save operations, in one embodiment, each time a save is made in a working system, a copy can be made to a storage system. Optionally, in order to prevent a virus or Trojan horse from causing havoc by performing millions of saves that get saved to the storage system, there could optionally be imposed a limit on frequency that a file could be saved, or other limitations could be placed on the process of saving data to the working system. Optionally this could be part of the ROM or copy, store, save, or other program.

A separate processor that has restricted functionality may be used to process data in the isolated working system, or the main processor can be given a restricted functionality. This can be done with multiple data storage devices, or one data storage device that has isolated partitions.

In one embodiment of the inventive system and method, data is transferred directly to and/or from one or more computing environments to and/or from one or more second computing environment(s) in a manner that eliminates the possibility of transferring malicious code. In one WO 2005/116804 PCT/US2005/001484 80 embodiment, this methodological procedure may for example, include the use in a first computing environment of an ASIC or other logic circuit or logic means that has the ability to send and/or receive ASCII or extended ASCII, connected to a data line leading to a second computing environment. In some embodiments, the capabilities of the ASIC or logic means are specifically limited so that no additional processing can occur. Optionally the second computing environment may directly receive the ASCII data, or instead the data may be received by a second ASIC with the ability of receive and/or send ASCII or extended ASCII data. These ASICS may limit the amount of data, ASCII characters, and/or requests that may be made (for example, within a period of time) in order to, for example, prevent buffer overrun.

In one embodiment, some optional handling for ASCII filtered or stripped files or content may be provided. For example, if a file, data set, or Internet or World Wide Web content is not ASCII stripped or filtered, then files from outside world and files derived from it (or derived from its progeny or children) are marked as or identified as "un-secure" and potentially infected, while files or content that are striped or filtered to only include certain permitted ASCII characters may be identified as being "secure". This type of marking can be used for other predetermined files or content other than ASCII. Therefore in.

general, a file may optionally be treated as secure if it is known that it has not been exposed to infections, malicious, or simply unknown code that may be problematic; and may be marked as secure if it is known not to have been so exposed.

In one embodiment, a repair process may be conducted which may consist of or include, for example, one or more of the following: making software in the CE identical and/or partially identical to all or part of a Master Template, deleting and/or repairing the computing environment or portion thereof such as the computing environment storage ("explosion room"), and/or switching to a secondary CE, reformatting and/or repairing one or more data storage devices, master boot records, partition tables, or the like, running one and/or more other repair processes, or any combination of these.

A repair process may be run, for example, each time a user "quits" a document (and/or other criteria may be used for when it may run). Thus each new document may be opened in a clean environment which contains no viruses and/or hacker software or other malicious code.

In one embodiment, a Master Template may be stored on a Data Storage Device that optionally may be hidden, and/or may not be normally visible to the user and may be referred to as a Protected Master Template, and/or Master Template. Optionally, it may be "read-only", and/or locked, and/or turned off, and/or disabled until needed, and/or disconnected, and/or inactivated, and/or communication with it can be terminated and/or inactivated. These (and other) techniques can be used to protect the Protected Master Template from malicious code.

In one embodiment, Data Storage Device(s) and/or partition(s) may be used to temporarily store the user's personal data (documents made by the user, E-mail, address book, bookmarks, favorites, database components, etc). This Data Storage Area may be referred to as Temporary Storage. For example, when the user saves a document, it may be saved to the Temporary Storage.

When the user saves a database, for example, it (and perhaps related components) may be saved to the Temporary Storage. When a user downloads e-mail, it may be saved to Temporary Storage. When items are created such as bookmarks and favorites, they may be saved to temporary storage when they are created, and/or when the application is quit. When a document is requested from Protected WO 2005/116804 PCT/US2005/001484 -81- Storage (described elsewhere herein), it may be first copied to Temporary Storage. For example, if the user wants to open an Internet browser, then favorites/bookmarks, and other user information may be copied from Protected Storage to Temporary Storage. Please note that this is an optional step that is not essential to this process, but in some embodiments may be desirable.

A repair process may repair Temporary Storage, or replace it with a new copy that has been prepared in advance. For example, in one embodiment, multiple temporary storage areas may be prepared in isolation. Then, as they are needed, the old Temporary Storage Device(s) may be deleted and replaced with one or more new ones, that may for example have been created using RAM, a RAM disk, a shell, or the like.

In one embodiment, for example, the Protected Storage may be the storage area where the user's personal data is isolated from the Explosion Room except after a repair, or if the explosion process has been suspended. Temporary Storage may be the data storage area that may be used (optionally) when data is "shuttled" from Protected Storage to Temporary Storage, and back again after the document has been worked on, from Temporary Storage to Protected Storage. Temporary Storage may, in one embodiment, always be accessible to the computing environment (also referred to in this and some earlier related applications as an explosion room). In this example, the user may save data to the Temporary Storage while working, and then upon quitting, the document (or other file or data set) is copied from Temporary Storage to Protected Storage.

With reference to files and backups, optionally, in one embodiment, backup system(s) or archive may be used to keep successive backups of all user's personal date: for example, documents, E-mail, favorites, and the like. Optionally, if a file is damaged by a virus or corruption, the user can copy past versions from the backup system. Successive backups and/or archives may be time/date stamped so that the user can easily determine when backups were made. The frequency of backups may be pre-determined as a default from the manufacturer, but may be changeable by the user.

Optionally, the backup system(s) may normally be hidden from the user. In one embodiment, when the backup system is made available to the user, it is kept in "read only" mode so that it can not be accidentally modified by the user. Optionally the backup may be on a separate data storage device (and in some embodiments, a partition,) and/or located elsewhere such as, for example, on a network.

Please note that this is an optional step that is not essential to this process, but in some embodiments may be desirable.

Relative to the indication that a problem or error has occurred in a computing environment, various steps for recovery or repair may be taken. In one embodiment, the processor may be allowed to complete processing and/or may be "cleared" or reset, RAM may be cleared or reset, (optionally, a second isolated RAM that may optionally be unavailable and/or deactivated may be made available, for example communication with it can be established, and/or activated and utilized while the first RAM is cleared, but use of a second RAM is not required), and the processor and/or RAM may now be utilized in the repair process. One exemplary embodiment of a repair process to an explosion room or isolated processing environment is now described, though many alternative processes and/or a different processor andlor RAM or other memory or storage may be utilized. In one embodiment, repair of a CE may also be defined as replacement of the CE with another CE. One method of achieving this is to delete the first CE, and activate communication with the second CE. Alternatively, the first explosion WO 2005/116804 PCT/US2005/001484 -82room can be repaired while the second CE is in use.

Electronic mail or E-mail in-boxes and out-boxes are usually stored as large files containing many individual messages. For example one "in-box" may contain all messages that have been sent to a user. Thus, when one E-mail is read or sent, the entire E-mail file may be at risk from a virus or hacker. According to one embodiment of the invention, E-mail software may be modified so one E-mail at a time can be copied to the Temporary Storage or isolated computing environment to be opened for use. This would protect other E-mail from contamination. Repair may be run prior to opening the next E-mail. In one embodiment, address books, and or other E-mail components could be stored in Protected Storage, and only the particular address(s) a user selects may be copied from Protected Storage to a work area to use. Thus, a virus would not have access to a users entire address book.

Optionally, updating an address book could be restricted so that a repair process must be first conducted, thus protecting the address book from contamination.

Optionally, databases and other software may store multiple files as one large file or database just as most E-mail programs treat individual Emails as one file. Such software may be modified so that individual files and/or discrete records can be copied to the Temporary Storage and worked on one at a time by the user, so entire databases are not put at risk. A repair may then be run prior to opening the next file or record. For example, each E-mail in an E-mail in box could be stored as separate file.

Alternatively, the location of the data could be entered in a directory and/or database, and only that data could be copied, without to the Temporary Storage and/or CE without opening any file in protected storage. In one embodiment computer program code may prevent user data from being opened in Protected Storage. In one embodiment E-mail and/or databases may be copied from the Protected Storage Area to a CE and/or other data storage device, and one (or more in some cases) E-mail or file(s) can be opened to work on. Only that one Email (or database file) can be opened and worked on and the rest of the E-mail and/or database can be deleted (because it still resides on the Protected Storage Device). In one embodiment, user and web site utilize proprietary inventive technology and methods. For example, in one embodiment, a system or device user .decides to do an e-commerce transaction at a web site. Instead of entering data on the web site in a conventional manner, the user indicates that he/she wants to do an e-commerce transaction, which causes the web site software to pick up (or the users software to automatically provide) the users public encryption key. The web site moves the users key into an isolated computing environment, and encrypts using a stand alone application program or procedure that the user can use to enter their transaction or database information. Then the encrypted file may be moved into an isolated computing environment that is connected or can be connected or coupled with the network such as with the Internet, or the network can be connected to the isolated computing environment where the stand alone application has been encrypted. The encrypted application is then sent to the user. The user's computer receives the application, moves it to an isolated computing environment and un-encrypts the application in an isolated computing environment. Then the user enters their user data into the application. The application may create a database of what the user has entered, and then that database can be encrypted, then network connection established with that an isolated computing environment, or the encrypted database moved to a new an isolated computing environment, and the encrypted data is then sent back to the e-commerce site, moved to a new an isolated computing environment, and WO 2005/116804 PCT/US2005/001484 -83unencrypted. In this manner unencrypted database and e-commerce is never exposed to the network.

In one embodiment, the Ethernet cable (or other network connection communication link) may communicate in only one direction rather than in both directions and each of the receive and transmit cables are switched to communicate with the computing environment separately. In these embodiments, each line or direction of the Ethernet (or other network connection communication link) is switched separately with each communication link being coupled with a separate isolated computing environment. One computing environment sends and another computing environment receives and their activity is coordinated by the controlling computing environment, such as by the CSCE or CCE. In another embodiment, a pair or network interface cards or capabilities (NICs) or modems are also configured to only send or only receive with the pair providing send/receive capability. By providing a receive only capability in one computing environment and a transmit only capability in another isolated computing environment, even if a hacker or virus gains access to the receive computing environment, the hacker or virus cannot get out or be communicated elsewhere from the transmit only computing environment.

In one embodiment, an internal DHCP router or other router is optionally provided so that computing environments can have multiple network transactions, multiple NIC cards, or multiple I/O devices. In one embodiment, any number of peripherals coupled exclusively with any number of computing environments in an isolated manner. These devices may,for example be USB devices, Firewire devices, SCSI devices, serial devices, or any other device types as are known in the art.

In one embodiment, rather than replacing the prior saved versions of files, the older files may be retained. For example, when the updated Netscape bookmarks and user data are copied back to Protected Storage, they may not replace the previous version of the Netscape bookmarks and history.

Thus, the next time the data is used, if it is corrupt and does not operate properly, the method of control and/or user may run a repair, and switch back to using a prior version of the data.

In one embodiment, optionally, two or more CE's can be created, one that, for example, has a complete Master Template, and another that, for example contains only abbreviated set of frequently used applications and the operating system. Optionally, when software is needed, if the CE does not contain the software, the required software may be added to the CE, by copying it from a Master Template that may for example contain the full set of the users software and may optionally contain an operating system.

In one embodiment, optionally, prior to activating network communication: some or all E-mail to be sent can be encrypted using a method of safeguarding E-mail by performing encryption in an isolated computing environment prior to sending, then copying the Email to a second isolated computing environment where it will be sent (and exposed to a potential hacker). After being received the encrypted email is moved to an isolated computing environment prior to being unencrypted. Thus email is never exposed to the Internet in a non-encrypted form. Our software automatically triggers the encryption and/or decryption process without user involvement. Optionally, users public key can be provided with each email automatically.

Optionally, in one embodiment, Protected Storage can be read only and/or locked until the CSCE or CCE or other controlling environment receives a command to move data to an CE. Thus, in this example, if a user selects a document in the Protected Storage to open, code (that may for WO 2005/116804 PCT/US2005/001484 -84example be instructions in ROM and/or an operating system) could instruct the CSCE to conduct a repair. Then following a repair the CSCE could switch Protected Storage to read-write and/or unlocked.

Data can be copied from the Protected Storage to the Temporary Storage and/or Explosion Room.

These events may take place in other order, may contain additional and/or other steps, and/or may not contain some of these steps.

Optionally multiple CE may operate simultaneously, so that if one "crashes" and/or is quit and/or closed, and/or no longer needed, another CE is ready to take the place of the CE that was in use. For example, the CSCE may switch to a secondary CE, and/or activate communication with a secondary CE.

In one embodiment, code associated with Protected Storage may not permit data to execute and/or may not support execution of data in Protected Storage) Thus, in this embodiment, no user data can execute in Protected Storage. Optionally, communication with Protected Storage may never be established with an CE prior to a repair, and prior to a new network connection with that CE, and/or prior to the opening of any user document. Thus, Protected Storage is impervious to hacking, and the execution of viruses.

In one embodiment, computing environments (also referred to as x-rooms or explosion rooms) may each be identical to each other, and/or may have differences from each other, and/or act as "time delayed" mirrors. In one embodiment secondary CEs may be identical, but keystrokes and/or input may be sent to multiple CEs in a delayed manner. Thus, some CEs may be time delayed so that if a CE crashed, the control system could switch to a time delayed CE. In one embodiment the method of control may utilize a process watcher and/or crash detection system to determine whether to switch to secondary system CEs, and optionally may diagnose problems so that problems may be avoided when switching to successively older CEs.

In one embodiment, data in volatile memory may be copied, and/or saved, and/or backed up to another memory area and/or logic device prior to executing a command. Successive backups of data prior to execution of commands may be stored. Then, when a command is executed, and if a problem such as a freeze occurs, a new secondary system and/or secondary self repairing user work area can be used, and/or optionally backups of volatile memory may be loaded into volatile memory. This may provide a good copy of volatile memory for use. If a problem or freeze occurred again, an older version of the saved volatile memory may be utilized. Optionally user(s) may be notified of the problem and asked to change what they input, and/or how they input data, and/or other behavior. Optionally a process watcher and/or error detection system may be used to identify problems. Optionally, when a secondary CE is used, the method of control may choose to utilize an earlier backup of volatile memory, and/or command the secondary system to treat the data differently to avoid a crash.

An alternative method of performing the repair for example, is to prepare multiple CEs in isolation. These CEs could be in the form of RAM disks, RAM, shells, volatile memory, or other data storage and may have associated RAM, and/or processing, and/or computing, and could contain copies of all or part of one or more master templates. Isolation could be created for example by activating and/or deactivating communication to switch CE from being an isolated backup, to being the current

CE.

Optionally, in one embodiment, in the event that one or more unanticipated, and/or unidentified WO 2005/116804 PCT/US2005/001484 files appears in the Temporary Storage Area, (for example one or more files that do not appear in a protected database of information pertaining to what data should be in the Temporary Storage Area) the code, for example, in the Method of Control and/or operating system, and/or ROM may draw such files to the attention of the user. The user may be given the option of destroying and/or saving the file(s), and/or marking the file(s) to indicate that the file(s) is/are some way questionable, and/or may need further inspection and/or validation. In another embodiment the unidentified files may be deleted and/or saved to a data storage device and/or marked for further inspection, and/or may be automatically and/or manually sent somewhere for further examination, for example to a network administrator and/or a virus inspection entity.

In one embodiment, one or more data storage device(s) may be hardware and/or software switched between read only and read/write modes and/or locked and/or unlocked mode, and/or accessible and/or inaccessible mode. In one example, a user may open a file from a read only data storage device, does work on the file, and when the user saves the files is saved to a temporary storage area. Optionally, on closing some or all files, logic and/or method of control may perform one or more of the following steps, clear and/or reset RAM, clear/reset processor, and/or make one or more data storage devices unlocked and/or locked, and/or read/write and/or read only, move data from temporary storage to data storage device, close/lock/make read only one or more data storage device(s), optionally clear/reset temporary storage area, (optionally run repair process), wait for next user command. In one embodiment, Temporary Storage may consist of volatile andJor non-volatile memory. In one example: random access memory and/or flash ROM, and or other data storage may be used. In one embodiment, to copy data between documents, data to copy may be loaded into one or more specific address(s) in RAM and/or volatile memory. When receiving a paste command the data may be communicated by use of a copy process that does not allow data to execute. For example, the data could be simplified to only transmit ASCII text that cannot be executed.

In one embodiment, although files may not be opened in Protected Storage, they may be, for example but not limited to: copied, moved, deleted, flagged, backed up, archived, and other such functions, as long as these functions are performed from a "secure" interface, such as the Control Environment.

In one embodiment, in order to run commands that would change preferences, modify master templates, delete backups, or to provide other administrative events to the control environment, or the like, the administration must occur from a secure environment, such as for example, the control environment itself which may have its own user interface software. Herein the term isolation may be used to convey the concept that at times what is being described is isolated; at specific other times as described herein it may not be isolated. For example, an CE may be isolated when user data is executing, and until a repair process runs. Then, to run a repair process, communication may be established with, for example a read only Master Template, a repair may be conducted, and then other communication may be established with the CE, such as communication with a network. Isolation is utilized as needed and when needed to prevent hacking and the spread of viruses.

With reference to master templates, "disposable copies" of Master Templates used in the CE may be created in many ways and using a variety of criteria. In one embodiment a variety of Master Templates in CEs may be created. Criteria for creating Master Templates may be established. For WO 2005/116804 PCT/US2005/001484 86 example one criteria could be based on selecting programs commonly used on the computer/computing device. For example, assume that a computer user most commonly uses: a word processing program, an E-mail program, two internet browsers and a utility that prevents pop-ups and a program that tracks on-line auctions; and to a lesser extent uses a variety of other applications, games, utilities and/or other programs. Using this example Master Template(s) could be created using each of these needs as criteria. Tt'us one Master Template may contain an operating system and a word processing program: another Master Template may contain an operating system and an E-mail program. Another Master Template may contain an operating system, two internet browsers and a utility that prevents pop-ups and a program that tracks on-line auctions; and yet another Master Template may contain all of the users software.

In another embodiment, one (or more) master templates may be created, and only the parts of the Master Template that are needed to meet a criteria may be copied to create one or more CE(s).

For example, there could be one master template, but it could be used to create parts of a Master Template in one or more CEs. For example, using the criteria mentioned above, one Master Template may be used to create CEs that are readied for possible use by the user.

In one embodiment, the user may be able to select which CE(s) to utilize/open, and may copy data to the CE(s). Optionally, selection of CEs and/or copies of Master Templates to use may happen automatically, and may be orchestrated by code. For example if the user selects a word processing document to open, when the document is selected code may execute that searches for an CE containing the appropriate word processing software, and/or may check a database and/or directory to identify the location of the appropriate software, and/or use other means to identify the correct software, and/or CE to utilize.

In some embodiments of the invention, data from one, several, or all computing environments may be displayed on a single display device (or on a set of fewer display devices than there are operating computing environments) so that there is a desireability of sharing such display devices and subsystems without contamination.

In one embodiment, the Control Environment may utilize multiple modes of operation. For example, in a first mode of operation the Control Environment may not allow copying between user computing environments except for ASCII and extended ASCII, and/or might not allow file sharing on a network. In a second mode of operation the Control Environment may allow copying of unknown executable code and/or might allow file sharing on a network. The first mode might be classified as "immune to hacking and viruses" whereas the second mode of operation might be classified as "resistant to hacking and viruses" or "non-secure". Documents created in the second mode of operation may be labeled for example as "non-secure" documents. Additional modes of operation may be utilized. Switching modes may be done for example by the Control Environment, and/or by the user, and/or by an administrator. Switching may be automatic, and/or triggered by a manual switching process, or by some condition that is detected.

There are many other possible modes that may be implemented with an embodiment of the invention. For example there may be various administrative modes. In one example of an administrative mode, a user may have to utilize a key, or a password, or any means of verifying identity or authorization in order to conduct repairs and/or maintenance to one or more computing WO 2005/116804 PCT/US2005/001484 87 environments, such as the protected storage or control environments. In a second example of administrative mode and/or a repair mode, protected storage(s), control environment(s), may be automatically saved to one or more data stores, reformatted/reset/erased, and reloaded as needed to recreate their state in a pristine manner. A master template of various environments such as the control environment may be utilized, and with proper authorization and switching another environment may conduct repairs to the control environment during the maintenance process. In one embodiment this switching may occur on a schedule, and/or may be triggered by a user.

In another embodiment, the control environment may label each file saved to protected storage.

If the file is unknown or untrusted it may be labeled for example "untrusted", whereas if the file was created from within in a pristine environment, the control environment may label the file as "trusted". In one example, in "immune to hacking and virus" mode, the Control Environment may allow copying of trusted data to a second User Computing Environment from a first User computing Environment, but disallow copying of "untrusted" data to a second User Computing Environment. Switching to "less secure" mode may enable the Control Environment to allow the untrusted code to be copied from the first User Computing Environment, to the Second User Computing Environment, and the resulting file may now be labeled "untrusted".

In another embodiment, in one mode, linked data in two or more computing environments may be copied directly between those environments. In another embodiment, groups of trusted linked data may be copied or moved into a user environment and data copied between them and/or cross linked if all data is trusted. Thus, entire databases and sets of linked data may be moved or copied to User Computing Environments and worked on with cross copying and linking of data between the various documents and/or databases. If all of the data is trusted, then the data can all be worked on together in one User Computing Environment. (Or in more than one, such as a second, third, etc.) A User Computing Environment may be in direct communication with the first computing environment, because all of the code is trusted. In a different untrusted mode of operation, untrusted data can be merged with trusted or untrusted data resulting in untrusted data, and so labeled. In this manner entire databases of linked data and databases may be maintained and shared in a trusted environment.

In another embodiment, networks composed of computers using this new art may share and intermingle trusted data, databases, and linked data documents that is communicated over trusted/secure communication lines.

In one embodiment, the Control Computing Environment may, for example, never allow the intermingling of files labeled untrusted with files labeled trusted. This method advantageously enables entire networks of computers attached by trusted/secure network connections to share and co-mingle trusted files, databases, and linked data, while simultaneously having the ability to have untrusted files on their computers and use those untrusted files without endangering their trusted files.

In one embodiment, the server can be of the art described herein, and client nodes can be connected via a secure/trusted network connection, and the client nodes may be comprised of computers of the prior art. In this example the server may perform the following steps: reformat a client computer hard drive and may clear memory; provide the user computer with access to the desktop environment, after the user selects a file, in the desktop environment; provide the requested file to the user environment and limit communication with the desktop environment to, for example, one WO 2005/116804 PCT/US2005/001484 -88bit, meaning "save" file, and more than one bit, save file and erase computing environment. There may also be the step: in order to save the file in a manner that does not put the Control Environment at risk, the user file may be copied from the client computer by a User Computing Environment on the Server, and then saved in the usual manner of saving data located in a User Computing Environment.

Then when the client is done, the client computer may be reformatted and reset by the server.

Optionally, the client may operate as a "thin client" so little or no data needs to be copied back to the client computer.

In one embodiment, files marked untrusted may be made trusted by means of a "stripping" process that removes any potentially executable code from, for example, a word processing document.

For example untrusted file data may by copied as ASCII characters to a secure environment and classed as trusted. In one embodiment, protected storage may be external and/or portable, and/or hotswappable, and/or portable media. In one embodiment a software and/or physical button and/or switch and/or combination can be used to trigger events such as resetting/repairing computing environments.

An internal or external backup system that may or may not be hidden, may be switched for example by the control environment, in order to backup protected storage, master templates, copies of the control environment, etc.

Attention is now directed to a description of how data from any selected one or a set of computing environments may be displayed and used. Such data may include but is not limited to the video output or representation of data or activities occurring in a computing environment as well as to actual input, output, and intermediate data sets or files that are used or generated by or within the computing environment during a processing episode.

In one embodiment involving a window based user interface, all (or selected) size, shape and location coordinates for all (or selected) windows, icons (and the names of the application programs or data such icons represent), and other relevant data and/or means of identification is sent from a computing environment (also referred to in some embodiments as an "explosion room" or "x-room" because any explosion of code is contained and not externally harmful) to the controlling entity within the system, normally a control computing environment (also referred to the "Brain" in some embodiments), such as the CSCE or CCE computing environments already described. This information may, for example, be provided to the control computing environment using the inventive procedures using computer program software instructions running in one or more of the various computing environments or on a temporally separated manner when single concurrent computing environment operation is supported. Alternatively, all or part of it may be created by or within the control computing environment.

This data, stored and tracked by the control computing environment, will be referred to herein as "computing environment data" or "x-room data".

Additionally, the control computing environment may also or alternatively track other data referred to as control data or "Brain data", such as, for example, data representing the order in which each "layer" or "process", was created, and the order in which each window was created. It may also maintain information on a selective or active window or process.

The control computing environment such as the CSCE or CCE described in some embodiments and also referred to as the system "Brain relative to other embodiments, may also track WO 2005/116804 PCT/US2005/001484 -89the mouse cursor's or other pointing device location and/or keyboard or other user input activity. Thus, the control computing environment can then determine the location of the mouse cursor (when a mouse or pointing device click occurs) relative to the locations of these open windows, icons, or the like, that is generated by each computing environment. It will be appreciated that although this specification primarily describes human user interaction using keyboard and mouse commands, in fact the inventive system and method may be applied to a variety of user interactions, such as but not limited to touchscreen interaction and command, voice interaction and command, drop down menus, hot spot selection interaction and command, function button presses, pens stylus interaction and command, and a variety of other user input and interaction methods and devices as are known in the art or may be expected to develop.

Thus, by calculating the mouse location "click" (or other "selection") and comparing that to the allocated computing environment's window location (and which window is "in front" or "active", it is then possible for the CSCE to determine specifically which window (or icon, or item, or computing environment process) was intended to be selected and receive that "click" input.

Thus, when the mouse button is clicked, the control computing environment can determine, for example, which layer to make "active and in front" in conventional windows terms, or which application to launch, or where to redirect the mouse and keyboard signals, based on the information collected by the control computing environment.

Direct connections from computing environments to the CSCE may by way of example but not limitation use a first (possibly dedicated) ASIC from a computing environment to a second (possibly dedicated) ASIC in the CSCE (or a filter) to prevent unintended activities or results. Such unintended results may for example be some code executing that causes a buffer or memory over-run intended to place or spread malicious code. The ASIC is merely one example of a logic circuit that provides a filtering or limiting operation so that only predetermined permitted processing can occur. For example, such logic whether in the form of an ASIC or otherwise implemented, operating as a "receiver" can only comprehend or interpret the received communication as y" or "line, sample" coordinates, and nothing else. Note that in some embodiments a single ASIC or other logic positioned in a communication path between a computing environment and the CSCE may be sufficient to provide the desired limitation or filtering operation in the intended communication. Such ASIC or logic circuit (optionally using software and/or firmware) may be controllable to securely and safely select one function from an available set of possible permitted functions or operations or may be dynamically programmable (such as by downloading code from a protected or other secure storage or sending a control signal or signals) to accomplish such selection.

Examples of "x-room data" or user computing environment data which may be included in the data provided to the control computing environment may include none or any one or more of, but are not limited to: window locations and sizes (like a wire-frame); names of icons and what they represent; file size, file location, and the like file or data set references or identifiers. By way of further examples, these may include a B-tree, a master directory, a desktop database, and the like. It may also or alternatively include a list or other data structure or index of which application programs, drivers, or operating system components are "associated" or intended to interoperate, open, or have a processing capability with which files or file types or devices or device types.

WO 2005/116804 PCT/US2005/001484 90 Examples of control data or "Brain data" may include none or any one or more of: data identifying an order in which layers, windows, and/or processors were created, a current ordering or priority of such layers, windows, and or processes; a mouse or pointing device absolute, screen relative, window relative cursor location, and/or a combination of these or other data. It will be appreciated that in some embodiments, a plurality of the computing environments may have similar or identical attributes, some of this data or information may only need to be created once, and then modified or adapted to each computing environment for subsequent update, if and when there is a relevant change for that computing environment.

Having described several embodiments of the invention including numerous optional features, it will be clear that the different aspects and features of the invention may be combined and used together as well as used separately. In this section attention is directed to particular exemplary embodiments that have certain combinations of features. This description is exemplary only and not intended to limit the scope or spirit of the invention in any way. Numerous aspects and features of the invention as described elsewhere in the specification are not described in the paragraphs to follow.

In one aspect the invention provides an information appliance. In one embodiment of the information appliance the information appliance is of the type having first storage for programs and data, and processor logic and executing computer program instructions to perform a task involving a user data; the information appliance characterized in that: separate control processing environments and user processing environments are created and maintained so that: user data having unknown or untrusted content is not exposed in the control processor logic environment to computer program code that can execute any computer program code instructions imbedded in the user data; and user data having unknown or untrusted content is only exposed in the user processor logic environment in a temporary storage different from the first storage when isolated from the first storage. In another embodiment of the information appliance, the information appliance is or includes a personal data assistant. In another embodiment of the information appliance, the information appliance includes or is a computer.

In another aspect, the invention provides an information appliance comprising: at least one processing logic device for executing at least one instruction; a first storage for storing first data and first program code including the at least one instruction and including a user data; a second storage for storing second data; a switching system for selectably and independently coupling and decoupling the processing logic device with the first storage and/or the second storage Under automated control, the switching system receiving at least one control signal from the processing logic device for selecting a condition of the switching system; the processing logic device operating in a control configuration and in a user data configuration according to the following conditions: the processing logic device may be coupled with the first storage when the processing logic is loaded with a program instruction not capable of executing a data item that has untrusted content or that did not originate within a known controlled environment; (ii) the processing logic device may not be coupled or only restrictively coupled to communicate known information with the first storage when the processing logic is loaded with a program instruction that may be capable of executing a data item that has untrusted content or that did not originate within a known controlled environment; (iii) the processing logic device may be coupled with the second storage when the processing logic is loaded with a program instruction that may be WO 2005/116804 PCT/US2005/001484 -91 capable of executing a data item that has untrusted content or that did not originate within a known controlled environment; and (iv) the processing logic device may be coupled with the first storage and the second storage when the processing logic is loaded with a program instruction that is only capable of copying a data item from the first storage to the second storage or from the second storage to the first storage.

In one embodiment of the afore described information appliance, the switching system can couple or decouple the processing logic device with the first storage and the second storage in at least the following ways: processing logic device coupled with the first storage only, (ii) processing logic device coupled with the second storage only, (iii) processing logic device coupled with the first and second storage concurrently, (iv) processing logic device coupled with neither the first storage nor the second storage. In another embodiment of the afore described information appliance, the processing logic device comprises a microprocessor. In another embodiment of the afore described information appliance, the processing logic device is selected from the set of processing logic circuits consisting of: Sa microprocessor, a central processing unit (CPU), a controller, a micro-controller, an ASIC, a logic circuit, a programmable logic circuit, and combinations of these. In another embodiment of the afore described information appliance, the information appliance is selected from the set of information appliances consisting of: a computer, a notebook computer, a personal data assistant, a personal data organizer, a cellular telephone, a mobile telephone, a radio receiver, a radio transmitter, a GPS receiver, a satellite telephone, an automobile on-board computer, an aircraft on-board computer, a navigation device, a home appliance, a printing device, a scanning device, a camera, an electronic camera, a television receiver, a broadcast control system, an electronic instrument, a medical monitoring device, a security device, an environmental control system, a electronic device, and combinations of these. In another embodiment of the afore described information appliance, the first data store and second data store are independently selectable and selected from the set of storage consisting of: a rotating magnetic hard disk drive, a rotating magnetic floppy disk drive, a CD, a DVD, a semiconductor memory, a solid state memory, a chemical memory, a magnetic memory, a molecular memory, a micro-drive, a flash memory, a compact flash card memory, a RAM memory, a ROM memory, and combinations thereof.

In another embodiment of the aforedescribed information appliance, the at least one processing logic device comprises a plurality of processing logic devices. In another embodiment of this information appliance, at least one of the plurality of processing logic devices comprises at least one microprocessor and the at least one instruction comprises a plurality of computer program code segments from an operating system and a plurality of computer program code segments from an application program; and wherein the switching system is coupleable to the microprocessor for receiving switch control commands for altering the switch configuration to selectably couple and decouple the microprocessor with the first and second storage. In another embodiment of this information appliance, the plurality of processing logic devices are intermittently sequentially isolated and communicatively restricted, by an automated control system executing one of the processing logic devices. In another embodiment of the information appliance, the second storage is configured to perform as a temporary storage during a processing operation when it is coupled with the processing logic device and automatically erased after each processing has occurred independent if the WO 2005/116804 PCT/US2005/001484 92 processing completed with error condition or without error condition, where an error condition may include detection of a virus or other malicious code execution. In another embodiment of the information appliance, the plurality of processing logic devices and at least the first and second storage are dynamically configurable to create computing environments having determined characteristics. In another embodiment of the information appliance, the first storage stores a master template file having operating system and application program components and a protected copy of user data.

In another aspect the invention provides a method for operating an information appliance of the type having at least one processing logic device for executing at least one instruction, a first storage for storing first data and first program code including the at least one instruction and including a user data, and a second storage for storing second data; the method comprising: selectively and independently switching to couple and decouple the processing logic device with the first storage and/or the second storage under automated control upon receipt of at least one control signal from the processing logic device for selecting a condition of the switching system; operating the processing logic device in a control configuration and in a user data configuration according to the following conditions: (i) permitting coupling the processing logic device with the first storage when the processing logic is loaded with a program instruction not capable of executing a data item that has untrusted content or that did not originate within a known controlled environment; (ii) not permitting coupling the processing logic device with the first storage or only restrictively permitting coupling the processing logic device with the first storage to communicate known information when the processing logic is loaded with a program instruction that may be capable of executing a data item that has untrusted content or that did not originate within a known controlled environment; (iii) permitting coupling the processing logic device with the second storage when the processing logic is loaded with a program instruction that may be capable of executing a data item that has untrusted content or that did not originate within a known controlled environment; and (iv) permitting coupling the processing logic device with the first storage and the second storage when the processing logic is loaded with a program instruction that is only capable of copying a data item from the first storage to the second storage or from the second storage to the first storage.

In another embodiment of the method for operating an information appliance, the method further comprising: erasing the second storage after any processing logic device has used the second storage to process a user data.

In another embodiment of the method for operating an information appliance, the information appliance is selected from the set of information appliances consisting of: a computer, a notebook computer, a personal data assistant, a personal data organizer, a cellular telephone, a mobile telephone, a radio receiver, a radio transmitter, a GPS receiver, a satellite telephone, an automobile onboard computer, an aircraft on-board computer, a navigation device, a home appliance, a printing device, a scanning device, a camera, an electronic camera, a television receiver, a broadcast control system, an electronic instrument, a medical monitoring device, a security device, an environmental control system, a electronic device, and combinations of these.

In another embodiment of the method for operating an information appliance, the at least one processing logic device comprises a plurality of processing logic devices. In another embodiment of the method for operating an information appliance, at least one of the plurality of processing logic devices WO 2005/116804 PCT/US2005/001484 -93comprises at least one microprocessor and the at least one instruction comprises a plurality of computer program code segments from an operating system and a plurality of computer program code segments from an application program; and wherein the switching system is coupleable to the microprocessor for receiving switch control commands for altering the switch configuration to selectably couple and decouple the microprocessor with the first and second storage.

In another aspect the invention provides an information processing device comprising: a housing having a form factor of a computer PC Card and a plurality of PCCardBus interface connections; a plurality of processors disposed within the housing; a plurality of data stores disposed within the housing or coupled thereto; a protected data store portion selected from the plurality of data stores for storing at least a user data; a data store switch system coupled with the plurality of data stores, the switch system coupled with a data store switch configuration for configuring communication with one or more data store disposed within the housing; an I/O switch system coupled with at least one peripheral, the I/C system coupled with an I/O system configuration including a plurality of traits for configuring communication with the peripheral disposed within the housing; a plurality of computing environments, each the computing environment including at least one processor and identified by at least one trait selected from the plurality of traits, including: a data store switch communication path coupled with the data store switch, the data store switch communication path coupling at least one data store with the computing environment according to the data store switch configuration; an I/O switch communication path coupled with the I/O switch system, the I/O switch communication path for coupling the peripheral with the computing environment according to the I/O switch system configuration; the computing environment capable of performing a processing activity including receiving input from the I/O switch system and sending output to the I/O switch system, the processing activity performed independently of the processing activity of another computing environment; a control computing environment selected from the plurality of computing environments for configuring the data store switch configuration, for configuring the I/O switch system configuration, the data store switch configuration supporting communication between the control computing environment and the protected data store; and at least one user isolated computing environment selected from the plurality of computing environments; wherein the I/O switch system configuration is configured to direct a received input to at least one of the computing environment, the I/O switch system configuration is configured to direct an output generated by one or more of the plurality of computing environments to the peripheral.

In another embodiment of the information processing device, the plurality of processors are independently selected from the set of processing logic circuits consisting of: a microprocessor, a central processing unit (CPU), a controller, a micro-controller, an ASIC, a logic circuit, a programmable logic circuit, and combinations of these; and the plurality of data store are independently selectable and selected from the set of storage consisting of: a rotating magnetic hard disk drive, a rotating magnetic floppy disk drive, a CD, a DVD, a semiconductor memory, a solid state memory, a chemical memory, a magnetic memory, a molecular memory, a micro-drive, a flash memory, a compact flash card memory, a RAM memory, a ROM memory, and combinations thereof.

In another aspect, the invention provides a computer of the type having first storage for programs and data, and processor logic and executing computer program instructions to perform a task involving a user data; the computer characterized in that: separate control processing environments WO 2005/116804 PCT/US2005/001484 -94and user processing environments are created and maintained so that: user data having unknown or untrusted content is not exposed in the control processor logic environment to computer program code that can execute any computer program code instructions imbedded in the user data; and user data having unknown or untrusted content is only exposed in the user processor logic environment in a temporary storage different from the first storage when isolated from the first storage.

In another aspect, the invention provides a computer system comprising: at least one processing logic device for executing at least one instruction; a first storage for storing first data and first program code including the at least one instruction and including a user data; a second storage for storing second data; a switching system for selectably and independently coupling and decoupling the processing logic device with the first storage and/or the second storage under automated control, the switching system receiving at least one control signal from the processing logic device for selecting a condition of the switching system; the processing logic device operating in a control configuration and in a user data configuration according to the following conditions: the processing logic device may be coupled with the first storage when the processing logic is loaded with a program instruction not capable of executing a data item that has untrusted content or that did not originate within a known controlled environment; (ii) the processing logic device may not be coupled or only restrictively coupled to communicate known information with the first storage when the processing logic is loaded with a program instruction that may be capable of executing a data item that has untrusted content or that did not originate within a known controlled environment; (iii) the processing logic device may be coupled with the second storage when the processing logic is loaded with a program instruction that may be capable of executing a data item that has untrusted content or that did not originate within a known controlled environment; and (iv) the processing logic device may be coupled with the first storage and the second storage when the processing logic is loaded with a program instruction that is only capable of copying a data item from the first storage to the second storage or from the second storage to the first storage.

In another aspect the invention provides a computer system of the type having first storage and at least one processor, the computer system characterized in that: separate control processing environments and user processing environments are created and maintained within at least one or the storage and the processor so that: identified data is not exposed in processor executable instructions imbedded in the data; and identified data is only exposed in the processor in a second storage different from the first storage when isolated from the first storage.

The foregoing descriptions of specific embodiments and best mode of the present invention have been presented for purposes of illustration and description. They are not intended to be exhaustive or to limit the invention to the precise forms disclosed, and obviously many modifications and variations are possible in light of the above teaching. The embodiments were chosen and described in order to best explain the principles of the invention and its practical application, to thereby enable others skilled in the art to best utilize the invention and various embodiments with various modifications as are suited to the particular use contemplated. It is intended that the scope of the invention be defined by the claims appended hereto and their equivalents.

PA 1083757vl

Claims (38)

1. A method for preventing a contamination of a first data by the execution of a second data, the ri method comprising the steps of: interposing a first isolation device between a source and a processing logic and a second 5 isolation device between the processing logic and a receiver, the first and second isolation devices each being incapable of executing any instruction coming into the isolation device from the source, from the receiver, or from the processor logic and preventing access to the processing logic and execution of any M instructions on the source or the receiver side by the processing logic; communicating the second data from the source to the processing logic through the first isolation 00 t0 device; processing the second data in the processor logic to generate a first result; and communicating the first result from the processor logic to the receiver through the second isolation device.

2. A method as in claim 1, wherein the first and second isolation devices are incapable of executing any the instructions because they only perform a copy operation on binary bits or a plurality of binary bits.

3. A method as in claim 1, wherein the copy operation is performed external to the processing logic. 0 4. A method as in claim 2, wherein the first and second isolation devices are the same device. A method as in claim 2, wherein the first and second isolation devices are different devices.

6. A method for preventing a contamination of a first data by the execution of a second data, the method comprising the steps of: isolating a source from a processing logic and from a receiver, the isolated source and isolated receiver being incapable of executing any instruction coming into the isolated source, from the receiver, or from the processor logic and preventing access to the processing logic and execution of any instructions on the source or the receiver side by the processing logic; communicating the second data from the source to the processing logic in an isolated mode; processing the second data in the processor logic to generate a first result; and communicating the first result from the processor logic to the receiver in an isolated mode.

7. A method as in claim 6, wherein the isolation is a logical isolation.

8. A method as in claim 6, wherein the isolation is a physical isolation.

9. A method as in claim 6, wherein the source and receiver are storage locations and the isolation is accomplished using an address control procedure. ID 10. A method as in claim 9, wherein the address control procedure includes exerting a level of control within the computer below the operating system that hides certain memory locations and makes other memory locations available to a process. 5 11. An information appliance of the type having first storage for programs and data, and processor V logic and executing computer program instructions to perform a task involving a user data; the information appliance characterized in that: separate control processing environments and user processing environments are created and maintained so that: user data having unknown or untrusted content is not exposed in the control processor logic environment to computer program code that can execute any 0 10 computer program code instructions imbedded in the user data; and user data having unknown or untrusted content is only exposed in the user processor logic environment in a temporary storage V different from the first storage when isolated from the first storage.

12. An information appliance comprising: at least one processing logic device for executing at least one instruction; a first storage for storing first data and first program code including said at least one instruction and including a user data; a second storage for storing second data; a switching system for selectably and independently coupling and decoupling the processing logic 0 device with the first storage and/or the second storage under automated control, the switching system receiving at least one control signal from the processing logic device for selecting a condition of the switching system; the processing logic device operating in a control configuration and in a user data configuration according to the following conditions: the processing logic device may be coupled with the first storage when the processing logic is loaded with a program instruction not capable of executing a data item that has untrusted content or that did not originate within a known controlled environment; (ii) the processing logic device may not be coupled or only restrictively coupled to communicate known information with the first storage when the processing logic is loaded with a program instruction that may be capable of executing a data item that has untrusted content or that did not originate within a known controlled environment; (iii) the processing logic device may be coupled with the second storage when the processing logic is loaded with a program instruction that may be capable of executing a data item that has untrusted content or that did not originate within a known controlled environment; and (iv) the processing logic device may be coupled with the first storage and the second storage when the processing logic is loaded with a program instruction that is only capable of copying a data item from the first storage to the second storage or from the second storage to the first storage.

13. An information appliance as in claim 12, wherein the switching system can couple or decouple the processing logic device with the first storage and the second storage in at least the following ways: (i) processing logic device coupled with the first storage only, (ii) processing logic device coupled with the second storage only, (iii) processing logic device coupled with the first and second storage concurrently, ID (iv) processing logic device coupled with neither the first storage nor the second storage. O S14. An information appliance as in claim 12, wherein the processing logic device comprises a microprocessor. An information appliance as in claim 12, wherein the processing logic device is selected from the set of processing logic circuits consisting of: a microprocessor, a central processing unit (CPU), a controller, a micro-controller, an ASIC, a logic circuit, a programmable logic circuit, and combinations of these.

16. An information appliance as in claim 12, wherein the information appliance is selected from the V set of information appliances consisting of: a computer, a notebook computer, a personal data assistant, Oa personal data organizer, a cellular telephone, a mobile telephone, a radio receiver, a radio transmitter, a GPS receiver, a satellite telephone, an automobile on-board computer, an aircraft on-board computer, a navigation device, a home appliance, a printing device, a scanning device, a camera, an electronic camera, a television receiver, a broadcast control system, an electronic instrument, a medical monitoring device, a security device, an environmental control system, a electronic device, a network appliance, and combinations of these. '0 17. An information appliance as in claim 12, wherein the first data store and second data store are independently selectable and selected from the set of storage consisting of: a rotating magnetic hard disk drive, a rotating magnetic floppy disk drive, a CD, a DVD, a semiconductor memory, a solid state memory, a chemical memory, a magnetic memory, a molecular memory, a micro-drive, a flash memory, a compact flash card memory, a RAM memory, a ROM memory, and combinations thereof.

18. An information appliance as in claim 12, wherein said at least one processing logic device comprises a plurality of processing logic devices.

19. An information appliance as in claim 18, wherein at least one of said plurality of processing logic devices comprises at least one microprocessor and said at least one instruction comprises a plurality of computer program code segments from an operating system and a plurality of computer program code segments from an application program; and wherein said switching system is coupleable to said microprocessor for receiving switch control commands for altering the switch configuration to selectably couple and decouple the microprocessor with the first and second storage. An information appliance as in claim 19, wherein the plurality of processing logic devices are intermittently sequentially isolated and communicatively restricted, by an automated control system executing one of the processing logic devices.

21. An information appliance as in claim 19, wherein the second storage is configured to perform as a temporary storage during a processing operation when it is coupled with the processing logic device and automatically erased after each processing has occurred independent if the processing completed ID with error condition or without error condition, where an error condition may include detection of a virus or 0 other malicious code execution..

22. An information appliance as in claim 20, wherein the plurality of processing logic devices and at V 5 least said first and second storage are dynamically configurable to create computing environments having determined characteristics.

23. An information appliance as in claim 11, wherein said first storage stores a master template file having operating system and application program components and a protected copy of user data. oo S 24. A method for operating an information appliance of the type having at least one processing logic V device for executing at least one instruction, a first storage for storing first data and first program code Oincluding said at least one instruction and including a user data, and a second storage for storing second data; the method comprising: selectively and independently switching to couple and decouple the processing logic device with the first storage and/or the second storage under automated control upon receipt of at least one control signal from the processing logic device for selecting a condition of the switching system; operating the processing logic device in a control configuration and in a user data configuration according to the following conditions: .0 permitting coupling the processing logic device with the first storage when the processing logic is loaded with a program instruction not capable of executing a data item that has untrusted content or that did not originate within a known controlled environment; (ii) not permitting coupling the processing logic device with the first storage or only restrictively permitting coupling the processing logic device with the first storage to communicate known information when the processing logic is loaded with a program instruction that may be capable of executing a data item that has untrusted content or that did not originate within a known controlled environment; (iii) permitting coupling the processing logic device with the second storage when the processing logic is loaded with a program instruction that may be capable of executing a data item that has untrusted content or that did not originate within a known controlled environment; and (iv) permitting coupling the processing logic device with the first storage and the second storage when the processing logic is loaded with a program instruction that is only capable of copying a data item from the first storage to the second storage or from the second storage to the first storage. A method for operating an information appliance as in claim 24, further comprising: erasing the second storage after any processing logic device has used said second storage to process a user data.

26. A method for operating an information appliance as in claim 24, wherein the information appliance is selected from the set of information appliances consisting of: a computer, a notebook computer, a personal data assistant, a personal data organizer, a cellular telephone, a mobile telephone, a radio receiver, a radio transmitter, a GPS receiver, a satellite telephone, an automobile on-board computer, an aircraft on-board computer, a navigation device, a home appliance, a printing device, a scanning device, a camera, an electronic camera, a television receiver, a broadcast control system, an ID electronic instrument, a medical monitoring device, a security device, an environmental control system, a electronic device, a network appliance, and combinations of these.

27. A method for operating an information appliance as in claim 24, wherein said at least one V 5 processing logic device comprises a plurality of processing logic devices.

28. A method for operating an information appliance as in claim 27, wherein at least one of said plurality of processing logic devices comprises at least one microprocessor and said at least one instruction comprises a plurality of computer program code segments from an operating system and a 00 10 plurality of computer program code segments from an application program; and wherein said switching system is coupleable to said microprocessor for receiving switch control commands for altering the switch V' configuration to selectably couple and decouple the microprocessor with the first and second storage.

29. An information processing device comprising: a housing having a form factor of a computer PC Card and a plurality of PCCardBus interface connections; a plurality of processors disposed within said housing; a plurality of data stores disposed within said housing or coupled thereto; a protected data store portion selected from said plurality of data stores for storing at least a user .0 data; a data store switch system coupled with said plurality of data stores, said switch system coupled with a data store switch configuration for configuring communication with one or more data store disposed within said housing; an I/O switch system coupled with at least one peripheral, said I/O system coupled with an I/O system configuration including a plurality of traits for configuring communication with said peripheral disposed within said housing; a plurality of computing environments, each said computing environment including at least one processor and identified by at least one trait selected from said plurality of traits, including: a data store switch communication path coupled with said data store switch, said data store switch communication path coupling at least one data store with said computing environment according to said data store switch configuration; an I/O switch communication path coupled with said I/O switch system, said I/O switch communication path for coupling said peripheral with said computing environment according to said I/O switch system configuration; said computing environment capable of performing a processing activity including receiving input from said I/O switch system and sending output to said I/O switch system, said processing activity performed independently of said processing activity of another computing environment; a control computing environment selected from said plurality of computing environments for configuring said data store switch configuration, for configuring said I/O switch system configuration, said data store switch configuration supporting communication between said control computing environment and said protected data store; and IND at least one user isolated computing environment selected from said plurality of computing O environments; r"l wherein said I/O switch system configuration is configured to direct a received input to at least dC one of said computing environment, said I/O switch system configuration is configured to direct an output V 5 generated by one or more of said plurality of computing environments to said peripheral. An information processing device as in claim 29, wherein: M the plurality of processors are independently selected from the set of processing logic circuits consisting of: a microprocessor, a central processing unit (CPU), a controller, a micro-controller, an ASIC, 00 10 a logic circuit, a programmable logic circuit, and combinations of these; and the plurality of data store are independently selectable and selected from the set of storage Sconsisting of: a rotating magnetic hard disk drive, a rotating magnetic floppy disk drive, a CD, a DVD, a Ssemiconductor memory, a solid state memory, a chemical memory, a magnetic memory, a molecular memory, a micro-drive, a flash memory, a compact flash card memory, a RAM memory, a ROM memory, and combinations thereof.

31. An information appliance as in claim 11, wherein the information appliance includes a personal data assistant. !0 32. An information appliance as in claim 11, wherein the information appliance includes a computer.

33. A method for operating an information appliance as in claim 24, wherein the information appliance includes a computer.

34. A computer of the type having first storage for programs and data, and processor logic and executing computer program instructions to perform a task involving a user data; the computer characterized in that: separate control processing environments and user processing environments are created and maintained so that: user data having unknown or untrusted content is not exposed in the control processor logic environment to computer program code that can execute any computer program code instructions imbedded in the user data; and user data having unknown or untrusted content is only exposed in the user processor logic environment in a temporary storage different from the first storage when isolated from the first storage. A computer system comprising: at least one processing logic device for executing at least one instruction; a first storage for storing first data and first program code including said at least one instruction and including a user data; a second storage for storing second data; a switching system for selectably and independently coupling and decoupling the processing logic device with the first storage and/or the second storage under automated control, the switching system receiving at least one control signal from the processing logic device for selecting a condition of the switching system; Ithe processing logic device operating in a control configuration and in a user data configuration C according to the following conditions: the processing logic device may be coupled with the first storage when the processing logic is loaded with a program instruction not capable of executing a data item that has untrusted content or that did not originate within a known controlled environment; (ii) the processing logic device may not be coupled or only restrictively coupled to communicate known information with the first storage when the processing logic is loaded with a program instruction that may be capable of executing a data item that has untrusted content or that did not originate within a known controlled environment; 00 10 (iii) the processing logic device may be coupled with the second storage when the processing logic is loaded with a program instruction that may be capable of executing a data item that has untrusted V' content or that did not originate within a known controlled environment; and (iv) the processing logic device may be coupled with the first storage and the second storage when the processing logic is loaded with a program instruction that is only capable of copying a data item from the first storage to the second storage or from the second storage to the first storage.

36. A computer system of the type having first storage and at least one processor, the computer system characterized in that: separate control processing environments and user processing environments are created and maintained within at least one or the storage and the processor so that: (1) Z0 identified data is not exposed in processor executable instructions imbedded in the data; and identified data is only exposed in the processor in a second storage different from the first storage when isolated from the first storage.

37. A processing system comprising: a plurality of isolated processing environments defined in at least one physical processor, each processing environment being reset to a known trusted state before accepting a process for execution, each processing environment maintaining a process in isolation of every other process executing in other of the processing environments; said processing environment executing the received process input and upon completion directing the process output to the external world; an input isolator for isolating a process input received from an external and potentially contaminated input source from one of said plurality of processing environments; an output isolator for isolating a process output result received from said first one of said plurality of processing environments from an external and potentially contaminated output destination; a protected storage storing a trusted state maintained in isolation from said processing environment during processing of said process input to said process output;

38. A processing system as in claim 37, further comprising a processing environment reset means for resetting each processing environment back to a known trusted state either before receiving an input process for processing.

39. A processing system as in claim 37, wherein the processing environment directing the process output to the requesting process or to another process configured to receive the results, through said output isolator. C) 5 40. A processing system as in claim 37, wherein the input isolator and the output isolator are the same physical isolator.

41. A processing system as in claim 37, wherein the input isolator and the output isolator are different physical isolators. oo

42. A processing system as in claim 37, wherein the input isolator and the output result isolator are V different physical isolators and the use of different physical input and output isolators permitting handling San input process in partial temporal overlap with an output process.

43. A processing system as in claim 37, wherein the processing environment flushes a process output result and not communicating it to the external world through the output isolator in the event that the processing environment detects a problem during processing.

44. A processing system as in claim 43, wherein the problem detected during processing comprises .0 any one of: execution of a virus or other malicious or damaging code, attempted execution of a virus or other malicious or damaging code, execution of code masquerading as data, and attempted execution of code masquerading as data. A processing system as in claim 37, further comprising a processing environment reset means for resetting each processing environment back to a known trusted state either before receiving an input process for processing.

46. A processing system as in claim 45, wherein the known trusted state is restored from a trusted template stored in the protected storage that has also been maintained in isolation from the processing environment during the processing task.

47. A processing system as in claim 46, wherein the trusted template is a source for reloading an operating system, and an application program.

48. A processing system as in claim 37, further including an embedded template for restoring a known trusted state.

49. A processing system as in claim 48, wherein isolation is provided by providing the trusted template in a read only memory. A processing system as in claim 37, wherein the isolation from input to the processor and from the processor to the output are provided by hardware circuits that merely perform bit or bit stream copy or ID transfer operations and have no capability to execute viral or other malicious code or to be modified to perform other operations.

51. A processing system comprising a multi-dimensional virtual processing space architecture, the V 5 processing system defining a plurality of virtual processing or computing environments, the system comprising: a plurality of processing resources including at least one physical processor; Ma trusted source of templates that stores or generates known clean and functional versions of operating system, program applications, driver software, system or program parameters and data, or 00 10 other software elements that are or may be required to handle a particular processing operation; a configuration, allocation, and control unit (CACU) adapted for configuring said physical Vprocessing resources, and for communicating with and controlling said trusted source of templates; and an isolated storage allocation controller logic responsible for connecting a process input to a particular isolated storage lock (ISL), the isolated storage allocation controller being operative to switch connections of a web or fabric of possible connections so that a particular process is exclusively routed to and connected with an available ISL, and the ISL may in turn be connected to a particular virtual processing environment where the connection is with a physical resource.

52. A processing system as in claim 51, wherein the plurality of processing resources are multiplexed 0 according to a multiplexing scheme so that said processing resources are available to the plurality of virtual processing or computing environments.

53. A processing system as in claim 51, wherein the multiplexing scheme is selected from the set of multiplexing schemes consisting of: address multiplexing, burst time division multiplexing, code-division multiplexing, differential multiplexing, isolated multiplexing, multi-user multiplexing, multi-user spatial multiplexing, orthogonal frequency division multiplexing, polarization division multiplexing, space-division multiplexing, spatial multiplexing, subcarrier multiplexing, statistical multiplexing, time division multiplexing, wavelength division multiplexing, secure virtualization, methods of creating separate or secure processing or computing environments, and/or any other technique, procedure, or method of multiplexing or division of information, data or computer processing, and combinations of these.

54. A method for operating each virtual processing environment within the virtual processing space comprising the steps of: identifying an external process and creating configuring or allocating a trusted virtual processing or computing environment to execute an identified external process; securely loading an external process inputs into trusted virtual processing environment from an initiating external process; executing the external process within the isolated virtual processing environment; securely unloading the external process results to an initiating external process; and de-allocating the trusted virtual processing environment and freeing any allocated virtual processing space resources. NO 55. A computing system comprising: a processor and a bus communicating a memory; one or more input bus ports for receiving one or more input streams from an input source; 0 one or more output bus ports for communicating one or more output streams to a receiver; at least one port or pin for communicating status and control; timing, address control, and switching (TACS) logic that includes input bus port for receiving an input or set of inputs and output bus port for communicating an output or set of outputs, the TACS logic Cc including an input stream seriallizer logic that receives the input process streams for a plurality of input processes identifies components within them that will be processed; and 00 10 means for maintaining separation of a plurality of processes including a controller for maintaining absolute separation of a plurality of processes. DATED this IS day of September, 2006 Self Repairing Computers, Inc. by DAVIES COLLISON CAVE Patent Attorneys for the Applicant