RU137626U1 - COMPUTER WITH HARDWARE DATA PROTECTION AGAINST UNAUTHORIZED CHANGE - Google Patents

Abstract

1. A computer with hardware protection of data from unauthorized changes, containing at least one additional switching element of the electric circuit, controlling access in the recording mode to the critical data-saving reprogrammable memory device (EPROM), in particular Disk-On-Module (DOM), characterized in that the said element (s) are assembled into an electronic switch circuit that generates a control signal on the "write permission" EPROM / DOM bus according to data coming from outside. 2. The computer according to claim 1, characterized in that the electronic switch circuit further comprises a cryptographic subsystem that controls data from the outside. The computer according to claim 1 or 2, characterized in that the electronic switch circuit further comprises a cryptographic subsystem that verifies the received data according to at least one of the following criteria: source authenticity, relevance, integrity, and / or other characteristics of their validity .four. The computer according to claim 1 or 2, characterized in that the electronic switch circuit further comprises a cryptographic subsystem that controls data from the outside using a standardized cryptographic procedure for verifying electronic signatures.

Description

The utility model relates to the field of computer technology and information technology.

In recent years, in connection with the active entry into the market of new generations of computers, including mobile (laptops, subnotebooks, tablet computers, etc.), the problem of reliable hardware protection of the information contained in them has become urgent. However, reliable hardware protection methods, well developed and widely used for ordinary personal computers - in particular, the installation of hardware trusted boot modules (AMDDZ) [1] - are not suitable for a number of new generation computer models for many reasons. For use in this area, simpler, but at the same time quite effective solutions are known, which are based on the use of physical (in particular, mechanical) and not software switching - for example, prohibition / permission to write to reprogrammable memory devices (EPROMs) that store critical data. Of particular interest in this regard are solutions designed for computers called “thin client”, which, formally, not being mobile (they are used, as a rule, in stationary terminal access systems), in a constructive relation to mobile are very close (also compact, diskless, etc.) [2].

Closest to the utility model is a thin client computer with hardware data protection, containing at least one additional switching circuit element that controls write access to critical data-saving flash-programmable memory device (ROM), in particular Disk-On -Module (DOM) [3].

In this computer, the first (and only) additional switching element of the electric circuit is a mechanical switch / disconnector (a miniature switch or a jumper) located under the computer case, included in the DOM “write permission” bus circuit, thereby blocking recording data on it. Thanks to this, an authorized system administrator gets the opportunity, setting up the system and writing the verified data to the DOM, to reliably protect them from unauthorized changes in the future.

The known solution, therefore, requires opening / closing of the computer case for its application, which is acceptable for corporate systems such as terminal access networks formed by thin clients, but for most other applications and other classes of computers, it is obviously inconvenient, insufficiently operative, or undesirable for other technical or organizational reasons.

The objective of the utility model is to expand the functionality of external computer control with hardware data protection from unauthorized changes.

This problem is solved in that in a computer with hardware data protection against unauthorized changes, containing at least one additional switching element of the electric circuit that controls access in recording mode to critical data-saving reprogrammable memory device (EPROM), in particular, Disk-On- Module (DOM), the mentioned element (s) are assembled in an electronic switch circuit that generates a control signal on the "write enable" EPROM / DOM bus according to data coming from outside.

This solution, without going beyond the concept of using physical switching instead of software in protection circuits for recording critical data, can be quickly applied the required number of times (including by the user himself) without opening the computer case, thereby expanding the functionality of external computer control.

It is advisable that the circuit of the electronic switch would additionally contain a cryptographic subsystem that controls data coming from outside. This can provide the necessary level of information security for the most critical (in particular, banking) applications.

For individual implementations of the utility model, the electronic switch circuit may contain a cryptographic subsystem that checks the received data for at least one of the following criteria: source authenticity, relevance, integrity, and / or other characteristics of their validity. Thereby, the risks of false and / or unauthorized shutdown of the critical data protection system can be minimized.

In particular, it is advisable that the electronic switch circuitry, additionally containing a cryptographic subsystem, be such that this control can be carried out using a standardized cryptographic procedure for verifying electronic signatures. Such a technical solution, for most critical applications and modern requirements for information protection methods, is the most effective.

INFORMATION SOURCES

1. Konyavsky V.A. Information security management on the basis of SZI NSD "Accord". - M .: Radio and communications, 1999.

2. Wikipedia - the free encyclopedia (http://ru.wikipedia.org).

3. Russian patent for utility model RU 118773.

Claims (4)

1. A computer with hardware protection of data from unauthorized changes, containing at least one additional switching element of the electric circuit, controlling access in the recording mode to the critical data-saving reprogrammable memory device (EPROM), in particular Disk-On-Module (DOM), characterized in that the said element (s) are assembled into an electronic switch circuit generating a control signal on the "write permission" EPROM / DOM bus according to data received from the outside. 2. The computer according to claim 1, characterized in that the electronic switch circuit further comprises a cryptographic subsystem that controls data from outside. 3. The computer according to claim 1 or 2, characterized in that the electronic switch circuit further comprises a cryptographic subsystem that verifies the received data according to at least one of the following criteria: source authenticity, relevance, integrity, and / or other characteristics the validity of those. 4. The computer according to claim 1 or 2, characterized in that the electronic switch circuit further comprises a cryptographic subsystem that controls data from the outside using a standardized cryptographic procedure for verifying electronic signatures.