Method and apparatus for protecting computers

Abstract

Computer protection is weak with the methods currently available and there are risks of malicious users getting access to computers, corrupting important data, including system data. We are proposing a method for improving access protection, more particularly, by using a slave device that will enable or disable protection for applications as required. The device supports one or more users, none or more user groups, none or one or more Application Security Environments for each user or user group and one or more states for each Application Security Environment. The state of the hardware is manually controlled by the users. Depending on the configuration, each hardware state corresponding to an Application Security Environment corresponds to a set of privileges the processes running in that Application Security Environment have while that Application Security Environment is in that state.

What is claimed is: 
     
         1 . A first apparatus implemented in hardware coupled to a first computer, wherein said first apparatus is used for implementing access control in said first computer, said first apparatus comprising:
 a) a first communication channel implemented in hardware to communicate to a second apparatus, wherein said first communication channel bypasses said first computer, wherein said second apparatus is not coupled to said first computer, wherein said second apparatus is not coupled to said first apparatus;   b) a second communication channel implemented in hardware to enable communication to a device driver of said first apparatus running in said first computer;   c) enablement to receive commands from said second apparatus on said first communication channel, wherein said commands comprise access restrictions for a first container running on said first computer;   d) enablement to process said commands received; and   e) storage for said access restrictions, wherein said second communication channel prevents software in said first computer from modifying said access restrictions, wherein said access restrictions for said first container are applied to said first container.   
     
     
         2 . The first apparatus of  claim 1 , wherein said second communication channel comprising registers readable by said first computer. 
     
     
         3 . The first apparatus of  claim 1 , wherein said second communication channel comprising memory readable by said first computer. 
     
     
         4 . The first apparatus of  claim 2 , wherein said first apparatus being used to implement access restrictions for a plurality of containers running on said first computer, wherein said plurality of containers includes said first container. 
     
     
         5 . The second apparatus of  claim 2 , wherein said second apparatus is used to synchronize access restrictions for containers running on a plurality of computers, wherein said plurality of computers includes said first computer, wherein said containers include said first container. 
     
     
         6 . The first apparatus of  claim 2 , wherein said commands further comprising access restrictions for users of said first computer. 
     
     
         7 . The first apparatus of  claim 6 , wherein said commands further comprising access restrictions for user groups of said first computer. 
     
     
         8 . The second apparatus of  claim 2 , wherein said second apparatus is used to synchronize access restrictions for users on a plurality of computers, wherein said plurality of computers includes said first computer. 
     
     
         9 . A first apparatus implemented in hardware coupled to a first computer, wherein said first apparatus is used for implementing access control in said first computer, said first apparatus comprising:
 a) a first communication channel implemented in hardware to communicate to a second apparatus, wherein said first communication channel bypasses said first computer, wherein said second apparatus is not coupled to said first computer, wherein said second apparatus is not coupled to said first apparatus;   b) a second communication channel implemented in hardware to enable communication to a device driver of said first apparatus enabled to run in said first computer;   c) enablement to receive commands from said second apparatus on said first communication channel, wherein said commands comprise access restrictions for a first user of said first computer;   d) enablement to process said commands received; and   e) storage for said access restrictions, wherein said second communication channel prevents software in said first computer from modifying said access restrictions, wherein said access restrictions are applied to said first user of said first computer.   
     
     
         10 . The first apparatus of  claim 9 , wherein said second communication channel comprising registers readable by said first computer. 
     
     
         11 . The first apparatus of  claim 10 , wherein said second communication channel comprising memory readable by said first computer. 
     
     
         12 . The first apparatus of  claim 10 , wherein said first apparatus being used to implement access restrictions for a plurality of users of said first computer, wherein said plurality of users includes said first user. 
     
     
         13 . The second apparatus of  claim 10 , wherein said second apparatus is used to synchronize access restrictions for a plurality of users in a plurality of computers, wherein said plurality of computers includes said first computer, wherein said plurality of users includes said first user. 
     
     
         14 . The first apparatus of claim  61 , wherein said commands further comprising state of a container in said first computer, wherein said state is applied to said container. 
     
     
         15 . A system for implementing synchronised state changes of containers in a plurality of first computers, said system comprising at least one second apparatus and a plurality of third apparatuses, said system comprising:
 a) coupling and a first communication channel implemented in hardware from each computer in said plurality of first computers to one apparatus in said plurality of third apparatuses, wherein each apparatus in said plurality of third apparatuses is coupled to at most one computer in said plurality of first computers, wherein said first communication channel prevents software in said plurality of first computers from modifying state of each of said containers stored in said plurality of third apparatuses, wherein said plurality of first computers implements said state of each of said containers;   b) a second communication channel implemented in hardware in each apparatus in said plurality of third apparatuses for communication to said at least one second apparatus, wherein said second communication channel in each apparatus in said plurality of third apparatuses bypasses every computer in said plurality of first computers, wherein said at least one second apparatus is not coupled to any computer in said plurality of first computers, wherein said at least one second apparatus is not coupled to any apparatus in said plurality of third apparatuses;   c) enablement in each apparatus in said plurality of third apparatuses to receive commands on said second communication channel in each apparatus in said plurality of third apparatuses from said at least one second apparatus, wherein said commands comprising said states of containers;   d) enablement in each apparatus in said plurality of third apparatuses to process said commands; and   e) enablement in each apparatus in said plurality of third apparatuses to synchronise said states of said containers.   
     
     
         16 . The system of  claim 15 , wherein said commands further comprising access restrictions for said containers. 
     
     
         17 . The system of  claim 16 , wherein said access restrictions for said containers are synchronized. 
     
     
         18 . The system of  claim 15 , wherein said commands further comprising access restrictions for users of each computer in said plurality of first computers. 
     
     
         19 . The system of  claim 16 , wherein said access restrictions for said users of each computer in said plurality of first computers are synchronized.