System and method for controlling the use of a computer

Claim 2

A computer-based method for controlling modification of an operating system and an approved application set of zero or more approved applications on a computer comprising a protected media, the protected media comprising a non-volatile storage device, the operating system and the approved application set being stored in the protected media, the method comprising the steps of: (1) loading the operating system from the protected media into a volatile memory of the computer and executing the operation system, the operating system having a trusted path mode and a general purpose mode; (2) establishing a reliable communication path between an administrator and the operating system by entering the trusted path mode of the operating system; (3) while said operating system is in said trusted path mode, carrying out a request by an administrator to modify the approved application set which resides on said protected media, wherein said operating system exits said trusted path mode and enters said general purpose mode upon detecting a request to do so by the administrator; (4) while said operating system is in said general purpose mode, (a) denying any request by an application program or an ordinary user to modify the approved application set which resides on said protected media; and (b) denying any request by said application program or said ordinary user to modify the operating system which resides on said protected media.

Claim 3

The method of claim 1, wherein step (2) comprises a step of carrying out a request to enter said trusted path mode, wherein said request is made by said administrator during system initialization.

Claim 4

The method of claim 1, further comprising a step of carrying out a request to enter said trusted path mode, wherein said request is made by said administrator in said general purpose mode of step (3).

Claim 5

The method of claim 1, further comprising a step of entering a single user mode of the operating system so as to enter said trusted path mode.

Claim 6

The method of claim 1, further comprising a step of carrying out a request to modify the operating system, wherein said request is made by said administrator in said trusted path mode.

Claim 7

The method of claim 1 in which said protected media also stores an approved data set of zero or more approved data, further comprising the steps of: carrying out a request to modify said approved data set which is stored in said protected media when said request is made by said administrator while the operating system is in said trusted path mode; and denying any request to modify said approved data set which is stored in said protected media when said request is made while the operating system is in said general purpose mode.

Claim 8

The method of claim 1, further comprising a step of carrying out a request by said application program or said ordinary user to modify user data.

Claim 9

The method of claim 1, further comprising a step of capturing and denying any request to modify a swap/page portion of said protected media, wherein said swap/page portion is used by the operating system for its internal purposes, and wherein said request is made by said ordinary user or said application program.

Claim 10

The method of claim 1, wherein step (1) comprises a step of mounting a file system corresponding to a portion of said protected media which stores an approved data set of zero or more data, wherein said file system is mounted so that its contents cannot be modified by said application programs or said ordinary users.

Claim 11

The method of claim 1, wherein step (1) comprises a step of mounting a user file system so that it can be read from and written to by said ordinary user, wherein said file system stores user data.

Claim 12

A computer-based system which controls modification of an operating system and an approved application set of zero or more approved applications on a computer, the computer-based system comprising: (a) the operating system; (b) the approved application set; (c) trusted path mechanism means for reliably establishing a trusted path between an administrator and the operating system; (d) a protected media comprising a non-volatile storage device, the protected media also comprising, (i) an operating system portion stored in said non-volatile storage device, wherein said operating system portion can be modified only by said administrator once said trusted path mechanism means has established said trusted path, said operating system portion comprising said operating system, (ii) an application/data portion stored in said non-volatile storage device, wherein said application/data portion can be modified only by said administrator once said trusted path mechanism means has established said trusted path, said application/data portion comprising said approved application set, and (iii) an internal operating system portion, stored in said non-volatile storage device; (e) initialization means for loading the operating system into a volatile memory of the computer from said protected media, and for executing the operating system; and (f) means for enabling the administrator to modify data stored in said protected media once said trusted path mechanism means has established said trusted path.

Claim 13

A computer-based system which controls modification of an operating system and an approved application set of zero or more approved applications on a computer, the computer-based system comprising: (a) the operating system; (b) the approved application set; (c) trusted path mechanism means for reliably establishing a trusted path between an administrator and the operating system; (d) a protected media comprising a non-volatile storage device, the protected media also comprising, (i) an operating system portion stored in said non-volatile storage device, wherein said operating system portion can be modified only by said administrator once said trusted path mechanism means has established said trusted path, said operating system portion comprising said operating system, (ii) an application/data portion stored in said non-volatile storage device, wherein said application/data portion can be modified only by said administrator once said trusted path mechanism means has established said trusted path, said application/data portion comprising said approved application set, and (iii) an internal operating system portion, stored in said non-volatile storage device; (e) initialization means for loading the operating system into a volatile memory of the computer from said protected media, and for executing the operating system; and (f) means for enabling the administrator to modify data stored in said protected media once said trusted path mechanism means has established said trusted path.

Claim 14

The computer-based system of claim 11, wherein said application/data portion also stores an approved data set of zero or more approved data.

Claim 15

The computer-based system of claim 11, wherein said protected media is represented by a file system which is mounted so that it cannot be modified by said application program or said ordinary user.

Claim 16

The computer-based system of claim 11, wherein said protected media further comprises a swap/page portion which cannot be modified by said application program or said ordinary user and which is used by the operating system for its internal purposes.

Claim 17

The computer-based system of claim 11, further comprising a user media which stores user data and which can be modified by said application program and said ordinary user.

Claim 18

The computer-based system of claim 15, wherein said user media comprises a file system which is mounted so that it can be modified by said application program and said ordinary user.

Claim 19

The computer-based system of claim 11, wherein said trusted path mechanism means comprises means for bringing the operating system into a single user mode.

Claim 20

The computer-based system of claim 11, wherein said trusted path mechanism means comprises means for restricting requests from said administrator to input from a particular input terminal electrically coupled to the computer.

Claim 21

The computer-based system of claim 11, wherein the operating system further comprises a trusted path program which can be invoked by said administrator in a trusted path mode of said operating system in order to modify the operating system.

Claim 22

A computer-based system which reliably audits the usage of a computer, comprising: (a) an operating system; (b) an audit log; (c) trusted path mechanism means for reliably establishing a trusted path between an administrator and said operating system; (d) a protected media comprising a non-volatile storage device, and also comprising, (i) an operating system portion which is stored in said non-volatile storage device, and which can be modified only by said administrator once said trusted path mechanism means has established said trusted path, said operating system portion comprising said operating system, (ii) an audit portion which is stored in said non-volatile storage device, and which can be modified only by said administrator once said trusted path mechanism means has established said trusted path, said audit portion comprising said audit log, and (iii) an internal operating system portion, stored in said non-volatile storage device; (e) initialization means for loading said operating system into a volatile memory of the computer from said protected media, and for executing said operating system; (f) means for collecting audit data; and (g) means for writing said audit data to said audit log.

Claim 23

A computer-based system which reliably audits the usage of a computer, comprising: (a) an operating system; (b) an audit log; (c) trusted path mechanism means for reliably establishing a trusted path between an administrator and said operating system; (d) a protected media comprising a non-volatile storage device, and also comprising, (i) an operating system portion which is stored in said non-volatile storage device, and which can be modified only by said administrator once said trusted path mechanism means has established said trusted path, said operating system portion comprising said operating system, (ii) an audit portion which is stored in said non-volatile storage device, and which can be modified only by said administrator once said trusted path mechanism means has established said trusted path, said audit portion comprising said audit log, and (iii) an internal operating system portion, stored in said non-volatile storage device; (e) initialization means for loading said operating system into a volatile memory of the computer from said protected media, and for executing said operating system; (f) means for collecting audit data; and (g) means for writing said audit data to said audit log.

Claim 24

The computer-based system of claim 20, further comprising a user media which stores user data and which can be modified by said application program and said ordinary user.

Claim 25

The computer-based system of claim 20, wherein said protected media further comprises an application/data portion which can be modified by said administrator but cannot be modified by said application program or said ordinary user and which stores an approved application set of zero or more approved applications.

Claim 26

The computer-based system of claim 20, wherein said operating system further comprises a trusted path program which can be invoked by said administrator in a trusted path mode of said operating system in order to modify said operating system.

Claim 27

The computer-based system of claim 20, wherein said operating system further comprises a trusted path program which can be invoked by said administrator in a trusted path mode of said operating system in order to modify audit configuration data, wherein said audit configuration data indicates what audit data is collected, and wherein said audit configuration data is stored in said audit portion.

Claim 28

The computer-based system of claim 20, wherein said means for collecting said audit data comprises means for collecting user activity data.

Claim 29

The computer-based system of claim 20, wherein said means for collecting said audit data comprises means for collecting system status data.

Claim 30

The computer-based system of claim 20, further comprising means for halting the computer if there is no room on said protected media to write said audit data.

Claim 31

The computer-based system of claim 20, further comprising means for deleting existing audit data from said audit log if there is no room on said protected media to write said audit data.

Claim 32

A computer-based method for restricting which programs can be executed on a computer, the computer-based method comprising the steps of: (1) loading an operating system from a protected media into a memory of the computer and executing said operating system, said operating system having a trusted path mode and a general purpose mode; (2) in said trusted path mode, carrying out a request by an administrator to modify an approved application set which resides on said protected media; (2a) exiting said trusted path mode and entering said general purpose mode upon detecting a request to do so by an administrator; (3) in said general purpose mode, (a) denying any request by an application program or an ordinary user to modify said operating system; (b) denying any request by said application program or said ordinary user to modify said approved application set; and (c) denying any request by said application program or said ordinary user to execute any application program which is not in said approved application set; and (4) repeating steps (2) and (3) as required.

Claim 33

A computer-based method for restricting which programs can be executed on a computer, the computer-based method comprising the steps of: (1) loading an operating system from a protected media into a memory of the computer and executing said operating system, said operating system having a trusted path mode and a general purpose mode; (2) in said trusted path mode, carrying out a request by an administrator to modify an approved application set which resides on said protected media; (2a) exiting said trusted path mode and entering said general purpose mode upon detecting a request to do so by an administrator; (3) in said general purpose mode, (a) denying any request by an application program or an ordinary user to modify said operating system; (b) denying any request by said application program or said ordinary user to modify said approved application set; and (c) denying any request by said application program or said ordinary user to execute any application program which is not in said approved application set; and (4) repeating steps (2) and (3) as required.

Claim 34

The method of claim 29, further comprising a step of carrying out a request to enter said trusted path mode of step (2), wherein said request is made by said administrator in said general purpose mode of step (3).

Claim 35

The method of claim 29, further comprising a step of carrying out a request to modify said operating system, wherein said request is made by said administrator in said trusted path mode of step (2).

Claim 36

The method of claim 29, further comprising a step of carrying out a request by said application program or said ordinary user to modify user data.

Claim 37

The method of claim 29, further comprising the steps of: (5) carrying out a request to modify an approved data set of zero or more approved data, wherein said request is made by said administrator in said trusted path mode of step (2); and (6) capturing and denying any request to modify said approved data set, wherein said request is made by said application program or said ordinary user.