# US 11,030,301 B2 · Hacking-resistant computer design

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,030,301 B2
- Document ID: US11030301B2
- Status: Granted
- Kind: B2
- Application number: 16/413,446
- Filed: 2019-05-15
- Published: 2020-04-30
- Granted: 2021-06-08
- Earliest claimed: 2015-08-31
- Applicants: PathGuard, LLC
- Inventors: Frank N. Newman; Dan Newman
- Web page: https://patentgrep.com/patent/US11030301B2

## CPC

- G06F 21/50: Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F 3/0619: {in relation to data integrity, e.g. data losses, bit errors}
- G06F 3/0644: {Management of space entities, e.g. partitions, extents, pools}
- G06F 3/0659: {Command handling arrangements, e.g. command buffers, queues, command scheduling}
- G06F 12/1433: {for a module or a part of a module}
- G06F 12/1441: {for a range}
- G06F 21/53: by executing in a restricted environment, e.g. sandbox or secure virtual machine
- G06F 21/71: to assure secure computing or processing of information
- G06F 21/79: in semiconductor storage media, e.g. directly-addressable memories
- H04L 63/10: {for controlling access to devices or network resources}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- G06F 2212/1052: Security improvement
- G06F 2221/031: Protect user input by software means
- G06F 2221/032: Protect output to user by software means
- G06F 2221/034: Test or assess a computer or a system
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A computer architecture is disclosed for implementing a hacking-resistant computing device. The computing device, which could be a mainframe computer, personal computer, smartphone, or any other computing device suitable for network communication, comprises a first partition and a second partition. The second partition can communicate over a public network such as the Internet, or over a private connection. In contrast, the first partition cannot connect to the Internet, and can directly communicate only with the second partition or with input/output devices directly connected to the first partition. Further, the first partition segments its memory addressing for program code and can be configured to hardware-protect that code from alteration. The second partition is hardware-limited from reading from or writing to the memory addressing of the first partition. As a result, the critical data files and program code stored on the first partition are protected from malicious code affecting the second partition.

## Claims

### Claim 1

A computer system comprising:
a first partition and a second partition;
the first partition comprising:
a first CPU; and
a first memory module comprising:
at least one memory address range for program code, wherein the program code comprises computer-executable code;
at least one memory address range for other data; and
wherein the system is configured for the first CPU to execute only the computer executable code in the at least one memory address range for program code;
the second partition comprising:
a second CPU;
a second memory module; and
at least one communication module configured to couple to a network;
wherein the system is configured for the first partition to read data from the second partition into only the at least one memory address range for other data;
wherein the first partition is configured to send data to the second partition; and
wherein the second CPU is restricted from directly accessing the first memory module.

### Claim 2 (depends on 1)

The computer system of claim 1, wherein the hardware circuitry comprises at least one field-programmable gate array.

### Claim 3 (depends on 1)

The computer system of claim 1, further comprising a hardware switch comprising at least one external physical switch comprising an on position and an off position, wherein data in the at least one memory address range for program code cannot be modified unless the at least one external physical switch is in the on position.

### Claim 4 (depends on 1)

The computer system of claim 1, wherein the first memory module comprises:
a first memory unit comprising the at least one memory address range for program code; and
a second memory unit comprising the at least one memory address range for other data.

### Claim 5 (depends on 1)

The computer system of claim 1, further comprising a chip comprising the first partition and the second partition.

### Claim 6 (depends on 1)

The computer system of claim 1, further comprising:
a first chip comprising the first partition; and
a second chip comprising the second partition.

### Claim 7 (depends on 1)

The computer system of claim 1, further comprising:
a bus;
wherein the first partition is interconnected to the second partition through the bus;
wherein the first partition is configured to execute a pull command through the bus to obtain data from the second partition and write the data to the at least one memory address range for other data; and
wherein the first partition is configured to execute a push command through the bus to send data to the second partition.