Secure control of insecure device

A secure computer, the secure computer being connected to an insecure computer over a first and second connection, wherein:

• the first connection connects to a dedicated video output with a hardware interface of the insecure computer;
• the second connection connects to an input of the insecure computer to receive instructions for controlling the insecure computer, and is associated with a unidirectional dataflow enforcer configured to enforce unidirectional dataflow between the secure computer and the insecure computer, such that dataflow from the secure computer over the second connection to the insecure computer is allowed, but dataflow from the insecure computer to the secure computer over the second connection is prevented;
• and
• the secure computer is configured to receive a screen image of the operating system interface of the insecure computer over the first connection and to transmit instructions for controlling the insecure computer over the second connection.

An insecure computer, the insecure computer being connected to a secure computer over a first and second connection, wherein:

• the insecure computer has a dedicated video output with a hardware interface, and transmits, by the video output, a screen image of its operating system interface to the secure computer over the first connection;
• the insecure computer has an input that is coupled to the second connection and that receives instructions from the secure computer for controlling the insecure computer;
• the second connection is associated with a unidirectional dataflow enforcer configured to enforce unidirectional dataflow between the secure computer and the insecure computer, such that dataflow from the secure computer over the second connection to the insecure computer is allowed, but dataflow from the insecure computer to the secure computer over the second connection is prevented;
• and
• the insecure computer is configured to receive the instructions from the secure computer and to carry out the instructions.

A method of securely controlling a computer comprising:

• transmitting a screen image of the operating system interface of an insecure computer having a dedicated video output with a hardware interface, by the video output, to a secure computer over a first connection;
• enforcing unidirectional dataflow between the secure computer and the insecure computer by allowing dataflow from the secure computer to the insecure computer over a second connection, and by preventing dataflow from the insecure computer to the secure computer over the second connection;
• and
• receiving, from the secure computer, at the insecure computer, over the second connection, instructions for controlling the insecure computer.

A method of operating an insecure computer using a secure computer, the insecure computer being connected to the secure computer over a first and second connection, the method comprising, at the insecure computer:

• transmitting a screen image of the operating system interface of the insecure computer to the secure computer over the first connection using a dedicated video output with a hardware interface;
• receiving, at an input that is coupled to the second connection, instructions from the secure computer for controlling the insecure computer, wherein the second connection is associated with a unidirectional dataflow enforcer configured to enforce unidirectional dataflow between the secure computer and the insecure computer, such that dataflow from the secure computer over the second connection to the insecure computer is allowed, but dataflow from the insecure computer to the secure computer over the second connection is prevented;
• and
• execute the instructions received from the secure computer.