Interception of touch pad events for handling in a secure environment

Patent metadata

Field	Value
Publication number	US-10037518-B2
Application number	US-201715444931-A
Country	US
Kind code	B2
Filing date	Feb 28, 2017
Priority date	Dec 9, 2015
Publication date	Jul 31, 2018
Grant date	Jul 31, 2018

Abstract

Some examples include sending, to a secure environment, coordinates for certain touch events made to a touchscreen of an electronic device. As one example, an import address table that is accessed by an event loop of the electronic device may be modified. For instance, only those touch events that are performed within the bounds of a user interface area may be diverted to the secure environment, and all touch events outside that area may continue to be identified, such as by using operating system libraries of the electronic device. In some cases, a checksum may be generated for the import address table using a cryptographic hash function. The checksum may allow a payment application and/or a payment processing system to determine whether an unauthorized modification of the import address table is present.

First claim

What is claimed is:

1. A method comprising:
receiving, by an application executing on a processor of a point-of-sale (POS) device, an indication of a touch event on a touchscreen of the POS device;
based at least partially on determining that the touch event occurred at a portion of the touchscreen on which a user interface of the application is displayed, sending coordinates associated with the touch event to a secure user interface (UI) element of the application executing on the POS device to isolate the coordinates from a user input handler of an operating system of the POS device;
receiving, by the secure UI element of the application, the coordinates associated with the touch event; and
identifying, by the secure UI element of the application, an intended input represented by the touch event based on the coordinates.

2. The method as recited in claim 1 , wherein sending the coordinates associated with the touch event to the secure UI element isolates the coordinates from a library associated with the operating system and prevents unauthorized interception of data indicative of the touch event.

3. The method as recited in claim 1 , wherein coordinates corresponding to a touch event that occurs outside the portion of the touchscreen on which the user interface is displayed are provided to the user input handler of the operating system.

4. The method as recited in claim 3 , wherein the touch event that occurs outside the portion of the touchscreen on which the user interface is displayed results in a function call being made to the user input handler of the operating system of the POS device to provide the coordinates corresponding to the touch event occurring outside the portion of touchscreen on which the user interface is displayed to the user input handler of the operating system.

5. The method as recited in claim 1 , wherein sending the coordinates associated with the touch event to the secure UI element of the application is accomplished at least partially by modifying an import address table accessed by a display driver of the POS device.

6. The method as recited in claim 1 , wherein sending the coordinates associated with the touch event to the secure UI element of the application is accomplished at least partially by placing a function call to the application.

7. The method as recited in claim 6 , wherein the function call is directed to the secure UI element of the application rather than to the user input handler of the operating system of the POS device by executing a modified function referenced in an import address table that is accessed by an event loop.

8. The method as recited in claim 1 , wherein sending the coordinates associated with the touch event to the secure UI element of the application is accomplished at least partially by placing the touch event into an event queue of the application.

9. The method as recited in claim 1 , wherein the touch event conveys at least part of a passcode for executing a payment transaction between a consumer and a merchant on the POS device, the method further comprising communicating, by the application, with a remote payment processing system associated with a payment processing entity for processing the payment transaction.

10. A computing device comprising:
a touchscreen;
a processor; and
a computer-readable medium storing instructions for an application that, when executed by the processor, cause the processor to perform operations including:
receiving, by the application, an indication of a touch event on the touchscreen;
based at least partially on determining that the touch event occurred within a first portion of the touchscreen, sending coordinates associated with the touch event to a secure user interface (UI) element of the application executing on the computing device to isolate the coordinates from a library associated with an operating system of the computing device;
receiving, by the secure UI element of the application, the coordinates associated with the touch event; and
identifying, by the secure UI element of the application, an intended input represented by the touch event based on the coordinates.

11. The computing device as recited in claim 10 , wherein:
the first portion of the touch screen corresponds to a user interface displayed on the touchscreen for receiving entry of a passcode; and
coordinates corresponding to a touch event that occurs outside the first portion of the touchscreen are provided to a user input handler of the operating system.

12. The computing device as recited in claim 10 , wherein the operation of sending the coordinates associated with the touch event to the secure UI element isolates the coordinates from the library associated with the operating system and prevents unauthorized interception of data indicative of the touch event.

13. The computing device as recited in claim 10 , wherein sending the coordinates associated with the touch event to the secure UI element of the application is accomplished at least partially by at least one of:
modifying an import address table accessed by a display driver of the POS computing device;
placing a function call to the application, wherein the function call is directed to the secure UI element of the application rather than to a user input handler of the operating system; or
placing the touch event into an event queue of the application.

14. The computing device as recited in claim 10 , wherein the operations further comprise:
generating a checksum of an import address table maintained by the operating system of the computing device; and
identifying and remapping a function address reference within the import address table that has been randomly arranged by address space layout randomization.

15. A method comprising:
receiving, by a processor of a computing device, an indication of a touch event on a touchscreen of the computing device;
based at least partially on determining that the touch event occurred at a first portion of the touchscreen, sending coordinates associated with the touch event to a secure user interface (UI) element of an application executing on the computing device to isolate the coordinates from a user input handler of an operating system of the computing device;
receiving, by the secure UI element of the application, the coordinates associated with the touch event; and
identifying, by the secure UI element of the application, an intended input represented by the touch event based on the coordinates.

16. The method as recited in claim 15 , wherein the first portion of the touchscreen corresponds to a portion of the touchscreen on which a user interface of the application is displayed for receiving entry of a passcode.

17. The method as recited in claim 15 , wherein coordinates corresponding to a touch event that occurs outside the first portion of the touchscreen are provided to the user input handler of the operating system.

18. The method as recited in claim 15 , wherein sending the coordinates associated with the touch event to the secure UI element of the application is accomplished at least partially by at least one of:
modifying an import address table accessed by a display driver of the computing device;
placing a function call to the application, wherein the function call is directed to the secure UI element of the application rather than to the user input handler of the operating system; or
placing the touch event into an event queue of the application.

19. The method as recited in claim 15 , wherein the touch event conveys at least p

Assignees

• Square Inc

Inventors

• Dai Zovi Dino
• Monti Eric

Classifications

• G06Q20/20 Primary

  Point-of-sale [POS] network systems · CPC title

• G06Q20/405

  Establishing or using transaction specific rules · CPC title

• G06Q20/401

  Transaction verification · CPC title

• G07F7/1025

  Identification of user by a PIN code · CPC title

• G06Q20/382

  insuring higher security of transaction · CPC title