Screenshot based TUI process for in-app purchase authentication

Patent metadata

Field	Value
Publication number	US-11204693-B2
Application number	US-201816124991-A
Country	US
Kind code	B2
Filing date	Sep 7, 2018
Priority date	Sep 7, 2018
Publication date	Dec 21, 2021
Grant date	Dec 21, 2021

Abstract

A method for generating a secure single-tap authentication user interface includes obtaining a screenshot of content from an application operating in an execution environment outside of a trusted execution environment, generating graphical elements of a single-tap authentication user interface, and generating a progress switching layer. Additionally, the method includes responsive to an authentication request, generating a composited display, the composited display comprising the screenshot of content from the application, the graphical elements of the single-tap authentication user interface, and the progress switching layer, passing the composited display from outside the trusted execution environment to the trusted execution environment and displaying, by the trusted execution environment, the composited display as part of a trusted user interface (TUI).

First claim

What is claimed is:

1. A method for generating a secure single-tap authentication user interface, comprising:
capturing a screenshot of a rendered display comprising content from an application operating in an execution environment outside of a trusted execution environment (TEE);
storing the screenshot in a memory outside of the TEE;
generating graphical elements of a single-tap authentication user interface;
generating a progress switching layer;
responsive to an authentication request, generating and displaying an intermediate display including a first composited display comprising the progress switching layer displayed above the stored screenshot of the content from the application and the graphical elements of the single-tap authentication user interface;
generating a second composited display, the second composited display comprising the progress switching layer displayed between the stored screenshot comprising content from the application and the graphical elements of the single-tap authentication user interface, wherein the first and second composited displays are single layered images having an appearance of a multi-layered image;
passing the second composited display from outside the trusted execution environment to the trusted execution environment;
generating, in the TEE, a trusted user interface (TUI), wherein the TUI includes the second composited display passed from outside the TEE into the TEE, and wherein the TUI defines an actionable region for receiving a user input; and
displaying, by the TEE, the second composited display, wherein passing the second composited display to the TEE further comprises:
comparing the second composited display to a threshold file size;
when the second composited display exceeds the threshold file size, splitting the composited display by separating the second composited display into a screenshot portion and a single-tap authentication portion;
passing the screenshot portion and the single-tap authentication portion separately into the TEE; and
reassembling the single-tap authentication portion and the screenshot portion as a single image within the TEE.

2. The method of claim 1 , wherein the splitting the second composited display occurs in a portion of a screen which does not include the graphical elements of the single-tap authentication user interface.

3. The method of claim 1 , further comprising:
obtaining, from outside the TEE, coordinate information for the actionable region of the second composited display; and
passing the coordinate information for the actionable region of the second composited display to the TEE.

4. The method of claim 3 , further comprising:
receiving, in the TEE, a coordinate value of an interaction with the actionable region of the second composited display;
passing information associated with the coordinate value of the interaction with the actionable region of the second composited display to outside of the TEE; and
responsive to passing the information associated with the coordinate value of the interaction with the actionable region of the second composited display, triggering an event outside of the TEE associated with the actionable region of the second composited display.

5. The method of claim 1 ,
wherein the progress switching layer appears as an intermediate layer below a layer comprising the graphical elements of the single-tap authentication user interface, and
wherein the progress switching layer appears above the layer comprising the screenshot of the content from the application.

6. The method of claim 1 , wherein the second composited display is based on the intermediate display and differs from the intermediate display in that the graphical elements of the single-tap authentication user interface appear above the progress switching layer.

7. An apparatus comprising:
a touchscreen;
a processor comprising a trusted execution environment (TEE); and
a memory containing instructions that, when executed by the processor, cause the apparatus to:
capture a screenshot of a rendered display comprising content from an application operating in an execution environment outside of the TEE,
store the screenshot in a memory outside of the TEE,
generate graphical elements of a single-tap authentication user interface,
generate a progress switching layer,
responsive to an authentication request,
generate and display an intermediate display including a first composited display comprising the progress switching layer displayed above the stored screenshot of the content from the application and the graphical elements of the single-tap authentication user interface,
generate a second composited display, the second composited display comprising the progress switching layer displayed between the stored screenshot comprising content from the application and the graphical elements of the single-tap authentication user interface, and wherein the first and second composited displays are single layered images having an appearance of a multi-layered image,
pass the second composited display from outside the TEE to the TEE,
generate, in the TEE, a trusted user interface (TUI), wherein the TUI includes the second composited display passed from outside the TEE into the TEE, and wherein the TUI defines an actionable region for receiving a user input, and
display, by the TEE, the second composited display on the touchscreen,
wherein the instructions that, when executed by the processor, cause the apparatus to pass the second composited display from outside the TEE to the TEE by:
comparing the second composited display to a threshold file size,
when the second composited display exceeds the threshold file size, splitting the composited display by separating the second composited display into a screenshot portion and a single-tap authentication portion,
pass the screenshot portion and the single-tap authentication portion separately into the TEE, and
reassemble the single-tap authentication portion and the screenshot portion as a single image within the TEE.

8. The apparatus of claim 7 , wherein the second composited display is split in a portion of the touchscreen which does not include the graphical elements of the single-tap authentication user interface.

9. The apparatus of claim 7 , wherein the memory contains instructions that, when executed by the processor, cause the apparatus to:
obtain, from outside the TEE, coordinate information for the actionable region of the second composited display, and
pass the coordinate information for the actionable region of the second composited display to the TEE.

10. The apparatus of claim 9 , wherein the memory contains instructions that, when executed by the processor, cause the apparatus to:
receive, in the TEE, a coordinate value of an interaction with the actionable region of the second composited display,
pass information associated with the coordinate value of the interaction with the actionable region of the second composited display to outside of the TEE, and
responsive to passing the information associated with the coordinate value of the interaction with the actionable region of the second composited display, trigger an event outside of the TEE associated with the actionable region of the second composited display.

11. The apparatus of claim 7 ,
wherein the progress switching layer appears as an intermediate layer below a layer comprising the graphical elements of the single-tap authentication user interface, and
wherein the progress switching layer appears above the layer comprising the screenshot of the content from the application.

12. The apparatus of claim 7 , wherein the second composited displa

Assignees

• Samsung Electronics Co Ltd

Inventors

• Lu Yi
• Zeng Junyuan
• Peng Pai

Classifications

• G06Q20/12

  specially adapted for electronic shopping systems · CPC title

• G06F9/452

  Remote windowing, e.g. X-Window System, desktop virtualisation (protocols for virtual reality H04L67/131) · CPC title

• G06F21/44

  Program or device authentication · CPC title

• G06F21/74 Primary

  operating in dual or compartmented mode, i.e. at least one secure mode · CPC title

• G06F3/04883 Primary

  for inputting data by handwriting, e.g. gesture or text · CPC title