Secure data transmission and verification with untrusted computing devices

Patent metadata

Field	Value
Publication number	US-9495544-B2
Application number	US-201414318266-A
Country	US
Kind code	B2
Filing date	Jun 27, 2014
Priority date	Jun 27, 2013
Publication date	Nov 15, 2016
Grant date	Nov 15, 2016

Abstract

Techniques from the proposed invention relate to providing enhanced security. For example, techniques described herein allow a computer system, such as a mobile device, to support a wide variety of security functions and security sensitive applications on a mobile device by providing enhanced security via secure input and output data transmission and verification through a secure module. The secure module may cause user interfaces to be provided to users by providing obfuscated user interface data to the operating system that do not reveal elements that are part of the user interfaces. The secure module may receive obfuscated user input values representing user input values, and de-obfuscate these user input values, whereby the actual input values are not exposed to the underlying operating system. The secure module may track the flow of user input/output data through the computing device to ensure the integrity and authenticity of this data.

First claim

What is claimed is:

1. A method in a secure module executing on a computing device with an operating system, comprising:
causing, by the secure module, a user interface to be presented to a user by providing obfuscated user interface data to the operating system that does not reveal meaningful elements that are part of the user interface;
receiving, by the secure module from the operating system, a notification that the user has provided an input value via the user interface to the computing device, wherein the notification does not include the input value and the operating system is not aware of the input value;
responsive to said receiving the notification, identifying an obfuscated user input value that represents the input value;
de-obfuscating, by the secure module, the obfuscated user input value to yield the input value;
receiving, by the secure module, one or more additional notifications that data representing the input value has been processed by one or more respective software or hardware modules of the computing device; and
updating, by the secure module, a measured value for information flow tracking in response to the one or more notifications, wherein the measured value identifies the one or more software or hardware modules that have processed the data representing the input value; and
wherein the method further comprises
after said receiving the notification that the user has provided the input value,
causing, by the secure module, an updated user interface to be presented to the user by providing updated obfuscated user interface data to the operating system that does not reveal meaningful elements that are part of the updated user interface.

2. The method of claim 1 , further comprising:
generating a secure connection, by the secure module with a server computing device, over another connection between the computing device and the server computing device, wherein the secure connection terminates within the secure module, and wherein the another connection terminates outside of the secure module; and
transmitting, by the secure module over the secure connection to the server computing device, a message comprising the de-obfuscated input value and the measured value.

3. The method of claim 2 , further comprising:
receiving, from the server computing device over the secure connection, a response message indicating a result of an authentication module executing at the server computing device attempting to authenticate the de-obfuscated input value at least based upon the measured value.

4. The method of claim 3 , wherein the result indicates that at least one of the one or more software or hardware modules of the computing device that processed the data representing the input value did not process the data correctly.

5. The method of claim 1 , wherein the measured value, for at least one of the one or more software or hardware modules, indicates an input provided to the respective module and an output generated by the respective module.

6. The method of claim 1 , wherein:
said obfuscated user interface data provided to the operating system comprises one or more pixel values, wherein each of the one or more pixel values indicates one or more of a location, a color, and a brightness.

7. The method of claim 1 , wherein:
said received obfuscated user input value comprises a coordinate of the user interface that the user interacted with to provide the input value.

8. The method of claim 7 , wherein said de-obfuscating the obfuscated user input value comprises identifying, based upon the coordinate, the input value entered by the user.

9. The method of claim 1 , further comprising:
receiving, from an application, a request to attain the input value from the user.

10. The method of claim 1 , further comprising:
registering, by the secure module with the operating system, a request to receive user input notifications.

11. A non-transitory computer-readable storage medium storing instructions that, when executed by one or more processors of a computing device, cause the computing device to execute a secure module with an operating system and perform operations comprising:
causing, by the secure module, a user interface to be presented to a user by providing obfuscated user interface data to the operating system that does not reveal meaningful elements that are part of the user interface;
receiving, by the secure module from the operating system, a notification that the user has provided an input value via the user interface to the computing device, wherein the notification does not include the input value and the operating system is not aware of the input value;
responsive to said receiving the notification, identifying an obfuscated user input value that represents the input value;
de-obfuscating, by the secure module, the obfuscated user input value to yield the input value;
updating, by the secure module, a measured value for information flow tracking that identifies one or more software or hardware modules of the computing device that have processed data representing the input value, and
wherein the measured value, for at least one of the software or hardware modules, indicates an input provided to the respective module and an output generated by the respective module; and
wherein the operations further comprise:
after said receiving the notification that the user has provided the input value, causing, by the secure module, an updated user interface to be presented to the user by providing updated obfuscated user interface data to the operating system that does not reveal meaningful elements that are part of the updated user interface.

12. The non-transitory computer readable storage medium of claim 11 , wherein the operations further comprise:
generating a secure connection, by the secure module with a server computing device, over another connection between the computing device and the server computing device, wherein the secure connection terminates within the secure module, and wherein the another connection terminates outside of the secure module; and
transmitting, by the secure module over the secure connection to the server computing device, a message comprising the de-obfuscated input value and the measured value.

13. The non-transitory computer readable storage medium of claim 11 , wherein:
said obfuscated user input value comprises a coordinate of the user interface that the user interacted with to provide the input value; and
said de-obfuscating the obfuscated user input value comprises identifying, based upon the coordinate, the input value entered by the user.

14. A computing device, comprising:
one or more processors;
a user-input hardware interface coupled to the one or more processors; and
a non-transitory computer readable storage medium, coupled to the one or more processors, which store instructions that, when executed by the one or more processors, cause the computing device to execute a secure module with an operating system and perform operations comprising:
causing, by the secure module, a user interface to be presented to a user by providing obfuscated user interface data to the operating system that does not reveal meaningful elements that are part of the user interface;
receiving, by the secure module from the operating system, a notification that the user has provided an input value via the user interface to the computing device, wherein the notification does not include the input value and the operating system is not aware of the input value;
responsive to said receiving the notification, identifying an obfuscated user input value that represents the input

Assignees

• Visa Int Service Ass

Inventors

• Aissi Selim
• Kgil Taeho
• Prakash Gyan

Classifications

• G06F7/58 Primary

  Random or pseudo-random number generators · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/123

  received data contents, e.g. message integrity · CPC title

• G06F21/60 Primary

  Protecting data · CPC title

• H04L2209/56

  Financial cryptography, e.g. electronic payment or e-cash · CPC title