Method and apparatus for inputting data

Patent metadata

Field	Value
Publication number	US-9672367-B2
Application number	US-201514721911-A
Country	US
Kind code	B2
Filing date	May 26, 2015
Priority date	Jun 3, 2013
Publication date	Jun 6, 2017
Grant date	Jun 6, 2017

Abstract

Embodiments of the present invention provide a method and an apparatus for inputting data. The present invention relates to the communications field and aims to improve security of input information. The method includes: acquiring, by a virtual machine manager, input data; performing, by the virtual machine manager, encryption processing on the input data according to an encryption rule of a security connection to obtain encrypted data; and sending, by the virtual machine manager, the encrypted data to the server. The present invention is applicable to a data input scenario.

First claim

What is claimed is:

1. A method for inputting data, the method comprising:
acquiring, by a virtual machine manager, input data;
performing, by the virtual machine manager, encryption processing on the input data according to an encryption rule of a security connection to obtain encrypted data, wherein the security connection refers to a connection that is established between an application interface and a server;
generating, by the virtual machine manager, forged input data and sending the forged input data to an operating system; and
sending, by the virtual machine manager, the encrypted data to the server via the security connection.

2. The method according to claim 1 , wherein acquiring, by a virtual machine manager, input data comprises:
acquiring, by the virtual machine manager, the input data by using a virtual input unit, wherein the virtual input unit implements a same function as a physical input unit.

3. The method according to claim 2 , wherein:
the virtual input unit comprises a first nominal zone and a first security zone, wherein the first normal zone is used to acquire second input data that requires no encryption processing, and the first security zone is used to acquire first input data that requires security processing;
acquiring, by the virtual machine manager, the input data by using a virtual input unit comprises:
acquiring, by the virtual machine manager, the first input data via the first security zone; and acquiring the second input data via the first normal zone; and

performing, by the virtual machine manager, encryption processing on the input data according to an encryption rule of a security connection to obtain encrypted data comprises:
performing, by the virtual machine manager, encryption processing on the first input data according to the encryption rule of the security connection to obtain the encrypted data.

4. The method according to claim 1 , wherein:
acquiring, by a virtual machine manager, input data comprises:
controlling, by the virtual machine manager, a physical input unit; and
acquiring, by the virtual machine manager, the input data by using the physical input unit, wherein the input data is buffered in an input buffer; and

after acquiring, by the virtual machine manager, the input data by using the physical input unit, the method further comprises:
clearing, by the virtual machine manager, the input buffer.

5. The method according to claim 4 , wherein:
the physical input unit comprises a second security zone and a second normal zone, wherein the second nominal zone is used to acquire fourth input data that requires no security processing, and the second security zone is used to acquire third input data that requires security processing;
acquiring, by the virtual machine manager, the input data by using the physical input unit comprises:
acquiring, by the virtual machine manager, the third input data via the second security zone; and acquiring the fourth input data via the second normal zone; and

performing, by the virtual machine manager, encryption processing on the input data according to an encryption rule of a security connection to obtain encrypted data comprises:
performing, by the virtual machine manager, encryption processing on the third input data according to the encryption rule of the security connection to obtain the encrypted data.

6. The method according to claim 1 , wherein:
before performing, by the virtual machine manager, encryption processing on the input data according to an encryption rule of a security connection to obtain encrypted data, the method further comprises:
receiving, by the virtual machine manager, a submission instruction, wherein the submission instruction is an instruction that is used to instruct a user to complete data input; and

performing, by the virtual machine manager, encryption processing on the input data according to an encryption rule of a security connection to obtain encrypted data comprises:
performing, by the virtual machine manager after receiving the submission instruction, encryption processing on the input data according to the encryption rule of the security connection to obtain the encrypted data.

7. The method according to claim 1 , wherein:
before acquiring, by a virtual machine manager, input data, the method further comprises:
receiving, by the virtual machine manager, a trigger instruction, wherein the trigger instruction is an instruction that is used to trigger the virtual machine manager to enable data encryption; and

performing, by the virtual machine manager, encryption processing on the input data according to an encryption rule of a security connection to obtain encrypted data comprises:
performing, by the virtual machine manager and in response to the trigger instruction, encryption processing on the input data according to the encryption rule of the security connection to obtain the encrypted data.

8. The method according to claim 1 , wherein:
the security connection comprises: a Secure Sockets Layer (SSL) connection; and
performing, by the virtual machine manager, encryption processing on the input data according to an encryption rule of a security connection to obtain encrypted data comprises:
performing, by the virtual machine manager, encryption processing on the input data according to an encryption rule of the SSL connection to obtain the encrypted data.

9. A physical host, comprising:
a memory and a processor; and
the memory stores a set of program code and the processor is configured to invoke the program code in the memory to:
acquire input data,
encrypt the input data according to an encryption rule of a security connection to obtain encrypted data, wherein the security connection refers to a connection that is established between an application interface of the physical host and a server,

generate forged input data and send the forged input data to an operating system of the physical host, and
send the encrypted data to the server.

10. The physical host according to claim 9 , wherein the processor is configured to acquire the input data by using a virtual input unit, wherein the virtual input unit implements a same function as a physical input unit, the virtual input unit is configured to determine, according to a position tapped by a user, data input by the user.

11. The physical host according to claim 10 , wherein:
the virtual input unit comprises a first normal zone and a first security zone, wherein the first normal zone is used to acquire second input data that requires no encryption processing, and the first security zone is used to acquire first input data that requires security processing; and
the processor is configured to:
acquire the first input data via the first security zone, acquire the second input data via the first normal zone, and
perform encryption processing on the first input data according to the encryption rule of the security connection to obtain the encrypted data.

12. The physical host according to claim 10 , wherein:
the virtual input unit comprises a virtual keyboard; and
the processor is further configured to create the virtual keyboard by using a virtual input unit interface provided by an operating system.

13. The physical host according to claim 9 , wherein the processor is configured to:
acquire the input data by using a physical input unit, wherein the input data is buffered in an input buffer; and
configured to clear the input buffer after acquiring the input data by using the physical input unit.

14. The physical host according to claim 13 , wherein:
the physical input unit comprises a sec

Assignees

• Huawei Tech Co Ltd

Inventors

• Wu Xiaoxin
• Tu Bin

Classifications

• G06F2009/45587

  Isolation or security of virtual machine instances · CPC title

• G06F21/62 Primary

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title

• G06F9/45558

  Hypervisor-specific management and integration aspects · CPC title

• G06F21/606 Primary

  by securing the transmission between two devices or processes · CPC title

• G06F21/602

  Providing cryptographic facilities or services · CPC title