JP6117402B2 - System and method for protecting input - Google Patents

Description

  This case is generally related to computers, and in particular to protecting computer input data from malware.

  Malware is software set in a computer without the user's permission. Malware can be used by a malicious or non-conscientious person to obtain confidential or security information. Confidential information can be used to leak information from bank accounts and other restricted access or restricted files and web pages. For example, when a user enters a code to access a bank account, the malware captures the keystroke on the touch screen and uses that keystroke (or input method) to There is a risk of transferring money from the account to the bank account of the person who installed the malware.

US Patent Application Publication No. 2011-0025610

  An object of an embodiment according to one aspect is to provide a method and apparatus for protecting key input from malware.

The method according to one aspect is
A method comprising protecting a series of input entries using a small domain encryption engine.

Schematic which shows one Embodiment of this invention. 5 is a flowchart illustrating a shuffle algorithm according to an embodiment of the present invention. 6 is a flowchart illustrating a non-shuffle algorithm according to an embodiment of the present invention.

  In one embodiment, using a small domain cryptographic engine, input data of two or more important dimensions is securely input by an interface such as a touch screen interface. Other interfaces include a gesture recognition interface, a mouse cursor input interface, or other application, and may include any means for converting input to coordinates. A small domain encryption engine is computer software or hardware used to obscure input data entries of two or more dimensions. Small domains have a domain size, a certain number of data elements, less than one billion input domains or ranges (from traditional encryption algorithms such as Advanced Encryption Standard or AES) Is also quite small).

  In one embodiment, techniques for protecting touch screen input do not compromise the user's quality of experience. In other words, the user is unaware that something different is being performed and the user does not need to enter the data in any different manner.

  In one embodiment, a host-based operating system can utilize a standard driver stack to communicate touch input events. Furthermore, in one embodiment, the function of the operating system framework on which the touch event is notified is exhibited without understanding that the touch event is confidential information. In some cases, application developers may use standard graphic user interface development tools to properly understand the technology and provide the ability to enter it safely on various operating systems (e.g. Android®). , Automatic dimension adjustment (auto sizing) of the secure area can be performed so that it can be integrated with Mego (registered trademark) and iOS (registered trademark).

  In one embodiment, when touch input is received in a secure area of the screen, the coordinates (s) of the touch input are shuffled using any of a variety of available shuffle algorithms. The shuffle algorithm changes the order of input data such as the coordinates of touch screen contact points. The shuffled touch input is then provided to the host software. When the host software has to use touch input, the host software uses the secure engine to return the touch input to the pre-shuffle state.

  In FIG. 1, the touch panel 10 has a touch input space of coordinates ranging from (0,0) in the lower left corner to (1920,1080) in the upper right corner in one embodiment. Other means of providing touch panel coordinates may be used. The coordinates of the location where the user (ie, the user's finger) touched the touch panel may be sent as raw coordinates. The raw coordinates are provided to the security engine 12, which in one embodiment includes a microcontroller and firmware. In one embodiment, the coordinates are sent from the touch panel to the security engine via an inter-integrated circuit bus (I2C bus).

  The security engine determines whether the touch input is input within the secure area of the current display on the touch panel. The security engine notifies the host software 14 of this. When the secure area is accessed, the coordinates of the touched location on the touch panel are shuffled by the security engine using a shuffle algorithm (two specific examples of the shuffle algorithm, such as the Knuth shuffle method, soap, (Thorp) Shuffle method etc. are mentioned).

  In one embodiment, security engine 12 includes a secure hardware controller, which may be a discrete device or part of a processor that is configured to provide an independent environment. As another example, the security engine may be a software-based secure controller, and may form an independent software secure environment, for example by performing virtualization to form an embedded operating system. In one embodiment, the security engine may be part of a touch screen.

  In one embodiment, if it is determined that the coordinates are contained within a secure area of the screen, the hardware touch screen 10 does not provide the information directly to the host software 14, but a secure processing data stream. Relocated to a new environment. If the coordinates are within the secure area of the screen, the encryption shuffle process is applied to both or one of the X and Y coordinates if they are orthogonal coordinates. Encryption shuffle processing or small domain encryption processing enables strong encryption for small data sets (data groups), but what is encrypted and what is decrypted are strictly one-to-one. There is a property (correspondence relationship) that corresponds to.

  In one embodiment, the encryption shuffle may use the Advanced Encryption Standard (AES) as a keying function that determines the order of shuffling. In one embodiment, the shuffle rearranges the coordinate (s) of the touch event in the protected area on the screen to the new coordinate (s) in the same protected area. “Rearrange” may be referred to as rearrangement, rearrangement, rearrangement, changing the alignment order, different permutations, and the like. For example, the rearranged coordinates are difficult to return to true coordinates as long as the key is unknown (at least not obvious). By maintaining the area of the repositioned coordinates within the safe input / output portion of the screen, the repositioned coordinates are exactly the same as touch events made via the software stack and at other parts of the screen. It appears as well. It is therefore very difficult for malware to capture secure coordinates in order to obtain secure data input.

  In one embodiment, each coordinate is associated or mapped to a newly encrypted coordinate. Thus, in one embodiment, multiple touch events that occur nearby are mapped to completely unrelated (distant) coordinates. In one embodiment, pressing the same key multiple times on a virtual keyboard results in significantly different and different coordinates within the shuffled coordinate group. In another embodiment, if the input coordinates deviate from the touch screen virtual key image, the input coordinates may be adjusted to be converted or changed to the center of the virtual key.

  A secure service (part) such as a financial institution that needs to decode (decode) a true input performs, for example, the following processing using the security engine 12 of the system shown in FIG. . A symmetric key is shared with a security controller such as a microcontroller that is part of the security engine 12, and the symmetric key is used to determine how to convert. The same mapping table is then prepared or used based on the encryption shuffle that is known to be used in a secure environment. An inverse transformation is performed to obtain the true coordinates when the touch screen is pressed. The touch event may be interpreted based on the manner (type) of data entry performed by the user by means of a virtual keyboard, pin pad, signed physical signature, or some other means.

  The above example relates to standard Cartesian coordinates, but the same technique can be used for any coordinate system, for example polar coordinates, and in the case of polar coordinates, a circular part on the screen may be the protected area. Alternatively, three-dimensional coordinates that allow the technique to be used for secure gesture input may be used.

  In addition, a unique indicator is formed on the screen to secure the user whose input will be (future) secure (if it is not secret at the moment but will be secret information in the future), and secure input data will be protected by encryption in the future. May be indicated (by its indicator). For example, under the control of a secure environment, the virtual keyboard can include a unique image watermark that is safely prepared in a secure execution environment.

  In one embodiment, the screen data does not need to be randomized, so the user gets a natural input experience. Furthermore, in one embodiment, free mixing of secure and non-secure events is allowed, and only the data required in the secure environment comes from the screen area associated as the security area. From the developer's perspective, the same touch screen event application program interface and framework may be used to interact with the hardware. The only difference is that the host software must know that the coordinates in the secure area should be sent to the secure application upon decoding.

  The security engine outputs the shuffled touch event to the driver 16, which provides the data to the untrusted code 22. It is assumed that the untrusted code 22 may be leaked.

  Alternatively, touch panel input that does not reach the secure area may be routed directly to the operating system driver 20 in the host software stack 14 via the path 18 (bypassing or bypassing the security engine 12). The server 24 may send secret data to the host software 14. Note that in one embodiment, the raw coordinates may be processed by an on-chip processing unit connected to on-chip (built-in) means or other similar means.

  In one embodiment, the pseudo code for implementing an example of the present invention is as follows:

図2において、キー入力座標をシャッフルするためのシーケンス26は、ソフトウェア、ファームウェア及び/又はハードウェアにより実現されてもよい。ファームウェア及びソフトウェアによる実施形態の場合、1つ以上の有形のコンピュータ可読媒体に保存されたコンピュータにより実行可能な命令により、シーケンスは実現されてもよい。コンピュータ可読媒体は、コンピュータが読み取ることが可能な記憶媒体であり、例えば磁気メモリ、光学メモリ、又は半導体メモリ等である。図1に示す実施形態の場合、一例として、ソフトウェア又はファームウェアのシーケンスはセキュリティエンジン12に保存されていてもよい。

In FIG. 2, the sequence 26 for shuffling the key input coordinates may be realized by software, firmware and / or hardware. For firmware and software embodiments, the sequence may be implemented by computer-executable instructions stored on one or more tangible computer-readable media. The computer-readable medium is a computer-readable storage medium, such as a magnetic memory, an optical memory, or a semiconductor memory. In the embodiment shown in FIG. 1, as an example, a software or firmware sequence may be stored in the security engine 12.

  The shuffle sequence 26 begins by receiving touch coordinates (coordinates touched by the user), as indicated by block 28. In the diamond-shaped block 30, it is confirmed whether or not the coordinates are a result of using the secure entry mode (safe input mode). A secure entry is any data entry that is shown to be secure or secret. A specific example of the secure entry mode may be a touch input in the secure area of the display. Another example of the secure entry mode includes performing input selection or input designation that designates an entry as being secure. If the coordinates are designated as a secure entry, the coordinates are shuffled by the security engine as shown in block 32. Then, as shown in block 34, if the input is shuffled, the shuffled coordinates will reach the host software 14 (FIG. 1) (bypassing the path 18 to the driver 20 in FIG. 1). . If the input is not shuffled, in one embodiment, unshuffled input is also provided to the host software 14.

  The sequence 36 shown in FIG. 3 is used by a key event receiver that does not shuffle input key events. For example, a website server needs to receive a key event and decode the key event. The receiving unit may use a device similar to that shown in FIG. 1 and a security engine corresponding to the security engine 12 (FIG. 1). The sequence 36 may be implemented in firmware, software and / or hardware. For firmware and software embodiments, the sequence may be implemented as computer-executable instructions stored in one or more tangible computer-readable media (e.g., magnetic memory, optical memory, or semiconductor memory, etc.). . Also in this case, the software or firmware sequence may be stored in the security engine 12 (FIG. 1).

  The sequence begins by sharing a symmetric key with the security controller as shown in block 38. As shown in block 40, the same mapping table used to form the key sequence (key sequence) is based on the encrypted shuffle used to produce the shuffled result. Prepared or used. In block 42, an inverse transformation is performed. Then, as shown in block 44, the touch event is interpreted based on the type of data entry.

  Throughout this specification "an embodiment" or "embodiment" includes a particular property, structure, or characteristic described in connection with that embodiment is included in at least one embodiment encompassed by the invention. Means that Where the phrase “one embodiment” or “an embodiment” appears, they do not necessarily refer to the same embodiment. Furthermore, the particular properties, structures, or features may be used in other suitable forms other than the specific embodiments described, and all such forms are encompassed within the claims of this application. Also good.

While the invention has been described in connection with a limited number of embodiments, those skilled in the art will recognize various suitable modifications and variations thereto. The appended claims are intended to cover all such modifications and changes as fall within the true spirit and scope of the invention.
Hereinafter, the means provided by the embodiments of the present application will be listed as an example.
(Appendix 1)
A method comprising protecting a series of input entries utilizing a small domain encryption engine.
(Appendix 2)
The method of claim 1, comprising shuffling the two-dimensional input coordinates.
(Appendix 3)
The method according to appendix 2, wherein shuffle is performed using a Thorp or Knuth shuffle method.
(Appendix 4)
The method of claim 2 including shuffling a series of touch panel entries.
(Appendix 5)
The method according to appendix 4, wherein the coordinates indicating where the touch panel is touched are shuffled.
(Appendix 6)
The method of claim 1 including the step of shuffling in a secure environment.
(Appendix 7)
The method according to claim 4, comprising detecting whether or not the input entry is obtained in a secure touch panel area.
(Appendix 8)
The method according to appendix 7, wherein only the input entry obtained in the secure touch panel area is shuffled.
(Appendix 9)
The method of claim 1 including the step of sharing a symmetric key to recover the input entry.
(Appendix 10)
The method of claim 9 including the step of restoring the coordinates of the input entry using a mapping table.
(Appendix 11)
At least one tangible computer readable storage medium storing instructions that cause a computer to perform processing, the processing comprising:
A storage medium comprising the step of protecting a series of input entries utilizing a small domain encryption engine.
(Appendix 12)
The storage medium according to appendix 11, wherein the processing includes a step of shuffling two-dimensional input coordinates.
(Appendix 13)
The storage medium according to appendix 12, wherein the processing is shuffled using a soap or Knuds shuffle method.
(Appendix 14)
The storage medium according to claim 12, wherein the processing includes a step of shuffling a series of touch panel entries.
(Appendix 15)
15. The storage medium according to appendix 14, wherein the processing shuffles coordinates indicating where the touch panel is touched.
(Appendix 16)
The storage medium according to claim 11, wherein the process includes a step of shuffling in a secure environment.
(Appendix 17)
15. The storage medium according to appendix 14, wherein the process includes a step of detecting whether or not the input entry is obtained in a secure touch panel area.
(Appendix 18)
The storage medium according to appendix 17, wherein the processing shuffles only input entries obtained in the secure touch panel area.
(Appendix 19)
The storage medium according to appendix 11, wherein the processing shuffles any one of polar coordinates, three-dimensional coordinates, and gesture coordinates.
(Appendix 20)
The storage medium according to claim 11, wherein the processing includes a step of sharing a symmetric key to restore the input entry.
(Appendix 21)
The storage medium according to appendix 20, wherein the process includes a step of restoring the coordinates of the input entry using a mapping table.
(Appendix 22)
A security engine that shuffles 2D input,
A device that detects whether or not the two-dimensional input has been made using a secure entry mode.
(Appendix 23)
The apparatus according to appendix 22, wherein the apparatus detects that an input has been made to the secure display area.
(Appendix 24)
The apparatus of claim 22 wherein the security engine does not shuffle input made without using secure entry mode.
(Appendix 25)
Item 22. The apparatus according to appendix 22, wherein shuffle is performed using a security engine that is a small domain encryption security engine.
(Appendix 26)
The apparatus according to appendix 22, wherein the security engine shuffles using a soap or Knuds shuffle method.
(Appendix 27)
The apparatus according to appendix 22, wherein the security engine shuffles coordinates indicating where the touch panel is touched.
(Appendix 28)
The apparatus of claim 22 wherein a watermark is displayed when the security engine is operating to shuffle input.
(Appendix 29)
Item 23. The apparatus according to item 22 having a secure data input mode and a non-secure data input mode.
(Appendix 30)
The apparatus of claim 22 wherein the apparatus comprises host software and the security engine shuffles the input before the input is accessible to the host software.

Claims (4)

A detection unit that detects whether or not a two-dimensional input is made in a secure area of the touch panel using the secure entry mode;
A controller that protects a series of input entries in a secure area of the touch panel, and protects the series of input entries by rearranging the coordinates of the input entries to other coordinates in the secure area. With the controller,
And the controller forms a software secure environment independent of host software that receives the relocated input entry from the controller. An input protection method performed by an input protection system, comprising:
Detecting whether a two-dimensional input has been made in a secure area of the touch panel using the secure entry mode;
Protecting a series of input entries in a secure area of the touch panel by a controller, wherein the series of input entries is re-arranged to another coordinate in the secure area Protect the steps and
And the controller forms a software secure environment independent of host software that receives the relocated input entry from the controller.   A computer program for causing a computer of an input protection system to execute the input protection method according to claim 2.   A storage medium for storing the computer program according to claim 3.

Images