Securing sensitive user data across hardware and software components having unbalanced trust levels

A method comprising:

• receiving, at a secure runtime environment associated with an application executing on a user device associated with a user, a request from the application for particular user input;
• providing the request to a remote location, wherein the remote location is assigned a first level of trust and the secure runtime environment is assigned a second level of trust that is lower than the first level of trust, wherein each level of trust is assigned based on physical access by an adversary, wherein the remote location does not trust the user device, and wherein the remote location requires the secure runtime environment to prove its identity uniquely on each interaction with the remote location;
• receiving, from the remote location and at the user device, code executable by display hardware to render a user interface configured to receive the user input, wherein the received code is not meaningfully readable by the secure runtime environment such that the secure runtime environment does not obtain information about content of the rendered user interface;
• capturing information at the secure runtime environment identifying particular display device locations to which the user provided input on the rendered user interface, wherein the secure runtime environment does not have information needed to map the captured information to the content of the rendered user interface;
• and
• providing a representation of the captured information to an auxiliary computing device for validation of the user input.

A system comprising:

• a user device having one or more processors and one or more storage devices storing a compiled program, that when executed by the one or more processors, causes the user device to perform operations comprising:
• in response to a request from an application executing on the user device for particular user input, providing the request to a remote location;
• receiving, within a secure runtime environment, executable code to render a user interface configured to receive the user input, wherein the executable code is not contextually readable by the secure runtime environment such that the secure runtime environment does not obtain information about content of the rendered user interface, wherein the remote location is assigned a first level of trust and the secure runtime environment is assigned a second level of trust that is lower than the first level of trust, wherein each level of trust is assigned based on physical access by an adversary, wherein the remote location does not trust the user device, and wherein the remote location requires the secure runtime environment to prove its identity uniquely on each interaction with the remote location;
• rendering the user interface on a display device of the user device;
• capturing information at the secure runtime environment identifying one or more particular display device locations to which a user of the user device provided input on the rendered user interface, wherein the secure runtime environment does not have information needed to map the captured information to the content of the rendered user interface;
• and
• providing the captured information to the remote location that evaluates integrity of a chain of custody tracking all interactions and flows involved from a point of receiving the request for user input and capturing the user input to the point of delivering the user input to an intended remote location.

A system comprising:

• a user device having one or more processors and one or more storage devices storing instructions, that when executed by the one or more processors, cause the user device to perform operations comprising:
• receiving, at a secure runtime environment associated with an application, a request from that application executing on the user device for particular user input;
• providing the request to a remote location, wherein the remote location is assigned a first level of trust and the secure runtime environment is assigned a second level of trust that is lower than the first level of trust, wherein each level of trust is assigned based on physical access by an adversary, wherein the remote location does not trust the user device, and wherein the remote location requires the secure runtime environment to prove its identity uniquely on each interaction with the remote location;
• receiving, from the remote location and at the user device, code executable by display hardware to render a user interface configured to receive the user input, wherein the received code is not meaningfully readable by the secure runtime environment such that the secure runtime environment does not obtain information about content of the rendered user interface;
• rendering the user interface on a display device of the user device;
• capturing metadata at the secure runtime environment describing user input on the rendered user interface, wherein the secure runtime environment does not have information needed to map the captured metadata to the content of the rendered user interface;
• and
• providing a representation of the captured metadata to an auxiliary computing device for extracting contextualized user input.