Protecting user input against focus change
AssigneeIntel Corporation
InventorsNathan Heldt-Sheller, Ned M. Smith
Life of this patent
Estimating the term…
Abstract
In an embodiment, a system includes a processor having at least one core and a security engine, the security engine having a focus change logic to inform a trusted application to be executed in a trusted execution environment of a request for a focus change during execution of the trusted application, enable the focus change to occur during execution of the trusted application when allowed by the trusted application, and otherwise to prevent the focus change. Other embodiments are described and claimed.
Claims12
At least one non-transitory computer readable storage medium comprising instructions that when executed enable a system to:
- register a trusted application with a focus change manager of a hardware security engine of the system;
- establish a trusted channel between a user input device of the system and the trusted application and set a focus to the trusted application to enable user input via the user input device to be provided to the trusted application;
- execute the trusted application on a hardware processor of the system;
- determine, in the trusted application, whether to allow a change of the focus to another entity during the execution of the trusted application;
- and
- if the change of the focus is determined to be allowed, enable the user input from the user input device to be provided to the another entity via an untrusted channel.
A method comprising:
- entering, by a trusted input control hardware logic, a trusted input mode of a system including at least one user input device and a hardware processor to execute a trusted application, wherein in the trusted input mode a trusted channel is provided between the at least one user input device and the trusted application;
- receiving, in the trusted input control hardware logic, user input from the at least one user input device via the trusted channel, protecting the user input and providing the protected user input to the trusted application;
- responsive to an indication of a focus change request, providing a notification to a user regarding a change in input mode, the notification including a request for the user to confirm whether to provide additional user input to an untrusted application, and determining, in the trusted application, whether to provide the additional user input to the untrusted application;
- and
- responsive to receipt of the user confirmation, causing a focus change to the untrusted application.
A computing system comprising:
- a processor having at least one core and a security engine;
- at least one user input device;
- a non-transitory storage medium coupled to the processor, the non-transitory storage medium comprising instructions that when executed enable the processor to:
- enter a trusted input mode, wherein in the trusted input mode a trusted channel is provided between the at least one user input device and a trusted application;
- receive user input from the at least one user input device via the trusted channel, protect the user input and provide the protected user input to the trusted application;
- responsive to an indication of a focus change request, provide a notification to a user regarding a change in input mode, the notification including a request for the user to confirm whether to provide additional user input to an untrusted application and determine, in the trusted application, whether to provide the additional user input to the untrusted application;
- and
- responsive to receipt of the user confirmation, cause a focus change to the untrusted application.
Dependencies are inferred from the claim text.