Secure desktop environment for unsophisticated computer users

• US 20030217287A1
• Filed: 05/14/2003
• Published: 11/20/2003
• Est. Priority Date: 05/16/2002
• Status: Abandoned Application

• Current Assignee: Ilya Kruglenko
• Original Assignee: Ilya Kruglenko
• Inventors: Kruglenko, Ilya
• Application Number:
  US10/437,293
• Publication Number:
  US 20030217287A1
• Time in Patent Office: Days
• US Class Current: 713/200
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/82 Protecting input, output or interconnection devices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment

Abstract

The invention presents a method for preventing an unsophisticated user, such as a small child, from access programs or resources on a computer that may allow the user to cause harm to the computer system. This is done by limiting access to the computer'"'"'s resources to a number of predefined secure programs and resources.

First, a number of predefined keystrokes or keystrokes combinations are disabled as input from a keyboard or similar input device in order to prevent input that starts or interacts with insecure programs or accesses insecure resources. In addition, user interaction with insecure programs or resources is prevented by making all windows associated with already running programs incapable of receiving input from user input devices, preferably by hiding them so they cannot appear on the computer screen. The user is then presented with a secure user interface, said interface presenting the user with representations of computer programs and resources that are defined as secure.

Claims

1. Method for limiting access to a computer'"'"'s resources to a number of predefined secure programs and resources, comprising

disabling predefined keyboard input from a keyboard or similar input device in order to prevent input that starts or interacts with insecure programs or accesses insecure resources;

preventing user interaction with insecure programs or resources by making all windows associated with already running programs incapable of receiving input from user input devices; and

generating a user interface to be presented on screen, said interface presenting the user with representations of computer programs and resources that are defined as secure.

2. The method of claim 1, wherein said windows associated with already running programs are made incapable of receiving input from user input devices by being removed from the screen of a display device connected to the computer.

3. The method of claim 1, wherein said windows associated with already running programs are made incapable of receiving input from user input devices by being disabled.

4. The method of claim 1, wherein the disabling of predefined keyboard input is performed by monitoring all input from said input device on a system level and preventing keystroke information from being passed on if it is defined as blocked.

5. The method of claim 4, wherein the monitoring is performed by a systems wide keyboard hook installed on the computer system.

6. The method of claim 4, wherein the monitoring is performed by a driver installed in the keyboard driver chain.

7. The method of claim 2, wherein the removal of all windows is performed by calling a system function that removes each window from the display, and registering each window hidden in this manner by obtaining unique identifiers for each window by calling a system function to obtain such identifiers and entering said identifiers in a list of identifiers.

8. The method of claim 2, wherein the removal of all windows is performed by defining a new window and relocating all existing windows to this window by defining a relationship between said new window and said existing windows that only allows said existing windows to be shown inside said new window, removing said new window from the display, and registering each window hidden in this manner by obtaining unique identifiers for each window by calling a system function to obtain such identifiers and entering said identifiers in a list of identifiers.

9. The method of claim 1, further including

monitoring the system in order to detect windows that are about to be displayed on the screen, checking if any window detected in this manner belongs to a process or a program that is previously defined as secure, and if not, hiding such a window before a user can interact with it, and/or suspending the process to which such a window belongs.

10. Computer program product capable of performing the method according to one of the claims 1 to 9.

11. Computer program product according to claim 10, carried on a computer storage medium readable by a computer.

12. Computer program product according to claim 10, carried by a propagated signal.

13. Computer program product according to claim 10, installed on a computer system.

14. Computer system capable of operating in a secure mode that provides access only to a number of predefined secure programs and resources, comprising

a keyboard filter module installed on the system and capable of disabling predefined keyboard input from a keyboard or similar input device,

a window interaction disabling module installed on the system and capable of disabling interaction between a user input device and insecure programs or resources by making all windows associated with already running programs incapable of receiving input from user input devices;

and

a graphical user interface module that generates representations of computer programs and resources that are defined as secure for representation on the display.

15. Computer system according to claim 14, wherein the window interaction disabling module is a window hiding module that is capable of hiding all windows representing already running programs from a display device associated with the computer system.

16. Computer system according to claim 14, wherein the window interaction disabling module is a module that is capable of disabling all windows associated with already running programs.

17. Computer system according to claim 14, wherein the module for disabling predefined keyboard input is a system wide keyboard hook installed on the system.

18. Computer system according to claim 14, wherein the module for disabling predefined keyboard input is a driver installed in the keyboard driver chain.

19. Computer system according to claim 15, wherein the window hiding module is a software module that is set to call system functions that will remove each window from the display, call system functions that will identify each such window uniquely, and register all such windows in a list of such identifiers.

20. Computer system according to claim 15, wherein the window hiding module is a software module that is set to define a new window and relocate all existing windows to this window by calling system functions that define a relationship between said new window and said existing windows that only allows said existing windows to be shown inside said new window, calling system functions that remove said new window from the display;

call system functions that will identify each such window uniquely, and register all such windows in a list of such identifiers.

21. Computer system according to claim 14, further including an alert service software module that is set to monitor the system in order to detect windows that are about to be displayed on the screen, check if any window detected in this manner belongs to a process or a program that is previously defined as secure, and if not, hide such a window before a user can interact with it, and/or suspending the process to which such a window belongs.