Trusted user interface for a secure mobile wireless device

• US 20050166064A1
• Filed: 05/28/2003
• Published: 07/28/2005
• Est. Priority Date: 05/28/2002
• Status: Abandoned Application

• Current Assignee: Nokia Corporation
• Original Assignee: Symbian Limited (Nokia Corporation)
• Inventors: Dive-Reclus, Corinne, Thoelke, Andrew, May, Dennis
• Application Number:
  US10/515,752
• Publication Number:
  US 20050166064A1
• Time in Patent Office: Days
• US Class Current: 713/189
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 21/84 output devices, e.g. displays or monitors
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: H04M 1/72403 with means for local support of applications that increase the functionality

Abstract

A mobile wireless device programmed with software which provides a trusted user interface for the device by allowing the content of a secure screen memory to be modifiable only by authorised applications. Normally, the entire screen memory address is public information, making the entire screen memory fully available to any application; hence, even sensitive dialogs would use screen memory which can in theory be looked at by malicious software, enabling that malicious code to grab PIN data etc. or corrupt a trusted user interface. But with the present invention, unauthorised applications are prevented from accessing the data displayed by the secure frame buffer because they are able to access only the non-secure screen memory. Hence, malicious applications cannot retrieve data from a trusted dialog or compromise that data. Further, as the present invention is a software only solution, it requires no new hardware per se—the only requirement is that components (e.g. a software window server; a video chip etc.) can select content from different parts of screen memory—i.e. secure and non-secure frame buffers.

Claims

1. A mobile wireless device programmed with software which provides a trusted user interface for the device by allowing the content of a secure screen memory to be accessible or modifiable only by authorised applications, the software operating automatically to detect whether an application is an authorised application, to thereby eliminate the need to deploy additional secure hardware as a mechanism for ensuring the integrity of the secure screen memory.

2. The device of claim 1 in which the address locations of the secure screen memory are known only to the window server and the kernel, which can make this secure screen memory available to executable code with the appropriate capability.

3. The device of claim 2 in which the window server is part of a trusted computing environment.

4. The device of claim 3 in which a capability is a property assigned to executable code which defines the sensitive actions which that code can perform or the sensitive resources which that code can access.

5. The device of claim 1 in which secure parts and non-secure parts of the screen memory are physically distinct parts of the same RAM based screen memory.

6. The device of claim 1 which provides a visual indication of the status of the trusted user interface.

7. The device of claim 6 in which the visual indication is a LED.

8. The device of claim 6 in which the visual indication is a particular screen icon or message.

9. The device of claim 6 in which the visual indication can be modified by the window server and the kernel only.

10. The device of claim 6 in which the window server changes the visual indication only when the trusted user interface is enabled or disabled.

11. The device of claim 1 in which input events generated by the user as keyboard, mouse and pen events can be retrieved from the kernel only by the window server.

12. The device of claim 11 in which the window server does not allow input events generated within the trusted user interface to be retrieved by a process that is not the trusted dialog owner.

13. Computer software which, when running on a mobile wireless device, causes the device to become a device as defined in claim 1.