USING MULTIPLE DISPLAY SERVERS TO PROTECT DATA

• US 20110239125A1
• Filed: 03/24/2010
• Published: 09/29/2011
• Est. Priority Date: 03/24/2010
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Kristensen, Kristian H., Zeuthen, David
• Granted Patent: US 9,355,282 B2
• Time in Patent Office: Days
• US Class Current: 715/743
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/6209 to a single file or object, e.g. in a secure envelope, encrypted and accessed using a key, or with access control rules appended to the object itself
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: G06F 21/629 to features or functions of an application
• CPC Class Codes: G06F 21/84 output devices, e.g. displays or monitors
• CPC Class Codes: G06F 9/543 User-generated data transfer, e.g. clipboards, dynamic data exchange [DDE], object linking and embedding [OLE]

Abstract

A first display server and a second display server execute on a processing device. The first display server provides a secure environment for data presented in first application windows of the first display server and the second display server provides an unsecure environment for data presented in second application windows of the second display server. The processing device receives at least one user command to copy data from one of the first application windows of the first display server to one of the second application windows of the second display server. The processing device prompts a user to perform an authentication upon receiving the at least one user command. In response to the user successfully performing the authentication, data is copied from said one of the first application windows to said one of the second application windows.

Claims

1. A computer implemented method, comprising:

executing, by a processing device, a first display server that provides a secure environment for data presented in a first application window of the first display server;

executing, by the processing device, a second display server that provides an unsecure environment for data presented in a second application window of the second display server;

receiving at least one user command to copy data from the first application window of the first display server to the second application window of the second display server;

prompting a user to perform an authentication upon receiving the at least one user command; and

in response to the user successfully performing the authentication, copying the data from said first application window to said second application window.

2. The method of claim 1, wherein receiving the at least one user command includes receiving a copy command to copy the data from said first application window and a paste command to paste the data to said second application window, and wherein the user is prompted to perform the authentication upon receiving the paste command.

3. The method of claim 1, wherein receiving the at least one command includes receiving a drag-and-drop command to drag an object representing the data from said first application window to said second application window.

4. The method of claim 1, wherein the first display server is a client of the second display server.

5. The method of claim 1, further comprising:

executing a third display server that provides an additional secure environment to clients of the third display server, wherein the first display server and the second display server are clients of the third display server.

6. The method of claim 1, wherein the second display server includes a compositing window manager, the method further comprising:

writing graphics data of the first application window to a first buffer by at least one of the first application window or the first display server;

writing graphics data of the second application window to a second buffer by at least one of the second application window or the second display server;

compositing contents of the first buffer and the second buffer by the compositing window manager; and

outputting the composited contents to a display.

7. The method of claim 6, further comprising:

receiving a request for graphics data in the first buffer from said second application window;

prompting a user to perform authentication; and

providing the graphics data to the requesting second application window upon the user successfully performing the authentication.

8. A computer readable storage medium including instructions that, when executed by a processing device, cause the processing device to perform a method, comprising:

executing, by the processing device, a first display server that provides a secure environment for data presented in a first application window of the first display server;

executing, by the processing device, a second display server that provides an unsecure environment for data presented in a second application window of the second display server;

receiving at least one user command to copy data from the first application window of the first display server to the second application window of the second display server;

prompting a user to perform an authentication upon receiving the at least one user command; and

in response to the user successfully performing the authentication, copying the data from said first application window to said second application window.

9. The computer readable storage medium of claim 8, wherein receiving the at least one user command includes receiving a copy command to copy the data from said first application window and a paste command to paste the data to said second application window, and wherein the user is prompted to perform the authentication upon receiving the paste command.

10. The computer readable storage medium of claim 8, wherein receiving the at least one command includes receiving a drag-and-drop command to drag an object representing the data from said first application window to said second application window.

11. The computer readable storage medium of claim 8, wherein the first display server is a client of the second display server.

12. The computer readable storage medium of claim 8, the method further comprising:

executing a third display server that provides an additional secure environment to clients of the third display server, wherein the first display server and the second display server are clients of the third display server.

13. The computer readable storage medium of claim 8, wherein the second display server includes a compositing window manager, the method further comprising:

writing graphics data of the first application window to a first buffer by at least one of the first application window or the first display server;

writing graphics data of the second application window to a second buffer by at least one of the second application window or the second display server;

compositing contents of the first buffer and the second buffer by the compositing window manager; and

outputting the composited contents to a display.

14. The computer readable storage medium of claim 13, the method further comprising:

receiving a request for graphics data in the first buffer from said second application window;

prompting a user to perform authentication; and

providing the graphics data to the requesting second application window upon the user successfully performing the authentication.

15. A computing device, comprising:

a memory to store instructions for a first display server that provides a secure environment for data presented in a first application window of the first display server, for a second display server that provides an unsecure environment for data presented in a second application window of the second display server, and for an authorization framework; and

a processing device, connected with the memory, to execute the instructions, wherein the instructions cause the processing device to;

receive at least one user command to copy data from the first application window of the first display server to the second application window of the second display server;

prompt a user to perform an authentication upon receiving the at least one user command; and

in response to the user successfully performing the authentication, copy the data from said first application window to said second application window.

16. The computing device of claim 15, wherein receiving the at least one user command includes receiving a copy command to copy the data from said first application window and a paste command to paste the data to said second application window, and wherein the user is prompted to perform the authentication upon receiving the paste command.

17. The computing device of claim 15, wherein receiving the at least one command includes receiving a drag-and-drop command to drag an object representing the data from said first application window to said second application window.

18. The computing device of claim 15, wherein the first display server is a client of the second display server.

19. The computing device of claim 15, further comprising:

the memory to store instructions for a third display server that provides an additional secure environment to clients of the third display server, wherein the first display server and the second display server are clients of the third display server.

20. The computing device of claim 15, wherein the second display server includes a compositing window manager, the computing device further comprising:

a first buffer for storing graphics data of the first application window and a second buffer for storing graphics data of the second application window;

wherein the instructions cause the processing device to composite contents of the first buffer and the second buffer and to output the composited contents to a display.

21. The computing device of claim 20, further comprising:

the instructions to cause the processing device to receive a request for graphics data in the first buffer from said second application window, prompt a user to perform authentication, and provide the graphics data to the requesting second application window upon the user successfully performing the authentication.