FACILTIATING USER INTERACTION WITH MULTIPLE DOMAINS WHILE PREVENTING CROSS-DOMAIN TRANSFER OF DATA

• US 20140282050A1
• Filed: 03/13/2013
• Published: 09/18/2014
• Est. Priority Date: 03/13/2013
• Status: Active Grant

• Current Assignee: Assured Information Security, Inc.
• Original Assignee: Assured Information Security, Inc.
• Inventors: Kerrigan, Brendan, QUINN, Rian
• Granted Patent: US 9,335,886 B2
• Time in Patent Office: Days
• US Class Current: 715/744
• CPC Class Codes: G06F 2203/04803 Split screen, i.e. subdividing the display area or the window area into separate subareas
• CPC Class Codes: G06F 3/0481 based on specific properties of the displayed interaction object or a metaphor-based environment, e.g. interaction with desktop elements like windows or icons, or assisted by a cursor's changing behaviour or appearance
• CPC Class Codes: G06F 9/452 Remote windowing, e.g. X-Window System, desktop virtualisation protocols for virtual reality H04L67/131

Abstract

User interaction with multiple domains is facilitated while preventing cross-domain transfer of data from those domains. A compositioning domain facilitates this interaction in a secure manner in which cross-domain transfer of data is prevented. This includes obtaining pixel information from the domains via one or more read-only communication paths, providing a user interface to the user, which includes providing a display buffer including at least some of the pixel information obtained from each domain of the domains for display to the user, and maintaining an in-focus domain state. The in-focus domain state indicates which domain of the domains is currently in-focus. User input from the user based on the user interface is provided by a user input handler directly to the currently in-focus domain indicated by the in-focus domain state absent transfer of the user input to the compositioning domain.

Claims

1. A method for facilitating user interaction with multiple domains in which applications execute, the method comprising:

providing, by a processor, a compositioning domain to facilitate interaction between a user and at least two domains in which applications execute, the at least two domains executing as separate execution environments for executing their respective applications, wherein the compositioning domain facilitates interaction between the user and the at least two domains in a secure manner in which cross-domain transfer of data is prevented, wherein the facilitating interaction comprises;

obtaining pixel information from the at least two domains via one or more read-only communication paths;

providing a user interface to the user, the providing comprising providing a display buffer of the compositioning domain, the display buffer comprising at least some of the pixel information obtained from each domain of the at least two domains for display to the user; and

maintaining an in-focus domain state indicating which domain of the at least two domains is currently in-focus, wherein user input from the user based on the user interface is provided by a user input handler directly to the currently in-focus domain indicated by the in-focus domain state absent transfer of the user input to the compositioning domain.

2. The method of claim 1, wherein the compositioning domain obtains the pixel information from a display buffer of each domain of the at least two domains via the one or more read-only communication paths.

3. The method of claim 2, wherein obtaining the pixel information comprises extracting pixel information of one or more graphical user interface windows of the first domain from the display buffer of the first domain and extracting pixel information of one or more graphical user interface windows of the second domain from the display buffer of the second domain.

4. The method of claim 3, wherein providing the user interface further comprises providing the extracted pixel information to the display buffer of the compositioning domain for output to the user via at least one display device.

5. The method of claim 2, wherein providing the user interface further comprises adding pixel information to the obtained pixel information from the at least two domains, wherein the added pixel information adds pixels to the display buffer of the compositioning domain to identify the window from the first domain as being from the first domain, and to identify the window from the second domain as being from the second domain.

6. The method of claim 1, wherein maintaining the in-focus domain state comprises monitoring the user input from the user to detect interaction with pixels from a domain other than the in-focus domain, and wherein, based on detecting interaction with pixels from the other domain, the compositioning domain switches focus to the other domain as the in-focus domain.

7. The method of claim 6, wherein, based on the switch in focus to the other domain as the in-focus domain, user input from the user is provided by the user input handler directly to the other domain by the compositioning domain.

8. The method of claim 1, wherein the compositioning domain executes as a first guest machine of a hypervisor, and wherein the at least two domains execute as at least two additional guest machines of the hypervisor separate from the first guest machine.

9. The method of claim 8, wherein the user input handler is of a component of the hypervisor.

10. The method of claim 8, wherein the hypervisor prevents write access for the first guest machine to the at least two additional guest machines by indicating that memory pages of each guest machine of the at least two additional guest machines are read-only by the first guest machine.

11. The method of claim 10, wherein the user input is directly provided to the guest machine of the in-focus domain, and wherein, based on preventing the write access to the at least two additional guest machines, and based on directly providing the user input to the guest machine of the in-focus domain, transfer of data between the at least two additional guest machines is prevented.

12. A system for facilitating user interaction with multiple domains in which applications execute, the system comprising:

a memory; and

a processor in communication with the memory, wherein the system is configured to perform a method comprising;

providing a compositioning domain to facilitate interaction between a user and at least two domains in which applications execute, the at least two domains executing as separate execution environments for executing their respective applications, wherein the compositioning domain facilitates interaction between the user and the at least two domains in a secure manner in which cross-domain transfer of data is prevented, wherein the facilitating interaction comprises;

obtaining pixel information from the at least two domains via one or more read-only communication paths;

providing a user interface to the user, the providing comprising providing a display buffer of the compositioning domain, the display buffer comprising at least some of the pixel information obtained from each domain of the at least two domains for display to the user; and

maintaining an in-focus domain state indicating which domain of the at least two domains is currently in-focus, wherein user input from the user based on the user interface is provided by a user input handler directly to the currently in-focus domain indicated by the in-focus domain state absent transfer of the user input to the compositioning domain.

13. The system of claim 12, wherein the compositioning domain obtains the pixel information from a display buffer of each domain of the at least two domains via the one or more read-only communication paths.

14. The system of claim 13, wherein obtaining the pixel information comprises extracting pixel information of one or more graphical user interface windows of the first domain from the display buffer of the first domain and extracting pixel information of one or more graphical user interface windows of the second domain from the display buffer of the second domain, and wherein providing the user interface further comprises providing the extracted pixel information to the display buffer of the compositioning domain for output to the user via at least one display device.

15. The method of claim 13, wherein providing the user interface further comprises adding pixel information to the obtained pixel information from the at least two domains, wherein the added pixel information adds pixels to the display buffer of the compositioning domain to identify the window from the first domain as being from the first domain, and to identify the window from the second domain as being from the second domain.

16. The system of claim 12, wherein maintaining the in-focus domain state comprises monitoring the user input from the user to detect interaction with pixels from a domain other than the in-focus domain, wherein, based on detecting interaction with pixels from the other domain, the compositioning domain switches focus to the other domain as the in-focus domain, and wherein, based on the switch in focus to the other domain as the in-focus domain, user input from the user is provided by the user input handler directly to the other domain by the compositioning domain.

17. The system of claim 12, wherein the compositioning domain executes as a first guest machine of a hypervisor, wherein the at least two domains execute as at least two additional guest machines of the hypervisor separate from the first guest machine, and wherein the user input handler is of a component of the hypervisor.

18. The system of claim 17, wherein the hypervisor prevents write access for the first guest machine to the at least two additional guest machines by indicating that memory pages of each guest machine of the at least two additional guest machines are read-only by the first guest machine, wherein the user input is directly provided to the guest machine of the in-focus domain, and wherein, based on preventing the write access to the at least two additional guest machines, and based on directly providing the user input to the guest machine of the in-focus domain, transfer of data between the at least two additional guest machines is prevented.

19. A computer program product comprising:

a tangible storage medium storing program instructions readable by a processor for execution to perform a method comprising;

providing a compositioning domain to facilitate interaction between a user and at least two domains in which applications execute, the at least two domains executing as separate execution environments for executing their respective applications, wherein the compositioning domain facilitates interaction between the user and the at least two domains in a secure manner in which cross-domain transfer of data is prevented, wherein the facilitating interaction comprises;

obtaining pixel information from the at least two domains via one or more read-only communication paths;

providing a user interface to the user, the providing comprising providing a display buffer of the compositioning domain, the display buffer comprising at least some of the pixel information obtained from each domain of the at least two domains for display to the user; and

maintaining an in-focus domain state indicating which domain of the at least two domains is currently in-focus, wherein user input from the user based on the user interface is provided by a user input handler directly to the currently in-focus domain indicated by the in-focus domain state absent transfer of the user input to the compositioning domain.

20. The computer program product of claim 19, wherein the compositioning domain obtains the pixel information from a display buffer of each domain of the at least two domains via the one or more read-only communication paths.

21. The computer program product of claim 20, wherein obtaining the pixel information comprises extracting pixel information of one or more graphical user interface windows of the first domain from the display buffer of the first domain and extracting pixel information of one or more graphical user interface windows of the second domain from the display buffer of the second domain, and wherein providing the user interface further comprises providing the extracted pixel information to the display buffer of the compositioning domain for output to the user via at least one display device.

22. The computer program product of claim 20, wherein providing the user interface further comprises adding pixel information to the obtained pixel information from the at least two domains, wherein the added pixel information adds pixels to the display buffer of the compositioning domain to identify the window from the first domain as being from the first domain, and to identify the window from the second domain as being from the second domain.

23. The computer program product of claim 19, wherein maintaining the in-focus domain state comprises monitoring the user input from the user to detect interaction with pixels from a domain other than the in-focus domain, wherein, based on detecting interaction with pixels from the other domain, the compositioning domain switches focus to the other domain as the in-focus domain, and wherein, based on the switch in focus to the other domain as the in-focus domain, user input from the user is provided by the user input handler directly to the other domain by the compositioning domain.

24. The computer program product of claim 19, wherein the compositioning domain executes as a first guest machine of a hypervisor, wherein the at least two domains execute as at least two additional guest machines of the hypervisor separate from the first guest machine, and wherein the user input handler is of a component of the hypervisor.

25. The computer program product of claim 24, wherein the hypervisor prevents write access for the first guest machine to the at least two additional guest machines by indicating that memory pages of each guest machine of the at least two additional guest machines are read-only by the first guest machine, wherein the user input is directly provided to the guest machine of the in-focus domain, and wherein, based on preventing the write access to the at least two additional guest machines, and based on directly providing the user input to the guest machine of the in-focus domain, transfer of data between the at least two additional guest machines is prevented.