DEVICE, SYSTEM, AND METHOD OF SECURE ENTRY AND HANDLING OF PASSWORDS

• US 20130301830A1
• Filed: 01/14/2013
• Published: 11/14/2013
• Est. Priority Date: 05/08/2012
• Status: Abandoned Application

• Current Assignee: Arm Limited (SoftBank Group Corp.)
• Original Assignee: Hagai Bar-El, Roni Sasson
• Inventors: BAR-EL, Hagai, SELLA, Yaacov, ZIV, Alon, SASSON, Roni
• Application Number:
  US13/740,291
• Publication Number:
  US 20130301830A1
• Time in Patent Office: Days
• US Class Current: 380/210
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 21/83 input devices, e.g. keyboards, mice or controllers thereof
• CPC Class Codes: G06F 21/84 output devices, e.g. displays or monitors
• CPC Class Codes: G09C 5/00 Ciphering apparatus or methods not provided for in the preceding groups, e.g. involving the concealment or deformation of graphic data such as designs, written or printed messages
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/603 Digital right managament [DRM]
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 9/08 Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords network architectures or network communication protocols for supporting key management in a packet data network H04L63/06
• CPC Class Codes: H04L 9/0894 Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 : using certificates or pre-shared keys

Abstract

Devices, system, and methods of secure entry and handling of passwords and Personal Identification Numbers (PINs), as well as for secure local storage, secure user authentication, and secure payment via mobile devices and via payment terminals. A mobile electronic device includes: a secure execution environment (SEE) to securely execute code; and a secure video path (SVP) to securely exchange information between the SEE and a touch-screen of the mobile electronic device; wherein the SEE includes a secure password entry module to generate a scrambled on-screen interface, and to send the scrambled on-screen interface to the touch-screen through the SVP.

Claims

1. A mobile electronic device comprising:

a secure execution environment (SEE) to securely execute code;

a secure video path (SVP) to securely exchange information between the SEE and a touch-screen of the mobile electronic device;

wherein the SEE comprises a secure password entry module to generate a scrambled on-screen interface, and to send the scrambled on-screen interface to the touch-screen through the SVP.

2. The mobile electronic device of claim 1, wherein the secure password entry module comprises:

a touch-event recognizer to securely identify within the SEE a character which corresponds to a virtual key that a user selected via the touch-screen on the scrambled on-screen interface.

3. The mobile electronic device of claim 1, comprising:

a secure content channel to transport the scrambled on-screen interface, securely against interception, from the SEE to the touch-screen.

4. The mobile electronic device of claim 1, comprising:

a secure content channel to transport the scrambled on-screen interface, from the SEE to the touch-screen, as an encoded Digital Rights Management (DRM) protected video.

5. The mobile electronic device of claim 4, comprising:

a DRM-enabled playback module to playback the encoded DRM-protected video representing the scrambled on-screen interface.

6. The mobile electronic device of claim 1, wherein the scrambled on-screen interface comprises at least one of:

an on-screen scrambled virtual keyboard;

an on-screen scrambled virtual keypad;

an on-screen representation of wheels of digits, wherein each wheel is rotatable in response to a user gesture on the touch-screen.

7. The mobile electronic device of claim 1, wherein the scrambled on-screen interface comprises a user-specific authenticity reassurance image.

8. The mobile electronic device of claim 7, wherein the user-specific authenticity reassurance image comprises a user-uploaded image captured by the user through a camera of the mobile electronic device.

9. The mobile electronic device of claim 8, wherein the SEE comprises code to securely modify, based on a user command, one or more visible properties of said image prior to an upload of said image.

10. The mobile electronic device of claim 7, wherein the SEE comprises code to securely modify, based on a user command, one or more visible properties of the user-specific authenticity reassurance image subsequent to selection of the user-specific authenticity reassurance image from a collection of images.

11. The mobile electronic device of claim 7, wherein the user-specific authenticity reassurance image comprises at least one of:

an image overlaid as a watermark on top of the scrambled on-screen interface;

an image overlaid as a watermark under the scrambled on-screen interface;

an image displayed in proximity to the scrambled on-screen interface.

12. The mobile electronic device of claim 1, wherein the SVP comprises a uni-directional SVP to send information securely only in a direction from the SEE to the touch-screen of the mobile electronic device.

13. The mobile electronic device of claim 1, wherein the mobile electronic device comprises a device selected from the group consisting of:

a laptop computer, a tablet, a smartphone, a portable computing device, a portable gaming device, a portable multimedia player, and a portable payment terminal.

14. The mobile electronic device of claim 1, comprising:

a secure storage unit to securely store a cryptographic key, wherein the cryptographic key is unique to a particular task to be performed by said mobile electronic device; and

a cryptographic operations module to release the cryptographic key from the secure storage unit based on a user gesture, received through said touch screen and indicating confirmation, and to utilize the cryptographic key for performing a cryptographic operation associated with said particular task.

15. The mobile electronic device of claim 14, wherein the cryptographic key is also unique to a user of said mobile electronic device.

16. The mobile electronic device of claim 14, wherein the cryptographic operation comprises at least one of:

encryption using the cryptographic key;

decryption using the cryptographic key.

17. The mobile electronic device of claim 16, wherein the cryptographic operation comprises a cryptographic operation transparent to said particular task on said mobile electronic device.

18. The mobile electronic device of claim 14, wherein said particular task, for which said cryptographic key is unique comprises a task of unlocking access to an entirety of a storage unit of said mobile electronic device.

19. The mobile electronic device of claim 1, further comprising:

a payment card reader to read a payment card swiped therethrough; and

a visual indicator to indicate to a user that the secure password entry module is activated and that the user can swipe the payment card through the payment card reader.

20. The mobile electronic device of claim 19, wherein the payment card reader is operational when the secure password entry module is activated, and wherein the payment card reader is non-operational when the secure password entry module is non-activated.

21. The mobile electronic device of claim 19, comprising:

a secure operations module to securely receive, from the secure password entry module, a password entered by a user via said touch-screen;

to encrypt the password; and

to send the encrypted password for verification at a verification module external to the mobile electronic device;

wherein the verification module external to the mobile electronic device is to send a verification response indicating whether or not the password is verified;

wherein the verification module comprises at least one of;

a remote server, and a smart-card external to the mobile electronic device.

22. The mobile electronic device of claim 19, wherein in response to a user entering a password via said scrambled on-screen interface on said touch-screen, the mobile electronic device is to send, to a remote server, a message indicating touch coordinates to enable the remote server to determine the password and to initiate a process of verifying the password;

wherein the mobile electronic device is unaware of the password entered by said user.

23. A server comprising:

a secure execution environment (SEE) system to securely execute code;

wherein the SEE system comprises a secure password entry module (a) to generate a scrambled on-screen interface, and (b) to send the scrambled on-screen interface, as an encoded Digital Rights Management (DRM) protected video to a remote mobile device.

24. The server of claim 23, wherein the encoded DRM-protected video, when played by a DRM-enabled playback module of the remote mobile device, causes a touch-screen of the remote mobile device to securely display said scrambled on-screen interface generated by the SEE system of said server.

25. The server of claim 23, wherein the scrambled on-screen interface comprises at least one of:

an on-screen scrambled virtual keyboard;

an on-screen scrambled virtual keypad;

an on-screen representation of wheels of digits, wherein each wheel is rotatable in response to a user gesture on a touch-screen.

26. The server of claim 23, wherein the scrambled on-screen interface comprises a user-specific authenticity reassurance image.

27. The server of claim 23, comprising:

a verification module to verify a user-entered password entered on said scrambled on-screen interface via a touch-screen of the remote mobile device,

wherein the verification module is to receive from said remote mobile device a message indicating touch coordinates corresponding to touch gestures of a user on said touch-screen,

wherein the verification module determines the user-entered password from said touch coordinates while the user-entered password remains unknown to the remote mobile device