System for providing a trustworthy user interface

• US 7,302,585 B1
• Filed: 05/25/2000
• Issued: 11/27/2007
• Est. Priority Date: 05/28/1999
• Status: Expired due to Fees

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Proudler, Graeme John, Chen, Liqun, Chan, David, Balacheff, Boris
• Primary Examiner(s): Moise; Emmanuel L.
• Assistant Examiner(s): PYZOCHA, MICHAEL J
• Application Number:
  US09/979,905
• Time in Patent Office: 2,742 Days
• Field of Search: 713/189, 713/190, 726/20
• US Class Current: 713/189
• CPC Class Codes: G06F 21/84 output devices, e.g. displays or monitors
• CPC Class Codes: G06F 2211/009 Trust
• CPC Class Codes: G09C 5/00 Ciphering apparatus or methods not provided for in the preceding groups, e.g. involving the concealment or deformation of graphic data such as designs, written or printed messages
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3273 for mutual authentication network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869
• CPC Class Codes: H04L 9/50 using hash chains, e.g. blockchains or hash trees

Abstract

The preferred embodiment of the invention comprises a computer system which employs a trusted display processor (260), which has a trusted processor (300) and trusted memory (305, 315, 335, 345) physically and functionally distinct from the processor and memory of the computer system. The trusted display processor (260) is immune to unauthorised modification or inspection of internal data. It is physical to prevent forgery, tamper-resistant to prevent counterfeiting, and has crypto functions (340) to securely communicate at a distance. The trusted display processor (260) interacts with a user'"'"'s smartcard (122) in order to extract and display a trusted image, or seal (1000), generate a digital signature of the bitmap of a document image and control the video memory (315) so that other processes of the computer system cannot subvert the image during the signing process. The user interacts with the trusted display processor via a trusted switch (135).

Claims

1. A data processing system capable of operating in a trusted operating mode, the data processing system comprising:

main processing means for executing at least one application process;

a trusted component comprising means for executing a trusted process in a trusted operating mode, means for mutually authenticating the trusted component with a user, means for acquiring trusted seal data associated with the user from a removable secure token having a secure token reader for reading data from and/or writing data to the removable secure token, and means for generating user feedback signals;

at least one user feedback device; and

user feedback processing means for receiving said user feedback signals and controlling the user feedback device on the basis of the signals,

wherein the trusted component comprises means for controlling the user feedback processing means to cause the user feedback device to provide an indication, using the trusted seal data, that the data processing system is operating in a trusted operating mode.

2. A data processing system according to claim 1, further comprising secure user input means, in communication with the trusted component via a secure communications path, by which a user may securely interact with the trusted process.

3. A data processing system according to claim 2, wherein the trusted process comprises plural steps and at least one of the steps is initiated by user interaction with the trusted component via the secure user input means.

4. A data processing system according to claim 1, wherein the trusted component is tamper-resistant.

5. A data processing system capable of operating in a trusted operating mode, the data processing system comprising:

main processing means for executing at least one application process and for generating signals characterising a main image to be displayed;

a trusted component comprising means for executing a trusted process in a trusted operating mode and means for mutually authenticating the trusted component with a computing entity trusted by a user;

display processing means for receiving said signals and generating respective display signals for driving a visual display unit to display the main image,

wherein the trusted component comprises means to acquire from a computing entity trusted by a user trusted image data associated with the user and means to control the display processing means using the trusted image data, in order to indicate to the user that the data processing system is operating in the trusted operating mode, the computing entity being a removable secure token having a secure token reader for reading data from and/or writing data to the removable secure token.

6. A data processing system according to claim 5, wherein the trusted component and the secure token each comprise means to interact with the other in order to execute the trusted process.

7. A data processing system according to claim 6, wherein the trusted component comprises means to control the display processing means to combine the trusted image with the main image to highlight at least a portion of the main image as being associated with execution of the trusted process.

8. A data processing system according to claim 7, wherein the trusted component comprises means to prevent modification by the display processing means of at least the highlighted portion of the main image substantially wile the data processing system is executing the trusted process.

9. A data processing system according to claim 7, wherein the trusted component controls the display processing means to highlight the main image, or portion thereof, by producing one or more of the following visual effects:

a border, or an indicator (or indicators) defining a border, characterised by the trusted image and placed at least partly around the main image or portion thereof;

a background pattern characterised by the trusted image forming at least part of the background of the main image or portion thereof;

an image characterised by the trusted image formed within the main image or portion thereof; and

/or

a text message characterised by the trusted image formed within the main image or portion thereof.

10. A data processing system according to claim 6, wherein the trusted component comprises means to interact with the secure token to execute a trusted process which includes generating a digital signature characteristic of at least a portion of the main image.

11. A data processing system according to claim 5, wherein each of the trusted component and the secure token include non-volatile memory.

12. A data processing system according to claim 11, wherein the trusted component and the secure token each hold a respective private cryptographic key in the respective non-volatile memory.

13. A data processing system according to claim 12, wherein the trusted component and the secure token each contain a digital certificate including a public key which forms a private/public key pair with their respective private key.

14. A data processing system according to claim 13, wherein the trusted component and the secure token each comprise means to receive encrypted data from the other and use their respective private keys to decrypt the encrypted data and/or verify that the encrypted data was encrypted using the corresponding public key.

15. A data processing system according to claim 5, wherein the data characterising the trusted image is stored by the secure token in compressed form and the trusted component comprises means to decompress the data.

16. A data processing system according to claim 5, wherein the data characterising the trusted image is stored by the secure token in encrypted form and the trusted component comprises means to decrypt the data and/or verify that the data was encrypted using a corresponding encryption key.

17. A data processing system according to claim 5, wherein the data characterising the trusted image comprises a series of instructions and the trusted component comprises means to interpret the instructions in order to generate the trusted image data.

18. A data processing system according to claim 5, wherein the display processing means comprises:

frame buffer memory;

a pixel generator to generate pixel data representative of the main image on the basis of the signals received from the main processing means;

a frame buffer refresher to update the pixel data in the frame buffer memory; and

a video controller to repeatedly read the pixel data from the frame buffer memory, generate signals suitable for driving the visual display unit and transmit said signals to the visual display unit to display the image,

and wherein the trusted component comprises means to write the trusted image data, or data derived from the trusted image data, to at least a portion of the frame buffer memory in order to combine the further image with the main image.

19. A data processing system according to claim 5, wherein the trusted component and the user feedback processing means are embodied in a single application-specific integrated circuit or as an appropriately programmed microcontroller.

20. A data processing system according to claim 5, further comprising secure user input means, in communication with the trusted component via a secure communications path, by which a user may securely interact with the trusted process.

21. The data processing system of claim 5, wherein the means to control the display processing means comprise means to combine said trusted image data with at least a portion of the main image in order to indicate to a user that the data processing system is operating in the trusted operating mode.

22. A computer platform capable of operating in a trusted operating mode, the computer platform comprising:

a main processor programmed to execute at least one application process and for generating signals characterising a main image to be displayed;

a trusted component protected against unauthorised modification comprising a trusted component processor programmed to execute a trusted process in a trusted operating mode and means for mutually authenticating the trusted component with a computing entity trusted by a user;

a display processor for receiving said signals and generating respective display signals for driving a visual display unit to display the main image,

wherein the trusted component processor is programmed to acquire from a computing entity trusted by a user trusted image data associated with the user and to control the display processor, using the trusted image data, in order to indicate to the user that the computer platform is operating in the trusted operating mode, the computing entity being a removable secure token having a secure token reader for reading data from and/or writing data to the removable secure token.

23. The computer platform of claim 22, wherein the computing entity is a removable secure token;

and further comprising a secure token reader for reading data from and/or writing data to the removable secure token.

24. The computer platform of claim 22, wherein the trusted component processor is programmed to control the display processor to combine said trusted image data with at least a portion of the main image in order to indicate to a user that the computer platform is operating in the trusted operating mode.

25. A method of providing a trusted user interface in a data processing system comprising a main processor and a trusted component containing a trusted component processor protected from unauthorised modification, the method comprising:

the main processor running an application process to generate main image data and sending the main image data to a display processing system;

the trusted component mutually authenticating itself with a computing entity trusted by a user;

the trusted component processor operating a trusted process and acquiring from the computing entity trusted image data associated with the user, the computing entity being a removable secure token having a secure token reader for reading data from and/or writing data to the removable secure token;

the trusted component processor controlling the output of the display processing system such that it comprises a combination of the trusted image data and the main image data so as to indicate to the user that the data processing system is operating in a trusted mode associated with the trusted process.

26. The method of claim 25, wherein the display processing system comprises a pixel generator, a frame buffer memory, and a video controller for generating data to be displayed by the visual display unit, wherein:

the step of sending the main image data to the display processing system comprises sending the main image data to the pixel generator which converts the main image data into pixel data and writes the pixel data to the frame buffer memory;

the step of producing trusted image data comprises writing the trusted image data into the frame buffer memory; and

the step of passing said combination as displayable data to a visual display unit comprises the video controller repeatedly reading combined pixel data from the frame buffer memory and generating signals suitable for driving the visual display unit to display the image represented by the combined pixel data.

27. The method of claim 25, wherein said combination indicates association of at least a part of the main image data with a trusted process.

28. The method of claim 27, comprising the further step of the trusted component processor preventing modification of the main image data associated with the trusted process during execution of the trusted process.

29. The method of claim 28, comprising preventing alteration of the main image data associated with the trusted process in the frame buffer memory during execution of the trusted process.

30. The method of claim 25, wherein the secure token reader is in communication with the trusted component processor.

31. The method of claim 30, wherein the secure token comprises a secure token processor, and whereby in execution of the trusted process, both the trusted component processor and the secure token processor execute process steps.

32. The method of claim 30, wherein said trusted process includes generating a digital signature for association with at least a part of the main image data or a document associated therewith.

33. The method of claim 30, wherein data exchanged between the secure token processor and the trusted component processor is encrypted.

34. The method of claim 30, wherein the trusted component and the secure token each have a respective memory containing a cryptographic key.

35. The method of claim 30, wherein the step of obtaining data characterising the trusted image data from a secure token of a user comprises the trusted component processor obtaining a series of instructions for generating the trusted image data from the secure token.

36. A method for a computing entity comprised of a removable secure token having a secure token reader for reading data from and/or writing data to the removable secure token, the computing entity being trusted by a user to establish a demonstrably authenticated connection with that user, the method comprising the computing entity:

holding trusted image data identified as being associated with that user;

conducting a mutual authentication process with a computing apparatus used by the user; and

if the mutual authentication process has a satisfactory result, providing the trusted image data to the computing apparatus used by the user for display to the user to demonstrate that a connection to the computing entity trusted by the user exists.