Patent Grant
7559083
The invention relates to processing devices with a user interface. More particularly, the invention relates to processing devices with a non-keyboard user interface.
Computer security is becoming increasingly important. Electronic data is valuable not only to the individuals who generated it, but to competitors who want to acquire it. Traditionally, electronic data is protected only by a user ID/password pair. Once the user ID and password become known, data accessible by the user may be compromised.
One well-known way for an information thief to obtain the user ID/password pair is by creating a “Trojan Horse” program that simulates a login screen. The Trojan Horse program may present a login screen to the user and obtain the user ID/password pair when this information is entered by the user. One mechanism that was developed to prevent this scenario is the Secured Attention Sequence (SAS), which guarantees to the user that the login screen is genuine. In one implementation of the SAS, the “Ctrl”, “Alt” and “Del” keys on the keyboard are pressed simultaneously, while using an operating system, such as a Windows NT® operating system from Microsoft Corporation of Redmond, Wash. The Windows NT® operating systems include Windows NT, Windows 2000 and Windows XP from Microsoft Corporation of Redmond, Wash. Using a secured code path, the SAS action notifies the operating system that the user wishes to authenticate himself or herself to the system.
The secured code path is an exclusive access channel to the keyboard device driver. When the operating system boots, it opens an exclusive communication channel to a keyboard driver. No malicious code can be run in the early stage of an operating system boot. Therefore, the operating system has the first chance to secure this communication channel. Once the channel is secured, no malicious code can tap into this channel for snooping on the communication. Any code trying to open a communication channel with the keyboard later will get “access denied” because it is already opened exclusively by the operating system.
In systems, such as those that are executing a Windows NT® operating system, multiple users can be logged onto the system at the same time. Each user has his/her own session and hence is isolated from other users. Each session has at least two desktops, a default desktop accessible by application programs, including a Trojan Horse program, and a secure desktop having a login dialog, accessible only by the operating system.
As a result of the SAS action, the system will display the secure desktop having the genuine login dialog, such as shown in
Some devices, including but not limited to a Tablet PC, may have input devices other than a keyboard. For example, some of the input devices on the Tablet PC are a pen-shaped stylus and a number of buttons on the case. When such a device does not include a keyboard or the keyboard is folded over or otherwise not available, it is not possible to generate a SAS by pressing keys on a keyboard. Therefore, another method of generating the SAS is needed for such devices.
Aspects of the invention pertain to a processing device having a non-keyboard user interface, thereby addressing at least one problem mentioned above. In an embodiment of the invention, a user makes a gesture indicating a request for a secured attention sequence, wherein the gesture is made without using a keyboard. The secured attention sequence is generated in response to the gesture.
In another aspect of the invention, the gesture includes pressing a button on the device or pressing a combination of two buttons on the device.
In a third aspect of the invention, a secure login screen is displayed as a result of generating the secured attention sequence.
In a fourth aspect of the invention, the generating of the secured attention sequence includes simulating the pressing of the Ctrl key, the Alt key and the Del key on a keyboard.
These and other aspects are described below and in the accompanying figures.
The foregoing summary of the invention, as well as the following detailed description of the drawings, is better understood when read in conjunction with the accompanying drawings, which are included by way of example, and not by way of limitation with regard to the claimed invention.
Exemplary Operating Environment
A basic input/output system 160 (BIOS), containing the basic routines that help to transfer information between elements within the computer 100, such as during start-up, is stored in the ROM 140. The computer 100 also includes a hard disk drive 170 for reading from and writing to a hard disk (not shown), a magnetic disk drive 180 for reading from or writing to a removable magnetic disk 190, and an optical disk drive 191 for reading from or writing to a removable optical disk 192 such as a CD ROM or other optical media. The hard disk drive 170, magnetic disk drive 180, and optical disk drive 191 are connected to the system bus 130 by a hard disk drive interface 192, a magnetic disk drive interface 193, and an optical disk drive interface 194, respectively. The drives and their associated computer-readable media provide nonvolatile storage of computer readable instructions, data structures, program modules and other data for the personal computer 100. It will be appreciated by those skilled in the art that other types of computer readable media that can store data that is accessible by a computer, such as magnetic cassettes, flash memory cards, digital video disks, Bernoulli cartridges, random access memories (RAMs), read only memories (ROMs), and the like, may also be used in the example operating environment.
A number of program modules can be stored on the hard disk drive 170, magnetic disk 190, optical disk 192, ROM 140 or RAM 150, including an operating system 195, one or more application programs 196, other program modules 197, and program data 198. A user can enter commands and information into the computer 100 through input devices such as a keyboard 101 and pointing device 102. Other input devices (not shown) may include a microphone, joystick, game pad, satellite dish, scanner or the like. These and other input devices are often connected to the processing unit 110 through a serial port interface 106 that is coupled to the system bus, but may be connected by other interfaces, such as a parallel port, game port or a universal serial bus (USB). Further still, these devices may be coupled directly to the system bus 130 via an appropriate interface (not shown). A monitor 107 or other type of display device is also connected to the system bus 130 via an interface, such as a video adapter 108. In addition to the monitor, personal computers typically include other peripheral output devices (not shown), such as speakers and printers. In a preferred embodiment, a pen digitizer 165 and accompanying pen or stylus 166 are provided in order to digitally capture freehand input. Although a direct connection between the pen digitizer 165 and the serial port interface 106 is shown, in practice, the pen digitizer 165 may be coupled to the processing unit 110 directly, parallel port or other interface and the system bus 130 as known in the art. Furthermore, although the digitizer 165 is shown apart from the monitor 107, the usable input area of the digitizer 165 may be co-extensive with the display area of the monitor 107. Further still, the digitizer 165 may be integrated in the monitor 107, or may exist as a separate device overlaying or otherwise appended to the monitor 107.
The computer 100 can operate in a networked environment using logical connections to one or more remote computers, such as a remote computer 109. The remote computer 109 can be a server, a router, a network PC, a peer device or other common network node, and typically includes many or all of the elements described above relative to the computer 100, although only a memory storage device 111 has been illustrated in
When used in a LAN networking environment, the computer 100 is connected to the local network 112 through a network interface or adapter 114. When used in a WAN networking environment, the personal computer 100 typically includes a modem 115 or other means for establishing communications over the wide area network 113, such as the Internet. The modem 115, which may be internal or external, is connected to the system bus 130 via the serial port interface 106. In a networked environment, program modules depicted relative to the personal computer 100, or portions thereof, may be stored in the remote memory storage device.
It will be appreciated that the network connections shown are illustrative and other techniques for establishing a communications link between the computers can be used. The existence of any of various well-known protocols such as TCP/IP, Ethernet, FTP, HTTP and the like is presumed, and the system can be operated in a client-server configuration to permit a user to retrieve web pages from a web-based server. Any of various conventional web browsers can be used to display and manipulate data on web pages.
The stylus 204 may be equipped with one or more buttons or other features to augment its selection capabilities. In one embodiment, the stylus 204 could be implemented as a “pencil” or “pen”, in which one end constitutes a writing portion and the other end constitutes an “eraser” end, and which, when moved across the display, indicates portions of the display are to be erased. Other types of input devices, such as a mouse, trackball, or the like could be used. Additionally, a user's own finger could be the stylus 204 and used for selecting or indicating portions of the displayed image on a touch-sensitive or proximity-sensitive display. Consequently, the term “user input device”, as used herein, is intended to have a broad definition and encompasses many variations on well-known input devices such as stylus 204. Region 205 shows a feedback region or contact region permitting the user to determine where the stylus 204 has contacted the display surface 202.
In one implementation, using an operating system such as Microsoft's Windows NT®, the Win32k subsystem establishes secure paths to the secured input devices such as keyboards early during the boot up process by enumerating all input devices and opening exclusive communication channels to the input devices before application programs are started. Win32k opens the channel exclusively so that other programs cannot gain access to the input devices later. Thus, no other applications, such as a Trojan Horse program, can monitor and intercept the input for a SAS action, such as the simultaneous pressing of the “Ctrl”, “Alt” and “Del” keys.
With reference to
The present invention has been described in terms of preferred and exemplary embodiments thereof. Numerous other embodiments, modifications and variations within the scope and spirit of the appended claims will occur to persons of ordinary skill in the art from a review of this disclosure.
| Number | Name | Date | Kind |
|---|---|---|---|
| 4672572 | Alsberg | Jun 1987 | A |
| 5596718 | Boebert et al. | Jan 1997 | A |
| 6212651 | Schieve et al. | Apr 2001 | B1 |
| 20030236935 | Amemiya et al. | Dec 2003 | A1 |
| Number | Date | Country | |
|---|---|---|---|
| 20040139351 A1 | Jul 2004 | US |
