Patent Application
20150249688
1. Field of the Invention
The present embodiments relate to devices, methods, systems, and computer programs for improving security, and more particularly to devices, methods, systems, and computer programs for improving security embedded in a presentation display.
2. Description of the Related Art
Rapid evolution of technology and mass adoption of cheap devices, such as tablets and electronic readers with high definition displays, digital cameras, 3D printers, 3D scanners, high capacity flash storage cards with embedded WiFi, wide spread availability of Internet services, etc., have introduced challenges to businesses and individuals to protect, preserve, and enhance their intellectual property and intellectual assets.
It is in this context that embodiments arise.
Devices, methods, computer programs, and are presented for displaying information output of a host computer. It should be appreciated that the present embodiments can be implemented in numerous ways, such as a method, an apparatus, a system, a device, or a computer program on a computer readable medium. Several embodiments are described below.
Devices, methods, and computer programs are presented for managing data security. One example method includes receiving user identification information from a screen of a device that is connectable to a database of secure information. The method includes authenticating the user identification information, the authenticating includes capturing image data of a user associated with the user identification information. The method provides access to the database of secure information upon authenticating the user identification information, such that while the access is provided the capturing of the image data of the user is maintained. The method records data of user interactive input and viewed images displayed on the screen while the access provided. The method stores audit data for the user when accessing the database of secure information, the audit data being associated with a history of use by the user. The audit data including a plurality of events associated with the use. The method enables replay of the audit data for at least one of the plurality of events associated with the use.
Other aspects will become apparent from the following detailed description, taken in conjunction with the accompanying drawings.
The embodiments may best be understood by reference to the following description taken in conjunction with the accompanying drawings.
The following embodiments describe devices, methods, systems and computer programs for improving security. In one embodiment, a monitor is embedded with security circuitry to implement security on the monitor in order to protect the information presented at the monitor.
It will be apparent, that the present embodiments may be practiced without some or all of these specific details. In other instances, well known process operations have not been described in detail in order not to unnecessarily obscure the present embodiments.
Digital Cameras are now being embedded into eyewear glasses, ID cards, pens, key chains, barcode scanners, and many are capable of shooting HD quality pictures at 30 frames per second or more. Taking ‘copies’ of IPR assets, creative designs, PII (Personally Identifiable Information), PHI (Personal Health Information) is now a major business issue worldwide for businesses, governments, and individuals. Stolen information can be transmitted anywhere bypassing existing security measures employed today, such as multi factor biometric access control, firewalls, intrusion detection systems, Data Leak Prevention (DLP) systems, Physical Access Control 15 Systems (PACS), etc.
Digital Data can be vulnerable to a breach in any of the commonly recognized 4 data states:
1. “data in motion” (i.e., data that is moving through a network, including wireless transmission)
2. “data at rest” (i.e., data that resides in databases, file systems, and other structured storage methods)
3. “data in use” (i.e., data in the process of being created, retrieved, updated, or deleted)
4. “data disposed” (e.g., discarded paper records or recycled electronic media)
Sensitive data in each of these data states (with the possible exception of “data in use”) may be secured using methods that render sensitive data unusable, unreadable, or indecipherable to unauthorized individuals, such as encryption and destruction.
The exception case of “data in use” is a major issue because the data may be “leaked” via different channels: a digital image taken with a digital camera, “copy/cut/paste” of email contents, a file copy, a “print screen” to an electronic file, etc.
While several solutions have attempted to solve the Digital copying problem, the solutions have failed to address the Human factor component to act as a deterrent. (References: JP2001313006 ANTI-PHOTOGRAPH-STEALING DEVICE BY INFRA-RED LIGHT; REMOTE CONTROL SYSTEM AND ACCESS CONTROL METHOD FOR INFORMATION INPUT APPARATUS US20060242254, SYSTEMS AND METHODS FOR RECEIVING INFRARED DATA WITH A CAMERA DESIGNED TO DETECT IMAGES BASED ON VISIBLE LIGHT US20110128384A1, US20040202382 Image capture method, device and system, US20100323608A1 System and method for preventing photography, Systems and methods for disabling recording features of cameras US20070103552).
These solutions do not address the data in use leak channel via computer display, also called the “last inch/millimeter” interface from the display to the user security, a vulnerability that has been present ever since computers became prevalent.
In addition, some embodiments provide circuitry that is embedded inside a computing device (e.g., a display). In other embodiments, the security solution may be distributed across two or more different devices. For example, a separate computing device may be installed between a display and a personal computer, where the computing device is also attached to a camera that monitors the user in front of the display.
The secure displays provide in-display security enforcement, and the displays are in communication with one or more remote security servers. In one embodiment the security servers include a policy server 214, a remote policy enforcer 216, and an administrator console 218. The policy server 214 enforces security policies configured by the administrator 220, and the remote enforcer 216 receives information from the remote secure displays and provides security commands that are transmitted to the secured displays. The administrator console 218 provides a Graphical User Interface (GUI) for configuring the security policies implemented by the system, including the creation, modification, and deletion of users, security levels, security rules, logging requirements, etc.
In
The wireless communication module 310 (e.g., a WiFi transceiver) provides an alternate channel of communication from the secure display to a remote security server, which is a different communications channel from the network connection utilized by the personal computer 304. This alternate communication channel provides a robust security solution that does not rely on the assets in the personal computer 304, such as a NIC card for connecting to the network.
Besides IPR protection management, the secure embodiments presented herein may be used for applications in work flow tracking and optimization, manufacturing, testing, quality assurance, payment systems, and DRM applications. Embodiments prevent the copying or misuse of information displayed on any monitor by employing continuous context-based smart activity processing technology. In one embodiment, every user in the range of visibility of the monitor is continuously monitored and authenticated.
In an exemplary embodiment, the secure display monitor 202 includes a security control integrated circuit (IC) that interfaces with other modules within the display 202. The display further includes a display panel (e.g., an LCD) IC 404 that drives the display panel 410, a display buffer memory 406 for storing pixel data to be displayed on the LCD 404, a side band network interface 408, and one or more sensors 416.
The security control integrated circuit 402 shares a link to the host computer with the display panel IC 404. This link provides the data to be displayed on the monitor and may utilize one or more different protocols such as HDMI, DVI, DP, etc. In addition, the security control IC 402 utilizes the side band network interface 408 to communicate with a remote security server without having to rely on networking resources from the host. The side band network interface 408 may utilize one or more communications protocols selected from a group consisting of USB, serial port, Ethernet, WiFi, Bluetooth, GPRS, any mobile communications protocol, etc.
The sensors 416 integrated in the display may include one or more of an infrared sensor, image sensor, proximity sensor, biometric sensor (e.g., fingerprint, eye recognition, etc.), Brain Computer Interface (BCI) with integrated NFC, RFID, magnetic card reader, microphone, speaker, etc. In one embodiment, the sensors 416 monitor communications near the monitor such as communications utilizing a mobile phone 412, or a smart card 414 being utilized by the user 302.
It is noted that the embodiments illustrated in
In another embodiment, user 502 is also authorized to operate with display 202. However, there is a security policy that only one user is able to access the display at any time, which causes the display being halted for having too many users accessing the display. This security policy may be useful when different users may access the same computing device, but the users may have different access levels when using the computing device. By disabling two users from accessing the display at the same time, the different security levels are enforced.
In one embodiment, the collected information include user images 710, screen captures 708, audio segments 706, images from area cameras 704, and sensor data 702. The user images are taken with the camera integrated in the display, or attached to the display, to provide information regarding the user or users situated in front of the display. Policy rules defined how often pictures of the user are taken or under what circumstances. In one embodiment, the images are taking every minute, although other intervals may also be configured. In addition, the user images may also be obtained when there are changes in front of the display (e.g., a new user enters the area) or when there is a large amount of data (e.g., beyond a threshold level of data per unit of time) being downloaded on the display. This guarantees that if a user is accessing a large amount of information, the user's image is captured.
The screen captures 708 provide, as its name implies, information regarding the appearance of the display at a given point in time. Similarly to the case of user images, screen captures may be obtained periodically or be triggered by security events. In one embodiment, the amount of data captured in the screen captures is reduced by eliminating some of the background information (e.g., Windows background photo) which is considered irrelevant for security purposes.
Audio segments 706 may also be obtained periodically or when triggered by a security event (e.g., voices detected near the secure display). Room cameras 704 provide images of an area where the display is situated (e.g. a room with a plurality of cubicles with workers in the cubicles). The sensor data 702 provides information collected by the sensors, such as temperature, humidity, air pressure, etc., and may be collected periodically or triggered under certain events.
It is noted that the embodiments illustrated in
In one embodiment, the biometric identity of the user is tied with the centrally available authentication system that uses a username and password, or any other additional data, such as physical location information, time and date, etc. The authentication utilizes multiple pieces of information to establish a physical presence of the user, which is integrated with the trusted display and computer. The trusted (e.g., secured) display device is both first and last point of interface to the user and any protected information and services are protected and available for use by an authorized user.
In one embodiment, the user is continuously authenticated throughout the session, based on physical presence and using data signals from multiple sensors integrated with the Display such as cameras, microphones, speakers, IR detectors, thermometers, proximity sensors. In one embodiment, additional inputs from other external sensors are utilized, such as pressure sensors, weight sensors, surveillance cameras in close proximity to the secured monitor in front of the user, IP addresses, MAC addresses, physical location data, etc., to improve system accuracy.
In one embodiment, the secure display is built by adding the security circuit 906, camera 308, and WiFi module 118 to an existing display. In another embodiment, the secure display is built at a factory including all the modules identified in
The security circuit 906 analyzes images captured with image capture device 308, which may be stored in memory 108 or in a dedicated memory within security circuit 906. The image analysis is utilized to provide authentication of the user 302 interfacing with the secure display, as well as for detecting security events related to unauthorized use, such as use by multiple users, user not present in front of the display, an authorized photograph taken of the display, etc.
The security circuit 906 transmits security related data (e.g., see above with reference to
An area camera 102 takes images of the work area of the user 302, and may include the work area of other users. For example, an area camera 102 may take images of a plurality of cubicles in an office, a hallway in an office floor, an office with several desks, the lobby of a building, etc.
The security circuit 906 is attached to the bus 140 and controls the output to LCD 902, by interfacing with the circuitry that drives the LCD 902 (e.g., processor 106 and pixel memory 112). In addition, the security circuit 906 interfaces with WiFi module 119 to send security data to security server 912 and to receive security and configuration commands from security server 912. In one embodiment, the security server sends authorized user information to the security server 906 information regarding the users authorized to utilize the secure display, the policy rules for implementing security in the secure display, login parameters, authenticated devices that may be utilized secure display 202 (e.g. computing device 304), etc.
In one embodiment, the security circuit 906 manages the authentication of the host computing device via an authentication module 142 embedded in the video interface 122 coupled to the video interface 908 in the host. In one embodiment, Trusted Platform Module (TPM) authentication is utilized, but other methods of authentication are also possible. TPM is both the name of a published specification detailing a secure cryptoprocessor that can store cryptographic keys that protect information, as well as the general name of implementations of that specification, often called the “TPM chip” or “TPM Security Device”.
The Trusted Platform Module offers facilities for the secure generation of cryptographic keys, and limitation of their use, in addition to a hardware pseudo-random number generator. It also includes capabilities such as remote attestation and sealed storage. “Remote attestation” creates a nearly unforgeable hash-key summary of the hardware and software configuration. The program encrypting the data determines the extent of the summary of the software. This allows a third party to verify that the software has not been changed. “Binding” encrypts data using the TPM endorsement key, a unique RSA key burned into the chip during its production, or another trusted key descended from it. “Sealing” encrypts data in similar manner to binding, but in addition specifies a state in which the TPM must be in order for the data to be decrypted (unsealed). Software can use a Trusted Platform Module to authenticate hardware devices. Since each TPM chip has a unique and secret RSA key burned in as it is produced, it is capable of performing platform authentication. For example, it can be used to verify that a system seeking access is the expected system. Generally, pushing the security down to the hardware level in conjunction with software provides more protection than a software-only solution.
In one embodiment, a security monitor cloud service provides storage 1308 and processing capacity 1310 for performing security related operations, such as searching security data, analyzing data, detecting possible threats within the data, etc. A security monitor management gateway 1312 acts as the interface between the security management console system 1302 and the security monitor cloud service 1306.
In one embodiment, the computing resources 1310 are utilized for implementing the security policy, as defined by the administrator utilizing the security management console system 1302. In one embodiment, the security policy comprises a plurality of security rules, where each security rule defines one or more actions to be performed when certain conditions are met.
In one embodiment, security monitor cloud service 1306 is also utilized to monitor the out-of-band communications originated at the protected visual security zone 1314, such as mobile telephony communications, or any other type of wireless or wired communications taking place within the protected visual security zone 1314.
The communications module 350 manages the communications with the remote secure displays, as well as other network communications regarding the management and administration of the secure server architecture. The administration module 352 provides options, user interfaces, help, etc. regarding the administration of the secure environment. An administration GUI 354 provides a user interface for authenticating access by one or more administrators and for setting the administration parameters required to configure, update, delete, service, etc., the security architecture service.
The remote enforcement module 356 exchanges management and control messages with the secure terminals, and more specifically with the security circuitry in the secure terminals. For example, the remote enforcement module 356 may send commands to a security display regarding policy rules be implemented at the secure terminal, users authenticated to use the secure display, hosts computers authenticated to interface with the secure display, authentication keys, instructions to disable or enable the remote display, etc. The remote enforcement module 356 manages the data stored in a secure database 366, including all the information received from secure displays.
The policy module 358 manages the security policy and the rules comprising the security policy, regarding the authorized use of secure displays. The security policy rules may be configured via the administration GUI 354. More details with reference to policy rules are given below with reference to
It is noted that the embodiment illustrated in
In one embodiment, separate enterprise physical access control system (PACs) network is utilized to connect the secure monitor management gateway to the security management console system.
The logging of data is event driven, as discussed above. In one embodiment, the events may fall within different categories, such as normal events, exceptional events, administration events, etc. In addition, the events may be time sliced, that is, a plurality of data items related to the secure display are captured simultaneously.
In one embodiment, a GUI is provided to users of the secure displays in order to enable the users to view or get limited access to the information logged by the secure system. The user may be given total or partial access to the information. In one embodiment, the user is able to select an option to request the deletion of some data from the system. For example, a user may identify that during a certain period of time the user was accessing personal information on the display, and the user may wish to have the information removed from the system. An administrator will then determine if the request is granted or denied.
In one embodiment, user feedback is provided via a signal light similar to a video camera. The “light is on” indicator signals that “recording” is taking place. The secure monitor may also provide audio cues including different tones or computerized voice message, etc. The audio cues alert the user that their activity is being actively tracked.
In another embodiment, software selectable buttons are provided via a software menu or via hardware buttons on the monitor, similar to the buttons on a DVR for play back of activities at any time. The alert light and the playback reinforce the message that their activity has been recorded and available for anyone to “see” including themselves, thus eliminating the “opportunity” for theft, enabling “rationalization” of good citizen behavior, reducing incentives ROI for quick profit, etc. The hardware or software buttons may also be controlled via access control so that only the appropriate user can access the stored data.
In one embodiment, tagging the image of a user to the computer interactions enables the tracking of computer generated transactions regarding applications and data, utilizing the user image as the tag or key. Additionally, other tags may also be utilized for searches, such as a computer display screen image. Thus, data might be searched utilizing the user image key, a screen capture, time, location, etc., in order to better track user's activities.
By linking the image key to other meta data such as IP address, MAC address, CPU ID, etc., it is possible to track, search and manage user activities by linking these keys to existing network and server log commercial product solutions.
In one embodiment, and Application Programming Interface (API) is provided to enable data access on user image key, screen image key, or some other capture security information. Current network and server log management often involve complex user interfaces. For example, some search approaches utilize Regex operations extensively. By using the “user image” key approach, log maintenance interface and activity is improved since humans are better at using visual techniques when compared to computers.
In one embodiment, the API enabling the use of user image keys and display screen keys, plus the associated metadata, to interface with, is used to enhance existing video surveillance equipment and physical access control products.
In one embodiment, the user image key may be utilized at point-of-sales (POS) terminals to provide secure transactions while eliminating the threats of credential attacks. In addition, in one embodiment, the display screen image is utilized, by performing OCR, to extract and track itemized transaction details, such as product, price, store, aisle location, cash paid, credit debit card used, coupons used, etc.
In one embodiment, the POS retail user data is gathered to provide custom services such as expense tracking, serving shopping deals, etc., by providing arbitrage interfaces to commerce, such as a shop retailer, a bank or a product vendor. In addition, it is possible to enhance Bank, remote teller ATM, ACH, mobile payments transactions security, to eliminate physical credential attacks that are common today.
The events that may trigger a policy rule may include one or more of a timer expiring, detection of a security threat, detection of an unauthorized user, detection of the use of an unauthorized application, setting a timer, detection of a photo taken of the display, detection of multiple users in front of the display, detection of an unauthorized user, detection of voices or other sounds near the display, detection of the temperature above a certain threshold temperature, detection of an RFID card near the secure display, detection of the establishment of a mobile phone call near the display, etc.
In one embodiment, a plurality of conditions associated with events may be combined utilizing logical operators (e.g., AND, OR, NOT, etc.). The policy rules may be implemented at the central security server, at the secure display, or both at the secure display and a central security server. In one embodiment, a first set of rules is downloaded to the secure display for implementation by the security circuitry inside the secure display. In addition, a second set of rules is implemented at the central security server.
In another embodiment, a third set of rules are implemented that correlate information regarding more than one secure terminal. For example, a policy rule may define to set up an alarm when all the secure displays in a room are left alone (e.g., there is no user sitting in front of any of the secure displays).
The option to search data 452 opens a new window that enables the administrator to enter search parameters for searching the security database. The search parameters may include a period of time, user ID, display ID, log data (e.g., “find users from building 7 that were using the word processor on Monday between 1:00 PM and 3 PM”), etc.
The alarms option 454 provides a separate window to set alarms, modify alarms, delete alarms, or review alarm information created by the system. The policy configuration 456 option enables administrator to set the policy rules, such as those described above with reference to
The client configuration option 458 enables the administrator to modify the client configuration (e.g., add, delete, or modify users or remote displays). Information window 466 shows a partial listing of terminal information, including user is authorized to use the remote terminal, maximum number of users that can use the terminal of the time, security level of the terminal, enabled schedule of operation, location of the terminal, policy rules for the terminal, etc.
It is noted that the embodiment illustrated in
From operation 854, the method flows to operation 856 where a check is made regarding the validity of the display. If the display is validated, the method flows to operation 858 when the display is enabled, and if the display is not enabled the method flows to operation 860, where the display is disabled.
From operation 954 method flows to operation 956, where a check is made to determine if the event detected in operation 954 is a security-related event. In one embodiment, a security event is an event resulting from the triggering of the conditions of one or more policy rules, but other types of security events are also possible.
If a security event is detected the method flows to operation 958, where the event is analyzed. In one embodiment, the remote display is disabled 964 if the security policy determines 960 that the security event requires disablement of the remote display. In addition, other types of actions may be performed based on the security event, as described above with reference to
From operation 956, the method flows to operation 962 where a check is performed to determine if the security event requires logging data. If data needs to be logged, the method flows to operation 966 to log the data, and to operation 968 to transmit the data to the remote security server.
In operation 972, a check is performed to determine if the event is a control event. In one embodiment, a control event is a command received from the secure server to be performed by the secure display, although other type of control events are also possible. If the security event is a control event, the method flows to operation 974 where the command associated with the control event is executed, and an acknowledgment that the command has been performed is sent back to the server, in operation 976. From operation 976, the method flows back to operation 954 to check for new security events.
Mass storage device 2314 represents a persistent data storage device such as a floppy disc drive or a fixed disc drive, which may be local or remote. Network interface 2330 provides connections via network 2332, allowing communications with other devices. It should be appreciated that CPU 2304 may be embodied in a general-purpose processor, a special purpose processor, or a specially programmed logic device. Input/Output (I/O) interface provides communication with different peripherals and is connected with CPU 2304, RAM 2306, ROM 2312, and mass storage device 2314, through bus 2310. Sample peripherals include display 2318, keyboard 2322, cursor control 2324, removable media device 2334, etc.
Display 2318 is configured to display the user interfaces described herein. Keyboard 2322, cursor control 2324, removable media device 2334, and other peripherals are coupled to I/O interface 2320 in order to communicate information in command selections to CPU 2304. It should be appreciated that data to and from external devices may be communicated through I/O interface 2320. The embodiments can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a wire-based or wireless network.
A1. A display device for presenting information output of a host computer, comprising,
a panel defined from a plurality of light emitting devices that are arranged to define an area for displaying the information output from the host computer;
display logic for receiving pixel data from the host computer to be displayed on the panel;
a sensor for capturing data proximate to the panel;
an integrated circuit disposed in communication with the display logic and the panel, the integrated circuit configured to intercept or examine the information output from the host computer, the data of the sensor being analyzed for security control while enabling the information output to be presented to the display logic, wherein the display processor causes the light emitting devices of the panel to activate and the sensor for capturing data is configured to trigger a plurality of times during a use of the panel; and
a communication device for enabling the integrated circuit to communicate with a remote computer without communication with the host computer.
A2. The panel of claim A1, wherein the security control is configured to validate policies for the data captured proximate to the panel.
A3. The panel of claim A1, wherein the security control is configured to disable transfer of the intercepted information from being displayed on the panel by the display processor.
Embodiments of the present disclosure may be practiced with various computer system configurations including hand-held devices, microprocessor systems, microprocessor-based or programmable consumer electronics, minicomputers, mainframe computers and the like. The embodiments can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are linked through a network.
With the above embodiments in mind, it should be understood that the embodiments can employ various computer-implemented operations involving data stored in computer systems. These operations are those requiring physical manipulation of physical quantities. Any of the operations described herein are useful machine operations. The e also relates to a device or an apparatus for performing these operations. The apparatus may be specially constructed for the required purpose, such as a special purpose computer. When defined as a special purpose computer, the computer can also perform other processing, program execution or routines that are not part of the special purpose, while still being capable of operating for the special purpose. Alternatively, the operations may be processed by a general purpose computer selectively activated or configured by one or more computer programs stored in the computer memory, cache, or obtained over a network. When data is obtained over a network the data may be processed by other computers on the network, e.g., a cloud of computing resources.
One or more embodiments can also be fabricated as computer readable code on a non-transitory computer readable storage medium. The non-transitory computer readable storage medium is any non-transitory data storage device that can store data, which can be thereafter be read by a computer system. Examples of the non-transitory computer readable storage medium include hard drives, network attached storage (NAS), read-only memory, random-access memory, CD-ROMs, CD-Rs, CD-RWs, magnetic tapes and other optical and non-optical data storage devices. The non-transitory computer readable storage medium can include computer readable storage medium distributed over a network-coupled computer system so that the computer readable code is stored and executed in a distributed fashion.
Although the method operations were described in a specific order, it should be understood that other housekeeping operations may be performed in between operations, or operations may be adjusted so that they occur at slightly different times, or may be distributed in a system which allows the occurrence of the processing operations at various intervals associated with the processing, as long as the processing of the overlay operations are performed in the desired way.
Although the foregoing embodiments have been described in some detail for purposes of clarity of understanding, it will be apparent that certain changes and modifications can be practiced within the scope of the appended claims.
Accordingly, the present embodiments are to be considered as illustrative and not restrictive, and the embodiments are not to be limited to the details given herein, but may be modified within the scope and equivalents of the appended claims.
This application is a Continuation Application under 35 USC §120 of U.S. application Ser. No. 13/830,601, entitled “Methods and Systems for Enterprise Data Use Monitoring and Auditing User-Data Interactions,” filed Mar. 14, 2013, which is a Continuation Application of U.S. patent application Ser. No. 13/444,840, entitled “Secure Display System for Prevention of Information Copying from a Display Screen System,” filed Apr. 11, 2012, which claims priority from U.S. Provisional Patent Application No. 61/474,255, filed Apr. 11, 2011, and entitled “Secure Display System for Prevention of Information Copying from any Display Screen System.” Each above-identified application is herein incorporated by reference.
| Number | Date | Country | |
|---|---|---|---|
| 61474255 | Apr 2011 | US |
| Number | Date | Country | |
|---|---|---|---|
| Parent | 13830601 | Mar 2013 | US |
| Child | 14715223 | US | |
| Parent | 13444840 | Apr 2012 | US |
| Child | 13830601 | US |
