Patent Application
20090300368
The present invention relates generally to data security, and specifically to methods and devices for preventing unauthorized parties from accessing unencrypted data.
Data encryption is widely used in preventing unauthorized access to data. Various methods of data encryption are known in the art. In general, these methods use a key to convert data to a form that is unintelligible to a reader (human or machine), and require an appropriate key in order to decrypt the data. Symmetric encryption methods use the same key for both encryption and decryption. Such symmetric methods include the well-known DES (Data Encryption Standard) and AES (Advanced Encryption Standard) algorithms. In asymmetric encryption methods, such as the RSA (Rivest Shamir Adelman) algorithm, a computer that is to receive encrypted data generates complementary public and private keys and transmits the public key to the sender. After the sender has encrypted the data using the public key, only the holder of the private key can decrypt it.
Modern methods of encryption make it very difficult for a malicious party who intercepts an encrypted message to decrypt the message contents. On the other hand, within the computer that sends the message, the message contents are typically held, at least temporarily, in clear (unencrypted) form in computer memory or storage. A malicious party who gains access to the memory or CPU of the computer (using a “Trojan horse” or other “spyware” program, for example) may be able to intercept the message in its internal clear form and read out or otherwise tamper with secret message contents (including user passwords and other sensitive private information). As additional examples, the malicious party may use a key-logger to copy and transmit a record of keystrokes input to the computer from the keyboard, or may use “phishing” in an attempt to trick the user into providing private information.
Embodiments of the present invention provide methods and apparatus for encryption that can be used to prevent unauthorized parties from accessing unencrypted secret data on the receiving computer. In these embodiments, a computer input device comprises an encryption processor, which is coupled between an input transducer, such as a keyboard, microphone, touch screen or camera, and the computer. The encryption processor receives and encrypts input data signals from the input transducer so that the data that are input to the computer from the input device are already encrypted. The input device comprises a mode switch, which switches between an encrypted mode for secret data, in which the data that have been input by the user are unintelligible to the computer, and a clear (unencrypted) mode, for normal (non-secure) data input. The computer may then transmit and/or store the encrypted input data from the input device without ever having to decrypt the data. Thus, even if an unauthorized party were to gain access to the computer, he or she would still be unable to read out the secret data in clear form.
In some embodiments, the computer input device also comprises an output transducer, such as a lamp, alphanumeric display or audio generator, which indicates to the user whether the input device is operating in encrypted or clear mode. Software running on the computer (whether on the CPU or on an embedded processor within the input device) may monitor the user input in order to detect unencrypted input of secret data to the computer. Upon detecting such input, the software initiates preventive action, such as prompting the user to flip the mode switch and re-enter the data, or preventing any further unencrypted data from being sent to the computer. By forcing the user to observe the status of the output transducer and re-enter data in this manner, the agent trains the user to make appropriate use of the encryption capabilities of the input device, so that the user will remember to flip the mode switch to encrypted mode even if the agent is later disabled (whether accidentally or intentionally).
There is therefore provided, in accordance with an embodiment of the present invention, a computer input device for operation with a computer, including:
an input transducer, which is coupled to receive an input from a user and to generate a data signal responsively to the input;
an encryption processor, which is coupled to process the data signal so as to output data to the computer, and which has a first operational mode in which the encryption processor encrypts the data signal using an encryption key not accessible to the computer so that the data are unintelligible to the computer, and a second operational mode in which the data are intelligible to the computer;
a mode switch, which is operative so as to switch between the first and second operational modes of the encryption processor; and
an output transducer, which is coupled to provide to the user an indication of whether the encryption processor is in the first or the second operational mode.
In one embodiment, the input transducer includes a text input device, such as a keyboard. The mode switch may by manually operable by a user. In a disclosed embodiment, the data signal is not accessible to the computer except in the data output by the encryption processor.
The output transducer may include a lamp, an alphanumeric display, or an audio transducer, or may cause a visible mode change in the input device.
There is also provided, in accordance with an embodiment of the present invention, a method for inputting data to a computer, including:
receiving a data signal from an input transducer responsively to an input by a user;
processing the data signal so as to generate data for output to the computer using an encryption processor, which has a first operational mode in which the encryption processor encrypts the data signal using an encryption key not accessible to the computer so that the data are unintelligible to the computer, and a second operational mode in which the data are intelligible to the computer;
setting a mode switch so as to select one of the first and second operational modes;
presenting to the user an indication of whether the encryption processor is in the first or the second operational mode; and
outputting the data to the computer in accordance with the selected one of the operational modes.
There is additionally provided, in accordance with an embodiment of the present invention, a method for inputting data to a computer, including:
receiving data input to the computer from an input device operated by a user, the input device having a first user-selectable operational mode in which the input device encrypts the data input and a second user-selectable operational mode in which the data input is unencrypted;
detecting that the data input made to the computer by the user via the input device for entry in a secret data field is unencrypted; and
initiating a preventive action responsively to detecting that the data input is unencrypted.
In one embodiment, initiating the preventive action includes preventing further unencrypted data from being sent from the input device to the computer.
In another embodiment, initiating the preventive action includes issuing an alert from the computer to the user, wherein issuing the alert includes instructing the user to switch the input device from the second to the first operational mode and repeat the data input. The computer may not alert the user to switch the input device to the first operational mode until the unencrypted data input is detected.
There is further provided, in accordance with an embodiment of the present invention, computing apparatus, including:
an input device having a first user-selectable operational mode in which the input device encrypts data input made to the device by the user and a second user-selectable operational mode in which the data input is unencrypted; and
a computer, which is coupled to receive the data input from the input device, and is configured to detect that the data input made by the user for entry in a secret data field is unencrypted, and to initiate a preventive action responsively to detecting that the data input is unencrypted.
There is moreover provided, in accordance with an embodiment of the present invention, a computer software product, including a tangible computer-readable medium in which program instructions are stored, which instructions, when read by a computer, cause the computer to receive data input to the computer from an input device operated by a user, the input device having a first user-selectable operational mode in which the input device encrypts the data input and a second user-selectable operational mode in which the data input is unencrypted, and to detect that the data input made to the computer by the user via the input device for entry in a secret data field is unencrypted, and to initiate a preventive action responsively to detecting that the data input is unencrypted.
The present invention will be more fully understood from the following detailed description of the embodiments thereof, taken together with the drawings in which:
Computer 20 comprises a console 26, which is coupled to one or more output devices, such as a video display screen 28, and one or more user input devices, which may comprise, for example, text, image capture and/or audio input transducers. In the present embodiment, the text input device is a keyboard 30, which comprises keys 32 as input transducers, and has novel encryption features that are described hereinbelow. Alternatively or additionally, the encryption capabilities of keyboard 30 may be incorporated into other user input devices, such as a mouse or other pointing device, a camera, scanner or other imaging device, a microphone, or a touch-sensitive screen, as well as other types of input devices that are known in the art. In the description that follows, certain techniques for secure input of encrypted data to console 26 are described, by way of example, with reference to keyboard 30. These techniques may similarly be applied, mutatis mutandis, to input devices of other types.
Keyboard 30 has two modes of operation:
A light-emitting diode (LED) 36 serves as an output transducer for indicating the current operating mode of keyboard 30. In this example, LED 36 lights to indicate that the keyboard is operating in encrypted mode. Alternatively, any other suitable type of output transducer may be used for this purpose, such as another type of lamp; an alphanumeric display, such as a liquid crystal display (LCD); another type of visual transducer such as a backlight, which causes a visible mode change in the input device; or even an audio transducer, which generates a sound to indicate the operating mode. The output transducer is typically controlled internally within the keyboard to prevent tampering by hackers.
To avoid this sort of scenario in the present embodiment, an encryption processor 46 associated with keyboard 30 encrypts data entered by the user via keys 32 when the encrypted mode is selected by switch 34. Keys 32 generate respective data signals when depressed by the user, as is known in the art. These data signals are digitized and, optionally, held in a buffer 50. The digitized data signals are then encoded by encryption processor 46, using an appropriate encryption key and program instructions stored in a program memory 48. The encryption processor may comprise a programmable processing device, such as a microprocessor or field-programmable gate array (FPGA), or it may alternatively comprise a hard-coded logic device.
In the embodiment shown in
In normal operation, the user maintains switch 34 in the clear position, so that the user can interact with computer 20 via keyboard 30 in the conventional manner. From time to time, however, the user may toggle switch 34 to the encryption mode, whereupon encryption processor 46 will output encrypted data to CPU 40. The CPU in this case is unable to decipher the encrypted data (and cannot access the unencrypted data signals in the keyboard). Rather, the CPU stores the encrypted data in memory 44 or transmits the encrypted data via communication interface 42 in accordance with instructions received by the CPU.
For example, in a secure communication session between computer 20 and remote computer 24, the user of computer 20 may flip switch 34 to the encryption mode position before inputting some particularly sensitive item of information, such as a password or account number. Software running on computer 20 may cause CPU 40 to generate a data packet for transmission to computer 24, and to insert the encrypted data that were entered via keyboard 30 into the payload of the packet before transmission. Computer 24 holds the necessary key to decrypt the payload upon reception, but CPU 40 does not have access to the key. Therefore, even if a hacker were to gain control over the CPU and copy the data transmitted to computer 24, the hacker will still have no way of deciphering the encrypted payload data.
The method of
The method carried out by the software agent trains the user to engage the encryption capabilities of keyboard 30 in such a way that even if the software agent is later deactivated or removed from the computer entirely (whether intentionally or accidentally), the user will already have acquired the habit of flipping the encryption switch at the appropriate times without further prompting.
In an example scenario, the software agent may monitor interaction between the user of computer 20 and the Web site of a bank where the user has an account. (In this example, remote computer 24 may be the bank's server.) In the course of this interaction, computer 20 presents a field on display 28 that requires secret data to be input securely, at an input display step 52. The secret data may comprise a password, for instance. Standing instructions from the bank indicate that the user is required to flip switch 34 to the encrypted mode before typing in the secret data.
The user begins to input the secret data, at a data input step 54. The software agent checks the steam of input data, at an encryption checking step 56. If possible, this step is carried out on the fly, as the user inputs the data, rather than waiting for all of the data to be transferred to memory 44. As long as the input data are encrypted, the agent takes no action. In this case, the encrypted data are typically transferred temporarily to memory 44 and are then transmitted by CPU 40 to computer 24 at the appropriate time (such as when the user presses the “ENTER” key), at a data transfer step 58. Alternatively, the encrypted data may be stored on computer 20 or otherwise output as required by the application.
On the other hand, if the software agent detects at step 56 that the incoming data are not encrypted, the agent takes preventive action. As one example, the agent may issue an alert to the user, at a user prompt step 60. For example, the agent may cause a warning to appear on display 28, prompting the user to flip switch 34 and repeat the data input. Alternatively or additionally, the agent may cause computer 20 to issue an audible alarm. Optionally, the agent may intervene and prevent further unencrypted input from being sent to the computer, either by preventing the computer from accepting the further input or preventing the input device from transmitting it. In any case, upon receiving the alert, the user is required to flip switch 34 and then repeat step 54. Before inputting the data, the user will now check to make sure LED 36 is lit, thus indicating that keyboard 30 is operating in encrypted mode. The user may alternatively have the option of continuing in clear mode if necessary.
The mode of training described above, using negative reinforcement, may be preferable to positively prompting the user for the sake of building proper user habits: If the user were positively prompted to flip the encryption switch before inputting secret data, the user could easily become dependent on the prompt as a memory aid.
Subsequently, if the prompt were turned off, due to malicious intervention by a hacker, for example, the user would be likely to forget to flip switch 34. On the other hand, the mild nuisance created by negative reinforcement in the method of
Although the description above relates to uses of embodiments of the present invention in preventing unauthorized access to unencrypted data, the architecture and methods associated with these embodiments may also be useful in enhancing the efficiency and reliability of other sorts of encryption processes. It will thus be appreciated that the embodiments described above are cited by way of example, and that the present invention is not limited to what has been particularly shown and described hereinabove. Rather, the scope of the present invention includes both combinations and subcombinations of the various features described hereinabove, as well as variations and modifications thereof which would occur to persons skilled in the art upon reading the foregoing description and which are not disclosed in the prior art.
| Number | Date | Country | Kind |
|---|---|---|---|
| 180020 | Dec 2006 | IL | national |
| 192043 | Oct 2008 | IL | national |
This application is a continuation-in-part of PCT patent application PCT/IL2007/001535, filed Dec. 11, 2007, whose disclosure is incorporated herein by reference.
| Number | Date | Country | |
|---|---|---|---|
| Parent | PCT/IL2007/001535 | Dec 2007 | US |
| Child | 12480692 | US |
