TW202318832A - Input encryption - Google Patents

Abstract

In one example in accordance with the present disclosure, a computing device is described. An example computing device includes an operating system to execute an operation based on received input. The example computing device includes a port to receive a connector of an input device and a processor. An example processor is to intercept input received from the input device along a communication path between the port and the operating system and select an encryption key based on an application to receive encrypted input. The example processor is to encrypt the input based on a selected encryption key and transmit encrypted input to the application.

Description

Enter encryption technology

The present invention relates to input encryption techniques.

Background of the invention

An input device allows a user to provide data to a computing device. For example, via a keyboard, a user can enter text, which the computing device can use for any of a variety of purposes. For example, the text may be inserted into a word processing document or used in an electronic message to another user. In another example, a microphone may be used to capture audio input to be shared with a user of another computing device. While specific input devices are specifically mentioned, a variety of input devices may be coupled to and provide different types of inputs to a computing device.

Summary of the invention

According to an embodiment of the present invention, a computing device is provided, which includes: an operating system for performing an operation based on input received; a port for receiving a connector of an input device; and a processor on the device to: intercept input received from the input device along a communication path between the port and the operating system; select an encryption key to receive encrypted input based on an application; based on a selected encrypting the input with an encryption key; and transmitting the encrypted input to the application.

Detailed Description of the Preferred Embodiment

Millions of people use computing devices every day to perform business, personal, and social operations, and it is not uncommon for an individual to interact with multiple computing devices on a daily basis. Examples of computing devices include desktops, laptops, all-in-one devices, tablets, and gaming systems, just to name a few. Users interact with these computing devices through input devices such as keyboards, microphones, cameras, and biometric input devices. These input devices provide data to a computing device, which performs operations on the data.

As computing devices become more pervasive in society, several developments may further enhance their integration. For example, securing inputs on computing devices is a recurring challenge. This may include applying security updates to the operating system and applications and running antivirus applications. Despite all these efforts, data may still be exposed through sophisticated attacks or user negligence. For example, a malicious user may use a phishing attack to install a keylogger application that enables the malicious user to view keystrokes at the computing device. If a computing device is compromised via a keylogger or other malicious application, an attacker can capture input from an input device such as a keyboard. This is especially worrisome when the user is typing in secure information such as a password.

Accordingly, this specification describes a system whereby input to an application executing on a computing device is cryptographically secure, thereby preventing any attacker from viewing input to such an application. Specifically, to prevent an attacker from accessing the input, the input is intercepted by a processor directly coupled to an input device. In one example, an application running in the operating system, which knows whether secure input should be received, triggers the secure input mode via a secure command to the processor.

Upon receiving a trigger, the processor begins to intercept the input. After interception, the input is no longer sent to the operating system via the keyboard-to-operating system communication line. To other components in the operating system, it will appear as if the user has not typed any input, except for the application program requesting the secure input mode. In this example, the processor receives the input and encrypts it using a key that has been pre-shared between the application and the processor. Encryption can continue until the processor receives a signal indicating that the user is done typing the input. In this example, the input is provided by the processor directly to the application via secure communication. Therefore, if a keylogger or application wants to obtain this data, such a program must find and intercept the secure channel. Even then, the data is encrypted, so a malicious user must have access to the pre-shared key to decrypt the input.

In a second example, particularly for keyboard input, the processor may implement a random shift cipher. In this embodiment, upon receiving a trigger indicating that a security input is required, the processor may begin applying a shift code to user input entered through the keypad. As a specific example, the keyed "w" may be shifted such that the encrypted input is some other value. In this instance, the cryptographic shift input decryption key can be passed to the application. In this instance, the material may bypass the secure channel. However, as in the first example, this material is encrypted, in this case by a shift cipher. Accordingly, if a keylogger intercepts the data, the data will not represent the actual user input because the user input has been shifted. In both examples, the computing device prevents input tracking applications and enables encrypted data input.

Specifically, this specification describes a computing device. The computing device includes an operating system to perform operations based on received input. A port of the computing device receives a connector of an input device. The computing device also includes a processor. The processor is configured to intercept input received from the input device along a communication path between the port and the operating system. The processor is configured to select an encryption key based on an application to receive encrypted input and encrypt the input based on the selected encryption key. The processor is used to send the encrypted input to the application program.

In another example, a computing device includes the port and processor described above. In this example, the processor is used to authorize and identify an application to receive encrypted input. As described above, the processor intercepts input received from the input device along a communication path between the port and the operating system. In this example, the processor selects an encryption key to receive encrypted input based on the application, the encryption key being unique to a particular encrypted communication session. The processor encrypts the input based on a selected encryption key and transmits the encrypted input to the application. The processor also prevents the transmission of unencrypted input.

This specification also describes a non-transitory machine-readable storage medium encoded with a plurality of instructions, where the term "non-transitory" does not include transitory propagated signals. The instructions are executable by a processor of a computing device. When executed by the processor, the instructions are to cause the processor to initiate an encrypted communication session in response to a first trigger. During the encrypted communication session, the instructions are to cause the processor to authorize an application to receive encrypted input; intercept input received from an input device along a communication path between the port and the operating system; select an encryption key unique to the encrypted communication session; encrypting the input based on a selected encryption key; and transmitting the encrypted input to the application. The instructions are also executable by the processor to terminate the encrypted communication session in response to a second trigger.

Turning now to the drawings, FIG. 1 is a block diagram of a computing device 100 to perform input encryption, according to an example. As described above, computing device 100 protects input 103 , such as keyboard input, as it is transmitted from an input device to operating system 106 , so that malicious programs cannot intercept and misappropriate input 103 .

Computing device 100 may be of a variety of types, including a desktop computer, laptop computer, tablet computer, smartphone, or any of a variety of other computing devices 100 . Computing device 100 includes an operating system 106 for receiving and performing operations based on received input. That is, the operating system 106 on the computing device 100 manages the computing device memory and programs and hosts the applications 108 that can be installed on the computing device 100 .

As noted above, the execution and programming of applications 108 and operating system 106 are dependent on user input. Accordingly, computing device 100 includes port 102 for receiving a connector of an input device. The input device may take a variety of forms. Examples of input devices include microphones, cameras, keyboards, and biometric readers, among others. From these input devices, port 102 receives input 103 upon which operating system 106 and/or application 108 will take action.

As a specific example, a user may enter text into a keyboard. The text can be passed to a word processing application, where the text is displayed on a screen. In another example, a user may speak into a microphone and the audio signal is passed to the communication application 108, where the audio signal may be recorded and/or transmitted to a third party. Although a few input devices are specifically mentioned, a variety of input devices can be implemented in accordance with the principles described herein. Therefore, port 102 can take various forms to match the connector of the input device. For example, port 102 may be an auxiliary port or a Universal Serial Bus (USB) port.

As noted above, while input 103 may allow computing device 100 to perform certain operations, input 103 is also vulnerable to malicious attacks. That is, a malicious application may intercept input 103 and thus may gain access to confidential information. As a specific example, a user may be typing a username and password to access a secure file. In this example, a keylogger application can track the input 103, username and password, so that a malicious user knows the username and password and can use them to gain unauthorized access to the secure file.

Accordingly, computing device 100 includes a processor 104 that prevents such unauthorized access, in particular by securing input 103 along the communication path between port 102 and operating system 106 . As shown in FIG. 1, processor 104 sits between port 102 and operating system 106 and acts as a gatekeeper for input 103 received from an input device. Specifically, the processor 104 intercepts the input 103 received from the input device. As shown in Figure 1, input 103 may be unencrypted. That is, it may represent raw material received from the input device. Such unencrypted input 103, if allowed to pass unencrypted, may be vulnerable to attack and misappropriation.

Processor 104 selects an encryption key based on application 108 to receive encrypted input 105 . That is, there may be multiple applications 108 executing on computing device 100, each of which may benefit from secure and encrypted communication with the input device. Rather than using a single encryption key for all applications 108 , the processor 104 can identify a particular application 108 and select an encryption key that is unique and specifically mapped to that application 108 .

As a specific example, a password shift can be implemented where keystrokes received from a keyboard are shifted by a certain amount or randomized based on a particular function. In this example, a password shift for a first application may shift the keystrokes by a first amount, while a password shift for a second application may shift the keystrokes Bit one second quantity. In another example, a password shift for a first application may randomize the keystrokes based on a first function, while a password shift for a second application may be based on a second function Randomizes the keystrokes. In this way, the processor 104 is used to authorize and identify the application 108 that has requested the encrypted input 105, so that each time the application 108 requests a secure communication, the associated encryption key for the application 108 is encrypted during encryption. call and use.

In one example, processor 104 may access a database including a mapping between encryption keys and applications 108 . For example, the first application 108 may be associated with a first encryption key. In this example, the processor 104 may retrieve the encryption key associated with the first application 108 when the first application 108 requests secure communication and is authorized and recognized by the processor 104 .

While specific mention is made of cryptographic key distribution based on repository entries, other forms of cryptographic key distribution can occur. For example, an encryption key may be unique to a particular encrypted communication session. That is, each time a secure input is requested, the processor 104 may sequentially or randomly select an encryption key for the encrypted communication session. In this example, processor 104 may transmit the encryption key to application 108 during or after authentication.

In another example, the application 108 may transmit the encryption key to the processor 104 during or after authentication. That is, the application 108 may include metadata or commands that are communicated to the processor 104 requesting secure input and instructing the processor 104 to secure the input using a particular encryption scheme. In this example, processor 104 selects the encryption key based on the metadata or commands from application 108 . In either example, sharing of the encryption key allows processor 104 and application 108 to encrypt and decrypt the input upon receipt. In either instance, the encryption key can be shared via a secure channel, as shown in FIGS. 2 and 3 .

In either example, following communication of the encryption key, processor 104 encrypts input 103 based on the selected encryption key and transmits encrypted input 105 to application 108 . Transmission can take many forms. As an example, processor 104 may transmit encrypted input 105 as blocks in response to a trigger to terminate the encrypted communication session. For example, when the application program 108 is a secure window for entering a username and password, the encrypted username and password may be sent as a "type" key, or a user interface element may be selected to indicate that the password and username have been entered. is typed, and is ready to transmit.

In another example, processor 104 may transmit encrypted input 105 when input 103 is received and encrypted. That is, encryption can occur on the fly when input 103 is received. For example, when a user is typing text for a word processing document, processor 104 may cryptographically shift the text and transmit the shifted text to application 108 . Upon receipt, the application 108 decrypts the encrypted input 105 .

In one example, the user may not be aware of any encryption because the displayed text may match the typed text. However, due to the activity of processor 104 in encrypting the text before sending it to word processing application 108, input 103 is protected from malicious attacks. In addition to transmitting encrypted input 105, processor 104 may prevent transmission of unencrypted input. That is, to all other applications except the one requesting encrypted communication 108, it may appear as if no input was received.

While encryption of keyboard input is specifically mentioned, other types of input 103 may be similarly encrypted. For example, processor 104 may receive audio input and use audio encryption to encode the audio before it reaches operating system 106 or audio application 108 . The encryption key may be shared from the application 108 to the processor 104 or from the processor 104 to the application 108 as described above. In either case, the audio application 108 can decrypt the audio signal, making the audio signal less vulnerable to the communication path between the port 102 and the application 108 . In a similar manner, video data or other input may be encrypted as it passes from the input device to the application 108, which will operate on it.

In an example, processor 104 may be integrated with other components. That is, in one example, processor 104 may be a separate component, such as a central processing unit (CPU). In another example, processor 104 may be integrated with an embedded controller including other components and resources such as registers, databases, and/or memory.

For example, the embedded controller may include various hardware components, which may include a processor 104 and memory. Processor 104 may include hardware architecture for retrieving executable code from memory and executing the executable code. As specific examples, a controller as described herein may include a computer-readable storage medium, a computer-readable storage medium and a processor 104, an application-specific integrated circuit (ASIC), a semiconductor-based microprocessor, a central processing unit (CPU) ), and Field Programmable Gate Array (FPGA) and/or other hardware devices.

Memory may include computer-readable storage media that may contain or store computer-usable program code for use by or in connection with an instruction execution system, apparatus, or device. Various types of memory can be used for the memory, including volatile and non-volatile memory. For example, memory may include random access memory (RAM), read only memory (ROM), optical memory disks, magnetic disks, and the like. When executed by the controller, the executable code can cause the controller to implement the functionality described herein. Therefore, the computing device 100 protects the input data at the hardware level to ensure that the input data remains safe to prevent input stealing operations.

2 is a block diagram of a computing device 100 for performing input encryption, according to an example. As noted above, in one example, processor 104 utilizes secure channel 210 to communicate encrypted input 105 to operating system 106 . That is, instead of utilizing a direct communication channel with the operating system 106, the processor 104 transmits the protected and encrypted input 105 through an intermediate secure channel 210 to ensure that the encrypted input 105 is further protected. That is, the encrypted input 105 is not only protected from attack due to its encryption, but also from passing through the communication channel with enhanced security features.

In this example, when input 103 is received and encrypted, processor 104 forwards encrypted input 105 to application 108 and/or operating system 106 via secure channel 210 . Such a safety channel 210 may take a variety of forms. As a specific example, secure channel 210 may implement direct memory access, shared memory access, or a combination thereof. In shared memory access, both the processor 104 and the operating system 106 can access data stored thereon. Thus, instead of one component (ie, processor 104 or operating system 106) collecting information, both can access memory. In this example, application 108 reads encrypted input 105 using an out-of-band communication channel, such as a device memory mapped I/O window, rather than relying on existing input channels in operating system 106 . Doing so may increase security by obfuscating the channeling of input flow to the application 108 .

In another example, the secure channel 210 includes a direct memory access. In this example, processor 104 may be separate from the CPU. In a direct memory access, the processor 104 and the operating system 106 can access the memory storing the encrypted input 105 independently of the CPU. In this case, the processor 104 that is encrypting the input 103 writes the encrypted key data directly into the runtime memory of the target application 108 . This allows processor 104 to verify that target application 108 is the intended application and to verify that target application 108 is functioning as expected before passing encrypted input 105 . This example also allows processor 104 to ensure that encrypted input 105 is received by target application 108 .

While specific reference is made to different secure channel 210 components, in other examples different components may be implemented to further ensure that encrypted input 105 is further secured during transmission to operating system 106 .

Through this same secure channel 210, the operating system 106 and the processor 104 can share encryption keys for encrypted communication sessions. That is to say, whether the application program 108 shares the encryption key with the processor 104 or the processor 104 shares the encryption key with the application program 108, this sharing can ensure that no malicious user obtains the encryption key via the secure channel 210 Unauthorized access to encryption keys.

A specific example is now provided where processor 104 forms part of an embedded controller. In this example, the application 108 may send a request to the embedded controller via the secure channel 210 to initiate an encrypted communication session. In response to the request and in response to the sharing of an encryption key, the embedded controller intercepts input 103 . Upon interception, the input 103 is encrypted and placed in a shared memory location. The application 108 reads the information stored at the shared memory location and processes the data by verifying a signature and decrypting the input for use by the application 108 .

3 is a block diagram of a computing device 100 for input encryption, according to an example. As noted above, in some examples, the input device is a keyboard. When the input device is a keyboard and input 103 is text input, processor 104 may cryptographically shift the text input to generate encrypted input 105 . A shift cipher can shift the text input by a certain amount. For example, a user may type the letter "a". However, a shift might output the letter "f" in place of "a" in the encrypted input. This can happen with all text input such that the actual input text is obfuscated by the cipher shift.

In this example, processor 104 may transmit cryptographically shifted encrypted input 105 directly to operating system 106 or application 108 . That is, the encrypted input 105 can bypass the secure channel 210 and be directly transmitted to the operating system 106 or the application 108 . In this example, even if a malicious application could intercept encrypted input 105, the malicious application may not be able to decipher the input because the input is encrypted.

To decrypt encrypted input 105 , processor 104 may share cryptographic shift key 307 with application 108 . In one example, the processor 104 provides the cryptographic shift key 307 to the application 108 via the secure channel 210 . In this way, cryptographically shifted key 307 and cryptographically shifted encrypted input 105 are passed from processor 104 to operating system 106 along different paths. Doing so ensures that a malicious application, even if able to intercept the password shift input, cannot decipher the encrypted input 105 because the password shift key 307 is shared via a different channel (ie, secure channel 210 ) from attack.

FIG. 4 is a flowchart of a method 400 for input encryption, according to an example. At step 401, method 400 includes initiating an encrypted communication session in response to a first trigger. Specifically, it may be the case that certain applications 108 on computing device 100 are designated as applications 108 that require encrypted communications while other applications 108 may execute without encrypted communications. As a specific example, an application 108 that provides authorization to enter a file system via a username and password may be an application 108 that requires encryption of the username and password. Therefore, a trigger establishes that any input received at this particular application 108 requires encrypted communication.

This first trigger can take many forms. For example, the first trigger may be metadata from the application 108 requesting an encrypted communication session. That is, the application 108 itself may include code indicating that encryption is required. In this example, application 108 may transmit the metadata to processor 104 to initiate the encrypted communication session. In addition to the encryption request, the application 108 may also transmit an encryption key to be used during the session.

In another example, the trigger can be via user input. For example, computing device 100 may include a mechanical switch, such as a keyboard button, where a user triggers the encrypted communication session. As another example, user input may be via a user interface element, such as an icon, programmed to trigger processor 104 to initiate encrypted communication.

At step 402 , method 400 includes authorization application 108 receiving encrypted input 105 . Specifically, as described above, processor 104 may authenticate application 108 as a security measure. At step 403 , method 400 includes intercepting input 103 . At step 404, method 400 includes selecting an encryption key unique to the encrypted communication session. That is, the encryption key may be unique to the application 108 requesting the encrypted communication, as described above.

In some examples, the encryption key may not only be unique to the application 108, but may also be unique to the encrypted communication session. For example, in some cases, processor 104 may randomly or sequentially select an encryption key to use for a particular encrypted communication session. In another example, the database may include various encryption keys, each mapping to a single application 108 . That is, each application 108 may have a number of encryption keys assigned to it. In this example, the processor 104 may cycle through the encryption keys assigned to a particular application 108 sequentially or randomly when communicating with the particular application 108 .

At step 405 , method 400 includes encrypting input 103 , and at step 406 method 400 includes transmitting encrypted input 105 to application 108 .

At step 407, method 400 includes terminating the encrypted communication session. Such termination may be in response to a second trigger. That is, computing device 100 includes a mechanism by which processor 104 may be instructed to temporarily stop intercepting input 103 . This can be used when the user switches from the application 108 currently in use and interacts with another application 108 in the operating system 106 before returning to that application 108 to complete entering secure input data. In another example, this can be used when the user stops using the application 108 that requested the encrypted input 105 . This mechanism can also cancel the current input request. For example, processor 104 may cancel the request if application 108 closes before the request is completed.

This second trigger can take a variety of forms. For example, the second trigger may be the deactivation of the application 108 to which the input device is providing input. For example, the user may close the window of the application 108 that originally requested encrypted communication, or may switch to another application 108 that has not yet requested encrypted communication. This tracking can be done by using a driver that monitors whether the application 108 that has requested the encrypted input 105 is selected. In response to the trigger, processor 104 may stop intercepting and encrypting input 103 and may return to transmitting unencrypted input to application 108 of computing device 100 .

In another example, the second trigger may be a session termination keystroke. For example, after entering a username and password, the user may press the "enter" key or may activate a user icon element. In response to the keystroke, processor 104 may stop intercepting and encrypting input 103 and may return to transmitting unencrypted input to application 108 of computing device 100 .

In yet another example, the second trigger may be the expiration of a timeout period. The timeout period may define the amount of time that no input 103 is received. That is, if the processor 104 does not receive any input 103 for a period of time, the request may be automatically canceled. For example, a user may step away from their computing device 100 . If sufficient time has elapsed, processor 104 may terminate the encrypted communication session and return to transmit the received unencrypted input. In one example, the timeout period may refer to a time period set for the request to be completed. The encrypted session may be terminated if encryption is not completed within a given time period. In either of these examples, processor 104 may provide a notification to the user that the encrypted communication session has terminated.

5 is a block diagram of a computing device 100 to perform input encryption, according to an example. In the example depicted in FIG. 5 , computing device 100 includes a hypervisor 512 . In this example, rather than sending the encrypted input 105 only to the application 108 requesting the encrypted communication, the security through encryption is available to all applications 108-1, 108-2. In this example, hypervisor 512 may receive encrypted input 105 as described above. That is, processor 104 may encrypt input 103 and pass it to hypervisor 512 via a secure channel 210, as described above in connection with FIG. 2, or may cryptographically shift input 103 and pass encrypted input 105 directly Passed to the management program 512, as described above in conjunction with FIG. 3 . In this example, the hypervisor 512 may decrypt the user input and transmit the decrypted input 509 to a first application 108-1 and a second application 108-2.

In this example, the encryption key may still be determined based on the application 108 of the computing device 100 . That is, the processor 104 can identify the applications 108 to receive user input and can select an encryption key specific to those applications 108 .

Implementing the hypervisor 512 upstream of the application 108 that is to receive the input 103 may enable secure communication for the application 108 that might otherwise be unprepared for data theft. For example, the secure access application may be aware of the need to hack into the shared username and password on the secure access application, thus potentially triggering encrypted communication. However, a word processing application 108 that may not include a trigger for one of the encrypted communications may also be vulnerable to security hacking. Thus, by implementing the hypervisor 512, even those applications 108 that do not include encryption triggers can receive input 103 that has been securely transmitted.

6 depicts a non-transitory machine-readable storage medium used to perform input encryption, according to an example. As used in this specification, the term "non-transitory" does not include transient propagating signals. In order to achieve its desired functionality, computing device 100 includes various hardware components. Specifically, the computing device 100 includes a processor 104 and a machine-readable storage medium 614 . A machine-readable storage medium 614 is communicatively coupled to the processor. The machine-readable storage medium 614 includes a plurality of instructions 616, 618, 620, 622, 624, 626, 628 for performing specified functions. The machine-readable storage medium 614 causes the processor to perform the specified functions of the instructions 616 , 618 , 620 , 622 , 624 , 626 , 628 . The machine-readable storage medium 614 can store data, programs, instructions, or any other machine-readable material that can be used to operate the computing device 100 . The machine-readable storage medium 614 can store computer-readable instructions that can be processed or executed by the processor of the computing device 100 . The machine-readable storage medium 614 may be an electronic, magnetic, optical, or other physical storage device that contains or stores executable instructions. The machine-readable storage medium 614 may be, for example, random access memory (RAM), electrically erasable programmable read-only memory (EEPROM), a storage device, an optical disc, and the like. Machine-readable storage medium 614 may be a non-transitory machine-readable storage medium 614 .

Referring to FIG. 6, start instructions 616, when executed by the processor, cause the processor to start an encrypted communication session in response to a first trigger. Authorization instructions 618, when executed by the processor, may cause the processor to authorize the application 108 to receive encrypted input 105 during the encrypted communication session. Intercept instructions 620, when executed by the processor, may cause the processor to intercept input 103 received from an input device along a communication path between a port 102 and the operating system 106 during the encrypted communication session. Select instructions 622, when executed by the processor, may cause the processor to select an encryption key unique to the encrypted communication session during the encrypted communication session. Encryption instructions 624, when executed by the processor, may cause the processor to encrypt input 103 during the encrypted communication session based on a selected encryption key. Send instructions 626, when executed by the processor, may cause the processor to send encrypted input 105 to an application during the encrypted communication session. Terminate instructions 628, when executed by the processor, may cause the processor to terminate the encrypted communication session in response to a second trigger.

100: computing device 102: port 103: input 104: Processor 105: encrypted input 106: Operating system 108: Apps 108-1: Application, first application 108-2: Application, Second Application 210: safe passage 307: password shift key 400: method 401, 402, 403, 404, 405, 406, 407: steps 509: Decrypted input 512: Management program 614: Machine-readable storage medium 616: start command 618: Authorization instruction 620: Intercept command 622: select command 624: encryption instruction 626:Transfer command 628: Terminate command

The drawings illustrate various examples of the principles described herein and are a part of the specification. The examples shown are for illustration only and do not limit the scope of the claimed claims.

1 is a block diagram of a computing device to perform input encryption, according to an example.

2 is a block diagram of a computing device to perform input encryption, according to an example.

3 is a block diagram of a computing device to perform input encryption, according to an example.

4 is a flowchart of a method to perform input encryption, according to an example.

5 is a block diagram of a computing device to perform input encryption, according to an example.

6 depicts a non-transitory machine-readable storage medium for performing input encryption, according to an example.

Throughout the drawings, like reference numbers indicate similar, but not necessarily identical, elements. The figures are not necessarily to scale and the dimensions of some parts may have been exaggerated to more clearly illustrate the examples shown. In addition, the drawings provide examples and/or implementations consistent with the description; however, the description is not limited to the examples and/or implementations provided in the drawings.

100: computing device

102: port

103: input

104: Processor

105: encrypted input

106: Operating system

108: Apps

Claims (15)

A computing device comprising: an operating system for performing an operation based on received input; a port for receiving a connector of an input device; and a processor on the computing device to: intercepting input received from the input device along a communication path between the port and the operating system; selecting an encryption key based on an application to receive encrypted input; encrypting the input based on a selected encryption key; and Send encrypted input to the application. The computing device of claim 1, wherein the processor is configured to implement a secure channel to transmit the encrypted input to the application program. The computing device of claim 2, wherein the secure channel is selected from the group consisting of: - direct memory access; a shared memory access; or other combinations. The computing device of claim 1, wherein: the input device is a keyboard; and The processor is used to cryptographically shift the input to generate the encrypted input. The computing device of claim 4, wherein the processor is configured to directly transmit the cryptographically shifted encrypted input to the application program. The computing device according to claim 5, wherein the processor is configured to provide a cryptographic shift key to the application program through a secure channel. The computing device of claim 1, wherein the application is configured to transmit the encryption key to the processor during authentication. The computing device according to claim 1, further comprising a management program for: receiving the encrypted input; decrypt the encrypted input; and The decrypted input is sent to a first application and a second application. A computing device comprising: an operating system for performing an operation based on received input; a port for receiving a connector of an input device; and a processor on the computing device to: authorize and identify an application to receive encrypted input; intercepting input received from the input device along a communication path between the port and the operating system; selecting an encryption key to receive encrypted input based on the application, wherein the encryption key is unique to a particular encrypted communication session; encrypting the input based on a selected encryption key; block the transmission of unencrypted input; and Send encrypted input to the application. The computing device according to claim 9, wherein the processor is configured to transmit the encryption key to the application program. The computing device of claim 9, wherein the processor is configured to transmit the encrypted input as a block in response to a trigger that terminates the encrypted communication session. The computing device of claim 9, wherein the processor is configured to transmit encrypted input as the input is received and encrypted. A non-transitory machine-readable storage medium encoded with instructions executable by a processor of a computing device, the machine-readable storage medium comprising instructions that, when executed by the processor, cause the processor to: initiating an encrypted communication session in response to a first trigger; During this encrypted communication session: Authorize an application to receive encrypted input; intercepting input received from an input device along a communication path between a port and an operating system; select an encryption key unique to the encrypted communication session; encrypting the input based on a selected encryption key; and send encrypted input to the application; and The encrypted communication session is terminated in response to a second trigger. The non-transitory machine-readable storage medium of claim 13, wherein the first trigger is selected from the group consisting of: Metadata from an application requesting an encrypted communication session; and input via a mechanical switch; input via a user interface element; or other combinations. The non-transitory machine-readable storage medium of claim 13, wherein the second trigger is selected from the group consisting of: disable an application to which the input device is providing input; A session termination keystroke; Expiration of a timeout period; or other combinations.

Images