Method and system for maintaining secure data input and output
Methods and systems for enhancing the security of data during input and output on a client computer system are provided to prevent attempts by unauthorized code to access, intercept, and/or modify data. Example embodiments provide a plurality of obfuscation techniques and security enhanced drivers that use these obfuscation techniques to prohibit unauthorized viewing/receiving of valid data. When the drivers are used together with the various obfuscation techniques, the security enhanced drivers provide mechanisms for “scheduling” the content of the storage areas used to store the data so that valid data is not available to unauthorized recipients. When unauthorized recipients attempt to access the “data,” they perceive or receive obfuscated data. The obfuscation techniques described include “copy-in,” “replace and restore,” and “in-place replacement” de-obfuscation/re-obfuscation techniques. In one embodiment, a security enhanced display driver, a security enhanced mouse driver, a security enhanced keyboard driver, and a security enhanced audio driver are provided. To complement the security enhancements, the methods and systems also provide for a watchdog mechanism to ensure that the driver is functioning as it should be and various user interface techniques for denoting security on a display device.
1. A method in a computer system for providing a secure display area on a video display device of a video display system, the video display system having video display memory for storing data to be displayed on the video display device, comprising:
reserving a portion of the video display memory for secure data storage that corresponds to the secure display area;
receiving a request to display valid data in the secure display area;
storing invalid data in the reserved portion of the video display memory until a determined period of time before the data stored in the reserved portion is transferred to the video display device for display, the valid data being an obfuscated form of the valid data; and
at the determined period of time, deobfuscating the invalid data stored in the reserved portion of the video display memory wherein the determined period of time corresponds to a time required to deobfuscate the invalid data in the reserved portion of the video display memory and transfer the reserved portion to the video display device.
2. The method of claim 1 , further comprising:
after the data stored in the reserved portion is transferred to the video display, reobfuscating the data in the reserved portion of the video display memory.
3. The method of claim 1 wherein obfuscation is performed by at least one of encryption of the valid data and a raster operation applied to the valid data and a mask.
4. The method of claim 3 wherein the mask is a bitmap comprising at least one of an encryption key, a company logo, a pattern, an advertisement, and a black region.
5. A non-transitory computer-readable medium for providing a secure display area on a video display device of a video display system, the video display system having video display memory for storing data to be displayed on the video display device, the computer-readable medium containing instructions that, if executed, will cause a computer system to implement:
a data receiver that is structured to receive a request to display valid data in the secure display area; and
a video display memory scheduler that is structured to:
reserve a portion of the video display memory for secure data storage that corresponds to the secure display area;
store invalid data in the reserved portion of the video display memory until a determined period of time before the data stored in the reserved portion is transferred to the video display device for display, the invalid data being an obfuscated form of the valid data; and
replacing the invalid data with valid data at the beginning of the determined period of time.
6. The computer-readable medium of claim 5 wherein the determined period of time corresponds to a time required to deobfuscate the invalid data stored in the reserved portion of the video display memory and transfer the reserved portion to the video display device.
7. The computer-readable medium of claim 5 , wherein the video display memory scheduler is further structured to:
after the data stored in the reserved portion is transferred to the video display, reobfuscate the valid data in the reserved portion of the video display memory.
8. The computer-readable medium of claim 5 wherein the valid data is obfuscated by at least one of encryption of the valid data and a raster operation applied to the valid data and a mask.
9. The computer readable medium of claim 8 wherein the mask is a bitmap comprising at least one of an encryption key, a company logo, a pattern, an advertisement, and a black region.