DEVICE, SYSTEM, AND METHOD OF SECURE ENTRY AND HANDLING OF PASSWORDS
Devices, system, and methods of secure entry and handling of passwords and Personal Identification Numbers (PINs), as well as for secure local storage, secure user authentication, and secure payment via mobile devices and via payment terminals. A mobile electronic device includes: a secure execution environment (SEE) to securely execute code; and a secure video path (SVP) to securely exchange information between the SEE and a touch-screen of the mobile electronic device; wherein the SEE includes a secure password entry module to generate a scrambled on-screen interface, and to send the scrambled on-screen interface to the touch-screen through the SVP.
1 . A mobile electronic device comprising:
a secure execution environment (SEE) to securely execute code;
a secure video path (SVP) to securely exchange information between the SEE and a touch-screen of the mobile electronic device;
wherein the SEE comprises a secure password entry module to generate a scrambled on-screen interface, and to send the scrambled on-screen interface to the touch-screen through the SVP.
2 . The mobile electronic device of claim 1 , wherein the secure password entry module comprises:
a touch-event recognizer to securely identify within the SEE a character which corresponds to a virtual key that a user selected via the touch-screen on the scrambled on-screen interface.
3 . The mobile electronic device of claim 1 , comprising:
a secure content channel to transport the scrambled on-screen interface, securely against interception, from the SEE to the touch-screen.
4 . The mobile electronic device of claim 1 , comprising:
a secure content channel to transport the scrambled on-screen interface, from the SEE to the touch-screen, as an encoded Digital Rights Management (DRM) protected video.
5 . The mobile electronic device of claim 4 , comprising:
a DRM-enabled playback module to playback the encoded DRM-protected video representing the scrambled on-screen interface.
6 . The mobile electronic device of claim 1 , wherein the scrambled on-screen interface comprises at least one of:
an on-screen scrambled virtual keyboard;
an on-screen scrambled virtual keypad;
an on-screen representation of wheels of digits, wherein each wheel is rotatable in response to a user gesture on the touch-screen.
7 . The mobile electronic device of claim 1 , wherein the scrambled on-screen interface comprises a user-specific authenticity reassurance image.
8 . The mobile electronic device of claim 7 , wherein the user-specific authenticity reassurance image comprises a user-uploaded image captured by the user through a camera of the mobile electronic device.
9 . The mobile electronic device of claim 8 , wherein the SEE comprises code to securely modify, based on a user command, one or more visible properties of said image prior to an upload of said image.
10 . The mobile electronic device of claim 7 , wherein the SEE comprises code to securely modify, based on a user command, one or more visible properties of the user-specific authenticity reassurance image subsequent to selection of the user-specific authenticity reassurance image from a collection of images.
11 . The mobile electronic device of claim 7 , wherein the user-specific authenticity reassurance image comprises at least one of:
an image overlaid as a watermark on top of the scrambled on-screen interface;
an image overlaid as a watermark under the scrambled on-screen interface;
an image displayed in proximity to the scrambled on-screen interface.
12 . The mobile electronic device of claim 1 , wherein the SVP comprises a uni-directional SVP to send information securely only in a direction from the SEE to the touch-screen of the mobile electronic device.
13 . The mobile electronic device of claim 1 , wherein the mobile electronic device comprises a device selected from the group consisting of: a laptop computer, a tablet, a smartphone, a portable computing device, a portable gaming device, a portable multimedia player, and a portable payment terminal.
14 . The mobile electronic device of claim 1 , comprising:
a secure storage unit to securely store a cryptographic key, wherein the cryptographic key is unique to a particular task to be performed by said mobile electronic device; and
a cryptographic operations module to release the cryptographic key from the secure storage unit based on a user gesture, received through said touch screen and indicating confirmation, and to utilize the cryptographic key for performing a cryptographic operation associated with said particular task.
15 . The mobile electronic device of claim 14 , wherein the cryptographic key is also unique to a user of said mobile electronic device.
16 . The mobile electronic device of claim 14 , wherein the cryptographic operation comprises at least one of:
encryption using the cryptographic key;
decryption using the cryptographic key.
17 . The mobile electronic device of claim 16 , wherein the cryptographic operation comprises a cryptographic operation transparent to said particular task on said mobile electronic device.
18 . The mobile electronic device of claim 14 , wherein said particular task, for which said cryptographic key is unique comprises a task of unlocking access to an entirety of a storage unit of said mobile electronic device.
19 . The mobile electronic device of claim 1 , further comprising:
a payment card reader to read a payment card swiped therethrough; and
a visual indicator to indicate to a user that the secure password entry module is activated and that the user can swipe the payment card through the payment card reader.
20 . The mobile electronic device of claim 19 , wherein the payment card reader is operational when the secure password entry module is activated, and wherein the payment card reader is non-operational when the secure password entry module is non-activated.
21 . The mobile electronic device of claim 19 , comprising:
a secure operations module to securely receive, from the secure password entry module, a password entered by a user via said touch-screen; to encrypt the password; and to send the encrypted password for verification at a verification module external to the mobile electronic device;
wherein the verification module external to the mobile electronic device is to send a verification response indicating whether or not the password is verified;
wherein the verification module comprises at least one of: a remote server, and a smart-card external to the mobile electronic device.
22 . The mobile electronic device of claim 19 , wherein in response to a user entering a password via said scrambled on-screen interface on said touch-screen, the mobile electronic device is to send, to a remote server, a message indicating touch coordinates to enable the remote server to determine the password and to initiate a process of verifying the password;
wherein the mobile electronic device is unaware of the password entered by said user.
23 . A server comprising:
a secure execution environment (SEE) system to securely execute code;
wherein the SEE system comprises a secure password entry module (a) to generate a scrambled on-screen interface, and (b) to send the scrambled on-screen interface, as an encoded Digital Rights Management (DRM) protected video to a remote mobile device.
24 . The server of claim 23 , wherein the encoded DRM-protected video, when played by a DRM-enabled playback module of the remote mobile device, causes a touch-screen of the remote mobile device to securely display said scrambled on-screen interface generated by the SEE system of said server.
25 . The server of claim 23 , wherein the scrambled on-screen interface comprises at least one of:
an on-screen scrambled virtual keyboard;
an on-screen scrambled virtual keypad;
an on-screen representation of wheels of digits, wherein each wheel is rotatable in response to a user gesture on a touch-screen.
26 . The server of claim 23 , wherein the scrambled on-screen interface comprises a user-specific authenticity reassurance image.
27 . The server of claim 23 , comprising:
a verification module to verify a user-entered password entered on said scrambled on-screen interface via a touch-screen of the remote mobile device,
wherein the verification module is to receive from said remote mobile device a message indicating touch coordinates corresponding to touch gestures of a user on said touch-screen,
wherein the verification module determines the user-entered password from said touch coordinates while the user-entered password remains unknown to the remote mobile device