Trusted display and input using screen overlays

Brandon, Anthony; Trimarchi, Michael

doi:10.1109/reconfig.2017.8279826

Cited by 7 publications

(3 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…While many works study how to use a hypervisor to build a trusted path to users (e.g. [60][61][62][63][64]), little work has been done in the trusted hardware setting. SGXIO [16] provides a hybrid solution that combines SGX with hypervisor techniques to allow a trusted I/O path with unmodified devices.…”

Section: Discussion and Extensionsmentioning

confidence: 99%

Fidelius: Protecting User Secrets from Compromised Browsers

Eskandarian

Cogan

Birnbaum

et al. 2019

2019 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

Users regularly enter sensitive data, such as passwords, credit card numbers, or tax information, into the browser window. While modern browsers provide powerful clientside privacy measures to protect this data, none of these defenses prevent a browser compromised by malware from stealing it. In this work, we present Fidelius, a new architecture that uses trusted hardware enclaves integrated into the browser to enable protection of user secrets during web browsing sessions, even if the entire underlying browser and OS are fully controlled by a malicious attacker.Fidelius solves many challenges involved in providing protection for browsers in a fully malicious environment, offering support for integrity and privacy for form data, JavaScript execution, XMLHttpRequests, and protected web storage, while minimizing the TCB. Moreover, interactions between the enclave and the browser, the keyboard, and the display all require new protocols, each with their own security considerations. Finally, Fidelius takes into account UI considerations to ensure a consistent and simple interface for both developers and users.As part of this project, we develop the first open source system that provides a trusted path from input and output peripherals to a hardware enclave with no reliance on additional hypervisor security assumptions. These components may be of independent interest and useful to future projects.We implement and evaluate Fidelius to measure its performance overhead, finding that Fidelius imposes acceptable overhead on page load and user interaction for secured pages and has no impact on pages and page components that do not use its enhanced security features.

show abstract

Section: Discussion and Extensionsmentioning

confidence: 99%

Fidelius: Protecting User Secrets from Compromised Browsers

Eskandarian

Cogan

Birnbaum

et al. 2019

2019 IEEE Symposium on Security and Privacy (SP)

View full text Add to dashboard Cite

show abstract

“…Bump in the Wire-based Solutions Fidelius [ECB + 19], ProtectIOn [DUKC20], Inte-griScreen [SUD + 20], FPGA-based overlays [BT17], IntegriKey [DYKC17] are some of the trusted path solutions that use external trusted hardware devices as intermediaries between the platform and IO devices. These external devices create a trusted path between a remote user and the peripheral and enable the user to exchange sensitive data securely with the peripheral in the presence of an attacker-controlled OS.…”

Section: Related Work Tee-based Solutionsmentioning

confidence: 99%

Composite Enclaves: Towards Disaggregated Trusted Execution

Schneider

Dhar²,

Puddu

et al. 2021

TCHES

View full text Add to dashboard Cite

The ever-rising computation demand is forcing the move from the CPU to heterogeneous specialized hardware, which is readily available across modern datacenters through disaggregated infrastructure. On the other hand, trusted execution environments (TEEs), one of the most promising recent developments in hardware security, can only protect code confined in the CPU, limiting TEEs’ potential and applicability to a handful of applications. We observe that the TEEs’ hardware trusted computing base (TCB) is fixed at design time, which in practice leads to using untrusted software to employ peripherals in TEEs. Based on this observation, we propose composite enclaves with a configurable hardware and software TCB, allowing enclaves access to multiple computing and IO resources. Finally, we present two case studies of composite enclaves: i) an FPGA platform based on RISC-V Keystone connected to emulated peripherals and sensors, and ii) a large-scale accelerator. These case studies showcase a flexible but small TCB (2.5 KLoC for IO peripherals and drivers), with a low-performance overhead (only around 220 additional cycles for a context switch), thus demonstrating the feasibility of our approach and showing that it can work with a wide range of specialized hardware.

show abstract

“…This is due to the usage of PIN codes for enabling access to sensitive information. Indeed, such a mechanism is vulnerable to several attacks (eg, side channel, phishing, shoulder surfing, and video‐recording attacks) and, thus, it can be easily bypassed . Therefore, the traditional PIN authentication mechanism is unreliable for security‐sensitive operations (eg, payment using Samsung Pay, Apple Pay, and Google Pay) on smartwatches.…”

Section: Introductionmentioning

confidence: 99%

Securing PIN‐based authentication in smartwatches with just two gestures

Guerar

Migliardi

Palmieri

et al. 2019

Concurrency and Computation

View full text Add to dashboard Cite

Summary Smartwatches are becoming increasingly ubiquitous as they offer new capabilities to develop sophisticated applications that make daily life easier and more convenient for consumers. The services provided include applications for mobile payment, ticketing, identification, access control, etc. While this makes modern smartwatches very powerful devices, it also makes them very attractive targets for attackers. Indeed, PINs and Pattern Lock have been widely used in smartwatches for user authentication. However, such authentication methods are not robust against various forms of cybersecurity attacks, such as side channel, phishing, smudge, shoulder surfing, and video‐recording attacks. Moreover, the recent adoption of hardware‐based solutions, like the Trusted Execution Environment (TEE), can mitigate only partially such problems. Thus, the user's security and privacy are at risk without a strong authentication scheme in place. In this work, we propose 2GesturePIN, a new authentication framework that allows users to authenticate securely to their smartwatches and related sensitive services through solely two gestures. 2GesturePIN leverages the rotating bezel or crown, which are the most intuitive ways to interact with a smartwatch, as a dedicated hardware. 2GesturePIN improves the resilience of the regular PIN authentication method against state‐of‐the‐art cybersecurity attacks while maintaining a high level of usability.

show abstract

Trusted display and input using screen overlays

Cited by 7 publications

References 11 publications

Fidelius: Protecting User Secrets from Compromised Browsers

Fidelius: Protecting User Secrets from Compromised Browsers

Composite Enclaves: Towards Disaggregated Trusted Execution

Securing PIN‐based authentication in smartwatches with just two gestures

Contact Info

Product

Resources

About