Method for enabling a trusted dialog for collection of sensitive data

Abstract

The present invention is a method for enabling a trusted dialog for collection of sensitive data, including the steps of: storing a personal security token specified by a user; receiving an input dialog request from an application; determining whether the application is a signed application; and, if a determination is made that the application is a signed application, accessing the personal security token and allowing the input dialog to be displayed with the personal security token and signed application identification. The personal security token may be at least one of an audible recording or a set of vibratory motions.

Description

CROSS REFERENCE TO RELATED DOCUMENTS [0001] The present invention is a continuation-in-part under 35 U.S.C. § 120 of U.S. application Ser. No. 10 / 981,253, filed on Nov. 4, 2004 which is herein incorporated by reference in its entirety.FIELD OF INVENTION [0002] The present invention relates to the field of computing and particularly to a method and program for enabling a trusted dialog for collection of sensitive data. BACKGROUND OF THE INVENTION [0003] Computing devices are being utilized to perform an ever-increasing number of tasks, some of which involve a user entering and / or storing private or sensitive data, such as when performing online banking transactions, making an online purchase or monitoring personal finances. Consequently, protection of such data from exploitation is becoming an increasingly important issue. On many software platforms, users are allowed to install software. This is problematic in that a user may unintentionally install a rogue application, which can co...

AI Technical Summary

Benefits of technology

The present invention is a method for securely collecting sensitive data from a user. It involves storing a personal security token specified by the user and accessing it when an application is requested. The application is first determined to be a signed application. This method ensures that the input dialog is displayed with the personal security token and the identification of the signed application. Overall, this invention provides a trusted and secure way to collect sensitive data.

Problems solved by technology

Consequently, protection of such data from exploitation is becoming an increasingly important issue.

This is problematic in that a user may unintentionally install a rogue application, which can compromise the security of both the software platform and the user's sensitive data.

However, by their very nature, rogue applications are almost always given access to a display of the computing device.

This presents the potential problem of a rogue application spoofing the appearance of a legitimate or trusted application and soliciting sensitive data from a user, such as passwords or credit card numbers, which can then be exploited.

Currently employed techniques to prevent a rogue application spoofing the appearance of a legitimate or trusted application are insufficient.

However, such approach is limited by the fact that a rogue application may be signed making a lone test for signed code invoking dialog insufficient.

Again, this approach is limited also because a rogue application may spoof the appearance of the entire display screen including the “trusted” indicator.

This approach is non-intuitive and not user friendly.

Images