Secure Frame Buffer Validation for Display Integrity
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Data processing systems lack mechanisms to restrict access to frame buffers, making them vulnerable to manipulation of displayed images, which can lead to unauthorized transactions by altering transaction details shown to users.
Innovation Solution
The system operates in a secure domain to store a subject image within a validated display area of the frame buffer and validation data, comparing user input data with validation data to ensure the displayed data matches the original image, using hash algorithms or direct comparison to prevent unauthorized changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the system uses a frame buffer stored in non-secure region for display, then display functionality is enabled and ease of operation is improved, but security is worsened because the frame buffer can be manipulated by non-secure software
Solution Approach 1:
The patent divides the frame buffer into two separate regions: a secure region accessible only by secure software and a non-secure region accessible by non-secure software. The subject image is rendered in the secure region with validation data, while the non-secure region contains overlay content. This segmentation allows display functionality to operate in the non-secure domain while maintaining security through the protected secure region.
Solution Approach 2:
The patent introduces a display controller as an intermediary component that manages the composite image formation by combining the secure subject image from the secure region with overlay content from the non-secure region. The display controller validates the subject image against stored validation data before allowing display, thus mediating between security requirements and display functionality.
2Reliability
If special purpose hardware for secure display is implemented, then security is improved, but device complexity increases
Solution Approach 1:
The patent makes the existing display controller multi-functional by enabling it to perform both standard display operations and security validation functions. The display controller is configured to read validation data, generate check data, and compare them to verify image integrity. This eliminates the need for separate dedicated security hardware while maintaining security functionality through the existing display infrastructure.
Solution Approach 2:
The patent combines security validation functionality with the existing display controller operations. The validation data is stored in the same memory structure as the frame buffer, and the validation process is integrated into the display rendering pipeline. This merging approach provides secure display functionality without adding separate complex hardware subsystems.
3Ease of operation
If the system allows non-secure software to access the frame buffer, then ease of operation is improved, but manufacturing precision is worsened because image manipulation becomes possible
Solution Approach 1:
The patent performs preliminary actions by storing validation data (such as hash values or checksums) in the secure region before the subject image is displayed. This pre-computed validation data enables later verification of image integrity without requiring complex real-time analysis, allowing non-secure software to access the frame buffer while maintaining image integrity through pre-established validation mechanisms.
Solution Approach 2:
The patent implements a feedback mechanism where the display controller reads the displayed subject image data, generates check data from it, and compares this check data against the pre-stored validation data. This feedback loop provides continuous verification that the displayed image matches the original authenticated image, preventing undetected manipulation even when non-secure software has frame buffer access.
Data Source
AI summary
A data processing device is provided with a processor core 8 that can operate in either a secure domain or a non-secure domain. Data stored within a secure region 34 of a memory 10 can only be accessed when the processor core 8 is executing in the secure domain. A frame buffer 36 for storing a display image 20 to be displayed is stored within a non-secure region of memory which can be accessed by the processor core 8 irrespective of whether it is in the secure domain or the non-secure domain as well as a display controller 12. When a subject image 22 is written to the frame buffer 36, validation data for the subject image 22 is stored within the secure region 34. When a user input is received the displayed data stored at a validated display area to which the subject image was written is read back and used to generate check data with is compared with the validation data before the user input is authenticated.