Method to protect display text from eavesdropping

A system and method for displaying a glyph on a graphical user interface to protect the displayed glyph against eavesdropping. The method comprises providing multiple frames of the glyph, each frame representing a partial glyph which includes at least one component of the glyph. The multiple frames of the glyph may be displayed successively, at a predetermined frequency, on the graphical user interface so that a user observes the glyph by visually integrating the successive multiple frames of partial glyphs. The glyph may be a combination of glyphs including characters, keys or images which may represent an onscreen keyboard or keypad. The glyph may be moved across the graphical user interface and may further be obfuscated.

TECHNICAL FIELD

The present application relates to the field of displaying glyphs, for example characters, keys and/or images, on a graphical user interface. In an example embodiment, the application relates to a method and system of providing multiple frames of partial glyphs and displaying these frames successively to inhibit or prevent eavesdropping.

BACKGROUND

To evade eavesdropping in a network environment, information that travels over the network, and in particular over the Internet, is usually encrypted between endpoints of the network. However, information is typically unprotected between a user and the application used by a user, making the information susceptible for interception and eavesdropping.

For example, a user's input is vulnerable to various types of keystroke logging. Keystroke logging captures a user's keystrokes, typically to obtain passwords or encryption keys, thereby bypassing security measures of a system. Keystroke logging may be achieved by both hardware and software means. Some systems include devices which are attached to the keyboard cable and also devices which can be installed in keyboards. Software applications for keylogging are also easy to obtain and/or develop, and may be distributed as a trojan horse or as part of a virus or worm.

To address this problem on-screen keyboards have been developed. However, a problem that has been identified with existing on-screen keyboards is that a screen capture of the keyboard, in addition to the recording of mouse pointer coordinates, will still reveal what keys have been clicked by a user, thereby overcoming this security measure.

Information presented or displayed to the user on the screen of a computer, or on any other graphical user interface (GUI), may be subjected to screen capture of various kinds. Therefore, sensitive or confidential information, such as a password or banking details of a user, may be obtained whenever it is displayed on the screen.

DETAILED DESCRIPTION

The present application relates to a system and method for the display of glyphs on a graphical user interface (GUI) to inhibit or prevent eavesdropping of the displayed glyphs. The system and method provides added security measures when information, in the form of glyphs, is displayed on a GUI, whether the displayed information relates to, for example, an on-screen keyboard or keypad used to capture sensitive data, or alternatively, whether the information relates to sensitive information only displayed to the user.

The method and system may be of particular relevance to on-screen keyboards and keypads having a random key layout, where such a keyboard may be embedded in an application that prompts a user for a password.

FIG. 1shows an example embodiment of a system10for the display of glyphs on a display or GUI12. The displayed glyphs may be any glyph or combination of glyphs including symbols, characters such as text characters, keys, for example the keys of an on-screen keyboard or keypad, and/or images.

The display or GUI12may be any type of GUI, for example a CRT (cathode ray tube) or LCD (liquid crystal display) used for the screen of a personal computer, such as a desktop or laptop, or the screen of a Personal Digital Assistant (PDA). In an example embodiment, the GUI12may be a bank terminal such as an Automatic Teller Machine (ATM) which provides self-service banking functions. The ATM may be a cash machine that allows a bank's customers to make cash withdrawals and check their account balances without the need for a human teller. Many ATMs also allow people to deposit cash or checks, transfer money between their bank accounts, top up their mobile phones' pre-paid accounts or even buy postage stamps.

The system10includes a frame creation module14to analyze a glyph or combination of glyphs and to break the glyphs into multiple frames. The frame creation module14thereby provides multiple frames, with each frame representing a partial glyph which includes at least one component40of the glyph (seeFIG. 2).

Each separate frame of the glyph contains insufficient information or components to allow a viewer of any of the multiple frames to extrapolate the information contained in the frame thereby to discern the displayed glyph. This results in a single screenshot of the GUI which would comprise only one of the multiple frames representing a partial glyph, and thus not provide sufficient information for eavesdropping. However, when the multiple frames are superimposed and aligned, the original glyph can be discerned.

A simplified example of a glyph is the letter “C” as shown inFIG. 2A. The multiple frames for the letter “C”, as provided by the frame creation module14, are shown inFIGS. 2B to 2F. From each respective frame, which would typically be frames captured by a screenshot, an eavesdropper would not be able to determine that the glyph represents the letter “C”, as each partial glyph contains too few components to extrapolate.

Glyphs may be broken up or divided into any type or number of components. Examples of types of component are dots, lines, pixels or the like. In the example embodiment shown inFIGS. 2B to 2F, the components of the glyphs are dots40. It will be appreciated that the components of the partial glyphs need not all be of the same shape and size. Also, the type of component used in the partial glyphs may be dependent on the original glyph to be displayed. For example, if a very fine font is used for the glyph, it may be more appropriate to use lines or pixels for the components, rather than dots.

The system10may further include a display rate module16to manage the rate at which the multiple frames of the glyph are displayed successively, e.g., the frequency of the display. Typically the display rate module16provides a display module22, to be described in more detail below, with a predetermined display rate frequency. The rate of display of the multiple frames of the glyph may be adjusted so as to limit visual discomfort of a user and may be dependent on the GUI, the glyphs to be displayed and the number of multiple frames of a glyph.

In the motion picture industry it has been determined that a frame rate of less than 16 frames per second causes the mind to see flashing images, which may be distracting to a viewer. However, in the motion picture industry, the aim is to see continuous movement, while the present application aims to provide a user with a visual perception of a complete glyph, while multiple frames of partial glyphs are displayed consecutively. In the application of the example method and system, a user's eyes may visually integrate the time-spaced multiple frames of partial glyphs displayed on the GUI to form the full original glyph.

From flicker problems experienced with computer monitors, it has been determined that a low refresh rate, less than 60 Hz, may cause a user to see flicker. Generally, a refresh rate of 75 Hz or above, used in most modem monitors, is considered flicker-free. As background, the refresh rate is the number of times in a second that a display is illuminated. This is distinct from the measure of frame rate in that the refresh rate includes the repeated illumination of identical frames, while frame rate measures how often a display can change from one image to another.

Flat-panel LCD monitors do not suffer from flicker even if their refresh rate is 60 Hz or even lower, since the light transmission changes in the liquid crystals are slower than that. While on smaller computer monitors (14″) few people notice any change above 60-72 Hz. On larger monitors (17″, 19″) most people would experience mild discomfort unless the refresh rate is set to a more comfortable 85 Hz or higher. 100 Hz is comfortable for most people. Different operating systems set the default refresh rate differently, with Windows 95 and Windows 98 setting the highest possible refresh rate. Windows NT and Windows 2000 by default set the refresh rate to the lowest supported, usually 60 Hz. The aforementioned may be taken into account when selecting a display rate using the display rate module16of the system10.

A motion control module18forms part of the system10and controls the overall motion of the glyphs across the GUI12. The relative motion of the glyphs may be slight and may be in any direction. The movement of the glyphs makes it difficult for an eavesdropper to align multiple captured screenshots, which may make superimposing captured frames impractical, in particular as there is no reference point to align screen captures.

The motion control module18provides the display module22, described in more detail below, with the speed and direction in which to sequentially move the glyphs across the GUI12, from a first location on the GUI to a second location, and further to subsequent locations. Typically the speed and direction of the movement or motion are random, but within predefined parameters. The movement or random speed of the glyphs may be between a predetermined maximum and minimum speed. This ensures that the glyphs are not moved too rapidly across the GUI12, thereby causing discomfort to the user and possibly blurring the glyph. Also, the speed should not be too slow, thereby obviating the move of the glyph across the GUI12.

FIG. 3shows the glyph “C”, as shown inFIG. 2, in a first60, second62and subsequent location64on the GUI12, as moved by the display module22and motion control module18.

The system10may optionally include an obfuscation module20which may be used to add a small number of obfuscation objects, such as dots or additional lines, to any of the multiple frames, thereby to obfuscate the displayed glyph. The obfuscation module20is aimed at providing the additional objects in spaces between or around the glyphs, for example spaces between characters or keys on an on-screen keyboard. In an example embodiment, the obfuscation module20may allow the obfuscation objects or dots to appear at a frequency lower than the display frequency of the multiple frames, thereby to ensure that the obfuscation objects do not interfere with the readability of the glyphs when the multiple frames are displayed successively. The obfuscation module20may display the obfuscation objects randomly on random multiple frames.

FIG. 4shows the glyph “C” ofFIG. 2, but with obfuscation objects80and82added between the components of the partial glyphs shown in the multiple frames ofFIGS. 4B and 4F. These obfuscation objects80and82are also shown in the superimposed glyph ofFIG. 4A.

The display module22is used to display the multiple frames, successively, at a first location on the GUI12. The display module22obtains the multiple frames from the frame creation module14and displays the frames successively at the predetermined frequency stipulated by and received from the display rate module16.

In an example embodiment, the display module22also receives information from the motion control module18to move the glyphs across the GUI12from a first location to a second location and, to subsequent locations. As mentioned, the information provided by the motion control module18may be the speed and direction of the movement of the glyph.

A first multiple frame of the glyph may be moved to a second location by the display module22, once all the multiple frames have been displayed successively, at least once, at the first location. This may ensure that blurring of the glyph is limited and that the eyes of the user observes a sufficient number of frames to visually integrate the displayed multiple frames.

The display module22may further receive information from the obfuscation module20to add obfuscation objects to any of the multiple frames, thereby to obfuscate the displayed glyph.

Prior to receiving information from the motion control module18and the obfuscation module20, the display module may first determine whether the glyph to be displayed on the GUI should be moved across the GUI and should be obfuscated.

FIG. 5shows simplified flow diagram of a method of displaying glyphs in accordance with an example embodiment.

In operation100, the frame creation module14provides the display module22with multiple frames which together, for example when superimposed, constitute a glyph to be displayed on the GUI12. Each frame may represent a partial glyph with at least one glyph component.

The display module22displays a plurality of the multiple frames successively at a first location on the GUI12, as shown in operation102. As the partial glyphs are displayed in the same location at a particular display rate, aligning the multiple frames, the eyes of a user visually integrate the multiple frames and partial glyphs thereby to observe the complete superimposed glyph and not a sequence of partial glyphs.

In operation104, a plurality of the multiple frames is displayed successively at a second location on the GUI12, after being moved by the display module22from the first location to the second location, using information provided by the motion control module18.

The glyph is obfuscated, as shown by operation106, by the display module22by displaying obfuscating components on any of the multiple frames, around or between components of the glyph, in accordance with information received from the obfuscation module20.

Turning toFIG. 6, a detailed flow diagram of the operations of a method of displaying glyphs in accordance with an example embodiment is shown.

Similar to operation100ofFIG. 5, the frame creation module14provides the display module22with multiple frames which together constitute a glyph to be displayed on the GUI12, in operation120. Each frame represents a partial glyph with at least one glyph component.

The display rate module16provides the display module22with the predetermined display rate frequency (shown in operation122), which determines how many frames of the multiple frames constituting the displayed glyph will be displayed per second.

In operation124, the display module determines whether the glyph to be displayed has to be obfuscated. This feature may be optional and preset in the system. For example, in certain applications of the system and method, it may be desirable not to obfuscate the glyph. If obfuscation is necessary, the display module22receives from the obfuscation module20, in operation126, information, typically relating to the type of obfuscating component, its position and frequency, for at least one of the multiple frames of the glyph.

The display module22uses this received information in operations128and130to obfuscate a partial glyph of one of the multiple frames, and thereby the displayed glyph, by displaying the obfuscating component in accordance with the received information.

If a glyph is not to be obfuscated, the glyph is displayed by the display module22(shown in operation128) by displaying a plurality of the multiple frames successively at a first location on the GUI12. As mentioned before, the multiple frames with the partial glyphs are displayed over each other, at the predefined display rate frequency and a visual illusion is created whereby a user will visually integrate the frames to observe the complete glyph and not a sequence of partial glyphs.

The display module22now determines, in operation132, whether the glyph being displayed should be moved across the GUI12. If it is determined that the glyph should be moved, the display module22may receive information on the speed and direction of such movement from the motion control module18, in operation134.

The display module22uses this information in operation138to display a plurality of multiple frames of the partial glyphs successively at a second or subsequent location. However, in an example embodiment, the display module22may first determine whether all the multiple frames which constitute the glyph have been displayed at least once at the prior location of the glyph, as shown in operation136. As mentioned above, this feature may provide for a clearer displayed image.

The display of glyphs on GUI's according to the method and system attempts to defeat keystroke loggers, but may also be used as a defense against applications that capture a graphical text and use OCR algorithms to deduce the text.

The exemplary computer system300includes a processor302(e.g., a central processing unit (CPU), a graphics processing unit (GPU) or both), a main memory304and a static memory306, which communicate with each other via a bus308. The computer system300may further include a video display unit310(e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)). The computer system300also includes an alphanumeric input device312(e.g., a keyboard), a user interface (UI) navigation device314(e.g., a mouse), a disk drive unit316, a signal generation device318(e.g., a speaker) and a network interface device320.

The disk drive unit316includes a machine-readable medium322on which is stored one or more sets of instructions and data structures (e.g., software324) embodying or utilized by any one or more of the methodologies or functions described herein. The software324may also reside, completely or at least partially, within the main memory304and/or within the processor302during execution thereof by the computer system300, the main memory304and the processor302also constituting machine-readable media.

The software324may further be transmitted or received over a network326via the network interface device320utilizing any one of a number of well-known transfer protocols (e.g., TCP).