# HyperIO: A Hypervisor-Based Framework for Secure IO
## 6 Applications
### FireSafe--Secure IO in Web Applications  
Web applications often display sensitive data, such as medical records, clients' private information, and the contents of private messages. Even more often, web applications request the user to input sensitive information, such as passwords and credit card numbers. This section presents an extension to the Firefox web browser, enabling a remote server to request the secure input and output of sensitive information. We call our extension \"FireSafe\". FireSafe acts as a mediator between the server and HyperIO by issuing hypercalls in response to various events occurring on the HTML page sent by the server. The server submits its request for secure input and output by embedding a \"data-hyper-io\" attribute in an HTML tag. When an event occurs in such a tag, FireSafe issues a hypercall. Since web browsers ignore the \"data-\" attributes, the web server can send the same HTML page to a FireSafe-enabled web browser and a regular web browser. The page will be displayed correctly, but without FireSafe, the user cannot display the sensitive information sent by the server. In the current implementation, the set of tags supported by FireSafe is limited. The server embeds the \"data-hyper-io\" attribute in an \"A\" tag (the A tag usually represents a hyperlink) to display sensitive information. The content of this tag can be text or an image. When a user clicks on the tag, FireSafe issues the HcDisplay hypercall. The values of the parameters for this hypercall are encoded using Base64 in the \"data-hyper-io\" attribute. The \"href\" attribute should contain an empty string to prevent redirection to another URL. The following example demonstrates the simplicity of the proposed system from the user's point of view (see Figure 2). Consider a medical web portal containing the user's private medical records. Usually, the portal includes several sub-pages. One of these pages list, for example, the results of the user's blood tests ordered by date. The user can view the results by clicking on the test title. The test title is an \"A\" tag that redirects the user to the test results page. With FireSafe and HyperIO, the server adds the \"data-hyper-io\" attribute to the \"A\" tag and clears its \"href\" attribute. The \"data-hyper-io\" attribute contains the test results in an encrypted form. After clicking on the \"A\" tag, FireSafe issues a hypercall. This hypercall requests HyperIO to switch to the secure mode and display the blood test results. From the user's perspective, the system behaves similarly to the standard case, with the only difference being the transition of the display adapter to text mode. The user exits the text mode by pressing the \"scroll lock\" key. To request sensitive input, the server embeds the \"data-hyper-io\" attribute in an \"INPUT\" tag, representing a text or password field (see Figure 3). When the tag becomes focused, FireSafe issues the HcDisplay hypercall. Similarly to the \"A\" tag, the parameters for this hypercall are encoded using Base64 in the \"data-hyper-io\" attribute. The hypercall returns immediately, but the display adapter remains in text mode until the user presses the \"scroll lock\" key. Next, all the characters the user enters are replaced by \"*\". Then, the \"scroll lock\" key is replaced by \"*\". FireSafe monitors the value of the \"INPUT\" tag by registering to its \"change\" event. In response to \"!\", FireSafe issues the HcAcquire hypercall, which returns the user's input in its encrypted form. The input is then converted to Base64 and set as the value of the \"INPUT\" tag. Upon submitting the form containing the \"INPUT\" tag, the browser sends the encrypted user input to the server. We demonstrate the simplicity of the proposed secure user input scheme using the previous example of the medical web portal. First, the portal requests to enter the user's login name and password to log in. The server embeds the \"data-hyper-io\" attribute in the password field (which is represented by the \"INPUT\" tag).