# HyperIO: A Hypervisor-Based Framework for Secure IO
## 6 Applications
### ClipCrypt--Secure IO in Graphical Applications  
Regular user-mode applications, such as email viewers, text editors, and database managers, often display sensitive information on the screen, making this information vulnerable to screen scrapers and other types of malicious software. We present ClipCrypt, a clipboard encryption system for the Windows operating system based on HyperIO. ClipCrypt allows the user to display and edit the sensitive information residing in the  
Figure 3: Webserver’s request to input sensitive information from the user’s keyboard. The “input” tag embeds the “data-hyper-io” attribute. Upon clicking the input field, FireSafe issues the HcDisplay hypercall (step 1) followed by the HcAcquire hypercall (step 2). HyperIO uses its private key to decrypt the sensitive information transmitted by the HcDisplay hypercall, switches to the secure mode, and displays the decrypted information. Then HyperIO inputs the sensitive information from the keyboard, encrypts it using the requester’s public key, and returns it to FireSafe (step 3), which transmits it to the server in the following POST HTTP request (step 4). Figure 2: Webserver’s request to display sensitive information on the user’s screen. The “A” tag embeds the “data-hyper-io” attribute. Upon clicking the tag, FireSafe issues the HcDisplay hypercall to HyperIO. HyperIO uses its private key to decrypt the sensitive information, switches to the secure mode, and displays the decrypted information. clipboard. To display previously encrypted sensitive data, the user places it in the clipboard (for example, by selecting the text and choosing copy in the context menu) and presses the \"scroll lock\" key. In response, ClipCrypt issues the HcDisplay hypercall, passing the clipboard's content and HyperIO's certificate as parameters. ClipCrypt sets the optional argument of HcDisplay to set the replacement scancode to the \"scroll lock\" key. HyperIO switches to the secure mode, decrypts the sensitive information using its private key, and displays it to the user. The user views or edits the text. HyperIO replaces all the user's input with the \"scroll lock\" key, thus not affecting the operating system and its applications. When the user completes editing, they press the \"scroll lock\" key. In response, HyperIO switches back to the regular mode. ClipCrypt issues the HcAcquire hypercall, which causes HyperIO to return the user's sensitive information encrypted using HyperIO's public key. Afterward, ClipCrypt stores the encrypted data in the clipboard. ClipCrypt converts the data it retrieves and stores it in the clipboard from and to the Base64 format. From the user's perspective, pressing the \"scroll lock\" key invokes the encryption/ decryption functionality. Otherwise, the behaviour of the system remains identical to the standard case. However, this approach is sufficiently general to be applied to various use cases. For example, suppose [PERSON] wants to send a confidential email to [PERSON]. In this case, she can open her favourite email client, press the \"scroll lock\" key, enter the body of the email, press the \"scroll lock\" key again, and paste the encrypted body by pressing \"CTRL + V\". After receiving the email, [PERSON] can view it by selecting the encrypted body, pressing \"CTRL + C\" to place it in the clipboard, and finally pressing the \"scroll lock\" key to decrypt and display it on the screen. This secure transmission method from [PERSON]'s keyboard to [PERSON]'s display is not limited to sending emails. It allows the user to write and view sensitive documents, database entries, chat messages, etc. Figure 4 illustrates the ClipCrypt's operation in this scenario. ClipCrypt consists of a window-less user-mode application and a kernel-mode driver, the Interception API project [39]. This allows our user-mode application to register for various keyboard events. Specifically, the user-mode application handle releases of keyboard keys.