Patent ID: 7996682

Claim:
A computer implemented method under control of a processor communicatively coupled to an input device, comprising: intercepting a prompt from an application running on a user desktop, the prompt requesting sensitive information, the user desktop created each time a user successfully logs on to a particular interactive logon session, wherein access to the user desktop is limited to the particular interactive logon session and an operating system kernel; responsive to intercepting the prompt from the application, issuing a hint to the user to switch to a secure desktop, wherein the secure desktop limits access to a kernel layer of the operating system; switching from the user desktop to the secure desktop in response to a unique input physically entered by the user on an input device, and drivers of the input device operate in a protected mode of the operating system kernel layer, wherein the secure desktop is presented such that there are visual differences between the user desktop and the secure desktop; capturing the unique input in a secure prompting module running on the secure desktop, wherein the secure prompting module cannot be monitored, simulated, or changed by applications running on the user desktop; displaying the prompt on the secure desktop; receiving the sensitive information physically entered by the user from the input device in response to the prompt on the secure desktop; authenticating that the sensitive information was physically entered by the user, wherein the authenticating comprises ensuring that an appropriate input device provided the information; encrypting the sensitive information in the operating system kernel; and returning a representation of the sensitive information to the application running on the user desktop, wherein the representation is selected from the group consisting of an authentication certificate, a status code, a one-way cryptographic hash of the sensitive information.