text:
US 7302585 B1 Abstract The preferred embodiment of the invention comprises a computer system which employs a trusted display processor (260), which has a trusted processor (300) and trusted memory (305, 315, 335, 345) physically and functionally distinct from the processor and memory of the computer system. The trusted display processor (260) is immune to unauthorised modification or inspection of internal data. It is physical to prevent forgery, tamper-resistant to prevent counterfeiting, and has crypto functions (340) to securely communicate at a distance. The trusted display processor (260) interacts with a user's smartcard (122) in order to extract and display a trusted image, or seal (1000), generate a digital signature of the bitmap of a document image and control the video memory (315) so that other processes of the computer system cannot subvert the image during the signing process. The user interacts with the trusted display processor via a trusted switch (135).
Claims(36) 1. A data processing system capable of operating in a trusted operating mode, the data processing system comprising:
main processing means for executing at least one application process;
a trusted component comprising means for executing a trusted process in a trusted operating mode, means for mutually authenticating the trusted component with a user, means for acquiring trusted seal data associated with the user from a removable secure token having a secure token reader for reading data from and/or writing data to the removable secure token, and means for generating user feedback signals;
at least one user feedback device; and
user feedback processing means for receiving said user feedback signals and controlling the user feedback device on the basis of the signals,
wherein the trusted component comprises means for controlling the user feedback processing means to cause the user feedback device to provide an indication, using the trusted seal data, that the data processing system is operating in a trusted operating mode.
2. A data processing system according to
3. A data processing system according to
4. A data processing system according to
5. A data processing system capable of operating in a trusted operating mode, the data processing system comprising:
main processing means for executing at least one application process and for generating signals characterising a main image to be displayed;
a trusted component comprising means for executing a trusted process in a trusted operating mode and means for mutually authenticating the trusted component with a computing entity trusted by a user;
display processing means for receiving said signals and generating respective display signals for driving a visual display unit to display the main image,
wherein the trusted component comprises means to acquire from a computing entity trusted by a user trusted image data associated with the user and means to control the display processing means using the trusted image data, in order to indicate to the user that the data processing system is operating in the trusted operating mode, the computing entity being a removable secure token having a secure token reader for reading data from and/or writing data to the removable secure token.
6. A data processing system according to
7. A data processing system according to
8. A data processing system according to
9. A data processing system according to
a border, or an indicator (or indicators) defining a border, characterised by the trusted image and placed at least partly around the main image or portion thereof;
a background pattern characterised by the trusted image forming at least part of the background of the main image or portion thereof;
an image characterised by the trusted image formed within the main image or portion thereof; and/or
a text message characterised by the trusted image formed within the main image or portion thereof.
10. A data processing system according to
11. A data processing system according to
12. A data processing system according to
13. A data processing system according to
14. A data processing system according to
15. A data processing system according to
16. A data processing system according to
17. A data processing system according to
18. A data processing system according to
frame buffer memory;
a pixel generator to generate pixel data representative of the main image on the basis of the signals received from the main processing means;
a frame buffer refresher to update the pixel data in the frame buffer memory; and
a video controller to repeatedly read the pixel data from the frame buffer memory, generate signals suitable for driving the visual display unit and transmit said signals to the visual display unit to display the image,
and wherein the trusted component comprises means to write the trusted image data, or data derived from the trusted image data, to at least a portion of the frame buffer memory in order to combine the further image with the main image.
19. A data processing system according to
20. A data processing system according to
21. The data processing system of
22. A computer platform capable of operating in a trusted operating mode, the computer platform comprising:
a main processor programmed to execute at least one application process and for generating signals characterising a main image to be displayed;
a trusted component protected against unauthorised modification comprising a trusted component processor programmed to execute a trusted process in a trusted operating mode and means for mutually authenticating the trusted component with a computing entity trusted by a user;
a display processor for receiving said signals and generating respective display signals for driving a visual display unit to display the main image,
wherein the trusted component processor is programmed to acquire from a computing entity trusted by a user trusted image data associated with the user and to control the display processor, using the trusted image data, in order to indicate to the user that the computer platform is operating in the trusted operating mode, the computing entity being a removable secure token having a secure token reader for reading data from and/or writing data to the removable secure token.
23. The computer platform of
24. The computer platform of
25. A method of providing a trusted user interface in a data processing system comprising a main processor and a trusted component containing a trusted component processor protected from unauthorised modification, the method comprising:
the main processor running an application process to generate main image data and sending the main image data to a display processing system;
the trusted component mutually authenticating itself with a computing entity trusted by a user;
the trusted component processor operating a trusted process and acquiring from the computing entity trusted image data associated with the user, the computing entity being a removable secure token having a secure token reader for reading data from and/or writing data to the removable secure token;
the trusted component processor controlling the output of the display processing system such that it comprises a combination of the trusted image data and the main image data so as to indicate to the user that the data processing system is operating in a trusted mode associated with the trusted process.
26. The method of
the step of sending the main image data to the display processing system comprises sending the main image data to the pixel generator which converts the main image data into pixel data and writes the pixel data to the frame buffer memory;
the step of producing trusted image data comprises writing the trusted image data into the frame buffer memory; and
the step of passing said combination as displayable data to a visual display unit comprises the video controller repeatedly reading combined pixel data from the frame buffer memory and generating signals suitable for driving the visual display unit to display the image represented by the combined pixel data.
27. The method of
28. The method of
29. The method of
30. The method of
31. The method of
32. The method of
33. The method of
34. The method of
35. The method of
36. A method for a computing entity comprised of a removable secure token having a secure token reader for reading data from and/or writing data to the removable secure token, the computing entity being trusted by a user to establish a demonstrably authenticated connection with that user, the method comprising the computing entity:
holding trusted image data identified as being associated with that user;
conducting a mutual authentication process with a computing apparatus used by the user; and
if the mutual authentication process has a satisfactory result, providing the trusted image data to the computing apparatus used by the user for display to the user to demonstrate that a connection to the computing entity trusted by the user exists.
Description The subject matter of the present application may also be related to the following U.S. patent applications: �System for Digitally Signing a Document,� Ser. No. 09/979,904, filed Nov. 27, 2001; and �Identifying a Trusted Computing Entity,� Ser. No. 10/162,020, filed Jun. 3, 2002. The present invention relates to apparatus and methods for providing a user interface in a system, and in particular a user interface which provides a user with a high degree of confidence that the system is operating in a trustworthy fashion. Conventional prior art mass market computing platforms include the well-known personal computer (PC) and competing products such as the Apple Macintosh�, and a proliferation of known palm-top and laptop personal computers. Generally, markets for such machines fall into two categories, these being domestic or consumer, and corporate. A general requirement for a computing platform for domestic or consumer use is a relatively high processing power, Internet access features, and multi-media features for handling computer games. For this type of computing platform, the Microsoft Windows� 95 and 98 operating system products and Intel processors, so-called WinTel platforms, dominate the market. On the other hand, for business use, there are a plethora of available proprietary computer platform solutions available aimed at organizations ranging from small businesses to multi-national organizations. In many of these applications, a server platform provides centralized data storage, and application functionality for a plurality of client stations. For business use, other key criteria are reliability, remote access, networking features, and security features. For such platforms, the Microsoft Windows NT 4.0� operating system is common, as well as the UNIX and, more recently, the Linux operating systems. Windows-type operating systems allow a user to run separate applications in separate windows, and provide a so-called WIMP (windows, icons, menus and pointers) interface, whereby a user typically interacts with applications using a keyboard to enter data and a mouse to select options and control applications via dialog boxes and drop-down (or pull-up) menus. With the increase in commercial activity transacted over the Internet, known as �e-commerce�, there has been much interest in the prior art on enabling data transactions between computing platforms, over the Internet. In particular, it is perceived to be important for users to be able to enter into binding contracts over the Internet, without the need for the current standard hand-signed paper contract. However, because of the potential for fraud and manipulation of electronic data, in such proposals, fully automated transactions with distant unknown parties on a wide-spread scale as required for a fully transparent and efficient market place have so far been held back. The fundamental issue is one of trust between users and their computer platforms, and between interacting computer platforms, for the making of such transactions. There have been several prior art schemes which are aimed at increasing the security and trustworthiness of computer platforms. Predominantly, these rely upon adding in security features at the application level, that is to say the security features are not inherently embedded in the kernel of operating systems, and are not built in to the fundamental hardware components of the computing platform. Portable computer devices have already appeared on the market which include a smartcard, which contains data specific to a user, which is input into a smartcard reader on the computer. Presently, such smartcards are at the level of being add-on extras to conventional personal computers, and in some cases are integrated into a casing of a known computer. Although these prior art schemes go some way to improving the security of computer platforms, the levels of security and trustworthiness gained by prior art schemes may be considered insufficient to enable widespread application of automated transactions between computer platforms. Before businesses expose significant value transactions to electronic commerce on a widespread scale, they will require greater confidence in the trustworthiness of the underlying technology. In the applicant's co-pending International Patent Applications �Trusted Computing Platform� PCT/GB 00/00528, filed on 15 Feb. 2000, and �Smartcard User Interface for Trusted Computing Platform� PCT/GB 00/00752, filed on 3 Mar. 2000, the entire contents of which are incorporated herein by reference, there is disclosed a concept of a �trusted computing platform� comprising a computing platform which has a �trusted component� in the form of a built-in hardware component. Two computing entities each provisioned with such a trusted component may interact with each other with a high degree of �trust�. That is to say, where the first and second computing entities interact with each other the security of the interaction is enhanced compared to the case where no trusted component is present, because:
While the concept of a trusted component as described in the co-pending application goes a long way to providing to a user with a substantial degree of trust in a computer platform, there are still times when the user requires an even higher degree of trust in his equipment, for example during an electronic transaction, such as digitally signing a document, or transferring funds from the platform to a remote platform. As has been indicated above, the conventional method of signing a document is to physically write a signature on the medium (usually paper) upon which an image of a document is reproduced. This method has the advantages that it is clear what is being signed, and the signed image is proof of what was signed. However, it does not meet the needs of e-commerce. Nowadays it is also possible to digitally sign a document, using a conventional computer platform and standard encryption techniques. In conventional computer platforms, however, the present inventors have appreciated that the electronic rendition of a document which is digitally signed is typically not the same rendition of the document that is visible to the user. It is therefore possible for a user to unintentionally sign data that is different from that which he intended to sign. Conversely, it is also possible for a user to intentionally sign data and later fraudulently claim that the signed data does not correspond to that displayed to him by the computer platform. Such problems would still be the present, even if a trusted platform, as described above, were used. Conventional electronic methods of signing are well known to those skilled in the art. Essentially, digital data is compressed into a digest, for example by the use of a hash function. Then that digest is encrypted by the use of some encryption method that has been initialised by a secret key (or simply a �secret�). This is normally done on a computer platform, such as a PC. One implementation is to sign data using a private encryption key held secret on a user's smartcard, which is plugged into a smartcard reader attached to the computer platform. In the specific case of a textual document, the digital data may be the file produced by a word processor application, such as Microsoft's Notepad, Wordpad, or Word. As usual, the act of signing implies that the signer accepts some legal responsibility for the meaning of the data that was signed. Hash functions are well-known in the prior art and comprise one way functions which are capable of generating a relatively small output data from a relatively large quantity of input data, where a small change in the input data results in a significant change in the output data. Thus, a data file to which is applied a hash function results in a first digest data (the output of the hash function). A small change e.g. a single bit of data in the original data file will result in a significantly different output when the hash function is reapplied to the modified data file. Thus, a data file comprising megabytes of data may be input into the hash function and result in a digital output of the order of 128 to 160 bits length, as the resultant digest data. Having a relatively small amount of digest data generated from a data file stored in the reserved directory is an advantage, since it takes up less memory space and less processing power in the trusted component. During known signing processes, a user will typically interpret a document as it has been rendered on the computer's monitor at normal magnification and resolution. In existing applications, the user's smartcard signs data in a format that is the representation of the document by the application used to create and/or manipulate the document. The present inventors believe, however, that there is potential for software to send data to the smartcard that has a different meaning from that understood by the user when viewing the screen. This possibility may be sufficient reason to introduce doubt into the validity of conventional methods of digitally signing electronic representations of documents that are to be interpreted by people. The present invention aims to provide a user with greater trust during a trusted operation by providing a trusted user interface. In accordance with a first aspect, the present invention provides a data processing system capable of operating in a trusted operating mode, the data processing system comprising: main processing means for executing at least one application process; a trusted component comprising means for executing a trusted process in a trusted operating mode and means for generating user feedback signals; at least one user feedback device; and user feedback processing means for receiving said user feedback signals and controlling the user feedback device on the basis of the signals, wherein the trusted component comprises means for controlling the user feedback processing means to cause the user feedback device to provide an indication that the data processing system is operating in a trusted operating mode. In preferred embodiments the data processing system comprises secure user input means, in communication with the trusted component via a secure communications path, by which a user may securely interact with the trusted process. In a preferred embodiment of the data processing system: the main processing means includes means to execute at least one application process and generate signals characterising a main image to be displayed; the user feedback processing means comprises display processing means for receiving said signals and generating respective display signals for driving a visual display unit to display the main image; and the trusted component comprises means to acquire and/or generate trusted image data and means to control the display processing means to combine a respective trusted image with at least a portion of the main image in order to indicate to a user that the data processing system is operating in the trusted operating mode. In preferred embodiments the data processing system further comprises a secure token reader for reading data from and/or writing data to a removable secure token, and a removable token containing data characterising the trusted image, wherein the trusted component comprises means to receive said data from the secure token. Other aspects and embodiments of the invention will become apparent from the following description, claims and drawings. Embodiments of the present invention will now be described in detail with reference to the accompanying drawings, of which: The preferred embodiment utilises a trusted component that most conveniently uses some of the characteristics of the �trusted component� described in the applicant's co-pending European patent application number 99301100.6. In that application, the trusted component is a hardware device, comprising a processor programmed to measure an integrity metric of its host computer, compare it with a true value of the integrity metric and communicate the integrity (or otherwise) of the host computer to users or other host computers. The significant similarities between that trusted component and the trusted component in the preferred embodiment herein are: that they both use cryptographic processes but preferably do not provide an external interface to those cryptographic processes; that they are both tamper-resistant or tamper-detecting, so that their operation cannot be subverted, at least without the knowledge of the legitimate user; and that they both preferably consist of one physical hardware component that is both physically and functionally independent of the host computer on which it resides. Such independence is achieved by the trusted component having its own processing capability and memory. Techniques relevant to tamper-resistance are well known to those skilled in the art of security. These techniques include methods for resisting tampering (such as appropriate encapsulation of the trusted device), methods for detecting tampering (such as detection of out of specification voltages, X-rays, or loss of physical integrity in the trusted device casing), and methods for eliminating data when tampering is detected. Further discussion of appropriate techniques can be found at http://www.cl.cam.ac.uk/�mgk25/tamper.html. It will be appreciated that, although tamper-proofing is a most desirable feature of the present invention, it does not enter into the normal operation of the invention and, as such, is beyond the scope of the present description. In this description, the term �trusted�, when used in relation to a physical or logical component or an operation or process, implies that the behaviour thereof is predictable under substantially any operating condition and highly resistant to interference or subversion by external agents, such as subversive application software, viruses or physical interference. The term �host computer� as used herein refers to a data processing apparatus having at least one data processor, at least one form of data storage and some form of communications capability for interacting with external entities, such as peripheral devices, users and/or other computers locally or via the Internet. The term �host computer system� in addition to the host computer itself includes standard external devices, such as a keyboard, mouse and VDU, that attach to the host computer. The term �document�, as used herein, includes any set of data that can be visualised using a host computer system. Commonly a document will be a textual document, such as a contract. However, a document may comprise graphics, or pictures, instead of, or as well as, text. In general, a document may comprise a single page or multiple pages. The term �pixmap�, as used herein, is used broadly to encompass data defining either monochrome or colour (or greyscale) images. Whereas the term �bitmap� may be associated with a monochrome image only, for example where a single bit is set to one or zero depending on whether a pixel is �on� or �off�, �pixmap� is a more general term, which encompasses both monochrome and colour images, where colour images may require up to 24 bits or more to define the hue, saturation and intensity of a single pixel. As will become apparent, the trusted component according to the preferred embodiment herein provides a secure user interface and, in particular, controls at least some of the display functionality of its host computer. The trusted component herein may or may not also acquire integrity metrics according to the trusted component in applicant's co-pending patent application, although such acquisition of integrity metrics will not be considered herein. In essence, the preferred embodiment enables a user to digitally sign a document stored on a host computer using the private key of the user's smartcard, or other form of secure token such as a cryptographic co-processor. The signing is enacted by a trusted display processor (i.e. the trusted component) of the host computer under conditions that provide the user with a high level of confidence that the document being viewed on screen is in fact the document the smartcard is signing. In particular, the smartcard carries trusted image data, or a �seal�, which is passed to the host computer over a secure channel and displayed by the trusted component during the signing procedure. It is in part the display of the trusted image, which is typically unique to the user, which provides the user with the confidence that the trusted component is in control of the signing operation. In addition, in the preferred embodiment, the host computer provides a trusted input device, connected directly to the trusted display processor, by which the user can interact with the host computer in a manner which cannot be subverted by other functions of the host computer. More particularly, the trusted display processor or a device with similar properties is associated with video data at a stage in the video processing beyond the point where data can be manipulated by standard host computer software. This allows the trusted display processor to display data on a display surface without interference or subversion by the host computer software. Thus, the trusted display processor can be certain what image is currently being displayed to the user. This is used to unambiguously identify the image (pixmap) that a user is signing. A side-effect of this is that the trusted display processor may reliably display any of its data on the display surface, including, for example, the integrity metrics of the prior patent application, or user status messages or prompts. It will be appreciated that, while the preferred embodiment is described in relation to a digital signing operation, the concept of providing a trusted user interface is far more broadly applicable to any operation for which a user needs to be able to trust his host computer system, for example during an electronic transaction. According to The other main components of the host computer 100 attached to the PCI bus 225 include: a SCSI (small computer system interface) adaptor connected via a SCSI bus 235 to a hard disk drive 240 and a CD-ROM drive 245; a LAN (local area network) adaptor 250 for connecting the host computer 100 to a LAN 125, via which the host computer 100 can communicate with other host computers (not shown), such as file servers, print servers or email servers, and the Internet 130; an IO (input/output) device 225, for attaching the keyboard 110, mouse 115 and smartcard reader 120; and a trusted display processor 260. The trusted display processor handles all standard display functions plus a number of further tasks, which will be described in detail below. �Standard display functions� are those functions that one would normally expect to find in any standard host computer 100, for example a PC operating under the Windows NT� operating system, for displaying an image associated with the operating system or application software. It should be noted that the keyboard 110 has a connection to the IO device 255, as well as a direct connection to the trusted display processor 260. All the main components, in particular the trusted display processor 260, are preferably also integrated onto the motherboard 215 of the host computer 100, although, sometimes, LAN adapters 250 and SCSI adapters 230 can be of the plugin type. According to a microcontroller 300; non-volatile memory 305, for example flash memory, containing respective control program instructions (i.e. firmware) for controlling the operation of the microcontroller 300 (alternatively, the trusted display processor 260 could be embodied in an ASIC, which would typically provide greater performance and cost efficiency in mass production, but would generally be more expensive to develop and less flexible); an interface 310 for connecting the trusted display processor 260 to the PCI bus for receiving image data (i.e. graphics primitives) from the CPU 200 and also trusted image data from the smartcard 122, as will be described; frame buffer memory 315, which comprises sufficient VRAM (video RAM) in which to store at least one full image frame (a typical frame buffer memory 315 is 1-2 Mbytes in size, for screen resolutions of 1280�768 supporting up to 16.7 million colours); a video DAC (digital to analogue converter) 320 for converting pixmap data into analogue signals for driving the (analogue) VDU 105, which connects to the video DAC 320 via a video interface 325; an interface 330 for receiving signals directly from the trusted switch 135; volatile memory 335, for example DRAM (dynamic RAM) or more expensive SRAM (static RAM), for storing state information, particularly received cryptographic keys, and for providing a work area for the microcontroller 300; a cryptographic processor 340, comprising hardware cryptographic accelerators and/or software, arranged to provide the trusted display processor 260 with a cryptographic identity and to provide authenticity, integrity and confidentiality, guard against replay attacks, make digital signatures, and use digital certificates, as will be described in more detail below; and non-volatile memory 345, for example flash memory, for storing an identifier IDP of the trusted display processor 260 (for example a simple text string name), a private key SDP of the trusted display processor 260, a certificate CertDP signed and provided by a trusted third party certification agency, such as VeriSign Inc., which binds the trusted display processor 260 with a signature public-private key pair and a confidentiality public-private key pair and includes the corresponding public keys of the trusted display processor 260. A certificate typically contains such information, but not the public key of the CA. That public key is typically made available using a �Public Key Infrastructure� (PKI). Operation of a PKI is well known to those skilled in the art of security. The certificate CertDP is used to supply the public key of the trusted display processor 260 to third parties in such a way that third parties are confident of the source of the public key and that the public key is a part of a valid public-private key pair. As such, it is unnecessary for a third party to have prior knowledge of, or to need to acquire, the public key of the trusted display processor 260. The trusted display processor 260 lends its identity and trusted processes to the host computer and the trusted display processor has those properties by virtue of its tamper-resistance, resistance to forgery, and resistance to counterfeiting. Only selected entities with appropriate authentication mechanisms are able to influence the processes running inside the trusted display processor 260. Neither an ordinary user of the host computer, nor any ordinary user or any ordinary entity connected via a network to the host computer may access or interfere with the processes running inside the trusted display processor 260. The trusted display processor 260 has the property of being �inviolate�. Originally, the trusted display processor 260 is initialised with its identity, private key and certificate by secure communication with the trusted display processor 260 after it is installed onto the motherboard of the host computer 100. The method of writing the certificate to the trusted display processor 260 is analogous to the method used to initialise smartcards by writing private keys thereto. The secure communications is supported by a �master key�, known only to the trusted third party (and to the manufacturer of the host computer 100), that is written to the trusted display processor 260 during manufacture, and used to enable the writing of data to the trusted display processor 260. Thus, writing of data to the trusted display processor 260 without knowledge of the master key is not possible. It will be apparent from A typical process by which graphics primitives are generated by a host computer 100 will now be described by way of background. Initially, an application program, which wishes to display a particular image, makes an appropriate call, via a graphical API (application programming interface), to the operating system. An API typically provides a standard interface for an application program to access specific underlying display functions, such as provided by Windows NT�, for the purposes of displaying an image. The API call causes the operating system to make respective graphics driver library routine calls, which result in the generation of graphics primitives specific to a display processor, which in this case is the trusted display processor 260. These graphics primitives are finally passed by the CPU 200 to the trusted display processor 260. Example graphics primitives might be �draw a line from point x to point y with thickness z� or �fill an area bounded by points w, x, y and z with a colour a�. The control program of the microcontroller 300 controls the microcontroller to provide the standard display functions to process the received graphics primitives, specifically: receiving from the CPU 200 and processing graphics primitives to form pixmap data which is directly representative of an image to be displayed on the VDU 105 screen, where the pixmap data generally includes intensity values for each of the red, green and blue dots of each addressable pixel on the VDU 105 screen; storing the pixmap data into the frame buffer memory 315; and periodically, for example sixty times a second, reading the pixmap data from the frame buffer memory 315, converting the data into analogue signals using the video DAC and transmitting the analogue signals to the VDU 105 to display the required image on the screen. Apart from the standard display functions, the control program includes a function to mix display image data deceived from the CPU 200 with trusted image data to form a single pixmap. The control program also manages interaction with the cryptographic processor and the trusted switch 135. The trusted display processor 260 forms a part of the overall �display system� of the host computer 100; the other parts typically being display functions of the operating system, which can be �called� by application programs and which access the standard display functions of the graphics processor, and the VDU 105. In other words, the �display system� of a host computer 100 comprises every piece of hardware or functionality which is concerned with displaying an image. As already mentioned, the present embodiment relies on interaction between the trusted display processor 260 and the user's smartcard 122. The processing engine of a smartcard suitable for use in accordance with the preferred embodiment is illustrated in Seal images can consume relatively large amounts of memory if stored as pixmaps. This may be a distinct disadvantage in circumstances where the image needs to be stored on a smartcard 122, where memory capacity is relatively limited. The memory requirement may be reduced by a number of different techniques. For example, the seal image could comprise: a compressed image, which can be decompressed by the trusted display processor 260; a thumb-nail image that forms the primitive element of a repeating mosaic generated by the trusted display processor 260; a naturally compressed image, such as a set of alphanumeric characters, which can be displayed by the trusted display processor 260 as a single large image, or used as a thumb-nail image as above. In any of these alternatives, the seal data itself may be in encrypted form and require the trusted display processor 260 to decrypt the data before it can be displayed. Alternatively, the seal data may be an encrypted index, which identifies one of a number of possible images stored by the host computer 100 or a network server. In this case, the index would be fetched by the trusted display processor 260 across a secure channel and decrypted in order to retrieve and display the correct image. Further, the seal data could comprise instructions (for example PostScript� instructions) that could be interpreted by an appropriately programmed trusted display processor 260 to generate an image. In accordance with The remaining functions of the host computer 100 are those provided by the trusted display processor 260. These functions are: a control process 520 for coordinating all the operations of the trusted display processor 260, and for receiving graphics primitives from the graphics primitives process and signature requests from the application process 500; a summary process 522 for generating a signed summary representative of a document signing procedure in response to a request from the control process 520; a signature request process 523 for acquiring a digital signature of the pixmap from the smartcard 122; a seal process 524 for retrieving seal data 540 from the smartcard 122; a smartcard process 525 for interacting with the smartcard 122 in order to enact challenge/response and data signing tasks required by the summary process 522, the signature request process 523 and the seal process 524; a read pixmap process 526 for reading stored pixmap data 531 and passing it to the signature request process 523 when requested to do so by the signature request process 523; a generate pixmap process 527 for generating the pixmap data 531 on the basis of graphics primitives and seal image data received from the control process 520; a screen refresh process 528 for reading the pixmap data, converting it into analogue signals and transmitting the signals to the VDU 105; and a trusted switch process 529 for monitoring whether the trusted switch 135 has been activated by the user. The smartcard process 525 has access to the trusted display processor's identity data IDP, private key SDP data and certificate CertDP data 530. In practice, the smart card and the trusted display processor interact with one another via standard operating system calls. The smartcard 122 has: seal data 540; a display processor process 542 for interacting with the trusted display processor 260 to enact challenge/response and data signing tasks; smartcard identity data ISC, smartcard private key data SSC and smartcard certificate data CertSC 543. A preferred process for signing a document using the arrangement shown in Initially, in step 600, the user controls the application process 500 to initiate a �signature request� for digitally signing a document. The application process 500 may be realised as a dedicated software program or may be an addition, for example a macro, to a standard word processing package such as Microsoft's Word. In either case, neither the signature request nor the application process 500 need to be secure. When the user initiates the signature request, he also specifies the document to be signed, if it is not one which is already filling the whole screen. For example, the document may be displayed across a part of the full screen area or in a particular window. Selection of a particular area on screen is a simple task, which may be achieved in several ways (using a WIMP environment), for example by drawing a user-defined box bounding the area or by simply specifying co-ordinates. Next, in step 602, the application process 500 calls the control process 520 to sign the image that is being displayed (within a defined area or window) on the screen; the control process 520 receives the call. In parallel, although it is not shown, the control process 520 receives any graphics primitives from the graphics primitives process and forwards them onto the generate pixmap process 527. The call from the application process 500 to sign a document includes the co-ordinates (a,b,c,d) of the edges of the document. Note that this sending of co-ordinates generally enables the signing of the entire surface of the screen, a complete window, or of an arbitrary part of the screen. The application process 500 then waits for the control process 520 to return the signature of the image. In response to the signature request, in step 604, the control process 520 forces the image that is to be signed to be �static� from the time of the request until the process has been completed. Herein, �static� means that the document image cannot be modified other than by the trusted display processor 260. This is so that the user can be certain that what he sees is what he is signing at all times during the process. In the present embodiment, the control process 520 achieves a �static� display by �holding-off�, or not processing, any further graphics primitives. In some situations, the graphics primitives process (or equivalent) may �buffer� graphics primitives until the control process 520 is ready to receive further graphics primitives. In other situations, graphics primitives for the image to be signed may simply be lost. Where the document image fills the whole screen, making the image static is simply a case not processing any graphics primitives. However, where the image to be signed forms only a subset, for example a window, of the full screen, the control process 520 needs to determine whether received graphics primitives would affect the �static� area, and reject ones that would. As such, the pixmap of the static document image in the frame buffer memory 315 remains unchanged by any instructions from the graphics primitives process, or any other process executing on the CPU 200, while the document image is static. Once the document image has been made static, in step 606, the control process 520 instructs the generate pixmap process 527, including in the call the co-ordinates (a,b,c,d) provided by the application process 500, to modify the pixmap to highlight the document to be signed, as will be described in more detail below with reference to Next, in step 618, the control process 520 calls the seal process 524, and the seal process 524 calls the smartcard process 525, to recover the seal data 540 from the smartcard 122. Optionally, the control process 520 calls the generate pixmap process 527 to display another message indicating to the user that recovery of the seal data 540 is being attempted. In steps 618 and 620, the smartcard process 525 of the trusted display processor 260 and the display processor process 542 of the smartcard 122 interact using well known, �challenge/response� techniques to enact mutual authentication and pass the seal data 540 from the smartcard and back to the control process 520. The details of the mutual authentication process and passing of the seal data 540 will now be described with reference to According to The nonces are used to protect the user from deception caused by replay of old but genuine signatures (called a �replay attack�) by untrustworthy processes. The display processor process 542 of the smartcard 122 then concatenates R2 with its seal data SEAL 540, signs the concatenation R2∥SEAL using its private key SSC to produce a signature sSSC(R2∥SEAL), encrypts the seal data SEAL 540 using its private key SSC to produce encrypted seal data 540 sSSC(SEAL), and sends nonce R2, the encrypted seal data sSSC(SEAL), the signature sSSC(R2∥SEAL) and the smartcard's certificate CertSC to the smartcard process 525 of the trusted display processor 260. The smartcard process 525 extracts the smartcard's public key from the certificate CertSC and uses this to verify nonce R2 and the signature sSSC(R2∥SEAL), decrypt the seal data SEAL 540 from the encrypted seal data 540 sSSC(SEAL) and, finally, return the seal data SEAL 540, via the seal process 524, to the control process 520. Returning to Next, in step 632, the control process 520 instructs the signature request process 523 to request the signing of the document image; the signature request process 523 calls the read pixmap process 526 to request return of a digest of the pixmap data of the document to be signed; and the read pixmap process 526 reads the respective pixmap data, uses a hash algorithm to generate a digest DPIX of the pixmap data and returns the digest to the signature request process 523. Additionally, the read pixmap process 526 generates �display format data� FD, which includes information necessary to reconstruct the image from the pixmap data into a text-based document at a later time (FD is not essential, since the document text may not need to be reconstructed), and returns this also to the signature request process 523. For example, the display format data FD may include the number of pixels on the screen surface and their distribution, such as �1024 by 768�, and the font type and size used for the text (if the document is text-based) in the document (at least some of this information may instead, or in addition, be contained in a document �summary�, as will be described below). In steps 634 and 636, the signature request process 523 interacts with the display processor process 542 of the smartcard 122 using well-known challenge/response processes to generate an individual signature of the document, as will now be described in detail with reference to the flow diagram in According to Returning to
In step 644, the control process 520 calls the summary process 522 to generate a summary message SUM containing the number of images (two in the example summary above) plus the individual signatures of the images (lines 6 and 10 of the example), a label identifying the trusted display device (line 1 in the example), the current time and date (line 2 in the example) and a signed digest of the summary itself (line 14 in the example). For each image, the summary also includes the size of the image in pixels (e.g. 560�414 for image 1), the offset from the origin of the screen in pixels (e.g. 187,190 for image 1) and the display resolution in pixels (e.g. 1024�768 for image 1). The summary process 522 then generates a digest of the summary DSUM in step 646 and calls the smartcard process 525 of the trusted display processor 260 to interact with the smartcard 122 using challenge/response processes to generate a signature of the summary digest DSUM, as will now be described with reference to According to Returning to The individual signature and summary may be used by the application process 500, or any other process running on the host computer 100 in various ways outside the scope of this invention, including as proof of contract, for storage or for transmission to other entities. Finally, in step 656, the control process 520 unfreezes the display, by recommencing receipt and processing of graphic primitives associated with the document image, and thereby in effect returns control of the display back to the application process 500 or other application software. Alternatively, control may not be handed back to the application process 500 until the user actuates the trusted switch 135 again, typically in response to another user message, which, this time, would not have a timeout period. This would give the user more time to review the static document image before returning the host computer to standard, non-trusted operation. In order to verify a signed document, both the individual signature PIX∥sSSC(DPIX)∥sSSC(FD) and the summary SUM∥sSSC(DSUM) must be verified. Such verification methods are well known to those skilled in the art of security. For example, the signature on the digest of the pixmap sSSC(DPIX) is verified using the public key of the user, which is publicly available and preferably contained within a digital certificate CertSC supplied by a certification authority. The verified digest is then compared with a value obtained by re-computing the digest from the pixmap, where the digest is generated using a standard, well-known and defined hash function. If the match is exact, the signature has been verified. Other signatures, including the summary, are checked in the same way. A preferred method of enabling a person to verify the wording of the signed document is to translate the pixmap back into an image. This requires an application, or indeed a trusted display processor 260, to load the pixmap data PIX into the frame buffer memory 315 of a respective host computer 100. This allows a person to view the document that the signer has signed. The stages of highlighting a document to be signed will now be described with reference to In the preferred embodiment, the seal data SEAL comprises a pixmap of a trusted image. For example, as shown in It will be appreciated that the trusted display processor 260 needs to be able to display the seal image(s) and the messages in the correct places on screen. Clearly, the seal image and the message images are temporary, to the extent they appear during the signature process and disappear thereafter. There are well-known, standard display techniques for overlaying a first image with a second image, thereby obscuring a part of the first image, then removing the second image and restoring the portion of the first image that had been obscured. Such techniques are used as a matter of course in normal windows environments, for example, where multiple windows may overlap one another. The trusted display processor 260 is arranged to implement one of more of these standard techniques for the purposes of superimposing the seal image(s) and the message images over the standard display. In some scenarios, it may be that a document is too large to fit all at once onto the VDU 105 screen and still be easily read by a person. Obviously, for the present embodiment to be practical, it is essential that a user can very clearly read the document before signing it. Therefore, the document can be split into multiple screen pages, each of which needs to be signed and cryptographically chained to the signature of the previous page, as will now be described. First, the application process 500 causes the image of the first page to be displayed and makes a call to the trusted display processor 260 for signing as before. When the trusted display processor 260 returns the individual signature, instead of requesting a summary, the application process 500 instructs the trusted display processor 260 to display the image of the second page and sign the image. Clearly, in this case, the trusted display processor 260 is arranged to support such a request by the application process 500. Only after all images have been signed and returned to the application process 500 does the application process 500 issue a request for a summary. Then, the summary includes the number of images that were signed in this multi-page document, for example as illustrated in the two-page summary above. The first page in the multi-page document is signed in the same way as a single page, resulting in return of an individual signature. When subsequent images are presented for signing, however, the trusted display processor 260 recognises that they are part of a multi-page document because no summary request was received after the previous signature request. As a result, the trusted display processor 260 displays a different message, which requests permission from the user to sign a continuation page. In response, the user who is signing a multi-page document uses the same reliable permission channel as before (for example, the trusted switch 135) to confirm to the trusted display processor 260 that this page is associated with the previous page, and is also to be signed. When the trusted display processor 260 receives this multi-page confirmation, it concatenates the signature of the previous signed page with the pixmap of the current page, creates a digest of the concatenation, and sends that to the smartcard for signing. This is instead of sending a digest of just the current pixmap. This process cryptographically �chains� a subsequent page to the previous page, so that pages cannot be rearranged without detection, nor can intermediate pages be inserted or deleted without detection. The validity of the first page may be checked in exactly the same way as a single page. The validity of subsequent pages is checked using the same method as for a single page, except that the digest of the current pixmap is replaced by the digest of the concatenated previous signature and current pixmap. It will be appreciated that there are many ways of cryptographically chaining a subsequent page to a previous page. Such ways will be obvious to those skilled in the art of security in the light of the present description. For added security, the image of each page of a multi-page document may be arranged to include the conventional footer �Page x of y, where �x� is the number of the page and �y� is the total number of pages. This enables ready detection by a person of a truncated document simply by reading the document. A significant benefit of the present document signing scheme is that a signed document can be re-signed and countersigned. As such, it is preferable for the summary of a document to include an audit trail. There are many variations on re-signing and countersigning, although (obviously) an electronic integrity check should always be done before any further signing. At one extreme, the new signer could view, confirm and re-sign each signed image in turn, effectively replacing the original signature by a new one. This method could be used, for example, by a user signing a document prepared for him by someone else. At the other extreme, the new signer could simply �rubber stamp� the original signature by signing the original summary, without necessarily viewing the document at all. This could be useful to a manager countersigning the work of a trusted employee. For a re-signing operation, the application process 500 issues a re-signing request, and transmits an already signed document (plus the individual signature(s) and the summary) to the trusted display processor 260. The trusted display processor 260 verifies the signed document using the public key of the signer, recovers the pixmap of the document (or each page of the document) and displays each verified image in the correct order to the new user, as if they were original images from the signature request application. The user confirms the acceptance of each individual image, for example using a trusted switch 135 as before, and causes the images to be signed as before by a smartcard belonging to the new user. This results in a signed document that is the same as the original document, except that it has been signed by the smartcard belonging to the new user. Similarly, for a counter-signing operation, the application process 500 issues a counter-signing request and transmits the signed document (plus individual signatures and the summary) to the trusted display processor 260. The trusted display processor 260 verifies the signed document and displays each verified image in the correct order to the new user, as if they were original images from the application process 500. The user confirms acceptance of each individual image and the trusted display processor 260 signs the original summary using the smartcard belonging to the new user. Optionally the new user could provide a certificate of the previous user's public key, signed by the new user, to ease the processing overhead associated with later verification of the signature. Clearly, there are many possible variations on the theme of re-signing and countersigning, which will be apparent to the skilled person in the light of the present description. Since a document may have a history of signing, resigning and/or counter-signing, the present embodiment conveniently provides audit information, which forms part of the document summary. This audit information allows the signature history of the document to be traced. The audit information includes data about the previous state of the document and the actions taken by the new user to create the new state of the document. The audit information is signed by the trusted display processor 260, since the audit information must be independent of the user. The audit information always contains any previous summary information (including the signature on that summary information, by the previous signer). If the signed document has been created from scratch, the identity label IDP of the trusted display processor 260 is inserted as an audit root. The audit information preferably also includes an indication of which individual images were viewed and confirmed by the new user, and whether the document was created from scratch, or was re-signed, or was countersigned by the new user. To create a summary including audit information, the smartcard is sent a digest of the audit information concatenated with the previously described contents of a summary, rather than a digest of just the previously described contents of a summary. The rest of the process is as previously described. An enhancement to the process for signing a document is that, prior to signing the pixmap data, the trusted display processor 260 compresses the pixmap using a lossless compression algorithm so that the overheads associated with storing and sending the individual signature are reduced. The pixmap may be compressed by standard compression algorithms, for example a codeword-based algorithm applying LZ-1 or LZ-2 compression. Alternatively, a technique similar to OCR (optical character recognition) may be used to compress the pixmap. In this case, the situation differs from conventional OCR in that the input data has been perfectly �scanned�, albeit at a lower resolution than in conventional OCR. The OCR-compressed version of the pixmap may be generated by �blob-matching� to create an alphabet for the pixmap, constructing a pixmap of each character in the alphabet, and constructing a message using those characters, such that the message represents the original pixmap. This means that the pixmap can been compressed to a new alphabet and a message written in that alphabet. Since there are, obviously, no errors nor ambiguity in the pixmap data, this is a lossless compression method. Another way of reducing the size of the image pixmap is by representing the image as a pure black and white image, requiring only a single bit�set to zero or one�to define whether a pixel is black or white. Otherwise, the document image is represented as a full colour image, where each pixel may typically require up to 24-bits. Obviously, this technique may be suitable for simple, black and white text-based documents. However, it would not be appropriate for colour documents or images. At any time, the document image may be converted back into a text-based document using an OCR-type process to reconstruct a standard digital textual representation of the document. This technique cannot be used in the signature, since the textual mapping may be incorrect, but can be used by the receiver of a signed document to convert it back into a standard digital textual representation (such as ASCII) for subsequent machine manipulation. In preferred embodiments, the trusted display processor 260 is equipped to enact OCR document recovery. To enact OCR, an OCR alphabet is generated in a standard fashion and is then matched to stored fonts and hence converted to a standard character set. As in conventional OCR, ambiguous matches may be retained as a pixmap and flagged for conversion by the user. (This is unlikely, particularly if font type and size information has been supplied in the display format data FD, because there is no error in the data.) In cases of extreme caution, the entire reconstructed document should be manually checked by a person against the view of the document that the signer intended to sign. Preferably all document reconstruction processes are done by processes that are trusted. The preferred embodiment described above relies on the premise that the trusted display processor 260 has direct and exclusive access to video data stored in the frame buffer memory 315, beyond the point where the video data can be manipulated by host computer 100 software, including the operating system. This implies that the video data cannot be modified unless the trusted display processor 260 makes the modification. It will be appreciated that not all computer architectures are arranged in this way. For example, some computer architectures are arranged such that the frame buffer memory forms a part of the main memory, thus forming a single address space (SAS) display system. One benefit of such a system is that both the CPU and the display processor can access the frame buffer memory and share the graphics operation overhead, thereby improving graphics performance. Clearly, an implementation of the present invention in such a SAS system cannot rely on the premise that the buffer memory is safe during signing, since the CPU can still access the memory. However, there are many ways in which such a SAS system may be modified to support implementations of the present invention. For example, the memory could be provided with a control line from a trusted display processor such that, during a signing operation, the memory is prevented from being updated by data from the CPU. The memory devices themselves are preferably modified so that they include the extra logic to perform this function. Alternatively, access to memory is blocked by other logic circuits inserted into the normal control path of the memory. Such systems, therefore, rely on the modified premise that the video data in the frame buffer memory can only be modified, other than by the trusted display processor, with the permission of the trusted display processor. Clearly, this premise is as valid for secure operation as the first premise, as long as the system is truly secure. In other architectures, for example in simple graphics environments, the functionality of a display processor may form part of the operating system itself, thereby removing the requirement for separate display processor hardware. Clearly, in this case, the graphics overhead put on the CPU will be higher than in a system with separate display processor hardware, thereby limiting the graphics performance of the platform. Clearly, there is then no place for a �trusted display processor� as such. However, it will be apparent to the skilled person that the same function as provided by the trusted display processor, that of protecting the frame buffer memory and interacting with a smartcard, can be implemented using an appropriate trusted component, which controls the display system (in whatever form) during signing. In other embodiments of the invention, the functionality of trusted switch 135 may be replaced by software. When the trusted switch process 529 is activated (as in step 630), instead of waiting for operation of a dedicated switch, the trusted component 260 uses its random number generation capability to generate a nonce in the form of a textual string. This textual string is then displayed on the trusted display in a message of the form �Please enter <textual string> to confirm the action>. To confirm the action, the user must then enter the given textual string, using the keyboard 110. As the textual string will be different every time, and because no other software has access to this textual string (it passes only between the trusted processor 300 and the display), it will not be possible for malicious software to subvert this confirmation process. In other embodiments of the invention, in addition or alternatively, the trusted display processor (or equivalent) includes an interface for driving a trusted display. The trusted display might be, for example, an LCD panel display. In the same way that the trusted switch provides a trusted means for a user to interact with the trusted display processor, the trusted display can provide a trusted means for feeding back information to the user other than via the standard VDU. For example, the trusted display might be used to provide user status messages, as described above, relating to a signing operation. As such, applications running on the standard host computer should not be able to access the trusted display, because the display is connected either directly to the trusted display processor or via some form of trusted channel. In essence, such a trusted display is an addition to the so-called �trusted interface� described above. In practice, there is no reason why other forms of trusted feedback device, of which the trusted display is one example, could not be included in addition, or as an alternative. For example, there may be scenarios where some form of trusted sound device would be useful for providing audible feedback. An alternative application for the invention is to provide a trusted interface during an electronic transaction. In one exemplary embodiment, the user wishes to send sensitive data to a remote computer system. The user cannot be sure that the remote computer system, or indeed the host computer he is using, is trustworthy. In order to ensure that the sensitive data is safe from interception by unauthorised parties during transmission to the remote computer system, and to ensure that only the authentic remote computer system can read the sensitive data when it is received, the user wishes to encrypt the data using the authentic remote computer system's public cryptographic key. In the embodiment, the host computer incorporates a trusted component, which interacts with the user's smart card in order to recover and display a trusted image as described in detail above. The trusted image may be displayed on the standard VDU screen or on a separate display, such as an LCD display, in order to indicate to the user that the trusted component, rather than a subversive application, is in control. The trusted component then interacts with the remote computer system in order to recover and authenticate the remote computer system's certificate containing a respective public key. With the public key, the trusted component encrypts the sensitive data, which might itself also be read from the smartcard, and transmits the encrypted data to the remote computer system. There are many other applications, especially e-commerce applications, where the concept of a trusted user interface, providing trusted user feedback and trusted user input device(s), would be valuable. As such, the present invention should not be read as being limited to the few embodiments described above, and should only be limited by the language of the claims. Patent Citations
Non-Patent Citations
Referenced by
Legal Events
Rotate |


text:
Ayer Reveals Jared Leto's Tattooed "Suicide Squad" Joker
Every day this year, I will be examining the artwork on a single comic book story. Today's artist is Dylan Meconis, and the comic is Outfoxed, which was self-published and dated 2011. Enjoy!
For the final day of Dylan Meconis's art, I'm taking a look at Outfoxed, and there's going to be a SPOILER. I haven't mentioned spoilers at all this year, because I figured most of what I'm showing is so old that any grace period for warning people is over, and I usually try to avoid them anyway, but Outfoxed is pretty new, and I kind of have to spoil it if I'm going to show some of the artwork. So you've been warned, all right?
For this story, Meconis goes a bit more angular, hearkening back to her early work but showing how far she's come since then. So the young lady has a sharp nose and black dots for eyes (as does the fox), but her face, for instance, isn't as sharp as Claire and Lucien from Bite Me! She's gotten very good at expressing emotion with very little, as she uses just a few lines in Panel 1 to show the fox's panic. She's back to using some hatching, as we see the thin lines on the laundress's basket, showing that it's probably made out of wicker or some other reedy substance. Meconis decided to use red as the base color here, which works really well for the background, as the trees are red against the black sky and the silhouettes of the hunters and their dogs stand out very starkly. In those silhouettes, we again see how well Meconis draws action – the figures are fluid, and the small clods of dirt the horses and dogs kick up help make the scene a bit more frenetic.
The hunters confront the laundress, and Meconis gives us this tremendous page. The layout at the top is wonderful, as she reduces the laundress in size compared to the hunter, creating an even bigger separation between the well-born lord and the low-born laundress than we get simply from the guy on the horse looking down at the woman standing on the ground. In Panel 1, the view we get is from high above the laundress, and in Panel 3, Meconis puts the dogs in the foreground as the sniff at her basket, pushing the woman to the back and reducing her further. Meanwhile, in between those two panels, we get the hunter in his tricorner hat, which seems to push the two panels on each side away, making them smaller. Meconis does a wonderful job contrasting the hunter and the laundress – she has the dots for eyes, while he has thin slits with no eyeballs. She has a simple "V" for a nose, he has a thick, slightly bumpy nose. Meconis doesn't do much on the laundress's face, retaining a sense of innocence about her person, while on the hunter, she uses thick inking lines to give him imposing jowels, and in Panel 4 she adds even more blacks to make him more sinister. Meconis brushes the laundress's face with red in Panel 5, but other than that, she leaves her face unadorned. In Panel 2, we even get a terrifying horse, as Meconis leaves its eyeballs out as well and rims it with white, making it look the tiniest bit supernatural. When the hunters ride off in Panel 7, we get the laundress alone on a dark road, receding in importance in the hunter's mind as he rides away. He's probably already forgotten her.
The fox turns into a man, because he wishes to be one. Then he decides he loves the laundress, who doesn't love him back. YOU CAN SEE WHERE THIS IS GOING!!!! Anyway, we get this page, where he pulls a jacket out of her basket (which is oddly magical) and "becomes" a shopkeeper. Meconis does a really nice job with the man, as he retains some of his foxy – no, wait, that's not right, let's check the Internet … vulpine features (INTERNET FTMFW!!!!!), with Meconis giving him flared hair and the slightest hint of fangs. His pointed nose has a bit of a bend in it, which is – wait for it – foreshadowing! Meconis once again contrasts the "lowly" laundress with the suddenly bourgeois "fox," as she still uses inking lines on the laundress's basket while the new man's jacket is crisply inked and his neckerchief is inked a bit more lushly, contrasted against her simple clothing. Once again, in the final panel, the laundress is reduced in size, as the man begins to distance himself from her. And, of course, we get the superb lettering, which adds a tone to the dialogue quite clearly.
The man turns into a hunter, which perhaps isn't too surprising, but it's still a very cool transformation. The laundress rejects him one last time, and notice how Meconis returns to the point of view of the earlier page, with the laundress in the second panel being looked at from up high and being reduced in the process. The "fox's" nose has widened, his jowls have become more defined, and his face has become sharper, especially in Panel 4. Meconis uses thicker blacks on his face, while she still leaves the laundress's face largely unhatched. The "fox" still has the black dots for eyes and red eyebrows, which are the only vestiges of his earlier self and sets him apart from the first hunter. Despite his suddenly fearful appearance, Meconis does a nice job with his disappointment at being rejected – his mouth is set in Panel 3, and he turns away angrily and a little bit sadly in Panel 4. The new man just wanted someone to love, and he believed it would be easy. When it turns out that it's not, he retreats further into his new life. It's a disturbing way to finish the story.
Meconis continues to work on Family Man and write for PvP, and she still has a lot of comics creating in front of her. I, for one, cannot wait to see more of her work. But for now, we'll have to move on, and tomorrow, I think I'll do an incredibly popular artist whose distinctive work has been wowing people for 40 years. Come back tomorrow to see who it is, or spend some time in the archives!
Didnt know meconis's work,
First 2 entry didnt convince me.. yesterday and today's entry, even though aretnt whet i'm usualy reading, are more to my flavour, and i will havean eye out on it.. to see if i can find them ;
ollieno: I always try to bring new people to readers' attention, so I'm glad you liked what you saw!
Comics Should Be Good accepts review copies. Anything sent to us will (for better or for worse) end up reviewed on the blog. See where to send the review copies.

subset: commoncrawl


text:
Register | FAQ | Blowout Cards Shop | My iTrader | Forum Rules | Members List | Search | Today's Posts | Mark Forums Read |
OTHER SPORTS BOX BREAKS Post your Other Sports Box & Case Breaks Here! |
LinkBack | Thread Tools | Display Modes |
04-12-2013, 08:38 PM | #1 (permalink) |
1 Upper Deck Vegas Summit box...and a swift Kick to the Junk!!
I wanted to get one of these as I have never before so my LCS had two and he cut me a deal on one, still pricey but When I opened the pack, I felt a nice sharp pain to the junk and I think it was probably the worst card out of there vegas set:
Attachment 139556 HULK HOGAN AUTO STICKET 10/17 Well at least I know to ask for lube and an ice pack the next time I try something like this. Thanks! Last edited by vollybal; 07-04-2013 at 12:29 PM. |
Bookmarks |
Thread Tools | |
Display Modes | |


text:
Republic Darjeeling Black Full Leaf
Choose your variety.
The Champagne of Teas - This Darjeeling tea blend has the smooth character of second flush leaves with the deep qualities of third flush leaves, resulting in a full, round cup.
- 5 Stars
Black Tea has less than half the amount of caffeine per cup than in a similar-sized cup of coffee. More about caffeine.
Steeping Instructions
Steeping black tea is easy. Simply heat fresh, filtered water to a rolling boil. Then pour water over tea and steep for 3-5 minutes if using a tea bag or full-leaf.
TGFOP Darjeeling tea leaves
Country of Origin
Darjeeling region, Northern India
- 5 Stars
- 5
What our Citizens are saying about this great gift of the leaf...
5 Stars | I love this tea | May 28, 2014 |
Christina Raeford, NC | This tea is my absolute favorite! I drink this every morning and I offer this to anyone who enjoys tea. |
4 Stars | Excellent iced | April 25, 2014 |
Rosa Union City, CA | A nice deep, malty nose with fruity and floral hints. Makes for a mild hot brew, the tea flavors disappearing with a splash of milk or cream. But served iced, it's a winner. I let this steep for a minute or two longer than recommended (and not much longer, as it will turn bitter) for that beautiful deep color. A crisp, clean, refreshing unsweetened iced tea with mild floral notes. |
5 Stars | Loving it | April 12, 2014 |
Barbara Salinas, CA | Bright, full, no need for milk or sweetener. I don't really like the bother of loose tea, but for this fantastic balanced cup I'll keep coming back for more. |
5 Stars | Great tea | January 03, 2014 |
Cheryl Hall San Jose, CA | My British husband loves this tea. He's been drinking it for years. |
5 Stars | fine darjeeling tea | October 19, 2013 |
Etta Laurel, MD | Smooth and delicious. Was a gift to a friend who doesn't drink tea and she gave it to me --it came straight from India! Thank God for friends with good taste! |
5 Stars | First Timer | March 29, 2013 |
Jason Chicago, IL | Never had this kind of tea before . It is very smooth and delicate not strong like most black teas. I'm hooked now. Try some. |
5 Stars | True Champagne of Teas | January 18, 2013 |
KARMEN Houston, TX | It has a smooth fruity, clear taste. Its great hot or cold. It doesnt have a bold strong taste like an English Breakfast. So if that is the kind of taste your going for, this isnt the tea. It has a fine delicate taste that I truly enjoy! |
5 Stars | Back to Basics | December 20, 2012 |
Patti Day Central Virginia, VA | Maybe it's me, but it seems this tea has returned to the superior quality offered in the past. For awhile it didn't have that robust flavor and deep, clear color I sought, but this is superb. Please don't change what you're doing. |
5 Stars | Try it iced! | November 11, 2012 |
Emily San Antonio, TX | Here in Texas it is often too hot to drink anything hot, even tea. This tea is absolutely marvelous iced. I make a whole pot the night before and put it in the fridge to cool. It is especially wonderful steeped with a sliced key lime. Go darjeeling! |
5 Stars | The Best | October 03, 2012 |
Lauren Missoula, MT | Delicious! Cannot get enough! |
4 Stars | Very Good Tea | May 23, 2012 |
Deb Lily Lakeland, MN | This is a very good tea. I liked it better than I thought I would. It is mild and even a little fruity. Even though I normally don't buy black tea, I think I would order it again. |
4 Stars | Very tasty | May 22, 2012 |
Jen San Antonio, TX | This tea has a great flavor. Very smooth, with a nice balance. A must buy. |
5 Stars | FANTASTIC | April 01, 2012 |
Lauren Condon, MT | A wonderful tea that we cannot live without!! <3 |
5 Stars | darjeeling black | March 22, 2012 |
mary binghamton, NY | I purchase this tea for my son. It is all he will drink. We both are sorry you have discontinued your spring pick darjeeling.Both make a very nice cup of tea. I will say even my Grandchildren like your childrens decafe teas I buy them,especially my Grandaughter....tea parties in crazy crazy hats are fun and tasty. |
4 Stars | A Nice Darjeeling | March 07, 2012 |
Rachel Sequim, WA | I love Republic's Darjeeling. This particular batch is a little more musky than I like and than previous batches, but still very good. |
5 Stars | AHHHHHH | February 11, 2012 |
Christina Raeford, NC | I love this tea! I have been looking for a black tea with wonderful flavor and beautiful color for so long. It is very slim pickings where I am, so when I began my search online and found this brand of tea, I became intrigued. This Darjeeling tea is so tasty all times of day be it cold or hot, I look forward to the next cup. Due to the rapid delivery, fantastic tea and competitive pricing, I will be order more of this tea and other flavors as well. Thanks for the great cup of tea!!! |
5 Stars | Best tasting tea, ever | January 23, 2012 |
tena Mount Vernon , IA | this is my very favorite tea, ever. I dabble with the flavored teas in the summer, but this tea with a dash of cream on a cold winter day is a wonderful warming start to the day or after supper treat. |
5 Stars | Yummmmmmmmmm | January 18, 2012 |
Audrey Orcas Island, WA | I like Darjeeling and have for many years. Yours has nice leaves, not broken up all that much and so I bought a pound of the stuff. As the headline indicates, Yummmmmm. And now since it is about 16 degrees outside with a northeast wind blowing at about 10 with gusts, I'm steeping one to consume shortly. |
3 Stars | Smooth and satisfying | January 11, 2012 |
Barbara Novato, CA | Just tried a tasting tin before jumping in- I'll be back for more. Great after-dinner cup, after the table is cleared. Smooth, but tasty. |
5 Stars | December 19, 2011 | |
John , | Wonderful |
| December 05, 2011 | |
John , | This is my favorite tea and I only drink the stuff I order from Republic of tea. |
5 Stars | Elegant | November 19, 2011 |
Heather San Francisco, CA | My husband and I love this tea weekend mornings in bed...lightly sweetened with honey or plain, it is a weekly indulgence. |


text:
BREAKING NEWS: Ibanez On 15-Day DL With Groin Strain
Posted by Tim Malcolm, Thu, June 18, 2009 10:34 AM | Comments: 69
News, Posts
Raul Ibanez has been placed on the 15-day disabled list with a left groin strain. John Mayberry Jr. has been sent up from Lehigh Valley to take his roster spot. He will start in today's series-closing game.
UPDATE (11:18 a.m.): The groin has been bothering Ibanez since April, and is unrelated to the Achilles injury. He will have an MRI today, and Ruben Amaro Jr. said Ibanez could be out longer than 15 days.
Opinion: Fine. Let him rest until the All Star game. I don't care if he plays or not. Get him healthy for the second half. Something tells me the Achilles contributed to the groin, or vice versa. Either way, get him healthy.
Posts: 0 Trout Boy
Well, shiiiiiiiiiiiiiiiiiiiit. That hurts. I'm getting worried…
Things look a bit bleak right now.
Posts: 0 Joe D
Well, its Johns time to shine and maybe we can use him as a better trade bait for a solid pitcher.
Posts: 0 Chuck P
Explains a lot, I guess…
Silver lining- we get to see Mayberry every day for a little while… would love to see if he can be our RH bench bat.
Posts: 0 adam
Lets just hope hes only out for the minimum 15 days
Posts: 0 Justin
I'm sure he does a rehab stint, they won't rush him back, specially if they're calling a groin strain they don't want it to be anything more serious where he misses more time.
Posts: 0 Buffalophilsfan
OK, lets just settle down. I wanted to get in before Jeff chimes in and says the season is over and let's look to rebuild by unloading Howard and Rollins for prospects.
This is a setback, but better it happened now than later. Even more of an issue I feel is the starting pitching. We can get by without Rauuuul for a couple weeks, but there is no way they can survive without adding 1 and probably 2 starters.
We are still +3 on the Mets and the Braves and Marlins seem to be fading well below .500. Keep treading water until we land those arms. Zach Duke goes today for the Buckos and he is my man to right this ship. Grabbing Duke and moving Bastardo to the pen will help both situations. In the meantime, lets get Rauuuul healthy and hope Mayberry gains some valuable every-day playing time to increase his trade value (or maybe Werth or Vic!!)
One more thing, Charlie PLEASE take JRoll out of the 1 hole. The way he is going it is like having pitchers hit back-to-back in the lineup.
Posts: 0 The Dispy
I was watching the Boston game on Sunday and I thought I saw him pull up a little going to first. I wonder if thats when he did it. Oh well. Perhaps a nice little stretch by Mayberry can bump his trade value a little.
The Dipsy
"Always striving to make the Phiilies a better team".
Posts: 0 Casey
on a pure selfish note – i hope this does not affect his all star standings – would love for him to still be able to go as a starter!!
Posts: 0 mkelly
mayberry will shine. he is a great young talent
Posts: 0 JeffS
On a selfish note for me, and since I don't have tix for Philly until sometime in July, maybe I'll get to see Raul in a rehab game in Reading or A-town.
After getting lots of good breaks early in the season, anyone else feel like there's a storm cloud following the Phils lately?
Posts: 0 Geoff
At least hell get to play this time. The injury storm is coming now. Eyre, Lidge, Ibanez, etc. I predict Lidge will be lights out again when he comes back – IF hes fully healthy.
The bullpen is burned out though as Manuel said last night.
They need a reliever – and fast – and a good one at that. AND a starter that still is missing. they may have to overpay for cliff lee because the other aces are dropping like flies.
Posts: 0 Bruce
I was about to post this quote by Charlie Manual on Ibanez before I read Tim's news blurb;
" LF Raul Ibanez(notes) went 0-for-3 Wednesday night and is 3-for-17 (.176) during the first five games of the Phillies' homestand. He has been bothered by a sore left Achilles tendon caused by an uncomfortable new pair of spikes, and after grounding into a double play in the fourth inning Wednesday, he hobbled to first base. "It looked like he couldn't turn it on," Manuel said. "He kind of gimped. It looked like it might've been bothering him."
Apparently the groin injury may have occurred when Ibanez attempted to avoid a doubleplay in straining to outrace the relay to first base.
The Phillies, unlike the Mets and other teams, have been fortunate to avoid injury to their position players early in the season. It's now catching up to them.
Posts: 0 Steve-o
ut-oh. I'm partially excited to see Big John, but it looks like the injury bug is coming to our city.
Posts: 0 Jeff
Sorry boys but this season will end…NOW. No pitching. No leadoff hitter. No closer..and a manager that just makes excuses. Cant wait to see Moyer against Tampa. There outfilder said he cant wait. He runs baby…
Posts: 0 Steve-o
In a partially unrelated note, my fantasy team is getting killed right now. I've now lost Votto, Aramis, Peavy, and Ibanez to the DL right now…
Posts: 0 pb
Maybe Charlie should've giving him a day or two off earlier in the season or pulled from some of the games that were one sided, the guy is 37 after all.
Posts: 0 Terri
From Ruben Amaro Jr.: The groin strain is unrelated to the Achilles' problem and has been bothering Ibanez on and off since April, although he only made the Phillies aware of the injury last week. Ibanez will undergo an MRI exam later today, and it's possible, Amaro said, that he could miss more than 15 days.
"There was no reason for him to talk me out of [putting him on the disabled list]," Amaro said. "If he was clearly hurting, he can hurt himself even more if he continued to play."
Posts: 0 Don M
What excuses is the manager making?
Ibanez has been the most consistent player on the team this season.. no need to give him days off unless he was hurting.. which he finally did.
Lets not blame the manager for injuries, and the hitting coach for lack-of contact last night..
Posts: 0 Dan
The fact that the mets are only 3 games back with all the injuries they have had is absolutely pathetic
Posts: 0 Chuck
Everybody…..Jeff are you listening??…..just SETTLE DOWN. We have the ability to get through this. Mayberry is a good talent and, while Rauuuuuul will be missed, we should be able to weather this.
Pitching, however, is a huge issue. I don't know about you guys, but I'm really sick of watching Moyer talking to reporters in the locker room about how he has no answers for his poor performances and as to why the Phillies can't win at home.
Posts: 0 Don M
That fact that Our closer, our #2 starter, and now our best hitter are all hit with injuries.. and we're still 3 games up! is absolutely awesome
Posts: 0 JeffS
Don M's glass isn't half-full, it's overflowing!
Posts: 0 Dan
your best hitter just went on the DL….your #2 starter sucked anyway…..and your closer also sucked
Posts: 0 Chuck
It IS awesome…..good thing the injuries are coming early enough. Ok…Myers is probably done….but Lidge and Raul will come back strong and with some pitching help (hopefully) we should be ok. I'm excited to see Mayberry, too. Someone mentioned the silver lining of getting to see him everyday for awhile…which isn't necessarily a bad thing.
Posts: 0 Dan
Have fun trying to upgrade your horrendous pitching staff also….Peavy (DL), Bedard (DL), top prospects are hurt, your only hope would be Oswalt- and Houston has indicated they dont want to trade him
Posts: 0 Chuck
Explain how Brett Myers "sucked" any more than any of our other pitchers besides Hamels.
Posts: 0 Phil
I say they call up Michael Taylor and see what this kid can do. He's 23. He's old enough and ready for the majors. He's projected to be a future all-star. He is raking in AA. AA is the spring board to the majors. That is where all the best talent is. AAA is just a holding station. Let Taylor come show us all what he can do. Anyone with me?
Posts: 0 Dan
Well Brett Myers might be the worst "Number 2″ starter in baseball, but I guess your right he was good for the Phillies
Posts: 0 raul
jays bring out the broms baby!
Posts: 0 JeffS
Phil, you know I have a man crush on Taylor, but I don't want him called up yet. If he does well, he could end up trade bait. Besides, position-wise, we want Taylor in left, not right.
Posts: 0 Phil
Dan, get out of here you little homer. Stop acting like the Mets are god's gift to baseball. They have the best 3B and CF in the NL but after that they have Reyes who is good, but not nearly as great as everyone thinks he is(see his OBP for reasons why) and Delgado who is pushing 40. Who are the Mets corner outfielders again? And don't get me started on Luis Castillo. Then there is that suspect pitching staff that outside of Santana isn't all that good. Santana also seems to be having some issues as well. The bullpen is very much improved, but that's it. With or without injuries the Phillies are still a better team.
Posts: 0 JeffS
I got those reversed – should stop working and doing this at the same time
Posts: 0 Ben
If only Justin Verlander or King Felix were available…
Posts: 0 Phil
JeffS, Taylor plays LF now, and besides Werth can play left anyway.
Posts: 0 John Fire
Welp, that settles it. The sky is falling.
Posts: 0 JeffS
I like his arm better in right, although the thought of Taylor and Werth in the outfiield — might keep some runners from going home.
Posts: 0 jeff
Posts: 0 Dan
Great now theres a Dan that's obvious a Mets fan posting here. Can't the Mets fans stay on their own blogs i've been posting on this site under this name for several years. (Phillies fan Dan) :/
Posts: 0 psujoe
This is exactly why Mayberry or a 4th outfielder that can play should've been on the roster. I've been saying all along that Werth and Victoino are injury prone and need breaks. Ibanez is 37 and should be getting days off periosidclaly as well. A guy like Mayberry could easily get 200+ ABs as a rotating starter and bench player.
Posts: 0 Dan
Your right Reyes is no Jimmy Rollins
Posts: 0 A.J.
Those with glass houses should not throw stones, Dan. You have a good third basemen and the rest are all second rate. You are second by default, when your team fields balls, tags bases and stops commiting stupid errors then come back and talk.
Posts: 0 Dan
Speaking of second rate….the city of Philadelphia as compared to New York
Posts: 0 Jack
Its amazing that every time a guy has a rough few games or so, they automatically blame it on an injury. Ruben said this has been bothering him since April? I couldnt find this more hard to believe. I would love for Charlie to say in the Locker Room, "If you are hurt… get it taken care of, stop bitching and making excuses and come back ready to play. If not tell Kyle Kendrick I said hi! This includes all 25 players on the roster, from Utley to Tacshner!" Its getting annoying people and we cant trade away 42 prospects for 3 pitchers, an Outfielder, a SS and a bench bat or 2. Man the F*** up already! 2008 is over, time to sober up!!!
Posts: 0 Jack
Dan seriously shut up. All your doing is wasting time because most people look right past your posts. Your probably from the "outskirts" of New York anyway you phucking blow j.
Posts: 0 Dan
P*ss off Dan, and go back to your Mets blog, seriously. I don't get these Mets fans coming to a Phillies blog and now I am lucky enough to have one who shares a name with me. Just great.
Posts: 0 Don M
You could put Jose Reyes' at SS and combined they wouldn't be as good defensively as Rollins..
my glass isn't overflowing yet.. but it's June 18th.. and we lost games to the RedSox and BlueJays .. last time I checked, they are two of the better teams in baseball
I won't be surprised at all if we take 2-of-3 from Toronto when we're up there next weekend.. its baseball and it's a LONG season
Here in Philadelphia.. our team worries about winning games when the pressure is on.. not jumping out to early division leads only to serve them them up late in the season
Posts: 0 Don M
two* Jose Reyes' ..
His OBP is better than Rollins.. but until he LEADS that team somewhere.. you can't say he's better..
David Wright is a hell of a ballplayer.. but also isn't great defensively..
Beltran reminds me of Utley.. a non-vocal leader.. who makes too much money, but is among the best overall players in baseball
It doesn't say much about the Braves if they can't jump on us, or the Mets with all these injuries
Posts: 0 psujoe
Philadelphia second rate to New York? LMAO. new York is going broke. I hope you enjoy your 25% taxes!
Posts: 0 A.J.
I do not live in Philly or PA, Dan, and I enjoy my lower taxes, so try another argument. Wait, I seem to remember 2007 and 2008 when the Mets wrapped up the East Division – OH WAIT – forgot… That was us.
Posts: 0 gabriel
trying my hand at writing… feedback appreciated!


text:
Halting progress in PortlandPublisher's NotebookJanuary 3, 2014New York state may be "Open for Business" when it comes to boosting development and enterprise, but the town of Portland is not getting the message.... joewYep send in the clowns who just don't get it and can't see the big picture! 0 Agrees | 0 Disagrees | Report Abuse » ClownsHey D' Augustino are you for real? What exactly is a bunch of cabins going to do for the tax base in Portland? Its not NRG. There is a lot of problems going on in your own backyard that are more story worthy. 0 Agrees | 1 Disagrees | Report Abuse » Showing 2 of 2 comments
Post a Comment |


text:
Why Is the Best New Gay TV Show
BY Diane Anderson-Minshall
February 15 2012 5:00 AM ET
On one of TV's most highly anticipated new spring series, NBC's Awake, Jason Isaacs plays detective Mark Britten, a talented cop who is in an auto accident that seems to have killed his wife. Hannah (Laura Allen, who played the bisexual drug addict on Dirt). and teenage son. Rex (Dylan Minnette, Medium). Yet when he awakens each morning, he's living one of two parallel lives: one in which his son survived, another where his wife survived. This new take on a police procedural is what Jennifer Salke, president of NBC Entertainment, calls a sliding doors concept. "The implications of this are complicated," says Salke. "But we think that the viewers will get hooked into the clever mythology in the way the stories overlap and affect each other in very interesting ways."
As he moves between worlds, two very different therapists help Mark address his ingenious coping mechanism. It's these conversations the surprisingly self-aware cop has with these two shrinks that fuel much of what's wonderful about Awake. B.D. Wong, the gay actor who played the moral compass at the heart of Law & Order: Special Victims Unit for a decade, is the confrontational therapist Dr. Lee. Cherry Jones, the lesbian actress best known as the president on 24 — and for being the first gay person to thank their partner when accepting a Tony Award, in 1995 — is warm and comforting Dr. Evans. Each struggles to gain control over Mark's sanity, knowing with certainty that he or she is in the only "real" world. It's the first time we've had a prime-time TV show that lets two openly gay actors play a cat-and-mouse game with each other — doing so as central characters in a storyline so completely unrelated to sexuality.
Jones and Wong are each sure of their own reality on-screen.
"I am sure that she is not right," joked Wong of Jones's shrink, at the Television Critics Association discussion in January. "That's all I can be sure of. It's really interesting and fun to play a character which is having an argument with someone who they never speak to."
- More Events Cancel Over Gay Hotel Owner's Ted Cruz Dinner Party
- Kris Humphries Blames Vague Tweet, Supports Bruce Jenner
- Gay High-Schooler Gets Date for Prom — With Straight Best Friend
- Check Out The Enormous Support for Bruce Jenner from Celebs on Twitter
- Bruce Jenner: 'I'm A Woman'
- Gay Youth Group in Israel Reaching Out to Arab LGBTs


text:
well for me i got two weeks before finals so i need to get better from this flu i got now gee i just wonder how hard is to get better from your health.
yeah thanks for that and i will make sure i dont get really sick because i dont want to miss a lot of class time since december is the last semester before finals i hope i get to be healthy again once i recover from this darn cough.
well my weekend was alright no problems there and very soon i need to get over this darn cough that i have so yeah i think i might be getting a little sick or something. not sure what it is.
thank you and it seems you have time to join in the fun dont you?
YEAH! I so can't wait till tomorrow! hehe nm just been hanging out with Roger! hehe I love him so much! what have you been up to?
yep two more days you said it and its going to be a blast for this one i'll brief you more in the RPG game that im coming up with alright?
I know! I really can't wait! I get to be with my bf! I get to see him and stay with him tomorrow!
yeah i cant wait either to start it up that way everyone can have fun and enjoy themselves.
well yeah i always have good ideas suddenly and never backdown from it anyways im going to start this thread before holidays or on the holidays which can take a while so its up to me to figure this cookie out and crack it if you know what i mean?
No I didn't drop it lol long story short.... Its my fault lol I guess lol. Oh well I will get a new one sooner or later at lest it still works lol.
God Of Angelz