KR20080036699A - Method for keyboard security and storage medium recording keyboard security driver using the method - Google Patents

Abstract

A method for keyboard security and a recording medium storing a keyboard security driver using the same are provided to block malicious keyboard data leakage by modifying a call function of an IRP(I/O(Input/Output) Request Packet) dispatch table of a USB(Universal Serial Bus) hub driver, which is the bottom layer of a system. A call function for IRP_ML_INTERNAL_DEVICE_CONTROL among an IRP dispatch table of a USB hub driver is changed into a security device control function(S534). The call functions for a keyboard disconnection request IRP among the IRP dispatch table of the USB hub driver are changed into a security device disconnection function. Device objects to protect inputted data are registered to a protected device list database. It is continuously monitored whether contents of the IRP dispatch table of the USB hub driver are changed. First and second stages are repeated when the contents of the IRP dispatch table of the USB hub driver are changed.

Description

Method for keyboard security and storage medium recording keyboard security driver using the method}

FIG. 1 is a block diagram sequentially illustrating a process of transmitting general keyboard input data to a web browser.

FIG. 2 is a configuration diagram sequentially illustrating a process of transmitting keyboard input data to a web browser by applying a keyboard security method according to an exemplary embodiment of the present invention.

3 is a block diagram schematically illustrating an internal configuration of a keyboard security driver according to a preferred embodiment of the present invention.

4 is a block diagram schematically illustrating an internal configuration of a security driver installation module of a keyboard security driver according to an exemplary embodiment of the present invention.

5 is a flowchart sequentially illustrating the operation of the security device control function of the keyboard security driver according to an embodiment of the present invention.

6 is a flowchart sequentially illustrating the operation of a security input data processing function of a keyboard security driver according to an embodiment of the present invention.

7 is a flowchart sequentially illustrating operations of a new device operator processing function of a keyboard security driver according to an exemplary embodiment of the present invention.

<Explanation of symbols for main parts of the drawings>

20: keyboard security driver

200: security driver installation module

210: configuration change monitoring module

230: protected device list database

240: device control functions for security

242: Security input data processing function

250: device disconnection processing function for security

270: New device descriptor processing function

202: protection device register

204: device control function installation unit

206: device connection termination processing function installation unit

The present invention relates to a keyboard security method for preventing the input data of the keyboard from leaking to the outside, and to a computer readable recording medium recording a keyboard security driver to which the method is applied. More specifically, in using a USB keyboard, A keyboard security method that changes the dispatch table of the I / O request packet (IRP) of the hub driver and intercepts the URB to prevent the data from the USB keyboard from leaking to the outside, and a computer that records the keyboard security driver applying the method A recording medium that can be used.

FIG. 1 is a block diagram sequentially illustrating a general process in which a kernel area of a computer receives keyboard input data from a keyboard using a USB interface (hereinafter, referred to as a “USB keyboard”) and transfers it to an application program which is a user area. As shown in FIG. 1, when data is input from a USB keyboard, the USB root hub driver, a HID (Human Interface Device) driver, a keyboard driver, and an operating system (O / S) program are sequentially passed through the application program. The input data of the keyboard is displayed in the web browser.

However, most of the various spyware or hacking programs intended to leak information are hacked while data input from an input device such as a keyboard is transmitted. As shown in FIG. 1, a filter driver capable of performing a malicious hacking function is installed between the USB root hub driver and the HID driver (A), between the HID driver and the keyboard driver (B), and the like. Keyboard data transmitted to the HID driver and keyboard data transmitted from the HID driver to the keyboard driver are hacked.

An object of the present invention to solve the above-mentioned problem is to provide a security method for a USB keyboard to prevent malicious keyboard data leakage by changing the call function of the IRP dispatch table of the USB hub driver, which is the bottom of the system.

Another object of the present invention is to provide a computer-readable recording medium recording a keyboard security driver program to which the above USB keyboard security method is applied.

The keyboard security driver program according to an aspect of the present invention for achieving the above technical problem is to block the leakage of keyboard input information by changing the calling functions of the I / O Request Packet (IRP) dispatch table of the USB hub driver,

A protected device list database that stores a list of device objects that will protect the input data;

A security driver installation module for changing the calling functions of the IRP dispatch table of the USB hub driver to the calling functions for security and registering device objects to protect the input data in the protected device list database;

After the operation of the security driver installation module is completed, continuously monitoring whether the contents of the IRP dispatch table of the USB hub driver is changed, and if the contents of the IRP dispatch table are changed, the call function of the IRP dispatch table is recalled. It has a configuration change monitoring module that changes back to security call functions.

The security driver installation module of the keyboard security driver having the above characteristics,

A protected device registration unit for retrieving device objects stored in the USB hub driver, acquiring device descriptors from the found device objects, and registering the device object in the protected device list database when it is confirmed that the device is a keyboard device. ,

Device control function installation unit for changing the call function for the IRP_MJ_INTERNAL_DEVICE_CONTROL in the IRP dispatch table of the USB hub driver to a device control function for security,

And a device connection release processing function installation unit for changing a call function for IRP_MJ_PNP in the IRP dispatch table of the USB hub driver to a device connection release processing function for security.

The security device control function of the security driver installation module having the above-mentioned features

If IRP_MJ_INTERNAL_DEVICE_CONTROL checks the control code and parameter value and determines that IRP is a URB requesting the transmission of keyboard input data, the calling function of the completion routine is changed to a security input data processing function.

If IRP_MJ_INTERNAL_DEVICE_CONTROL checks the control code and parameter value and determines that IRP is a URB requesting a device descriptor for a newly connected USB device, the calling function of the completion routine is changed to a new device descriptor processing function.

It is preferable to store the address values for the calling function and context of the completion routine before the change in a separate place, and then change the context of the relevant IRP to the address values. At this time, in the case of other device control codes or URB function codes, the corresponding IRP is not modified.

The security input data processing function copies and encrypts the data transmitted through the URB from the keyboard, deletes the data stored in the existing buffer, restores the IRP information to the existing pre-stored IRP completion routine and context, and then Call the IRP completion routine.

The new device descriptor processing function analyzes the device descriptor of the new device passed through the URB by using the device descriptor reading function, and if the analysis determines that the device is a keyboard device, the device of the device in the protected device list database. After adding the object, restore the IRP information to the previously saved IRP completion routine and context, and call the existing IRP completion routine.

The device descriptor read function reads a USB device descriptor and determines that the device is a keyboard device if it is determined that the device is a HID class and uses a keyboard protocol.

Preferably, the security device disconnection processing function of the keyboard security driver having the above-mentioned feature deletes the disconnected device object from the protected device list database.

Keyboard security method according to another aspect of the present invention is to block the leakage of keyboard input information by changing the call function of the IRP dispatch table of the USB hub driver,

(a) changing the calling function for IRP_MJ_INTERNAL_DEVICE_CONTROL in the IRP dispatch table of the USB hub driver to the device control function for security;

(b) changing a call function for IRP_MJ_PNP in the IRP dispatch table of the USB hub driver to a device disconnect processing function for security;

(c) registering device objects to protect input data in the protected device list database,

(d) continuously monitoring whether the contents of the IRP dispatch table of the USB hub driver are changed, and if the contents of the IRP dispatch table are changed, repeating steps (a) and (b).

Step (c) of the keyboard security method having the features described above

(c1) searching for device objects stored in the USB hub driver;

(c2) obtaining a USB device descriptor from the retrieved device objects,

(c3) reading the device descriptor to confirm that it is a device object representing a keyboard device,

(c4) preferably registering the identified device object with the protected device list database.

The security device control function of step (a) of the keyboard security method having the above-mentioned characteristics

Check the control code of IRP_MJ_INTERNAL_DEVICE_CONTROL and the function code of the URB, and store the address of the calling function and context of the IRP completion routine if it is keyboard input data or requesting a device descriptor. step,

Changing the calling function of the completion routine to a security input data processing function or a new device descriptor processing function, and

Changing the context of IRP_MJ_INTERNAL_DEVICE_CONTROL to the address value of the memory where the stored call function and the address value of the existing context are stored;

The security input data processing function encrypts the keyboard input data received through the completion routine of the IRP, transmits the encrypted keyboard input data to an external security control module, and deletes the original keyboard input data.

Preferably, the security device connection release processing function of the keyboard security method having the above-mentioned feature deletes a device object in which a connection release request of IRP_MJ_PNP has occurred from the protected device list database.

Hereinafter, a configuration and an operation of a USB keyboard security method and a security program to which the security method is applied according to a preferred embodiment of the present invention will be described in detail with reference to the accompanying drawings.

2 is a block diagram showing the overall system of the keyboard security driver 20 to which the keyboard security method according to the preferred embodiment of the present invention is installed to block leakage of keyboard input data.

3 is a block diagram schematically illustrating a configuration of a keyboard security driver 20 to which a USB keyboard security method is applied according to a preferred embodiment of the present invention.

Referring to FIG. 3, the keyboard security driver 20 according to the present invention includes a security driver installation module 200, a configuration change monitoring module 210, a protection device list database 230, a device control function 240 for security, Security device disassociation processing function 250, device descriptor read function, and new device descriptor processing function 270.

4 is a block diagram schematically illustrating an internal configuration of the security driver installation module 200. As shown in FIG. 4, the security driver installation module 200 includes a protection device registration unit 202, a device control function installation unit 204, and a device connection termination processing function installation unit 206.

The protected device registration unit 202 of the secure driver installation module 200 searches for device objects stored in the USB hub driver, finds a device object indicating a keyboard device among the found device objects, and lists the object as the protected device list. Register with database 230.

At this time, in order to check whether it is a keyboard device, insert the value of "USB_DEVICE_CLASS_HUMAN_INTERFACE" into the "InterfaceClass" parameter of the "USBD_ParseConfigurationDescriptorEx" function and the value of "KeyboardInterface" (1) into the "InterfaceProtocol" parameter. You can check whether the keyboard device uses the keyboard protocol.

The device control function installation unit 204 of the security driver installation module 200 changes the existing processing function called when the IRP is IRP_MJ_INTERNAL_DEVICE_CONTROL in the IRP dispatch table of the USB hub driver to the security device control function 240. do. Therefore, when IRP_MJ_INTERNAL_DEVICE_CONTROL is transmitted to the USB hub driver, the security device control function 240 included in the keyboard security driver is called and executed.

The device connection release processing function installation unit 206 of the security driver installation module 200 stores the function called when the IRP is IRP_MJ_PNP in the IRP dispatch table of the USB hub driver indicating that the keyboard device is disconnected. The device disconnection processing function 250. Therefore, when an IRP of "IRP_MJ_INTERNAL_DEVICE_CONTROL" is delivered to the USB hub driver, the device connection termination processing function 250 included in the keyboard security driver is called and executed.

After the operation of the security driver installation module is completed, the configuration change monitoring module 210 continuously creates a thread and continuously monitors whether addresses of call functions of the IRP dispatch table of the USB hub driver are changed. do. If it is confirmed that the address of the call functions of the IRP dispatch table of the USB hub driver has been changed, the configuration change monitoring module 210 re-executes the security driver installation module, thereby causing the IRP_MJ_INTERNAL_DEVICE_CONTROL of the IRP dispatch table of the USB hub driver. And call functions for IRP_MJ_PNP back to the security device control function 240 and the security device disconnect processing function 250.

The protected device list database 230 stores and manages a list of input / output devices for protecting input data by the keyboard security driver. The protected device list database registers information about device objects connected to the USB hub driver at the beginning of installation by executing the secure driver installation module, and initializes by executing a new device descriptor processing function of the security device control function. After installation, you will additionally register information about device objects connected to the USB hub driver. In addition, the protected device list database deletes the corresponding device object disconnected by the execution of the security device connection termination processing function 250.

5 is a flowchart illustrating a process of the security device control function 240 according to the present invention. Referring to FIG. 5, the security device control function 240 checks the control code and the URB function code of the IRP_MJ_INTERNAL_DEVICE_CONTROL (step 500).

If the control code and the URB function code are determined to be a code for requesting URB data transmission (step 510), and if the corresponding device object is in the protected device list database (step 520), the completion routine of IRP_MJ_INTERNAL_DEVICE_CONTROL After storing address values stored in a calling function and context (step 522), the calling function of the completion routine is changed to a security input data processing function 242 (step 524), and the stored completion in the context. Change to the address value of the calling function and context of the routine (step 526).

Here, whether the control code of the IRP_MJ_INTERNAL_DEVICE_CONTROL is a URB data transmission request code is "Parameters.DeviceIoControlCode" value of the current IRP stack "IOCTL_INTERNAL_USB_SUBMIT_URB", and the "UrbHeader." If the value of "Function" is "URB_FUNCTION_BULK_OR_INTERRUPT_TRANSFER", it is determined that it is a URB data transmission request code.

 If it is determined that the control code and the URB function code are the code for requesting device information (step 530), after storing the address values stored in the calling function and context of the completion routine of IRP_MJ_INTERNAL_DEVICE_CONTROL (step) 532), the call function of the completion routine is changed to a new device descriptor processing function 270 (step 534), and the context is changed to the address value of the call function and the context of the stored completion routine (step 536).

Here, whether the control code of IRP_MJ_INTERNAL_DEVICE_CONTROL is a device information request code is determined as a device information request code when the value of "UrbHeader.Function" in the function code of the URB structure is "URB_FUNCTION_GET_DESCRIPTOR_FROM_DEVICE".

Hereinafter, the security input data processing function 242 will be described with reference to FIG. 6. The IRP and URB with the completion routine modified by the security device control function are passed to the URB driver and the completion routine (i.e. the security input data processing function) is executed when the processing on the USB device is completed.

First, it is checked whether the corresponding device driver is activated (step 600). If the corresponding driver is activated, after receiving the keyboard input data stored in the URB, the received keyboard input data is encrypted and the original received keyboard input data is deleted (step 610).

Next, the context value of the IRP and the completion routine are restored to the existing context and the address value of the existing completion routine using the passed IRP context value (step 620), and the existing calling functions are called again. After execution (step 630), the process ends.

Meanwhile, the keyboard input data encrypted by the above-described step 610 is transmitted to the outside at the request of the external application program.

Hereinafter, the new device descriptor processing function 270 will be described with reference to FIG. 7. When IRP_MJ_INTERNAL_DEVICE_CONTROL is transmitted to the security device control function 230, it is checked whether or not it is a USB Request Block (URB) requesting a device descriptor of the USB device. When a new USB keyboard device is connected to a PC, etc., an IRP requesting a USB device descriptor for the new device is generated and sent to the USB hub driver, and the security device control function converts the completion routine of the IRP into a new device descriptor processing function. Will be replaced.

First, the device descriptor of the new device passed through the URB is analyzed using the device descriptor read function (step 700). The device descriptor read function obtains a device descriptor from a USB device and checks whether the device is a keyboard device using the obtained device descriptor.

If it is determined that it is a keyboard device (step 710), after adding the device object of the device to the protected device list database (step 720), the IRP information is restored to the previously stored IRP completion routine and context ( In step 730, the restored existing IRP completion routine is called (step 740). At this time, to check whether the device is a keyboard device, insert the "USB_DEVICE_CLASS_HUMAN_INTERFACE" value into the "InterfaceClass" parameter of the "USBD_ParseConfigurationDescriptorEx" function and the "KeyboardInterface" value into the "InterfaceProtocol" parameter. You can check whether the keyboard device uses the keyboard protocol.

The security device connection termination processing function 250 is a function that is called when IRP_MJ_PNP is delivered and deletes the disconnected device object from the protected device list database to release the data protection function for the device object. If the "MinorFunction" value of the current IRP stack is one of "IRP_MN_REMOVE_DEVICE", "IRP_MN_SURPRISE_REMOVAL", "IRP_MN_QUERY_REMOVE_DEVICE", the device disconnect processing function deletes the device object from the protected device list database.

Although the present invention has been described above with reference to preferred embodiments thereof, this is merely an example and is not intended to limit the present invention, and those skilled in the art do not depart from the essential characteristics of the present invention. It will be appreciated that various modifications and applications are not possible in the scope. And differences relating to such modifications and applications should be construed as being included in the scope of the invention defined in the appended claims.

The keyboard security method and keyboard security driver according to the present invention prevents the keyboard input data from leaking out by changing the calling functions of the IRP dispatch table of the USB hub driver or the USB root hub driver, which is the lowest level of the system.

Therefore, the present invention takes the keyboard input data of the USB hub driver or the USB root hub driver and transfers the keyboard input data to the ActiveX controller which is an application program that will directly transfer the keyboard input information through the security control module without passing through the existing keyboard information transmission path. It is possible to prevent leakage of personal information at source. As a result, according to the present invention, it is possible to securely protect data input from the USB keyboard in the system using the USB keyboard.

Claims (13)

Keyboard security driver program that changes the call function of the IRP dispatch table of the USB hub driver to prevent the leakage of keyboard input information. A protected device list database that stores a list of device objects for protecting input data; A security driver installation module for changing the calling functions of the IRP dispatch table of the USB hub driver into the calling functions for security and registering device objects to protect the input data in the protected device list database; After the operation of the security driver installation module is completed, continuously monitoring whether the contents of the IRP dispatch table of the USB hub driver is changed, and if the contents of the IRP dispatch table are changed, the call function of the IRP dispatch table is recalled. A configuration change monitoring module for changing back to security calling functions; A computer-readable recording medium having a keyboard security driver program recorded thereon. The method of claim 1, wherein the security driver installation module Searching for device objects stored in the USB hub driver, acquiring a device descriptor from the found device object, and if it is determined that the device is a keyboard device using the device descriptor, the device object for the corresponding device is listed in the protected device list. A protection device register to register in a database, Device control function installation unit for changing the call function for the IRP_MJ_INTERNAL_DEVICE_CONTROL in the IRP dispatch table of the USB hub driver to a device control function for security, Device connection termination processing function installation unit for changing the call function for the IRP_MJ_PNP in the IRP dispatch table of the USB hub driver to the security device connection termination processing function And a computer-readable recording medium having a keyboard security driver program recorded thereon. 3. The security device control function of claim 2, wherein Check the control code and parameter values of IRP_MJ_INTERNAL_DEVICE_CONTROL, If it is determined that the URB requests the keyboard input data through the control code and the parameter value, the address value of the calling function and the context of the existing completion routine before the change is stored and the completion routine a keyboard security driver program recorded therein, wherein the call function of the complement routine is changed to a security input data processing function, and the context of IRP_MJ_INTERNAL_DEVICE_CONTROL is changed to an address value of a memory in which the existing address value is stored. Computer-readable recording media. 4. The security input data processing function of claim 3, wherein the security input data processing function copies and encrypts input data transmitted from the keyboard through URB, deletes the input data stored in the existing buffer, and saves the existing IRP completion routine in the context of the IRP. A computer-readable recording medium having a keyboard security driver program recorded thereon, after restoring information and calling an existing IRP completion routine. 3. The security device control function of claim 2, wherein Check the control code and parameter values of IRP_MJ_INTERNAL_DEVICE_CONTROL, If it is determined that the URB is requesting device information through the control code and the parameter value, the address value of the call function and context of the existing completion routine before the change is stored, and the completion routine ( change the calling function of the completion routine to a new device descriptor processing function and change the context of IRP_MJ_INTERNAL_DEVICE_CONTROL to the address of the memory where the existing address value is stored. Readable Recording Media. 6. The method of claim 5, wherein the new device descriptor processing function is Analyzing the device descriptor of the new device delivered through the URB, and if the analysis determines that the device is a keyboard device, the keyboard security driver, which adds the device object of the device to the protected device list database. Computer-readable recording media recorded by the program. The computer-readable recording medium of claim 2, wherein the security device disconnection processing function deletes the disconnected device object from the protected device list database. The keyboard security method that changes the call function of the USB hub driver's IRP dispatch table to prevent the leakage of keyboard input information, (a) changing a call function for IRP_MJ_INTERNAL_DEVICE_CONTROL in the IRP dispatch table of the USB hub driver to a security device control function; (b) changing the calling functions for the keyboard disconnect request IRP in the IRP dispatch table of the USB hub driver to the security device disconnect processing function; (c) registering device objects to protect input data in the protected device list database; (d) continuously monitoring whether the contents of the IRP dispatch table of the USB hub driver are changed, and if the contents of the IRP dispatch table are changed, redoing the steps (a) and (b); Keyboard security method for preventing the keyboard input data from leaking to the outside.  The method of claim 8, wherein step (c) (c1) searching for device objects stored in the USB hub driver; (c2) obtaining a USB device descriptor from the retrieved device object, (c3) reading the obtained USB device descriptor to identify a device object indicating that the device is a keyboard device, (c4) registering the identified device object in the protected device list database Keyboard security method for preventing the keyboard input data from leaking to the outside, comprising a. 9. The security device control function of claim 8, wherein (a1) checking the control code of IRP_MJ_INTERNAL_DEVICE_CONTROL and the function code of URB, (a2) If the check result indicates that the keyboard input data or device information is requested, the call function of the completion routine of the IRP and the address value of the context are stored, and the call function of the completion routine is secured. Changing to an input data processing function or a new device descriptor processing function, and (a3) changing the context of IRP_MJ_INTERNAL_DEVICE_CONTROL to the address of the stored call function and the existing context to the address of the stored memory; preventing keyboard input data from leaking to the outside. Keyboard security method.  The method of claim 10, wherein the security input data processing function encrypts the keyboard input data received through the completion routine of the IRP, transmits the encrypted keyboard input data to an external security control module, and deletes the original keyboard input data. Keyboard security method to prevent keyboard input data from leaking outside. The keyboard as claimed in claim 8, wherein the security device connection termination processing function deletes a device object from which a connection termination request of IRP_MJ_PNP is generated from the protected device list database. Security method. 11. The method of claim 10, wherein the new device descriptor processing function is Analyzing the device descriptor of the new device delivered through the URB, and if the analysis determines that the device is a keyboard device, the keyboard input data of the device is added to the protected device list database. How to secure your keyboard to prevent it from leaking outside.

Images