AU2002315824A1

AU2002315824A1 - A anti keylog editor of activex base

Info

Publication number: AU2002315824A1
Application number: AU2002315824A
Authority: AU
Inventors: Choong-Hee Nam
Original assignee: P and IB Co Ltd; TECHOUS CO Ltd
Current assignee: P and IB Co Ltd; TECHOUS CO Ltd
Priority date: 2001-08-29
Filing date: 2002-06-20
Publication date: 2003-06-05
Anticipated expiration: 2022-06-20

Description

A ANTI KEYLOG EDITOR OF ACTIVEX BASE

TECHNICAL FIELD

A security program has an ActiveX format for web browsers and

application programs, and comprises a software security input window for

preventing leakage of keyboard data without an additional hardwired device but rather by using a conventional keyboard.

Therefore, the present invention protects keyboard data on the web

browsers or application programs.

BACKGROUND OF THE INVENTION

(a) Field of the Invention

The present invention relates to a security program. More specifically,

the present invention relates to a security program for preventing leakage of

keyboard data.

(b) Description of the Related Art

Conventional techniques of keyboard data security on the Internet

include a product "Kis" released by Safetek (www.esafetek.com) in January

2001 , and devices for replacing keyboard data inputs using input means (or methods) other than a Java-based virtual keyboard. However, since the former

protects keyboard data on a hardware basis, it requires an additional predetermined device, and it is accordingly difficult to provide huge general- purpose services such as on the Internet, and the latter, that is, the security method using an additional input means is not greatly used because of users'

lack of skill and the inconvenience involved. Hence, even though it is urgently

required to secure keyboard data comprising important personal information on

the Internet, no general-purpose products have been provided to the market.

The present invention uses a keyboard to securely and easily process

input data.

SUMMARY OF THE INVENTION

It is an object of the present invention to prevent keyboard data

leakages because of hacking when a user inputs personal information, writes

electronic mail, or produces a document on the Internet.

To accomplish the present invention, a keyboard data protecting

function and a web browser supporting function are required.

In order to perform keyboard data security, first, when a scan code is

transmitted to a keyboard device driver from a hardwired keyboard, leakage of

the keyboard data remaining at the I/O port 60H is must be prevented. However, since general application programs may not properly control the leakage because of their hardwired properties and the Windows properties, a virtual

device driver (VxD) accessible to Ring 0 is to be used to prevent the above-

noted leakage.

Second, while the keyboard device driver converts the scan code into

keyboard data and transmits the same to a system message queue, the converted keyboard data may be leaked by external programs including API hooking and message hooking. Since this process is included in the Window's

default operating system (USER. EXE) and it may not be protected through general methods, another keyboard entry method that does not use the Window's default system is to be supported.

Third, data leakage during the process of transmitting the keyboard data to a desired application program must be prevented. Hackers may hook or monitor the APIs or messages used by the application programs to leak the keyboard data. Therefore, a technique for securely transmitting the keyboard data to the application program is to be created. In order to use the keyboard data on the web browser, first, it is needed for a security input window to be described using HTML documents supported by the web browser. Since the security input window does not follow the Window's default keyboard operating system, it is to be realized through a specific method to be in cooperation with the web browser. Second, it is required to support low level tasks including communication with a virtual device driver VxD on the web browser, and controlling hardware because the security input window according to the present invention uses a security keyboard driver, and directly controls the hardwired keyboard to realize the security input window.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate an embodiment of the invention, and, together with the description, serve to explain the principles of the invention:

FIG. 1 shows a whole configuration of a keyboard data security system

according to a preferred embodiment of the present invention;

FIG. 2 shows a keyboard data flowchart of a security input window

according to a preferred embodiment of the present invention;

FIG. 3 shows a data flowchart between a security keyboard driver and

the ActiveX according to a preferred embodiment of the present invention;

FIG. 4 shows a web browser to which a security input window is applied according to a preferred embodiment of the present invention; and

FIG. 5 shows an exemplified HTML source to which a security input window is applied according to a preferred embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

In the following detailed description, only the preferred embodiment of the invention has been shown and described, simply by way of illustration of the

best mode contemplated by the inventor(s) of carrying out the invention. As will be realized, the invention is capable of modification in various obvious respects, all without departing from the invention. Accordingly, the drawings and

description are to be regarded as illustrative in nature, and not restrictive. The basic operation principle according to a preferred embodiment of

the present invention is to not use a Microsoft Window standard keyboard, but

rather to use a security keyboard driver and a security input window to securely transmit the keyboard data input by the user to a web browser. FIG. 1 shows a whole configuration of a keyboard data security system,

applied to a web browser, according to a preferred embodiment of the present

invention.

Normal keyboard processing of Microsoft Windows will be subsequently

described. Electrical signals generated from keyboard hardware 101 are

provided to the 8255 of the motherboard, they are represented in scan codes, and they are provided to a virtual keyboard driver (VKD) 102. The scan codes

that are different depending on the keyboard type are converted by the VKD

102 into keyboard messages used as the standard of the operating system. The keyboard messages are transmitted to a virtual machine (VM) currently

activated according to USER.EXE that is stored in a system message queue

and which is a Ring 3 component of the operating system. The keyboard data

stored in the VM are transmitted to a web browser 105 through a thread

message queue 103 to perform a key input task. However, the key input task of the security input window according to a

preferred embodiment of the present invention is realized in a manner differing

from the above-noted conventional description.

Regarding the principle of the key input security task in a security input window, electrical signals generated from keyboard hardware 101 are provided

to the 8255 of the motherboard, they are represented in scan codes, and they are provided to a virtual keyboard driver (VKD) 102. After this, the virtual

keyboard driver 102 calls VKD_Filter_Keyboard_lnput that represents a hooking function (a user redefinition function) for user-defined key management. When a carry is set and returned from the hooking function called by the virtual keyboard driver 102, the virtual keyboard driver 102 ignores a keyboard

message and aborts subsequent keyboard message processing. The hooking

function in the security keyboard driver stores the keyboard data in its queue,

sets a carry, and returns the carry. Therefore, the keyboard message is not

transmitted to a system message queue, a thread message queue, and a web

browser, thereby preventing leakage of the keyboard data through message hooking. In this instance, the hooking function is provided to and managed by a

security keyboard driver.

The security keyboard driver redefines the VKD_Filter_Keyboard_lnput

to prevent message hooking. However, the scan code remains in the 8255 of the motherboard after the above-noted task. Scan code trace data may not be

erased through a general method because of properties of the 8255. Hence,

the keyboard hardware is controlled so as to erase the scan code trace data

remaining in the 8255. As to the method for erasing the trace data, when the hooking function calls the VKD_Filter_Keyboard_lnput of the security keyboard driver, a general

control command (enable keyboard [F4H]) of the keyboard hardware is output to the port 60h. When receiving the control command, the keyboard hardware enables the keyboard (initially enabled), erases the keyboard data stored in the

keyboard hardware, and outputs an acknowledgement (FAh) to the 8255. In

this process, the keyboard data stored in the keyboard hardware are erased,

the trace data of the port 60h are changed to another value FAh, and accordingly, the scan code trace data are erased. By using this process, keyboard data hacking using a keyboard port scan is prevented. As to the method for transmitting the keyboard data stored in the

keyboard data queue of the security keyboard driver to the security input

window 1 10 having the ActiveX format, states of the queue of the security

keyboard driver are periodically monitored in the security input window to

receive the stored keyboard data. When receiving the keyboard data, the

security input window converts the keyboard data of a scan code format into characters to store them, and displays them to a screen for the user to check

input states.

When the user inputs data in the security input window, and presses one of a transmit button and a check button to go to a next task, the web

browser 1 12 refers to data properties 1 1 1 of the security input window through

scripts to proceed to perform tasks assigned by the scripts.

FIG. 2 shows a flowchart for interface and management between a

virtual keyboard driver and a security keyboard driver. When a user presses a

keyboard button, the keyboard receives keyboard data from the 8255 to

generate a keyboard interrupt and call a virtual keyboard driver in step S201. The called virtual keyboard driver reads a value of the port 60H storing the keyboard data, stores it in a predetermined register, and calls a hooking function 210 of a next VKD_Filter_Keyboard_lnput. The hooking function 210

representing a function that the security keyboard driver has, determines

whether the security keyboard driver is activated, and the hooking function 210

is terminated when the security keyboard driver is not activated. It also erases the keyboard data traces of the keyboard port 06h using the above-noted

method and stores the keyboard data in its queue when the security keyboard driver is activated. It then assigns a carry so that the virtual keyboard driver may

not use the keyboard data, and it is terminated.

When calling the hooking function, the virtual keyboard driver checks

the carry to perform the existing virtual keyboard driver or ignores the input

keyboard data.

FIG. 3 shows a flowchart for processing keyboard data through interface between a security input window and a security keyboard driver. The

security input window uses a timer to periodically communicate (function

DeviceloControl) with the security keyboard driver in step S301 to receive

security keyboard data in step S303.

FIG. 4 shows an exemplified web browser 405 to which a security input

window 404 is applied, referring to HTML codes of FIG. 5. Referring to FIG. 4,

when a user uses a keyboard 401 to input a web address in the security input

window 404 of the browser 405, and presses a button 406, the user is linked to

the corresponding web page.

FIG. 5 shows the HTML codes of the exemplified web page including a method 501 for describing the keyboard data input to the security input window in the HTML code format, and a method 502 for processing the keyboard data input to the security input window in the HTML format.

The description of the security input window in the HTML format is

performed according to the ActiveX format, and the data reference of the security input window follows the ActiveX property format.

The security input window as shown in the subsequent example 502 is expressed as the OBJECT in the HTML codes. <OBJECT

classid="clsid:C1 BF8F0F-05BA-497C-AEDA-F377E0867B3C"

name="akl1 "

codebase="http://localhost/AKLEditXControl.cab#version=1 , 0,89,9" width=350

height=23 align=center

hspace=0

vspace=0

>

</OBJECT>

(Reference document:

http://msdn.microsoft.eom/workshop/author/dhtml/reference/objects/OBJECT.a sp)

The next exemplar 501 describes a method for referring to the

keyboard data input to the security input window in the HTML codes.

function geturl() {

var ak = http:// + akh .value; window.open(ak)

} </script>

In the above codes, akM . value is called to refer to the data of the

security input window.

1. The preferred embodiment of the present invention protects the

keyboard data input by a user on the Internet to increase reliability of Internet-

related industries and activate the industries.

Internet tasks including Internet banking, Internet games, web mail, web contents, and security document composition basically require a user to use a keyboard. Leaked keyboard data may cause great confusion and

damage to the Internet tasks of companies.

Therefore, the use of the security key input window prevents leakages

of the keyboard data to improve reliability of Internet business and to activate the Internet business, and it will reduce direct loss and damage caused by the

leakage of the keyboard data. 2. The preferred embodiment does not handle malicious programs in the like manner of vaccine programs, but it copes with hacking, and hence, the preferred embodiment protects the user's keyboard data against new programs

and undetected hacking programs. 3. Hackers may not steal the keyboard data using existing hacking tools if they have no new hacking techniques, which reduces the hackers' fields of action.

4. The preferred embodiment provides a software security system, and it recovers the security level through an immediate improvement when the security level of the system is lowered, thereby increasing the reliability of keyboard data security and obtaining Internet business related reliability.

While this invention has been described in connection with what is presently considered to be the most practical and preferred embodiment, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

Claims

WHAT IS CLAIMED IS:

1. A security keyboard driver for erasing trace data to prevent a leakage of keyboard data.

2. An ActiveX control comprising a security function operable in cooperation with the security keyboard driver of claim 1.

3. A security keyboard driver for hooking a virtual keyboard driver, and comprising an additional keyboard message processing routine instead of a normal keyboard driver processing routine (a kernel).

4. An ActiveX control comprising a security function operable in cooperation with the security keyboard driver of claim 3.