KR100998214B1 - Apparatus for and method of securing keyboard to evade stealth sniffing - Google Patents

Abstract

The present invention relates to a keyboard security device and method for completely preventing sniffing based on hardware, the device of the present invention is a keyboard encryption module for encrypting the scan code received from the keyboard with a secret key, and executed on a computer platform secret Generates and distributes a key, receives the secret key from a security application that decrypts the data encrypted with the secret key, passes the secret key to the keyboard encryption module, and receives the encrypted scan code from the keyboard encryption module to the security application. It consists of a keyboard controller that passes. Therefore, according to the present invention, the keyboard encryption module encrypts the input information using a secret key and transmits it to a security application, thereby completely solving the security problem caused by the structural weakness of the keyboard controller.

Hacking, Keyboard Security, Computer Security, Encryption, AES, Scancode, Keyboard Controller

Description

Keyboard security device and method for preventing sniffing {APPARATUS FOR AND METHOD OF SECURING KEYBOARD TO EVADE STEALTH SNIFFING}

TECHNICAL FIELD The present invention relates to computer security technology, and more particularly, to a keyboard security device and method for completely preventing sniffing based on hardware.

Recently, various computer security technologies have been used to reinforce the safety of electronic transactions as the e-commerce becomes more frequent, but hacking attempts are frequently made to collect user personal information, and sniffing attacks to collect user and administrator passwords are used as means for this. This is widely used. Therefore, various researches such as image-based passwords have been conducted to prevent password sniffing, and although one-time password schemes such as OTP have been introduced, they are not easy to solve due to the fundamental vulnerability of the keyboard controller.

1 is a schematic diagram illustrating a connection between a general keyboard controller and a keyboard, in which a keyboard 10 and a platform 20 of a computer are shown. The keyboard 10 includes a key matrix 12 in which switches are arranged in a matrix form, and a keyboard processor 14 which scans the key matrix 12 through an input / output port and detects a pressed switch to generate a corresponding scan code. It is composed.

The platform 20 of the computer for processing input from the keyboard 10 is connected to the keyboard processor 14 to process keyboard input with the keyboard controller 22 which delivers the scan code of the keyboard to the host processor 24. It consists of a host processor 24 for executing a program. The keyboard 10 and the computer main body 20 may be connected by a PS / 2 method or a USB method. The PS / 2 interface includes a clock clk and a data line.

In order to collect the keyboard value, that is, the scan code, in the current PC platform 20, the software must pass the keyboard controller 22 to receive the scan code from the keyboard 10 generating the scan code and transmit the scan code to the software. . The keyboard controller 22 is connected between the keyboard 10 and the host processor 24 and has a register therein for keyboard control and communication with the host processor 24.

The platform 20 of the PC not only accesses the keyboard controller registers, but also transmits control codes, control factors, command codes to the keyboard 10, and the like, control responses from the keyboard controller 22, keyboard ( In order to receive command response and scan code from 10), two ports of read and write control port and data port are prepared and assigned to "0x64" and "0x60", respectively.

In addition, the control code is transmitted and interpreted to the keyboard controller 22 to perform various functions, and in some cases, require additional arguments or provide a response. The command code is passed through the keyboard controller 22 to the keyboard 10 and may require arguments or responses. The scan code is transmitted from the keyboard 10 and passed through the keyboard controller 22 to be used to generate keyboard characters.

On the other hand, there are a variety of points that can be hijacked by the attacker in the process of passing the password input from the keyboard 10 to the application program, and by dividing the hijacking point can be divided into the operating system kernel level and the keyboard controller level.

FIG. 2 is a diagram illustrating vulnerabilities in sections in kernel mode when using a conventional keyboard, and FIG. 3 is a diagram showing vulnerabilities in sections in user mode.

Referring to FIG. 2, the keyboard input information is transmitted from the keyboard hardware 10 to the kbdclass.sys 36 via the i8042prt.sys 34 via the input / output port 22a of the keyboard controller. In kernel mode, when the input information is transmitted to the keyboard controller 22 by an electrical signal from the keyboard hardware 10, the keyboard controller 22 writes a keyboard scan code to the input / output port 22a and generates an interrupt. . Therefore, the attacker can acquire the scan code by polling the keyboard input / output port 22a as in SP1 of FIG. 2 or handle his handle via the interrupt object 33 through the address of the interrupt vector table 32 as in SP2. The scan code can be obtained by substituting for.

Referring to FIG. 3, information input to kbdclass.sys 36 in kernel mode is transmitted to the in-house process 46 through the filter driver and the system message queue 42 and the thread message queue 44. In this case, as in SP3 of FIG. 3, input information may be acquired by a filter driver for providing an environment in which additional functions may be inserted into the keyboard hardware device. As shown in SP4 and SP5 of FIG. 3, the keyboard input information may be acquired by substituting the main function of the application or the process of processing the keyboard input information in the form of a window message.

However, such sniffing attacks in each kernel mode and user mode can be solved mostly by software methods. However, sniffing by keyboard I / O port polling at the lowest level is limited to the current operating system's access authority management and the weakness of the keyboard controller. There is a problem that cannot be solved by a software method for reasons such as exposure. In other words, most of the techniques used for operating system kernel level takeover are aimed at very common preemption in the process of interrupts and exceptions, and replace the user's interrupt handler according to the selection of the takeover point. How to obtain the scan code by changing the offset of the gate descriptor in the keyboard interrupt vector in the IDT, replacing the interrupt object of the operating system, and using exception handling mechanisms such as debug traps. It can be fully solved with the security technology. However, when the current computer hardware was designed, there was not enough information security consideration, and there is no effective way to solve the weaknesses in the keyboard controller.

The present invention has been proposed to solve the above problems, and an object of the present invention is to provide a keyboard security device and method that can completely prevent sniffing using hardware.

In order to achieve the above object, the device of the present invention is a keyboard encryption module for encrypting the scan code received from the keyboard with a secret key, and executed on a computer platform to generate and distribute a secret key and decrypt the data encrypted with the secret key. It receives the secret key from the security application program and passes it to the keyboard encryption module, and receives a encrypted scan code from the keyboard encryption module and a keyboard controller for passing to the security application program for compatibility with the existing keyboard protocols While retaining, the software uses the volatile port to decrypt the secret key.

The keyboard encryption module may be implemented in a dongle form that can be attached and detached between a keyboard and a PS / 2 connection terminal, or in a conversion dongle form that interfaces between a PS / 2 method and a USB method.

In order to achieve the above object, the method of the present invention comprises the steps of: generating a secret key by a security application; Transferring the generated secret key to a keyboard encryption module through a volatile input / output port of a keyboard controller; Encrypting, by the keyboard encryption module, the predetermined size of data with the received secret key and transmitting the encrypted data to the keyboard controller; The keyboard controller passing an encrypted scan code to the secure application; And decrypting, by the security application program, the scan code encrypted using the secret key.

The keyboard security method may further include generating a disturbing code according to a command transmitted from the security application program.

Keyboard security apparatus and method for preventing sniffing according to the present invention is a keyboard encryption module implemented in hardware between the keyboard and the keyboard controller of the PC platform, and a security application including a security application running on the PC platform keyboard encryption The one-time secret key is distributed to the module, and the keyboard encryption module encrypts the input information using the secret key and transmits it to the security application, thereby completely solving the security problem caused by the structural weakness of the keyboard controller.

In particular, by using the volatile port of the keyboard controller, it is possible to conceal protocols, secure distribution of secret keys, use idle codes as command codes, maintain compatibility with existing keyboards, and generate command codes to generate disturbing codes. Security can be strengthened by passing the key, and security can be strengthened through key distribution, volatile secret keys, and information updates inside the module.

The technical problems achieved by the present invention and the practice of the present invention will be more clearly understood by the preferred embodiments of the present invention described below. The following examples are merely illustrative of the present invention and are not intended to limit the scope of the present invention.

4 is a schematic diagram illustrating a keyboard security device for preventing sniffing according to the present invention, and FIG. 5 is a flowchart illustrating the entire sequence of a keyboard security procedure for preventing sniffing according to the present invention.

As shown in FIG. 4, the keyboard security device according to the present invention includes a keyboard encryption module 130 hardware-implemented between the keyboard 110 and the keyboard controller 122 of the PC platform 120 and a PC platform. Security driver 140 to be executed, and the security application 150, the security application 150 distributes the one-time secret key to the keyboard encryption module 130, the keyboard encryption module 130 secrets the input information After encrypting using a key, it is transmitted to the security application 150, and the security application 150 decrypts the encrypted input information using the secret key.

Referring to FIG. 4, the keyboard 110 detects a pressed switch by scanning the key matrix 112b in which the switches are arranged in a matrix form, and the key matrix 112b through the input / output ports 112a and 112c. It consists of a keyboard processor 114 for generating a scan code.

The keyboard encryption module 130 may be implemented in the form of a dongle detachable between the keyboard 110 and the PS / 2 connection terminal of the computer main body 120 or in the form of a conversion dongle that interfaces between the PS / 2 method and the USB method. Between the keyboard 110 and the keyboard controller 122, ground (GND), + 5V, keyboard data (KBD Data), keyboard clock (KBD Clock), reset signal line, communication port for internal information update Connected to (IN / OUT, OUT). In particular, the communication port may be connected to the internal information updating apparatus 160 through the PS / 2 connection terminal without disassembling the module for updating the internal information of the keyboard encryption module.

The keyboard encryption module 130 encrypts the scan code with the secret key transmitted from the security application 150 and transmits the scan code to the keyboard controller 122, and the encrypted scan transmitted through the keyboard controller 122 and the security driver 140. The code is decrypted in the security application 150 and then passed to the application. Therefore, even if a scan code is attacked by sniffing at the input / output port (0x60) of the keyboard controller 122, it is encrypted and cannot be decrypted, thereby completely solving the security problem of the keyboard. In this case, the encryption algorithm of the keyboard encryption module 130 may use both a block encryption method and a stream encryption method.

Referring to FIG. 5, in the application layer L3, an application includes a case in which part or all of the application is installed and executed in a local computer where a keyboard encryption module is installed or a computer located at a remote location. It may include (S1, S2). When the security application is activated, generate a one-time or one-time secret key (S3, S4).

Subsequently, the secret key is transmitted through the kernel layer L2, and the hardware layer L1 generates a shared session key and receives a password from the user (S5 to S7). If a password is input from the user, the padding is generated in the hardware layer L1 and then encrypted (S8, S9). In this case, in order to enhance security, such as password extraction prevention, a separate secret key may be assigned and encrypted for each character constituting the password. In this case, the application layer generates a separate secret key and delivers it to the keyboard encryption module. The encryption and the result transmission are repeated until the enter key is entered.

Subsequently, the encryption information is transmitted to the application layer through the kernel layer (L2), and the application layer (L3) decodes the password information, extracts the password, and compares the passwords and transmits the comparison result to the application program (S10 to S13). ).

On the other hand, in secret key encryption, it is very important to securely distribute the secret key. The keyboard security device according to the present invention distributes the secret key safely in the following manner.

The keyboard controller 122 has an input buffer and an output buffer for sending and receiving keyboard information with the software, and the software inputs and outputs addresses of "0x60 (data port)" and "0x64 (control port)" to read and write these buffers. I use it. Therefore, in the present invention, in the process of transmitting the secret key to the keyboard encryption module 130 by the security application 150, the secret key is stored in the input buffer of the keyboard controller 122 at "0x60" address so that the secret key does not leak. To pass. The information passed to the input buffer through the "0x60" port is known only by the security application 150 and the keyboard controller 122 or the keyboard 110 itself, which is the party transferring the information, and is volatile for other software. The information becomes a value that cannot be retrieved by other software.

Therefore, the secure secret key distribution proposed in the present invention is secure The application 150 generates a secret key and securely transmits it to the keyboard encryption module 130 through the input / output port "0x60" of the keyboard controller 122. Here, the input information may be configured by adding a password input from the user and random number padding. In order to make the information more secure, the padding position to be added may be arbitrarily selected. However, in order to extract the padding during decoding, the position information of the actual padding may be transmitted in a mutually negotiated manner.

In addition, the security application 150 and the keyboard encryption module 130 is distributed to share the secret key in a mutually agreed method or by receiving and managing through a separate internal information updater 160 to a part of the distributed secret key It is possible to protect the keyboard scan code without mutually exchanging some of the distributed secret keys by sharing the generation method and encrypting and decrypting some distributed secret keys generated separately from each other.

Thus, according to the present invention, even if the same secret key and password are input using random number padding, the output cipher information is different, and it is safe even in a selected plaintext attack of an attacker who knows the input information and the cipher information.

The decryption process is performed using the shared secret key as in the encryption process, and the input information is extracted by excluding the padding from the decrypted data.

[Experimental Example]

As a result of comparing and verifying a keyboard security device manufactured according to the present invention with a widely used product, the following Table 1 is provided.

Sniffing Segment Sniffing method Existing Security Method Security keyboard Windows message hooking Sniffing with Keylogger Unable to determine actual input information due to virtual scan code Get Null Information Hooking Interrupt Vector Tables Replace interrupt vector table with your own sniffing handle Unable to determine actual input information due to virtual scan code Get Password Information simple
Port polling Acquire scan codes by simply polling the keyboard controller I / O ports Unable to determine actual input information due to virtual scan code Get Password Information Port Polling Using Hardware Vulnerabilities Acquire only scan code input from keyboard using hardware vulnerability Input exposure Get Password Information

Table 1 shows the comparison verification results. As a result of the experiment, the existing security method is protected against input information in most sniffing sections, but the input information is exposed in port polling using a hardware vulnerability of the keyboard controller. However, it has been verified that the secure keyboard protocol according to the present invention shows superior performance compared to the existing security method.

The present invention has been described above with reference to one embodiment shown in the drawings, but those skilled in the art will understand that various modifications and equivalent other embodiments are possible therefrom.

1 is a schematic diagram illustrating a connection between a general keyboard controller and a keyboard;

2 is a diagram showing the vulnerability of each section in the kernel mode when using a conventional keyboard,

3 is a diagram showing the vulnerability of each section in the user mode,

4 is a schematic diagram illustrating a keyboard security device for preventing sniffing according to the present invention;

5 is a flow chart illustrating the entire sequence of a keyboard security procedure for preventing sniffing in accordance with the present invention.

DESCRIPTION OF THE REFERENCE NUMERALS

110: keyboard 114: keyboard processor

120: PC platform 122: keyboard controller

130: keyboard encryption module 140: security driver

150: security application

Claims (7)

A keyboard encryption module for encrypting the scan code received from the keyboard with a secret key; And It is executed on a computer platform to generate and distribute a secret key and receive the secret key from a security application that decrypts the data encrypted with the secret key to the keyboard encryption module, and transmits the encrypted scan code from the keyboard encryption module. A keyboard controller that receives and delivers to the secure application, The keyboard controller And a data input / output port and a control input / output port, wherein the secret key is received from the security application through the data input / output port, which is a volatile port, to secure a secret key distribution. delete delete delete Generating a secret key by the security application; Transferring the generated secret key to a keyboard encryption module through a volatile input / output port of a keyboard controller; Encrypting, by the keyboard encryption module, the scan code with the received secret key and delivering the scan code to the keyboard controller; The keyboard controller passing an encrypted scan code to the secure application; And And decrypting, by the security application, the scan code encrypted using the secret key. The method of claim 5, wherein the keyboard security method, And generating a disturbing code according to a command transmitted from the security application program. The method of claim 5, wherein the security application and the keyboard encryption module By distributing and managing secret keys in a mutually negotiated manner, sharing the generation method for some of the distributed secret keys, and encrypting and decrypting the distributed secret keys generated separately from each other without exchanging some of the distributed secret keys, A keyboard security method for sniffing prevention, characterized in that the keyboard scan code can be protected.

Images