KR20040092101A - Using Virtual Keystroke Data Transmission for Keystroke Hacking Protect - Google Patents

Abstract

PURPOSE: A method for preventing keyboard hacking using virtual keyboard data transmission is provided to protect keyboard input information of a user by making a hacking program simultaneously receive keyboard data actually inputted from the user and virtual data repeatedly generated from a keyboard security system when the user uses a keyboard. CONSTITUTION: A virtual keyboard data generator generates the virtual keyboard data(202). The virtual keyboard data is stored to a virtual keyboard data buffer(203). The virtual keyboard data generator generates the keyboard data with a virtual key pushing effect(204) or the keyboard data is generated by user's key input. A keyboard driver transmits the keyboard data to a virtual keyboard data comparator. The virtual keyboard data and the actual keyboard data are separated by comparing the keyboard data received to the keyboard data comparator with a value of the virtual keyboard data buffer. In case of the virtual keyboard data, a keyboard data processor blocks the keyboard data transmission by ignoring the keyboard input. In the case of the actual keyboard data, the keyboard data is transmitted to the keyboard data processor.

Description

How to prevent keyboard hacking using virtual keyboard data transfer {Using Virtual Keystroke Data Transmission for Keystroke Hacking Protect}

Personal information by illegally stealing data, such as hacking programs, to perform important tasks such as financial transactions, securities transactions, e-commerce, e-mail transmissions, chats, and games on the Internet. And the input information is leaked and is suffering a lot of damage.

Accordingly, an object of the present invention is to protect personal information and input information by preventing keyboard input data from being leaked by a program that steals data illegally such as a hacking program when using a computer.

Prior to the present invention, there is a registration bar for "ActiveX-based keyboard hacking prevention method and apparatus" (Patent No. 0378586) as a technique for preventing leakage of keyboard input data. This patent claims that when keyboard data is generated due to keyboard press, the keyboard data is buffered and then the keyboard hardware is controlled to delete the remaining keyboard trace data at the keyboard port. A method of protecting keyboard data by passing keyboard data to an application.

However, the present invention is a method of protecting keyboard data.

The way that keyboard data is hacked is done by the system through various paths in the process of passing from keyboard to application program.

Of keyboard data in this process

An interrupt is generated by the keyboard controller after the first keyboard is pressed and released. This interrupt is sent to the CPU via PIC (Programmable Interrupt Controller), and the CPU executes the keyboard interrupt function set in the Interrupt Descriptor Table (IDT), the interrupt function drives the corresponding keyboard driver, and the keyboard driver Receives keyboard data through O port. In this case, if the hacking program intercepts or manipulates the keyboard interrupt, the keyboard data remaining in the keyboard I / O port can be hacked, and the keyboard data can be hacked by hacking the process transferred between the keyboard drivers.

second

The third window system removes the message from the system message queue and loads the message into the thread message queue. In this process, the message can be hooked and hacked.

Fourth, a hacking program can intercept keyboard messages by subclassing the application's event handling function (WndProc).

The technical challenges to protecting keyboard data against these vulnerabilities are as follows.

The first is to prevent leakage of trace data remaining in the keyboard port after keyboard data is sent to the keyboard driver.

Second is to prevent the leakage of keyboard data transmitted between keyboard drivers.

Third, the message leakage in the process of delivering keyboard message to the application in the Windows system should be prevented.

Fourth, it is necessary to prevent the leakage of keyboard events delivered to application programs.

1 illustrates the overall flow of keyboard data protection in accordance with the present invention.

2 illustrates the flow of a virtual keyboard data generator in accordance with the present invention.

3 illustrates the flow of a virtual keyboard data comparator according to the present invention.

The configuration of the present invention consists of existing keyboard processing, virtual keyboard data generator, virtual keyboard data comparator.

The basic principle of operation is when the computer is set to keyboard security mode.

The virtual keyboard data generator repeatedly generates random virtual keyboard data and transmits it to the existing keyboard processing path. In addition, the keyboard data input by the user by the existing system is also transmitted to the keyboard processing path. After that, the keyboard data delivered to the application program is separated by the virtual keyboard data comparator, the virtual keyboard data is discarded, and the keyboard data input by the user is extracted and transmitted to the keyboard processing path of the application program. Even if the keyboard data is hacked, the keyboard data mixed with the virtual keyboard data and the actual keyboard data is taken to protect the keyboard input data actually input by the user.

If you describe in detail based on the drawing,

1 illustrates the overall flow of keyboard data protection in accordance with the present invention.

The flow of existing keyboard data is transmitted to the keyboard controller 102 in the computer body in the form of scan codes when the user presses the keyboard 101. The keyboard controller generates an interrupt, and the keyboard driver 104 is driven by the interrupt. The keyboard message interpreted by the scan code is loaded into the message queue 105 and delivered to the application program to process the keyboard data. In this process, when the computer is set to the keyboard security mode, the virtual keyboard data generator 109 controls the keyboard controller 102 to create a keyboard pressing effect (keyboard data generation) regardless of the user's keyboard operation. The keyboard driver 104 processes the keyboard data and stores 110 information about the generated virtual keyboard data in the virtual keyboard data comparison buffer 111. The keyboard driver 104 then loads the virtual keyboard data into the message queue as if the actual keyboard was entered, and before the application 107 processes the keyboard data, the virtual keyboard data comparator 106 buffers the virtual keyboard data comparison buffer. Reference numeral 111 is used to separate the keyboard data from the actual keyboard data. If the keyboard data is the virtual keyboard data, the keyboard message is blocked to be transmitted to the application 107. If the keyboard data is the actual keyboard data, the keyboard data is transmitted to the application 107.

2 illustrates the flow of a keyboard data generator according to the present invention.

The randomized virtual keyboard data 202 is generated at an arbitrary time of generating virtual keyboard data 201 and the virtual keyboard data is stored 309 in the virtual keyboard data comparison buffer 111. In addition, the controller 110 controls the keyboard controller 102 to generate a virtual keyboard pressing effect so that the keyboard interrupt is called. In this case, the method of controlling the keyboard controller 102 to produce a keyboard press effect is to transmit D2h to the keyboard command port 64h in the case of the 8042 keyboard controller, and then to transmit the scan code of the virtual keyboard data to the keyboard data port 60h. The scan code of the virtual keyboard data transmitted to the keyboard data port 60h is set. The interrupt function is then triggered either through the 8042's interrupt function or a direct interrupt call.

3 illustrates the flow of a keyboard data comparator according to the present invention.

The contents of the buffer stored first in the keyboard data of the keyboard message and the virtual keyboard data comparison buffer 308 before the application 107 processes the keyboard message received from the keyboard message queue 105 due to the keyboard event. If the comparison is the same, it is determined as the virtual keyboard data (305) to remove the compared buffer value of the virtual keyboard data comparison buffer 308 (306) and cancel the keyboard input (307) so that the application 107 keyboard message If it is not the same (303), it is determined that the user inputs the keyboard data so that the keyboard message processing of the application program 107 can proceed (304).

1. It contributes to improving the reliability and activation of the Internet-related industry by protecting keyboard data entered by users.

Keyboard-based work is essential for Internet-related tasks such as internet banking, internet security, internet games, web mail, web content, and secure document creation. Because of this, leaked keyboard data can cause a lot of confusion and great damage in doing business with the Internet.

Therefore, if the keyboard hacking prevention method using the virtual keyboard data transmission is used, the leakage of keyboard data is prevented, which leads to securing the reliability of the Internet business, which will greatly affect the activation of the Internet business.

It will also reduce the direct damage caused by keyboard data leakage.

2. By taking action against hacking techniques rather than taking actions against one program like a vaccine, it is possible to protect the user's keyboard data against a new program or a hacking program not found.

3. The present invention is a software-based security system, when the security of the system is lowered, it is possible to recover the security by immediate improvement work, thereby increasing the confidence in keyboard data security, thereby securing the reliability of the Internet-related industry.

Claims (2)

In a method for preventing hacking of keyboard data input by a user of a computer system, Generating virtual keyboard data to a random value in the virtual keyboard data generator, Storing the virtual keyboard data in the virtual keyboard data comparison buffer in the virtual keyboard data generator, The virtual keyboard data generator controlling the keyboard hardware to generate keyboard data with a virtual key press effect; Or generating keyboard data by a user's key input, The steps in which the keyboard driver set in the system is called, Transferring keyboard data from the system's keyboard driver to the virtual keyboard data comparator, Separating the virtual keyboard data from the actual keyboard data by comparing the keyboard data received by the virtual keyboard data comparator with the value of the virtual keyboard data comparison buffer; Blocking keyboard input from being sent to the keyboard data handler of the system by ignoring keyboard input if separated by virtual keyboard data, Transmitting keyboard data to the keyboard data handler of the system if separated into actual keyboard data; Keyboard hack prevention method that includes In claim 1 In a method for preventing hacking of keyboard data input by a user of a computer system, Generating virtual keyboard data to a random value in the virtual keyboard data generator, Storing the virtual keyboard data in the virtual keyboard data comparison buffer in the virtual keyboard data generator, The virtual keyboard data generator controlling the keyboard hardware to generate keyboard data with a virtual key press effect; Or generating keyboard data by a user's key input, The steps in which the keyboard driver set in the system is called, Transferring keyboard data from the system's keyboard driver to the virtual keyboard data comparator, Separating the virtual keyboard data from the actual keyboard data by comparing the keyboard data received by the virtual keyboard data comparator with the value of the virtual keyboard data comparison buffer; Blocking keyboard input from being sent to the keyboard data handler of the system by ignoring keyboard input if separated by virtual keyboard data, Sending keyboard data to the system's keyboard data handler, if separated into actual keyboard data, Storage medium that can read a program that performs a process comprising a.